Merge pull request #1130 from sarthurdev/firewall

firewall: T4130: Fix firewall state-policy errors

1 files changed, 17 insertions, 0 deletions

diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py
index 1520020fd..5f728f0cd 100755
--- a/smoketest/scripts/cli/test_firewall.py
+++ b/smoketest/scripts/cli/test_firewall.py
@@ -134,6 +134,23 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
                     break
             self.assertTrue(matched)
 
+    def test_state_policy(self):
+        self.cli_set(['firewall', 'state-policy', 'established', 'action', 'accept'])
+        self.cli_set(['firewall', 'state-policy', 'related', 'action', 'accept'])
+        self.cli_set(['firewall', 'state-policy', 'invalid', 'action', 'drop'])
+
+        self.cli_commit()
+
+        chains = {
+            'ip filter': ['VYOS_FW_IN', 'VYOS_FW_OUTPUT', 'VYOS_FW_LOCAL'],
+            'ip6 filter': ['VYOS_FW6_IN', 'VYOS_FW6_OUTPUT', 'VYOS_FW6_LOCAL']
+        }
+
+        for table in ['ip filter', 'ip6 filter']:
+            for chain in chains[table]:
+                nftables_output = cmd(f'sudo nft list chain {table} {chain}')
+                self.assertTrue('jump VYOS_STATE_POLICY' in nftables_output)
+
     def test_sysfs(self):
         for name, conf in sysfs_config.items():
             paths = glob(conf['sysfs'])