132 lines
4.0 KiB
Go
132 lines
4.0 KiB
Go
package nftables
|
|
|
|
import (
|
|
"encoding/json"
|
|
"reflect"
|
|
"testing"
|
|
|
|
"github.com/google/nftables"
|
|
"github.com/google/nftables/expr"
|
|
"github.com/mdlayher/netlink"
|
|
"golang.org/x/sys/unix"
|
|
|
|
"git.unkin.net/unkin/tomswall/internal/config"
|
|
)
|
|
|
|
func TestSnapshotRulesRoundTrip(t *testing.T) {
|
|
exprs := []expr.Any{
|
|
&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
|
|
&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{unix.IPPROTO_TCP}},
|
|
&expr.Payload{DestRegister: 1, Base: expr.PayloadBaseTransportHeader, Offset: 2, Len: 2},
|
|
&expr.Cmp{Op: expr.CmpOpEq, Register: 1, Data: []byte{0, 22}},
|
|
&expr.Ct{Register: 1, Key: expr.CtKeySTATE},
|
|
&expr.Notrack{},
|
|
&expr.Verdict{Kind: expr.VerdictAccept},
|
|
}
|
|
state := &FirewallState{Rules: map[string][]ManagedRule{
|
|
"input": {{Chain: "input", Tag: "ssh", Exprs: exprs}, {Chain: "input", Tag: "drop", Exprs: []expr.Any{&expr.Verdict{Kind: expr.VerdictDrop}}}},
|
|
}}
|
|
|
|
rules, err := encodeState(state)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
b, err := json.Marshal(&Snapshot{Table: "tomswall", Present: true, Rules: rules,
|
|
Policies: map[string]nftables.ChainPolicy{"input": nftables.ChainPolicyAccept}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var snap Snapshot
|
|
if err := json.Unmarshal(b, &snap); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if snap.Policies["input"] != nftables.ChainPolicyAccept {
|
|
t.Errorf("policy lost: %v", snap.Policies)
|
|
}
|
|
got, err := decodeState(snap.Rules)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
in := got.Rules["input"]
|
|
if len(in) != 2 || in[0].Tag != "ssh" || in[1].Tag != "drop" {
|
|
t.Fatalf("rules/order lost: %+v", in)
|
|
}
|
|
if !reflect.DeepEqual(in[0].Exprs, exprs) {
|
|
t.Errorf("exprs changed:\n got %#v\nwant %#v", in[0].Exprs, exprs)
|
|
}
|
|
if _, ok := in[1].Exprs[0].(*expr.Verdict); !ok {
|
|
t.Errorf("verdict decoded as %T", in[1].Exprs[0])
|
|
}
|
|
}
|
|
|
|
func TestEnsureChainsPolicyOverride(t *testing.T) {
|
|
e := testEngine(t, nil)
|
|
chains := e.ensureChains(e.ensureTable(), map[string]nftables.ChainPolicy{"input": nftables.ChainPolicyAccept})
|
|
if *chains["input"].Policy != nftables.ChainPolicyAccept {
|
|
t.Error("input policy not overridden")
|
|
}
|
|
if *chains["forward"].Policy != nftables.ChainPolicyDrop {
|
|
t.Error("forward policy should keep its default")
|
|
}
|
|
}
|
|
|
|
func TestSnapshotAndRestoreAbsentTable(t *testing.T) {
|
|
tablePresent := false
|
|
var sent []netlink.HeaderType
|
|
e := testEngine(t, func(req []netlink.Message) ([]netlink.Message, error) {
|
|
for _, m := range req {
|
|
sent = append(sent, m.Header.Type)
|
|
if m.Header.Type == nftType(unix.NFT_MSG_GETTABLE) && tablePresent {
|
|
data := []byte{inet, 0, 0, 0}
|
|
attrs, _ := netlink.MarshalAttributes([]netlink.Attribute{{Type: unix.NFTA_TABLE_NAME, Data: []byte("tomswall\x00")}})
|
|
return []netlink.Message{{Header: netlink.Header{Type: nftType(unix.NFT_MSG_NEWTABLE), Sequence: m.Header.Sequence}, Data: append(data, attrs...)}}, nil
|
|
}
|
|
}
|
|
return nil, nil
|
|
})
|
|
|
|
snap, err := e.Snapshot()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if snap.Present || snap.Table != "tomswall" {
|
|
t.Fatalf("want absent tomswall snapshot, got %+v", snap)
|
|
}
|
|
|
|
// The try created the table; restoring the absent snapshot deletes it.
|
|
tablePresent = true
|
|
sent = nil
|
|
if err := e.Restore(snap); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
deleted := false
|
|
for _, ht := range sent {
|
|
deleted = deleted || ht == nftType(unix.NFT_MSG_DELTABLE)
|
|
}
|
|
if !deleted {
|
|
t.Errorf("table not deleted; sent %v", sent)
|
|
}
|
|
}
|
|
|
|
func TestRestoreRejectsOtherTable(t *testing.T) {
|
|
e := testEngine(t, nil)
|
|
if err := e.Restore(&Snapshot{Table: "other"}); err == nil {
|
|
t.Error("expected table mismatch error")
|
|
}
|
|
}
|
|
|
|
func nftType(msg int) netlink.HeaderType {
|
|
return netlink.HeaderType(unix.NFNL_SUBSYS_NFTABLES<<8 | msg)
|
|
}
|
|
|
|
func testEngine(t *testing.T, dial func([]netlink.Message) ([]netlink.Message, error)) *Engine {
|
|
if dial == nil {
|
|
dial = func([]netlink.Message) ([]netlink.Message, error) { return nil, nil }
|
|
}
|
|
conn, err := nftables.New(nftables.WithTestDial(dial))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return &Engine{cfg: &config.Config{Settings: config.Settings{TableName: "tomswall"}}, conn: conn}
|
|
}
|