fwtester: add new zone 'nfwm' to simulate a non-firewalled VM

diff --git a/test/README b/test/README
index 71801d4c66644fa1f444cd0dccde68a785da4d96..e8d04684f6e547256eda11928537c01c1ba513e5 100644 (file)
--- a/test/README
+++ b/test/README
@@ -38,6 +38,8 @@ The following <zone> definition exist currently:
 
 * ct<ID>:   An openvz container
 
+* nfvm:     Non firewalled VM (vmbr port tapXYZ)
+
 ==Test examples==
 
  { from => 'outside', to => 'ct200', dport => 22, action => 'ACCEPT' }

diff --git a/test/fwtester.pl b/test/fwtester.pl
index 6a9c408e9152330a8b165f78d75a3f7162037321..af25014efe8f6a61e041f8f5ae3a0bf01b8a113a 100755 (executable)
--- a/test/fwtester.pl
+++ b/test/fwtester.pl
@@ -14,6 +14,9 @@ my $trace;
 my $outside_iface = 'eth0';
 my $outside_bridge = 'vmbr0';
 
+my $nfvm_iface = 'tapXYZ';
+my $nfvm_bridge = 'vmbr0';
+
 my $debug = 0;
 
 sub print_usage_and_exit {
@@ -224,6 +227,9 @@ sub route_packet {
        if ($route_state eq 'from-outside') {
            $next_route_state = $outside_bridge || die 'internal error';
            $next_physdev_in = $outside_iface || die 'internal error';
+       } elsif ($route_state eq 'from-nfvm') {
+           $next_route_state = $nfvm_bridge || die 'internal error';
+           $next_physdev_in = $nfvm_iface || die 'internal error';
        } elsif ($route_state eq 'host') {
 
            if ($target->{type} eq 'outside') {
@@ -231,6 +237,11 @@ sub route_packet {
                $pkg->{iface_out} = $outside_bridge;
                $chain = 'PVEFW-OUTPUT';
                $next_route_state = $outside_iface
+           } elsif ($target->{type} eq 'nfvm') {
+               $pkg->{iface_in} = 'lo';
+               $pkg->{iface_out} = $nfvm_bridge;
+               $chain = 'PVEFW-OUTPUT';
+               $next_route_state = $nfvm_iface
            } elsif ($target->{type} eq 'ct') {
                $pkg->{iface_in} = 'lo';
                $pkg->{iface_out} = 'venet0';
@@ -261,6 +272,13 @@ sub route_packet {
                $pkg->{iface_out} = $outside_bridge;
                $next_route_state = $outside_iface;
 
+           } elsif ($target->{type} eq 'nfvm') {
+               
+               $chain = 'PVEFW-FORWARD';
+               $pkg->{iface_in} = 'venet0';
+               $pkg->{iface_out} = $nfvm_bridge;
+               $next_route_state = $nfvm_iface;
+
            } elsif ($target->{type} eq 'vm') {
 
                $chain = 'PVEFW-FORWARD';
@@ -321,6 +339,17 @@ sub route_packet {
                }
                $next_route_state = $outside_iface;
 
+           } elsif ($target->{type} eq 'nfvm') {
+
+               $chain = 'PVEFW-FORWARD';
+               $pkg->{iface_in} = $route_state;
+               $pkg->{iface_out} = $nfvm_bridge;
+               # conditionally set physdev_out (same behavior as kernel)
+               if ($route_state eq $nfvm_bridge) {
+                   $pkg->{physdev_out} = $nfvm_iface || die 'internal error';
+               }
+               $next_route_state = $nfvm_iface;
+
            } elsif ($target->{type} eq 'ct') {
 
                $chain = 'PVEFW-FORWARD';
@@ -431,6 +460,9 @@ sub simulate_firewall {
     } elsif ($from eq 'outside') {
        $from_info->{type} = 'outside';
        $start_state = 'from-outside';
+    } elsif ($from eq 'nfvm') {
+       $from_info->{type} = 'nfvm';
+       $start_state = 'from-nfvm';
     } elsif ($from =~ m/^ct(\d+)$/) {
        my $vmid = $1;
        $from_info = extract_ct_info($vmdata, $vmid);
@@ -457,6 +489,9 @@ sub simulate_firewall {
     } elsif ($to eq 'outside') {
        $target->{type} = 'outside';
        $target->{iface} = $outside_iface;
+     } elsif ($to eq 'nfvm') {
+       $target->{type} = 'nfvm';
+       $target->{iface} = $nfvm_iface;
     } elsif ($to =~ m/^ct(\d+)$/) {
        my $vmid = $1;
        $target = extract_ct_info($vmdata, $vmid);

diff --git a/test/test-basic1/tests b/test/test-basic1/tests
index 477853ba87f8d83022ce98a507e31c959d85e3dc..2b762de9d68c26199e7d3436160c5a4461b1541a 100644 (file)
--- a/test/test-basic1/tests
+++ b/test/test-basic1/tests
@@ -38,3 +38,16 @@
 { from => 'outside', to => 'host', dport => 100, action => 'REJECT' }
 { from => 'outside', to => 'host', dport => 101, action => 'DROP' }
 
+{ from => 'nfvm', to => 'host', dport => 22, action => 'ACCEPT' }
+{ from => 'nfvm', to => 'host', dport => 80, action => 'DROP' }
+{ from => 'nfvm', to => 'outside', dport => 22, action => 'ACCEPT' }
+{ from => 'nfvm', to => 'outside', dport => 80, action => 'ACCEPT' }
+{ from => 'nfvm', to => 'vm100', dport => 443, action => 'ACCEPT', id => 'nfw2vm'}
+{ from => 'nfvm', to => 'vm100', dport => 80, action => 'DROP' }
+{ from => 'nfvm', to => 'ct200', dport => 22, action => 'ACCEPT' }
+{ from => 'nfvm', to => 'ct200', dport => 80, action => 'DROP' }
+
+{ from => 'ct200', to => 'nfvm', dport => 80, action => 'ACCEPT' }
+{ from => 'vm100', to => 'nfvm', dport => 80, action => 'ACCEPT' }
+{ from => 'outside', to => 'nfvm', dport => 80, action => 'ACCEPT' }
+{ from => 'host', to => 'nfvm', dport => 80, action => 'ACCEPT' }