iptables_lib.sh 9.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381
  1. #!/bin/sh
  2. # SPDX-License-Identifier: GPL-2.0-or-later
  3. # Copyright (c) 2018-2019 Oracle and/or its affiliates. All Rights Reserved.
  4. # Copyright (c) International Business Machines Corp., 2001
  5. #
  6. # Author: Jan 20 2004 Hubert Lin <linux02NOSPAAAM@tw.ibm.com>
  7. # <hubertNOSPAAAM@symbio.com.tw>
  8. TST_CNT=6
  9. TST_TESTFUNC="test"
  10. TST_NEEDS_TMPDIR=1
  11. TST_NEEDS_ROOT=1
  12. TST_SETUP="${TST_SETUP:-init}"
  13. TST_CLEANUP="${TST_CLEANUP:-cleanup}"
  14. TST_NEEDS_CMDS="grep telnet"
  15. . tst_net.sh
  16. NFRUN()
  17. {
  18. local rule
  19. if [ "$use_iptables" = 1 ]; then
  20. ip${TST_IPV6}tables $@
  21. else
  22. $(ip${TST_IPV6}tables-translate $@ | sed 's,\\,,g')
  23. fi
  24. }
  25. NFRUN_REMOVE()
  26. {
  27. if [ "$use_iptables" = 1 ]; then
  28. ROD ip${TST_IPV6}tables -D INPUT 1
  29. else
  30. ROD nft flush chain ip${TST_IPV6} filter INPUT
  31. fi
  32. }
  33. init()
  34. {
  35. if [ "$use_iptables" = 1 ]; then
  36. toolname=ip${TST_IPV6}tables
  37. cmds="$toolname"
  38. tst_require_drivers ip${TST_IPV6}_tables
  39. else
  40. toolname=nft
  41. cmds="$toolname ip${TST_IPV6}tables-translate"
  42. fi
  43. if [ "$TST_IPV6" ];then
  44. loc_addr="::1"
  45. proto="icmpv6"
  46. else
  47. loc_addr="127.0.0.1"
  48. proto="icmp"
  49. fi
  50. ping_cmd="ping$TST_IPV6"
  51. tst_require_cmds $cmds $ping_cmd
  52. tst_res TINFO "INIT: Flushing all rules"
  53. NFRUN -F -t filter > tst_iptables.out 2>&1
  54. NFRUN -F -t nat > tst_iptables.out 2>&1
  55. NFRUN -F -t mangle > tst_iptables.out 2>&1
  56. }
  57. cleanup()
  58. {
  59. if lsmod | grep -q "ip${TST_IPV6}_tables"; then
  60. NFTRUN -F -t filter > /dev/null 2>&1
  61. NFTRUN -F -t nat > /dev/null 2>&1
  62. NFTRUN -F -t mangle > /dev/null 2>&1
  63. rmmod -v ipt_limit ipt_multiport ipt_LOG ipt_REJECT \
  64. ip${TST_IPV6}table_mangle ip${TST_IPV6}table_nat ip_conntrack \
  65. ip${TST_IPV6}table_filter ip${TST_IPV6}_tables nf_nat_ipv${TST_IPVER} nf_nat \
  66. nf_log_ipv${TST_IPVER} nf_log_common nf_reject_ipv${TST_IPVER} \
  67. nf_conntrack_ipv${TST_IPVER} nf_defrag_ipv${TST_IPVER} nf_conntrack \
  68. > tst_iptables.out 2>&1
  69. fi
  70. }
  71. test1()
  72. {
  73. if [ "$use_iptables" != 1 ]; then
  74. tst_res TCONF "$toolname not applicable for test $1"
  75. return
  76. fi
  77. local chaincnt=0
  78. local ipt_cmd="ip${TST_IPV6}tables"
  79. local cmd="$ipt_cmd -L -t filter"
  80. tst_res TINFO "$cmd will list all rules in table filter"
  81. $cmd > tst_iptables.out 2>&1
  82. if [ $? -ne 0 ]; then
  83. tst_res TFAIL "$cmd failed to list rules"
  84. cat tst_iptables.out
  85. return
  86. else
  87. chaincnt=$(grep -c Chain tst_iptables.out)
  88. if [ $chaincnt -lt 3 ]; then
  89. tst_res TFAIL "$cmd failed to list rules"
  90. cat tst_iptables.out
