diff --git a/tests/sys/netpfil/common/dummynet.sh b/tests/sys/netpfil/common/dummynet.sh index b77b2df84010..66736fbecdb7 100644 --- a/tests/sys/netpfil/common/dummynet.sh +++ b/tests/sys/netpfil/common/dummynet.sh @@ -1,645 +1,641 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2021 Rubicon Communications, LLC (Netgate) # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr . $(atf_get_srcdir)/runner.subr interface_removal_head() { atf_set descr 'Test removing interfaces with dummynet delayed traffic' atf_set require.user root } interface_removal_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up # Sanity check atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2 jexec alcatraz dnctl pipe 1 config delay 1500 firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 pipe 1 ip from any to any" \ "pf" \ "pass on ${epair}b dnpipe 1" # single ping succeeds just fine atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 # Send traffic that'll still be pending when we remove the interface ping -c 5 -s 1200 192.0.2.2 & sleep 1 # Give ping the chance to start. # Remove the interface, but keep the jail around for a bit ifconfig ${epair}a destroy sleep 3 } interface_removal_cleanup() { firewall_cleanup $1 } pipe_head() { atf_set descr 'Basic pipe test' atf_set require.user root } pipe_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up # Sanity check atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2 jexec alcatraz dnctl pipe 1 config bw 30Byte/s firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 pipe 1 ip from any to any" \ "pf" \ "pass on ${epair}b dnpipe 1" # single ping succeeds just fine atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 # Saturate the link ping -i .1 -c 5 -s 1200 192.0.2.2 # We should now be hitting the limits and get this packet dropped. atf_check -s exit:2 -o ignore ping -c 1 -s 1200 192.0.2.2 } pipe_cleanup() { firewall_cleanup $1 } pipe_v6_head() { atf_set descr 'Basic IPv6 pipe test' atf_set require.user root } pipe_v6_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a inet6 2001:db8:42::1/64 up no_dad jexec alcatraz ifconfig ${epair}b inet6 2001:db8:42::2/64 up no_dad # Sanity check atf_check -s exit:0 -o ignore ping6 -i .1 -c 3 -s 1200 2001:db8:42::2 jexec alcatraz dnctl pipe 1 config bw 100Byte/s firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 pipe 1 ip6 from any to any" \ "pf" \ "pass on ${epair}b dnpipe 1" # Single ping succeeds atf_check -s exit:0 -o ignore ping6 -c 1 2001:db8:42::2 # Saturate the link ping6 -i .1 -c 5 -s 1200 2001:db8:42::2 # We should now be hitting the limit and get this packet dropped. atf_check -s exit:2 -o ignore ping6 -c 1 -s 1200 2001:db8:42::2 } pipe_v6_cleanup() { firewall_cleanup $1 } codel_head() { atf_set descr 'FQ_CODEL basic test' atf_set require.user root } codel_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up # Sanity check atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2 jexec alcatraz dnctl pipe 1 config bw 10Mb queue 100 droptail jexec alcatraz dnctl sched 1 config pipe 1 type fq_codel target 0ms interval 0ms quantum 1514 limit 10240 flows 1024 ecn jexec alcatraz dnctl queue 1 config pipe 1 droptail firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 queue 1 ip from any to any" \ "pf" \ "pass dnqueue 1" # single ping succeeds just fine atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 } codel_cleanup() { firewall_cleanup $1 } wf2q_heap_head() { atf_set descr 'Test WF2Q+, attempting to provoke use-after-free' atf_set require.user root } wf2q_heap_body() { fw=$1 firewall_init $fw dummynet_init $fw j=dummynet_wf2q_heap_${fw}_ epair=$(vnet_mkepair) epair_other=$(vnet_mkepair) vnet_mkjail ${j}a ${epair}a vnet_mkjail ${j}b ${epair}b ${epair_other}b jexec ${j}a ifconfig ${epair}a up mtu 9000 va=$(jexec ${j}a ifconfig vlan create vlan 42 vlandev ${epair}a) jexec ${j}a ifconfig ${va} 192.0.2.1/24 up #mtu 8000 jexec ${j}b ifconfig ${epair}b up mtu 9000 vb=$(jexec ${j}b ifconfig vlan create vlan 42 vlandev ${epair}b) jexec ${j}b ifconfig ${vb} 192.0.2.2/24 up #mtu 8000 jexec ${j}b ifconfig ${epair_other}b up # Sanity check atf_check -s exit:0 -o ignore \ jexec ${j}b ping -c 1 192.0.2.1 jexec ${j}b dnctl pipe 1 config bw 10Mb queue 100 delay 500 droptail jexec ${j}b dnctl sched 1 config