diff options
| -rwxr-xr-x | python/vyos/firewall.py | 2 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 24 |
2 files changed, 23 insertions, 3 deletions
diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index 0025ed98a..04e59eb25 100755 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -555,7 +555,7 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name): timeout_value = side_conf['timeout'] output.append(f'set update ip{def_suffix} {prefix}addr timeout {timeout_value} @DA{def_suffix}_{dyn_group}') else: - output.append(f'set update ip{def_suffix} saddr @DA{def_suffix}_{dyn_group}') + output.append(f'set update ip{def_suffix} {prefix}addr @DA{def_suffix}_{dyn_group}') set_table = False if 'set' in rule_conf: diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index ca08cc389..cc9289d22 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -413,9 +413,11 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): def test_ipv4_dynamic_groups(self): group01 = 'knock01' group02 = 'allowed' + group03 = 'restricted' self.cli_set(['firewall', 'group', 'dynamic-group', 'address-group', group01]) self.cli_set(['firewall', 'group', 'dynamic-group', 'address-group', group02]) + self.cli_set(['firewall', 'group', 'dynamic-group', 'address-group', group03]) self.cli_set(['firewall', 'ipv4', 'input', 'filter', 'rule', '10', 'action', 'drop']) self.cli_set(['firewall', 'ipv4', 'input', 'filter', 'rule', '10', 'protocol', 'tcp']) @@ -435,18 +437,26 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'ipv4', 'input', 'filter', 'rule', '30', 'destination', 'port', '22']) self.cli_set(['firewall', 'ipv4', 'input', 'filter', 'rule', '30', 'source', 'group', 'dynamic-address-group', group02]) + self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '40', 'action', 'drop']) + self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '40', 'protocol', 'tcp']) + self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '40', 'destination', 'port', '6667']) + self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '40', 'add-address-to-group', 'destination-address', 'address-group', group03]) + self.cli_commit() nftables_search = [ [f'DA_{group01}'], [f'DA_{group02}'], + [f'DA_{group03}'], ['type ipv4_addr'], ['flags dynamic,timeout'], ['chain VYOS_INPUT_filter {'], ['type filter hook input priority filter', 'policy accept'], ['tcp dport 5151', f'update @DA_{group01}', '{ ip saddr timeout 30s }', 'drop'], ['tcp dport 7272', f'ip saddr @DA_{group01}', f'update @DA_{group02}', '{ ip saddr timeout 5m }', 'drop'], - ['tcp dport 22', f'ip saddr @DA_{group02}', 'accept'] + ['tcp dport 22', f'ip saddr @DA_{group02}', 'accept'], + ['chain VYOS_FORWARD_filter {'], + ['tcp dport 6667', f'update @DA_{group03}', '{ ip daddr }', 'drop'], ] self.verify_nftables(nftables_search, 'ip vyos_filter') @@ -605,9 +615,11 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): def test_ipv6_dynamic_groups(self): group01 = 'knock01' group02 = 'allowed' + group03 = 'restricted' self.cli_set(['firewall', 'group', 'dynamic-group', 'ipv6-address-group', group01]) self.cli_set(['firewall', 'group', 'dynamic-group', 'ipv6-address-group', group02]) + self.cli_set(['firewall', 'group', 'dynamic-group', 'ipv6-address-group', group03]) self.cli_set(['firewall', 'ipv6', 'input', 'filter', 'rule', '10', 'action', 'drop']) self.cli_set(['firewall', 'ipv6', 'input', 'filter', 'rule', '10', 'protocol', 'tcp']) @@ -627,18 +639,26 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'ipv6', 'input', 'filter', 'rule', '30', 'destination', 'port', '22']) self.cli_set(['firewall', 'ipv6', 'input', 'filter', 'rule', '30', 'source', 'group', 'dynamic-address-group', group02]) + self.cli_set(['firewall', 'ipv6', 'forward', 'filter', 'rule', '40', 'action', 'drop']) + self.cli_set(['firewall', 'ipv6', 'forward', 'filter', 'rule', '40', 'protocol', 'tcp']) + self.cli_set(['firewall', 'ipv6', 'forward', 'filter', 'rule', '40', 'destination', 'port', '6667']) + self.cli_set(['firewall', 'ipv6', 'forward', 'filter', 'rule', '40', 'add-address-to-group', 'destination-address', 'address-group', group03]) + self.cli_commit() nftables_search = [ [f'DA6_{group01}'], [f'DA6_{group02}'], + [f'DA6_{group03}'], ['type ipv6_addr'], ['flags dynamic,timeout'], ['chain VYOS_IPV6_INPUT_filter {'], ['type filter hook input priority filter', 'policy accept'], ['tcp dport 5151', f'update @DA6_{group01}', '{ ip6 saddr timeout 30s }', 'drop'], ['tcp dport 7272', f'ip6 saddr @DA6_{group01}', f'update @DA6_{group02}', '{ ip6 saddr timeout 5m }', 'drop'], - ['tcp dport 22', f'ip6 saddr @DA6_{group02}', 'accept'] + ['tcp dport 22', f'ip6 saddr @DA6_{group02}', 'accept'], + ['chain VYOS_IPV6_FORWARD_filter {'], + ['tcp dport 6667', f'update @DA6_{group03}', '{ ip6 daddr }', 'drop'], ] self.verify_nftables(nftables_search, 'ip6 vyos_filter') |