tests: shell: coverage for simple port knocking ruleset

Add a test to cover port knocking simple ruleset.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/tests/shell/testcases/nft-f/0032pknock_0 b/tests/shell/testcases/nft-f/0032pknock_0
new file mode 100755 (executable)
index 0000000..94fc840
--- /dev/null
+++ b/tests/shell/testcases/nft-f/0032pknock_0
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+set -e
+
+RULESET="define guarded_ports = {ssh}
+
+table inet portknock {
+        set clients_ipv4 {
+                type ipv4_addr
+                flags timeout
+        }
+
+        set candidates_ipv4 {
+                type ipv4_addr . inet_service
+                flags timeout
+        }
+
+        chain input {
+                type filter hook input priority -10; policy accept;
+
+                tcp dport 10001 add @candidates_ipv4 {ip  saddr . 10002 timeout 1s}
+                tcp dport 10002 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10003 timeout 1s}
+                tcp dport 10003 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10004 timeout 1s}
+                tcp dport 10004 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10005 timeout 1s}
+                tcp dport 10005 ip  saddr . tcp dport @candidates_ipv4 add @clients_ipv4 {ip  saddr timeout 600s} log prefix \"Successful portknock: \"
+
+                tcp dport \$guarded_ports ip  saddr @clients_ipv4 counter accept
+                tcp dport \$guarded_ports ct state established,related counter accept
+
+                tcp dport \$guarded_ports reject with tcp reset
+        }
+}"
+
+$NFT -f - <<< "$RULESET"

diff --git a/tests/shell/testcases/nft-f/dumps/0032pknock_0.nft b/tests/shell/testcases/nft-f/dumps/0032pknock_0.nft
new file mode 100644 (file)
index 0000000..f29dfb2
--- /dev/null
+++ b/tests/shell/testcases/nft-f/dumps/0032pknock_0.nft
@@ -0,0 +1,25 @@
+table inet portknock {
+       set clients_ipv4 {
+               type ipv4_addr
+               size 65535
+               flags dynamic,timeout
+       }
+
+       set candidates_ipv4 {
+               type ipv4_addr . inet_service
+               size 65535
+               flags dynamic,timeout
+       }
+
+       chain input {
+               type filter hook input priority filter - 10; policy accept;
+               tcp dport 10001 add @candidates_ipv4 { ip saddr . 10002 timeout 1s }
+               tcp dport 10002 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10003 timeout 1s }
+               tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10004 timeout 1s }
+               tcp dport 10004 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 { ip saddr . 10005 timeout 1s }
+               tcp dport 10005 ip saddr . tcp dport @candidates_ipv4 add @clients_ipv4 { ip saddr timeout 10m } log prefix "Successful portknock: "
+               tcp dport 22 ip saddr @clients_ipv4 counter packets 0 bytes 0 accept
+               tcp dport 22 ct state established,related counter packets 0 bytes 0 accept
+               tcp dport 22 reject with tcp reset
+       }
+}