Differential D21305

Add set ToS test for ipfw and pf
ClosedPublic
Actions

Authored by ahsanb on Aug 17 2019, 2:31 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Tue, Apr 8, 1:31 PM

	Unknown Object (File)
	Sat, Apr 5, 3:43 AM

	Unknown Object (File)
	Tue, Apr 1, 11:28 PM

	Unknown Object (File)
	Fri, Mar 28, 8:26 PM

	Unknown Object (File)
	Feb 20 2025, 3:08 PM

	Unknown Object (File)
	Feb 18 2025, 7:14 AM

	Unknown Object (File)
	Feb 2 2025, 4:25 AM

	Unknown Object (File)
	Jan 25 2025, 10:43 AM

Subscribers

Details

Reviewers

kp
thj

Commits

rGcacf2d4beb4e: netpfil tests: Add the set ToS test for ipfw and pf
rS351248: netpfil tests: Add the set ToS test for ipfw and pf

Summary

Add the set ToS test for ipfw and pf. This test tests the following:

The firewall is able to set the tos bits
The firewall is able to set the DSCP bits when EN bits is already set and the EN bits remains unchanged.
The firewall is able to drop the packets based on ToS value

Note: This diff must be applied after applying D21276

Diff Detail

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

ahsanb created this revision.Aug 17 2019, 2:31 PM

ahsanb edited the summary of this revision. (Show Details)

ahsanb mentioned this in D21307: Add too many fragments test for pf, ipfw and ipf.Aug 17 2019, 5:46 PM

thj added inline comments.Aug 18 2019, 6:05 PM

tests/sys/netpfil/common/tos.sh
65	Can you wrap this comment and the two below so that there lines don't wrap? This one might be fine, but the one below is probably too long

wrap the comments

This revision was not accepted when it landed; it landed in state Needs Review.Aug 20 2019, 2:31 PM

Closed by commit rS351248: netpfil tests: Add the set ToS test for ipfw and pf (authored by kp). · Explain Why

This revision was automatically updated to reflect the committed changes.

kp added a commit: rS351248: netpfil tests: Add the set ToS test for ipfw and pf.

Herald added a subscriber: imp. · View Herald TranscriptAug 20 2019, 2:31 PM

kp added a commit: rGcacf2d4beb4e: netpfil tests: Add the set ToS test for ipfw and pf.Sep 14 2021, 8:03 PM

Herald added a subscriber: melifaro. · View Herald TranscriptSep 14 2021, 8:03 PM

Revision Contents
Changeset List

Path

Size

tests/

sys/

netpfil/

common/

3 lines

118 lines

Diff 60972

tests/sys/netpfil/common/Makefile

Context not available.

	ATF_TESTS_SH+= \			ATF_TESTS_SH+= \
	pass_block \			pass_block \
	nat			nat \
				tos

	${PACKAGE}FILES+= \			${PACKAGE}FILES+= \
	utils.subr \			utils.subr \
Context not available.

tests/sys/netpfil/common/tos.sh

This file was added.

				#-
				# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
				#
				# Copyright (c) 2019 Ahsan Barkati
				#
				# Redistribution and use in source and binary forms, with or without
				# modification, are permitted provided that the following conditions
				# are met:
				# 1. Redistributions of source code must retain the above copyright
				# notice, this list of conditions and the following disclaimer.
				# 2. Redistributions in binary form must reproduce the above copyright
				# notice, this list of conditions and the following disclaimer in the
				# documentation and/or other materials provided with the distribution.
				#
				# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
				# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
				# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
				# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
				# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
				# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
				# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
				# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
				# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
				# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
				# SUCH DAMAGE.
				#
				# $FreeBSD$
				#

				. $(atf_get_srcdir)/utils.subr
				. $(atf_get_srcdir)/runner.subr

				tos_head()
				{
				atf_set descr 'set-tos test'
				atf_set require.user root
				atf_set require.progs scapy
				}

				tos_body()
				{
				firewall=$1
				firewall_init $firewall

				epair_send=$(vnet_mkepair)
				ifconfig ${epair_send}a 192.0.2.1/24 up

				epair_recv=$(vnet_mkepair)
				ifconfig ${epair_recv}a up

				vnet_mkjail iron ${epair_send}b ${epair_recv}b
				jexec iron ifconfig ${epair_send}b 192.0.2.2/24 up
				jexec iron ifconfig ${epair_recv}b 198.51.100.2/24 up
				jexec iron sysctl net.inet.ip.forwarding=1
				jexec iron arp -s 198.51.100.3 00:01:02:03:04:05
				route add -net 198.51.100.0/24 192.0.2.2

				# Check if the firewall is able to set the ToS bits
				firewall_config "iron" ${firewall} \
				"pf" \
				"scrub out proto icmp set-tos 36" \
				"ipfw" \
				"ipfw -q add 100 setdscp 9 ip from any to any"
				# dscp is set to 9 because last two bits are for
				# EN and hence tos would be 36
				thjUnsubmitted Not Done Inline Actions Can you wrap this comment and the two below so that there lines don't wrap? This one might be fine, but the one below is probably too long thj: Can you wrap this comment and the two below so that there lines don't wrap? This one might be…

				atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
				--sendif ${epair_send}a \
				--to 198.51.100.3 \
				--recvif ${epair_recv}a \
				--expect-tos 36

				# Check if the firewall is able to set the ToS bits
				# and persists the EN bits (if already set)
				firewall_config "iron" ${firewall} \
				"pf" \
				"scrub out proto icmp set-tos 36" \
				"ipfw" \
				"ipfw -q add 100 setdscp 9 ip from any to any"

				atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
				--sendif ${epair_send}a \
				--to 198.51.100.3 \
				--recvif ${epair_recv}a \
				--send-tos 3 \
				--expect-tos 39

				# Check if the firewall is able to filter the
				# packets based on the ToS value
				firewall_config "iron" ${firewall} \
				"pf" \
				"block all tos 36" \
				"ipfw" \
				"ipfw -q add 100 deny all from any to any dscp 9"

				atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
				--sendif ${epair_send}a \
				--to 198.51.100.3 \
				--recvif ${epair_recv}a \
				--send-tos 36

				atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
				--sendif ${epair_send}a \
				--to 198.51.100.3 \
				--recvif ${epair_recv}a \
				--send-tos 32
				}

				tos_cleanup()
				{
				firewall=$1
				firewall_cleanup $firewall
				}

				setup_tests \
				"tos" \
				"pf" \
				"ipfw"
				No newline at end of file