Commit Graph

1163 Commits

Author SHA1 Message Date
Kristof Provost
e14d56f370 pf tests: Test set keepcounters
MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29781
2021-04-19 14:31:47 +02:00
Kristof Provost
4ae3a97e12 bridge tests: Test STP config BPDU validation
PR:		254924
Reviewed by:	donner
Differential Revision:	https://reviews.freebsd.org/D29783
2021-04-19 12:09:35 +02:00
Mark Johnston
3a248c8441 Add some regression tests for O_PATH and AT_EMPTY_PATH
Reviewed by:	kib
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D29719
2021-04-15 09:40:57 -04:00
Kristof Provost
112f007e12 pf tests: Test clearing rules counters
This was briefly broken, so ensure that we can read and clear rules
counters.

MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29728
2021-04-14 13:33:02 +02:00
Kurosawa Takahiro
2aa21096c7 pf: Implement the NAT source port selection of MAP-E Customer Edge
MAP-E (RFC 7597) requires special care for selecting source ports
in NAT operation on the Customer Edge because a part of bits of the port
numbers are used by the Border Relay to distinguish another side of the
IPv4-over-IPv6 tunnel.

PR:		254577
Reviewed by:	kp
Differential Revision:	https://reviews.freebsd.org/D29468
2021-04-13 10:53:18 +02:00
Ryan Libby
13d4f96130 shared shadow vm object invalidation regression test
Add a regression test for a scenario where a shadow vm object is shared
by multiple mappings.  If a page COW occurs through one of the mappings,
then the virtual-to-physical mapping may become invalidated.

This tests the scenario from CVE-2021-29626 which was fixed by
982693bb72.

Reviewed by:	markj
Sponsored by:	Dell EMC Isilon
2021-04-07 12:39:05 -07:00
Kristof Provost
f37667e235 pf tests: Test multi-wan rdr
This replicates an issue observed on pfSense: https://redmine.pfsense.org/issues/11436

In essence, reply-to is needed to ensure that connections always leave
the WAN interface they came in on, but this confused the state tracking.

MFC after:	2 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2021-04-07 17:03:20 +02:00
Kurosawa Takahiro
5a5623397c pf tests: make synproxy and nat work correctly even if inetd is running
tests/sys/netfil/pf/synproxy fails if inetd has been running
outside of the jail because pidfile_open() fails with EEXIST.
tests/sys/netfil/pf/nat has the same problem but the test succeeds
because whether inetd is running is not so important.

Fix the problem by changing the pidfile path from the default
location.

Reviewed by:	kp
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D29622
2021-04-07 13:05:23 +02:00
Alex Richardson
83532eb68c tests/sys/net/routing: XFAIL the two failing tests
They have been failing for 1.5 months and the patch to fix them is stuck
in review so mark them as XFAIL for now to get Jenkins back to green.

To be reverted when https://reviews.freebsd.org/D28886 (or similar) is
commited.

Reviewed By:	kp
MFC after:	3 days
Differential Revision: https://reviews.freebsd.org/D29528
2021-04-07 10:34:22 +01:00
Vincenzo Maffione
36d6e65722 netmap: update unit tests with libnetmap tests 2021-04-02 14:39:30 +00:00
Vincenzo Maffione
45c67e8f6b netmap: several typo fixes
No functional changes intended.
2021-04-02 07:01:20 +00:00
Alex Richardson
6f30d1c851 ng_macfilter_test: Skip rather than fail if there is no network
This should bring the number of Jenkins failures from 4 down to 3.
Locally kyua now prints `skipped: could not find a valid interface  [0.115s]`
when I run it in QEMU without a network device.

Reviewed By:	lwhsu
MFC after:	3 days
Differential Revision: https://reviews.freebsd.org/D29414
2021-03-25 11:16:12 +00:00
Alex Richardson
aa05775ef0 tests/sys/net/if_lagg_test: Fix syntax error
Fixes:	ee231b27ff ("Also skip sys/net/if_lagg_test:witness on non-i386")
2021-03-22 11:55:06 +00:00
Alex Richardson
ee231b27ff Also skip sys/net/if_lagg_test:witness on non-i386
The LOR also happens on amd64 and other architectures. Ideally we would
fix this. However, in order to get Jenkins green again to catch real
regressions, we should skip this test for now.

PR:		251726
Reviewed By:	lwhsu
Differential Revision: https://reviews.freebsd.org/D29341
2021-03-19 18:35:06 +00:00
Alex Richardson
7dd1f932c1 tests/sys/netgraph: Further CI fixes
I was trying to debug why this test is working locally but failing in CI.
While doing so I made some small changes to allow running it with set -e.

It turns out the problem is that find_iface does not return anything in
Jenkins, so all following tests fail with obscure error messages.
To handle this case exit early if $eth is empty.

Reviewed By:	lwhsu
Differential Revision: https://reviews.freebsd.org/D29340
2021-03-19 18:34:30 +00:00
Alan Somers
929acdb19a fusefs: fix two bugs regarding fcntl file locks
1) F_SETLKW (blocking) operations would be sent to the FUSE server as
   F_SETLK (non-blocking).

2) Release operations, F_SETLK with lk_type = F_UNLCK, would simply
   return EINVAL.

PR:		253500
Reported by:	John Millikin <jmillikin@gmail.com>
MFC after:	2 weeks
2021-03-18 17:09:10 -06:00
Alex Richardson
6ceacebdf5 Unbreak MSG_CMSG_CLOEXEC
MSG_CMSG_CLOEXEC has not been working since 2015 (SVN r284380) because
_finstall expects O_CLOEXEC and not UF_EXCLOSE as the flags argument.
This was probably not noticed because we don't have a test for this flag
so this commit adds one. I found this problem because one of the
libwayland tests was failing.

