From 37cfa8cdb1c6a1d395109aabd3ee29e83db151da Mon Sep 17 00:00:00 2001 From: Nicolas Fort Date: Sat, 27 Aug 2022 15:35:52 +0000 Subject: Firewall: T4651: Add options to match packet size on firewall rules. --- smoketest/scripts/cli/test_firewall.py | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) (limited to 'smoketest/scripts/cli') diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 684a07681..5ca00eafa 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -209,6 +209,13 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'name', 'smoketest', 'rule', '5', 'tcp', 'flags', 'syn']) self.cli_set(['firewall', 'name', 'smoketest', 'rule', '5', 'tcp', 'mss', mss_range]) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '6', 'action', 'accept']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '6', 'ip-length', '64,512,1024']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '7', 'action', 'accept']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '7', 'ip-length', '0-30000']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '8', 'action', 'accept']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '8', 'ip-length', '!60000-65535']) + self.cli_set(['interfaces', 'ethernet', 'eth0', 'firewall', 'in', 'name', 'smoketest']) self.cli_commit() @@ -220,7 +227,10 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['tcp dport { 22 }', 'limit rate 5/minute', 'return'], ['log prefix "[smoketest-default-D]"','smoketest default-action', 'drop'], ['tcp dport { 22 }', 'add @RECENT_smoketest_4 { ip saddr limit rate over 10/minute burst 10 packets }', 'drop'], - [f'tcp flags & syn == syn tcp option maxseg size {mss_range}'] + [f'tcp flags & syn == syn tcp option maxseg size {mss_range}'], + ['ip length { 64, 512, 1024 }', 'return'], + ['ip length { 0-30000 }', 'return'], + ['ip length != { 60000-65535 }', 'return'] ] self.verify_nftables(nftables_search, 'ip filter') @@ -239,6 +249,13 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '2', 'protocol', 'tcp_udp']) self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '2', 'destination', 'port', '8888']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '3', 'action', 'accept']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '3', 'ip-length', '64,512,1024']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '4', 'action', 'accept']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '4', 'ip-length', '0-30000']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '5', 'action', 'accept']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '5', 'ip-length', '!60000-65535']) + self.cli_set(['interfaces', 'ethernet', 'eth0', 'firewall', 'in', 'ipv6-name', 'v6-smoketest']) self.cli_commit() @@ -247,6 +264,9 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['iifname "eth0"', 'jump NAME6_v6-smoketest'], ['saddr 2002::1', 'daddr 2002::1:1', 'log prefix "[v6-smoketest-1-A]" level crit', 'return'], ['meta l4proto { tcp, udp }', 'th dport { 8888 }', 'reject'], + ['ip6 length { 64, 512, 1024 }', 'return'], + ['ip6 length { 0-30000 }', 'return'], + ['ip6 length != { 60000-65535 }', 'return'], ['smoketest default-action', 'log prefix "[v6-smoketest-default-D]"', 'drop'] ] -- cgit v1.2.3 From 312ee15058fbb26feb6a93520417f0d5343ad15b Mon Sep 17 00:00:00 2001 From: Nicolas Fort Date: Thu, 1 Sep 2022 19:08:37 +0000 Subject: Firewall: T4651: Change proposed cli from ip-length to packet-length --- interface-definitions/firewall.xml.in | 42 ++-------------------- .../include/firewall/packet-length.xml.i | 18 ++++++++++ python/vyos/firewall.py | 7 ++-- smoketest/scripts/cli/test_firewall.py | 12 +++---- src/validators/ip-length | 29 --------------- src/validators/packet-length | 29 +++++++++++++++ 6 files changed, 57 insertions(+), 80 deletions(-) create mode 100644 interface-definitions/include/firewall/packet-length.xml.i delete mode 100755 src/validators/ip-length create mode 100755 src/validators/packet-length (limited to 'smoketest/scripts/cli') diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in index f838f1b88..ed84acbb7 100644 --- a/interface-definitions/firewall.xml.in +++ b/interface-definitions/firewall.xml.in @@ -383,26 +383,7 @@ #include - - - Payload size in bytes, including any extension header - - u32:1-65535 - Numbered packet length - - - <start-end> - Packet length range (e.g. 1001-1005) - - - - \n\n Multiple values can be specified as a comma-separated list.