pipe 1 type wf2q+ jexec ${j}b dnctl queue 1 config pipe 1 droptail firewall_config ${j}b ${fw} \ "pf" \ "pass dnqueue 1" jexec ${j}a ping -f 192.0.2.2 & sleep 1 jexec ${j}b ifconfig ${vb} destroy sleep 2 } wf2q_heap_cleanup() { firewall_cleanup $1 } queue_head() { atf_set descr 'Basic queue test' atf_set require.user root } queue_body() { fw=$1 - if [ $fw = "ipfw" ] && [ "$(atf_config_get ci false)" = "true" ]; then - atf_skip "https://bugs.freebsd.org/264805" - fi - firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz /usr/sbin/inetd -p ${PWD}/inetd-alcatraz.pid \ $(atf_get_srcdir)/../pf/echo_inetd.conf # Sanity check atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2 reply=$(echo "foo" | nc -N 192.0.2.2 7) if [ "$reply" != "foo" ]; then atf_fail "Echo sanity check failed" fi jexec alcatraz dnctl pipe 1 config bw 1MByte/s jexec alcatraz dnctl sched 1 config pipe 1 type wf2q+ jexec alcatraz dnctl queue 100 config sched 1 weight 99 mask all jexec alcatraz dnctl queue 200 config sched 1 weight 1 mask all firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 queue 100 tcp from 192.0.2.2 to any out" \ "ipfw add 1001 queue 200 icmp from 192.0.2.2 to any out" \ "ipfw add 1002 allow ip from any to any" \ "pf" \ "pass in proto tcp dnqueue (0, 100)" \ "pass in proto icmp dnqueue (0, 200)" # Single ping succeeds atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 # Unsaturated TCP succeeds reply=$(echo "foo" | nc -w 5 -N 192.0.2.2 7) if [ "$reply" != "foo" ]; then atf_fail "Unsaturated echo failed" fi # Saturate the link ping -f -s 1300 192.0.2.2 & # Allow this to fill the queue sleep 1 # TCP should still just pass fails=0 for i in `seq 1 5` do result=$(dd if=/dev/zero bs=1024 count=2000 | timeout 3 nc -w 5 -N 192.0.2.2 7 | wc -c) if [ $result -ne 2048000 ]; then echo "Failed to prioritise TCP traffic. Got only $result bytes" fails=$(( ${fails} + 1 )) fi done if [ ${fails} -gt 2 ]; then atf_fail "We failed prioritisation ${fails} times" fi # This will fail if we reverse the pola^W priority firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 queue 200 tcp from 192.0.2.2 to any out" \ "ipfw add 1001 queue 100 icmp from 192.0.2.2 to any out" \ "ipfw add 1002 allow ip from any to any" \ "pf" \ "pass in proto tcp dnqueue (0, 200)" \ "pass in proto icmp dnqueue (0, 100)" jexec alcatraz ping -f -s 1300 192.0.2.1 & sleep 1 fails=0 for i in `seq 1 5` do result=$(dd if=/dev/zero bs=1024 count=2000 | timeout 3 nc -w 5 -N 192.0.2.2 7 | wc -c) if [ $result -ne 2048000 ]; then echo "Failed to prioritise TCP traffic. Got only $result bytes" fails=$(( ${fails} + 1 )) fi done if [ ${fails} -lt 3 ]; then atf_fail "We failed reversed prioritisation only ${fails} times." fi } queue_cleanup() { firewall_cleanup $1 } queue_v6_head() { atf_set descr 'Basic queue test' atf_set require.user root } queue_v6_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a inet6 2001:db8:42::1/64 no_dad up jexec alcatraz ifconfig ${epair}b inet6 2001:db8:42::2 no_dad up jexec alcatraz /usr/sbin/inetd -p ${PWD}/inetd-alcatraz.pid \ $(atf_get_srcdir)/../pf/echo_inetd.conf jexec alcatraz sysctl net.inet6.icmp6.errppslimit=0 # Sanity check atf_check -s exit:0 -o ignore ping6 -i .1 -c 3 -s 1200 2001:db8:42::2 reply=$(echo "foo" | nc -N 2001:db8:42::2 7) if [ "$reply" != "foo" ]; then atf_fail "Echo sanity check failed" fi jexec alcatraz dnctl pipe 1 config bw 1MByte/s jexec alcatraz dnctl sched 1 config pipe 1 type wf2q+ jexec alcatraz dnctl queue 100 config sched 1 weight 99 mask all jexec alcatraz dnctl queue 200 config sched 1 weight 1 mask all firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1001 queue 100 tcp from 2001:db8:42::2 to any out" \ "ipfw add 1000 queue 200 ipv6-icmp from 2001:db8:42::2 to any out" \ "ipfw add 1002 allow ip6 from any to any" \ "pf" \ "pass in proto tcp dnqueue (0, 100)" \ "pass in proto icmp6 dnqueue (0, 200)" # Single ping succeeds atf_check -s exit:0 -o ignore ping6 -c 1 2001:db8:42::2 # Unsaturated TCP succeeds reply=$(echo "foo" | nc -w 5 -N 2001:db8:42::2 7) if [ "$reply" != "foo" ]; then atf_fail "Unsaturated echo failed" fi # Saturate the link ping6 -f -s 1200 2001:db8:42::2 & # Allow this to fill the queue sleep 1 # TCP should still just pass fails=0 for i in `seq 1 5` do result=$(dd if=/dev/zero