From 6b5d3568b88fad9cda694c0cd8b82c1f16773b15 Mon Sep 17 00:00:00 2001 From: sarthurdev <965089+sarthurdev@users.noreply.github.com> Date: Sat, 26 Aug 2023 23:02:10 +0200 Subject: firewall: T5080: Disable conntrack unless required by rules --- smoketest/scripts/cli/test_firewall.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'smoketest/scripts') diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index c6514210b..ee6ccb710 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -78,6 +78,17 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): break self.assertTrue(not matched if inverse else matched, msg=search) + def verify_nftables_chain(self, nftables_search, table, chain, inverse=False, args=''): + nftables_output = cmd(f'sudo nft {args} list chain {table} {chain}') + + for search in nftables_search: + matched = False + for line in nftables_output.split("\n"): + if all(item in line for item in search): + matched = True + break + self.assertTrue(not matched if inverse else matched, msg=search) + def wait_for_domain_resolver(self, table, set_name, element, max_wait=10): # Resolver no longer blocks commit, need to wait for daemon to populate set count = 0 @@ -511,6 +522,10 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') + # Check conntrack + self.verify_nftables_chain([['accept']], 'raw', 'FW_CONNTRACK') + self.verify_nftables_chain([['return']], 'ip6 raw', 'FW_CONNTRACK') + def test_source_validation(self): # Strict self.cli_set(['firewall', 'global-options', 'source-validation', 'strict']) -- cgit v1.2.3