system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-04 23:50:27 +00:00
Code Issues Packages Projects Releases Wiki Activity
freebsd-src/tests/sys/netpfil/pf/Makefile

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

80 lines
1.4 KiB
Makefile
Raw Normal View History

pf: Basic automated test using VIMAGE If VIMAGE is present we can start jails with their own pf instance. This makes it fairly easy to run tests. For example, this basic test verifies that drop/pass and icmp classification works. It's a basic sanity test for pf, and hopefully an example on how to write more pf tests. The tests are skipped if VIMAGE is not enabled. This work is inspired by the GSoC work of Panagiotes Mousikides. Differential Revision: https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00
PACKAGE= tests
TESTSDIR= ${TESTSBASE}/sys/netpfil/pf
pf: fix pf divert-to loop Resolved conflict between ipfw and pf if both are used and pf wants to do divert(4) by having separate mtags for pf and ipfw. Also fix the incorrect 'rulenum' check, which caused the reported loop. While here add a few test cases to ensure that divert-to works as expected, even if ipfw is loaded. divert(4) PR: 272770 MFC after: 3 weeks Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D42142
2023-10-19 10:12:15 +00:00
BINDIR= ${TESTSDIR}
pf tests: Basic ioctl validation tests Validate the DIOCRADDTABLES and DIOCRDELTABLES ioctls with invalid size values. All of these requests should fail. MFC after: 1 week
2018-04-06 15:03:48 +00:00
TESTS_SUBDIRS+= ioctl
pf: Basic automated test using VIMAGE If VIMAGE is present we can start jails with their own pf instance. This makes it fairly easy to run tests. For example, this basic test verifies that drop/pass and icmp classification works. It's a basic sanity test for pf, and hopefully an example on how to write more pf tests. The tests are skipped if VIMAGE is not enabled. This work is inspired by the GSoC work of Panagiotes Mousikides. Differential Revision: https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00
altq tests: Basic ALTQ test Activate ALTQ_HFSC, crudely check if it really limits bandwidth as we'd expect. Reviewed by: donner@ Differential Revision: https://reviews.freebsd.org/D28303
2021-01-23 09:37:03 +00:00
ATF_TESTS_SH+= altq \
anchor \
pf: fix pf divert-to loop Resolved conflict between ipfw and pf if both are used and pf wants to do divert(4) by having separate mtags for pf and ipfw. Also fix the incorrect 'rulenum' check, which caused the reported loop. While here add a few test cases to ensure that divert-to works as expected, even if ipfw is loaded. divert(4) PR: 272770 MFC after: 3 weeks Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D42142
2023-10-19 10:12:15 +00:00
divert-to \
pf tests: Test that dup-to doesn't produce extra duplicate packets
2021-01-28 10:02:20 +00:00
dup \
pf tests: MAC address filtering test Test the MAC address filtering capability in the new 'ether' feature in pf. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31743
2021-02-09 10:04:36 +00:00
ether \
pf: test set-tos Introduce tests for the set-tos feature of pf. Teach pft_ping.py to send and verify ToS flags.
2017-10-16 15:01:49 +00:00
forward \
pf tests: add tests for the new scrub syntax Add functions for testing new scrub option syntax and for packet fragmentation and route tables, because this was modified too. When testing of both the new and the compatible syntax is necessary, move original tests into _compat.sh file. Reviewed by: kp Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D38129
2023-04-13 16:14:52 +00:00
fragmentation_compat \
fragmentation_pass \
pf: Fix packet reassembly Don't drop fragmented packets when reassembly is disabled, they can be matched by rules with "fragment" keyword. Ensure that presence of scrub rules forces old behaviour. Reviewed by: kp Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D42355
2023-10-26 12:26:33 +00:00
fragmentation_no_reassembly \
pf tests: Stress state retrieval Create and retrieve 20.000 states. There have been issues with nvlists causing very slow state retrieval. We don't impose a specific limit on the time required to retrieve the states, but do log it. In excessive cases the Kyua timeout will fail this test. Reviewed by: donner MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30943
2021-06-28 10:48:20 +00:00
get_state \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
icmp \
pf tests: Test cases for the 'kill state(s)' feature MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29796
2021-04-16 15:33:17 +00:00
killstate \
