diff --git a/tests/sys/netpfil/common/dummynet.sh b/tests/sys/netpfil/common/dummynet.sh index 7ff9a1e18fdc..644b36516b5a 100644 --- a/tests/sys/netpfil/common/dummynet.sh +++ b/tests/sys/netpfil/common/dummynet.sh @@ -1,330 +1,344 @@ # $FreeBSD$ # # SPDX-License-Identifier: BSD-2-Clause-FreeBSD # # Copyright (c) 2021 Rubicon Communications, LLC (Netgate) # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. . $(atf_get_srcdir)/utils.subr . $(atf_get_srcdir)/runner.subr pipe_head() { atf_set descr 'Basic pipe test' atf_set require.user root } pipe_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up # Sanity check atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2 jexec alcatraz dnctl pipe 1 config bw 30Byte/s firewall_config alcatraz ${fw} \ "ipfw" \ - "ipfw add 1000 pipe 1 ip from any to any" + "ipfw add 1000 pipe 1 ip from any to any" \ + "pf" \ + "pass dnpipe 1" # single ping succeeds just fine atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 # Saturate the link ping -i .1 -c 5 -s 1200 192.0.2.2 # We should now be hitting the limits and get this packet dropped. atf_check -s exit:2 -o ignore ping -c 1 -s 1200 192.0.2.2 } pipe_cleanup() { firewall_cleanup $1 } pipe_v6_head() { atf_set descr 'Basic IPv6 pipe test' atf_set require.user root } pipe_v6_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a inet6 2001:db8:42::1/64 up no_dad jexec alcatraz ifconfig ${epair}b inet6 2001:db8:42::2/64 up no_dad # Sanity check atf_check -s exit:0 -o ignore ping6 -i .1 -c 3 -s 1200 2001:db8:42::2 jexec alcatraz dnctl pipe 1 config bw 100Byte/s firewall_config alcatraz ${fw} \ "ipfw" \ - "ipfw add 1000 pipe 1 ip6 from any to any" + "ipfw add 1000 pipe 1 ip6 from any to any" \ + "pf" \ + "pass dnpipe 1" # Single ping succeeds atf_check -s exit:0 -o ignore ping6 -c 1 2001:db8:42::2 # Saturate the link ping6 -i .1 -c 5 -s 1200 2001:db8:42::2 # We should now be hitting the limit and get this packet dropped. atf_check -s exit:2 -o ignore ping6 -c 1 -s 1200 2001:db8:42::2 } pipe_v6_cleanup() { firewall_cleanup $1 } queue_head() { atf_set descr 'Basic queue test' atf_set require.user root } queue_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a 192.0.2.1/24 up jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up jexec alcatraz /usr/sbin/inetd -p inetd-alcatraz.pid \ $(atf_get_srcdir)/../pf/echo_inetd.conf # Sanity check atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2 reply=$(echo "foo" | nc -N 192.0.2.2 7) if [ "$reply" != "foo" ]; then atf_fail "Echo sanity check failed" fi jexec alcatraz dnctl pipe 1 config bw 1MByte/s jexec alcatraz dnctl sched 1 config pipe 1 type wf2q+ jexec alcatraz dnctl queue 100 config sched 1 weight 99 mask all jexec alcatraz dnctl queue 200 config sched 1 weight 1 mask all firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 queue 100 tcp from 192.0.2.2 to any out" \ "ipfw add 1001 queue 200 icmp from 192.0.2.2 to any out" \ - "ipfw add 1002 allow ip from any to any" + "ipfw add 1002 allow ip from any to any" \ + "pf" \ + "pass in proto tcp dnqueue (0, 100)" \ + "pass in proto icmp dnqueue (0, 200)" # Single ping succeeds atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 # Unsaturated TCP succeeds reply=$(echo "foo" | nc -w 5 -N 192.0.2.2 