d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf tests: Test killing states by gateway

Browse Source 
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30059
This commit is contained in:
Kristof Provost 2021-04-30 17:07:23 +02:00
parent abbcba9cf5
commit c2e11d81d2
1 changed files with 60 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
tests/sys/netpfil/pf/killstate.sh
View File

@ -318,10 +318,70 @@ multilabel_cleanup()
pft_cleanup
}
atf_test_case "gateway" "cleanup"
gateway_head()
{
atf_set descr 'Test killing states by route-to/reply-to address'
atf_set require.user root
atf_set require.progs scapy
}
gateway_body()
{
pft_init
epair=$(vnet_mkepair)
ifconfig ${epair}a 192.0.2.1/24 up
vnet_mkjail alcatraz ${epair}b
jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up
jexec alcatraz pfctl -e
pft_set_rules alcatraz "block all" \
"pass in reply-to (${epair}b 192.0.2.1) proto icmp"
# Sanity check & establish state
# Note: use pft_ping so we always use the same ID, so pf considers all
# echo requests part of the same flow.
atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
--sendif ${epair}a \
--to 192.0.2.2 \
--replyif ${epair}a
# Change rules to now deny the ICMP traffic
pft_set_rules noflush alcatraz "block all"
# Established state means we can still ping alcatraz
atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
--sendif ${epair}a \
--to 192.0.2.2 \
--replyif ${epair}a
# Killing with a different gateway does not affect our state
jexec alcatraz pfctl -k gateway -k 192.0.2.2
atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
--sendif ${epair}a \
--to 192.0.2.2 \
--replyif ${epair}a
# Killing states with the relevant gateway does terminate our state
jexec alcatraz pfctl -k gateway -k 192.0.2.1
atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \
--sendif ${epair}a \
--to 192.0.2.2 \
--replyif ${epair}a
}
gateway_cleanup()
{
pft_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "v4"
atf_add_test_case "v6"
atf_add_test_case "label"
atf_add_test_case "multilabel"
atf_add_test_case "gateway"
}