diff --git a/tests/sys/netpfil/pf/nat.sh b/tests/sys/netpfil/pf/nat.sh index 16c981f97399..5ea1dd6d8b2f 100644 --- a/tests/sys/netpfil/pf/nat.sh +++ b/tests/sys/netpfil/pf/nat.sh @@ -1,830 +1,831 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2018 Kristof Provost # Copyright (c) 2025 Kajetan Staszkiewicz # Copyright (c) 2021 KUROSAWA Takahiro # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr atf_test_case "exhaust" "cleanup" exhaust_head() { atf_set descr 'Test exhausting the NAT pool' atf_set require.user root } exhaust_body() { pft_init epair_nat=$(vnet_mkepair) epair_echo=$(vnet_mkepair) vnet_mkjail nat ${epair_nat}b ${epair_echo}a vnet_mkjail echo ${epair_echo}b ifconfig ${epair_nat}a 192.0.2.2/24 up route add -net 198.51.100.0/24 192.0.2.1 jexec nat ifconfig ${epair_nat}b 192.0.2.1/24 up jexec nat ifconfig ${epair_echo}a 198.51.100.1/24 up jexec nat sysctl net.inet.ip.forwarding=1 jexec echo ifconfig ${epair_echo}b 198.51.100.2/24 up jexec echo /usr/sbin/inetd -p ${PWD}/inetd-echo.pid $(atf_get_srcdir)/echo_inetd.conf # Enable pf! jexec nat pfctl -e pft_set_rules nat \ "nat pass on ${epair_echo}a inet from 192.0.2.0/24 to any -> (${epair_echo}a) port 30000:30001 sticky-address" # Sanity check atf_check -s exit:0 -o ignore ping -c 3 198.51.100.2 atf_check -s exit:0 -o match:foo* echo "foo" | nc -N 198.51.100.2 7 atf_check -s exit:0 -o match:foo* echo "foo" | nc -N 198.51.100.2 7 # This one will fail, but that's expected echo "foo" | nc -N 198.51.100.2 7 & sleep 1 # If the kernel is stuck in pf_get_sport() this will not succeed either. timeout 2 jexec nat pfctl -sa if [ $? -eq 124 ]; then # Timed out atf_fail "pfctl timeout" fi } exhaust_cleanup() { pft_cleanup } atf_test_case "nested_anchor" "cleanup" nested_anchor_head() { atf_set descr 'Test setting and retrieving nested nat anchors' atf_set require.user root } nested_anchor_body() { pft_init epair=$(vnet_mkepair) vnet_mkjail nat ${epair}a pft_set_rules nat \ "nat-anchor \"foo\"" echo "nat-anchor \"bar\"" | jexec nat pfctl -g -a foo -f - echo "nat on ${epair}a from any to any -> (${epair}a)" | jexec nat pfctl -g -a "foo/bar" -f - atf_check -s exit:0 -o inline:"nat-anchor \"foo\" all { nat-anchor \"bar\" all { nat on ${epair}a all -> (${epair}a) round-robin } } " jexec nat pfctl -sn -a "*" } endpoint_independent_setup() { pft_init filter="udp and dst port 1234" # only capture udp pings epair_client=$(vnet_mkepair) epair_nat=$(vnet_mkepair) epair_server1=$(vnet_mkepair) epair_server2=$(vnet_mkepair) bridge=$(vnet_mkbridge) vnet_mkjail nat ${epair_client}b ${epair_nat}a vnet_mkjail client ${epair_client}a vnet_mkjail server1 ${epair_server1}a vnet_mkjail server2 ${epair_server2}a ifconfig ${epair_server1}b up ifconfig ${epair_server2}b up ifconfig ${epair_nat}b up ifconfig ${bridge} \ addm ${epair_server1}b \ addm ${epair_server2}b \ addm ${epair_nat}b \ up jexec nat ifconfig ${epair_client}b 192.0.2.1/24 up jexec nat ifconfig ${epair_nat}a 198.51.100.42/24 up jexec nat sysctl net.inet.ip.forwarding=1 jexec client ifconfig ${epair_client}a 192.0.2.2/24 up jexec client route add default 192.0.2.1 jexec server1 ifconfig ${epair_server1}a 198.51.100.32/24 up jexec server2 ifconfig ${epair_server2}a 198.51.100.22/24 up } endpoint_independent_common() { # Enable pf! jexec nat pfctl -e # validate non-endpoint independent nat rule behaviour pft_set_rules nat "${1}" jexec server1 tcpdump -i ${epair_server1}a -w ${PWD}/server1.pcap \ --immediate-mode $filter & server1tcppid="$!" jexec server2 tcpdump -i ${epair_server2}a -w ${PWD}/server2.pcap \ --immediate-mode $filter & server2tcppid="$!" # send out multiple packets for i in $(seq 1 10); do echo "ping" | jexec client nc -u 198.51.100.32 1234 -p 4242 -w 0 echo "ping" | jexec client nc -u 198.51.100.22 1234 -p 4242 -w 0 done kill $server1tcppid kill $server2tcppid tuple_server1=$(tcpdump -r ${PWD}/server1.pcap | awk '{addr=$3} END {print addr}') tuple_server2=$(tcpdump -r ${PWD}/server2.pcap | awk '{addr=$3} END {print addr}') if [ -z $tuple_server1 ] then atf_fail "server1 did not receive connection from client (default)" fi if [ -z $tuple_server2 ] then atf_fail "server2 did not receive connection from client (default)" fi if [ "$tuple_server1" = "$tuple_server2" ] then echo "server1 tcpdump: $tuple_server1" echo "server2 tcpdump: $tuple_server2" atf_fail "Received same IP:port on server1 and server2 (default)" fi # validate endpoint independent nat rule behaviour pft_set_rules nat "${2}" jexec server1 tcpdump -i ${epair_server1}a -w ${PWD}/server1.pcap \ --immediate-mode $filter & server1tcppid="$!" jexec server2 tcpdump -i ${epair_server2}a -w ${PWD}/server2.pcap \ --immediate-mode $filter & server2tcppid="$!" # send out multiple packets, sometimes one fails to go through for i in $(seq 1 10); do echo "ping" | jexec client nc -u 198.51.100.32 1234 -p 4242 -w 0 echo "ping" | jexec client nc -u 198.51.100.22 1234 -p 4242 -w 0 done kill $server1tcppid kill $server2tcppid tuple_server1=$(tcpdump -r ${PWD}/server1.pcap | awk '{addr=$3} END {print addr}') tuple_server2=$(tcpdump -r ${PWD}/server2.pcap | awk '{addr=$3} END {print addr}') if [ -z $tuple_server1 ] then atf_fail "server1 did not receive connection from client (endpoint-independent)" fi if [ -z $tuple_server2 ] then atf_fail "server2 did not receive connection from client (endpoint-independent)" fi if [ ! "$tuple_server1" = "$tuple_server2" ] then echo "server1 tcpdump: $tuple_server1" echo "server2 tcpdump: $tuple_server2" atf_fail "Received different IP:port on server1 than server2 (endpoint-independent)" fi } atf_test_case "endpoint_independent_compat" "cleanup" endpoint_independent_compat_head() { atf_set descr 'Test that a client behind NAT gets the same external IP:port for different servers' atf_set require.user root } endpoint_independent_compat_body() { endpoint_independent_setup # Sets ${epair_…} variables endpoint_independent_common \ "nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a)" \ "nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a) endpoint-independent" } endpoint_independent_compat_cleanup() { pft_cleanup rm -f server1.out rm -f server2.out } atf_test_case "endpoint_independent_pass" "cleanup" endpoint_independent_pass_head() { atf_set descr 'Test that a client behind NAT gets the same external IP:port for different servers' atf_set require.user root } endpoint_independent_pass_body() { endpoint_independent_setup # Sets ${epair_…} variables endpoint_independent_common \ "pass out on ${epair_nat}a inet from ! (${epair_nat}a) to any nat-to (${epair_nat}a) keep state" \ "pass out on ${epair_nat}a inet from ! (${epair_nat}a) to any nat-to (${epair_nat}a) endpoint-independent keep state" } endpoint_independent_pass_cleanup() { pft_cleanup rm -f server1.out rm -f server2.out } nested_anchor_cleanup() { pft_cleanup } atf_test_case "nat6_nolinklocal" "cleanup" nat6_nolinklocal_head() { atf_set descr 'Ensure we do not use link-local addresses' atf_set require.user root } nat6_nolinklocal_body() { pft_init epair_nat=$(vnet_mkepair) epair_echo=$(vnet_mkepair) vnet_mkjail nat ${epair_nat}b ${epair_echo}a vnet_mkjail echo ${epair_echo}b ifconfig ${epair_nat}a inet6 2001:db8::2/64 no_dad up route add -6 -net 2001:db8:1::/64 2001:db8::1 jexec nat ifconfig ${epair_nat}b inet6 2001:db8::1/64 no_dad up jexec nat ifconfig ${epair_echo}a inet6 2001:db8:1::1/64 no_dad up jexec nat sysctl net.inet6.ip6.forwarding=1 jexec echo ifconfig ${epair_echo}b inet6 2001:db8:1::2/64 no_dad up # Ensure we can't reply to link-local pings jexec echo pfctl -e pft_set_rules echo \ "pass" \ "block in inet6 proto icmp6 from fe80::/10 to any icmp6-type echoreq" jexec nat pfctl -e pft_set_rules nat \ "nat pass on ${epair_echo}a inet6 from 2001:db8::/64 to any -> (${epair_echo}a)" \ "pass" # Sanity check atf_check -s exit:0 -o ignore \ ping -6 -c 1 2001:db8::1 for i in `seq 0 10` do atf_check -s exit:0 -o ignore \ ping -6 -c 1 2001:db8:1::2 done } nat6_nolinklocal_cleanup() { pft_cleanup } empty_table_common() { option=$1 pft_init epair_wan=$(vnet_mkepair) epair_lan=$(vnet_mkepair) vnet_mkjail srv ${epair_wan}a jexec srv ifconfig ${epair_wan}a 192.0.2.2/24 up vnet_mkjail rtr ${epair_wan}b ${epair_lan}a jexec rtr ifconfig ${epair_wan}b 192.0.2.1/24 up jexec rtr ifconfig ${epair_lan}a 198.51.100.1/24 up jexec rtr sysctl net.inet.ip.forwarding=1 ifconfig ${epair_lan}b 198.51.100.2/24 up route add default 198.51.100.1 jexec rtr pfctl -e pft_set_rules rtr \ "table " \ "nat on ${epair_wan}b inet from 198.51.100.0/24 -> ${option}" \ "pass" # Sanity checks atf_check -s exit:0 -o ignore \ jexec rtr ping -c 1 192.0.2.2 atf_check -s exit:0 -o ignore \ ping -c 1 198.51.100.1 atf_check -s exit:0 -o ignore \ ping -c 1 192.0.2.1 # Provoke divide by zero ping -c 1 192.0.2.2 true } atf_test_case "empty_table_source_hash" "cleanup" empty_table_source_hash_head() { atf_set descr 'Test source-hash on an emtpy table' atf_set require.user root } empty_table_source_hash_body() { empty_table_common "source-hash" } empty_table_source_hash_cleanup() { pft_cleanup } atf_test_case "empty_table_random" "cleanup" empty_table_random_head() { atf_set descr 'Test random on an emtpy table' atf_set require.user root } empty_table_random_body() { empty_table_common "random" } empty_table_random_cleanup() { pft_cleanup } no_addrs_common() { option=$1 pft_init epair_wan=$(vnet_mkepair) epair_lan=$(vnet_mkepair) vnet_mkjail srv ${epair_wan}a jexec srv ifconfig ${epair_wan}a 192.0.2.2/24 up vnet_mkjail rtr ${epair_wan}b ${epair_lan}a jexec rtr route add -net 192.0.2.0/24 -iface ${epair_wan}b jexec rtr ifconfig ${epair_lan}a 198.51.100.1/24 up jexec rtr sysctl net.inet.ip.forwarding=1 ifconfig ${epair_lan}b 198.51.100.2/24 up route add default 198.51.100.1 jexec rtr pfctl -e pft_set_rules rtr \ "nat on ${epair_wan}b inet from 198.51.100.0/24 -> (${epair_wan}b) ${option}" \ "pass" # Provoke divide by zero ping -c 1 192.0.2.2 true } atf_test_case "no_addrs_source_hash" "cleanup" no_addrs_source_hash_head() { atf_set descr 'Test source-hash on an interface with no addresses' atf_set require.user root } no_addrs_source_hash_body() { no_addrs_common "source-hash" } no_addrs_source_hash_cleanup() { pft_cleanup } atf_test_case "no_addrs_random" "cleanup" no_addrs_random_head() { atf_set descr 'Test random on an interface with no addresses' atf_set require.user root } no_addrs_random_body() { no_addrs_common "random" } no_addrs_random_cleanup() { pft_cleanup } nat_pass_head() { atf_set descr 'IPv4 NAT on pass rule' atf_set require.user root atf_set require.progs scapy } nat_pass_body() { setup_router_server_ipv4 # Delete the route back to make sure that the traffic has been NAT-ed jexec server route del -net ${net_tester} ${net_server_host_router} pft_set_rules router \ "block" \ "pass in on ${epair_tester}b inet proto tcp keep state" \ "pass out on ${epair_server}a inet proto tcp nat-to ${epair_server}a keep state" ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4201 jexec router pfctl -qvvsr jexec router pfctl -qvvss jexec router ifconfig jexec router netstat -rn } nat_pass_cleanup() { pft_cleanup } nat_match_head() { atf_set descr 'IPv4 NAT on match rule' atf_set require.user root atf_set require.progs scapy } nat_match_body() { setup_router_server_ipv4 # Delete the route back to make sure that the traffic has been NAT-ed jexec server route del -net ${net_tester} ${net_server_host_router} # NAT is applied during ruleset evaluation: # rules after "match" match on NAT-ed address pft_set_rules router \ "block" \ "pass in on ${epair_tester}b inet proto tcp keep state" \ "match out on ${epair_server}a inet proto tcp nat-to ${epair_server}a" \ "pass out on ${epair_server}a inet proto tcp from ${epair_server}a keep state" ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4201 jexec router pfctl -qvvsr jexec router pfctl -qvvss jexec router ifconfig jexec router netstat -rn } nat_match_cleanup() { pft_cleanup } map_e_common() { NC_TRY_COUNT=12 pft_init epair_map_e=$(vnet_mkepair) epair_echo=$(vnet_mkepair) vnet_mkjail map_e ${epair_map_e}b ${epair_echo}a vnet_mkjail echo ${epair_echo}b ifconfig ${epair_map_e}a 192.0.2.2/24 up route add -net 198.51.100.0/24 192.0.2.1 jexec map_e ifconfig ${epair_map_e}b 192.0.2.1/24 up jexec map_e ifconfig ${epair_echo}a 198.51.100.1/24 up jexec map_e sysctl net.inet.ip.forwarding=1 jexec echo ifconfig ${epair_echo}b 198.51.100.2/24 up jexec echo /usr/sbin/inetd -p ${PWD}/inetd-echo.pid $(atf_get_srcdir)/echo_inetd.conf # Enable pf! jexec map_e pfctl -e } atf_test_case "map_e_compat" "cleanup" map_e_compat_head() { atf_set descr 'map-e-portset test' atf_set require.user root } map_e_compat_body() { map_e_common pft_set_rules map_e \ "nat pass on ${epair_echo}a inet from 192.0.2.0/24 to any -> (${epair_echo}a) map-e-portset 2/12/0x342" # Only allow specified ports. jexec echo pfctl -e pft_set_rules echo "block return all" \ "pass in on ${epair_echo}b inet proto tcp from 198.51.100.1 port 19720:19723 to (${epair_echo}b) port 7" \ "pass in on ${epair_echo}b inet proto tcp from 198.51.100.1 port 36104:36107 to (${epair_echo}b) port 7" \ "pass in on ${epair_echo}b inet proto tcp from 198.51.100.1 port 52488:52491 to (${epair_echo}b) port 7" \ "set skip on lo" i=0 while [ ${i} -lt ${NC_TRY_COUNT} ] do echo "foo ${i}" | timeout 2 nc -N 198.51.100.2 7 if [ $? -ne 0 ]; then atf_fail "nc failed (${i})" fi i=$((${i}+1)) done } map_e_compat_cleanup() { pft_cleanup } atf_test_case "map_e_pass" "cleanup" map_e_pass_head() { atf_set descr 'map-e-portset test' atf_set require.user root } map_e_pass_body() { map_e_common pft_set_rules map_e \ "pass out on ${epair_echo}a inet from 192.0.2.0/24 to any nat-to (${epair_echo}a) map-e-portset 2/12/0x342 keep state" jexec map_e pfctl -qvvsr # Only allow specified ports. jexec echo pfctl -e pft_set_rules echo "block return all" \ "pass in on ${epair_echo}b inet proto tcp from 198.51.100.1 port 19720:19723 to (${epair_echo}b) port 7" \ "pass in on ${epair_echo}b inet proto tcp from 198.51.100.1 port 36104:36107 to (${epair_echo}b) port 7" \ "pass in on ${epair_echo}b inet proto tcp from 198.51.100.1 port 52488:52491 to (${epair_echo}b) port 7" \ "set skip on lo" i=0 while [ ${i} -lt ${NC_TRY_COUNT} ] do echo "foo ${i}" | timeout 2 nc -N 198.51.100.2 7 if [ $? -ne 0 ]; then atf_fail "nc failed (${i})" fi i=$((${i}+1)) done } map_e_pass_cleanup() { pft_cleanup } binat_compat_head() { atf_set descr 'IPv4 BINAT with nat ruleset' atf_set require.user root atf_set require.progs scapy } binat_compat_body() { setup_router_server_ipv4 # Delete the route back to make sure that the traffic has been NAT-ed jexec server route del -net ${net_tester} ${net_server_host_router} pft_set_rules router \ "set state-policy if-bound" \ "set ruleset-optimization none" \ "binat on ${epair_server}a inet proto tcp from ${net_tester_host_tester} to any tag sometag -> ${epair_server}a" \ "block" \ "pass in on ${epair_tester}b inet proto tcp !tagged sometag keep state" \ "pass out on ${epair_server}a inet proto tcp tagged sometag keep state" \ "pass in on ${epair_server}a inet proto tcp tagged sometag keep state" \ "pass out on ${epair_tester}b inet proto tcp tagged sometag keep state" # Test the outbound NAT part of BINAT. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4201 states=$(mktemp) || exit 1 jexec router pfctl -qvss | normalize_pfctl_s > $states for state_regexp in \ "${epair_tester}b tcp ${net_server_host_server}:9 <- ${net_tester_host_tester}:4201 .* 3:2 pkts,.* rule 1" \ "${epair_server}a tcp ${net_server_host_router}:4201 \(${net_tester_host_tester}:4201\) -> ${net_server_host_server}:9 .* 3:2 pkts,.* rule 2" \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done # Test the inbound RDR part of BINAT. # The "tester" becomes "server" and vice versa. inetd_conf=$(mktemp) echo "discard stream tcp nowait root internal" > $inetd_conf inetd -p ${PWD}/inetd_tester.pid $inetd_conf atf_check -s exit:0 \ jexec server ${common_dir}/pft_ping.py \ --ping-type=tcp3way --send-sport=4202 \ --sendif ${epair_server}b \ --to ${net_server_host_router} \ --replyif ${epair_server}b states=$(mktemp) || exit 1 jexec router pfctl -qvss | normalize_pfctl_s > $states for state_regexp in \ "${epair_server}a tcp ${net_tester_host_tester}:9 \(${net_server_host_router}:9\) <- ${net_server_host_server}:4202 .* 3:2 pkts,.* rule 3" \ "${epair_tester}b tcp ${net_server_host_server}:4202 -> ${net_tester_host_tester}:9 .* 3:2 pkts,.* rule 4" \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done } binat_compat_cleanup() { pft_cleanup kill $(cat ${PWD}/inetd_tester.pid) } binat_match_head() { atf_set descr 'IPv4 BINAT with nat ruleset' atf_set require.user root atf_set require.progs scapy } binat_match_body() { setup_router_server_ipv4 # Delete the route back to make sure that the traffic has been NAT-ed jexec server route del -net ${net_tester} ${net_server_host_router} # The "binat-to" rule expands to 2 rules so the ""pass" rules start at 3! pft_set_rules router \ "set state-policy if-bound" \ "set ruleset-optimization none" \ "block" \ "match on ${epair_server}a inet proto tcp from ${net_tester_host_tester} to any tag sometag binat-to ${epair_server}a" \ "pass in on ${epair_tester}b inet proto tcp !tagged sometag keep state" \ "pass out on ${epair_server}a inet proto tcp tagged sometag keep state" \ "pass in on ${epair_server}a inet proto tcp tagged sometag keep state" \ "pass out on ${epair_tester}b inet proto tcp tagged sometag keep state" # Test the outbound NAT part of BINAT. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4201 states=$(mktemp) || exit 1 jexec router pfctl -qvss | normalize_pfctl_s > $states for state_regexp in \ "${epair_tester}b tcp ${net_server_host_server}:9 <- ${net_tester_host_tester}:4201 .* 3:2 pkts,.* rule 3" \ "${epair_server}a tcp ${net_server_host_router}:4201 \(${net_tester_host_tester}:4201\) -> ${net_server_host_server}:9 .* 3:2 pkts,.* rule 4" \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done # Test the inbound RDR part of BINAT. # The "tester" becomes "server" and vice versa. inetd_conf=$(mktemp) echo "discard stream tcp nowait root internal" > $inetd_conf inetd -p ${PWD}/inetd_tester.pid $inetd_conf atf_check -s exit:0 \ jexec server ${common_dir}/pft_ping.py \ --ping-type=tcp3way --send-sport=4202 \ --sendif ${epair_server}b \ --to ${net_server_host_router} \ --replyif ${epair_server}b states=$(mktemp) || exit 1 jexec router pfctl -qvss | normalize_pfctl_s > $states for state_regexp in \ "${epair_server}a tcp ${net_tester_host_tester}:9 \(${net_server_host_router}:9\) <- ${net_server_host_server}:4202 .* 3:2 pkts,.* rule 5" \ "${epair_tester}b tcp ${net_server_host_server}:4202 -> ${net_tester_host_tester}:9 .* 3:2 pkts,.* rule 6" \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done } binat_match_cleanup() { pft_cleanup kill $(cat ${PWD}/inetd_tester.pid) } atf_test_case "empty_pool" "cleanup" empty_pool_head() { atf_set descr 'NAT with empty pool' atf_set require.user root + atf_set require.progs python3 scapy } empty_pool_body() { pft_init setup_router_server_ipv6 pft_set_rules router \ "block" \ "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "pass in on ${epair_tester}b" \ "pass out on ${epair_server}a inet6 from any to ${net_server_host_server} nat-to " \ # pf_map_addr_sn() won't be able to pick a target address, because # the table used in redireciton pool is empty. Packet will not be # forwarded, error counter will be increased. ping_server_check_reply exit:1 # Ignore warnings about not-loaded ALTQ atf_check -o "match:map-failed +1 +" -x "jexec router pfctl -qvvsi 2> /dev/null" } empty_pool_cleanup() { pft_cleanup } atf_init_test_cases() { atf_add_test_case "exhaust" atf_add_test_case "nested_anchor" atf_add_test_case "endpoint_independent_compat" atf_add_test_case "endpoint_independent_pass" atf_add_test_case "nat6_nolinklocal" atf_add_test_case "empty_table_source_hash" atf_add_test_case "no_addrs_source_hash" atf_add_test_case "empty_table_random" atf_add_test_case "no_addrs_random" atf_add_test_case "map_e_compat" atf_add_test_case "map_e_pass" atf_add_test_case "nat_pass" atf_add_test_case "nat_match" atf_add_test_case "binat_compat" atf_add_test_case "binat_match" atf_add_test_case "empty_pool" } diff --git a/tests/sys/netpfil/pf/route_to.sh b/tests/sys/netpfil/pf/route_to.sh index fd1653cce311..765403dcb79c 100644 --- a/tests/sys/netpfil/pf/route_to.sh +++ b/tests/sys/netpfil/pf/route_to.sh @@ -1,997 +1,999 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2018 Kristof Provost # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr common_dir=$(atf_get_srcdir)/../common atf_test_case "v4" "cleanup" v4_head() { atf_set descr 'Basic route-to test' atf_set require.user root } v4_body() { pft_init epair_send=$(vnet_mkepair) ifconfig ${epair_send}a 192.0.2.1/24 up epair_route=$(vnet_mkepair) ifconfig ${epair_route}a 203.0.113.1/24 up vnet_mkjail alcatraz ${epair_send}b ${epair_route}b jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up jexec alcatraz ifconfig ${epair_route}b 203.0.113.2/24 up jexec alcatraz route add -net 198.51.100.0/24 192.0.2.1 jexec alcatraz pfctl -e # Attempt to provoke PR 228782 pft_set_rules alcatraz "block all" "pass user 2" \ "pass out route-to (${epair_route}b 203.0.113.1) from 192.0.2.2 to 198.51.100.1 no state" jexec alcatraz nc -w 3 -s 192.0.2.2 198.51.100.1 22 # atf wants us to not return an error, but our netcat will fail true } v4_cleanup() { pft_cleanup } atf_test_case "v6" "cleanup" v6_head() { atf_set descr 'Basic route-to test (IPv6)' atf_set require.user root } v6_body() { pft_init epair_send=$(vnet_mkepair) ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled epair_route=$(vnet_mkepair) ifconfig ${epair_route}a inet6 2001:db8:43::1/64 up no_dad -ifdisabled vnet_mkjail alcatraz ${epair_send}b ${epair_route}b jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad jexec alcatraz ifconfig ${epair_route}b inet6 2001:db8:43::2/64 up no_dad jexec alcatraz route add -6 2001:db8:666::/64 2001:db8:42::2 jexec alcatraz pfctl -e # Attempt to provoke PR 228782 pft_set_rules alcatraz "block all" "pass user 2" \ "pass out route-to (${epair_route}b 2001:db8:43::1) from 2001:db8:42::2 to 2001:db8:666::1 no state" jexec alcatraz nc -6 -w 3 -s 2001:db8:42::2 2001:db8:666::1 22 # atf wants us to not return an error, but our netcat will fail true } v6_cleanup() { pft_cleanup } atf_test_case "multiwan" "cleanup" multiwan_head() { atf_set descr 'Multi-WAN redirection / reply-to test' atf_set require.user root } multiwan_body() { pft_init epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) epair_cl_one=$(vnet_mkepair) epair_cl_two=$(vnet_mkepair) vnet_mkjail srv ${epair_one}b ${epair_two}b vnet_mkjail wan_one ${epair_one}a ${epair_cl_one}b vnet_mkjail wan_two ${epair_two}a ${epair_cl_two}b vnet_mkjail client ${epair_cl_one}a ${epair_cl_two}a jexec client ifconfig ${epair_cl_one}a 203.0.113.1/25 jexec wan_one ifconfig ${epair_cl_one}b 203.0.113.2/25 jexec wan_one ifconfig ${epair_one}a 192.0.2.1/24 up jexec wan_one sysctl net.inet.ip.forwarding=1 jexec srv ifconfig ${epair_one}b 192.0.2.2/24 up jexec client route add 192.0.2.0/24 203.0.113.2 jexec client ifconfig ${epair_cl_two}a 203.0.113.128/25 jexec wan_two ifconfig ${epair_cl_two}b 203.0.113.129/25 jexec wan_two ifconfig ${epair_two}a 198.51.100.1/24 up jexec wan_two sysctl net.inet.ip.forwarding=1 jexec srv ifconfig ${epair_two}b 198.51.100.2/24 up jexec client route add 198.51.100.0/24 203.0.113.129 jexec srv ifconfig lo0 127.0.0.1/8 up jexec srv route add default 192.0.2.1 jexec srv sysctl net.inet.ip.forwarding=1 # Run echo server in srv jail jexec srv /usr/sbin/inetd -p ${PWD}/multiwan.pid $(atf_get_srcdir)/echo_inetd.conf jexec srv pfctl -e pft_set_rules srv \ "nat on ${epair_one}b inet from 127.0.0.0/8 to any -> (${epair_one}b)" \ "nat on ${epair_two}b inet from 127.0.0.0/8 to any -> (${epair_two}b)" \ "rdr on ${epair_one}b inet proto tcp from any to 192.0.2.2 port 7 -> 127.0.0.1 port 7" \ "rdr on ${epair_two}b inet proto tcp from any to 198.51.100.2 port 7 -> 127.0.0.1 port 7" \ "block in" \ "block out" \ "pass in quick on ${epair_one}b reply-to (${epair_one}b 192.0.2.1) inet proto tcp from any to 127.0.0.1 port 7" \ "pass in quick on ${epair_two}b reply-to (${epair_two}b 198.51.100.1) inet proto tcp from any to 127.0.0.1 port 7" # These will always succeed, because we don't change interface to route # correctly here. result=$(echo "one" | jexec wan_one nc -N -w 3 192.0.2.2 7) if [ "${result}" != "one" ]; then atf_fail "Redirect on one failed" fi result=$(echo "two" | jexec wan_two nc -N -w 3 198.51.100.2 7) if [ "${result}" != "two" ]; then atf_fail "Redirect on two failed" fi result=$(echo "one" | jexec client nc -N -w 3 192.0.2.2 7) if [ "${result}" != "one" ]; then atf_fail "Redirect from client on one failed" fi # This should trigger the issue fixed in 829a69db855b48ff7e8242b95e193a0783c489d9 result=$(echo "two" | jexec client nc -N -w 3 198.51.100.2 7) if [ "${result}" != "two" ]; then atf_fail "Redirect from client on two failed" fi } multiwan_cleanup() { pft_cleanup } atf_test_case "multiwanlocal" "cleanup" multiwanlocal_head() { atf_set descr 'Multi-WAN local origin source-based redirection / route-to test' atf_set require.user root } multiwanlocal_body() { pft_init epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) epair_cl_one=$(vnet_mkepair) epair_cl_two=$(vnet_mkepair) vnet_mkjail srv1 ${epair_one}b vnet_mkjail srv2 ${epair_two}b vnet_mkjail wan_one ${epair_one}a ${epair_cl_one}b vnet_mkjail wan_two ${epair_two}a ${epair_cl_two}b vnet_mkjail client ${epair_cl_one}a ${epair_cl_two}a jexec client ifconfig ${epair_cl_one}a 203.0.113.1/25 jexec wan_one ifconfig ${epair_cl_one}b 203.0.113.2/25 jexec wan_one ifconfig ${epair_one}a 192.0.2.1/24 up jexec wan_one sysctl net.inet.ip.forwarding=1 jexec srv1 ifconfig ${epair_one}b 192.0.2.2/24 up jexec client ifconfig ${epair_cl_two}a 203.0.113.128/25 jexec wan_two ifconfig ${epair_cl_two}b 203.0.113.129/25 jexec wan_two ifconfig ${epair_two}a 198.51.100.1/24 up jexec wan_two sysctl net.inet.ip.forwarding=1 jexec srv2 ifconfig ${epair_two}b 198.51.100.2/24 up jexec client route add default 203.0.113.2 jexec srv1 route add default 192.0.2.1 jexec srv2 route add default 198.51.100.1 # Run data source in srv1 and srv2 jexec srv1 sh -c 'dd if=/dev/zero bs=1024 count=100 | nc -l 7 -w 2 -N &' jexec srv2 sh -c 'dd if=/dev/zero