  91. return
  92. else
  93. tst_res TINFO "$cmd lists rules"
  94. fi
  95. fi
  96. local cmd="$ipt_cmd -L -t nat"
  97. tst_res TINFO "$cmd will list all rules in table nat"
  98. $cmd > tst_iptables.out 2>&1
  99. if [ $? -ne 0 ]; then
  100. tst_res TFAIL "$cmd failed to list rules"
  101. cat tst_iptables.out
  102. return
  103. else
  104. chaincnt=$(grep -c Chain tst_iptables.out)
  105. if [ $chaincnt -lt 3 ]; then
  106. tst_res TFAIL "$cmd failed to list rules"
  107. cat tst_iptables.out
  108. return
  109. else
  110. tst_res TINFO "$cmd lists rules"
  111. fi
  112. fi
  113. local cmd="$ipt_cmd -L -t mangle"
  114. tst_res TINFO "$cmd will list all rules in table mangle"
  115. $cmd > tst_iptables.out 2>&1
  116. if [ $? -ne 0 ]; then
  117. tst_res TFAIL "$cmd failed to list rules"
  118. cat tst_iptables.out
  119. return
  120. else
  121. chaincnt=$(grep -c Chain tst_iptables.out)
  122. if [ $chaincnt -lt 5 ]; then
  123. tst_res TFAIL "$cmd failed to list rules"
  124. cat tst_iptables.out
  125. else
  126. tst_res TINFO "$cmd lists rules"
  127. fi
  128. fi
  129. tst_res TPASS "$ipt_cmd -L lists rules"
  130. }
  131. test2()
  132. {
  133. tst_res TINFO "Use $toolname to DROP packets from particular IP"
  134. tst_res TINFO "Rule to block icmp from $loc_addr"
  135. NFRUN -A INPUT -s $loc_addr -p $proto -j DROP > tst_iptables.out 2>&1
  136. if [ $? -ne 0 ]; then
  137. tst_res TFAIL "$toolname command failed to append new rule"
  138. cat tst_iptables.out
  139. return
  140. fi
  141. tst_res TINFO "Pinging $loc_addr"
  142. $ping_cmd -c 2 $loc_addr -W 1 -i 0 > tst_iptables.out 2>&1
  143. if [ $? -ne 0 ]; then
  144. grep "100% packet loss" tst_iptables.out > tst_iptables.err 2>&1
  145. if [ $? -ne 0 ]; then
  146. tst_res TFAIL \
  147. "$toolname did not block packets from loopback"
  148. cat tst_iptables.err
  149. return
  150. else
  151. tst_res TINFO "Ping $loc_addr not successful"
  152. fi
  153. else
  154. tst_res TFAIL "$toolname did not block $proto from $loc_addr"
  155. cat tst_iptables.out
  156. return
  157. fi
  158. tst_res TINFO "Deleting $proto DROP from $loc_addr rule"
  159. NFRUN_REMOVE
  160. tst_res TINFO "Pinging $loc_addr again"
  161. $ping_cmd -c 2 $loc_addr -W 1 -i 0 > tst_iptables.out 2>&1
  162. if [ $? -ne 0 ]; then
  163. tst_res TFAIL "$toolname blocking loopback. This is expected" \
  164. "behaviour on certain distributions where" \
  165. "enabling firewall drops all packets by default"
  166. cat tst_iptables.out
  167. return
  168. fi
  169. tst_res TINFO "Ping succsess"
  170. tst_res TPASS "$toolname can DROP packets from particular IP"
  171. }
  172. test3()
  173. {
  174. tst_res TINFO "Use $toolname to REJECT ping request"
  175. tst_res TINFO "Rule to reject ping request"
  176. NFRUN -A INPUT -p $proto --${proto}-type echo-request -d $loc_addr -j \
