Commit Graph

45 Commits

Author SHA1 Message Date
Tom Jones
f97a8a3615 Add common firewall test suite
Add a common test suite for the firewalls included in the base system. The test
suite allows common test infrastructure to test pf, ipfw and ipf firewalls from
test files containing the setup for all three firewalls.

Add the pass block test for pf, ipfw and ipf. The pass block test checks the
allow/deny functionality of the firewalls tested.

Submitted by:   Ahsan Barkati
Sponsored by:   Google, Inc. (GSoC 2019)
Reviewed by:    kp
Approved by:    bz (co-mentor)
MFC after:      2 weeks
Differential Revision: https://reviews.freebsd.org/D21065
2019-08-05 11:47:34 +00:00
Li-Wen Hsu
4f6d74c9c4 Temporarily skip sys.netpfil.pf.forward.{v4,v6} and sys.netpfil.pf.set_tos.v4
on i386 as they are flakey on it

PR:		239380
Sponsored by:	The FreeBSD Foundation
2019-07-22 18:54:26 +00:00
Li-Wen Hsu
43527153dc Skip sys.netpfil.pf.names.names and sys.netpfil.pf.synproxy.synproxy
temporarily because kernel panics when flushing epair queue.

PR:		238870
Sponsored by:	The FreeBSD Foundation
2019-06-29 12:19:57 +00:00
Kristof Provost
b20ff7b90a pf tests: Fail the test if we can't set the rules
The test should fail if pf rules can't be set. This is helpful both
while writing tests and to verify that pfctl works as expected.

MFC after:	1 week
Event:		Aberdeen hackathon 2019
2019-04-18 10:54:08 +00:00
Kristof Provost
246e18b224 pf tests: Try to provoke the panic with invalid DIOCRSETTFLAGS
There was an issue with copyin() on DIOCRSETTFLAGS, which would panic if
pfrio_buffer was NULL.
Test for the issue fixed in r346319.

MFC after:	1 week
Event:		Aberdeen hackathon 2019
2019-04-17 16:45:35 +00:00
Kristof Provost
dcccc93ae4 pf tests: Fix accidental duplication of content
Also use the correct name for the scapy test script.
2019-03-23 01:07:51 +00:00
Kristof Provost
7de4bd92b8 pf tests: Test CVE-2019-5598
Verify that pf correctly drops inconsistent ICMP packets (i.e. where the
IP src/dst do not match the IP src/dst in the ICMP packet.
2019-03-22 07:39:28 +00:00
Kristof Provost
d1805f60af pf tests: Move Sniffer to its own file
Make it easier to re-use the sniffer class in other test support
scripts.
2019-03-21 08:15:46 +00:00
Kristof Provost
16b56c7f4e pf tests: Accelerate tests
Make the tests run slightly faster by having pft_ping.py end the capture
of packets as soon as it sees the expected packet, rather than
continuing to sniff.

MFC after:	2 weeks
2019-03-07 11:09:29 +00:00
Kristof Provost
06aac31aec tests: Move common (vnet) test functions into a common file
The netipsec and pf tests have a number of common test functions. These
used to be duplicated, but it makes more sense for them to re-use the
common functions.

PR:		236223
2019-03-04 18:15:06 +00:00
Kristof Provost
bd0eb4dcc4 pf tests: Test for nested inline anchor issue
PR:		196314
MFC after:	1 week
2019-03-02 12:30:59 +00:00
Kristof Provost
15426769bb pf tests: Test CVE-2019-5597
Generate a fragmented packet with different header chains, to provoke
the incorrect behaviour of pf.
Without the fix this will trigger a panic.

Obtained from:	Corentin Bayet, Nicolas Collignon, Luca Moro at Synacktiv
2019-03-01 07:39:55 +00:00
Kristof Provost
fe5a065d4b pf tests: Check size validation in DIOCGETSRCNODES
Ensure that invalid sizes for DIOCGETSRCNODES do not cause panics.

MFC after:	 1 week
2019-01-22 02:56:36 +00:00
Kristof Provost
b9dee1ff02 pf tests: Test PR 229241
pfctl has an issue with 'set skip on <group>', which causes inconsistent
behaviour: the set skip directive works initially, but does not take
effect when the same rules are re-applied.

PR:		229241
MFC after:	1 week
2019-01-13 05:31:53 +00:00
Kristof Provost
ff514f1f8a pf tests: Basic rdr test
MFC after:	2 weeks
2018-12-12 20:19:56 +00:00
Kristof Provost
9bfe20461c pf tests: NAT exhaustion test
It's been reported that pf doesn't handle running out of available ports
for NAT correctly. It freezes until a state expires and it can find a
free port.
Test for this, by setting up a situation where only two ports are
available for NAT and then attempting to create three connections.

