diff --git a/tests/sys/netpfil/pf/divert-to.sh b/tests/sys/netpfil/pf/divert-to.sh index 72adbeedb007..c7118c397032 100644 --- a/tests/sys/netpfil/pf/divert-to.sh +++ b/tests/sys/netpfil/pf/divert-to.sh @@ -1,529 +1,386 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2023 Igor Ostapenko # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # pf divert-to action test cases # # -----------| |-- |----| ----| |----------- # ( ) inbound |pf_check_in| ) -> |host| -> ( ) |pf_check_out| outbound ) # -----------| | |-- |----| ----| | |----------- # | | # \|/ \|/ # |------| |------| # |divapp| |divapp| # |------| |------| # # The basic cases: # - inbound > diverted | divapp terminated # - inbound > diverted > inbound | host terminated # - inbound > diverted > outbound | network terminated # - outbound > diverted | divapp terminated # - outbound > diverted > outbound | network terminated # - outbound > diverted > inbound | e.g. host terminated # # When a packet is diverted, forwarded, and possibly diverted again: # - inbound > diverted > inbound > forwarded # > outbound | network terminated # - inbound > diverted > inbound > forwarded # > outbound > diverted > outbound | network terminated # # Test case naming legend: -# ipfwon - with ipfw enabled -# ipfwoff - with ipfw disabled # in - inbound # div - diverted # out - outbound # fwd - forwarded # dn - delayed by dummynet # . $(atf_get_srcdir)/utils.subr divert_init() { if ! kldstat -q -m ipdivert; then atf_skip "This test requires ipdivert" fi } dummynet_init() { if ! kldstat -q -m dummynet; then atf_skip "This test requires dummynet" fi } -ipfw_init() -{ - if ! kldstat -q -m ipfw; then - atf_skip "This test requires ipfw" - fi -} - -assert_ipfw_is_off() -{ - if kldstat -q -m ipfw; then - atf_skip "This test is for the case when ipfw is not loaded" - fi -} - -atf_test_case "ipfwoff_in_div" "cleanup" -ipfwoff_in_div_head() +atf_test_case "in_div" "cleanup" +in_div_head() { atf_set descr 'Test inbound > diverted | divapp terminated' atf_set require.user root } -ipfwoff_in_div_body() +in_div_body() { - local ipfwon - pft_init divert_init - test "$1" == "ipfwon" && ipfwon="yes" - test $ipfwon && ipfw_init || assert_ipfw_is_off epair=$(vnet_mkepair) vnet_mkjail div ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec div ifconfig ${epair}b 192.0.2.2/24 up - test $ipfwon && jexec div ipfw add 65534 allow all from any to any # Sanity check atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 jexec div pfctl -e pft_set_rules div \ "pass all" \ "pass in inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2000" jexec div $(atf_get_srcdir)/divapp 2000 & divapp_pid=$! # Wait for the divapp to be ready sleep 1 # divapp is expected to "eat" the packet atf_check -s not-exit:0 -o ignore ping -c1 192.0.2.2 wait $divapp_pid } -ipfwoff_in_div_cleanup() -{ - pft_cleanup -} - -atf_test_case "ipfwon_in_div" "cleanup" -ipfwon_in_div_head() -{ - atf_set descr 'Test inbound > diverted | divapp terminated, with ipfw enabled' - atf_set require.user root -} -ipfwon_in_div_body() -{ - ipfwoff_in_div_body "ipfwon" -} -ipfwon_in_div_cleanup() +in_div_cleanup() { pft_cleanup } -atf_test_case "ipfwoff_in_div_in" "cleanup" -ipfwoff_in_div_in_head() +atf_test_case "in_div_in" "cleanup" +in_div_in_head() { atf_set