Fixes:		ea31808c3b ("fd: move out actual fp installation to _finstall")
MFC after:	3 days
Reviewed By:	mjg, kib
Differential Revision: https://reviews.freebsd.org/D29328
2021-03-18 20:52:20 +00:00
Kristof Provost
8ad7d25dfc pf tests: pfsync bulk update test
Test that pfsync works as expected with bulk updates. That is, create
some state before setting up the second firewall. Let that firewall
request a bulk update so it can catch up, and check that it got the
state which was created before it enable pfsync.

PR:		254236
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D29272
2021-03-17 19:18:14 +01:00
Kyle Evans
f187d6dfbf base: remove if_wg(4) and associated utilities, manpage
After length decisions, we've decided that the if_wg(4) driver and
related work is not yet ready to live in the tree.  This driver has
larger security implications than many, and thus will be held to
more scrutiny than other drivers.

Please also see the related message sent to the freebsd-hackers@
and freebsd-arch@ lists by Kyle Evans <kevans@FreeBSD.org> on
2021/03/16, with the subject line "Removing WireGuard Support From Base"
for additional context.
2021-03-17 09:14:48 -05:00
Kyle Evans
e277a507d8 tests: netinet: add missing up from local change 2021-03-15 00:24:54 -05:00
Kyle Evans
74ae3f3e33 if_wg: import latest fixup work from the wireguard-freebsd project
This is the culmination of about a week of work from three developers to
fix a number of functional and security issues.  This patch consists of
work done by the following folks:

- Jason A. Donenfeld <Jason@zx2c4.com>
- Matt Dunwoodie <ncon@noconroy.net>
- Kyle Evans <kevans@FreeBSD.org>

Notable changes include:
- Packets are now correctly staged for processing once the handshake has
  completed, resulting in less packet loss in the interim.
- Various race conditions have been resolved, particularly w.r.t. socket
  and packet lifetime (panics)
- Various tests have been added to assure correct functionality and
  tooling conformance
- Many security issues have been addressed
- if_wg now maintains jail-friendly semantics: sockets are created in
  the interface's home vnet so that it can act as the sole network
  connection for a jail
- if_wg no longer fails to remove peer allowed-ips of 0.0.0.0/0
- if_wg now exports via ioctl a format that is future proof and
  complete.  It is additionally supported by the upstream
  wireguard-tools (which we plan to merge in to base soon)
- if_wg now conforms to the WireGuard protocol and is more closely
  aligned with security auditing guidelines

Note that the driver has been rebased away from using iflib.  iflib
poses a number of challenges for a cloned device trying to operate in a
vnet that are non-trivial to solve and adds complexity to the
implementation for little gain.

The crypto implementation that was previously added to the tree was a
super complex integration of what previously appeared in an old out of
tree Linux module, which has been reduced to crypto.c containing simple
boring reference implementations.  This is part of a near-to-mid term
goal to work with FreeBSD kernel crypto folks and take advantage of or
improve accelerated crypto already offered elsewhere.

There's additional test suite effort underway out-of-tree taking
advantage of the aforementioned jail-friendly semantics to test a number
of real-world topologies, based on netns.sh.

Also note that this is still a work in progress; work going further will
be much smaller in nature.

MFC after:	1 month (maybe)
2021-03-14 23:52:04 -05:00
Alex Richardson
65f4ff4e68 tests/sys/netgraph/ng_macfilter_test: Fix invalid TAP output
This should allow the test to pass in Jenkins. Testing it locally now
reports "passed" instead of "invalid TAP data".

While touching this file also fix some shellcheck warnings that were
pointed out by my IDE.

Reviewed By:	lwhsu, afedorov
Differential Revision: https://reviews.freebsd.org/D29054
2021-03-12 17:35:26 +00:00
Alex Richardson
0b86424c31 tests/sys/cddl: correctly quote atf_set "require.progs"
The argument has to be a single whitespace-separate value. While touching
all these lines also add ksh93, since `atf_set "require.progs"` overrides
the default value specified in the Kyuafile. This then results in tests
being executed despite ksh93 not being installed.

Reviewed By:	asomers
Differential Revision: https://reviews.freebsd.org/D29066
2021-03-08 09:38:27 +00:00
Kristof Provost
9d3b2bcf76 pf tests: Test tos/dscp matching
MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29078
2021-03-06 10:08:44 +01:00
Alex Richardson
1fcbddec14 Fix GCC build of ptrace_test after 96a9e50e63
It seems like GCC's -Wsign-compare is stricter and also warns for
constants. Appease GCC by adding the required casts.

Fixes:		96a9e50e63 ("ptrace_test: Add more debug output on test failures")
Reported by:	Jenkins CI
2021-03-03 11:22:43 +00:00
Alex Richardson
c97304110a tests/sys/audit: add missing comma delimiter between fields
This makes the `kyua report --verbose` output a lot easier to parse when
looking at failed tests. It also fixes the closefrom() test since I
tested my changes with this commit but forgot to push it together with
fa32350347.

Fixes:		fa32350347 ("close_range: add audit support")
2021-03-02 18:37:12 +00:00
Alex Richardson
53a535c1d8 Simplify the capsicum-test wrapper script
Instead of running tests one-by-one with the shell wrapper we now run
the full gtest testsuite twice (once as root, once as non root). This
significantly speeds up running tests despite running them twice.
This change also passes the missing -u flag to capsicum-test that caused
test failures (https://bugs.freebsd.org/250178)

Previously, running the testsuite with the wrapper script took ~3s per
test on aarch64 QEMU, i.e. a total of almost 5 minutes.
Now it takes 6 seconds to run all tests twice.

