jschoubben
663e8143d4
The seat's three verbs over the machine's own tools: the filter as enforced (nftables and the legacy filter), the mesh's own table reloaded from its file, and one rule set the mesh did not write removed by the name the host reports it under (ADR 0168) — a predecessor's chain loses its jumps and goes, the runtime's user chain is emptied back to its return, a table of the machine's own goes whole; the mesh's tables, the runtime's chains, a built-in chain and an active found firewall's chains are refused. Tested over the shapes two machines of the first mesh reported live. The module's own tool stays.
75 lines
4.1 KiB
TypeScript
75 lines
4.1 KiB
TypeScript
// `remove` acts on one rule set the mesh did not write, named as the host reports it (novox/hq ADR
|
|
// 0168, 0169), over the shapes two machines of the first mesh reported live: a predecessor's chain in
|
|
// the legacy filter, the runtime's user chain in the IPv6 legacy filter, a leftover front-end chain,
|
|
// and the same in an iptables-nft table. It refuses what is not the operator's to remove.
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { FirewallClient, chainsJumpingTo, type Runner } from "../client.ts";
|
|
|
|
const legacy = [
|
|
"-P INPUT ACCEPT", "-P FORWARD DROP", "-P OUTPUT ACCEPT",
|
|
"-N DOCKER", "-N DOCKER-USER", "-N HAL-MESH-ONLY",
|
|
"-A FORWARD -j DOCKER-USER",
|
|
"-A DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
|
|
"-A HAL-MESH-ONLY -m conntrack --ctorigdstport 80 -j RETURN",
|
|
"-A HAL-MESH-ONLY -m comment --comment \"HAL: not public -> mesh only\" -j DROP",
|
|
].join("\n") + "\n";
|
|
|
|
function fake(ufwActive = false): { run: Runner; asked: string[] } {
|
|
const asked: string[] = [];
|
|
const run: Runner = async (cmd, args) => {
|
|
asked.push([cmd, ...args].join(" "));
|
|
if (cmd === "ufw") return ufwActive ? "Status: active\n" : "Status: inactive\n";
|
|
if (args.join(" ") === "-S") return legacy;
|
|
if (cmd === "nft" && args[0] === "list" && args[1] === "table") {
|
|
return "table ip6 own {\n\tchain forward {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tjump deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
|
|
}
|
|
if (cmd === "nft" && args[0] === "-a") {
|
|
return "table ip6 own {\n\tchain forward {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tjump deny # handle 7\n\t}\n}\n";
|
|
}
|
|
return "";
|
|
};
|
|
return { run, asked };
|
|
}
|
|
|
|
test("a predecessor's chain in the legacy filter loses its jumps, is flushed and deleted", async () => {
|
|
const f = fake();
|
|
const out = await new FirewallClient(f.run).remove("chain HAL-MESH-ONLY (iptables-legacy)");
|
|
assert.deepEqual(out.did, [
|
|
"iptables-legacy -D DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
|
|
"iptables-legacy -F HAL-MESH-ONLY",
|
|
"iptables-legacy -X HAL-MESH-ONLY",
|
|
]);
|
|
});
|
|
|
|
test("the runtime's user chain is emptied back to its one return, never deleted", async () => {
|
|
const f = fake();
|
|
const out = await new FirewallClient(f.run).remove("chain DOCKER-USER (ip6tables-legacy)");
|
|
assert.deepEqual(out.did, ["ip6tables-legacy -F DOCKER-USER", "ip6tables-legacy -A DOCKER-USER -j RETURN"]);
|
|
const nft = await new FirewallClient(fake().run).remove("table ip6 filter, chain DOCKER-USER");
|
|
assert.deepEqual(nft.did, ["ip6tables -F DOCKER-USER", "ip6tables -A DOCKER-USER -j RETURN"]);
|
|
});
|
|
|
|
test("a chain of the machine's own nftables table goes with the rules that reach it", async () => {
|
|
const f = fake();
|
|
const out = await new FirewallClient(f.run).remove("table ip6 own, chain deny");
|
|
assert.deepEqual(out.did, ["nft delete rule ip6 own forward handle 7", "nft delete chain ip6 own deny"]);
|
|
});
|
|
|
|
test("what is not the operator's to remove is refused by name", async () => {
|
|
const c = new FirewallClient(fake(true).run);
|
|
await assert.rejects(c.remove("table inet mesh, chain forward"), /the mesh's own table/);
|
|
await assert.rejects(c.remove("chain DOCKER (iptables-legacy)"), /container runtime's own/);
|
|
await assert.rejects(c.remove("chain FORWARD (iptables-legacy)"), /built in/);
|
|
await assert.rejects(c.remove("chain ufw6-docker-logging-deny (ip6tables-legacy)"), /found firewall, which is in force/);
|
|
await assert.rejects(c.remove("something else"), /not a rule set as the host reports one/);
|
|
// Retired, a front end's leftover is nobody's and goes.
|
|
const retired = await new FirewallClient(fake(false).run).remove("chain ufw6-docker-logging-deny (ip6tables-legacy)");
|
|
assert.ok(retired.did.includes("ip6tables-legacy -X ufw6-docker-logging-deny"));
|
|
});
|
|
|
|
test("which chains jump to a target is read from a listing", () => {
|
|
const listing = "table ip6 own {\n\tchain a {\n\t\tjump deny\n\t}\n\tchain b {\n\t\tgoto deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
|
|
assert.deepEqual(chainsJumpingTo(listing, "deny"), ["a", "b"]);
|
|
});
|