diff options
| author | Christian Breunig <christian@breunig.cc> | 2025-02-22 14:15:26 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-02-22 14:15:26 +0100 |
| commit | 5d9d232fd93ad5bf89ba44a2d0ec3b196599fa74 (patch) | |
| tree | ca9a86e3aca88f990f3c139ee355d216b2925990 /smoketest/scripts/cli | |
| parent | b7ce1c1448f0f52976468fd579104f1e805fa8d8 (diff) | |
| parent | ac890f5e3ff7d0bb4853199204e4db7c4f1dcc3e (diff) | |
| download | vyos-1x-5d9d232fd93ad5bf89ba44a2d0ec3b196599fa74.tar.gz vyos-1x-5d9d232fd93ad5bf89ba44a2d0ec3b196599fa74.zip | |
Merge pull request #4357 from sarthurdev/T7148
firewall: T7148: Bridge state-policy uses drop in place of reject
Diffstat (limited to 'smoketest/scripts/cli')
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 93d41a7f7..33144c7fa 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -658,6 +658,13 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') + # T7148 - Ensure bridge rule reject -> drop + self.cli_set(['firewall', 'global-options', 'state-policy', 'invalid', 'action', 'reject']) + self.cli_commit() + + self.verify_nftables([['ct state invalid', 'reject']], 'ip vyos_filter') + self.verify_nftables([['ct state invalid', 'drop']], 'bridge vyos_filter') + # Check conntrack is enabled from state-policy self.verify_nftables_chain([['accept']], 'ip vyos_conntrack', 'FW_CONNTRACK') self.verify_nftables_chain([['accept']], 'ip6 vyos_conntrack', 'FW_CONNTRACK') |