Before:
root@freebsd-aarch64:/usr/tests/sys/capsicum # /usr/bin/time kyua test functional
94/96 passed (2 failed)
      309.97 real        58.46 user       244.31 sys

After:
root@freebsd-aarch64:/usr/tests/sys/capsicum # /usr/bin/time kyua test functional
functional:test_root  ->  passed  [2.659s]
functional:test_unprivileged  ->  passed  [2.391s]
2/2 passed (0 failed)
        5.48 real         1.06 user         2.52 sys

This overhead is caused by kyua + atf-sh spawning lots of additional
processes and can be avoided by just running the googletest test binary.
syscall                     seconds   calls  errors
fork                   39.810229456    1275       0
sigprocmask            13.546928736     572       0

i.e. 1275 processes spawned to run a single test.

Test Plan:	All tests pass with D28907.
PR:		250178
Reviewed By:	lwhsu
Differential Revision: https://reviews.freebsd.org/D29014
2021-03-02 18:27:36 +00:00
Alex Richardson
955a3f9ad5 Update capsicum-test to git commit f4d97414d48b8f8356b971ab9f45dc5c70d53c40
This includes various fixes that I submitted recently such as updating the
pdkill() tests for the actual implemented behaviour
(https://github.com/google/capsicum-test/pull/53) and lots of changes to
avoid calling sleep() and replacing it with reliable synchronization
(pull requests 49,51,52,53,54). This should make the testsuite more reliable
when running on Jenkins. Additionally, process status is now retrieved using
libprocstat instead of running `ps` and parsing the output
(https://github.com/google/capsicum-test/pull/50). This fixes one previously
failing test and speeds up execution.

Overall, this update reduces the total runtime from ~60s to about 4-5 seconds.
2021-03-02 16:38:05 +00:00
Alex Richardson
17cc20092c Fix ptrace_test:ptrace__syscall_args after ATF upgrade
ATF now opens the results file (without CLOEXEC), so the child actually
has a valid file descriptor 3. To fix this simply use a large number that
will definitely not be a valid file descriptor.

Reviewed by:	jhb, cem, lwhsu
Differential Revision: https://reviews.freebsd.org/D28889
2021-03-01 19:56:05 +00:00
Alex Richardson
1032131464 Remove atf_tc_skip calls from ptrace_test
I've run these tests many times in a loop on multiple architectures and
it works reliably for me, maybe it's time to retire these skips?
This also adds an additional waitpid to one of the tests to avoid
a potential race condition (suggested by markj@).

PR:		239397, 244056, 239425, 240510, 220841, 243605
Reviewed By:	markj
Differential Revision: https://reviews.freebsd.org/D28888
2021-03-01 19:56:05 +00:00
Alex Richardson
96a9e50e63 ptrace_test: Add more debug output on test failures
Mostly automatic, using
`CHILD_REQUIRE\(([^|&\n]*) ==` -> `CHILD_REQUIRE_EQ_INT($1,`
`ATF_REQUIRE\(([^|&\n]*) ==` -> `REQUIRE_EQ_INT($1,` followed by
git-clang-format -f and then manually checking ones that contain ||/&&.

Test Plan:
Still getting the same failure but now it prints
`psr.sr_error (0) == EBADF (9) not met` instead of just failing
without printing the values.

PR:		243605
Reviewed By:	jhb
Differential Revision: https://reviews.freebsd.org/D28887
2021-03-01 19:55:43 +00:00
Alex Richardson
98202829d1 tests/sys/netpfil/pf: Add missing python3 requirements
This also fixes a typo in the dup test that caused the head function to
not be called. On my test system without python3 the tests are now
skipped instead of failing.

Reviewed By:	kp
Differential Revision: https://reviews.freebsd.org/D28903
2021-03-01 12:53:45 +00:00
Kristof Provost
7a4dbffa42 bridge tests: Test that we also forward on some interfaces
Ensure that we not only block on some interfaces, but also forward on
some. Without the previous commit we wound up discarding on all ports,
rather than only on the ports needed to break the loop.

MFC after:	1 week
Sponsored by:	Orange Business Services
Differential Revision:	https://reviews.freebsd.org/D28917
2021-02-25 10:17:03 +01:00
Konstantin Belousov
3ae8d83d04 Remove __NO_TLS.
All supported platforms support thread-local vars and __thread.

Reviewed by:	emaste
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D28796
2021-02-23 20:08:10 +02:00
Alex Richardson
fa32350347 close_range: add audit support
This fixes the closefrom test in sys/audit.

Includes cherry-picks of the following commits from openbsm:

4dfc628aaf
99ff6fe32a
da48a0399e

Reviewed By:	kevans
Differential Revision: https://reviews.freebsd.org/D28388
2021-02-23 17:47:07 +00:00
Alex Richardson
3775ddcf5a tests/sys/netgraph: Tell kyua that perl is required
Otherwise these tests fail with incomprehensible error messages.

Reviewed By:	kp
Differential Revision: https://reviews.freebsd.org/D28894
2021-02-23 17:43:31 +00:00
Kristof Provost
26492ba271 bridge tests: Test STP on top of VLAN devices
This is basically the same test as the existing STP test, but now on top
of VLAN interfaces instead of directly using the epair devices.