\n For example: '64, 512,1001-1005' - - - - - - + #include Hop Limit @@ -591,26 +572,7 @@ #include - - - Packet size in bytes, including header and data - - u32:1-65535 - Numbered packet length - - - <start-end> - Packet length range (e.g. 1001-1005) - - - - \n\n Multiple values can be specified as a comma-separated list.\n For example: '64, 512,1001-1005' - - - - - - + #include ICMP type and code information diff --git a/interface-definitions/include/firewall/packet-length.xml.i b/interface-definitions/include/firewall/packet-length.xml.i new file mode 100644 index 000000000..866a76bbb --- /dev/null +++ b/interface-definitions/include/firewall/packet-length.xml.i @@ -0,0 +1,18 @@ + + + + Payload size in bytes, including header and data + + u32:1-65535 + Packet length value. Multiple values can be specified as a comma-separated list. Inverted match is also supported + + + <start-end> + Packet length range. Inverted match is also supported (e.g. 1001-1005 or !1001-1005) + + + + + + + diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index a4fd64830..ea28aa91d 100644 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -266,9 +266,9 @@ def parse_rule(rule_conf, fw_name, rule_id, ip_name): output.append(icmp + ' type ' + rule_conf[icmp]['type']) - if 'ip_length' in rule_conf: + if 'packet_length' in rule_conf: #proto = rule_conf['protocol'] - length = rule_conf['ip_length'].split(',') + length = rule_conf['packet_length'].split(',') lengths = [] negated_lengths = [] @@ -279,9 +279,6 @@ def parse_rule(rule_conf, fw_name, rule_id, ip_name): else: lengths.append(p) - #if proto == 'tcp_udp': - # proto = 'th' - if lengths: lengths_str = ','.join(lengths) output.append(f'ip{def_suffix} length {{{lengths_str}}}') diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 5ca00eafa..8b6c221e3 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -210,11 +210,11 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'name', 'smoketest', 'rule', '5', 'tcp', 'mss', mss_range]) self.cli_set(['firewall', 'name', 'smoketest', 'rule', '6', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '6', 'ip-length', '64,512,1024']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '6', 'packet-length', '64,512,1024']) self.cli_set(['firewall', 'name', 'smoketest', 'rule', '7', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '7', 'ip-length', '0-30000']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '7', 'packet-length', '0-30000']) self.cli_set(['firewall', 'name', 'smoketest', 'rule', '8', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '8', 'ip-length', '!60000-65535']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '8', 'packet-length', '!60000-65535']) self.cli_set(['interfaces', 'ethernet', 'eth0', 'firewall', 'in', 'name', 'smoketest']) @@ -250,11 +250,11 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '2', 'destination', 'port', '8888']) self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '3', 'action', 'accept']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '3', 'ip-length', '64,512,1024']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '3', 'packet-length', '64,512,1024']) self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '4', 'action', 'accept']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '4', 'ip-length', '0-30000']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '4', 'packet-length', '0-30000']) self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '5', 'action', 'accept']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '5', 'ip-length', '!60000-65535']) + self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '5', 'packet-length', '!60000-65535']) self.cli_set(['interfaces', 'ethernet', 'eth0', 'firewall', 'in', 'ipv6-name', 'v6-smoketest']) diff --git a/src/validators/ip-length b/src/validators/ip-length deleted file mode 100755 index d96093849..000000000 --- a/src/validators/ip-length +++ /dev/null @@ -1,29 +0,0 @@ -#!/usr/bin/python3 - -from sys import argv -from sys import exit -import re - -if __name__ == '__main__': - if len(argv)>1: - lengths = argv[1].split(",") - - for length in lengths: - if length and length[0] == '!': - length = length[1:] - if re.match('^[0-9]{1,5}-[0-9]{1,5}$', length): - length_1, length_2 = length.split('-') - if int(length_1) not in range(0, 65536) or int(length_2) not in range(0, 65536): - print(f'Error: {length} is not a valid length range') - exit(1) - if int(length_1) > int(length_2): - print(f'Error: {length} is not a valid length range') - exit(1) - elif length.isnumeric(): - if int(length) not in range(0, 65536): - print(f'Error: {length} is not a valid length value') - exit(1) - else: - exit(2) - - exit(0) \ No newline at end of file diff --git a/src/validators/packet-length b/src/validators/packet-length new file mode 100755 index 000000000..d96093849 --- /dev/null +++ b/src/validators/packet-length @@ -0,0 +1,29 @@ +#!