descr 'Test inbound > diverted > inbound | host terminated' atf_set require.user root } -ipfwoff_in_div_in_body() +in_div_in_body() { - local ipfwon - pft_init divert_init - test "$1" == "ipfwon" && ipfwon="yes" - test $ipfwon && ipfw_init || assert_ipfw_is_off epair=$(vnet_mkepair) vnet_mkjail div ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec div ifconfig ${epair}b 192.0.2.2/24 up - test $ipfwon && jexec div ipfw add 65534 allow all from any to any # Sanity check atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 jexec div pfctl -e pft_set_rules div \ "pass all" \ "pass in inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2000 no state" jexec div $(atf_get_srcdir)/divapp 2000 divert-back & divapp_pid=$! # Wait for the divapp to be ready sleep 1 # divapp is NOT expected to "eat" the packet atf_check -s exit:0 -o ignore ping -c1 192.0.2.2 wait $divapp_pid } -ipfwoff_in_div_in_cleanup() +in_div_in_cleanup() { pft_cleanup } -atf_test_case "ipfwon_in_div_in" "cleanup" -ipfwon_in_div_in_head() -{ - atf_set descr 'Test inbound > diverted > inbound | host terminated, with ipfw enabled' - atf_set require.user root -} -ipfwon_in_div_in_body() -{ - ipfwoff_in_div_in_body "ipfwon" -} -ipfwon_in_div_in_cleanup() -{ - pft_cleanup -} - -atf_test_case "ipfwoff_out_div" "cleanup" -ipfwoff_out_div_head() +atf_test_case "out_div" "cleanup" +out_div_head() { atf_set descr 'Test outbound > diverted | divapp terminated' atf_set require.user root } -ipfwoff_out_div_body() +out_div_body() { - local ipfwon - pft_init divert_init - test "$1" == "ipfwon" && ipfwon="yes" - test $ipfwon && ipfw_init || assert_ipfw_is_off epair=$(vnet_mkepair) vnet_mkjail div ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec div ifconfig ${epair}b 192.0.2.2/24 up - test $ipfwon && jexec div ipfw add 65534 allow all from any to any # Sanity check atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 jexec div pfctl -e pft_set_rules div \ "pass all" \ "pass in inet proto icmp icmp-type echoreq no state" \ "pass out inet proto icmp icmp-type echorep divert-to 127.0.0.1 port 2000 no state" jexec div $(atf_get_srcdir)/divapp 2000 & divapp_pid=$! # Wait for the divapp to be ready sleep 1 # divapp is expected to "eat" the packet atf_check -s not-exit:0 -o ignore ping -c1 192.0.2.2 wait $divapp_pid } -ipfwoff_out_div_cleanup() -{ - pft_cleanup -} - -atf_test_case "ipfwon_out_div" "cleanup" -ipfwon_out_div_head() -{ - atf_set descr 'Test outbound > diverted | divapp terminated, with ipfw enabled' - atf_set require.user root -} -ipfwon_out_div_body() -{ - ipfwoff_out_div_body "ipfwon" -} -ipfwon_out_div_cleanup() +out_div_cleanup() { pft_cleanup } -atf_test_case "ipfwoff_out_div_out" "cleanup" -ipfwoff_out_div_out_head() +atf_test_case "out_div_out" "cleanup" +out_div_out_head() { atf_set descr 'Test outbound > diverted > outbound | network terminated' atf_set require.user root } -ipfwoff_out_div_out_body() +out_div_out_body() { - local ipfwon - pft_init divert_init - test "$1" == "ipfwon" && ipfwon="yes" - test $ipfwon && ipfw_init || assert_ipfw_is_off epair=$(vnet_mkepair) vnet_mkjail div ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec div ifconfig ${epair}b 192.0.2.2/24 up - test $ipfwon && jexec div ipfw add 65534 allow all from any to any # Sanity check atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 jexec div pfctl -e pft_set_rules div \ "pass all" \ "pass in inet proto icmp icmp-type echoreq no state" \ "pass out inet proto icmp icmp-type echorep divert-to 127.0.0.1 port 2000 no state" jexec div $(atf_get_srcdir)/divapp 2000 divert-back & divapp_pid=$! # Wait for the divapp to be ready sleep 1 # divapp is NOT expected to "eat" the packet atf_check -s exit:0 -o ignore ping -c1 192.0.2.2 wait $divapp_pid } -ipfwoff_out_div_out_cleanup() +out_div_out_cleanup() { pft_cleanup } -atf_test_case "ipfwon_out_div_out" "cleanup" -ipfwon_out_div_out_head() -{ - atf_set descr 'Test outbound > diverted > outbound | network terminated, with ipfw enabled' - atf_set require.user root -} -ipfwon_out_div_out_body() -{ - ipfwoff_out_div_out_body "ipfwon" -} -ipfwon_out_div_out_cleanup() -{ - pft_cleanup -} - -atf_test_case "ipfwoff_in_div_in_fwd_out_div_out" "cleanup" -ipfwoff_in_div_in_fwd_out_div_out_head() +atf_test_case "in_div_in_fwd_out_div_out" "cleanup" +in_div_in_fwd_out_div_out_head() { atf_set descr 'Test inbound > diverted > inbound > forwarded > outbound > diverted > outbound | network terminated' atf_set require.user root } -ipfwoff_in_div_in_fwd_out_div_out_body() +in_div_in_fwd_out_div_out_body() { - local ipfwon - pft_init divert_init - test "$1" == "ipfwon" && ipfwon="yes" - test $ipfwon && ipfw_init || assert_ipfw_is_off # host router site epair0=$(vnet_mkepair) epair1=$(vnet_mkepair) vnet_mkjail router ${epair0}b ${epair1}a ifconfig ${epair0}a 192.0.2.1/24 up jexec router sysctl net.inet.ip.forwarding=1 jexec router ifconfig ${epair0}b 192.0.2.2/24 up jexec router ifconfig ${epair1}a 198.51.100.1/24 up - test $ipfwon && jexec router ipfw add 65534 allow all from any to any vnet_mkjail site ${epair1}b jexec site ifconfig ${epair1}b 198.51.100.2/24 up jexec site route add default 198.51.100.1 - test $ipfwon && jexec site ipfw add 65534 allow all from any to any route add -net 198.51.100.0/24 192.0.2.2 # Sanity check atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 # Should be routed without pf atf_check -s exit:0 -o ignore ping -c3 198.51.100.2 jexec router pfctl -e pft_set_rules router \ "pass all" \ "pass in inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2001 no state" \ "pass out inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2002 no state" jexec router $(atf_get_srcdir)/divapp 2001 divert-back & indivapp_pid=$! jexec router $(atf_get_srcdir)/divapp 2002 divert-back & outdivapp_pid=$! # Wait for the divappS to be ready sleep 1 # Both divappS are NOT expected to "eat" the packet atf_check -s exit:0 -o ignore ping -c1 198.51.100.2 wait $indivapp_pid && wait $outdivapp_pid } -ipfwoff_in_div_in_fwd_out_div_out_cleanup() -{ - pft_cleanup -} - -atf_test_case "ipfwon_in_div_in_fwd_out_div_out" "cleanup" -ipfwon_in_div_in_fwd_out_div_out_head() -{ - atf_set descr 'Test inbound > diverted > inbound > forwarded > outbound > diverted > outbound | network terminated, with ipfw enabled' - atf_set require.user root -} -ipfwon_in_div_in_fwd_out_div_out_body() -{ - ipfwoff_in_div_in_fwd_out_div_out_body "ipfwon" -} -ipfwon_in_div_in_fwd_out_div_out_cleanup() +in_div_in_fwd_out_div_out_cleanup() { pft_cleanup } -atf_test_case "ipfwoff_in_dn_in_div_in_out_div_out_dn_out" "cleanup" -ipfwoff_in_dn_in_div_in_out_div_out_dn_out_head() +atf_test_case "in_dn_in_div_in_out_div_out_dn_out" "cleanup" +in_dn_in_div_in_out_div_out_dn_out_head() { atf_set descr 'Test inbound > delayed+diverted > outbound > diverted+delayed > outbound | network terminated' atf_set require.user root } -ipfwoff_in_dn_in_div_in_out_div_out_dn_out_body() +in_dn_in_div_in_out_div_out_dn_out_body() { - local ipfwon - pft_init divert_init dummynet_init - test "$1" == "ipfwon" && ipfwon="yes" - test $ipfwon && ipfw_init || assert_ipfw_is_off epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up ifconfig ${epair}a ether 02:00:00:00:00:01 jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up - test $ipfwon && jexec alcatraz ipfw add 65534 allow all from any to any # Sanity check atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 # a) ping should time out due to very narrow dummynet pipes { jexec alcatraz dnctl pipe 1001 config bw 1Byte/s jexec alcatraz dnctl pipe 1002 config bw 1Byte/s jexec alcatraz pfctl -e pft_set_rules alcatraz \ "ether pass in from 02:00:00:00:00:01 l3 all dnpipe 1001" \ "ether pass out to 02:00:00:00:00:01 l3 all dnpipe 1002 " \ "pass all" \ "pass in inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 1001 no state" \ "pass out inet proto icmp icmp-type echorep divert-to 127.0.0.1 port 1002 no state" jexec alcatraz $(atf_get_srcdir)/divapp 1001 divert-back & indivapp_pid=$! jexec alcatraz $(atf_get_srcdir)/divapp 1002 divert-back & outdivapp_pid=$! # Wait for the divappS to be ready sleep 1 atf_check -s not-exit:0 -o ignore ping -c1 -s56 -t1 192.0.2.2 wait $indivapp_pid atf_check_not_equal 0 $? wait $outdivapp_pid atf_check_not_equal 0 $? # } # b) ping should NOT time out due to wide enough dummynet pipes { jexec alcatraz dnctl pipe 2001 config bw 100KByte/s jexec alcatraz dnctl pipe 2002 config bw 100KByte/s jexec alcatraz pfctl -e pft_set_rules alcatraz \ "ether pass in from 02:00:00:00:00:01 l3 all dnpipe 2001" \ "ether pass out to 02:00:00:00:00:01 l3 all dnpipe 2002 " \ "pass all" \ "pass in inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2001 no state" \ "pass out inet proto icmp icmp-type echorep divert-to 127.0.0.1 port 2002 no state" jexec alcatraz $(atf_get_srcdir)/divapp 2001 divert-back & indivapp_pid=$! jexec alcatraz $(atf_get_srcdir)/divapp 2002 divert-back & outdivapp_pid=$! # Wait for the divappS to be ready sleep 1 atf_check -s exit:0 -o ignore ping -c1 -s56 -t1 192.0.2.2 wait $indivapp_pid atf_check_equal 0 $? wait $outdivapp_pid atf_check_equal 0 $? # } } -ipfwoff_in_dn_in_div_in_out_div_out_dn_out_cleanup() -{ - pft_cleanup -} - -atf_test_case "ipfwon_in_dn_in_div_in_out_div_out_dn_out" "cleanup" -ipfwon_in_dn_in_div_in_out_div_out_dn_out_head() -{ - atf_set descr 'Test inbound > delayed+diverted > outbound > diverted+delayed > outbound | network terminated, with ipfw enabled' - atf_set require.user root -} -ipfwon_in_dn_in_div_in_out_div_out_dn_out_body() -{ - ipfwoff_in_dn_in_div_in_out_div_out_dn_out_body "ipfwon" -} -ipfwon_in_dn_in_div_in_out_div_out_dn_out_cleanup() +in_dn_in_div_in_out_div_out_dn_out_cleanup() { pft_cleanup } atf_init_test_cases() { - atf_add_test_case "ipfwoff_in_div" - atf_add_test_case "ipfwoff_in_div_in" - atf_add_test_case "ipfwon_in_div" - atf_add_test_case "ipfwon_in_div_in" + atf_add_test_case "in_div" + atf_add_test_case "in_div_in" - atf_add_test_case "ipfwoff_out_div" - atf_add_test_case "ipfwoff_out_div_out" - atf_add_test_case "ipfwon_out_div" - atf_add_test_case "ipfwon_out_div_out" + atf_add_test_case "out_div" + atf_add_test_case "out_div_out" - atf_add_test_case "ipfwoff_in_div_in_fwd_out_div_out" - atf_add_test_case "ipfwon_in_div_in_fwd_out_div_out" + atf_add_test_case "in_div_in_fwd_out_div_out" - atf_add_test_case "ipfwoff_in_dn_in_div_in_out_div_out_dn_out" - atf_add_test_case "ipfwon_in_dn_in_div_in_out_div_out_dn_out" + atf_add_test_case "in_dn_in_div_in_out_div_out_dn_out" } diff --git a/tests/sys/netpfil/pf/if_enc.sh b/tests/sys/netpfil/pf/if_enc.sh index 2e9060d4aa68..40090b175470 100644 --- a/tests/sys/netpfil/pf/if_enc.sh +++ b/tests/sys/netpfil/pf/if_enc.sh @@ -1,220 +1,178 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2024 Igor Ostapenko # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr # # The following network is used as a base for testing. # # # ${awan}b |----------| ${bwan}b # 2.0.0.1 | host wan | 3.0.0.1 # .---->| Internet |<----. # A WAN | |----------| | B WAN # | | # Office A side | | Office B side # | ${awan}a ${bwan}a | # v 2.0.0.22 3.0.0.33 v # ${alan}b |----------| |----------| ${blan}b # 1.0.0.1 | host agw | | host bgw | 4.0.0.1 # .----------->| gateway | < IPsec > | gateway |<-----------. # | A LAN |----------| tunnel |----------| B LAN | # | | # | | # | ${alan}a ${blan}a | # v 1.0.0.11 4.0.0.44 v # |----------| |----------| # | host a | | host b | # | client | | client | # |----------| |----------| # # # There is routing between office A clients and office B ones. The traffic is # encrypted, i.e. host wan should see IPsec flow (ESP packets). # ipsec_init() { if ! sysctl -q kern.features.ipsec >/dev/null ; then atf_skip "This test requires ipsec" fi } if_enc_init() { ipsec_init if ! kldstat -q -m if_enc; then atf_skip "This test requires if_enc" fi } -ipfw_init() -{ - if ! kldstat -q -m ipfw; then - atf_skip "This test requires ipfw" - fi -} - -assert_ipfw_is_off() -{ - if kldstat -q -m ipfw; then - atf_skip "This test is for the case when ipfw is not loaded" - fi -} - build_test_network() { - local ipfwon=$1 - alan=$(vnet_mkepair) awan=$(vnet_mkepair) bwan=$(vnet_mkepair) blan=$(vnet_mkepair) # host a vnet_mkjail a ${alan}a jexec a ifconfig ${alan}a 1.0.0.11/24 up jexec a route add default 1.0.0.1 - test $ipfwon && jexec a ipfw add 65534 allow all from any to any # host agw vnet_mkjail agw ${alan}b ${awan}a jexec agw ifconfig ${alan}b 1.0.0.1/24 up jexec agw ifconfig ${awan}a 2.0.0.22/24 up jexec agw route add default 2.0.0.1 jexec agw sysctl net.inet.ip.forwarding=1 - test $ipfwon && jexec agw ipfw add 65534 allow all from any to any # host wan vnet_mkjail wan ${awan}b ${bwan}b jexec wan ifconfig ${awan}b 2.0.0.1/24 up jexec wan ifconfig ${bwan}b 3.0.0.1/24 up jexec wan sysctl net.inet.ip.forwarding=1 - test $ipfwon && jexec wan ipfw add 65534 allow all from any to any # host bgw vnet_mkjail bgw ${bwan}a ${blan}b jexec bgw ifconfig ${bwan}a 3.0.0.33/24 up jexec bgw ifconfig ${blan}b 4.0.0.1/24 up jexec bgw route add default 3.0.0.1 jexec bgw sysctl net.inet.ip.forwarding=1 - test $ipfwon && jexec bgw