mirror of
https://github.com/webmin/webmin.git
synced 2026-05-06 15:20:29 +01:00
255 lines
9.2 KiB
Perl
Executable File
255 lines
9.2 KiB
Perl
Executable File
#!/usr/bin/perl
|
|
use strict;
|
|
use warnings;
|
|
use Test::More;
|
|
use Cwd qw(abs_path);
|
|
use File::Temp qw(tempdir);
|
|
|
|
sub script_dir
|
|
{
|
|
my $path = $0;
|
|
if ($path =~ m{^/}) {
|
|
$path =~ s{/[^/]+$}{};
|
|
return $path;
|
|
}
|
|
my $cwd = `pwd`;
|
|
chomp($cwd);
|
|
if ($path =~ m{/}) {
|
|
$path =~ s{/[^/]+$}{};
|
|
return $cwd.'/'.$path;
|
|
}
|
|
return $cwd;
|
|
}
|
|
|
|
my $bindir = script_dir();
|
|
my $rootdir = abs_path("$bindir/../..") or die "rootdir: $!";
|
|
|
|
my $confdir = tempdir(CLEANUP => 1);
|
|
my $vardir = tempdir(CLEANUP => 1);
|
|
open(my $cfh, ">", "$confdir/config") or die "config: $!";
|
|
print $cfh "os_type=linux\nos_version=0\n";
|
|
close($cfh);
|
|
open(my $vfh, ">", "$confdir/var-path") or die "var-path: $!";
|
|
print $vfh "$vardir\n";
|
|
close($vfh);
|
|
$ENV{'WEBMIN_CONFIG'} = $confdir;
|
|
$ENV{'WEBMIN_VAR'} = $vardir;
|
|
$ENV{'FOREIGN_MODULE_NAME'} = 'nftables';
|
|
$ENV{'FOREIGN_ROOT_DIRECTORY'} = $rootdir;
|
|
|
|
chdir("$bindir/..") or die "chdir: $!";
|
|
|
|
require "$bindir/../nftables-lib.pl";
|
|
|
|
sub check_fields
|
|
{
|
|
my ($name, $got, $expect) = @_;
|
|
foreach my $k (sort keys %$expect) {
|
|
is($got->{$k}, $expect->{$k}, "$name $k");
|
|
}
|
|
}
|
|
|
|
my @cases = (
|
|
{
|
|
name => 'tcp dport accept',
|
|
line => 'tcp dport 22 accept',
|
|
expect => { proto => 'tcp', dport => '22', action => 'accept' },
|
|
},
|
|
{
|
|
name => 'iif oif drop',
|
|
line => 'iif "eth0" oif "eth1" drop',
|
|
expect => { iif => 'eth0', oif => 'eth1', action => 'drop' },
|
|
},
|
|
{
|
|
name => 'comment with quotes',
|
|
line => 'tcp dport 80 accept comment "a \\"quote\\""',
|
|
expect => { proto => 'tcp', dport => '80', action => 'accept', comment => 'a "quote"' },
|
|
},
|
|
{
|
|
name => 'ct state',
|
|
line => 'ct state established,related accept',
|
|
expect => { ct_state => 'established,related', action => 'accept' },
|
|
},
|
|
{
|
|
name => 'icmp type',
|
|
line => 'icmp type echo-request accept',
|
|
expect => { icmp_type => 'echo-request', action => 'accept' },
|
|
},
|
|
{
|
|
name => 'limit log counter',
|
|
line => 'tcp dport 22 limit rate 10/second burst 20 packets log prefix "ssh" level info counter accept',
|
|
expect => {
|
|
proto => 'tcp',
|
|
dport => '22',
|
|
limit_rate => '10/second',
|
|
limit_burst => '20',
|
|
log_prefix => 'ssh',
|
|
log_level => 'info',
|
|
counter => 1,
|
|
action => 'accept',
|
|
},
|
|
},
|
|
{
|
|
name => 'unknown tokens preserved',
|
|
line => 'tcp dport 22 meta skgid 1000 accept',
|
|
expect => { proto => 'tcp', dport => '22', action => 'accept' },
|
|
preserve => 'meta skgid 1000',
|
|
},
|
|
);
|
|
|
|
foreach my $c (@cases) {
|
|
my $r = parse_rule_text($c->{line});
|
|
ok($r && ref($r) eq 'HASH', "$c->{name} parse hash");
|
|
check_fields($c->{name}, $r, $c->{expect});
|
|
|
|
my $out = format_rule_text($r);
|
|
ok($out =~ /\S/, "$c->{name} formatted non-empty");
|
|
if ($c->{preserve}) {
|
|
like($out, qr/\Q$c->{preserve}\E/, "$c->{name} preserves unknowns");
|
|
}
|
|
|
|
my $r2 = parse_rule_text($out);
|
|
check_fields($c->{name}.' roundtrip', $r2, $c->{expect});