bs=1024 count=100 | nc -l 7 -w 2 -N &' jexec client pfctl -e pft_set_rules client \ "block in" \ "block out" \ "pass out quick route-to (${epair_cl_two}a 203.0.113.129) inet proto tcp from 203.0.113.128 to any port 7" \ "pass out on ${epair_cl_one}a inet proto tcp from any to any port 7" \ "set skip on lo" # This should work result=$(jexec client nc -N -w 1 192.0.2.2 7 | wc -c) if [ ${result} -ne 102400 ]; then jexec client pfctl -ss atf_fail "Redirect from client on one failed: ${result}" fi # This should trigger the issue result=$(jexec client nc -N -w 1 -s 203.0.113.128 198.51.100.2 7 | wc -c) jexec client pfctl -ss if [ ${result} -ne 102400 ]; then atf_fail "Redirect from client on two failed: ${result}" fi } multiwanlocal_cleanup() { pft_cleanup } atf_test_case "icmp_nat" "cleanup" icmp_nat_head() { atf_set descr 'Test that ICMP packets are correct for route-to + NAT' atf_set require.user root atf_set require.progs python3 scapy } icmp_nat_body() { pft_init epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) epair_three=$(vnet_mkepair) vnet_mkjail gw ${epair_one}b ${epair_two}a ${epair_three}a vnet_mkjail srv ${epair_two}b vnet_mkjail srv2 ${epair_three}b ifconfig ${epair_one}a 192.0.2.2/24 up route add -net 198.51.100.0/24 192.0.2.1 jexec gw sysctl net.inet.ip.forwarding=1 jexec gw ifconfig ${epair_one}b 192.0.2.1/24 up jexec gw ifconfig ${epair_two}a 198.51.100.1/24 up jexec gw ifconfig ${epair_three}a 203.0.113.1/24 up mtu 500 jexec srv ifconfig ${epair_two}b 198.51.100.2/24 up jexec srv route add default 198.51.100.1 jexec srv2 ifconfig ${epair_three}b 203.0.113.2/24 up mtu 500 jexec srv2 route add default 203.0.113.1 # Sanity check atf_check -s exit:0 -o ignore ping -c 1 198.51.100.2 jexec gw pfctl -e pft_set_rules gw \ "nat on ${epair_two}a inet from 192.0.2.0/24 to any -> (${epair_two}a)" \ "nat on ${epair_three}a inet from 192.0.2.0/24 to any -> (${epair_three}a)" \ "pass out route-to (${epair_three}a 203.0.113.2) proto icmp icmp-type echoreq" # Now ensure that we get an ICMP error with the correct IP addresses in it. atf_check -s exit:0 ${common_dir}/pft_icmp_check.py \ --to 198.51.100.2 \ --fromaddr 192.0.2.2 \ --recvif ${epair_one}a \ --sendif ${epair_one}a # ping reports the ICMP error, so check of that too. atf_check -s exit:2 -o match:'frag needed and DF set' \ ping -D -c 1 -s 1000 198.51.100.2 } icmp_nat_cleanup() { pft_cleanup } atf_test_case "dummynet" "cleanup" dummynet_head() { atf_set descr 'Test that dummynet applies to route-to packets' atf_set require.user root } dummynet_body() { dummynet_init epair_srv=$(vnet_mkepair) epair_gw=$(vnet_mkepair) vnet_mkjail srv ${epair_srv}a jexec srv ifconfig ${epair_srv}a 192.0.2.1/24 up jexec srv route add default 192.0.2.2 vnet_mkjail gw ${epair_srv}b ${epair_gw}a jexec gw ifconfig ${epair_srv}b 192.0.2.2/24 up jexec gw ifconfig ${epair_gw}a 198.51.100.1/24 up jexec gw sysctl net.inet.ip.forwarding=1 ifconfig ${epair_gw}b 198.51.100.2/24 up route add -net 192.0.2.0/24 198.51.100.1 # Sanity check atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.1 jexec gw dnctl pipe 1 config delay 1200 pft_set_rules gw \ "pass out route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe 1" jexec gw pfctl -e # The ping request will pass, but take 1.2 seconds # So this works: atf_check -s exit:0 -o ignore ping -c 1 -t 2 192.0.2.1 # But this times out: atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1 # return path dummynet pft_set_rules gw \ "pass out route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe (0, 1)" # The ping request will pass, but take 1.2 seconds # So this works: atf_check -s exit:0 -o ignore ping -c 1 -t 2 192.0.2.1 # But this times out: atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1 } dummynet_cleanup() { pft_cleanup } atf_test_case "dummynet_in" "cleanup" dummynet_in_head() { atf_set descr 'Thest that dummynet works as expected on pass in route-to packets' atf_set require.user root } dummynet_in_body() { dummynet_init epair_srv=$(vnet_mkepair) epair_gw=$(vnet_mkepair) vnet_mkjail srv ${epair_srv}a jexec srv ifconfig ${epair_srv}a 192.0.2.1/24 up jexec srv route add default 192.0.2.2 vnet_mkjail gw ${epair_srv}b ${epair_gw}a jexec gw ifconfig ${epair_srv}b 192.0.2.2/24 up jexec gw ifconfig ${epair_gw}a 198.51.100.1/24 up jexec gw sysctl net.inet.ip.forwarding=1 ifconfig ${epair_gw}b 198.51.100.2/24 up route add -net 192.0.2.0/24 198.51.100.1 # Sanity check atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.1 jexec gw dnctl pipe 1 config delay 1200 pft_set_rules gw \ "pass in route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe 1" jexec gw pfctl -e # The ping request will pass, but take 1.2 seconds # So this works: echo "Expect 1.2 s" ping -c 1 192.0.2.1 atf_check -s exit:0 -o ignore ping -c 1 -t 2 192.0.2.1 # But this times out: atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1 # return path dummynet pft_set_rules gw \ "pass in route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe (0, 1)" # The ping request will pass, but take 1.2 seconds # So this works: echo "Expect 1.2 s" ping -c 1 192.0.2.1 atf_check -s exit:0 -o ignore ping -c 1 -t 2 192.0.2.1 # But this times out: atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1 } dummynet_in_cleanup() { pft_cleanup } atf_test_case "ifbound" "cleanup" ifbound_head() { atf_set descr 'Test that route-to states bind the expected interface' atf_set require.user root } ifbound_body() { pft_init j="route_to:ifbound" epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) ifconfig ${epair_one}b up vnet_mkjail ${j}2 ${epair_two}b jexec ${j}2 ifconfig ${epair_two}b inet 198.51.100.2/24 up jexec ${j}2 ifconfig ${epair_two}b inet alias 203.0.113.1/24 jexec ${j}2 route add default 198.51.100.1 vnet_mkjail $j ${epair_one}a ${epair_two}a jexec $j ifconfig ${epair_one}a 192.0.2.1/24 up jexec $j ifconfig ${epair_two}a 198.51.100.1/24 up jexec $j route add default 192.0.2.2 jexec $j pfctl -e pft_set_rules $j \ "set state-policy if-bound" \ "block" \ "pass out route-to (${epair_two}a 198.51.100.2)" atf_check -s exit:0 -o ignore \ jexec $j ping -c 3 203.0.113.1 } ifbound_cleanup() { pft_cleanup } atf_test_case "ifbound_v6" "cleanup" ifbound_v6_head() { atf_set descr 'Test that route-to states for IPv6 bind the expected interface' atf_set require.user root } ifbound_v6_body() { pft_init j="route_to:ifbound_v6" epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) ifconfig ${epair_one}b up vnet_mkjail ${j}2 ${epair_two}b jexec ${j}2 ifconfig ${epair_two}b inet6 2001:db8:1::2/64 up no_dad jexec ${j}2 ifconfig ${epair_two}b inet6 alias 2001:db8:2::1/64 no_dad jexec ${j}2 route -6 add default 2001:db8:1::1 vnet_mkjail $j ${epair_one}a ${epair_two}a jexec $j ifconfig ${epair_one}a inet6 2001:db8::1/64 up no_dad jexec $j ifconfig ${epair_two}a inet6 2001:db8:1::1/64 up no_dad jexec $j route -6 add default 2001:db8::2 jexec $j ping6 -c 3 2001:db8:1::2 jexec $j pfctl -e pft_set_rules $j \ "set state-policy if-bound" \ "block" \ "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "pass out route-to (${epair_two}a 2001:db8:1::2)" atf_check -s exit:0 -o ignore \ jexec $j ping6 -c 3 2001:db8:2::1 } ifbound_v6_cleanup() { pft_cleanup } atf_test_case "ifbound_reply_to" "cleanup" ifbound_reply_to_head() { atf_set descr 'Test that reply-to states bind to the expected interface' atf_set require.user root atf_set require.progs python3 scapy } ifbound_reply_to_body() { pft_init j="route_to:ifbound_reply_to" epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) ifconfig ${epair_one}b inet 192.0.2.2/24 up ifconfig ${epair_two}b up vnet_mkjail $j ${epair_one}a ${epair_two}a jexec $j ifconfig ${epair_one}a 192.0.2.1/24 up jexec $j ifconfig ${epair_two}a 198.51.100.1/24 up jexec $j route add default 198.51.100.254 jexec $j pfctl -e pft_set_rules $j \ "set state-policy if-bound" \ "block" \ "pass in on ${epair_one}a reply-to (${epair_one}a 192.0.2.2) inet from any to 192.0.2.0/24 keep state" atf_check -s exit:0 -o ignore \ ping -c 3 192.0.2.1 atf_check -s exit:0 \ ${common_dir}/pft_ping.py \ --to 192.0.2.1 \ --from 203.0.113.2 \ --sendif ${epair_one}b \ --replyif ${epair_one}b # pft_ping uses the same ID every time, so this will look like more traffic in the same state atf_check -s exit:0 \ ${common_dir}/pft_ping.py \ --to 192.0.2.1 \ --from 203.0.113.2 \ --sendif ${epair_one}b \ --replyif ${epair_one}b jexec $j pfctl -ss -vv } ifbound_reply_to_cleanup() { pft_cleanup } atf_test_case "ifbound_reply_to_v6" "cleanup" ifbound_reply_to_v6_head() { atf_set descr 'Test that reply-to states bind to the expected interface for IPv6' atf_set require.user root atf_set require.progs python3 scapy } ifbound_reply_to_v6_body() { pft_init j="route_to:ifbound_reply_to_v6" epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) vnet_mkjail ${j}s ${epair_one}b ${epair_two}b jexec ${j}s ifconfig ${epair_one}b inet6 2001:db8::2/64 up no_dad jexec ${j}s ifconfig ${epair_two}b up #jexec ${j}s route -6 add default 2001:db8::1 vnet_mkjail $j ${epair_one}a ${epair_two}a jexec $j ifconfig ${epair_one}a inet6 2001:db8::1/64 up no_dad jexec $j ifconfig ${epair_two}a inet6 2001:db8:1::1/64 up no_dad jexec $j route -6 add default 2001:db8:1::254 jexec $j pfctl -e pft_set_rules $j \ "set state-policy if-bound" \ "block" \ "pass quick inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "pass in on ${epair_one}a reply-to (${epair_one}a 2001:db8::2) inet6 from any to 2001:db8::/64 keep state" atf_check -s exit:0 -o ignore \ jexec ${j}s ping6 -c 3 2001:db8::1 atf_check -s exit:0 \ jexec ${j}s ${common_dir}/pft_ping.py \ --to 2001:db8::1 \ --from 2001:db8:2::2 \ --sendif ${epair_one}b \ --replyif ${epair_one}b # pft_ping uses the same ID every time, so this will look like more traffic in the same state atf_check -s exit:0 \ jexec ${j}s ${common_dir}/pft_ping.py \ --to 2001:db8::1 \ --from 2001:db8:2::2 \ --sendif ${epair_one}b \ --replyif ${epair_one}b jexec $j pfctl -ss -vv } ifbound_reply_to_v6_cleanup() { pft_cleanup } atf_test_case "ifbound_reply_to_rdr_dummynet" "cleanup" ifbound_reply_to_rdr_dummynet_head() { atf_set descr 'Test that reply-to states bind to the expected non-default-route interface after rdr and dummynet' atf_set require.user root atf_set require.progs python3 scapy } ifbound_reply_to_rdr_dummynet_body() { dummynet_init j="route_to:ifbound_reply_to_rdr_dummynet" epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) ifconfig ${epair_one}b inet 192.0.2.2/24 up ifconfig ${epair_two}b up vnet_mkjail $j ${epair_one}a ${epair_two}a jexec $j ifconfig lo0 inet 127.0.0.1/8 up jexec $j ifconfig ${epair_one}a 192.0.2.1/24 up jexec $j ifconfig ${epair_two}a 198.51.100.1/24 up jexec $j route add default 198.51.100.254 jexec $j pfctl -e jexec $j dnctl pipe 1 config delay 1 pft_set_rules $j \ "set state-policy if-bound" \ "rdr on ${epair_one}a proto icmp from any to 192.0.2.1 -> 127.0.0.1" \ "rdr on ${epair_two}a proto icmp from any to 198.51.100.1 -> 127.0.0.1" \ "match in on ${epair_one}a inet all dnpipe (1, 1)" \ "pass in on ${epair_one}a reply-to (${epair_one}a 192.0.2.2) inet from any to 127.0.0.1 keep state" atf_check -s exit:0 -o ignore \ ping -c 3 192.0.2.1 atf_check -s exit:0 \ ${common_dir}/pft_ping.py \ --to 192.0.2.1 \ --from 203.0.113.2 \ --sendif ${epair_one}b \ --replyif ${epair_one}b # pft_ping uses the same ID every time, so this will look like more traffic in the same state atf_check -s exit:0 \ ${common_dir}/pft_ping.py \ --to 192.0.2.1 \ --from 203.0.113.2 \ --sendif ${epair_one}b \ --replyif ${epair_one}b jexec $j pfctl -sr -vv jexec $j pfctl -ss -vv } ifbound_reply_to_rdr_dummynet_cleanup() { pft_cleanup } atf_test_case "dummynet_frag" "cleanup" dummynet_frag_head() { atf_set descr 'Test fragmentation with route-to and dummynet' atf_set require.user root } dummynet_frag_body() { pft_init dummynet_init epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) ifconfig ${epair_one}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair_one}b ${epair_two}a jexec alcatraz ifconfig ${epair_one}b 192.0.2.2/24 up jexec alcatraz ifconfig ${epair_two}a 198.51.100.1/24 up jexec alcatraz sysctl net.inet.ip.forwarding=1 vnet_mkjail singsing ${epair_two}b jexec singsing ifconfig ${epair_two}b 198.51.100.2/24 up jexec singsing route add default 198.51.100.1 route add 198.51.100.0/24 192.0.2.2 jexec alcatraz dnctl pipe 1 config bw 1000Byte/s burst 4500 jexec alcatraz dnctl pipe 2 config # This second pipe ensures that the pf_test(PF_OUT) call in pf_route() doesn't # delay packets in dummynet (by inheriting pipe 1 from the input rule). jexec alcatraz pfctl -e pft_set_rules alcatraz \ "set reassemble yes" \ "pass in route-to (${epair_two}a 198.51.100.2) inet proto icmp all icmp-type echoreq dnpipe 1" \ "pass out dnpipe 2" atf_check -s exit:0 -o ignore ping -c 1 198.51.100.2 atf_check -s exit:0 -o ignore ping -c 1 -s 4000 198.51.100.2 } dummynet_frag_cleanup() { pft_cleanup } atf_test_case "dummynet_double" "cleanup" dummynet_double_head() { atf_set descr 'Ensure dummynet is not applied multiple times' atf_set require.user root } dummynet_double_body() { pft_init dummynet_init epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) ifconfig ${epair_one}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair_one}b ${epair_two}a jexec alcatraz ifconfig ${epair_one}b 192.0.2.2/24 up jexec alcatraz ifconfig ${epair_two}a 198.51.100.1/24 up jexec alcatraz sysctl net.inet.ip.forwarding=1 vnet_mkjail singsing ${epair_two}b jexec singsing ifconfig ${epair_two}b 198.51.100.2/24 up jexec singsing route add default 198.51.100.1 route add 198.51.100.0/24 192.0.2.2 jexec alcatraz dnctl pipe 1 config delay 800 jexec alcatraz pfctl -e pft_set_rules alcatraz \ "set reassemble yes" \ "nat on ${epair_two}a from 192.0.2.0/24 -> (${epair_two}a)" \ "pass in route-to (${epair_two}a 198.51.100.2) inet proto icmp all icmp-type echoreq dnpipe (1, 1)" \ "pass out route-to (${epair_two}a 198.51.100.2) inet proto icmp all icmp-type echoreq" ping -c 1 198.51.100.2 jexec alcatraz pfctl -sr -vv jexec alcatraz pfctl -ss -vv # We expect to be delayed 1.6 seconds, so timeout of two seconds passes, but # timeout of 1 does not. atf_check -s exit:0 -o ignore ping -t 2 -c 1 198.51.100.2 atf_check -s exit:2 -o ignore ping -t 1 -c 1 198.51.100.2 } dummynet_double_cleanup() { pft_cleanup } atf_test_case "sticky" "cleanup" sticky_head() { atf_set descr 'Set and retrieve a rule with sticky-address' atf_set require.user root } sticky_body() { pft_init vnet_mkjail alcatraz pft_set_rules alcatraz \ "pass in quick log on n_test_h_rtr route-to (n_srv_h_rtr ) sticky-address from any to keep state" jexec alcatraz pfctl -qvvsr } sticky_cleanup() { pft_cleanup } atf_test_case "ttl" "cleanup" ttl_head() { atf_set descr 'Ensure we decrement TTL on route-to' atf_set require.user root } ttl_body() { pft_init epair_one=$(vnet_mkepair) epair_two=$(vnet_mkepair) ifconfig ${epair_one}b 192.0.2.2/24 up route add default 192.0.2.1 vnet_mkjail alcatraz ${epair_one}a ${epair_two}a jexec alcatraz ifconfig ${epair_one}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair_two}a 198.51.100.1/24 up jexec alcatraz sysctl net.inet.ip.forwarding=1 vnet_mkjail singsing ${epair_two}b jexec singsing ifconfig ${epair_two}b 198.51.100.2/24 up jexec singsing route add default 198.51.100.1 # Sanity check atf_check -s exit:0 -o ignore \ ping -c 3 198.51.100.2 jexec alcatraz pfctl -e pft_set_rules alcatraz \ "pass out" \ "pass in route-to (${epair_two}a 198.51.100.2)" atf_check -s exit:0 -o ignore \ ping -c 3 198.51.100.2 atf_check -s exit:2 -o ignore \ ping -m 1 -c 3 198.51.100.2 } ttl_cleanup() { pft_cleanup } atf_test_case "empty_pool" "cleanup" empty_pool_head() { atf_set descr 'Route-to with empty pool' atf_set require.user root + atf_set require.progs python3 scapy } empty_pool_body() { pft_init setup_router_server_ipv6 pft_set_rules router \ "block" \ "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "pass in on ${epair_tester}b route-to (${epair_server}a ) inet6 from any to ${net_server_host_server}" \ "pass out on ${epair_server}a" # pf_map_addr_sn() won't be able to pick a target address, because # the table used in redireciton pool is empty. Packet will not be # forwarded, error counter will be increased. ping_server_check_reply exit:1 # Ignore warnings about not-loaded ALTQ atf_check -o "match:map-failed +1 +" -x "jexec router pfctl -qvvsi 2> /dev/null" } empty_pool_cleanup() { pft_cleanup } atf_test_case "table_loop" "cleanup" table_loop_head() { atf_set descr 'Check that iterating over tables poperly loops' atf_set require.user root + atf_set require.progs python3 scapy } table_loop_body() { setup_router_server_nat64 # Clients will connect from another network behind the router. # This allows for using multiple source addresses. jexec router route add -6 ${net_clients_6}::/${net_clients_6_mask} ${net_tester_6_host_tester} jexec router route add ${net_clients_4}.0/${net_clients_4_mask} ${net_tester_4_host_tester} # The servers are reachable over additional IP addresses for # testing of tables and subnets. The addresses are noncontinougnus # for pf_map_addr() counter tests. for i in 0 1 4 5; do a1=$((24 + i)) jexec server1 ifconfig ${epair_server1}b inet ${net_server1_4}.${a1}/32 alias jexec server1 ifconfig ${epair_server1}b inet6 ${net_server1_6}::42:${i}/128 alias a2=$((40 + i)) jexec server2 ifconfig ${epair_server2}b inet ${net_server2_4}.