Changeset View
Changeset View
Standalone View
Standalone View
tests/sys/netpfil/pf/ether.sh
| Show First 20 Lines • Show All 127 Lines • ▼ Show 20 Lines | proto_body() | ||||
| atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.2 | atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.2 | ||||
| } | } | ||||
| proto_cleanup() | proto_cleanup() | ||||
| { | { | ||||
| pft_cleanup | pft_cleanup | ||||
| } | } | ||||
| atf_test_case "captive" "cleanup" | |||||
| captive_head() | |||||
| { | |||||
| atf_set descr 'Test a basic captive portal-like setup' | |||||
| atf_set require.user root | |||||
| } | |||||
| captive_body() | |||||
| { | |||||
| # Host is client, jail 'gw' is the captive portal gateway, jail 'srv' | |||||
| # is a random (web)server. We use the echo protocol rather than http | |||||
| # for the test, because that's easier. | |||||
| pft_init | |||||
| epair_gw=$(vnet_mkepair) | |||||
| epair_srv=$(vnet_mkepair) | |||||
| epair_gw_a_mac=$(ifconfig ${epair_gw}a ether | awk '/ether/ { print $2; }') | |||||
| vnet_mkjail gw ${epair_gw}b ${epair_srv}a | |||||
| vnet_mkjail srv ${epair_srv}b | |||||
| ifconfig ${epair_gw}a 192.0.2.2/24 up | |||||
| route add -net 198.51.100.0/24 192.0.2.1 | |||||
| jexec gw ifconfig ${epair_gw}b 192.0.2.1/24 up | |||||
| jexec gw ifconfig lo0 127.0.0.1/8 up | |||||
| jexec gw sysctl net.inet.ip.forwarding=1 | |||||
| jexec gw ifconfig ${epair_srv}a 198.51.100.1/24 up | |||||
| jexec srv ifconfig ${epair_srv}b 198.51.100.2/24 up | |||||
| jexec srv route add -net 192.0.2.0/24 198.51.100.1 | |||||
| # Sanity check | |||||
| atf_check -s exit:0 -o ignore ping -c 1 -t 1 198.51.100.2 | |||||
| pft_set_rules gw \ | |||||
| "ether pass quick proto 0x0806" \ | |||||
| "ether pass tag captive" \ | |||||
| "rdr on ${epair_gw}b proto tcp to port echo tagged captive -> 127.0.0.1 port echo" | |||||
| jexec gw pfctl -e | |||||
| # ICMP should still work, because we don't redirect it. | |||||
| atf_check -s exit:0 -o ignore ping -c 1 -t 1 198.51.100.2 | |||||
| # Run the echo server only on the gw, so we know we've redirectly | |||||
| # correctly if we get an echo message. | |||||
| jexec gw /usr/sbin/inetd $(atf_get_srcdir)/echo_inetd.conf | |||||
| # Confirm that we're getting redirected | |||||
| atf_check -s exit:0 -o match:"^foo$" -x "echo foo | nc -N 198.51.100.2 7" | |||||
| jexec gw killall inetd | |||||
| # Now pretend we've authenticated, so add the client's MAC address | |||||
| pft_set_rules gw \ | |||||
| "ether pass quick proto 0x0806" \ | |||||
| "ether pass quick from ${epair_gw_a_mac}" \ | |||||
| "ether pass tag captive" \ | |||||
| "rdr on ${epair_gw}b proto tcp to port echo tagged captive -> 127.0.0.1 port echo" | |||||
| # No redirect, so failure. | |||||
| atf_check -s exit:1 -x "echo foo | nc -N 198.51.100.2 7" | |||||
| # Start a server in srv | |||||
| jexec srv /usr/sbin/inetd $(atf_get_srcdir)/echo_inetd.conf | |||||
| # And now we can talk to that one. | |||||
| atf_check -s exit:0 -o match:"^foo$" -x "echo foo | nc -N 198.51.100.2 7" | |||||
| } | |||||
| captive_cleanup() | |||||
| { | |||||
| pft_cleanup | |||||
| } | |||||
| atf_init_test_cases() | atf_init_test_cases() | ||||
| { | { | ||||
| atf_add_test_case "mac" | atf_add_test_case "mac" | ||||
| atf_add_test_case "proto" | atf_add_test_case "proto" | ||||
| atf_add_test_case "captive" | |||||
| } | } | ||||