MFC after:	1 week
Sponsored by:	Orange Business Services
Differential Revision:	https://reviews.freebsd.org/D28861
2021-02-23 13:54:07 +01:00
Alexander V. Chernikov
f17f94cd1b Add arp/ndp tests in addition to rtsock ll tests. 2021-02-20 18:26:36 +00:00
Ed Maste
4621c4f2fd tests/sys/audit: force PIE off
df093aa946 linked against libprivateauditd.a, but that is currently
(and incorrectly) built as position-dependent.  For now just force PIE
off for this test to fix the WITH_PIE build.

Sponsored by:	The FreeBSD Foundation
2021-02-18 20:45:36 -05:00
Alex Richardson
df093aa946 tests/sys/audit: Avoid race caused by starting auditd(8) for testing
In the CheriBSD CI we reproducibly see the first test in sys/audit
(administrative:acct_failure) fail due to a missing startup message.
It appears this is caused by a race condition when starting auditd:
`service auditd onestart` returns as soon as the initial auditd() parent
exits (after the daemon(3) call).
We can avoid this problem by setting up the auditd infrastructure
in-process: libauditd contains audit_quick_{start,stop}() functions that
look like they are ideally suited to this task.
This patch also avoids forking lots of shell processes for each of the 418
tests by using `auditon(A_SENDTRIGGER, &trigger, sizeof(trigger))` to check
for a running auditd(8) instead of using `service auditd onestatus`.

With these two changes (and D28388 to fix the XFAIL'd test) I can now
boot and run `cd /usr/tests/sys/audit && kyua test` without any failures
in a single-core QEMU instance. Before there would always be at least one
failed test.

Besides making the tests more reliable in CI, a nice side-effect of this
change is that it also significantly speeds up running them by avoiding
lots of fork()/execve() caused by shell scripts:
Running kyua test on an AArch64 QEMU took 315s before and now takes 68s,
so it's roughly 3.5 times faster. This effect is even larger when running
on a CHERI-RISC-V QEMU since emulating CHERI instructions on an x86 host
is noticeably slower than emulating AArch64.

Test Plan: aarch64+amd64 QEMU no longer fail.

Reviewed By:	asomers
Differential Revision: https://reviews.freebsd.org/D28451
2021-02-18 14:02:48 +00:00
Kristof Provost
4a7d84058d pf tests: Explicitly ask for python3
If we install the scapy package (which we do list as a dependency) we
don't automatically install python (but we do have python3).

MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC (“Netgate”’)
2021-02-17 14:04:33 +01:00
Alexander V. Chernikov
2fe5a79425 Fix dst/netmask handling in routing socket code.
Traditionally routing socket code did almost zero checks on
 the input message except for the most basic size checks.

This resulted in the unclear KPI boundary for the routing system code
 (`rtrequest*` and now `rib_action()`) w.r.t message validness.

Multiple potential problems and nuances exists:
* Host bits in RTAX_DST sockaddr. Existing applications do send prefixes
 with hostbits uncleared. Even `route(8)` does this, as they hope the kernel
 would do the job of fixing it. Code inside `rib_action()` needs to handle
 it on its own (see `rt_maskedcopy()` ugly hack).
* There are multiple way of adding the host route: it can be DST without
 netmask or DST with /32(/128) netmask. Also, RTF_HOST has to be set correspondingly.
 Currently, these 2 options create 2 DIFFERENT routes in the kernel.
* no sockaddr length/content checking for the "secondary" fields exists: nothing
 stops rtsock application to send sockaddr_in with length of 25 (instead of 16).
 Kernel will accept it, install to RIB as is and propagate to all rtsock consumers,
 potentially triggering bugs in their code. Same goes for sin_port, sin_zero, etc.

The goal of this change is to make rtsock verify all sockaddr and prefix consistency.
Said differently, `rib_action()` or internals should NOT require to change any of the
 sockaddrs supplied by `rt_addrinfo` structure due to incorrectness.

To be more specific, this change implements the following:
* sockaddr cleanup/validation check is added immediately after getting sockaddrs from rtm.
* Per-family dst/netmask checks clears host bits in dst and zeros all dst/netmask "secondary" fields.
* The same netmask checking code converts /32(/128) netmasks to "host" route case
 (NULL netmask, RTF_HOST), removing the dualism.
* Instead of allowing ANY "known" sockaddr families (0<..<AF_MAX), allow only actually
 supported ones (inet, inet6, link).
* Automatically convert `sockaddr_sdl` (AF_LINK) gateways to
  `sockaddr_sdl_short`.

Reported by:	Guy Yur <guyyur at gmail.com>
Reviewed By:	donner
Differential Revision: https://reviews.freebsd.org/D28668
MFC after:	3 days
2021-02-16 20:30:04 +00:00
Kristof Provost
6b52139eb8 pf tests: Test unicast reverse path forwarding check
Ensure that pf's urpf-failed keyword works as expected.

PR:		253479
MFC after:	1 week
Reviewed by:	melifaro@
Differential Revision:	https://reviews.freebsd.org/D28694
2021-02-16 10:48:58 +01:00
Alan Somers
71befc3506 fusefs: set d_off during VOP_READDIR
This allows d_off to be used with lseek to position the file so that
getdirentries(2) will return the next entry.  It is not used by
readdir(3).

PR:		253411
Reported by:	John Millikin <jmillikin@gmail.com>
Reviewed by:	cem
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D28605
2021-02-12 21:50:52 -07:00
Alex Richardson
1eec5861d5 tests/sys/vfs/lookup_cap_dotdot: No longer aborts after ATF update
It appears this test no longer fails after c203bd70b5.