/usr/bin/python3 + +from sys import argv +from sys import exit +import re + +if __name__ == '__main__': + if len(argv)>1: + lengths = argv[1].split(",") + + for length in lengths: + if length and length[0] == '!': + length = length[1:] + if re.match('^[0-9]{1,5}-[0-9]{1,5}$', length): + length_1, length_2 = length.split('-') + if int(length_1) not in range(0, 65536) or int(length_2) not in range(0, 65536): + print(f'Error: {length} is not a valid length range') + exit(1) + if int(length_1) > int(length_2): + print(f'Error: {length} is not a valid length range') + exit(1) + elif length.isnumeric(): + if int(length) not in range(0, 65536): + print(f'Error: {length} is not a valid length value') + exit(1) + else: + exit(2) + + exit(0) \ No newline at end of file -- cgit v1.2.3 From e09ea64a636e40f30cca72bce5d92f42ee837d3c Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 3 Sep 2022 20:16:41 +0200 Subject: smoketest: firewall: add re-usable variables when running testcases --- smoketest/scripts/cli/test_firewall.py | 164 ++++++++++++++++----------------- 1 file changed, 79 insertions(+), 85 deletions(-) (limited to 'smoketest/scripts/cli') diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index 8b6c221e3..c5756a027 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -36,6 +36,8 @@ sysfs_config = { 'twa_hazards_protection': {'sysfs': '/proc/sys/net/ipv4/tcp_rfc1337', 'default': '0', 'test_value': 'enable'} } +eth0_addr = '172.16.10.1/24' + class TestFirewall(VyOSUnitTestSHIM.TestCase): @classmethod def setUpClass(cls): @@ -45,11 +47,12 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): # out the current configuration :) cls.cli_delete(cls, ['firewall']) - cls.cli_set(cls, ['interfaces', 'ethernet', 'eth0', 'address', '172.16.10.1/24']) + cls.cli_set(cls, ['interfaces', 'ethernet', 'eth0', 'address', eth0_addr]) + cls.debug=True @classmethod def tearDownClass(cls): - cls.cli_delete(cls, ['interfaces', 'ethernet', 'eth0', 'address', '172.16.10.1/24']) + cls.cli_delete(cls, ['interfaces', 'ethernet', 'eth0', 'address', eth0_addr]) super(TestFirewall, cls).tearDownClass() def tearDown(self): @@ -95,6 +98,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): ['ip saddr @GEOIP_CC_smoketest_1', 'drop'], ['ip saddr != @GEOIP_CC_smoketest_2', 'return'] ] + # -t prevents 1000+ GeoIP elements being returned self.verify_nftables(nftables_search, 'ip filter', args='-t') @@ -114,6 +118,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.cli_set(['firewall', 'group', 'port-group', 'smoketest_port', 'port', '123']) self.cli_set(['firewall', 'group', 'domain-group', 'smoketest_domain', 'address', 'example.com']) self.cli_set(['firewall', 'group', 'domain-group', 'smoketest_domain', 'address', 'example.org']) + self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'action', 'accept']) self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'source', 'group', 'network-group', 'smoketest_network']) self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'destination', 'address', '172.16.10.10']) @@ -176,98 +181,84 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip filter') - def test_basic_rules(self): + def test_ipv4_basic_rules(self): + name = 'smoketest' + interface = 'eth0' mss_range = '501-1460' - self.cli_set(['firewall', 'name', 'smoketest', 'default-action', 'drop']) - self.cli_set(['firewall', 'name', 'smoketest', 'enable-default-log']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'source', 'address', '172.16.20.10']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'destination', 'address', '172.16.10.10']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'log', 'enable']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'log-level', 'debug']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'ttl', 'eq', '15']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'action', 'reject']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'protocol', 'tcp']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'destination', 'port', '8888']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'log', 'enable']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'log-level', 'err']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'tcp', 'flags', 