mirror of
https://github.com/slackhq/nebula.git
synced 2025-01-30 03:33:56 +00:00
55858c64cc
Test that basic inbound / outbound firewall rules work during the smoke test. This change sets an inbound firewall rule on host3, and a new host4 with outbound firewall rules. It also tests that conntrack allows packets once the connection has been established.
54 lines
956 B
Bash
Executable file
54 lines
956 B
Bash
Executable file
#!/bin/sh
|
|
|
|
set -e
|
|
|
|
FIREWALL_ALL='[{"port": "any", "proto": "any", "host": "any"}]'
|
|
|
|
if [ "$STATIC_HOSTS" ] || [ "$LIGHTHOUSES" ]
|
|
then
|
|
echo "static_host_map:"
|
|
echo "$STATIC_HOSTS" | while read -r NEBULA_IP STATIC
|
|
do
|
|
[ -z "$NEBULA_IP" ] || echo " '$NEBULA_IP': ['$STATIC']"
|
|
done
|
|
echo "$LIGHTHOUSES" | while read -r NEBULA_IP STATIC
|
|
do
|
|
[ -z "$NEBULA_IP" ] || echo " '$NEBULA_IP': ['$STATIC']"
|
|
done
|
|
echo
|
|
fi
|
|
|
|
lighthouse_hosts() {
|
|
if [ "$LIGHTHOUSES" ]
|
|
then
|
|
echo
|
|
echo "$LIGHTHOUSES" | while read -r NEBULA_IP STATIC
|
|
do
|
|
echo " - '$NEBULA_IP'"
|
|
done
|
|
else
|
|
echo "[]"
|
|
fi
|
|
}
|
|
|
|
cat <<EOF
|
|
pki:
|
|
ca: /ca.crt
|
|
cert: /${HOST}.crt
|
|
key: /${HOST}.key
|
|
|
|
lighthouse:
|
|
am_lighthouse: ${AM_LIGHTHOUSE:-false}
|
|
hosts: $(lighthouse_hosts)
|
|
|
|
listen:
|
|
host: 0.0.0.0
|
|
port: ${LISTEN_PORT:-4242}
|
|
|
|
tun:
|
|
dev: ${TUN_DEV:-nebula1}
|
|
|
|
firewall:
|
|
outbound: ${OUTBOUND:-$FIREWALL_ALL}
|
|
inbound: ${INBOUND:-$FIREWALL_ALL}
|
|
EOF
|