Page MenuHomeFreeBSD
Files F161463903

D21065.id60145.diff
No OneTemporary
Actions

D21065.id60145.diff
View Options

Index: tests/sys/netpfil/Makefile
===================================================================
--- tests/sys/netpfil/Makefile
+++ tests/sys/netpfil/Makefile
@@ -5,7 +5,11 @@
TESTSDIR= ${TESTSBASE}/sys/netpfil
.if ${MK_PF} != "no"
-TESTS_SUBDIRS+= pf
+TESTS_SUBDIRS+= pf \
+ common \
+
.endif
+
+
.include <bsd.test.mk>
Index: tests/sys/netpfil/common/Makefile
===================================================================
--- /dev/null
+++ tests/sys/netpfil/common/Makefile
@@ -0,0 +1,13 @@
+# $FreeBSD$
+
+PACKAGE= tests
+
+TESTSDIR= ${TESTSBASE}/sys/netpfil/common
+
+
+ATF_TESTS_SH+= pass_block \
+
+${PACKAGE}FILES+= utils.subr \
+ runner.subr \
+
+.include <bsd.test.mk>
Index: tests/sys/netpfil/common/pass_block.sh
===================================================================
--- /dev/null
+++ tests/sys/netpfil/common/pass_block.sh
@@ -0,0 +1,127 @@
+#-
+# Copyright (c) 2019 Ahsan Barkati
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in the
+# documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# SUCH DAMAGE.
+#
+# $FreeBSD$
+#
+
+
+. $(atf_get_srcdir)/utils.subr
+. $(atf_get_srcdir)/runner.subr
+
+v4_head()
+{
+ atf_set require.user root
+}
+
+v4_body()
+{
+ firewall=$1
+ ${firewall}_init
+
+ epair=$(vnet_mkepair)
+ ifconfig ${epair}a 192.0.2.1/24 up
+ vnet_mkjail iron ${epair}b
+ jexec iron ifconfig ${epair}b 192.0.2.2/24 up
+
+ # Block All
+ firewall_config "iron" ${firewall} \
+ "pf" \
+ "block in" \
+ "ipfw" \
+ "ipfw -q add 100 deny all from any to any" \
+ "ipf" \
+ "block in all" \
+
+ atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.2
+
+ # Pass All
+ firewall_config "iron" ${firewall} \
+ "pf" \
+ "pass in" \
+ "ipfw" \
+ "ipfw -q add 100 allow all from any to any" \
+ "ipf" \
+ "pass in all" \
+
+ atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2
+}
+
+v4_cleanup()
+{
+ firewall_cleanup
+}
+
+v6_head()
+{
+ atf_set require.user root
+}
+
+v6_body()
+{
+ firewall=$1
+ ${firewall}_init
+
+ epair=$(vnet_mkepair)
+ ifconfig ${epair}a inet6 2001:db8:42::1/64 up no_dad
+
+ vnet_mkjail iron ${epair}b
+ jexec iron ifconfig ${epair}b inet6 2001:db8:42::2/64 up no_dad
+
+ # Block All
+ firewall_config "iron" ${firewall} \
+ "pf" \
+ "block in" \
+ "ipfw" \
+ "ipfw -q add 100 deny all from any to any" \
+ "ipf" \
+ "block in all" \
+
+ atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
+
+ # Pass All
+ firewall_config "iron" ${firewall} \
+ "pf" \
+ "pass in" \
+ "ipfw" \
+ "ipfw -q add 100 allow all from any to any" \
+ "ipf" \
+ "pass in all" \
+
+ atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
+}
+
+v6_cleanup()
+{
+ firewall_cleanup
+}
+
+setup_tests "v4" \
+ "pf" \
+ "ipfw" \
+ "ipf" \
+ "v6" \
+ "pf" \
+ "ipfw" \
+ "ipf"\
Index: tests/sys/netpfil/common/runner.subr
===================================================================
--- /dev/null
