d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix failure test cases after r351423 due to ping6(8) options changed

Browse Source 
Failure test cases:
    sys.netpfil.common.pass_block.pf_v6
    sys.netpfil.pf.pass_block.noalias
    sys.netpfil.pf.pass_block.v6

Sponsored by:	The FreeBSD Foundation
This commit is contained in:
lwhsu 2019-08-24 01:28:39 +00:00
parent 088e7aa9fb
commit 7ed91a6e6f
2 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
tests/sys/netpfil/common/pass_block.sh
View File

@ -99,7 +99,7 @@ v6_body()
"ipf" \
"block in all"
atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 fd7a:803f:cc4b::2
atf_check -s exit:2 -o ignore ping6 -c 1 -W 1 fd7a:803f:cc4b::2
# Pass All
firewall_config "iron" ${firewall} \
@ -110,7 +110,7 @@ v6_body()
"ipf" \
"pass in all"
atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 fd7a:803f:cc4b::2
atf_check -s exit:0 -o ignore ping6 -c 1 -W 1 fd7a:803f:cc4b::2
}
v6_cleanup()
@ -126,4 +126,4 @@ setup_tests "v4" \
"v6" \
"pf" \
"ipfw" \
"ipf"
"ipf"

20
tests/sys/netpfil/pf/pass_block.sh
View File

@ -60,23 +60,23 @@ v6_body()
jexec alcatraz ifconfig ${epair}b inet6 2001:db8:42::2/64 up no_dad
# Trivial ping to the jail, without pf
atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
atf_check -s exit:0 -o ignore ping6 -c 1 -W 1 2001:db8:42::2
# pf without policy will let us ping
jexec alcatraz pfctl -e
atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
atf_check -s exit:0 -o ignore ping6 -c 1 -W 1 2001:db8:42::2
# Block everything
pft_set_rules alcatraz "block in"
atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
atf_check -s exit:2 -o ignore ping6 -c 1 -W 1 2001:db8:42::2
# Block everything but ICMP
pft_set_rules alcatraz "block in" "pass in proto icmp6"
atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
atf_check -s exit:0 -o ignore ping6 -c 1 -W 1 2001:db8:42::2
# Allowing ICMPv4 does not allow ICMPv6
pft_set_rules alcatraz "block in" "pass in proto icmp"
atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
atf_check -s exit:2 -o ignore ping6 -c 1 -W 1 2001:db8:42::2
}
v6_cleanup()
@ -107,21 +107,21 @@ noalias_body()
| cut -d % -f 1)
# Sanity check
atf_check -s exit:0 -o ignore ping6 -c 3 -x 1 2001:db8:42::2
atf_check -s exit:0 -o ignore ping6 -c 3 -x 1 ${linklocaladdr}%${epair}a
atf_check -s exit:0 -o ignore ping6 -c 3 -W 1 2001:db8:42::2
atf_check -s exit:0 -o ignore ping6 -c 3 -W 1 ${linklocaladdr}%${epair}a
jexec alcatraz pfctl -e
pft_set_rules alcatraz "block out inet6 from (${epair}b:0) to any"
atf_check -s exit:2 -o ignore ping6 -c 3 -x 1 2001:db8:42::2
atf_check -s exit:2 -o ignore ping6 -c 3 -W 1 2001:db8:42::2
# We should still be able to ping the link-local address
atf_check -s exit:0 -o ignore ping6 -c 3 -x 1 ${linklocaladdr}%${epair}a
atf_check -s exit:0 -o ignore ping6 -c 3 -W 1 ${linklocaladdr}%${epair}a
pft_set_rules alcatraz "block out inet6 from (${epair}b) to any"
# We cannot ping to the link-local address
atf_check -s exit:2 -o ignore ping6 -c 3 -x 1 ${linklocaladdr}%${epair}a
atf_check -s exit:2 -o ignore ping6 -c 3 -W 1 ${linklocaladdr}%${epair}a
}
noalias_cleanup()