  177. REJECT > tst_iptables.out 2>&1
  178. if [ $? -ne 0 ]; then
  179. tst_res TFAIL "$toolname command failed to append new rule"
  180. cat tst_iptables.out
  181. return
  182. fi
  183. tst_res TINFO "Pinging $loc_addr"
  184. $ping_cmd -c 2 $loc_addr -W 1 -i 0 > tst_iptables.out 2>&1
  185. if [ $? -ne 0 ]; then
  186. grep "100% packet loss" tst_iptables.out > tst_iptables.err 2>&1
  187. if [ $? -ne 0 ]; then
  188. tst_res TFAIL "$toolname did not block ping request"
  189. cat tst_iptables.err
  190. return
  191. else
  192. tst_res TINFO "Ping $loc_addr not successful"
  193. fi
  194. else
  195. tst_res TFAIL "$toolname did not reject ping request"
  196. cat tst_iptables.out
  197. return
  198. fi
  199. tst_res TINFO "Deleting icmp request REJECT rule"
  200. NFRUN_REMOVE
  201. tst_res TINFO "Pinging $loc_addr again"
  202. $ping_cmd -c 2 $loc_addr -W 1 -i 0 > tst_iptables.out 2>&1
  203. if [ $? -ne 0 ]; then
  204. tst_res TFAIL "$toolname blocking ping requests. This is" \
  205. "expected behaviour on certain distributions" \
  206. "where enabling firewall drops all packets by" \
  207. "default"
  208. cat tst_iptables.out
  209. return
  210. fi
  211. tst_res TINFO "Ping succsess"
  212. tst_res TPASS "$toolname can REJECT ping requests"
  213. }
  214. test4()
  215. {
  216. local dport=45886
  217. local logprefix="${TCID}$(date +%m%d%H%M%S):"
  218. tst_res TINFO "Use $toolname to log packets to particular port"
  219. tst_res TINFO "Rule to log tcp packets to particular port"
  220. NFRUN -A INPUT -p tcp -d $loc_addr --dport $dport -j LOG \
  221. --log-prefix "$logprefix" > tst_iptables.out 2>&1
  222. if [ $? -ne 0 ]; then
  223. tst_res TFAIL "$toolname command failed to append new rule"
  224. cat tst_iptables.out
  225. return
  226. fi
  227. tst_res TINFO "telnet $loc_addr $dport"
  228. telnet $loc_addr $dport > tst_iptables.out 2>&1
  229. if [ $? -ne 0 ]; then
  230. sleep 2
  231. dmesg | grep "$logprefix" > tst_iptables.err 2>&1
  232. if [ $? -ne 0 ]; then
  233. tst_res TFAIL \
  234. "$toolname did not log packets to port $dport"
  235. cat tst_iptables.err
  236. return
  237. else
  238. tst_res TINFO "Packets to port $dport logged"
  239. fi
  240. else
  241. tst_res TFAIL "telnet to $loc_addr $dport should fail"
  242. cat tst_iptables.out
  243. return
  244. fi
  245. tst_res TINFO "Deleting the rule to log"
  246. NFRUN_REMOVE
  247. tst_res TINFO "$toolname logging succsess"
  248. tst_res TPASS "$toolname can log packets to particular port"
  249. }
  250. test5()
  251. {
  252. local dport=0
  253. local logprefix="${TCID}$(date +%m%d%H%M%S):"
  254. tst_res TINFO "Use $toolname to log packets to multiple ports"
  255. tst_res TINFO "Rule to log tcp packets to port 45801 - 45803"
  256. NFRUN -A INPUT -p tcp -d $loc_addr --dport 45801:45803 -j LOG \
  257. --log-prefix "$logprefix" > tst_iptables.out 2>&1