'syn']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'tcp', 'flags', 'not', 'ack']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'ttl', 'gt', '102']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '3', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '3', 'protocol', 'tcp']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '3', 'destination', 'port', '22']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '3', 'limit', 'rate', '5/minute']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '3', 'log', 'disable']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'action', 'drop']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'protocol', 'tcp']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'destination', 'port', '22']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'recent', 'count', '10']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'recent', 'time', 'minute']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '5', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '5', 'protocol', 'tcp']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '5', 'tcp', 'flags', 'syn']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '5', 'tcp', 'mss', mss_range]) - - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '6', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '6', 'packet-length', '64,512,1024']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '7', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '7', 'packet-length', '0-30000']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '8', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '8', 'packet-length', '!60000-65535']) - self.cli_set(['interfaces', 'ethernet', 'eth0', 'firewall', 'in', 'name', 'smoketest']) + self.cli_set(['firewall', 'name', name, 'default-action', 'drop']) + self.cli_set(['firewall', 'name', name, 'enable-default-log']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'action', 'accept']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'source', 'address', '172.16.20.10']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'destination', 'address', '172.16.10.10']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'log', 'enable']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'log-level', 'debug']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'ttl', 'eq', '15']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'action', 'reject']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'protocol', 'tcp']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'destination', 'port', '8888']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'log', 'enable']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'log-level', 'err']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'tcp', 'flags', 'syn']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'tcp', 'flags', 'not', 'ack']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'ttl', 'gt', '102']) + self.cli_set(['firewall', 'name', name, 'rule', '3', 'action', 'accept']) + self.cli_set(['firewall', 'name', name, 'rule', '3', 'protocol', 'tcp']) + self.cli_set(['firewall', 'name', name, 'rule', '3', 'destination', 'port', '22']) + self.cli_set(['firewall', 'name', name, 'rule', '3', 'limit', 'rate', '5/minute']) + self.cli_set(['firewall', 'name', name, 'rule', '3', 'log', 'disable']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'action', 'drop']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'protocol', 'tcp']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'destination', 'port', '22']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'recent', 'count', '10']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'recent', 'time', 'minute']) + self.cli_set(['firewall', 'name', name, 'rule', '5', 'action', 'accept']) + self.cli_set(['firewall', 'name', name, 'rule', '5', 'protocol', 'tcp']) + self.cli_set(['firewall', 'name', name, 'rule', '5', 'tcp', 'flags', 'syn']) + self.cli_set(['firewall', 'name', name, 'rule', '5', 'tcp', 'mss', mss_range]) + + self.cli_set(['interfaces', 'ethernet', interface, 'firewall', 'in', 'name', name]) self.cli_commit() nftables_search = [ - ['iifname "eth0"', 'jump NAME_smoketest'], + [f'iifname "{interface}"', f'jump NAME_{name}'], ['saddr 172.16.20.10', 'daddr 172.16.10.10', 'log prefix "[smoketest-1-A]" level debug', 'ip ttl 15','return'], ['tcp flags & (syn | ack) == syn', 'tcp dport { 8888 }', 'log prefix "[smoketest-2-R]" level err', 'ip ttl > 102', 'reject'], ['tcp dport { 22 }', 'limit rate 5/minute', 