7) if [ "$reply" != "foo" ]; then atf_fail "Unsaturated echo failed" fi # Saturate the link ping -f -s 1300 192.0.2.2 & # Allow this to fill the queue sleep 1 # TCP should still just pass fails=0 for i in `seq 1 3` do result=$(dd if=/dev/zero bs=1024 count=2000 | timeout 3 nc -w 5 -N 192.0.2.2 7 | wc -c) if [ $result -ne 2048000 ]; then echo "Failed to prioritise TCP traffic. Got only $result bytes" fails=$(( ${fails} + 1 )) fi done if [ ${fails} -gt 0 ]; then atf_fail "We failed prioritisation ${fails} times" fi # This will fail if we reverse the pola^W priority firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1000 queue 200 tcp from 192.0.2.2 to any out" \ "ipfw add 1001 queue 100 icmp from 192.0.2.2 to any out" \ - "ipfw add 1002 allow ip from any to any" + "ipfw add 1002 allow ip from any to any" \ + "pf" \ + "pass in proto tcp dnqueue (0, 200)" \ + "pass in proto icmp dnqueue (0, 100)" jexec alcatraz ping -f -s 1300 192.0.2.1 & sleep 1 fails=0 for i in `seq 1 3` do result=$(dd if=/dev/zero bs=1024 count=2000 | timeout 3 nc -w 5 -N 192.0.2.2 7 | wc -c) if [ $result -ne 2048000 ]; then echo "Failed to prioritise TCP traffic. Got only $result bytes" fails=$(( ${fails} + 1 )) fi done if [ ${fails} -lt 3 ]; then atf_fail "We failed reversed prioritisation only ${fails} times." fi } queue_cleanup() { firewall_cleanup $1 } queue_v6_head() { atf_set descr 'Basic queue test' atf_set require.user root } queue_v6_body() { fw=$1 firewall_init $fw dummynet_init $fw epair=$(vnet_mkepair) vnet_mkjail alcatraz ${epair}b ifconfig ${epair}a inet6 2001:db8:42::1/64 no_dad up jexec alcatraz ifconfig ${epair}b inet6 2001:db8:42::2 no_dad up jexec alcatraz /usr/sbin/inetd -p inetd-alcatraz.pid \ $(atf_get_srcdir)/../pf/echo_inetd.conf # Sanity check atf_check -s exit:0 -o ignore ping6 -i .1 -c 3 -s 1200 2001:db8:42::2 reply=$(echo "foo" | nc -N 2001:db8:42::2 7) if [ "$reply" != "foo" ]; then atf_fail "Echo sanity check failed" fi jexec alcatraz dnctl pipe 1 config bw 1MByte/s jexec alcatraz dnctl sched 1 config pipe 1 type wf2q+ jexec alcatraz dnctl queue 100 config sched 1 weight 99 mask all jexec alcatraz dnctl queue 200 config sched 1 weight 1 mask all firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1001 queue 100 tcp from 2001:db8:42::2 to any out" \ "ipfw add 1000 queue 200 ipv6-icmp from 2001:db8:42::2 to any out" \ "ipfw add 1002 allow ip6 from any to any" \ "pf" \ - "pass out proto tcp dnqueue 100" \ - "pass out proto icmp6 dnqueue 200" + "pass in proto tcp dnqueue (0, 100)" \ + "pass in proto icmp6 dnqueue (0, 200)" # Single ping succeeds atf_check -s exit:0 -o ignore ping6 -c 1 2001:db8:42::2 # Unsaturated TCP succeeds reply=$(echo "foo" | nc -w 5 -N 2001:db8:42::2 7) if [ "$reply" != "foo" ]; then atf_fail "Unsaturated echo failed" fi # Saturate the link ping6 -f -s 1200 2001:db8:42::2 & # Allow this to fill the queue sleep 1 # TCP should still just pass fails=0 for i in `seq 1 3` do result=$(dd if=/dev/zero bs=1024 count=1000 | timeout 3 nc -w 5 -N 2001:db8:42::2 7 | wc -c) if [ $result -ne 1024000 ]; then echo "Failed to prioritise TCP traffic. Got only $result bytes" fails=$(( ${fails} + 1 )) fi done if [ ${fails} -gt 0 ]; then atf_fail "We failed prioritisation ${fails} times" fi # What