PR:		215690
2021-02-04 17:57:27 +00:00
Alex Richardson
8b820df156 Fix build with read-only source dir after 83c20b8a2d
I changed the Makefile to use SRCS instead of LDADD, but since there is
still and absolute path to the source the .o file was created inside the
source directory instead of the build directory.
It would be nice if this was an error/warning by default, but for now just
fix this issue by using .PATH and the base name of the file.

Reported by:	cy, peterj
2021-02-03 09:30:53 +00:00
Neel Chauhan
a08cdb6cfb Allow setting alias port ranges in libalias and ipfw. This will allow a system
to be a true RFC 6598 NAT444 setup, where each network segment (e.g. user,
subnet) can have their own dedicated port aliasing ranges.

Reviewed by:		donner, kp
Approved by:		0mp (mentor), donner, kp
Differential Revision:	https://reviews.freebsd.org/D23450
2021-02-02 13:24:17 -08:00
Alex Richardson
40407d3998 tests/sys/audit: Skip extattr tests if extattrs are not supported
In the CheriBSD CI, we run the testsuite with /tmp as tmpfs. This causes
the extattr audit tests to fail since tmpfs does not (yet) support
extattrs. Skip those tests if the target path is on a file system that
does not support extended file attributes.

While touching these two files also convert the ATF_REQUIRE_EQ(-1, ...)
checks to use ATF_REQURIE_ERRNO().

Reviewed By:	asomers
Differential Revision: https://reviews.freebsd.org/D28392
2021-02-02 09:55:19 +00:00
Alex Richardson
83c20b8a2d tests/sys/kern/crc32: Check for SSE4.2 before using it
This avoids a SIGILL when running these tests on QEMU (which
defaults to a basic amd64 CPU without SSE4.2).

This commit also tests the table-based implementations in addition to
testing the hw-accelerated crc32 versions.

Reviewed By:	cem, kib, markj
Differential Revision: https://reviews.freebsd.org/D28395
2021-02-02 09:53:39 +00:00
Alex Richardson
869cc06480 tests/sys/audit: fix timeout calculation
This changes the behaviour to a 30s total timeout (needed when running
on slow emulated uniprocessor systems) and timing out after 10s without
any input. This also uses timespecsub() instead of ignoring the
nanoseconds field.

After this change the tests runs more reliably on QEMU and time out less
frequently.

Reviewed By:	asomers
Differential Revision: https://reviews.freebsd.org/D28391
2021-01-28 17:24:24 +00:00
Kristof Provost
cd579b6fba pf tests: Test that dup-to doesn't produce extra duplicate packets 2021-01-28 16:46:44 +01:00
Kristof Provost
16b3833344 altq tests: Basic ALTQ test
Activate ALTQ_HFSC, crudely check if it really limits bandwidth as we'd expect.

Reviewed by:		donner@
Differential Revision:	https://reviews.freebsd.org/D28303
2021-01-25 19:58:22 +01:00
Alexander V. Chernikov
81728a538d Split rtinit() into multiple functions.
rtinit[1]() is a function used to add or remove interface address prefix routes,
  similar to ifa_maintain_loopback_route().
It was intended to be family-agnostic. There is a problem with this approach
 in reality.

1) IPv6 code does not use it for the ifa routes. There is a separate layer,
  nd6_prelist_(), providing interface for maintaining interface routes. Its part,
  responsible for the actual route table interaction, mimics rtenty() code.

2) rtinit tries to combine multiple actions in the same function: constructing
  proper route attributes and handling iterations over multiple fibs, for the
  non-zero net.add_addr_allfibs use case. It notably increases the code complexity.

3) dstaddr handling. flags parameter re-uses RTF_ flags. As there is no special flag
 for p2p connections, host routes and p2p routes are handled in the same way.
 Additionally, mapping IFA flags to RTF flags makes the interface pretty messy.
 It make rtinit() to clash with ifa_mainain_loopback_route() for IPV4 interface
 aliases.

4) rtinit() is the last customer passing non-masked prefixes to rib_action(),
 complicating rib_action() implementation.

5) rtinit() coupled ifa announce/withdrawal notifications, producing "false positive"
 ifa messages in certain corner cases.

To address all these points, the following has been done:

* rtinit() has been split into multiple functions:
- Route attribute construction were moved to the per-address-family functions,
 dealing with (2), (3) and (4).
- funnction providing net.add_addr_allfibs handling and route rtsock notificaions
 is the new routing table inteface.
- rtsock ifa notificaion has been moved out as well. resulting set of funcion are only
 responsible for the actual route notifications.

Side effects:
* /32 alias does not result in interface routes (/32 route and "host" route)
* RTF_PINNED is now set for IPv6 prefixes corresponding to the interface addresses

Differential revision:	https://reviews.freebsd.org/D28186
2021-01-16 22:42:41 +00:00
Kristof Provost
44117554b1 pf tests: pass NULL buffer to DIOCRCLRTSTATS
As discovered by syzcaller this used to provoke panics.

MFC after:	1 week
2021-01-13 19:49:45 +01:00
Alan Somers
ff1a307801 lio_listio: validate aio_lio_opcode
Previously, we would accept any kind of LIO_* opcode, including ones
that were intended for in-kernel use only like LIO_SYNC (which is not
defined in userland).  The situation became more serious with
022ca2fc7f.  After that revision, setting
aio_lio_opcode to LIO_WRITEV or LIO_READV would trigger an assertion.

Note that POSIX does not specify what should happen if aio_lio_opcode is
invalid.