${a2}/32 alias jexec server2 ifconfig ${epair_server2}b inet6 ${net_server2_6}::42:${i}/128 alias done jexec router pfctl -e pft_set_rules router \ "set debug loud" \ "set reassemble yes" \ "set state-policy if-bound" \ "table { ${net_server1_6}::42:4/127 ${net_server1_6}::42:0/127 }" \ "table { ${net_server2_6}::42:4/127 }" \ "pass in on ${epair_tester}b \ route-to { \ (${epair_server1}a ) \ (${epair_server2}a ) \ (${epair_server2}a ) \ } \ inet6 proto tcp \ keep state" # Both hosts of the pool are tables. Each table gets iterated over once, # then the pool iterates to the next host, which is also iterated, # then the pool loops back to the 1st host. If an empty table is found, # it is skipped. Unless that's the only table, that is tested by # the "empty_pool" test. for port in $(seq 1 7); do port=$((4200 + port)) atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_tester}a --replyif ${epair_tester}a \ --fromaddr ${net_clients_6}::1 --to ${host_server_6} \ --ping-type=tcp3way --send-sport=${port} done states=$(mktemp) || exit 1 jexec router pfctl -qvvss | normalize_pfctl_s > $states cat $states for state_regexp in \ "${epair_tester}b tcp ${host_server_6}\[9\] <- ${net_clients_6}::1\[4201\] .* route-to: ${net_server1_6}::42:0@${epair_server1}a" \ "${epair_tester}b tcp ${host_server_6}\[9\] <- ${net_clients_6}::1\[4202\] .* route-to: ${net_server1_6}::42:1@${epair_server1}a" \ "${epair_tester}b tcp ${host_server_6}\[9\] <- ${net_clients_6}::1\[4203\] .* route-to: ${net_server1_6}::42:4@${epair_server1}a" \ "${epair_tester}b tcp ${host_server_6}\[9\] <- ${net_clients_6}::1\[4204\] .* route-to: ${net_server1_6}::42:5@${epair_server1}a" \ "${epair_tester}b tcp ${host_server_6}\[9\] <- ${net_clients_6}::1\[4205\] .* route-to: ${net_server2_6}::42:4@${epair_server2}a" \ "${epair_tester}b tcp ${host_server_6}\[9\] <- ${net_clients_6}::1\[4206\] .* route-to: ${net_server2_6}::42:5@${epair_server2}a" \ "${epair_tester}b tcp ${host_server_6}\[9\] <- ${net_clients_6}::1\[4207\] .* route-to: ${net_server1_6}::42:0@${epair_server1}a" \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done } table_loop_cleanup() { pft_cleanup } atf_init_test_cases() { atf_add_test_case "v4" atf_add_test_case "v6" atf_add_test_case "multiwan" atf_add_test_case "multiwanlocal" atf_add_test_case "icmp_nat" atf_add_test_case "dummynet" atf_add_test_case "dummynet_in" atf_add_test_case "ifbound" atf_add_test_case "ifbound_v6" atf_add_test_case "ifbound_reply_to" atf_add_test_case "ifbound_reply_to_v6" atf_add_test_case "ifbound_reply_to_rdr_dummynet" atf_add_test_case "dummynet_frag" atf_add_test_case "dummynet_double" atf_add_test_case "sticky" atf_add_test_case "ttl" atf_add_test_case "empty_pool" atf_add_test_case "table_loop" } diff --git a/tests/sys/netpfil/pf/src_track.sh b/tests/sys/netpfil/pf/src_track.sh index f4031e9dd8ad..68e7e72f5018 100755 --- a/tests/sys/netpfil/pf/src_track.sh +++ b/tests/sys/netpfil/pf/src_track.sh @@ -1,576 +1,577 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2020 Kristof Provost # Copyright (c) 2024 Kajetan Staszkiewicz # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr atf_test_case "source_track" "cleanup" source_track_head() { atf_set descr 'Basic source tracking test' atf_set require.user root } source_track_body() { pft_init epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.2/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up # Enable pf! jexec alcatraz pfctl -e pft_set_rules alcatraz \ "pass in keep state (source-track)" \ "pass out keep state (source-track)" ping -c 3 192.0.2.1 atf_check -s exit:0 -o match:'192.0.2.2 -> 0.0.0.0 \( states 1,.*' \ jexec alcatraz pfctl -sS # Flush all source nodes jexec alcatraz pfctl -FS # We can't find the previous source node any more atf_check -s exit:0 -o not-match:'192.0.2.2 -> 0.0.0.0 \( states 1,.*' \ jexec alcatraz pfctl -sS # But we still have the state atf_check -s exit:0 -o match:'all icmp 192.0.2.1:8 <- 192.0.2.2:.*' \ jexec alcatraz pfctl -ss } source_track_cleanup() { pft_cleanup } atf_test_case "kill" "cleanup" kill_head() { atf_set descr 'Test killing source nodes' atf_set require.user root } kill_body() { pft_init epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.2/24 up ifconfig ${epair}a inet alias 192.0.2.3/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up # Enable pf! jexec alcatraz pfctl -e pft_set_rules alcatraz \ "pass in keep state (source-track)" \ "pass out keep state (source-track)" # Establish two sources atf_check -s exit:0 -o ignore \ ping -c 1 -S 192.0.2.2 192.0.2.1 atf_check -s exit:0 -o ignore \ ping -c 1 -S 192.0.2.3 192.0.2.1 # Check that both source nodes exist atf_check -s exit:0 -o match:'192.0.2.2 -> 0.0.0.0 \( states 1,.*' \ jexec alcatraz pfctl -sS atf_check -s exit:0 -o match:'192.0.2.3 -> 0.0.0.0 \( states 1,.*' \ jexec alcatraz pfctl -sS jexec alcatraz pfctl -sS # Kill the 192.0.2.2 source jexec alcatraz pfctl -K 192.0.2.2 # The other source still exists atf_check -s exit:0 -o match:'192.0.2.3 -> 0.0.0.0 \( states 1,.*' \ jexec alcatraz pfctl -sS # But not the one we killed atf_check -s exit:0 -o not-match:'192.0.2.2 -> 0.0.0.0 \( states 1,.*' \ jexec alcatraz pfctl -sS } kill_cleanup() { pft_cleanup } max_src_conn_rule_head() { atf_set descr 'Max connections per source per rule' atf_set require.user root atf_set require.progs python3 scapy } max_src_conn_rule_body() { setup_router_server_ipv6 # Clients will connect from another network behind the router. # This allows for using multiple source addresses and for tester jail # to not respond with RST packets for SYN+ACKs. jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 jexec server route add -6 2001:db8:44::0/64 2001:db8:43::1 pft_set_rules router \ "block" \ "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "pass in on ${epair_tester}b inet6 proto tcp keep state (max-src-conn 3 source-track rule overload )" \ "pass out on ${epair_server}a inet6 proto tcp keep state" # Limiting of connections is done for connections which have successfully # finished the 3-way handshake. Once the handshake is done, the state # is moved to CLOSED state. We use pft_ping.py to check that the handshake # was really successful and after that we check what is in pf state table. # 3 connections from host ::1 will be allowed. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4201 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4202 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4203 --fromaddr 2001:db8:44::1 # The 4th connection from host ::1 will have its state killed. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4204 --fromaddr 2001:db8:44::1 # A connection from host :2 is will be allowed. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4205 --fromaddr 2001:db8:44::2 states=$(mktemp) || exit 1 jexec router pfctl -qss | normalize_pfctl_s | grep 'tcp 2001:db8:43::2\[9\] <-' > $states grep -qE '2001:db8:44::1\[4201\] ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4201 not found or not established" grep -qE '2001:db8:44::1\[4202\] ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4202 not found or not established" grep -qE '2001:db8:44::1\[4203\] ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4203 not found or not established" grep -qE '2001:db8:44::2\[4205\] ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4205 not found or not established" if ( grep -qE '2001:db8:44::1\[4204\] ' $states && ! grep -qE '2001:db8:44::1\[4204\] CLOSED:CLOSED' $states ); then atf_fail "State for port 4204 found but not closed" fi jexec router pfctl -T test -t bad_hosts 2001:db8:44::1 || atf_fail "Host not found in overload table" } max_src_conn_rule_cleanup() { pft_cleanup } max_src_states_rule_head() { atf_set descr 'Max states per source per rule' atf_set require.user root atf_set require.progs python3 scapy } max_src_states_rule_body() { setup_router_server_ipv6 # Clients will connect from another network behind the router. # This allows for using multiple source addresses and for tester jail # to not respond with RST packets for SYN+ACKs. jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 jexec server route add -6 2001:db8:44::0/64 2001:db8:43::1 pft_set_rules router \ "block" \ "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "pass in on ${epair_tester}b inet6 proto tcp from port 4210:4219 keep state (max-src-states 3 source-track rule) label rule_A" \ "pass in on ${epair_tester}b inet6 proto tcp from port 4220:4229 keep state (max-src-states 3 source-track rule) label rule_B" \ "pass out on ${epair_server}a keep state" # The option max-src-states prevents even the initial SYN packet going # through. It's enough that we check ping_server_check_reply, no need to # bother checking created states. # 2 connections from host ::1 matching rule_A will be allowed, 1 will fail to create a state. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4211 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4212 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4213 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4214 --fromaddr 2001:db8:44::1 # 2 connections from host ::1 matching rule_B will be allowed, 1 will fail to create a state. # Limits from rule_A don't interfere with rule_B. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4221 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4222 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4223 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4224 --fromaddr 2001:db8:44::1 # 2 connections from host ::2 matching rule_B will be allowed, 1 will fail to create a state. # Limits for host ::1 will not interfere with host ::2. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4224 --fromaddr 2001:db8:44::2 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4225 --fromaddr 2001:db8:44::2 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4226 --fromaddr 2001:db8:44::2 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4227 --fromaddr 2001:db8:44::2 # We will check the resulting source nodes, though. # Order of source nodes in output is not guaranteed, find each one separately. nodes=$(mktemp) || exit 1 jexec router pfctl -qvsS | normalize_pfctl_s > $nodes for node_regexp in \ '2001:db8:44::1 -> :: \( states 3, connections 3, rate [0-9/\.]+s \) age [0-9:]+, 9 pkts, [0-9]+ bytes, filter rule 3, limit source-track$' \ '2001:db8:44::1 -> :: \( states 3, connections 3, rate [0-9/\.]+s \) age [0-9:]+, 9 pkts, [0-9]+ bytes, filter rule 4, limit source-track$' \ '2001:db8:44::2 -> :: \( states 3, connections 3, rate [0-9/\.]+s \) age [0-9:]+, 9 pkts, [0-9]+ bytes, filter rule 4, limit source-track$' \ ; do grep -qE "${node_regexp}" $nodes || atf_fail "Source node not found for '${node_regexp}'" done # Check if limit counters have been properly set. jexec router pfctl -qvvsi | grep -qE 'max-src-states\s+3\s+' || atf_fail "max-src-states not set to 3" } max_src_states_rule_cleanup() { pft_cleanup } max_src_states_global_head() { atf_set descr 'Max states per source global' atf_set require.user root atf_set require.progs python3 scapy } max_src_states_global_body() { setup_router_server_ipv6 # Clients will connect from another network behind the router. # This allows for using multiple source addresses and for tester jail # to not respond with RST packets for SYN+ACKs. jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 jexec server route add -6 2001:db8:44::0/64 2001:db8:43::1 pft_set_rules router \ "block" \ "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "pass in on ${epair_tester}b inet6 proto tcp from port 4210:4219 keep state (max-src-states 3 source-track global) label rule_A" \ "pass in on ${epair_tester}b inet6 proto tcp from port 4220:4229 keep state (max-src-states 3 source-track global) label rule_B" \ "pass out on ${epair_server}a keep state" # Global source tracking creates a single source node shared between all # rules for each connecting source IP address and counts states created # by all rules. Each rule has its own max-src-conn value checked against # that single source node. # 3 connections from host …::1 matching rule_A will be allowed. ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4211 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4212 --fromaddr 2001:db8:44::1 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4213 --fromaddr 2001:db8:44::1 # The 4th connection matching rule_A from host …::1 will have its state killed. ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4214 --fromaddr 2001:db8:44::1 # A connection matching rule_B from host …::1 will have its state killed too. ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4221 --fromaddr 2001:db8:44::1 nodes=$(mktemp) || exit 1 jexec router pfctl -qvsS | normalize_pfctl_s > $nodes cat $nodes node_regexp='2001:db8:44::1 -> :: \( states 3, connections 3, rate [0-9/\.]+s \) age [0-9:]+, 9 pkts, [0-9]+ bytes, limit source-track' grep -qE "$node_regexp" $nodes || atf_fail "Source nodes not matching expected output" } max_src_states_global_cleanup() { pft_cleanup } sn_types_compat_head() { atf_set descr 'Combination of source node types with compat NAT rules' atf_set require.user root atf_set require.progs python3 scapy } sn_types_compat_body() { setup_router_dummy_ipv6 # Clients will connect from another network behind the router. # This allows for using multiple source addresses. jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 # Additional gateways for route-to. rtgw=${net_server_host_server%::*}::2:1 jexec router ndp -s ${rtgw} 00:01:02:03:04:05 # This test will check for proper source node creation for: # max-src-states -> PF_SN_LIMIT # sticky-address -> PF_SN_NAT # route-to -> PF_SN_ROUTE # The test expands to all 8 combinations of those source nodes being # present or not. pft_set_rules router \ "table { ${rtgw} }" \ "table { 2001:db8:45::1 }" \ "rdr on ${epair_tester}b inet6 proto tcp from 2001:db8:44::10/124 to 2001:db8:45::1 -> port 4242 sticky-address" \ "block" \ "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "pass in quick on ${epair_tester}b route-to ( ${epair_server}a ) inet6 proto tcp from port 4211 keep state label rule_3" \ "pass in quick on ${epair_tester}b route-to ( ${epair_server}a ) sticky-address inet6 proto tcp from port 4212 keep state label rule_4" \ "pass in quick on ${epair_tester}b route-to ( ${epair_server}a ) inet6 proto tcp from port 4213 keep state (max-src-states 3 source-track rule) label rule_5" \ "pass in quick on ${epair_tester}b route-to ( ${epair_server}a ) sticky-address inet6 proto tcp from port 4214 keep state (max-src-states 3 source-track rule) label rule_6" \ "pass out quick on ${epair_server}a keep state" # We don't check if state limits are properly enforced, this is tested # by other tests in this file. # Source address will not match the NAT rule ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4211 --fromaddr 2001:db8:44::01 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4212 --fromaddr 2001:db8:44::02 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4213 --fromaddr 2001:db8:44::03 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4214 --fromaddr 2001:db8:44::04 --to 2001:db8:45::1 # Source address will match the NAT rule ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4211 --fromaddr 2001:db8:44::11 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4212 --fromaddr 2001:db8:44::12 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4213 --fromaddr 2001:db8:44::13 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4214 --fromaddr 2001:db8:44::14 --to 2001:db8:45::1 states=$(mktemp) || exit 1 jexec router pfctl -qvss | normalize_pfctl_s > $states nodes=$(mktemp) || exit 1 jexec router pfctl -qvvsS | normalize_pfctl_s > $nodes # Order of states in output is not guaranteed, find each one separately. for state_regexp in \ 'all tcp 2001:db8:45::1\[9\] <- 2001:db8:44::1\[4211\] .* 1:0 pkts, 76:0 bytes, rule 3$' \ 'all tcp 2001:db8:45::1\[9\] <- 2001:db8:44::2\[4212\] .* 1:0 pkts, 76:0 bytes, rule 4, route sticky-address$' \ 'all tcp 2001:db8:45::1\[9\] <- 2001:db8:44::3\[4213\] .* 1:0 pkts, 76:0 bytes, rule 5, limit source-track$' \ 'all tcp 2001:db8:45::1\[9\] <- 2001:db8:44::4\[4214\] .* 1:0 pkts, 76:0 bytes, rule 6, limit source-track, route sticky-address$' \ 'all tcp 2001:db8:45::1\[4242\] \(2001:db8:45::1\[9\]\) <- 2001:db8:44::11\[4211\] .* 1:0 pkts, 76:0 bytes, rule 3, NAT/RDR sticky-address' \ 'all tcp 2001:db8:45::1\[4242\] \(2001:db8:45::1\[9\]\) <- 2001:db8:44::12\[4212\] .* 1:0 pkts, 76:0 bytes, rule 4, NAT/RDR sticky-address, route sticky-address' \ 'all tcp 2001:db8:45::1\[4242\] \(2001:db8:45::1\[9\]\) <- 2001:db8:44::13\[4213\] .* 1:0 pkts, 76:0 bytes, rule 5, limit source-track, NAT/RDR sticky-address' \ 'all tcp 2001:db8:45::1\[4242\] \(2001:db8:45::1\[9\]\) <- 2001:db8:44::14\[4214\] .