Proxmox/pve-firewall
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-firewall.git synced 2025-01-02 01:18:00 +03:00
Code Releases Activity

test/simulator: add very basic ICMP type functionallity

Browse Source 
For now without integer to full-name, and vice versa, mapping of
ICMP types.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2020-05-04 14:10:53 +02:00
parent 430a2be282
commit 29e5ce1536
3 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/PVE/FirewallSimulator.pm
View File

@ -29,9 +29,7 @@ my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
sub debug {
my $new_value = shift;
$debug = $new_value if defined($new_value);
return $debug;
}
@ -140,6 +138,13 @@ sub rule_match {
return undef if $atype ne $pkg->{dsttype};
}
if ($rule =~ s/^-m icmp(v6)? --icmp-type (\S+)\s*//) {
my $icmpv6 = !!$1;
my $icmptype = $2;
die "missing destination address type (dsttype)\n" if !defined($pkg->{dport});
return undef if $icmptype ne $pkg->{dport};
}
if ($rule =~ s/^-i (\S+)\s*//) {
my $devre = $1;
die "missing interface (iface_in)\n" if !$pkg->{iface_in};

2
test/test-basic1/100.fw
View File

@ -5,4 +5,6 @@ enable: 1
[RULES]
IN ACCEPT -p tcp -dport 443
IN ACCEPT -p icmp -dport 0
IN ACCEPT -p icmp -dport host-unreachable
OUT REJECT -p tcp -dport 81

4
test/test-basic1/tests
View File

@ -21,6 +21,10 @@
{ from => 'vm110', to => 'vm100', dport => 22, action => 'DROP' }
{ from => 'vm110', to => 'vm100', dport => 443, action => 'ACCEPT' }
{ from => 'vm110', to => 'vm100', dport => 0, proto => 'icmp', action => 'ACCEPT' }
{ from => 'vm110', to => 'vm100', dport => 'host-unreachable', proto => 'icmp', action => 'ACCEPT' }
{ from => 'vm110', to => 'vm100', dport => 255, proto => 'icmpv6', action => 'DROP' }
{ from => 'outside', to => 'ct200', dport => 22, action => 'ACCEPT' }
{ from => 'outside', to => 'ct200', dport => 23, action => 'DROP' }
{ from => 'outside', to => 'vm100', dport => 22, action => 'DROP' }