bs=1024 count=1000 | timeout 3 nc -w 5 -N 2001:db8:42::2 7 | wc -c) if [ $result -ne 1024000 ]; then echo "Failed to prioritise TCP traffic. Got only $result bytes" fails=$(( ${fails} + 1 )) fi done if [ ${fails} -gt 2 ]; then atf_fail "We failed prioritisation ${fails} times" fi # What happens if we prioritise ICMP over TCP? firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1001 queue 200 tcp from 2001:db8:42::2 to any out" \ "ipfw add 1000 queue 100 ipv6-icmp from 2001:db8:42::2 to any out" \ "ipfw add 1002 allow ip6 from any to any" \ "pf" \ "pass in proto tcp dnqueue (0, 200)" \ "pass in proto icmp6 dnqueue (0, 100)" fails=0 for i in `seq 1 5` do result=$(dd if=/dev/zero bs=1024 count=1000 | timeout 3 nc -w 5 -N 2001:db8:42::2 7 | wc -c) if [ $result -ne 1024000 ]; then echo "Failed to prioritise TCP traffic. Got only $result bytes" fails=$(( ${fails} + 1 )) fi done if [ ${fails} -lt 3 ]; then atf_fail "We failed reversed prioritisation only ${fails} times." fi } queue_v6_cleanup() { firewall_cleanup $1 } nat_head() { atf_set descr 'Basic dummynet + NAT test' atf_set require.user root } nat_body() { fw=$1 firewall_init $fw dummynet_init $fw nat_init $fw epair=$(vnet_mkepair) epair_two=$(vnet_mkepair) ifconfig ${epair}a 192.0.2.2/24 up route add -net 198.51.100.0/24 192.0.2.1 vnet_mkjail gw ${epair}b ${epair_two}a jexec gw ifconfig ${epair}b 192.0.2.1/24 up jexec gw ifconfig ${epair_two}a 198.51.100.1/24 up jexec gw sysctl net.inet.ip.forwarding=1 vnet_mkjail srv ${epair_two}b jexec srv ifconfig ${epair_two}b 198.51.100.2/24 up jexec gw dnctl pipe 1 config bw 300Byte/s firewall_config gw $fw \ "pf" \ "nat on ${epair_two}a inet from 192.0.2.0/24 to any -> (${epair_two}a)" \ "pass dnpipe 1" # We've deliberately not set a route to 192.0.2.0/24 on srv, so the # only way it can respond to this is if NAT is applied correctly. atf_check -s exit:0 -o ignore ping -c 1 198.51.100.2 } nat_cleanup() { firewall_cleanup $1 } pls_basic_head() { atf_set descr 'Basic dummynet packet loss rate test' atf_set require.user root } pls_basic_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 65432 ip from any to any" \ "pf" \ "pass on ${epair}b" # Sanity check atf_check -s exit:0 -o match:'100 packets transmitted, 100 packets received' ping -i .1 -c 100 192.0.2.2 jexec alcatraz dnctl pipe 1 config plr 0.1 firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 pipe 1 ip from 192.0.2.1 to 192.0.2.2" \ "pf" \ "pass on ${epair}b dnpipe 1" # check if the expected number of pings # are dropped (84 - 96 responses). # repeat up to 6 times if the initial # checks fail atf_check -s exit:0 -o match:'100 packets transmitted, (8[4-9]|9[0-6]) packets received' -r 20:10 ping -i 0.010 -c 100 192.0.2.2 } pls_basic_cleanup() { firewall_cleanup $1 } pls_gilbert_head() { atf_set descr 'dummynet Gilbert-Elliott packet loss model test' atf_set require.user root } pls_gilbert_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 65432 ip from any to any" \ "pf" \ "pass on ${epair}b" # Sanity check atf_check -s exit:0 -o match:'100 packets transmitted, 100 packets received' ping -i .1 -c 100 192.0.2.2 jexec alcatraz dnctl pipe 1 config plr 0.01,0.1,0.8,0.2 firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 pipe 1 ip from 192.0.2.1 to 192.0.2.2" \ "pf" \ "pass on ${epair}b dnpipe 1" # check if the expected number of pings # are dropped (70 - 85 responses). # repeat up to 6 times if the initial # checks fail atf_check -s exit:0 -o match:'100 packets transmitted, (7[0-9]|8[0-5]) packets received' -r 20:10 ping -i 0.010 -c 100 192.0.2.2 } pls_gilbert_cleanup() { firewall_cleanup $1 } setup_tests \ interface_removal \ ipfw \ pf \ pipe \ ipfw \ pf \ pipe_v6 \ ipfw \ pf \ codel \ ipfw \ pf \ wf2q_heap \ pf \ queue \ ipfw \ pf \ queue_v6 \ ipfw \ pf \ nat \ pf \ pls_basic \ ipfw \ pf \ pls_gilbert \ ipfw \ pf diff --git a/tests/sys/netpfil/pf/forward.sh b/tests/sys/netpfil/pf/forward.sh index 5d7d48a5dd9a..e9539bc9d278 100644 --- a/tests/sys/netpfil/pf/forward.sh +++ b/tests/sys/netpfil/pf/forward.sh @@ -1,174 +1,170 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2017 Kristof Provost # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr common_dir=$(atf_get_srcdir)/../common atf_test_case "v4" "cleanup" v4_head() { atf_set descr 'Basic