Merge pull request #5372 from ruben-herold/T9157-fib-type-match

firewall: T9157: add fib-type match for destination/source

1 files changed, 428 insertions, 4 deletions

diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py
index 44afeb33e..aee8d26cd 100755
--- a/smoketest/scripts/cli/test_firewall.py
+++ b/smoketest/scripts/cli/test_firewall.py
@@ -111,6 +111,434 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
         # -t prevents 1000+ GeoIP elements being returned
         self.verify_nftables(nftables_search, 'ip vyos_filter', args='-t')
 
+    def test_fib_type(self):
+        self.cli_set(
+            ['firewall', 'ipv4', 'name', 'smoketest', 'rule', '1', 'action', 'accept']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'lookup',
+                'destination-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'match',
+                'route-type',
+                'local',
+            ]
+        )
+        self.cli_set(
+            ['firewall', 'ipv4', 'name', 'smoketest', 'rule', '2', 'action', 'drop']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '2',
+                'fib',
+                'lookup',
+                'source-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '2',
+                'fib',
+                'match',
+                'route-type',
+                '!local',
+            ]
+        )
+
+        self.cli_set(
+            ['firewall', 'ipv6', 'name', 'smoketest', 'rule', '1', 'action', 'accept']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'lookup',
+                'destination-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'match',
+                'route-type',
+                'local',
+            ]
+        )
+        self.cli_set(
+            ['firewall', 'ipv6', 'name', 'smoketest', 'rule', '2', 'action', 'drop']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'name',
+                'smoketest',
+                'rule',
+                '2',
+                'fib',
+                'lookup',
+                'source-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'name',
+                'smoketest',
+                'rule',
+                '2',
+                'fib',
+                'match',
+                'route-type',
+                '!local',
+            ]
+        )
+        self.cli_set(
+            ['firewall', 'ipv6', 'name', 'smoketest', 'rule', '3', 'action', 'drop']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'name',
+                'smoketest',
+                'rule',
+                '3',
+                'fib',
+                'lookup',
+                'destination-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'name',
+                'smoketest',
+                'rule',
+                '3',
+                'fib',
+                'match',
+                'route-type',
+                'prohibit',
+            ]
+        )
+
+        # prerouting raw runs before the kernel's FIB lookup decides
+        # local-delivery vs. forward, which is the main use case fib
+        # lookup/match was added for - cover it explicitly rather than
+        # only the named filter rules above
+        self.cli_set(
+            ['firewall', 'ipv4', 'prerouting', 'raw', 'rule', '1', 'action', 'notrack']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'prerouting',
+                'raw',
+                'rule',
+                '1',
+                'fib',
+                'lookup',
+                'destination-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'prerouting',
+                'raw',
+                'rule',
+                '1',
+                'fib',
+                'match',
+                'route-type',
+                'local',
+            ]
+        )
+        self.cli_set(
+            ['firewall', 'ipv4', 'prerouting', 'raw', 'rule', '2', 'action', 'drop']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'prerouting',
+                'raw',
+                'rule',
+                '2',
+                'fib',
+                'lookup',
+                'source-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'prerouting',
+                'raw',
+                'rule',
+                '2',
+                'fib',
+                'match',
+                'route-type',
+                '!local',
+            ]
+        )
+
+        self.cli_set(
+            ['firewall', 'ipv6', 'prerouting', 'raw', 'rule', '1', 'action', 'notrack']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'prerouting',
+                'raw',
+                'rule',
+                '1',
+                'fib',
+                'lookup',
+                'destination-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'prerouting',
+                'raw',
+                'rule',
+                '1',
+                'fib',
+                'match',
