Differential D11137 Diff 142155 tests/sys/netpfil/pf/nat.sh

Changeset View

Standalone View

tests/sys/netpfil/pf/nat.sh

Show First 20 Lines • Show All 106 Lines • ▼ Show 20 Lines	nested_anchor_body()
nat-anchor \"bar\" all {		nat-anchor \"bar\" all {
nat on ${epair}a all -> (${epair}a) round-robin		nat on ${epair}a all -> (${epair}a) round-robin
}		}
}		}
" jexec nat pfctl -sn -a "*"		" jexec nat pfctl -sn -a "*"

}		}

		atf_test_case "endpoint_independent" "cleanup"
		endpoint_independent_head()
		{
		atf_set descr 'Test that a client behind NAT gets the same external IP:port for different servers'
		atf_set require.user root
		}

		endpoint_independent_body()
		{
		pft_init

		epair_client=$(vnet_mkepair)
		epair_nat=$(vnet_mkepair)
		epair_server1=$(vnet_mkepair)
		epair_server2=$(vnet_mkepair)
		bridge=$(vnet_mkbridge)

		vnet_mkjail nat ${epair_client}b ${epair_nat}a
		vnet_mkjail client ${epair_client}a
		vnet_mkjail server1 ${epair_server1}a
		vnet_mkjail server2 ${epair_server2}a

		ifconfig ${epair_server1}b up
		ifconfig ${epair_server2}b up
		ifconfig ${epair_nat}b up
		ifconfig ${bridge} \
		addm ${epair_server1}b \
		addm ${epair_server2}b \
		addm ${epair_nat}b \
		up

		jexec nat ifconfig ${epair_client}b 192.0.2.1/24 up
		jexec nat ifconfig ${epair_nat}a 10.42.42.42/8 up
		kpUnsubmitted Done Inline Actions Ideally use a documentation/test subnet here, so 198.51.100.0/24 or 203.0.113.0/24 kp: Ideally use a documentation/test subnet here, so 198.51.100.0/24 or 203.0.113.0/24
		jexec nat sysctl net.inet.ip.forwarding=1
		kpUnsubmitted Not Done Inline Actions TEST-NET-2 is 198.51.100.0/24, not 192.51.100.0/24. kp: TEST-NET-2 is 198.51.100.0/24, not 192.51.100.0/24.

		jexec client ifconfig ${epair_client}a 192.0.2.2/24 up
		jexec client route add default 192.0.2.1

		jexec server1 ifconfig ${epair_server1}a 10.32.32.32/8 up
		jexec server2 ifconfig ${epair_server2}a 10.22.22.22/8 up

		# Enable pf!
		jexec nat pfctl -e

		# validate non-endpoint independent nat rule behaviour
		pft_set_rules nat \
		"nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a)"

		jexec server1 nc -u -l 1234 -v 2> server1.out &
		kpUnsubmitted Done Inline Actions I've been poking the test failure a bit, and it looks like there's some buffering going on on the receive side, and that's causing the test to fail. I wonder if it wouldn't be better to just use tcpdump on the receive side. That'll also show us the port numbers. There are a few other test cases that use tcpdump with --immediate-mode to get immediate output, rather than have to deal with buffering. kp: I've been poking the test failure a bit, and it looks like there's some buffering going on on…
		server1pid="$!"
		jexec server2 nc -u -l 1234 -v 2> server2.out &
		server2pid="$!"

		# send out three packets because sometimes one fails to go through
		for i in $(seq 1 3); do
		echo "ping" \| jexec client nc -u 10.32.32.32 1234 -p 4242 -w 0
		echo "ping" \| jexec client nc -u 10.22.22.22 1234 -p 4242 -w 0
		done

		ipport_server1=$(cat server1.out \| grep Connection)
		ipport_server2=$(cat server2.out \| grep Connection)

		if [ -z "$ipport_server1" ]; then
		atf_fail "server1 did not receive connection from client (default)"
		fi

		if [ -z "$ipport_server2" ]; then
		atf_fail "server2 did not receive connection from client (default)"
		fi

		if [ "$ipport_server1" = "$ipport_server2" ]; then
		echo "server1: $ipport_server1"
		echo "server2: $ipport_server2"
		atf_fail "Received same IP:port on server1 and server2 (default)"
		fi
		kill $server1pid
		kill $server2pid

		# validate endpoint independent nat rule behaviour
		pft_set_rules nat \
		"nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a) endpoint-independent"

		jexec server1 nc -u -l 1234 -v 2> server1.out &
		server1pid="$!"
		jexec server2 nc -u -l 1234 -v 2> server2.out &
		server2pid="$!"

		# send out three packets because sometimes one fails to go through
		for i in $(seq 1 3); do
		echo "ping" \| jexec client nc -u 10.32.32.32 1234 -p 4242 -w 0
		echo "ping" \| jexec client nc -u 10.22.22.22 1234 -p 4242 -w 0
		done

		ipport_server1=$(cat server1.out \| grep Connection)
		ipport_server2=$(cat server2.out \| grep Connection)

		if [ -z "$ipport_server1" ]; then
		atf_fail "server1 did not receive connection from client (endpoint-independent)"
		fi

		if [ -z "$ipport_server2" ]; then
		atf_fail "server2 did not receive connection from client (endpoint-independent)"
		fi

		if [ ! "$ipport_server1" = "$ipport_server2" ]; then
		echo "server1: $ipport_server1"
		echo "server2: $ipport_server2"
		atf_fail "Received different IP:port on server1 than server2 (endpoint-independent)"
		fi
		kill $server1pid
		kill $server2pid
		}

		endpoint_independent_cleanup()
		{
		pft_cleanup
		rm -f server1.out
		rm -f server2.out
		}

nested_anchor_cleanup()		nested_anchor_cleanup()
{		{
pft_cleanup		pft_cleanup
}		}

atf_init_test_cases()		atf_init_test_cases()
{		{
atf_add_test_case "exhaust"		atf_add_test_case "exhaust"
atf_add_test_case "nested_anchor"		atf_add_test_case "nested_anchor"
}		}