forwarding test' atf_set require.user root # We need scapy to be installed for out test scripts to work atf_set require.progs python3 scapy } v4_body() { pft_init epair_send=$(vnet_mkepair) ifconfig ${epair_send}a 192.0.2.1/24 up epair_recv=$(vnet_mkepair) ifconfig ${epair_recv}a up vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up jexec alcatraz sysctl net.inet.ip.forwarding=1 jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05 route add -net 198.51.100.0/24 192.0.2.2 # Sanity check, can we forward ICMP echo requests without pf? atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a jexec alcatraz pfctl -e # Forward with pf enabled pft_set_rules alcatraz "block in" atf_check -s exit:1 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a pft_set_rules alcatraz "block out" atf_check -s exit:1 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recv ${epair_recv}a # Allow ICMP pft_set_rules alcatraz "block in" "pass in proto icmp" atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a } v4_cleanup() { pft_cleanup } atf_test_case "v6" "cleanup" v6_head() { atf_set descr 'Basic IPv6 forwarding test' atf_set require.user root atf_set require.progs python3 scapy } v6_body() { pft_init - if [ "$(atf_config_get ci false)" = "true" ]; then - atf_skip "https://bugs.freebsd.org/260460" - fi - epair_send=$(vnet_mkepair) epair_recv=$(vnet_mkepair) ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled ifconfig ${epair_recv}a up vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad jexec alcatraz ifconfig ${epair_recv}b inet6 2001:db8:43::2/64 up no_dad jexec alcatraz sysctl net.inet6.ip6.forwarding=1 jexec alcatraz ndp -s 2001:db8:43::3 00:01:02:03:04:05 route add -6 2001:db8:43::/64 2001:db8:42::2 # Sanity check, can we forward ICMP echo requests without pf? atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 2001:db8:43::3 \ --recvif ${epair_recv}a jexec alcatraz pfctl -e # Block incoming echo request packets pft_set_rules alcatraz \ "block in inet6 proto icmp6 icmp6-type echoreq" atf_check -s exit:1 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 2001:db8:43::3 \ --recvif ${epair_recv}a # Block outgoing echo request packets pft_set_rules alcatraz \ "block out inet6 proto icmp6 icmp6-type echoreq" atf_check -s exit:1 -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 2001:db8:43::3 \ --recvif ${epair_recv}a # Allow ICMPv6 but nothing else pft_set_rules alcatraz \ "block out" \ "pass out inet6 proto icmp6" atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 2001:db8:43::3 \ --recvif ${epair_recv}a # Allowing ICMPv4 does not allow ICMPv6 pft_set_rules alcatraz \ "block out inet6 proto icmp6 icmp6-type echoreq" \ "pass in proto icmp" atf_check -s exit:1 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 2001:db8:43::3 \ --recvif ${epair_recv}a } v6_cleanup() { pft_cleanup } atf_init_test_cases() { atf_add_test_case "v4" atf_add_test_case "v6" } diff --git a/tests/sys/netpfil/pf/killstate.sh b/tests/sys/netpfil/pf/killstate.sh index 447a4e388f11..0d98db822535 100644 --- a/tests/sys/netpfil/pf/killstate.sh +++ b/tests/sys/netpfil/pf/killstate.sh @@ -1,714 +1,710 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2021 Rubicon Communications, LLC (Netgate) # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr common_dir=$(atf_get_srcdir)/../common find_state() { jail=${1:-alcatraz} ip=${2:-192.0.2.2} jexec ${jail} pfctl -ss | grep icmp | grep ${ip} } find_state_v6() { jexec alcatraz pfctl -ss | grep icmp | grep 2001:db8::2 } atf_test_case "v4" "cleanup" v4_head() { atf_set descr 'Test killing states by IPv4 address' atf_set require.user root atf_set require.progs python3 scapy } v4_body() { pft_init epair=$(vnet_mkepair) ifconfig ${epair}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz pfctl -e pft_set_rules alcatraz "block all" \ "pass in proto icmp" \ "set skip on lo" # Sanity check & establish state atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --replyif ${epair}a # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" if ! find_state; then atf_fail "Setting new rules removed the state." fi # Killing with the wrong IP doesn't affect our state jexec alcatraz pfctl -k 192.0.2.3 if ! find_state; then atf_fail "Killing with the wrong IP removed our state." fi # Killing