+                'route-type',
+                'local',
+            ]
+        )
+        self.cli_set(
+            ['firewall', 'ipv6', 'prerouting', 'raw', 'rule', '2', 'action', 'drop']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'prerouting',
+                'raw',
+                'rule',
+                '2',
+                'fib',
+                'lookup',
+                'source-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv6',
+                'prerouting',
+                'raw',
+                'rule',
+                '2',
+                'fib',
+                'match',
+                'route-type',
+                '!local',
+            ]
+        )
+
+        self.cli_commit()
+
+        nftables_search_v4 = [
+            ['fib daddr type local', 'accept'],
+            ['fib saddr type != local', 'drop'],
+        ]
+        nftables_search_v6 = [
+            ['fib daddr type local', 'accept'],
+            ['fib saddr type != local', 'drop'],
+            ['fib daddr type prohibit', 'drop'],
+        ]
+
+        self.verify_nftables_chain(
+            nftables_search_v4, 'ip vyos_filter', 'NAME_smoketest'
+        )
+        self.verify_nftables_chain(
+            nftables_search_v6, 'ip6 vyos_filter', 'NAME6_smoketest'
+        )
+
+        nftables_search_v4_raw = [
+            ['fib daddr type local', 'notrack'],
+            ['fib saddr type != local', 'drop'],
+        ]
+        nftables_search_v6_raw = [
+            ['fib daddr type local', 'notrack'],
+            ['fib saddr type != local', 'drop'],
+        ]
+
+        self.verify_nftables_chain(
+            nftables_search_v4_raw, 'ip vyos_filter', 'VYOS_PREROUTING_raw'
+        )
+        self.verify_nftables_chain(
+            nftables_search_v6_raw, 'ip6 vyos_filter', 'VYOS_IPV6_PREROUTING_raw'
+        )
+
+    def test_fib_type_incomplete(self):
+        self.cli_set(
+            ['firewall', 'ipv4', 'name', 'smoketest', 'rule', '1', 'action', 'accept']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'lookup',
+                'destination-address',
+            ]
+        )
+
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+        self.cli_delete(
+            ['firewall', 'ipv4', 'name', 'smoketest', 'rule', '1', 'fib', 'lookup']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'match',
+                'route-type',
+                'local',
+            ]
+        )
+
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+        # "fib match" set as a bare node with nothing underneath it: 'match' is
+        # present as a key, so it isn't caught by the simple presence check in
+        # verify_rule(), only by is_node_empty()
+        self.cli_delete(['firewall', 'ipv4', 'name', 'smoketest', 'rule', '1', 'fib'])
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'lookup',
+                'destination-address',
+            ]
+        )
+        self.cli_set(
+            ['firewall', 'ipv4', 'name', 'smoketest', 'rule', '1', 'fib', 'match']
+        )
+
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+    def test_fib_lookup_conflict(self):
+        self.cli_set(
+            ['firewall', 'ipv4', 'name', 'smoketest', 'rule', '1', 'action', 'accept']
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'lookup',
+                'source-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'lookup',
+                'destination-address',
+            ]
+        )
+        self.cli_set(
+            [
+                'firewall',
+                'ipv4',
+                'name',
+                'smoketest',
+                'rule',
+                '1',
+                'fib',
+                'match',
+                'route-type',
+                'local',
+            ]
+        )
+
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
     def test_groups(self):
         hostmap_path = ['system', 'static-host-mapping', 'host-name']
         example_org = ['192.0.2.8', '192.0.2.10', '192.0.2.11']
@@ -328,8 +756,6 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
 
     def test_ipv4_advanced(self):
         name = 'smoketest-adv'
-        name2 = 'smoketest-adv2'
-        interface = 'eth0'
 
         self.cli_set(['firewall', 'ipv4', 'name', name, 'default-action', 'drop'])
         self.cli_set(['firewall', 'ipv4', 'name', name, 'default-log'])
@@ -415,7 +841,6 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
 
     def test_ipv4_mask(self):
         name = 'smoketest-mask'
-        interface = 'eth0'
 
         self.cli_set(['firewall', 'group', 'address-group', 'mask_group', 'address', '1.1.1.1'])
 
@@ -675,7 +1100,6 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
 
     def test_ipv6_mask(self):
         name = 'v6-smoketest-mask'
-        interface = 'eth0'
 
         self.cli_set(['firewall', 'group', 'ipv6-address-group', 'mask_group', 'address', '::beef'])