diff options
| author | Viacheslav Hletenko <v.gletenko@vyos.io> | 2026-03-17 17:44:18 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-03-17 17:44:18 +0200 |
| commit | d173e9772e70c1e4ed088143866bff0a346ea0bf (patch) | |
| tree | 08a8afc951730d55c98bfe7fc4ce34299b837750 /smoketest/scripts/cli | |
| parent | f40c38dbea00dd71b35aa7fbbd751f1f551cfa1f (diff) | |
| parent | 31bad6c20bf096f88b7f9a45ee56b48601e4754a (diff) | |
| download | vyos-1x-d173e9772e70c1e4ed088143866bff0a346ea0bf.tar.gz vyos-1x-d173e9772e70c1e4ed088143866bff0a346ea0bf.zip | |
Merge pull request #5054 from alexk37/fix-add-address-to-group-daddr
T8387: fix hardcoded saddr in add-address-to-group
Diffstat (limited to 'smoketest/scripts/cli')
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 24 |
1 files changed, 22 insertions, 2 deletions
diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index ca08cc389..cc9289d22 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -413,9 +413,11 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): def test_ipv4_dynamic_groups(self): group01 = 'knock01' group02 = 'allowed' + group03 = 'restricted' self.cli_set(['firewall', 'group', 'dynamic-group', 'address-group', group01]) self.cli_set(['firewall', 'group', 'dynamic-group', 'address-group', group02]) + self.cli_set(['firewall', 'group', 'dynamic-group', 'address-group', group03]) self.cli_set(['firewall', 'ipv4', 'input', 'filter', 'rule', '10', 'action', 'drop']) self.cli_set(['firewall', 'ipv4', 'input', 'filter', 'rule', '10', 'protocol', 'tcp']) @@ -435,18 +437,26 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'ipv4', 'input', 'filter', 'rule', '30', 'destination', 'port', '22']) self.cli_set(['firewall', 'ipv4', 'input', 'filter', 'rule', '30', 'source', 'group', 'dynamic-address-group', group02]) + self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '40', 'action', 'drop']) + self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '40', 'protocol', 'tcp']) + self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '40', 'destination', 'port', '6667']) + self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '40', 'add-address-to-group', 'destination-address', 'address-group', group03]) + self.cli_commit() nftables_search = [ [f'DA_{group01}'], [f'DA_{group02}'], + [f'DA_{group03}'], ['type ipv4_addr'], ['flags dynamic,timeout'], ['chain VYOS_INPUT_filter {'], ['type filter hook input priority filter', 'policy accept'], ['tcp dport 5151', f'update @DA_{group01}', '{ ip saddr timeout 30s }', 'drop'], ['tcp dport 7272', f'ip saddr @DA_{group01}', f'update @DA_{group02}', '{ ip saddr timeout 5m }', 'drop'], - ['tcp dport 22', f'ip saddr @DA_{group02}', 'accept'] + ['tcp dport 22', f'ip saddr @DA_{group02}', 'accept'], + ['chain VYOS_FORWARD_filter {'], + ['tcp dport 6667', f'update @DA_{group03}', '{ ip daddr }', 'drop'], ] self.verify_nftables(nftables_search, 'ip vyos_filter') @@ -605,9 +615,11 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): def test_ipv6_dynamic_groups(self): group01 = 'knock01' group02 = 'allowed' + group03 = 'restricted' self.cli_set(['firewall', 'group', 'dynamic-group', 'ipv6-address-group', group01]) self.cli_set(['firewall', 'group', 'dynamic-group', 'ipv6-address-group', group02]) + self.cli_set(['firewall', 'group', 'dynamic-group', 'ipv6-address-group', group03]) self.cli_set(['firewall', 'ipv6', 'input', 'filter', 'rule', '10', 'action', 'drop']) self.cli_set(['firewall', 'ipv6', 'input', 'filter', 'rule', '10', 'protocol', 'tcp']) @@ -627,18 +639,26 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'ipv6', 'input', 'filter', 'rule', '30', 'destination', 'port', '22']) self.cli_set(['firewall', 'ipv6', 'input', 'filter', 'rule', '30', 'source', 'group', 'dynamic-address-group', group02]) + self.cli_set(['firewall', 'ipv6', 'forward', 'filter', 'rule', '40', 'action', 'drop']) + self.cli_set(['firewall', 'ipv6', 'forward', 'filter', 'rule', '40', 'protocol', 'tcp']) + self.cli_set(['firewall', 'ipv6', 'forward', 'filter', 'rule', '40', 'destination', 'port', '6667']) + self.cli_set(['firewall', 'ipv6', 'forward', 'filter', 'rule', '40', 'add-address-to-group', 'destination-address', 'address-group', group03]) + self.cli_commit() nftables_search = [ [f'DA6_{group01}'], [f'DA6_{group02}'], + [f'DA6_{group03}'], ['type ipv6_addr'], ['flags dynamic,timeout'], ['chain VYOS_IPV6_INPUT_filter {'], ['type filter hook input priority filter', 'policy accept'], ['tcp dport 5151', f'update @DA6_{group01}', '{ ip6 saddr timeout 30s }', 'drop'], ['tcp dport 7272', f'ip6 saddr @DA6_{group01}', f'update @DA6_{group02}', '{ ip6 saddr timeout 5m }', 'drop'], - ['tcp dport 22', f'ip6 saddr @DA6_{group02}', 'accept'] + ['tcp dport 22', f'ip6 saddr @DA6_{group02}', 'accept'], + ['chain VYOS_IPV6_FORWARD_filter {'], + ['tcp dport 6667', f'update @DA6_{group03}', '{ ip6 daddr }', 'drop'], ] self.verify_nftables(nftables_search, 'ip6 vyos_filter') |