with one correct address and one incorrect doesn't kill the state jexec alcatraz pfctl -k 192.0.2.1 -k 192.0.2.3 if ! find_state; then atf_fail "Killing with one wrong IP removed our state." fi # Killing with correct address does remove the state jexec alcatraz pfctl -k 192.0.2.1 if find_state; then atf_fail "Killing with the correct IP did not remove our state." fi } v4_cleanup() { pft_cleanup } atf_test_case "v6" "cleanup" v6_head() { atf_set descr 'Test killing states by IPv6 address' atf_set require.user root atf_set require.progs python3 scapy } v6_body() { pft_init - if [ "$(atf_config_get ci false)" = "true" ]; then - atf_skip "https://bugs.freebsd.org/260458" - fi - epair=$(vnet_mkepair) ifconfig ${epair}a inet6 2001:db8::1/64 up no_dad vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b inet6 2001:db8::2/64 up no_dad jexec alcatraz pfctl -e pft_set_rules alcatraz "block all" \ "pass in proto icmp6" \ "set skip on lo" # Sanity check & establish state atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8::2 \ --replyif ${epair}a # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" if ! find_state_v6; then atf_fail "Setting new rules removed the state." fi # Killing with the wrong IP doesn't affect our state jexec alcatraz pfctl -k 2001:db8::3 if ! find_state_v6; then atf_fail "Killing with the wrong IP removed our state." fi # Killing with one correct address and one incorrect doesn't kill the state jexec alcatraz pfctl -k 2001:db8::1 -k 2001:db8::3 if ! find_state_v6; then atf_fail "Killing with one wrong IP removed our state." fi # Killing with correct address does remove the state jexec alcatraz pfctl -k 2001:db8::1 if find_state_v6; then atf_fail "Killing with the correct IP did not remove our state." fi } v6_cleanup() { pft_cleanup } atf_test_case "label" "cleanup" label_head() { atf_set descr 'Test killing states by label' atf_set require.user root atf_set require.progs python3 scapy } label_body() { pft_init epair=$(vnet_mkepair) ifconfig ${epair}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz pfctl -e pft_set_rules alcatraz "block all" \ "pass in proto tcp label bar" \ "pass in proto icmp label foo" \ "set skip on lo" # Sanity check & establish state atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --replyif ${epair}a # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" if ! find_state; then atf_fail "Setting new rules removed the state." fi # Killing a label on a different rules keeps the state jexec alcatraz pfctl -k label -k bar if ! find_state; then atf_fail "Killing a different label removed the state." fi # Killing a non-existing label keeps the state jexec alcatraz pfctl -k label -k baz if ! find_state; then atf_fail "Killing a non-existing label removed the state." fi # Killing the correct label kills the state jexec alcatraz pfctl -k label -k foo if find_state; then atf_fail "Killing the state did not remove it." fi } label_cleanup() { pft_cleanup } atf_test_case "multilabel" "cleanup" multilabel_head() { atf_set descr 'Test killing states with multiple labels by label' atf_set require.user root atf_set require.progs python3 scapy } multilabel_body() { pft_init epair=$(vnet_mkepair) ifconfig ${epair}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz pfctl -e pft_set_rules alcatraz "block all" \ "pass in proto icmp label foo label bar" \ "set skip on lo" # Sanity check & establish state atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --replyif ${epair}a # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" if ! find_state; then atf_fail "Setting new rules removed the state." fi # Killing a label on a different rules keeps the state jexec alcatraz pfctl -k label -k baz if ! find_state; then atf_fail "Killing a different label removed the state." fi # Killing the state with the last label works jexec alcatraz pfctl -k label -k bar if find_state; then atf_fail "Killing with the last label did not remove the state." fi pft_set_rules alcatraz "block all" \ "pass in proto icmp label foo label bar" \ "set skip on lo" # Reestablish state atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --replyif ${epair}a # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" if ! find_state; then atf_fail "Setting new rules removed the state." fi # Killing with the