MFC-with:	022ca2fc7f
Reviewed by:	jhb, tmunro, 0mp
Differential Revision:	<https://reviews.freebsd.org/D28078
2021-01-11 19:53:01 -07:00
Alan Somers
19cca0b961 aio: fix the tests when ZFS is not available
Don't try to cleanup the zpool if we couldn't create a zpool in the
first place.

Submitted by:	tmunro
MFC-with:	022ca2fc7f
2021-01-09 17:16:38 -07:00
Thomas Munro
801ac943ea aio_fsync(2): Support O_DSYNC.
aio_fsync(O_DSYNC, ...) is the asynchronous version of fdatasync(2).

Reviewed by: kib, asomers, jhb
Differential Review: https://reviews.freebsd.org/D25071
2021-01-08 13:15:56 +13:00
Alan Somers
022ca2fc7f Add aio_writev and aio_readv
POSIX AIO is great, but it lacks vectored I/O functions. This commit
fixes that shortcoming by adding aio_writev and aio_readv. They aren't
part of the standard, but they're an obvious extension. They work just
like their synchronous equivalents pwritev and preadv.

It isn't yet possible to use vectored aiocbs with lio_listio, but that
could be added in the future.

Reviewed by:    jhb, kib, bcr
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D27743
2021-01-02 19:57:58 -07:00
Alan Somers
92bbfe1f0d fusefs: implement FUSE_COPY_FILE_RANGE.
This updates the FUSE protocol to 7.28, though most of the new features
are optional and are not yet implemented.

MFC after:	2 weeks
Relnotes:	yes
Reviewed by:	cem
Differential Revision:	https://reviews.freebsd.org/D27818
2021-01-01 10:18:23 -07:00
Alan Somers
ae39db7406 fusefs: fix an expectation in one of the tests
An order-of-operations problem caused an expectation intended for
FUSE_READ to instead match FUSE_ACCESS.  Surprisingly, only one test
case was affected.

MFC after:	2 weeks
Reviewed by:	cem
Differential Revision:	https://reviews.freebsd.org/D27818
2021-01-01 10:18:22 -07:00
Cy Schubert
1d010cd31c Fix i386 build following 37df9d3bba.
MFC after:	2 weeks
X-MFC with:	37df9d3bba
2021-01-01 08:48:14 -08:00
Alan Somers
37df9d3bba fusefs: update FUSE protocol to 7.24 and implement FUSE_LSEEK
FUSE_LSEEK reports holes on fuse file systems, and is used for example
by bsdtar.

MFC after:	2 weeks
Relnotes:	yes
Reviewed by:	cem
Differential Revision: https://reviews.freebsd.org/D27804
2020-12-31 08:51:47 -07:00
Alan Somers
f928dbcb16 fusefs: fix the tests for a wider range of maxphys
maxphys is now a tunable, ever since r368124.  The default value is also
larger than it used to be.  That broke several fusefs tests that made
assumptions about maxphys.

* WriteCluster.clustering used the MAXPHYS compile-time constant.

* WriteBackAsync.direct_io_partially_overlaps_cached_block implicitly
  depended on the default value of maxphys.  Fix it by making the
  dependency explicit.

* Write.write_large implicitly assumed that maxphys would be no more
  than twice maxbcachebuf.  Fix it by explicitly setting m_max_write.

* WriteCluster.clustering and several others failed because the MockFS
  module did not work for max_write > 128KB (which most tests would set
  when maxphys > 256KB).  Limit max_write accordingly.  This is the same
  as fusefs-libs's behavior.

* Bmap's tests were originally written for MAXPHYS=128KB.  With larger
  values, the simulated file size was too small.

PR:		252096
Reviewed by:	emaste
Differential Revision:	https://reviews.freebsd.org/D27769
2020-12-28 18:56:17 +00:00
Kristof Provost
2d3fda5fa1 pf tests: Verify (tcp) checksum modification on unaligned options
It turns out pf incorrectly updates the TCP checksum if the TCP option
we're modifying is not 2-byte algined with respect to the start of the
packet.

Create a TCP packet with such an option and throw it through a scrub
rule, which will update timestamps and modify the packet.

PR:		240416
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D27688
2020-12-23 12:03:20 +01:00
Kristof Provost
e1f6571a12 pf tests: Sort Makefile entries
MFC after:	1 week
2020-12-23 12:03:20 +01:00
Kristof Provost
03ffa25695 net tests: Re-enable most if_clone tests
All but one of these (tap_ipv6_up_stress) currently pass, so we should enable
them so we don't regress.
2020-12-17 21:54:25 +00:00
Ryan Libby
c821ba35b6 posixshm_test.c: remove tautological checks
Reviewed by:	kib, markj
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D27564
2020-12-11 22:52:20 +00:00
Ryan Libby
6d759051d3 fdgrowtable_test.c: appease gcc
Work around bogus gcc -Wreturn-type.

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=44511

Reviewed by:	kevans, rew
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D27563
2020-12-11 22:52:16 +00:00
Nick Hibma
e8db04c389 New Netgraph module ng_macfilter:
Macfilter to route packets through different hooks based on sender MAC address.

Based on ng_macfilter written by Pekka Nikander

Sponsered by Retina b.v.

Reviewed by:	afedorov
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D27268
2020-12-08 15:09:42 +00:00
Mitchell Horne
22bd0c9731 ossl: port to arm64
Enable in-kernel acceleration of SHA1 and SHA2 operations on arm64 by adding
support for the ossl(4) crypto driver. This uses OpenSSL's assembly routines
under the hood, which will detect and use SHA intrinsics if they are
supported by the CPU.