'return'], ['log prefix "[smoketest-default-D]"','smoketest default-action', 'drop'], ['tcp dport { 22 }', 'add @RECENT_smoketest_4 { ip saddr limit rate over 10/minute burst 10 packets }', 'drop'], [f'tcp flags & syn == syn tcp option maxseg size {mss_range}'], - ['ip length { 64, 512, 1024 }', 'return'], - ['ip length { 0-30000 }', 'return'], - ['ip length != { 60000-65535 }', 'return'] ] self.verify_nftables(nftables_search, 'ip filter') - def test_basic_rules_ipv6(self): - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'default-action', 'drop']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'enable-default-log']) + def test_ipv6_basic_rules(self): + name = 'v6-smoketest' + interface = 'eth0' - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '1', 'action', 'accept']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '1', 'source', 'address', '2002::1']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '1', 'destination', 'address', '2002::1:1']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '1', 'log', 'enable']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '1', 'log-level', 'crit']) + self.cli_set(['firewall', 'ipv6-name', name, 'default-action', 'drop']) + self.cli_set(['firewall', 'ipv6-name', name, 'enable-default-log']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '2', 'action', 'reject']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '2', 'protocol', 'tcp_udp']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '2', 'destination', 'port', '8888']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '1', 'action', 'accept']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '1', 'source', 'address', '2002::1']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '1', 'destination', 'address', '2002::1:1']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '1', 'log', 'enable']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '1', 'log-level', 'crit']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '3', 'action', 'accept']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '3', 'packet-length', '64,512,1024']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '4', 'action', 'accept']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '4', 'packet-length', '0-30000']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '5', 'action', 'accept']) - self.cli_set(['firewall', 'ipv6-name', 'v6-smoketest', 'rule', '5', 'packet-length', '!60000-65535']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '2', 'action', 'reject']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '2', 'protocol', 'tcp_udp']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '2', 'destination', 'port', '8888']) - self.cli_set(['interfaces', 'ethernet', 'eth0', 'firewall', 'in', 'ipv6-name', 'v6-smoketest']) + self.cli_set(['interfaces', 'ethernet', 'eth0', 'firewall', 'in', 'ipv6-name', name]) self.cli_commit() nftables_search = [ - ['iifname "eth0"', 'jump NAME6_v6-smoketest'], + [f'iifname "{interface}"', f'jump NAME6_{name}'], ['saddr 2002::1', 'daddr 2002::1:1', 'log prefix "[v6-smoketest-1-A]" level crit', 'return'], ['meta l4proto { tcp, udp }', 'th dport { 8888 }', 'reject'], - ['ip6 length { 64, 512, 1024 }', 'return'], - ['ip6 length { 0-30000 }', 'return'], - ['ip6 length != { 60000-65535 }', 'return'], - ['smoketest default-action', 'log prefix "[v6-smoketest-default-D]"', 'drop'] + ['smoketest default-action', f'log prefix "[{name}-default-D]"', 'drop'] ] self.verify_nftables(nftables_search, 'ip6 filter') @@ -289,33 +280,36 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): nftables_output = cmd(f'sudo nft list chain {table} {chain}') self.assertTrue('jump VYOS_STATE_POLICY' in nftables_output) - def test_state_and_status_rules(self): - self.cli_set(['firewall', 'name', 'smoketest', 'default-action', 'drop']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'state', 'established', 'enable']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '1', 'state', 'related', 'enable']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'action', 'reject']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '2', 'state', 'invalid', 'enable']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '3', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '3', 'state', 'new', 'enable']) + def test_ipv4_state_and_status_rules(self): + name = 'smoketest-state' + interface = 'eth0' - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '3', 'connection-status', 'nat', 'destination']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'action', 