Server IP : 85.214.239.14 / Your IP : 3.145.110.145 Web Server : Apache/2.4.62 (Debian) System : Linux h2886529.stratoserver.net 4.9.0 #1 SMP Tue Jan 9 19:45:01 MSK 2024 x86_64 User : www-data ( 33) PHP Version : 7.4.18 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : OFF | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : OFF Directory : /proc/2/cwd/proc/self/root/proc/self/root/usr/share/augeas/lenses/dist/tests/ |
Upload File : |
module Test_iptables = let add_rule = Iptables.table_rule let ipt_match = Iptables.ipt_match test add_rule get "-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n" = { "append" = "INPUT" { "match" = "state" } { "state" = "ESTABLISHED,RELATED" } { "jump" = "ACCEPT" } } test add_rule get "-A INPUT -p icmp -j \tACCEPT \n" = { "append" = "INPUT" { "protocol" = "icmp" } { "jump" = "ACCEPT" } } test add_rule get "-A INPUT -i lo -j ACCEPT\n" = { "append" = "INPUT" { "in-interface" = "lo" } { "jump" = "ACCEPT" } } test ipt_match get " -m tcp -p tcp --dport 53" = { "match" = "tcp" } { "protocol" = "tcp" } { "dport" = "53" } let arule = " -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT" test add_rule get ("--append INPUT" . arule . "\n") = { "append" = "INPUT" { "match" = "state" } { "state" = "NEW" } { "match" = "tcp" } { "protocol" = "tcp" } { "dport" = "53" } { "jump" = "ACCEPT" } } test ipt_match get arule = { "match" = "state" } { "state" = "NEW" } { "match" = "tcp" } { "protocol" = "tcp" } { "dport" = "53" } { "jump" = "ACCEPT" } test ipt_match get ("-A INPUT" . arule) = * test ipt_match get " -p esp -j ACCEPT" = { "protocol" = "esp" } { "jump" = "ACCEPT" } test ipt_match get " -m state --state NEW -m udp -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT" = { "match" = "state" } { "state" = "NEW" } { "match" = "udp" } { "protocol" = "udp" } { "dport" = "5353" } { "destination" = "224.0.0.251" } { "jump" = "ACCEPT" } test add_rule get "-I FORWARD -m physdev --physdev-is-bridged -j ACCEPT\n" = { "insert" = "FORWARD" { "match" = "physdev" } { "physdev-is-bridged" } { "jump" = "ACCEPT" } } test add_rule get "-A INPUT -j REJECT --reject-with icmp-host-prohibited\n" = { "append" = "INPUT" { "jump" = "REJECT" } { "reject-with" = "icmp-host-prohibited" } } test add_rule get "-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT\n" = { "append" = "RH-Firewall-1-INPUT" { "protocol" = "icmp" } { "icmp-type" = "any" } { "jump" = "ACCEPT" } } test Iptables.table get "*filter :RH-Firewall-1-INPUT - [0:0] -A FORWARD -j RH-Firewall-1-INPUT -A RH-Firewall-1-INPUT -i lo -j ACCEPT COMMIT\n" = { "table" = "filter" { "chain" = "RH-Firewall-1-INPUT" { "policy" = "-" } } { "append" = "FORWARD" { "jump" = "RH-Firewall-1-INPUT" } } { "append" = "RH-Firewall-1-INPUT" { "in-interface" = "lo" } { "jump" = "ACCEPT" } } } test Iptables.table get "*filter :RH-Firewall-1-INPUT - [0:0] -A FORWARD -j RH-Firewall-1-INPUT COMMIT\n" = { "table" = "filter" { } { "chain" = "RH-Firewall-1-INPUT" { "policy" = "-" } } { } { "append" = "FORWARD" { "jump" = "RH-Firewall-1-INPUT" } } { } } let conf = "# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002 *filter :INPUT DROP [1:229] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -I FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT # comments and blank lines are allow between rules -A FORWARD -i eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT --append OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT COMMIT # Completed on Wed Apr 24 10:19:55 2002 # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002 *mangle :PREROUTING ACCEPT [658:32445] :INPUT ACCEPT [658:32445] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [891:68234] :POSTROUTING