Changeset View
Changeset View
Standalone View
Standalone View
tests/sys/netpfil/pf/nat.sh
Show First 20 Lines • Show All 106 Lines • ▼ Show 20 Lines | nested_anchor_body() | ||||
nat-anchor \"bar\" all { | nat-anchor \"bar\" all { | ||||
nat on ${epair}a all -> (${epair}a) round-robin | nat on ${epair}a all -> (${epair}a) round-robin | ||||
} | } | ||||
} | } | ||||
" jexec nat pfctl -sn -a "*" | " jexec nat pfctl -sn -a "*" | ||||
} | } | ||||
atf_test_case "endpoint_independent" "cleanup" | |||||
endpoint_independent_head() | |||||
{ | |||||
atf_set descr 'Test that a client behind NAT gets the same external IP:port for different servers' | |||||
atf_set require.user root | |||||
} | |||||
endpoint_independent_body() | |||||
{ | |||||
pft_init | |||||
epair_client=$(vnet_mkepair) | |||||
epair_nat=$(vnet_mkepair) | |||||
epair_server1=$(vnet_mkepair) | |||||
epair_server2=$(vnet_mkepair) | |||||
bridge=$(vnet_mkbridge) | |||||
vnet_mkjail nat ${epair_client}b ${epair_nat}a | |||||
vnet_mkjail client ${epair_client}a | |||||
vnet_mkjail server1 ${epair_server1}a | |||||
vnet_mkjail server2 ${epair_server2}a | |||||
ifconfig ${epair_server1}b up | |||||
ifconfig ${epair_server2}b up | |||||
ifconfig ${epair_nat}b up | |||||
ifconfig ${bridge} \ | |||||
addm ${epair_server1}b \ | |||||
addm ${epair_server2}b \ | |||||
addm ${epair_nat}b \ | |||||
up | |||||
jexec nat ifconfig ${epair_client}b 192.0.2.1/24 up | |||||
jexec nat ifconfig ${epair_nat}a 10.42.42.42/8 up | |||||
kp: Ideally use a documentation/test subnet here, so 198.51.100.0/24 or 203.0.113.0/24 | |||||
jexec nat sysctl net.inet.ip.forwarding=1 | |||||
Not Done Inline ActionsTEST-NET-2 is 198.51.100.0/24, not 192.51.100.0/24. kp: TEST-NET-2 is 198.51.100.0/24, not 192.51.100.0/24. | |||||
jexec client ifconfig ${epair_client}a 192.0.2.2/24 up | |||||
jexec client route add default 192.0.2.1 | |||||
jexec server1 ifconfig ${epair_server1}a 10.32.32.32/8 up | |||||
jexec server2 ifconfig ${epair_server2}a 10.22.22.22/8 up | |||||
# Enable pf! | |||||
jexec nat pfctl -e | |||||
# validate non-endpoint independent nat rule behaviour | |||||
pft_set_rules nat \ | |||||
"nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a)" | |||||
jexec server1 nc -u -l 1234 -v 2> server1.out & | |||||
Done Inline ActionsI've been poking the test failure a bit, and it looks like there's some buffering going on on the receive side, and that's causing the test to fail. I wonder if it wouldn't be better to just use tcpdump on the receive side. That'll also show us the port numbers. There are a few other test cases that use tcpdump with --immediate-mode to get immediate output, rather than have to deal with buffering. kp: I've been poking the test failure a bit, and it looks like there's some buffering going on on… | |||||
server1pid="$!" | |||||
jexec server2 nc -u -l 1234 -v 2> server2.out & | |||||
server2pid="$!" | |||||
# send out three packets because sometimes one fails to go through | |||||
for i in $(seq 1 3); do | |||||
echo "ping" | jexec client nc -u 10.32.32.32 1234 -p 4242 -w 0 | |||||
echo "ping" | jexec client nc -u 10.22.22.22 1234 -p 4242 -w 0 | |||||
done | |||||
ipport_server1=$(cat server1.out | grep Connection) | |||||
ipport_server2=$(cat server2.out | grep Connection) | |||||
if [ -z "$ipport_server1" ]; then | |||||
atf_fail "server1 did not receive connection from client (default)" | |||||
fi | |||||
if [ -z "$ipport_server2" ]; then | |||||
atf_fail "server2 did not receive connection from client (default)" | |||||
fi | |||||
if [ "$ipport_server1" = "$ipport_server2" ]; then | |||||
echo "server1: $ipport_server1" | |||||
echo "server2: $ipport_server2" | |||||
atf_fail "Received same IP:port on server1 and server2 (default)" | |||||
fi | |||||
kill $server1pid | |||||
kill $server2pid | |||||
# validate endpoint independent nat rule behaviour | |||||
pft_set_rules nat \ | |||||
"nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a) endpoint-independent" | |||||
jexec server1 nc -u -l 1234 -v 2> server1.out & | |||||
server1pid="$!" | |||||
jexec server2 nc -u -l 1234 -v 2> server2.out & | |||||
server2pid="$!" | |||||
# send out three packets because sometimes one fails to go through | |||||
for i in $(seq 1 3); do | |||||
echo "ping" | jexec client nc -u 10.32.32.32 1234 -p 4242 -w 0 | |||||
echo "ping" | jexec client nc -u 10.22.22.22 1234 -p 4242 -w 0 | |||||
done | |||||
ipport_server1=$(cat server1.out | grep Connection) | |||||
ipport_server2=$(cat server2.out | grep Connection) | |||||
if [ -z "$ipport_server1" ]; then | |||||
atf_fail "server1 did not receive connection from client (endpoint-independent)" | |||||
fi | |||||
if [ -z "$ipport_server2" ]; then | |||||
atf_fail "server2 did not receive connection from client (endpoint-independent)" | |||||
fi | |||||
if [ ! "$ipport_server1" = "$ipport_server2" ]; then | |||||
echo "server1: $ipport_server1" | |||||
echo "server2: $ipport_server2" | |||||
atf_fail "Received different IP:port on server1 than server2 (endpoint-independent)" | |||||
fi | |||||
kill $server1pid | |||||
kill $server2pid | |||||
} | |||||
endpoint_independent_cleanup() | |||||
{ | |||||
pft_cleanup | |||||
rm -f server1.out | |||||
rm -f server2.out | |||||
} | |||||
nested_anchor_cleanup() | nested_anchor_cleanup() | ||||
{ | { | ||||
pft_cleanup | pft_cleanup | ||||
} | } | ||||
atf_init_test_cases() | atf_init_test_cases() | ||||
{ | { | ||||
atf_add_test_case "exhaust" | atf_add_test_case "exhaust" | ||||
atf_add_test_case "nested_anchor" | atf_add_test_case "nested_anchor" | ||||
atf_add_test_case "endpoint_independent" | |||||
} | } |
Ideally use a documentation/test subnet here, so 198.51.100.0/24 or 203.0.113.0/24