If successful the third connection will fail immediately. In an
incorrect case the connection attempt will freeze, also freezing all
interaction with pf through pfctl and trigger timeout.

PR:		233867
MFC after:	2 weeks
2018-12-12 20:19:18 +00:00
Kristof Provost
d3cc40300e pf tests: Use the ATF cleanup infrastructure in the ioctl tests
Use ATF_TC_CLEANUP(), because that means the cleanup code will get
called even if a test fails. Before it would only be executed if every
test within the body succeeded.

Reported by:	Marie Helene Kvello-Aune <marieheleneka@gmail.com>
MFC after:	2 weeks
2018-12-11 21:49:13 +00:00
Kristof Provost
87c7063c2b pf tests: ioctl tests require root rights
Explicitly mark these tests as requiring root rights. We need to be able
to open /dev/pf.

Reported by:	Marie Helene Kvello-Aune <marieheleneka@gmail.com>
MFC after:	2 weeks
2018-12-11 21:45:56 +00:00
Kristof Provost
369d9a2c15 pf tests: Add a defer mode test for pfsync
Repeat the pfsync test, this time with the 'defer' option enabled. This
exercises slightly different code paths.
2018-12-05 19:53:09 +00:00
Kristof Provost
df5ceb3b66 pf tests: Test name handling
Provoke a situation where two interfaces have the same name, and verify
pf's reaction to this.
2018-12-01 09:59:32 +00:00
Kristof Provost
db785060cb pf tests: Make pass_block:noalias more robust
Send several ICMPv6 echo requests. We've seen occasional failures with a
single request.
2018-12-01 09:57:29 +00:00
Li-Wen Hsu
b0e9618e68 Fix test: sys.netpfil.pf.pass_block.noalias
Replace hard-coded epair0b with the variable holds the real epair interface
used for testing.

Reviewed by:	kp
Approved by:	emaste, markj (mentors)
MFC with:	r339836
Sponsored by:	The FreeBSD Foundation
2018-11-09 15:24:24 +00:00
Kristof Provost
55177f18a1 pf tests: Test PR 183198
Create a table which is only used inside an anchor, ensure that the
table exists.

PR:		183198
MFC after:	2 weeks
2018-11-08 21:56:06 +00:00
Kristof Provost
6ab3ac5afa pf tests: Basic pfsync test
Set up two jails, configure pfsync between them and create state in one
of them, verify that this state is copied to the other jail.

MFC after:	2 weeks
Sponsored by:	Orange Business Services
Differential Revision:	https://reviews.freebsd.org/D17504
2018-11-02 16:59:55 +00:00
Kristof Provost
71f8908a1a pf tests: Test ':0' ignoring link-local addresses
PR:		201695
2018-10-28 05:37:15 +00:00
Kristof Provost
2848a0e2da pf tests: Verify that pf limits the number of fragments per packet
Test the limitation on number of frames per packet introduced in pf in r337969.

Sponsored by:	Klara Systems
2018-08-17 15:02:58 +00:00
Kristof Provost
9317ba2226 pf tests: Basic test for 'set skip in $groupname'
This tests for the problem reported in PR 229241, where using a group
name in 'set skip on' did not work as expected.

Sponsored by:	Essen Hackathon
2018-08-11 16:41:07 +00:00
Kristof Provost
6e0bca03bd pf tests: Basic synproxy test
A very basic syncproxy test: set up a connection via a synproxy rule.
This triggeres the panic fixed in r336273.
2018-07-14 21:32:32 +00:00
Kristof Provost
d850143efd pf tests: Basic route-to tests
Very basic route-to tests. These tests attempt to provoke PR 228782 for IPv4
and IPv6. A test failure will panic the machine.
2018-06-09 14:21:07 +00:00
Kristof Provost
cb625c1e17 pf tests: Do not build or install if pf is not enabled
Do not build or install pf tests if WITHOUT_PF is set. This fixes the build
failure with WITHOUT_PF=yes.

Reported by:	Vladimir Zakharov <zakharov.vv@gmail.com>
2018-04-10 12:45:34 +00:00
Kristof Provost
62d28676c3 pf tests: Basic ioctl validation
Basic validation tests for DIOCRADDADDRS, DIOCRDELADDRS, DIOCRSETADDRS,
DIOCRGETADDRS, DIOCRGETASTATS, DIOCRCLRASTATS, DIOCRTSTADDRS,
DIOCRINADEFINE, DIOCXBEGIN and DIOCXROLLBACK.

