pf tests: test fast port re-use with syncookies
When a src/dst ip/port tuple is re-used before the pf state fully expires we clean up the state and create a new one, unless syncookies are enabled. Test this, by running two back-to-back nc sessions, with a fixed source port. Move the interface and IP to a different (vnet) jail, to trick the network stack into letting us do this. MFC after: 2 weeks Event: Aberdeen hackathon 2022 Differential Revision: https://reviews.freebsd.org/D36886
This commit is contained in:
parent
9c041b450d
commit
dc698b2cd5
@ -279,6 +279,62 @@ limits_cleanup()
|
|||||||
pft_cleanup
|
pft_cleanup
|
||||||
}
|
}
|
||||||
|
|
||||||
|
atf_test_case "port_reuse" "cleanup"
|
||||||
|
port_reuse_head()
|
||||||
|
{
|
||||||
|
atf_set descr 'Test rapid port re-use'
|
||||||
|
atf_set require.user root
|
||||||
|
}
|
||||||
|
|
||||||
|
port_reuse_body()
|
||||||
|
{
|
||||||
|
pft_init
|
||||||
|
|
||||||
|
epair=$(vnet_mkepair)
|
||||||
|
|
||||||
|
vnet_mkjail alcatraz ${epair}b
|
||||||
|
vnet_mkjail singsing
|
||||||
|
jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up
|
||||||
|
jexec alcatraz /usr/sbin/inetd -p ${HOME}/inetd-alcatraz.pid \
|
||||||
|
$(atf_get_srcdir)/echo_inetd.conf
|
||||||
|
|
||||||
|
ifconfig ${epair}a 192.0.2.2/24 up
|
||||||
|
|
||||||
|
jexec alcatraz pfctl -e
|
||||||
|
jexec alcatraz pfctl -x loud
|
||||||
|
pft_set_rules alcatraz \
|
||||||
|
"set syncookies always" \
|
||||||
|
"pass in" \
|
||||||
|
"pass out"
|
||||||
|
|
||||||
|
# Sanity check
|
||||||
|
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1
|
||||||
|
|
||||||
|
reply=$(echo foo | nc -p 1234 -N -w 5 192.0.2.1 7)
|
||||||
|
if [ "${reply}" != "foo" ];
|
||||||
|
then
|
||||||
|
atf_fail "Failed to connect to syncookie protected echo daemon"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# We can't re-use the source IP/port combo quickly enough, so we're
|
||||||
|
# going to play a really dirty trick, and move our interface to a new
|
||||||
|
# jail, and do it from there.
|
||||||
|
ifconfig ${epair}a vnet singsing
|
||||||
|
jexec singsing ifconfig ${epair}a 192.0.2.2/24 up
|
||||||
|
atf_check -s exit:0 -o ignore jexec singsing ping -c 1 192.0.2.1
|
||||||
|
|
||||||
|
reply=$(echo bar | jexec singsing nc -p 1234 -N -w 5 192.0.2.1 7)
|
||||||
|
if [ "${reply}" != "bar" ];
|
||||||
|
then
|
||||||
|
atf_fail "Failed to connect to syncookie protected echo daemon (2)"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
port_reuse_cleanup()
|
||||||
|
{
|
||||||
|
pft_cleanup
|
||||||
|
}
|
||||||
|
|
||||||
atf_init_test_cases()
|
atf_init_test_cases()
|
||||||
{
|
{
|
||||||
atf_add_test_case "basic"
|
atf_add_test_case "basic"
|
||||||
@ -286,4 +342,5 @@ atf_init_test_cases()
|
|||||||
atf_add_test_case "nostate"
|
atf_add_test_case "nostate"
|
||||||
atf_add_test_case "adaptive"
|
atf_add_test_case "adaptive"
|
||||||
atf_add_test_case "limits"
|
atf_add_test_case "limits"
|
||||||
|
atf_add_test_case "port_reuse"
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user