Reviewed by:	jhb
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D27390
2020-12-04 21:12:17 +00:00
Kristof Provost
e997614fd2 pf tests: Test case for bug
Changing a table from not having counters to having counters (or vice versa)
may trigger panics.

PR:		251414
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D27441
2020-12-02 16:33:23 +00:00
Alan Somers
23693bd8f3 AIO tests: update expected failure messages after r368265
PR:		220398, 251515
MFC after:	1 week
MFC-With:	r368265
2020-12-02 00:53:03 +00:00
Kristof Provost
c49747eaf2 pf tests: Re-enable panicing tests
We've fixed the vnet/epair cleanup race, so it is now safe to re-enable these
tests.

MFC after:	2 weeks
Sponsored by:	Modirum MDPay
2020-12-01 16:44:36 +00:00
Alan Somers
01f3f35447 ping: fix some man pages and tests after r368045
MFC-with:	r368045
2020-11-26 04:55:02 +00:00
John Baldwin
a4a23d2137 Remove uses of CRIOGET in OCF tests after r368005.
Pointy hat to:	jhb
Sponsored by:	Chelsio Communications
Differential Revision:	https://reviews.freebsd.org/D27367
2020-11-25 01:31:00 +00:00
Kristof Provost
d5325f2f3c pf tests: provoke tag hashing panic
Attempt to provoke the panic fixed in r367987.

MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D27350
2020-11-24 17:32:49 +00:00
Robert Wing
3c85ca21d1 fd: free old file descriptor tables when not shared
During the life of a process, new file descriptor tables may be allocated. When
a new table is allocated, the old table is placed in a free list and held onto
until all processes referencing them exit.

When a new file descriptor table is allocated, the old file descriptor table
can be freed when the current process has a single-thread and the file
descriptor table is not being shared with any other processes.

Reviewed by:    kevans
Approved by:    kevans (mentor)
Differential Revision:  https://reviews.freebsd.org/D18617
2020-11-22 05:00:28 +00:00
Kristof Provost
d8f541d9a3 pf tests: Basic source tracking test
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D27255
2020-11-20 10:11:03 +00:00
Jonathan T. Looney
36c52a52ee Add a regression test for the port-selection behavior fixed in r367680.
Reviewed by:	markj, olivier, tuexen
Sponsored by:	Netflix
Differential Revision:	https://reviews.freebsd.org/D27173
2020-11-14 15:44:28 +00:00
Adrian Chadd
07a605f427 [tests] Fix unused variable warning in gcc
Reviewed by:	markj, imp, cem,
Approved by:	markj
Differential Revision:	https://reviews.freebsd.org/D26792
2020-11-13 18:50:24 +00:00
Mark Johnston
870d4ba3ff cryptotest: Add qat(4) coverage
MFC after:	3 days
Sponsored by:	Rubicon Communications, LLC (Netgate)
2020-11-05 16:00:57 +00:00
Jung-uk Kim
8f02e2ac27 Make the tests work without COMPAT_FREEBSD12 in kernel.
sysctl 'kern.cryptodevallowsoft' was renamed to 'kern.crypto.allow_soft' in
r359374 and the prevous one is only available in kernel built with
"options COMPAT_FREEBSD12".
2020-11-04 22:41:54 +00:00
Jung-uk Kim
ac61934942 Add ossl(4) to cryptotest. 2020-10-30 19:53:16 +00:00
Edward Tomasz Napierala
bce7ee9d41 Drop "All rights reserved" from all my stuff. This includes
Foundation copyrights, approved by emaste@.  It does not include
files which carry other people's copyrights; if you're one
of those people, feel free to make similar change.

Reviewed by:	emaste, imp, gbe (manpages)
Differential Revision:	https://reviews.freebsd.org/D26980
2020-10-28 13:46:11 +00:00
Mateusz Piotrowski
7b39bef2cf Do not recommend to install kyua with pkg in the tests README
Kyua is now available in the base system.

While here, reword the usage section a bit.
2020-10-27 09:53:49 +00:00
Alexander V. Chernikov
c7cffd65c5 Add support for stacked VLANs (IEEE 802.1ad, AKA Q-in-Q).
802.1ad interfaces are created with ifconfig using the "vlanproto" parameter.
Eg., the following creates a 802.1Q VLAN (id ) over a 802.1ad S-VLAN
(id ) over a physical Ethernet interface (em0).

ifconfig vlan5 create vlandev em0 vlan 5 vlanproto 802.1ad up
ifconfig vlan42 create vlandev vlan5 vlan 42 inet 10.5.42.1/24

VLAN_MTU, VLAN_HWCSUM and VLAN_TSO capabilities should be properly
supported. VLAN_HWTAGGING is only partially supported, as there is
currently no IFCAP_VLAN_* denoting the possibility to set the VLAN
EtherType to anything else than 0x8100 (802.1ad uses 0x88A8).

Submitted by:	Olivier Piras
Sponsored by:	RG Nets
Differential Revision:	https://reviews.freebsd.org/D26436
2020-10-21 21:28:20 +00:00
Alexander V. Chernikov
a3525bd166 Try to enable multipath routing in flowid tests. 2020-10-16 21:51:17 +00:00
Andrew Turner
f56a08c810 Fix write only mappings on arm64
When trapping on a wrote access to a buffer the kernel has mapped as write
only we should only pass the VM_PROT_WRITE flag. Previously the call to
vm_fault_trap as the VM_PROT_READ flag was unexpected.

Reported by:	manu
Sponsored by:	Innovate UK
2020-10-13 10:26:15 +00:00
Kristof Provost
e6f9af16bc pf tests: Test that 'set skip on <group>' works on new group members
There's a know issue where new group members don't get the 'set skip on'
applied until the rules are re-loaded.

