diff options
| author | Simon <965089+sarthurdev@users.noreply.github.com> | 2025-11-24 20:48:07 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-11-24 20:48:07 +0100 |
| commit | fdda826b48688e253c30d3578ca5edd45b034ab0 (patch) | |
| tree | e23d2dce4f302de5157604501188894a2abd31c5 /smoketest/scripts/cli | |
| parent | 1aec97d70ceaba9f89db8c592478e10ed1c0aefc (diff) | |
| parent | cc5895fe61f938189e229dffb7746fc93aac0f3b (diff) | |
| download | vyos-1x-fdda826b48688e253c30d3578ca5edd45b034ab0.tar.gz vyos-1x-fdda826b48688e253c30d3578ca5edd45b034ab0.zip | |
Merge pull request #4672 from apschultz/zone_default_firewall_ruleset
firewall: T7739: Default ruleset for firewall zones
Diffstat (limited to 'smoketest/scripts/cli')
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index c29471b63..ca08cc389 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -994,6 +994,50 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') self.verify_nftables(nftables_search_v6, 'ip6 vyos_filter') + def test_zone_with_default_firewall(self): + self.cli_set(['firewall', 'ipv4', 'name', 'smoketest', 'default-action', 'drop']) + self.cli_set(['firewall', 'ipv4', 'name', 'smoketest-default', 'default-action', 'drop']) + self.cli_set(['firewall', 'zone', 'smoketest-eth0', 'member', 'interface', 'eth0']) + self.cli_set(['firewall', 'zone', 'smoketest-eth0', 'from', 'smoketest-eth1', 'firewall', 'name', 'smoketest']) + self.cli_set(['firewall', 'zone', 'smoketest-eth0', 'from', 'smoketest-local', 'firewall', 'name', 'smoketest']) + self.cli_set(['firewall', 'zone', 'smoketest-eth0', 'default-firewall', 'name', 'smoketest-default']) + self.cli_set(['firewall', 'zone', 'smoketest-eth1', 'member', 'interface', 'eth1']) + self.cli_set(['firewall', 'zone', 'smoketest-eth1', 'default-firewall', 'name', 'smoketest-default']) + self.cli_set(['firewall', 'zone', 'smoketest-eth2', 'member', 'interface', 'eth2']) + self.cli_set(['firewall', 'zone', 'smoketest-local', 'local-zone']) + self.cli_set(['firewall', 'zone', 'smoketest-local', 'from', 'smoketest-eth0', 'firewall', 'name', 'smoketest']) + self.cli_set(['firewall', 'zone', 'smoketest-local', 'default-firewall', 'name', 'smoketest-default']) + self.cli_commit() + + smoketest_eth0_search = [ + ['iifname "eth1"', 'jump NAME_smoketest'], + ['jump NAME_smoketest-default'] + ] + self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-eth0') + self.verify_nftables_chain(smoketest_eth0_search, 'ip vyos_filter', 'VZONE_smoketest-eth0') + + smoketest_eth1_search = [ + ['jump NAME_smoketest-default'] + ] + self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-eth1') + self.verify_nftables_chain(smoketest_eth1_search, 'ip vyos_filter', 'VZONE_smoketest-eth1') + + self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-eth2') + + smoketest_local_in_search = [ + ['iifname "eth0"', 'jump NAME_smoketest'], + ['jump NAME_smoketest-default'], + ] + self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-local_IN') + self.verify_nftables_chain(smoketest_local_in_search, 'ip vyos_filter', 'VZONE_smoketest-local_IN') + + smoketest_local_out_search = [ + ['oifname "eth0"', 'jump NAME_smoketest'], + ['oifname "eth1"', 'jump NAME_smoketest-default'] + ] + self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-local_OUT') + self.verify_nftables_chain(smoketest_local_out_search, 'ip vyos_filter', 'VZONE_smoketest-local_OUT') + def test_zone_with_vrf(self): self.cli_set(['firewall', 'ipv4', 'name', 'ZONE1-to-LOCAL', 'default-action', 'accept']) self.cli_set(['firewall', 'ipv4', 'name', 'ZONE2_to_ZONE1', 'default-action', 'continue']) |