'accept']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'state', 'new', 'enable']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'state', 'established', 'enable']) - self.cli_set(['firewall', 'name', 'smoketest', 'rule', '4', 'connection-status', 'nat', 'source']) + self.cli_set(['firewall', 'name', name, 'default-action', 'drop']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'action', 'accept']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'state', 'established', 'enable']) + self.cli_set(['firewall', 'name', name, 'rule', '1', 'state', 'related', 'enable']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'action', 'reject']) + self.cli_set(['firewall', 'name', name, 'rule', '2', 'state', 'invalid', 'enable']) + self.cli_set(['firewall', 'name', name, 'rule', '3', 'action', 'accept']) + self.cli_set(['firewall', 'name', name, 'rule', '3', 'state', 'new', 'enable']) - self.cli_set(['interfaces', 'ethernet', 'eth0', 'firewall', 'in', 'name', 'smoketest']) + self.cli_set(['firewall', 'name', name, 'rule', '3', 'connection-status', 'nat', 'destination']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'action', 'accept']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'state', 'new', 'enable']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'state', 'established', 'enable']) + self.cli_set(['firewall', 'name', name, 'rule', '4', 'connection-status', 'nat', 'source']) + + self.cli_set(['interfaces', 'ethernet', interface, 'firewall', 'in', 'name', name]) self.cli_commit() nftables_search = [ - ['iifname "eth0"', 'jump NAME_smoketest'], + [f'iifname "{interface}"', f'jump NAME_{name}'], ['ct state { established, related }', 'return'], ['ct state { invalid }', 'reject'], ['ct state { new }', 'ct status { dnat }', 'return'], ['ct state { established, new }', 'ct status { snat }', 'return'], - ['smoketest default-action', 'drop'] + ['drop', f'comment "{name} default-action drop"'] ] self.verify_nftables(nftables_search, 'ip filter') -- cgit v1.2.3 From d9eb48a0ced1eb60bd00fe2f18559b3c780ee98a Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 3 Sep 2022 20:37:10 +0200 Subject: firewall: T4651: re-implement packet-length CLI option to use --- .../include/firewall/packet-length.xml.i | 28 ++++++++-- python/vyos/firewall.py | 25 +++------ smoketest/scripts/cli/test_firewall.py | 59 +++++++++++++++++++++- src/validators/packet-length | 29 ----------- 4 files changed, 88 insertions(+), 53 deletions(-) delete mode 100755 src/validators/packet-length (limited to 'smoketest/scripts/cli') diff --git a/interface-definitions/include/firewall/packet-length.xml.i b/interface-definitions/include/firewall/packet-length.xml.i index 866a76bbb..043f56d16 100644 --- a/interface-definitions/include/firewall/packet-length.xml.i +++ b/interface-definitions/include/firewall/packet-length.xml.i @@ -1,18 +1,38 @@ - Payload size in bytes, including header and data + Payload size in bytes, including header and data to match u32:1-65535 - Packet length value. Multiple values can be specified as a comma-separated list. Inverted match is also supported + Packet length to match <start-end> - Packet length range. Inverted match is also supported (e.g. 1001-1005 or !1001-1005) + Packet length range to match - + + + + + + + + Payload size in bytes, including header and data not to match + + u32:1-65535 + Packet length not to match + + + <start-end> + Packet length range not to match + + + + + + diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index ea28aa91d..0bc5378db 100644 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -150,7 +150,7 @@ def parse_rule(rule_conf, fw_name, rule_id, ip_name): if suffix[0] == '!': suffix = f'!= {suffix[1:]}' output.append(f'{ip_name} {prefix}addr {suffix}') - + if dict_search_args(side_conf, 'geoip', 'country_code'): operator = '' if dict_search_args(side_conf, 'geoip', 'inverse_match') != None: @@ -267,25 +267,12 @@ def parse_rule(rule_conf, fw_name, rule_id, ip_name): if 'packet_length' in rule_conf: - #proto = rule_conf['protocol'] - length = rule_conf['packet_length'].split(',') - - lengths = [] - negated_lengths = [] - - for p in length: - if p[0] == '!': - negated_lengths.append(p[1:]) - else: - lengths.append(p) - - if lengths: - lengths_str = ','.join(lengths) - output.append(f'ip{def_suffix} length {{{lengths_str}}}') + lengths_str = ','.join(rule_conf['packet_length']) + output.append(f'ip{def_suffix} length {{{lengths_str}}}') - if negated_lengths: - negated_lengths_str = ','.join(negated_lengths) - output.append(f'ip{def_suffix} length != {{{negated_lengths_str}}}') + if 'packet_length_exclude' in rule_conf: + negated_lengths_str = ','.join(rule_conf['packet_length_exclude']) + output.append(f'ip{def_suffix} length != {{{negated_lengths_str}}}') if 'ipsec' in rule_conf: diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index c5756a027..1517180de 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -48,7 +48,6 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): cls.cli_delete(cls, ['firewall']) cls.cli_set(cls, ['interfaces', 'ethernet', 'eth0', 'address', eth0_addr]) - cls.debug=True @classmethod def tearDownClass(cls): @@ -233,6 +232,35 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip filter') + def test_ipv4_packet_length(self): + name = 'smoketest-plen' + interface = 'eth0' + + self.cli_set(['firewall', 'name', name, 'default-action', 'drop']) + self.cli_set(['firewall', 'name', name, 'enable-default-log']) + + self.cli_set(['firewall', 'name', name, 'rule', '6', 'action', 'accept']) + self.cli_set(['firewall', 'name', name, 'rule', '6', 'packet-length', '64']) + self.cli_set(['firewall', 'name', name, 'rule', '6', 'packet-length', '512']) + self.cli_set(['firewall', 'name', name, 'rule', '6', 'packet-length', '1024']) + + self.cli_set(['firewall', 'name', name, 'rule', '7', 'action', 'accept']) + self.cli_set(['firewall', 'name', name, 'rule', '7', 'packet-length', '1-30000']) + self.cli_set(['firewall', 'name', name, 'rule', '7', 'packet-length-exclude', '60000-65535']) + + self.cli_set(['interfaces', 'ethernet', interface, 'firewall', 'in', 'name', name]) + + self.cli_commit() + + nftables_search = [ + [f'iifname "{interface}"', f'jump NAME_{name}'], + ['ip length { 64, 512, 1024 }', 'return'], + ['ip length { 1-30000 }', 'ip length != { 60000-65535 }', 'return'], + [f'log prefix "[{name}-default-D]" drop'] + ] + + self.verify_nftables(nftables_search, 'ip filter') + def test_ipv6_basic_rules(self): name = 'v6-smoketest' interface = 'eth0' @@ -263,6 +291,35 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip6 filter') + def test_ipv6_packet_length(self): + name = 'v6-smoketest-plen' + interface = 'eth0' + + self.cli_set(['firewall', 'ipv6-name', name, 'default-action', 'drop']) + self.cli_set(['firewall', 'ipv6-name', name, 'enable-default-log']) + + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '3', 'action', 'accept']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '3', 'packet-length', '65']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '3', 'packet-length', '513']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '3', 'packet-length', '1025']) + + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '4', 'action', 'accept']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '4', 'packet-length', '1-1999']) + self.cli_set(['firewall', 'ipv6-name', name, 'rule', '4', 'packet-length-exclude', '60000-65535']) + + self.cli_set(['interfaces', 'ethernet', interface, 'firewall', 'in', 'ipv6-name', name]) + + self.cli_commit() + + nftables_search = [ + [f'iifname "{interface}"', f'jump NAME6_{name}'], + ['ip6 length { 65, 513, 1025 }', 'return'], + ['ip6 length { 1-1999 }', 'ip6 length != { 60000-65535 }', 'return'], + [f'log prefix "[{name}-default-D]"', 'drop'] + ] + + self.verify_nftables(nftables_search, 'ip6 filter') + def test_state_policy(self): self.cli_set(['firewall', 'state-policy', 'established', 'action', 'accept']) self.cli_set(['firewall', 'state-policy', 'related', 'action', 'accept']) diff --git a/src/validators/packet-length b/src/validators/packet-length deleted file mode 100755 index d96093849..000000000 --- a/src/validators/packet-length +++ /dev/null @@ -1,29 +0,0 @@ -#!/usr/bin/python3 - -from sys import argv -from sys import exit -import re - -if __name__ == '__main__': - if len(argv)>1: - lengths = argv[1].split(",") - - for length in lengths: - if length and length[0] == '!': - length = length[1:] - if re.match('^[0-9]{1,5}-[0-9]{1,5}$', length): - length_1, length_2 = length.split('-') - if int(length_1) not in range(0, 65536) or int(length_2) not in range(0, 65536): - print(f'Error: {length} is not a valid length range') - exit(1) - if int(length_1) > int(length_2): - print(f'Error: {length} is not a valid length range') - exit(1) - elif length.isnumeric(): - if int(length) not in range(0, 65536): - print(f'Error: {length} is not a valid length value') - exit(1) - else: - exit(2) - - exit(0) \ No newline at end of file -- cgit v1.2.3