happens if we prioritise ICMP over TCP? firewall_config alcatraz ${fw} \ "ipfw" \ "ipfw add 1001 queue 200 tcp from 2001:db8:42::2 to any out" \ "ipfw add 1000 queue 100 ipv6-icmp from 2001:db8:42::2 to any out" \ "ipfw add 1002 allow ip6 from any to any" \ "pf" \ - "pass out proto tcp dnqueue 200" \ - "pass out proto icmp6 dnqueue 100" + "pass in proto tcp dnqueue (0, 200)" \ + "pass in proto icmp6 dnqueue (0, 100)" fails=0 for i in `seq 1 3` do result=$(dd if=/dev/zero bs=1024 count=1000 | timeout 3 nc -w 5 -N 2001:db8:42::2 7 | wc -c) if [ $result -ne 1024000 ]; then echo "Failed to prioritise TCP traffic. Got only $result bytes" fails=$(( ${fails} + 1 )) fi done if [ ${fails} -lt 3 ]; then atf_fail "We failed reversed prioritisation only ${fails} times." fi } queue_v6_cleanup() { firewall_cleanup $1 } setup_tests \ pipe \ ipfw \ + pf \ pipe_v6 \ ipfw \ + pf \ queue \ ipfw \ + pf \ queue_v6 \ - ipfw + ipfw \ + pf diff --git a/tests/sys/netpfil/common/utils.subr b/tests/sys/netpfil/common/utils.subr index 722271981af4..43cd856b2e87 100644 --- a/tests/sys/netpfil/common/utils.subr +++ b/tests/sys/netpfil/common/utils.subr @@ -1,138 +1,141 @@ #- # SPDX-License-Identifier: BSD-2-Clause-FreeBSD # # Copyright (c) 2019 Ahsan Barkati # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # $FreeBSD$ # . $(atf_get_srcdir)/../../common/vnet.subr firewall_config() { jname=$1 shift fw=$1 shift while [ $# -gt 0 ]; do if [ $(is_firewall "$1") -eq 1 ]; then current_fw="$1" shift filename=${current_fw}.rule cwd=$(pwd) if [ -f ${current_fw}.rule ]; then rm ${current_fw}.rule fi fi rule=$1 echo $rule >> $filename shift done if [ ${fw} == "ipfw" ]; then jexec ${jname} ipfw -q -f flush jexec ${jname} /bin/sh $cwd/ipfw.rule elif [ ${fw} == "pf" ]; then jexec ${jname} pfctl -e jexec ${jname} pfctl -F all jexec ${jname} pfctl -f $cwd/pf.rule elif [ ${fw} == "ipf" ]; then jexec ${jname} ipf -E jexec ${jname} ipf -Fa -f $cwd/ipf.rule elif [ ${fw} == "ipfnat" ]; then jexec ${jname} service ipfilter start jexec ${jname} ipnat -CF -f $cwd/ipfnat.rule else atf_fail "$fw is not a valid firewall to configure" fi } firewall_cleanup() { firewall=$1 echo "Cleaning $firewall" vnet_cleanup } firewall_init() { firewall=$1 vnet_init if [ ${firewall} == "ipfw" ]; then if ! kldstat -q -m ipfw; then atf_skip "This test requires ipfw" fi elif [ ${firewall} == "pf" ]; then if [ ! -c /dev/pf ]; then atf_skip "This test requires pf" fi elif [ ${firewall} == "ipf" ]; then if ! kldstat -q -m ipfilter; then atf_skip "This test requires ipf" fi elif [ ${firewall} == "ipfnat" ]; then if ! kldstat -q -m ipfilter; then atf_skip "This test requires ipf" fi else atf_fail "$fw is not a valid firewall to initialize" fi } dummynet_init() { firewall=$1 if ! kldstat -q -m dummynet; then atf_skip "This test requires dummynet" fi - if [ ${firewall} == "ipfw" ]; then + case $firewall in + ipfw|pf) # Nothing. This is okay. - else + ;; + *) atf_skip "${firewall} does not support dummynet" - fi + ;; + esac } nat_init() { firewall=$1 if [ ${firewall} == "ipfw" ]; then if ! kldstat -q -m ipfw_nat; then atf_skip "This test requires ipfw_nat" fi fi } is_firewall() { if [ "$1" = "pf" -o "$1" = "ipfw" -o "$1" = "ipf" -o "$1" = "ipfnat" ]; then echo 1 else echo 0 fi }