93 lines
3.1 KiB
Go
93 lines
3.1 KiB
Go
package nftables
|
|
|
|
import (
|
|
"os"
|
|
"os/exec"
|
|
"testing"
|
|
|
|
"github.com/google/nftables/expr"
|
|
|
|
"git.unkin.net/unkin/tomswall/internal/config"
|
|
)
|
|
|
|
func guardCfg(af config.AddressFamily) *config.Config {
|
|
return hostsCfg(func(c *config.Config) {
|
|
c.Settings.AddressFamily = af
|
|
c.Hosts[0].Addresses = append(c.Hosts[0].Addresses, "2001:db8::/64")
|
|
c.Hosts[0].Exclusions = []string{"192.0.2.9", "2001:db8::9"}
|
|
c.Interfaces[0].Options.NoSmurfs = true
|
|
c.Rules = append(c.Rules,
|
|
config.Rule{Action: config.RuleDrop, Source: "net:203.0.113.7", Dest: "lan:192.0.2.5"},
|
|
config.Rule{Action: config.RuleDrop, Source: "net:2001:db8:1::7", Dest: "lan:2001:db8::5"})
|
|
})
|
|
}
|
|
|
|
func TestCompile_FamilyGuardsDecodable(t *testing.T) {
|
|
addrLen := map[config.AddressFamily]uint32{config.FamilyIP: 4, config.FamilyIP6: 16}
|
|
for _, af := range []config.AddressFamily{config.FamilyINET, config.FamilyIP, config.FamilyIP6} {
|
|
t.Run(string(af), func(t *testing.T) {
|
|
for chain, rules := range mustCompile(t, guardCfg(af)).Rules {
|
|
for _, r := range rules {
|
|
guards, l3 := 0, false
|
|
for i, e := range r.Exprs {
|
|
if nfprotoGuard(r.Exprs, i) != 0 {
|
|
guards++
|
|
if l3 {
|
|
t.Errorf("%s %s: guard after a network payload: %s", chain, r.Tag, describeRule(r))
|
|
}
|
|
}
|
|
if p, ok := e.(*expr.Payload); ok && p.Base == expr.PayloadBaseNetworkHeader {
|
|
l3 = true
|
|
if n := addrLen[af]; n != 0 && (p.Len == 4 || p.Len == 16) && p.Len != n {
|
|
t.Errorf("%s %s: other-family address in %s table: %s", chain, r.Tag, af, describeRule(r))
|
|
}
|
|
}
|
|
}
|
|
if max := map[bool]int{true: 1, false: 0}[af == config.FamilyINET]; guards > max {
|
|
t.Errorf("%s %s: %d family guards in %s table: %s", chain, r.Tag, guards, af, describeRule(r))
|
|
}
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestNetnsNftListDecodes applies each family in a fresh user+net namespace and requires
|
|
// nft(8) to list the ruleset and a second plan to be empty. Needs unshare and nft.
|
|
func TestNetnsNftListDecodes(t *testing.T) {
|
|
if af := os.Getenv("TOMSWALL_NETNS_CHILD"); af != "" {
|
|
netnsChild(t, config.AddressFamily(af))
|
|
return
|
|
}
|
|
if os.Getenv("TOMSWALL_NETNS_TEST") == "" {
|
|
t.Skip("set TOMSWALL_NETNS_TEST=1 to run (needs unshare and nft)")
|
|
}
|
|
for _, af := range []config.AddressFamily{config.FamilyINET, config.FamilyIP, config.FamilyIP6} {
|
|
cmd := exec.Command("unshare", "-rn", os.Args[0], "-test.run=^TestNetnsNftListDecodes$", "-test.v")
|
|
cmd.Env = append(os.Environ(), "TOMSWALL_NETNS_CHILD="+string(af))
|
|
if out, err := cmd.CombinedOutput(); err != nil {
|
|
t.Errorf("%s: %v\n%s", af, err, out)
|
|
}
|
|
}
|
|
}
|
|
|
|
func netnsChild(t *testing.T, af config.AddressFamily) {
|
|
e, err := NewEngine(guardCfg(af))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
cs, err := e.Plan()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := e.Apply(cs); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if out, err := exec.Command("nft", "list", "ruleset").CombinedOutput(); err != nil {
|
|
t.Fatalf("nft list ruleset: %v\n%s", err, out)
|
|
}
|
|
if cs, err = e.Plan(); err != nil || len(cs.Add)+len(cs.Remove) != 0 {
|
|
t.Fatalf("second plan not empty: %d add, %d remove, err %v", len(cs.Add), len(cs.Remove), err)
|
|
}
|
|
}
|