We have created a preliminary test suite for kernel pf tests and
integrated it under FreeBSD's src/tests using kyua/ATF. The tests
reside under src/tests/sys/netpfil/pf, and can get installed
under /usr/tests.
The tests consist mostly of connecting to the test target machine
via SSH, activating pf and possibly forwarding, and then running
tests. We use scapy (runnning on python) for some of the tests.
The host machine is connected to the test machine via several
interfaces. Usually we have one interface for SSH, and two or
three for the tests. The reason for that is so that we can have
different pf rules on the test machine for the different
interfaces, which helps verify the validity of the tests by
looking at the difference in behavior of the different
interfaces.
Currently the tests need the user to manually change
configuration parameters for all addresses and names of
interfaces used.
The tests are put together using FreeBSD's recommended test suite
which uses kyua. The tests are hierarchically organized under
src/tests using a structure of files named Kyuafile. That means
that running 'kyua test' under src/tests will find our tests and
run them as part of the complete test suite.
To run the tests, first run 'make'. Then, run either 'kyua test'
as root or 'make install' as root followed by 'kyua test' as root
under /usr/tests.