Do this by setting rules that block all traffic, but skip members of the
'epair' group. If we can communicate over the epair interface we know the set
skip rule took effect, even if the rule was set before the interface was
created.

MFC after:	2 weeks
2020-10-12 12:41:10 +00:00
Li-Wen Hsu
2c39128feb Temporarily skip failing test cases in CI:
sys.capsicum.functional.Capability__NoBypassDAC
sys.capsicum.functional.Pdfork__OtherUserForked

PR:		250178, 250179
Sponsored by:	The FreeBSD Foundation
2020-10-07 09:53:24 +00:00
Li-Wen Hsu
3d077160cb Skip test written in Googltest in the wrapper script
This leaves the main test body untouched and only skip running in the CI env,
makes doing local test easier while developing.

PR:		244165
Sponsored by:	The FreeBSD Foundation
2020-10-07 07:23:29 +00:00
Li-Wen Hsu
c300407979 Temporarily skip failing test cases in CI:
sys.capsicum.functional.ForkedOpenatTest_WithFlagInCapabilityMode___
sys.capsicum.functional.OpenatTest__WithFlag

PR:		249960
Sponsored by:	The FreeBSD Foundation
2020-10-06 12:57:54 +00:00
Li-Wen Hsu
194d562872 Make capsicum test cases fine-grained
Add a wrapping script to use ATF to run tests written with Googletest
one by one. This helps locating and tracking the failing case in CI easier.

This is a temporarily solution while Googletest support in Kyua is developing.
We will revert this once Kyua+Googletest integration is ready.

Reviewed by:	emaste
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D25896
2020-10-06 06:45:52 +00:00
Li-Wen Hsu
7862a433e9 Clear the dmesg buffer to prevent rotating causes issues
This is a workaround for the current continuously failing test case

sys.kern.sonewconn_overflow.sonewconn_overflow_01

The side effect is the dmesg buffer got cleared and may effect other tests
depends on dmesg output running in parallel.  The better solution would be
tailing the log file like /var/log/debug.log

Sponsored by:	The FreeBSD Foundation
2020-10-06 04:18:42 +00:00
Alexander V. Chernikov
1b95005e95 Fix route flags update during RTM_CHANGE.
Nexthop lookup was not consireding rt_flags when doing
 structure comparison, which lead to an original nexthop
 selection when changing flags. Fix the case by adding
 rt_flags field into comparison and rearranging nhop_priv
 fields to allow for efficient matching.
Fix `route change X/Y flags` case - recent changes
 disallowed specifying RTF_GATEWAY flag without actual gateway.
 It turns out, route(8) fills in RTF_GATEWAY by default, unless
 -interface flag is specified. Fix regression by clearing
 RTF_GATEWAY flag instead of failing.
Fix route flag reporting in RTM_CHANGE messages by explicitly
 updating rtm_flags after operation competion.
Add IPv4/IPv6 tests for flag-only route changes.
2020-10-04 13:24:58 +00:00
Alan Somers
d262168916 fusefs tests: quell Coverity "Argument cannot be negative" warnings
Must abort tests early if open(2) fails.

Reported by:	Coverity
Coverity CID:	1432810 and many others
Reviewed by:	kevans
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D26635
2020-10-02 17:06:05 +00:00
Kyle Evans
7cc42f6d25 Do a sweep and remove most WARNS=6 settings
Repeating the default WARNS here makes it slightly more difficult to
experiment with default WARNS changes, e.g. if we did something absolutely
bananas and introduced a WARNS=7 and wanted to try lifting the default to
that.

Drop most of them; there is one in the blake2 kernel module, but I suspect
it should be dropped -- the default WARNS in the rest of the build doesn't
currently apply to kernel modules, and I haven't put too much thought into
whether it makes sense to make it so.
2020-10-01 01:10:51 +00:00
Olivier Cochard
0d46edd0bb Enable SO_LINGER to the so_reuseport_lb_test regression tests, preventing
many sockets in TIME_WAIT state at the end of the test.

PR:		249885
Reviewed by:	markj
Approved by:	markj
Sponsored by:	Netflix
Differential Revision:	https://reviews.freebsd.org/D26549
2020-09-25 16:02:13 +00:00
Alan Somers
a62772a78e fusefs: fix mmap'd writes in direct_io mode
If a FUSE server returns FOPEN_DIRECT_IO in response to FUSE_OPEN, that
instructs the kernel to bypass the page cache for that file. This feature
is also known by libfuse's name: "direct_io".

However, when accessing a file via mmap, there is no possible way to bypass
the cache completely. This change fixes a deadlock that would happen when
an mmap'd write tried to invalidate a portion of the cache, wrongly assuming
that a write couldn't possibly come from cache if direct_io were set.

Arguably, we could instead disable mmap for files with FOPEN_DIRECT_IO set.
But allowing it is less likely to cause user complaints, and is more in
keeping with the spirit of open(2), where O_DIRECT instructs the kernel to
"reduce", not "eliminate" cache effects.

PR:		247276
Reported by:	trapexit@spawn.link
Reviewed by:	cem
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D26485
2020-09-24 16:27:53 +00:00
Kyle Evans
93900fe76d tests: move the memfd tests over to sys/posixshm
memfd_create is implemented on top of posixshm, so this is a logically
correct place for them to be. Moreover, this reduces the number of places to
look to run tests when working in this part of the tree.

Discussed with:	kib (to some extent, a while ago)
2020-09-23 19:54:59 +00:00