first label works too jexec alcatraz pfctl -k label -k foo if find_state; then atf_fail "Killing with the first label did not remove the state." fi } multilabel_cleanup() { pft_cleanup } atf_test_case "gateway" "cleanup" gateway_head() { atf_set descr 'Test killing states by route-to/reply-to address' atf_set require.user root atf_set require.progs python3 scapy } gateway_body() { pft_init epair=$(vnet_mkepair) ifconfig ${epair}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz pfctl -e pft_set_rules alcatraz "block all" \ "pass in reply-to (${epair}b 192.0.2.1) proto icmp" \ "set skip on lo" # Sanity check & establish state # Note: use pft_ping so we always use the same ID, so pf considers all # echo requests part of the same flow. atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --replyif ${epair}a # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" if ! find_state; then atf_fail "Setting new rules removed the state." fi # Killing with a different gateway does not affect our state jexec alcatraz pfctl -k gateway -k 192.0.2.2 if ! find_state; then atf_fail "Killing with a different gateway removed the state." fi # Killing states with the relevant gateway does terminate our state jexec alcatraz pfctl -k gateway -k 192.0.2.1 if find_state; then atf_fail "Killing with the gateway did not remove the state." fi } gateway_cleanup() { pft_cleanup } atf_test_case "match" "cleanup" match_head() { atf_set descr 'Test killing matching states' atf_set require.user root } wait_for_state() { jail=$1 addr=$2 while ! jexec $jail pfctl -s s | grep $addr >/dev/null; do sleep .1 done } match_body() { pft_init epair_one=$(vnet_mkepair) ifconfig ${epair_one}a 192.0.2.1/24 up epair_two=$(vnet_mkepair) vnet_mkjail alcatraz ${epair_one}b ${epair_two}a jexec alcatraz ifconfig ${epair_one}b 192.0.2.2/24 up jexec alcatraz ifconfig ${epair_two}a 198.51.100.1/24 up jexec alcatraz sysctl net.inet.ip.forwarding=1 jexec alcatraz pfctl -e vnet_mkjail singsing ${epair_two}b jexec singsing ifconfig ${epair_two}b 198.51.100.2/24 up jexec singsing route add default 198.51.100.1 jexec singsing /usr/sbin/inetd -p ${PWD}/inetd-echo.pid \ $(atf_get_srcdir)/echo_inetd.conf route add 198.51.100.0/24 192.0.2.2 pft_set_rules alcatraz \ "nat on ${epair_two}a from 192.0.2.0/24 -> (${epair_two}a)" \ "pass all" nc 198.51.100.2 7 & wait_for_state alcatraz 192.0.2.1 # Expect two states states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l) if [ $states -ne 2 ] ; then atf_fail "Expected two states, found $states" fi # If we don't kill the matching NAT state one should be left jexec alcatraz pfctl -k 192.0.2.1 states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l) if [ $states -ne 1 ] ; then atf_fail "Expected one states, found $states" fi # Flush jexec alcatraz pfctl -F states nc 198.51.100.2 7 & wait_for_state alcatraz 192.0.2.1 # Kill matching states, expect all of them to be gone jexec alcatraz pfctl -M -k 192.0.2.1 states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l) if [ $states -ne 0 ] ; then atf_fail "Expected zero states, found $states" fi } match_cleanup() { pft_cleanup } atf_test_case "interface" "cleanup" interface_head() { atf_set descr 'Test killing states based on interface' atf_set require.user root atf_set require.progs python3 scapy } interface_body() { pft_init epair=$(vnet_mkepair) ifconfig ${epair}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz pfctl -e pft_set_rules alcatraz "block all" \ "pass in proto icmp" \ "set skip on lo" # Sanity check & establish state atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --replyif ${epair}a # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" if ! find_state; then atf_fail "Setting new rules removed the state." fi # Flushing states on a different interface doesn't affect our state jexec alcatraz pfctl -i ${epair}a -Fs if ! find_state; then atf_fail "Flushing on a different interface removed the state." fi # Flushing on the correct interface does (even with floating states) jexec alcatraz pfctl -i ${epair}b -Fs if find_state; then atf_fail "Flushing on a the interface did not remove the state." fi } interface_cleanup() { pft_cleanup } atf_test_case "id" "cleanup" id_head() { atf_set descr 'Test killing states by id' atf_set require.user root atf_set