proxmox-mirrors/pve-firewall
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-firewall synced 2025-10-04 16:21:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

test/simulator: add very basic ICMP type functionallity

Browse Source 
For now without integer to full-name, and vice versa, mapping of
ICMP types.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2020-05-04 14:10:53 +02:00
parent 430a2be282
commit 29e5ce1536
3 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/PVE/FirewallSimulator.pm
View File

@ -29,9 +29,7 @@ my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
sub debug { sub debug {
my $new_value = shift; my $new_value = shift;
$debug = $new_value if defined($new_value); $debug = $new_value if defined($new_value);
return $debug; return $debug;
} }
@ -140,6 +138,13 @@ sub rule_match {
return undef if $atype ne $pkg->{dsttype}; return undef if $atype ne $pkg->{dsttype};
} }
if ($rule =~ s/^-m icmp(v6)? --icmp-type (\S+)\s*//) {
my $icmpv6 = !!$1;
my $icmptype = $2;
die "missing destination address type (dsttype)\n" if !defined($pkg->{dport});
return undef if $icmptype ne $pkg->{dport};
}
if ($rule =~ s/^-i (\S+)\s*//) { if ($rule =~ s/^-i (\S+)\s*//) {
my $devre = $1; my $devre = $1;
die "missing interface (iface_in)\n" if !$pkg->{iface_in}; die "missing interface (iface_in)\n" if !$pkg->{iface_in};

2
test/test-basic1/100.fw
View File

@ -5,4 +5,6 @@ enable: 1
[RULES] [RULES]
IN ACCEPT -p tcp -dport 443 IN ACCEPT -p tcp -dport 443
IN ACCEPT -p icmp -dport 0
IN ACCEPT -p icmp -dport host-unreachable
OUT REJECT -p tcp -dport 81 OUT REJECT -p tcp -dport 81

4
test/test-basic1/tests
View File

@ -21,6 +21,10 @@
{ from => 'vm110', to => 'vm100', dport => 22, action => 'DROP' } { from => 'vm110', to => 'vm100', dport => 22, action => 'DROP' }
{ from => 'vm110', to => 'vm100', dport => 443, action => 'ACCEPT' } { from => 'vm110', to => 'vm100', dport => 443, action => 'ACCEPT' }
{ from => 'vm110', to => 'vm100', dport => 0, proto => 'icmp', action => 'ACCEPT' }
{ from => 'vm110', to => 'vm100', dport => 'host-unreachable', proto => 'icmp', action => 'ACCEPT' }
{ from => 'vm110', to => 'vm100', dport => 255, proto => 'icmpv6', action => 'DROP' }
{ from => 'outside', to => 'ct200', dport => 22, action => 'ACCEPT' } { from => 'outside', to => 'ct200', dport => 22, action => 'ACCEPT' }
{ from => 'outside', to => 'ct200', dport => 23, action => 'DROP' } { from => 'outside', to => 'ct200', dport => 23, action => 'DROP' }
{ from => 'outside', to => 'vm100', dport => 22, action => 'DROP' } { from => 'outside', to => 'vm100', dport => 22, action => 'DROP' }