  258. if [ $? -ne 0 ]; then
  259. tst_res TFAIL "$toolname command failed to append new rule"
  260. cat tst_iptables.out
  261. return
  262. fi
  263. tst_res TINFO "Rule to log tcp packets to port 45804 - 45806"
  264. NFRUN -A INPUT -p tcp -d $loc_addr -m multiport --dports \
  265. 45804,45806,45805 -j LOG --log-prefix "$logprefix" \
  266. > tst_iptables.out 2>&1
  267. if [ $? -ne 0 ]; then
  268. tst_res TFAIL "$toolname command failed to append new rule"
  269. cat tst_iptables.out
  270. return
  271. fi
  272. for dport in 45801 45802 45803 45804 45805 45806; do
  273. tst_res TINFO "telnet $loc_addr $dport"
  274. telnet $loc_addr $dport > tst_iptables.out 2>&1
  275. if [ $? -ne 0 ]; then
  276. sleep 2
  277. dmesg | grep "$logprefix" | grep "=$dport " \
  278. > tst_iptables.err 2>&1
  279. if [ $? -ne 0 ]; then
  280. tst_res TFAIL "$toolname did not log packets" \
  281. "to port $dport"
  282. cat tst_iptables.err
  283. return
  284. else
  285. tst_res TINFO "Packets to port $dport logged"
  286. fi
  287. else
  288. tst_res TFAIL "telnet to $loc_addr $dport should fail"
  289. cat tst_iptables.out
  290. return
  291. fi
  292. done
  293. tst_res TINFO "Flushing all rules"
  294. NFRUN -F > tst_iptables.out 2>&1
  295. if [ $? -ne 0 ]; then
  296. tst_res TFAIL "$toolname did not flush all rules"
  297. cat tst_iptables.out
  298. return
  299. fi
  300. tst_res TINFO "$toolname logging succsess"
  301. tst_res TPASS "$toolname can log packets to multiple ports"
  302. }
  303. test6()
  304. {
  305. local logcnt=0
  306. local logprefix="${TCID}$(date +%m%d%H%M%S):"
  307. tst_res TINFO "Use $toolname to log ping request with limited rate"
  308. tst_res TINFO "Rule to log ping request"
  309. NFRUN -A INPUT -p $proto --$proto-type echo-request -d $loc_addr -m \
  310. limit -j LOG --log-prefix "$logprefix" > tst_iptables.out 2>&1
  311. if [ $? -ne 0 ]; then
  312. tst_res TFAIL "$toolname command failed to append new rule"
  313. cat tst_iptables.out
  314. return
  315. fi
  316. tst_res TINFO "Pinging $loc_addr"
  317. $ping_cmd -c 10 $loc_addr -W 1 -i 0 > tst_iptables.out 2>&1
  318. if [ $? -eq 0 ]; then
  319. sleep 2
  320. logcnt=$(dmesg | grep -c "$logprefix")
  321. if [ $logcnt -ne 5 ]; then
  322. tst_res TFAIL "$toolname did not log packets with" \
  323. "limited rate"
  324. cat tst_iptables.out
  325. return
  326. else
  327. tst_res TINFO "ping requests logged with limited rate"
  328. fi
  329. else
  330. tst_res TFAIL "ping to $loc_addr failed. This is expected" \
  331. "behaviour on certain distributions where" \
  332. "enabling firewall drops all packets by default"
  333. cat tst_iptables.out
  334. return
  335. fi
  336. tst_res TINFO "Deleting the rule to log"
  337. NFRUN_REMOVE
  338. tst_res TINFO "$toolname limited logging succsess"
  339. tst_res TPASS "$toolname can log packets with limited rate"
  340. }