|
|
}
|
|
|
|
my $ruleset = "$bindir/rulesets/basic.nft";
|
|
my @tables = get_nftables_save($ruleset);
|
|
ok(@tables == 1, 'ruleset table count');
|
|
my $t = $tables[0];
|
|
is($t->{family}, 'inet', 'ruleset family');
|
|
is($t->{name}, 'filter', 'ruleset name');
|
|
my $chain = $t->{chains}->{input};
|
|
ok($chain, 'input chain present');
|
|
is($chain->{type}, 'filter', 'chain type');
|
|
is($chain->{hook}, 'input', 'chain hook');
|
|
is($chain->{priority}, '0', 'chain priority');
|
|
is($chain->{policy}, 'drop', 'chain policy');
|
|
|
|
my $ruleset_prio = "$bindir/rulesets/firewalld-priority.nft";
|
|
my @tables_prio = get_nftables_save($ruleset_prio);
|
|
ok(@tables_prio == 1, 'firewalld priority table count');
|
|
is($tables_prio[0]->{flags}, 'owner,persist', 'firewalld table flags');
|
|
ok(table_is_externally_managed($tables_prio[0]), 'firewalld table is externally managed');
|
|
is(active_table_status($tables_prio[0], []), 'external',
|
|
'external active table status');
|
|
is(active_table_status({ family => 'inet', name => 'filter' }, [ $t ]), 'webmin',
|
|
'saved active table status');
|
|
is(active_table_status({ family => 'inet', name => 'loose' }, []), 'unclaimed',
|
|
'unclaimed active table status');
|
|
my $fw_chain = $tables_prio[0]->{chains}->{filter_INPUT};
|
|
ok($fw_chain, 'firewalld priority chain present');
|
|
is($fw_chain->{type}, 'filter', 'firewalld priority chain type');
|
|
is($fw_chain->{hook}, 'input', 'firewalld priority chain hook');
|
|
is($fw_chain->{priority}, 'filter + 10', 'firewalld priority chain priority');
|
|
is($fw_chain->{policy}, 'accept', 'firewalld priority chain policy');
|
|
is(scalar @{$tables_prio[0]->{rules}}, 1,
|
|
'firewalld priority chain definition is not parsed as a rule');
|
|
|
|
my @rules = @{$t->{rules}};
|
|
check_fields('ruleset r1', $rules[0], { iif => 'lo', action => 'accept' });
|
|
check_fields('ruleset r2', $rules[1], { saddr => '192.168.1.0/24', proto => 'tcp', dport => '22', action => 'accept', comment => 'ssh' });
|
|
check_fields('ruleset r3', $rules[2], { ct_state => 'established,related', action => 'accept' });
|
|
|
|
my $ruleset_sets = "$bindir/rulesets/sets.nft";
|
|
my @tables_sets = get_nftables_save($ruleset_sets);
|
|
ok(@tables_sets == 1, 'sets ruleset table count');
|
|
my $ts = $tables_sets[0];
|
|
ok($ts->{sets} && $ts->{sets}->{trusted_v4}, 'trusted_v4 set present');
|
|
is($ts->{sets}->{trusted_v4}->{type}, 'ipv4_addr', 'trusted_v4 type');
|
|
is($ts->{sets}->{trusted_v4}->{flags}, 'interval', 'trusted_v4 flags');
|
|
is_deeply($ts->{sets}->{trusted_v4}->{elements},
|
|
[ '192.168.1.0/24', '10.0.0.1' ],
|
|
'trusted_v4 elements');
|
|
ok($ts->{sets}->{web_ports}, 'web_ports set present');
|
|
is($ts->{sets}->{web_ports}->{type}, 'inet_service', 'web_ports type');
|
|
is_deeply($ts->{sets}->{web_ports}->{elements},
|
|
[ '80', '443' ],
|
|
'web_ports elements');
|
|
|
|
my $rset = $ts->{rules}->[0];
|
|
check_fields('set rule', $rset,
|
|
{ saddr => '@trusted_v4', proto => 'tcp', dport => '@web_ports', action => 'accept' });
|
|
my $rset_out = format_rule_text($rset);
|
|
like($rset_out, qr/\@trusted_v4/, 'set rule format preserves address set');
|
|
like($rset_out, qr/\@web_ports/, 'set rule format preserves port set');
|
|
|
|