MFC after:	1 week
2018-04-06 19:37:15 +00:00
Kristof Provost
1bb72c2943 pf tests: Try to provoke a memory leak
There was a memory leak in the DIOCRADDTABLES ioctl() code which could
be triggered by trying to add tables with the same name.
Try to provoke this memory leak. It was fixed in r331225.

MFC after:	1 week
2018-04-06 19:22:22 +00:00
Kristof Provost
8e748b94e7 pf tests: Basic ioctl validation for DIOCIGETIFACES and DIOCXCOMMIT
Validate the DIOCIGETIFACES and DIOCXCOMMIT ioctls with invalid values.

MFC after:	1 week
2018-04-06 19:21:29 +00:00
Kristof Provost
1ff545d642 pf tests: Basic ioctl validation for DIOCRGETTABLES, DIOCRGETTSTATS, DIOCRCLRTSTATS and DIOCRSETTFLAGS
Validate the DIOCRGETTABLES, DIOCRGETTSTATS, DIOCRCLRTSTATS and
DIOCRSETTFLAGS ioctls with invalid values. These may succeed (because
the kernel uses the minimally required size, not the specified size),
but should not trigger kernel panics.

MFC after:	1 week
2018-04-06 15:57:20 +00:00
Kristof Provost
98c5f9884e pf tests: Basic ioctl validation tests
Validate the DIOCRADDTABLES and DIOCRDELTABLES ioctls with invalid size
values. All of these requests should fail.

MFC after:	1 week
2018-04-06 15:03:48 +00:00
Kristof Provost
a60f45a0d5 pf tests: Fix pft_ping.py to work with scapy 2.3.3
Scapy requires the Raw payload to be a string, which was not the case. This
caused the pft_ping.py script to fail, which in turn caused the test to fail.
2018-01-09 19:02:42 +00:00
Bryan Drewery
3806950135 DIRDEPS_BUILD: Connect new directories.
Sponsored by:	Dell EMC Isilon
2017-10-31 00:04:07 +00:00
Kristof Provost
96b90524d1 pf tests: Remove temporary files
Remove the created_jails.lst and created_interfaces.lst files in the
cleanup code.
2017-10-26 20:55:33 +00:00
Kristof Provost
57d465298a pf tests: Fragmentation (v6) test
Test fragmentation handling (i.e. scrub fragment reassemble) code for
IPv6.

Two simple tests: Ping a host (jail) and test forwarding of fragmented
packets.
2017-10-26 20:54:52 +00:00
Kristof Provost
da86443874 pf tests: destroy jails before destroying interfaces
When cleaning up we must destroy the jails before we destroy the interfaces.
Otherwise we might try to destroy interfaces that belong to a jail, which won't
work and fail to completely clean up.
2017-10-26 20:53:56 +00:00
Kristof Provost
f038a398da pf tests: Use pft_set_rules everywhere
We now have a utility function to set pf rules in the jail. Use it
whenever we need to set the pf rules in the test jail.
2017-10-16 15:05:32 +00:00
Kristof Provost
ba22aeacf1 pf tests: Basic IPv6 forwarding tests
Pass/block packets in the forwarding path with pf.

Introduce the pft_set_rules() helper function, because we need to
remember to flush states between individual tests. If not we can get
packets passing despite rules blocking them because they match states
created in a previous test.

Extend pft_ping.py to be able to send IPv6 echo requests.
2017-10-16 15:03:45 +00:00
Kristof Provost
67f4baf8b0 pf: test set-tos
Introduce tests for the set-tos feature of pf. Teach pft_ping.py to send
and verify ToS flags.
2017-10-16 15:01:49 +00:00
Kristof Provost
c0b63519b0 pf: Very basic forwarding test
This test illustrates the use of scapy to test pf.

Differential Revision:	https://reviews.freebsd.org/D12581
2017-10-06 20:51:32 +00:00
Kristof Provost
1d6f5f214a pf: Basic automated test using VIMAGE
If VIMAGE is present we can start jails with their own pf instance. This
makes it fairly easy to run tests.
For example, this basic test verifies that drop/pass and icmp
classification works. It's a basic sanity test for pf, and hopefully an
example on how to write more pf tests.

The tests are skipped if VIMAGE is not enabled.

This work is inspired by the GSoC work of Panagiotes Mousikides.

Differential Revision:	https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00