* 1:0 pkts, 76:0 bytes, rule 6, limit source-track, NAT/RDR sticky-address, route sticky-address' \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done # Order of source nodes in output is not guaranteed, find each one separately. for node_regexp in \ '2001:db8:44::2 -> 2001:db8:43::2:1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 4, route sticky-address' \ '2001:db8:44::3 -> :: \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 5, limit source-track' \ '2001:db8:44::4 -> 2001:db8:43::2:1 \( states 1, connections 0, rate 0.0/0s ) age [0-9:]+, 1 pkts, 76 bytes, filter rule 6, route sticky-address' \ '2001:db8:44::4 -> :: \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 6, limit source-track' \ '2001:db8:44::11 -> 2001:db8:45::1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, rdr rule 0, NAT/RDR sticky-address' \ '2001:db8:44::12 -> 2001:db8:45::1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, rdr rule 0, NAT/RDR sticky-address' \ '2001:db8:44::12 -> 2001:db8:43::2:1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 4, route sticky-address' \ '2001:db8:44::13 -> 2001:db8:45::1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, rdr rule 0, NAT/RDR sticky-address' \ '2001:db8:44::13 -> :: \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 5, limit source-track' \ '2001:db8:44::14 -> 2001:db8:45::1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, rdr rule 0, NAT/RDR sticky-address' \ '2001:db8:44::14 -> 2001:db8:43::2:1 \( states 1, connections 0, rate 0.0/0s ) age [0-9:]+, 1 pkts, 76 bytes, filter rule 6, route sticky-address' \ '2001:db8:44::14 -> :: \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 6, limit source-track' \ ; do grep -qE "${node_regexp}" $nodes || atf_fail "Source node not found for '${node_regexp}'" done ! grep -q 'filter rule 3' $nodes || atf_fail "Source node found for rule 3" } sn_types_compat_cleanup() { pft_cleanup } sn_types_pass_head() { atf_set descr 'Combination of source node types with pass NAT rules' atf_set require.user root atf_set require.progs python3 scapy } sn_types_pass_body() { setup_router_dummy_ipv6 # Clients will connect from another network behind the router. # This allows for using multiple source addresses. jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 # Additional gateways for route-to. rtgw=${net_server_host_server%::*}::2:1 jexec router ndp -s ${rtgw} 00:01:02:03:04:05 # This test will check for proper source node creation for: # max-src-states -> PF_SN_LIMIT # sticky-address -> PF_SN_NAT # route-to -> PF_SN_ROUTE # The test expands to all 8 combinations of those source nodes being # present or not. pft_set_rules router \ "table { ${rtgw} }" \ "table { 2001:db8:45::1 }" \ "block" \ "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ "match in on ${epair_tester}b inet6 proto tcp from 2001:db8:44::10/124 to 2001:db8:45::1 rdr-to port 4242 sticky-address label rule_3" \ "pass in quick on ${epair_tester}b route-to ( ${epair_server}a ) inet6 proto tcp from port 4211 keep state label rule_4" \ "pass in quick on ${epair_tester}b route-to ( ${epair_server}a ) sticky-address inet6 proto tcp from port 4212 keep state label rule_5" \ "pass in quick on ${epair_tester}b route-to ( ${epair_server}a ) inet6 proto tcp from port 4213 keep state (max-src-states 3 source-track rule) label rule_6" \ "pass in quick on ${epair_tester}b route-to ( ${epair_server}a ) sticky-address inet6 proto tcp from port 4214 keep state (max-src-states 3 source-track rule) label rule_7" \ "pass out quick on ${epair_server}a keep state" # We don't check if state limits are properly enforced, this is tested # by other tests in this file. # Source address will not match the NAT rule ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4211 --fromaddr 2001:db8:44::01 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4212 --fromaddr 2001:db8:44::02 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4213 --fromaddr 2001:db8:44::03 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4214 --fromaddr 2001:db8:44::04 --to 2001:db8:45::1 # Source address will match the NAT rule ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4211 --fromaddr 2001:db8:44::11 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4212 --fromaddr 2001:db8:44::12 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4213 --fromaddr 2001:db8:44::13 --to 2001:db8:45::1 ping_dummy_check_request exit:0 --ping-type=tcpsyn --send-sport=4214 --fromaddr 2001:db8:44::14 --to 2001:db8:45::1 states=$(mktemp) || exit 1 jexec router pfctl -qvss | normalize_pfctl_s > $states nodes=$(mktemp) || exit 1 jexec router pfctl -qvvsS | normalize_pfctl_s > $nodes echo " === states ===" cat $states echo " === nodes ===" cat $nodes echo " === end === " # Order of states in output is not guaranteed, find each one separately. for state_regexp in \ 'all tcp 2001:db8:45::1\[9\] <- 2001:db8:44::1\[4211\] .* 1:0 pkts, 76:0 bytes, rule 4$' \ 'all tcp 2001:db8:45::1\[9\] <- 2001:db8:44::2\[4212\] .* 1:0 pkts, 76:0 bytes, rule 5, route sticky-address$' \ 'all tcp 2001:db8:45::1\[9\] <- 2001:db8:44::3\[4213\] .* 1:0 pkts, 76:0 bytes, rule 6, limit source-track$' \ 'all tcp 2001:db8:45::1\[9\] <- 2001:db8:44::4\[4214\] .* 1:0 pkts, 76:0 bytes, rule 7, limit source-track, route sticky-address$' \ 'all tcp 2001:db8:45::1\[4242\] \(2001:db8:45::1\[9\]\) <- 2001:db8:44::11\[4211\] .* 1:0 pkts, 76:0 bytes, rule 4, NAT/RDR sticky-address' \ 'all tcp 2001:db8:45::1\[4242\] \(2001:db8:45::1\[9\]\) <- 2001:db8:44::12\[4212\] .* 1:0 pkts, 76:0 bytes, rule 5, NAT/RDR sticky-address, route sticky-address' \ 'all tcp 2001:db8:45::1\[4242\] \(2001:db8:45::1\[9\]\) <- 2001:db8:44::13\[4213\] .* 1:0 pkts, 76:0 bytes, rule 6, limit source-track, NAT/RDR sticky-address' \ 'all tcp 2001:db8:45::1\[4242\] \(2001:db8:45::1\[9\]\) <- 2001:db8:44::14\[4214\] .* 1:0 pkts, 76:0 bytes, rule 7, limit source-track, NAT/RDR sticky-address, route sticky-address' \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done # Order of source nodes in output is not guaranteed, find each one separately. for node_regexp in \ '2001:db8:44::2 -> 2001:db8:43::2:1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 5, route sticky-address' \ '2001:db8:44::3 -> :: \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 6, limit source-track' \ '2001:db8:44::4 -> 2001:db8:43::2:1 \( states 1, connections 0, rate 0.0/0s ) age [0-9:]+, 1 pkts, 76 bytes, filter rule 7, route sticky-address' \ '2001:db8:44::4 -> :: \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 7, limit source-track' \ '2001:db8:44::11 -> 2001:db8:45::1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 3, NAT/RDR sticky-address' \ '2001:db8:44::12 -> 2001:db8:45::1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 3, NAT/RDR sticky-address' \ '2001:db8:44::12 -> 2001:db8:43::2:1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 5, route sticky-address' \ '2001:db8:44::13 -> 2001:db8:45::1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 3, NAT/RDR sticky-address' \ '2001:db8:44::13 -> :: \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 6, limit source-track' \ '2001:db8:44::14 -> 2001:db8:45::1 \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 3, NAT/RDR sticky-address' \ '2001:db8:44::14 -> 2001:db8:43::2:1 \( states 1, connections 0, rate 0.0/0s ) age [0-9:]+, 1 pkts, 76 bytes, filter rule 7, route sticky-address' \ '2001:db8:44::14 -> :: \( states 1, connections 0, rate 0.0/0s \) age [0-9:]+, 1 pkts, 76 bytes, filter rule 7, limit source-track' \ ; do grep -qE "${node_regexp}" $nodes || atf_fail "Source node not found for '${node_regexp}'" done } sn_types_pass_cleanup() { pft_cleanup } atf_test_case "mixed_af" "cleanup" mixed_af_head() { atf_set descr 'Test mixed address family source tracking' atf_set require.user root + atf_set require.progs python3 scapy } mixed_af_body() { setup_router_server_nat64 # Clients will connect from another network behind the router. # This allows for using multiple source addresses. jexec router route add -6 ${net_clients_6}::/${net_clients_6_mask} ${net_tester_6_host_tester} jexec router pfctl -e pft_set_rules router \ "set reassemble yes" \ "set state-policy if-bound" \ "pass in on ${epair_tester}b \ route-to { (${epair_server1}a ${net_server1_4_host_server}) \ } sticky-address \ inet6 proto tcp from any to 64:ff9b::/96 \ af-to inet from ${net_clients_4}.0/${net_clients_4_mask} round-robin sticky-address" atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_tester}a \ --replyif ${epair_tester}a \ --fromaddr 2001:db8:44::1 \ --to 64:ff9b::192.0.2.100 \ --ping-type=tcp3way \ --send-sport=4201 states=$(mktemp) || exit 1 jexec router pfctl -qvvss | normalize_pfctl_s > $states nodes=$(mktemp) || exit 1 jexec router pfctl -qvvsS | normalize_pfctl_s > $nodes # States are checked for proper route-to information. # The route-to gateway is IPv4. for state_regexp in \ "${epair_tester}b tcp 203.0.113.0:4201 \(2001:db8:44::1\[4201\]\) -> 192.0.2.100:9 \(64:ff9b::c000:264\[9\]\) .* route-to: 198.51.100.18@${epair_server1}a" \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done # Source nodes map IPv6 source address onto IPv4 gateway and IPv4 SNAT address. for node_regexp in \ '2001:db8:44::1 -> 203.0.113.0 .* states 1, .* NAT/RDR sticky-address' \ '2001:db8:44::1 -> 198.51.100.18 .* states 1, .* route sticky-address' \ ; do grep -qE "${node_regexp}" $nodes || atf_fail "Source node not found for '${node_regexp}'" done } mixed_af_cleanup() { pft_cleanup } atf_init_test_cases() { atf_add_test_case "source_track" atf_add_test_case "kill" atf_add_test_case "max_src_conn_rule" atf_add_test_case "max_src_states_rule" atf_add_test_case "max_src_states_global" atf_add_test_case "sn_types_compat" atf_add_test_case "sn_types_pass" atf_add_test_case "mixed_af" }