ok(validate_chain_base('filter', 'input', '0', 'accept'),
|
|
'chain base allows zero priority');
|
|
ok(!validate_chain_base('filter', 'input', undef, 'accept'),
|
|
'chain base missing priority invalid');
|
|
ok(validate_chain_base(undef, undef, undef, undef),
|
|
'chain base none set valid');
|
|
|
|
my $table_move = {
|
|
rules => [
|
|
{ chain => 'input', index => 0, text => 'r0' },
|
|
{ chain => 'input', index => 1, text => 'r1' },
|
|
{ chain => 'forward', index => 2, text => 'r2' },
|
|
{ chain => 'input', index => 3, text => 'r3' },
|
|
],
|
|
};
|
|
ok(move_rule_in_chain($table_move, 'input', 1, 'down'),
|
|
'move rule down returns true');
|
|
is($table_move->{rules}->[1]->{text}, 'r3', 'rule moved down in array');
|
|
is($table_move->{rules}->[3]->{text}, 'r1', 'rule swapped down in array');
|
|
is($table_move->{rules}->[1]->{index}, 1, 'moved rule index updated');
|
|
is($table_move->{rules}->[3]->{index}, 3, 'swapped rule index updated');
|
|
|
|
my $table_move2 = {
|
|
rules => [
|
|
{ chain => 'input', index => 0, text => 'r0' },
|
|
{ chain => 'input', index => 1, text => 'r1' },
|
|
],
|
|
};
|
|
is(move_rule_in_chain($table_move2, 'input', 0, 'up'), 0,
|
|
'top rule cannot move up');
|
|
|
|
my $quick_table = {
|
|
family => 'inet',
|
|
name => 'quick',
|
|
chains => {
|
|
input => { hook => 'input' },
|
|
},
|
|
rules => [
|
|
{ chain => 'input', index => 0, text => 'ct state established,related accept' },
|
|
],
|
|
};
|
|
is(add_quick_ip_rule($quick_table, '192.0.2.1', 'block'), undef,
|
|
'quick block rule added');
|
|
is($quick_table->{rules}->[0]->{text},
|
|
'ip saddr 192.0.2.1 drop comment "Webmin quick block"',
|
|
'quick block inserted before normal input rules');
|
|
is(add_quick_ip_rule($quick_table, '192.0.2.1', 'allow'), undef,
|
|
'quick allow rule added');
|
|
is($quick_table->{rules}->[0]->{text},
|
|
'ip saddr 192.0.2.1 accept comment "Webmin quick allow"',
|
|
'quick allow inserted before quick block rules');
|
|
like(add_quick_ip_rule($quick_table, '192.0.2.1', 'allow'), qr/exists/,
|
|
'duplicate quick rule rejected');
|
|
my $quick_ip_table = {
|
|
family => 'ip',
|
|
name => 'quick',
|
|
chains => { input => { hook => 'input' } },
|
|
rules => [ ],
|
|
};
|
|
like(add_quick_ip_rule($quick_ip_table, '2001:db8::1/64', 'allow'),
|
|
qr/cannot contain/, 'wrong address family rejected');
|
|
|
|
my $profile_table = create_profile_ruleset('profile_virtualmin', 'virtualmin', '*');
|
|
is($profile_table->{family}, 'inet', 'profile helper family');
|
|
is($profile_table->{name}, 'profile_virtualmin', 'profile helper table name');
|
|
ok($profile_table->{sets}->{profile_hosting_tcp_ports},
|
|
'profile helper tcp port set');
|
|
is($profile_table->{sets}->{profile_hosting_tcp_ports}->{flags}, 'interval',
|
|
'profile helper tcp port set interval flag');
|
|
is_deeply($profile_table->{sets}->{profile_hosting_udp_ports}->{elements},
|
|
[ '53' ], 'profile helper udp port set elements');
|
|
ok(scalar(grep { $_->{text} eq 'tcp dport @profile_hosting_tcp_ports accept' }
|
|
@{$profile_table->{rules}}),
|
|
'profile helper tcp set rule');
|
|
ok(scalar(grep { $_->{text} eq 'ip6 daddr fe80::/64 udp dport 546 accept' }
|
|
@{$profile_table->{rules}}),
|
|
'profile helper special dhcpv6 rule');
|
|
|
|
done_testing();
|