require.progs python3 scapy } id_body() { pft_init epair=$(vnet_mkepair) ifconfig ${epair}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz pfctl -e pft_set_rules alcatraz "block all" \ "pass in proto tcp" \ "pass in proto icmp" \ "set skip on lo" # Sanity check & establish state atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --replyif ${epair}a # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" if ! find_state; then atf_fail "Setting new rules removed the state." fi # Get the state ID id=$(jexec alcatraz pfctl -ss -vvv | grep -A 3 icmp | grep -A 3 192.0.2.2 | awk '/id:/ { printf("%s/%s", $2, $4); }') # Kill the wrong ID jexec alcatraz pfctl -k id -k 1 if ! find_state; then atf_fail "Killing a different ID removed the state." fi # Kill the correct ID jexec alcatraz pfctl -k id -k ${id} if find_state; then atf_fail "Killing the state did not remove it." fi } id_cleanup() { pft_cleanup } atf_test_case "key" "cleanup" key_head() { atf_set descr 'Test killing states by their key' atf_set require.user root atf_set require.progs python3 scapy } key_body() { pft_init epair=$(vnet_mkepair) ifconfig ${epair}a 192.0.2.1/24 up vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz pfctl -e pft_set_rules alcatraz \ "block all" \ "pass in proto tcp" \ "pass in proto icmp" # Sanity check & establish state atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --replyif ${epair}a # Get the state key key=$(jexec alcatraz pfctl -ss -vvv | awk '/icmp/ { print($2 " " $3 " " $4 " " $5); }') bad_key=$(echo ${key} | sed 's/icmp/tcp/') # Kill the wrong key atf_check -s exit:0 -e "match:killed 0 states" \ jexec alcatraz pfctl -k key -k "${bad_key}" if ! find_state; then atf_fail "Killing a different ID removed the state." fi # Kill the correct key atf_check -s exit:0 -e "match:killed 1 states" \ jexec alcatraz pfctl -k key -k "${key}" if find_state; then atf_fail "Killing the state did not remove it." fi } key_cleanup() { pft_cleanup } atf_test_case "nat" "cleanup" nat_head() { atf_set descr 'Test killing states by their NAT-ed IP address' atf_set require.user root atf_set require.progs python3 scapy } nat_body() { pft_init j="killstate:nat" epair_c=$(vnet_mkepair) epair_srv=$(vnet_mkepair) vnet_mkjail ${j}c ${epair_c}a ifconfig -j ${j}c ${epair_c}a inet 192.0.2.2/24 up jexec ${j}c route add default 192.0.2.1 vnet_mkjail ${j}srv ${epair_srv}a ifconfig -j ${j}srv ${epair_srv}a inet 198.51.100.2/24 up vnet_mkjail ${j}r ${epair_c}b ${epair_srv}b ifconfig -j ${j}r ${epair_c}b inet 192.0.2.1/24 up ifconfig -j ${j}r ${epair_srv}b inet 198.51.100.1/24 up jexec ${j}r sysctl net.inet.ip.forwarding=1 jexec ${j}r pfctl -e pft_set_rules ${j}r \ "nat on ${epair_srv}b inet from 192.0.2.0/24 to any -> (${epair_srv}b)" # Sanity check atf_check -s exit:0 -o ignore \ jexec ${j}c ping -c 1 192.0.2.1 atf_check -s exit:0 -o ignore \ jexec ${j}srv ping -c 1 198.51.100.1 atf_check -s exit:0 -o ignore \ jexec ${j}c ping -c 1 198.51.100.2 # Establish state # Note: use pft_ping so we always use the same ID, so pf considers all # echo requests part of the same flow. atf_check -s exit:0 -o ignore jexec ${j}c ${common_dir}/pft_ping.py \ --sendif ${epair_c}a \ --to 198.51.100.1 \ --replyif ${epair_c}a # There's NAT here, so the source IP will be 198.51.100.1 if ! find_state ${j}r 198.51.100.1; then atf_fail "Expected state not found" fi # By NAT-ed address? jexec ${j}r pfctl -k nat -k 192.0.2.2 if find_state ${j}r 198.51.100.1; then jexec ${j}r pfctl -ss -v atf_fail "Failed to remove state" fi } nat_cleanup() { pft_cleanup } atf_init_test_cases() { atf_add_test_case "v4" atf_add_test_case "v6" atf_add_test_case "label" atf_add_test_case "multilabel" atf_add_test_case "gateway" atf_add_test_case "match" atf_add_test_case "interface" atf_add_test_case "id" atf_add_test_case "key" atf_add_test_case "nat" } diff --git a/tests/sys/netpfil/pf/set_tos.sh b/tests/sys/netpfil/pf/set_tos.sh index 75b96edbab6e..842377ee97c6 100644 --- a/tests/sys/netpfil/pf/set_tos.sh +++ b/tests/sys/netpfil/pf/set_tos.sh @@ -1,221 +1,217 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2017 Kristof Provost # # Copyright (c) 2021 Samuel Robinette # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr common_dir=$(atf_get_srcdir)/../common atf_test_case "v4" "cleanup" v4_head() { atf_set