d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf tests: test fast port re-use with syncookies

Browse Source 
When a src/dst ip/port tuple is re-used before the pf state fully
expires we clean up the state and create a new one, unless syncookies
are enabled.

Test this, by running two back-to-back nc sessions, with a fixed source
port. Move the interface and IP to a different (vnet) jail, to trick the
network stack into letting us do this.

MFC after:      2 weeks
Event:          Aberdeen hackathon 2022
Differential Revision:  https://reviews.freebsd.org/D36886
This commit is contained in:
Kristof Provost 2022-12-31 19:23:15 +01:00
parent 9c041b450d
commit dc698b2cd5
1 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
tests/sys/netpfil/pf/syncookie.sh
View File

@ -279,6 +279,62 @@ limits_cleanup()
pft_cleanup
}
atf_test_case "port_reuse" "cleanup"
port_reuse_head()
{
atf_set descr 'Test rapid port re-use'
atf_set require.user root
}
port_reuse_body()
{
pft_init
epair=$(vnet_mkepair)
vnet_mkjail alcatraz ${epair}b
vnet_mkjail singsing
jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up
jexec alcatraz /usr/sbin/inetd -p ${HOME}/inetd-alcatraz.pid \
$(atf_get_srcdir)/echo_inetd.conf
ifconfig ${epair}a 192.0.2.2/24 up
jexec alcatraz pfctl -e
jexec alcatraz pfctl -x loud
pft_set_rules alcatraz \
"set syncookies always" \
"pass in" \
"pass out"
# Sanity check
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1
reply=$(echo foo | nc -p 1234 -N -w 5 192.0.2.1 7)
if [ "${reply}" != "foo" ];
then
atf_fail "Failed to connect to syncookie protected echo daemon"
fi
# We can't re-use the source IP/port combo quickly enough, so we're
# going to play a really dirty trick, and move our interface to a new
# jail, and do it from there.
ifconfig ${epair}a vnet singsing
jexec singsing ifconfig ${epair}a 192.0.2.2/24 up
atf_check -s exit:0 -o ignore jexec singsing ping -c 1 192.0.2.1
reply=$(echo bar | jexec singsing nc -p 1234 -N -w 5 192.0.2.1 7)
if [ "${reply}" != "bar" ];
then
atf_fail "Failed to connect to syncookie protected echo daemon (2)"
fi
}
port_reuse_cleanup()
{
pft_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "basic"
@ -286,4 +342,5 @@ atf_init_test_cases()
atf_add_test_case "nostate"
atf_add_test_case "adaptive"
atf_add_test_case "limits"
atf_add_test_case "port_reuse"
}