+++ tests/sys/netpfil/common/runner.subr
@@ -0,0 +1,61 @@
+#
+# Copyright (c) 2019 Ahsan Barkati
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in the
+# documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# SUCH DAMAGE.
+#
+# $FreeBSD$
+#
+
+setup_tests()
+{
+ tests=""
+ while [ $# -gt 0 ];do
+ if [ "$1" = "pf" -o "$1" = "ipf" -o "$1" = "ipfw" -o "$1" = "ipfnat" ];
+ then
+ fw=$1
+ shift
+ atf_test_case "${fw}_${testcase}" "cleanup"
+ eval "${fw}_${testcase}_head(){ ${testcase}_head; }"
+ eval "${fw}_${testcase}_body(){ ${testcase}_body $fw; }"
+ eval "${fw}_${testcase}_cleanup(){ ${testcase}_cleanup; }"
+ tests="$tests ${fw}_${testcase}"
+ else
+ testcase=$1
+ shift
+ fi
+ done
+ init_testcases $tests
+}
+
+
+init_testcases()
+{
+ args="$@"
+ atf_init_test_cases()
+ {
+ for testcase in $args;
+ do
+ atf_add_test_case "$testcase"
+ done
+ }
+}
\ No newline at end of file
Index: tests/sys/netpfil/common/utils.subr
===================================================================
--- /dev/null
+++ tests/sys/netpfil/common/utils.subr
@@ -0,0 +1,132 @@
+#-
+# Copyright (c) 2019 Ahsan Barkati
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in the
+# documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# SUCH DAMAGE.
+#
+# $FreeBSD$
+#
+
+# Utility functions
+##
+
+. $(atf_get_srcdir)/../../common/vnet.subr
+
+pf_init()
+{
+ vnet_init
+
+ if [ ! -c /dev/pf ]; then
+ atf_skip "This test requires pf"
+ fi
+}
+
+ipfw_init()
+{
+ vnet_init
+
+ if ! kldstat -q -m ipfw; then
+ atf_skip "This test requires ipfw"
+ fi
+}
+
+ipf_init()
+{
+ vnet_init
+
+ if [ ! -c /dev/ipl ]; then
+ atf_skip "This test requires ipf"
+ fi
+}
+
+pf_nat_init()
+{
+ pf_init
+}
+
+ipfw_nat_init()
+{
+ ipfw_init
+ if ! kldstat -q -m ipfw_nat; then
+ atf_skip "This test requires ipfw_nat"
+ fi
+}
+
+ipfnat_nat_init()
+{
+ ipf_init
+}
+
+firewall_config()
+{
+ jname=$1
+ shift
+ fw=$1
+ shift
+
+ while [ $# -gt 0 ]; do
+ if [ "$1" = "pf" -o "$1" = "ipfw" -o "$1" = "ipf" -o "$1" = "ipfnat" ];
+ then
+ current_fw="$1"
+ shift
+ filename=${current_fw}.rule
+ cwd=$(pwd)
+
+ if [ -f ${current_fw}.rule ];
+ then
+ rm ${current_fw}.rule
+ fi
+
+ fi
+ rule=$1
+ echo $rule >> $filename
+ shift
+ done
+
+ if [ ${fw} == "ipfw" ];
+ then
+ ipfw_init
+ jexec ${jname} ipfw -q -f flush
+ jexec ${jname} /bin/sh $cwd/ipfw.rule
+
+ elif [ ${fw} == "pf" ];
+ then
+ pf_init
+ jexec ${jname} pfctl -e
+ jexec ${jname} pfctl -F all
+ jexec ${jname} pfctl -f $cwd/pf.rule
+ elif [ ${fw} == "ipf" ];
+ then
+ ipf_init
+ jexec ${jname} service ipfilter start
+ jexec ${jname} ipf -Fa -f $cwd/ipf.rule
+ else
+ ipf_init
+ jexec ${jname} service ipfilter start
+ jexec ${jname} ipnat -CF -f $cwd/ipfnat.rule
+ fi
+}
+
+firewall_cleanup()
+{
+ vnet_cleanup
+}
\ No newline at end of file

File Metadata

Mime Type
text/plain
Expires
Sun, Jul 5, 1:31 AM (12 h, 53 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
34649853
Default Alt Text
D21065.id60145.diff (9 KB)

Event Timeline