d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf tests: Test per-anchor tables

Browse Source 
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2022-02-17 14:13:50 +01:00
parent 7f55a9b490
commit 7d3fc84b2d
1 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
tests/sys/netpfil/pf/table.sh
View File

@ -277,6 +277,48 @@ precreate_cleanup()
pft_cleanup
}
atf_test_case "anchor" "cleanup"
anchor_head()
{
atf_set descr 'Test tables in anchors'
atf_set require.user root
}
anchor_body()
{
pft_init
epair=$(vnet_mkepair)
ifconfig ${epair}a 192.0.2.1/24 up
vnet_mkjail alcatraz ${epair}b
jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up
jexec alcatraz pfctl -e
(echo "table <testtable> persist"
echo "block in quick from <testtable> to any"
) | jexec alcatraz pfctl -a anchorage -f -
pft_set_rules noflush alcatraz \
"pass" \
"anchor anchorage"
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
# Tables belong to anchors, so this is a different table and won't affect anything
jexec alcatraz pfctl -t testtable -T add 192.0.2.1
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
# But when we add the address to the table in the anchor it does block traffic
jexec alcatraz pfctl -a anchorage -t testtable -T add 192.0.2.1
atf_check -s exit:2 -o ignore ping -c 1 192.0.2.2
}
anchor_cleanup()
{
pft_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "v4_counters"
@ -286,4 +328,5 @@ atf_init_test_cases()
atf_add_test_case "network"
atf_add_test_case "pr259689"
atf_add_test_case "precreate"
atf_add_test_case "anchor"
}