Page MenuHomeFreeBSD
Differential D21276 Diff 60885 tests/sys/netpfil/pf/forward.sh

Changeset View

Standalone View

View Options

tests/sys/netpfil/pf/forward.sh

Context not available.
. $(atf_get_srcdir)/utils.subr . $(atf_get_srcdir)/utils.subr
common_dir=$(atf_get_srcdir)/../common
atf_test_case "v4" "cleanup" atf_test_case "v4" "cleanup"
v4_head() v4_head()
{ {
Context not available.
# Forward with pf enabled # Forward with pf enabled
pft_set_rules alcatraz "block in" pft_set_rules alcatraz "block in"
atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \ atf_check -s exit:1 ${common_dir}/pft_ping.py \
kpUnsubmitted
Not Done
Inline Actions

I'd do ${common_dir}/pft_ping.py, if only for consistency.

kp: I'd do `${common_dir}/pft_ping.py`, if only for consistency.
--sendif ${epair_send}a \ --sendif ${epair_send}a \
--to 198.51.100.3 \ --to 198.51.100.3 \
--recvif ${epair_recv}a --recvif ${epair_recv}a
pft_set_rules alcatraz "block out" pft_set_rules alcatraz "block out"
atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \ atf_check -s exit:1 ${common_dir}/pft_ping.py \
--sendif ${epair_send}a \ --sendif ${epair_send}a \
--to 198.51.100.3 \ --to 198.51.100.3 \
--recv ${epair_recv}a --recv ${epair_recv}a
# Allow ICMP # Allow ICMP
pft_set_rules alcatraz "block in" "pass in proto icmp" pft_set_rules alcatraz "block in" "pass in proto icmp"
atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \ atf_check -s exit:0 ${common_dir}/pft_ping.py \
--sendif ${epair_send}a \ --sendif ${epair_send}a \
--to 198.51.100.3 \ --to 198.51.100.3 \
--recvif ${epair_recv}a --recvif ${epair_recv}a
Context not available.
route add -6 2001:db8:43::/64 2001:db8:42::2 route add -6 2001:db8:43::/64 2001:db8:42::2
# Sanity check, can we forward ICMP echo requests without pf? # Sanity check, can we forward ICMP echo requests without pf?
atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \ atf_check -s exit:0 ${common_dir}/pft_ping.py \
--ip6 \ --ip6 \
--sendif ${epair_send}a \ --sendif ${epair_send}a \
--to 2001:db8:43::3 \ --to 2001:db8:43::3 \
Context not available.
# Block incoming echo request packets # Block incoming echo request packets
pft_set_rules alcatraz \ pft_set_rules alcatraz \
"block in inet6 proto icmp6 icmp6-type echoreq" "block in inet6 proto icmp6 icmp6-type echoreq"
atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \ atf_check -s exit:1 ${common_dir}/pft_ping.py \
--ip6 \ --ip6 \
--sendif ${epair_send}a \ --sendif ${epair_send}a \
--to 2001:db8:43::3 \ --to 2001:db8:43::3 \
Context not available.
# Block outgoing echo request packets # Block outgoing echo request packets
pft_set_rules alcatraz \ pft_set_rules alcatraz \
"block out inet6 proto icmp6 icmp6-type echoreq" "block out inet6 proto icmp6 icmp6-type echoreq"
atf_check -s exit:1 -e ignore $(atf_get_srcdir)/pft_ping.py \ atf_check -s exit:1 -e ignore ${common_dir}/pft_ping.py \
--ip6 \ --ip6 \
--sendif ${epair_send}a \ --sendif ${epair_send}a \
--to 2001:db8:43::3 \ --to 2001:db8:43::3 \
Context not available.
pft_set_rules alcatraz \ pft_set_rules alcatraz \
"block out" \ "block out" \
"pass out inet6 proto icmp6" "pass out inet6 proto icmp6"
atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \ atf_check -s exit:0 ${common_dir}/pft_ping.py \
--ip6 \ --ip6 \
--sendif ${epair_send}a \ --sendif ${epair_send}a \
--to 2001:db8:43::3 \ --to 2001:db8:43::3 \
Context not available.
pft_set_rules alcatraz \ pft_set_rules alcatraz \
"block out inet6 proto icmp6 icmp6-type echoreq" \ "block out inet6 proto icmp6 icmp6-type echoreq" \
"pass in proto icmp" "pass in proto icmp"
atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \ atf_check -s exit:1 ${common_dir}/pft_ping.py \
--ip6 \ --ip6 \
--sendif ${epair_send}a \ --sendif ${epair_send}a \
--to 2001:db8:43::3 \ --to 2001:db8:43::3 \
Context not available.