ipfw add 65534 allow all from any to any # host b vnet_mkjail b ${blan}a jexec b ifconfig ${blan}a 4.0.0.44/24 up jexec b route add default 4.0.0.1 - test $ipfwon && jexec b ipfw add 65534 allow all from any to any # Office A VPN setup echo ' spdadd 1.0.0.0/24 4.0.0.0/24 any -P out ipsec esp/tunnel/2.0.0.22-3.0.0.33/require; spdadd 4.0.0.0/24 1.0.0.0/24 any -P in ipsec esp/tunnel/3.0.0.33-2.0.0.22/require; add 2.0.0.22 3.0.0.33 esp 0x203 -E aes-gcm-16 "123456789012345678901234567890123456"; add 3.0.0.33 2.0.0.22 esp 0x302 -E aes-gcm-16 "123456789012345678901234567890123456"; ' | jexec agw setkey -c # Office B VPN setup echo ' spdadd 4.0.0.0/24 1.0.0.0/24 any -P out ipsec esp/tunnel/3.0.0.33-2.0.0.22/require; spdadd 1.0.0.0/24 4.0.0.0/24 any -P in ipsec esp/tunnel/2.0.0.22-3.0.0.33/require; add 2.0.0.22 3.0.0.33 esp 0x203 -E aes-gcm-16 "123456789012345678901234567890123456"; add 3.0.0.33 2.0.0.22 esp 0x302 -E aes-gcm-16 "123456789012345678901234567890123456"; ' | jexec bgw setkey -c } -atf_test_case "ipfwoff_ip4_pfil_in_after_stripping" "cleanup" -ipfwoff_ip4_pfil_in_after_stripping_head() +atf_test_case "ip4_pfil_in_after_stripping" "cleanup" +ip4_pfil_in_after_stripping_head() { - atf_set descr 'Test that pf pulls up mbuf if m_len==0 after stripping the outer header, with ipfw disabled' + atf_set descr 'Test that pf pulls up mbuf if m_len==0 after stripping the outer header' atf_set require.user root atf_set require.progs nc } -ipfwoff_ip4_pfil_in_after_stripping_body() +ip4_pfil_in_after_stripping_body() { - local ipfwon - pft_init if_enc_init - test "$1" == "ipfwon" && ipfwon="yes" - test $ipfwon && ipfw_init || assert_ipfw_is_off - build_test_network $ipfwon + build_test_network # Sanity check atf_check -s exit:0 -o ignore jexec a ping -c3 4.0.0.44 # Configure port forwarding on host bgw jexec bgw ifconfig enc0 up jexec bgw sysctl net.inet.ipsec.filtertunnel=0 jexec bgw sysctl net.enc.in.ipsec_filter_mask=2 # after stripping jexec bgw sysctl net.enc.out.ipsec_filter_mask=1 # before outer header jexec bgw pfctl -e pft_set_rules bgw \ "rdr on enc0 proto tcp to 4.0.0.1 port 666 -> 4.0.0.44" \ "pass" # Prepare the catcher on host b echo "unexpected" > ./receiver jexec b nc -n4l -N 666 > ./receiver & nc_pid=$! sleep 1 # Poke it from host a to host bgw spell="Ak Ohum Oktay Weez Barsoom." echo $spell | jexec a nc -w3 4.0.0.1 666 # Expect it to hit host b instead sleep 1 # let the catcher finish jexec b kill -KILL $nc_pid # in a fail case the catcher may listen forever atf_check_equal "$spell" "$(cat ./receiver)" } -ipfwoff_ip4_pfil_in_after_stripping_cleanup() -{ - pft_cleanup -} - -atf_test_case "ipfwon_ip4_pfil_in_after_stripping" "cleanup" -ipfwon_ip4_pfil_in_after_stripping_head() -{ - atf_set descr 'Test that pf pulls up mbuf if m_len==0 after stripping the outer header, with ipfw enabled' - atf_set require.user root - atf_set require.progs nc -} -ipfwon_ip4_pfil_in_after_stripping_body() -{ - ipfwoff_ip4_pfil_in_after_stripping_body "ipfwon" -} -ipfwon_ip4_pfil_in_after_stripping_cleanup() +ip4_pfil_in_after_stripping_cleanup() { pft_cleanup } atf_init_test_cases() { - atf_add_test_case "ipfwoff_ip4_pfil_in_after_stripping" - atf_add_test_case "ipfwon_ip4_pfil_in_after_stripping" + atf_add_test_case "ip4_pfil_in_after_stripping" }