ACCEPT [891:68234] COMMIT # Completed on Wed Apr 24 10:19:55 2002 # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002 *nat :PREROUTING ACCEPT [1:229] :POSTROUTING ACCEPT [3:450] # The output chain :OUTPUT ACCEPT [3:450] # insert something --insert POSTROUTING -o eth0 -j SNAT --to-source 195.233.192.1 \t # and now commit COMMIT # Completed on Wed Apr 24 10:19:55 2002\n" test Iptables.lns get conf = { "#comment" = "Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002" } { "table" = "filter" { "chain" = "INPUT" { "policy" = "DROP" } } { "chain" = "FORWARD" { "policy" = "DROP" } } { "chain" = "OUTPUT" { "policy" = "DROP" } } { "append" = "INPUT" { "match" = "state" } { "state" = "RELATED,ESTABLISHED" } { "jump" = "ACCEPT" } } {} { "insert" = "FORWARD" { "in-interface" = "eth0" } { "match" = "state" } { "state" = "RELATED,ESTABLISHED" } { "jump" = "ACCEPT" } } {} { "#comment" = "comments and blank lines are allow between rules" } {} { "append" = "FORWARD" { "in-interface" = "eth1" } { "match" = "state" } { "state" = "NEW,RELATED,ESTABLISHED" } { "jump" = "ACCEPT" } } { "append" = "OUTPUT" { "match" = "state" } { "state" = "NEW,RELATED,ESTABLISHED" } { "jump" = "ACCEPT" } } } { "#comment" = "Completed on Wed Apr 24 10:19:55 2002" } { "#comment" = "Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002" } { "table" = "mangle" { "chain" = "PREROUTING" { "policy" = "ACCEPT" } } {} { "chain" = "INPUT" { "policy" = "ACCEPT" } } { "chain" = "FORWARD" { "policy" = "ACCEPT" } } { "chain" = "OUTPUT" { "policy" = "ACCEPT" } } { "chain" = "POSTROUTING" { "policy" = "ACCEPT" } } } { "#comment" = "Completed on Wed Apr 24 10:19:55 2002" } { "#comment" = "Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002" } { "table" = "nat" { "chain" = "PREROUTING" { "policy" = "ACCEPT" } } { "chain" = "POSTROUTING" { "policy" = "ACCEPT" } } { "#comment" = "The output chain" } { "chain" = "OUTPUT" { "policy" = "ACCEPT" } } { "#comment" = "insert something" } { "insert" = "POSTROUTING" { "out-interface" = "eth0" } { "jump" = "SNAT" } { "to-source" = "195.233.192.1" } } { "#comment" = "and now commit" } } { "#comment" = "Completed on Wed Apr 24 10:19:55 2002" } test ipt_match get " -m comment --comment \"A comment\"" = { "match" = "comment" } { "comment" = "\"A comment\"" } (* * Test the various schemes for negation that iptables supports * * Note that the two ways in which a parameter can be negated lead to * two different trees that mean the same. *) test add_rule get "-I POSTROUTING ! -d 192.168.122.0/24 -j MASQUERADE\n" = { "insert" = "POSTROUTING" { "destination" = "192.168.122.0/24" { "not" } } { "jump" = "MASQUERADE" } } test add_rule get "-I POSTROUTING -d ! 192.168.122.0/24 -j MASQUERADE\n" = { "insert" = "POSTROUTING" { "destination" = "! 192.168.122.0/24" } { "jump" = "MASQUERADE" } } test add_rule put "-I POSTROUTING ! -d 192.168.122.0/24 -j MASQUERADE\n" after rm "/insert/destination/not" = "-I POSTROUTING -d 192.168.122.0/24 -j MASQUERADE\n" (* I have no idea if iptables will accept double negations, but we * allow it syntactically *) test add_rule put "-I POSTROUTING -d ! 192.168.122.0/24 -j MASQUERADE\n" after clear "/insert/destination/not" = "-I POSTROUTING ! -d ! 192.168.122.0/24 -j MASQUERADE\n" test Iptables.chain get ":tcp_packets - [0:0] " = { "chain" = "tcp_packets" { "policy" = "-" } } (* Bug #157 *) test ipt_match get " --tcp-flags SYN,RST,ACK,FIN SYN" = { "tcp-flags" { "mask" = "SYN" } { "mask" = "RST" } { "mask" = "ACK" } { "mask" = "FIN" } { "set" = "SYN" } } (* Bug #224 *) test ipt_match get " --icmpv6-type neighbor-solicitation" = { "icmpv6-type" = "neighbor-solicitation" }