Differential D12580 Diff 33777 tests/sys/netpfil/pf/pass_block.sh

Changeset View

Standalone View

tests/sys/netpfil/pf/pass_block.sh

This file was added.

				# $FreeBSD$

				. $(atf_get_srcdir)/utils.subr

				atf_test_case "v4" "cleanup"
				v4_head()
				asomersUnsubmitted Done Inline Actions Conventionally, this function goes at the end of the file. asomers: Conventionally, this function goes at the end of the file.
				{
				atf_set descr 'Basic pass/block test for IPv4'
				atf_set require.user root
				}

				v4_body()
				{
				pft_init

				epair=$(pft_mkepair)
				ifconfig ${epair}a 192.0.2.1/24 up

				# Set up a simple jail with one interface
				pft_mkjail alcatraz ${epair}b
				jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up

				# Trivial ping to the jail, without pf
				atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2
				asomersUnsubmitted Done Inline Actions This could potentially conflict with a real interface. For other tests, I've used the 192.0.2.0/24 network, which is reserved for documentation per RFC5737. asomers: This could potentially conflict with a real interface. For other tests, I've used the 192.0.2.

				# pf without policy will let us ping
				jexec alcatraz pfctl -e
				atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2

				# Block everything
				printf "block in\n" \| jexec alcatraz pfctl -f -
				atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.2

				# Block everything but ICMP
				printf "block in\npass in proto icmp\n" \| jexec alcatraz pfctl -f -
				atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2
				}

				v4_cleanup()
				{
				pft_cleanup
				}

				atf_test_case "v6" "cleanup"
				v6_head()
				{
				atf_set descr 'Basic pass/block test for IPv6'
				atf_set require.user root
				}

				v6_body()
				{
				pft_init

				epair=$(pft_mkepair)
				ifconfig ${epair}a inet6 2001:db8:42::1/64 up no_dad

				# Set up a simple jail with one interface
				pft_mkjail alcatraz ${epair}b
				jexec alcatraz ifconfig ${epair}b inet6 2001:db8:42::2/64 up no_dad

				# Trivial ping to the jail, without pf
				atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2

				# pf without policy will let us ping
				jexec alcatraz pfctl -e
				atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2

				# Block everything
				printf "block in\n" \| jexec alcatraz pfctl -f -
				philipUnsubmitted Done Inline Actions Ugh... Is 1 second long enough when you're spinning up lots of jails at the same time? Might be worth wrapping this in a loop that checks if the address actually got assigned to avoid surprising test failures. philip: Ugh... Is 1 second long enough when you're spinning up lots of jails at the same time? Might…
				asomersUnsubmitted Done Inline Actions Try passing `no_dad` to ifconfig. That might eliminate the need for the sleep. asomers: Try passing `no_dad` to ifconfig. That might eliminate the need for the sleep.
				atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2

				# Block everything but ICMP
				printf "block in\npass in proto icmp6\n" \| jexec alcatraz pfctl -f -
				atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2

				# Allowing ICMPv4 does not allow ICMPv6
				printf "block in\npass in proto icmp\n" \| jexec alcatraz pfctl -f -
				atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
				}

				v6_cleanup()
				{
				pft_cleanup
				}

				atf_init_test_cases()
				{
				atf_add_test_case "v4"
				atf_add_test_case "v6"
				}