descr 'set-tos test' atf_set require.user root # We need scapy to be installed for out test scripts to work atf_set require.progs python3 scapy } v4_body() { pft_init epair_send=$(vnet_mkepair) ifconfig ${epair_send}a 192.0.2.1/24 up epair_recv=$(vnet_mkepair) ifconfig ${epair_recv}a up vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up jexec alcatraz sysctl net.inet.ip.forwarding=1 jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05 route add -net 198.51.100.0/24 192.0.2.2 jexec alcatraz pfctl -e # No change is done if not requested pft_set_rules alcatraz "scrub out proto icmp" atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a \ --expect-tc 42 # The requested ToS is set pft_set_rules alcatraz "scrub out proto icmp set-tos 42" atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a \ --expect-tc 42 # ToS is not changed if the scrub rule does not match pft_set_rules alcatraz "scrub out proto tcp set-tos 42" atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a \ --expect-tc 42 # Multiple scrub rules match as expected pft_set_rules alcatraz "scrub out proto tcp set-tos 13" \ "scrub out proto icmp set-tos 14" atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a \ --expect-tc 14 # And this works even if the packet already has ToS values set atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a \ --send-tc 42 \ --expect-tc 14 # ToS values are unmolested if the packets do not match a scrub rule pft_set_rules alcatraz "scrub out proto tcp set-tos 13" atf_check -s exit:0 ${common_dir}/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a \ --send-tc 42 \ --expect-tc 42 } v4_cleanup() { pft_cleanup } atf_test_case "v6" "cleanup" v6_head() { atf_set descr 'set-tos6 test' atf_set require.user root # We need scapy to be installed for out test scripts to work atf_set require.progs python3 scapy } v6_body() { pft_init - if [ "$(atf_config_get ci false)" = "true" ]; then - atf_skip "https://bugs.freebsd.org/260459" - fi - epair=$(vnet_mkepair) ifconfig ${epair}a inet6 add 2001:db8:192::1 vnet_mkjail alcatraz ${epair}b jexec alcatraz ifconfig ${epair}b inet6 add 2001:db8:192::2 route -6 add 2001:db8:192::2 2001:db8:192::1 jexec alcatraz route -6 add 2001:db8:192::1 2001:db8:192::2 jexec alcatraz pfctl -e # No change is done if not requested pft_set_rules alcatraz "scrub out proto ipv6-icmp" atf_check -s exit:1 -o ignore -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8:192::2 \ --replyif ${epair}a \ --expect-tc 42 # The requested ToS is set pft_set_rules alcatraz "scrub out proto ipv6-icmp set-tos 42" atf_check -s exit:0 -o ignore -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8:192::2 \ --replyif ${epair}a \ --expect-tc 42 # ToS is not changed if the scrub rule does not match pft_set_rules alcatraz "scrub out from 2001:db8:192::3 set-tos 42" atf_check -s exit:1 -o ignore -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8:192::2 \ --replyif ${epair}a \ --expect-tc 42 # Multiple scrub rules match as expected pft_set_rules alcatraz "scrub out from 2001:db8:192::3 set-tos 13" \ "scrub out proto ipv6-icmp set-tos 14" atf_check -s exit:0 -o ignore -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8:192::2 \ --replyif ${epair}a \ --expect-tc 14 # And this works even if the packet already has ToS values set atf_check -s exit:0 -o ignore -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8:192::2 \ --replyif ${epair}a \ --send-tc 42 \ --expect-tc 14 # ToS values are unmolested if the packets do not match a scrub rule pft_set_rules alcatraz "scrub out from 2001:db8:192::3 set-tos 13" atf_check -s exit:0 -o ignore -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8:192::2 \ --replyif ${epair}a \ --expect-tc 0 # We can set tos on pass rules pft_set_rules alcatraz "pass out set tos 13" atf_check -s exit:0 -o ignore -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8:192::2 \ --replyif ${epair}a \ --expect-tc 13 # And that still works with 'scrub' options too pft_set_rules alcatraz "pass out set tos 14 scrub (min-ttl 64)" atf_check -s exit:0 -o ignore -e ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 2001:db8:192::2 \ --replyif ${epair}a \ --expect-tc 14 } v6_cleanup() { pft_cleanup } atf_init_test_cases() { atf_add_test_case "v4" atf_add_test_case "v6" }