Index: tests/sys/netpfil/Makefile =================================================================== --- tests/sys/netpfil/Makefile +++ tests/sys/netpfil/Makefile @@ -5,7 +5,11 @@ TESTSDIR= ${TESTSBASE}/sys/netpfil .if ${MK_PF} != "no" -TESTS_SUBDIRS+= pf +TESTS_SUBDIRS+= pf \ + common \ + .endif + + .include Index: tests/sys/netpfil/common/Makefile =================================================================== --- /dev/null +++ tests/sys/netpfil/common/Makefile @@ -0,0 +1,13 @@ +# $FreeBSD$ + +PACKAGE= tests + +TESTSDIR= ${TESTSBASE}/sys/netpfil/common + + +ATF_TESTS_SH+= pass_block \ + +${PACKAGE}FILES+= utils.subr \ + runner.subr \ + +.include Index: tests/sys/netpfil/common/pass_block.sh =================================================================== --- /dev/null +++ tests/sys/netpfil/common/pass_block.sh @@ -0,0 +1,127 @@ +#- +# Copyright (c) 2019 Ahsan Barkati +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# SUCH DAMAGE. +# +# $FreeBSD$ +# + + +. $(atf_get_srcdir)/utils.subr +. $(atf_get_srcdir)/runner.subr + +v4_head() +{ + atf_set require.user root +} + +v4_body() +{ + firewall=$1 + ${firewall}_init + + epair=$(vnet_mkepair) + ifconfig ${epair}a 192.0.2.1/24 up + vnet_mkjail iron ${epair}b + jexec iron ifconfig ${epair}b 192.0.2.2/24 up + + # Block All + firewall_config "iron" ${firewall} \ + "pf" \ + "block in" \ + "ipfw" \ + "ipfw -q add 100 deny all from any to any" \ + "ipf" \ + "block in all" \ + + atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.2 + + # Pass All + firewall_config "iron" ${firewall} \ + "pf" \ + "pass in" \ + "ipfw" \ + "ipfw -q add 100 allow all from any to any" \ + "ipf" \ + "pass in all" \ + + atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2 +} + +v4_cleanup() +{ + firewall_cleanup +} + +v6_head() +{ + atf_set require.user root +} + +v6_body() +{ + firewall=$1 + ${firewall}_init + + epair=$(vnet_mkepair) + ifconfig ${epair}a inet6 2001:db8:42::1/64 up no_dad + + vnet_mkjail iron ${epair}b + jexec iron ifconfig ${epair}b inet6 2001:db8:42::2/64 up no_dad + + # Block All + firewall_config "iron" ${firewall} \ + "pf" \ + "block in" \ + "ipfw" \ + "ipfw -q add 100 deny all from any to any" \ + "ipf" \ + "block in all" \ + + atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2 + + # Pass All + firewall_config "iron" ${firewall} \ + "pf" \ + "pass in" \ + "ipfw" \ + "ipfw -q add 100 allow all from any to any" \ + "ipf" \ + "pass in all" \ + + atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2 +} + +v6_cleanup() +{ + firewall_cleanup +} + +setup_tests "v4" \ + "pf" \ + "ipfw" \ + "ipf" \ + "v6" \ + "pf" \ + "ipfw" \ + "ipf"\ Index: tests/sys/netpfil/common/runner.subr =================================================================== --- /dev/null +++ tests/sys/netpfil/common/runner.subr @@ -0,0 +1,61 @@ +# +# Copyright (c) 2019 Ahsan Barkati +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +setup_tests() +{ + tests="" + while [ $# -gt 0 ];do + if [ "$1" = "pf" -o "$1" = "ipf" -o "$1" = "ipfw" -o "$1" = "ipfnat" ]; + then + fw=$1 + shift + atf_test_case "${fw}_${testcase}" "cleanup" + eval "${fw}_${testcase}_head(){ ${testcase}_head; }" + eval "${fw}_${testcase}_body(){ ${testcase}_body $fw; }" + eval "${fw}_${testcase}_cleanup(){ ${testcase}_cleanup; }" + tests="$tests ${fw}_${testcase}" + else + testcase=$1 + shift + fi + done + init_testcases $tests +} + + +init_testcases() +{ + args="$@" + atf_init_test_cases() + { + for testcase in $args; + do + atf_add_test_case "$testcase" + done + } +} \ No newline at end of file Index: tests/sys/netpfil/common/utils.subr =================================================================== --- /dev/null +++ tests/sys/netpfil/common/utils.subr @@ -0,0 +1,132 @@ +#- +# Copyright (c) 2019 Ahsan Barkati +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +# Utility functions +## + +. $(atf_get_srcdir)/../../common/vnet.subr + +pf_init() +{ + vnet_init + + if [ ! -c /dev/pf ]; then + atf_skip "This test requires pf" + fi +} + +ipfw_init() +{ + vnet_init + + if ! kldstat -q -m ipfw; then + atf_skip "This test requires ipfw" + fi +} + +ipf_init() +{ + vnet_init + + if [ ! -c /dev/ipl ]; then + atf_skip "This test requires ipf" + fi +} + +pf_nat_init() +{ + pf_init +} + +ipfw_nat_init() +{ + ipfw_init + if ! kldstat -q -m ipfw_nat; then + atf_skip "This test requires ipfw_nat" + fi +} + +ipfnat_nat_init() +{ + ipf_init +} + +firewall_config() +{ + jname=$1 + shift + fw=$1 + shift + + while [ $# -gt 0 ]; do + if [ "$1" = "pf" -o "$1" = "ipfw" -o "$1" = "ipf" -o "$1" = "ipfnat" ]; + then + current_fw="$1" + shift + filename=${current_fw}.rule + cwd=$(pwd) + + if [ -f ${current_fw}.rule ]; + then + rm ${current_fw}.rule + fi + + fi + rule=$1 + echo $rule >> $filename + shift + done + + if [ ${fw} == "ipfw" ]; + then + ipfw_init + jexec ${jname} ipfw -q -f flush + jexec ${jname} /bin/sh $cwd/ipfw.rule + + elif [ ${fw} == "pf" ]; + then + pf_init + jexec ${jname} pfctl -e + jexec ${jname} pfctl -F all + jexec ${jname} pfctl -f $cwd/pf.rule + elif [ ${fw} == "ipf" ]; + then + ipf_init + jexec ${jname} service ipfilter start + jexec ${jname} ipf -Fa -f $cwd/ipf.rule + else + ipf_init + jexec ${jname} service ipfilter start + jexec ${jname} ipnat -CF -f $cwd/ipfnat.rule + fi +} + +firewall_cleanup() +{ + vnet_cleanup +} \ No newline at end of file