pf tests: ensure that $nr expansion is correct Test the $nr expansion in labels is correct, even if the optimiser reduces the rule count. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D32489
2021-10-03 16:07:04 +00:00
macro \
pf: Implement the NAT source port selection of MAP-E Customer Edge MAP-E (RFC 7597) requires special care for selecting source ports in NAT operation on the Customer Edge because a part of bits of the port numbers are used by the Border Relay to distinguish another side of the IPv4-over-IPv6 tunnel. PR: 254577 Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D29468
2021-04-13 08:50:00 +00:00
map_e \
pf tests: test match keyword and dummynet Ensure that the 'match' keyword works with dummynet Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32480
2021-09-29 15:45:15 +00:00
match \
netpfil tests: Add functions for testing routing scenarios Many pf tests use identical setup where one jail is a router and optionally another jail is a server. Add functions to create such jails for IPv6 and IPv4 and functions to perform tests on such setup. Add tests using those functions: scrub actions, routing table, tcp sequence number modulation. Reviewed by: kp Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D38126
2023-03-04 13:35:24 +00:00
modulate \
pf tests: Test name handling Provoke a situation where two interfaces have the same name, and verify pf's reaction to this.
2018-12-01 09:59:32 +00:00
names \
pf tests: NAT exhaustion test It's been reported that pf doesn't handle running out of available ports for NAT correctly. It freezes until a state expires and it can find a free port. Test for this, by setting up a situation where only two ports are available for NAT and then attempting to create three connections. If successful the third connection will fail immediately. In an incorrect case the connection attempt will freeze, also freezing all interaction with pf through pfctl and trigger timeout. PR: 233867 MFC after: 2 weeks
2018-12-12 20:19:18 +00:00
nat \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
pass_block \
pf tests: ensure that pflog shows malformed packets as blocked, not passed Sponsored by: Rubicon Communications, LLC ("Netgate")
2024-01-02 15:01:20 +00:00
pflog \
pf tests: initial pflow test case Basic creation, validation and cleanup test for the new pflow interface. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D43109
2023-12-01 17:04:00 +00:00
pflow \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
pfsync \
pf tests: Basic 'set prio' test The ability to set VLAN PCP from pf was introduced in 3e248e0fb4, but never had a test added. Create a basic setup to set the PCP to an arbitrary value and use tcpdump to check it's actually set. MFC after: 1 week
2022-02-14 17:44:15 +00:00
prio \
pf tests: ftp-proxy test Basic test case for ftp-proxy PR: 256917 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate")
2021-07-01 15:15:36 +00:00
proxy \
pf tests: basic test for ridentifier MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32751
2021-10-29 15:52:59 +00:00
ridentifier \
pf tests: Basic synproxy test A very basic syncproxy test: set up a connection via a synproxy rule. This triggeres the panic fixed in r336273.
2018-07-14 21:32:32 +00:00
route_to \
netpfil tests: Add functions for testing routing scenarios Many pf tests use identical setup where one jail is a router and optionally another jail is a server. Add functions to create such jails for IPv6 and IPv4 and functions to perform tests on such setup. Add tests using those functions: scrub actions, routing table, tcp sequence number modulation. Reviewed by: kp Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D38126
2023-03-04 13:35:24 +00:00
rtable \
pf tests: Test clearing rules counters This was briefly broken, so ensure that we can read and clear rules counters. MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29728
2021-04-12 15:29:19 +00:00
rules_counter \
pf tests: add tests for the new scrub syntax Add functions for testing new scrub option syntax and for packet fragmentation and route tables, because this was modified too. When testing of both the new and the compatible syntax is necessary, move original tests into _compat.sh file. Reviewed by: kp Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D38129
2023-04-13 16:14:52 +00:00
scrub_compat \
scrub_pass \
pf tests: basic SCTP connection test pf can now inspect SCTP. Check that we can set up a connection. IPv4 and IPv6 tests. MFC after: 3 weeks Sponsored by: Orange Business Services Differential Revision: https://reviews.freebsd.org/D40863
2023-04-27 09:13:40 +00:00
sctp \
pf tests: Basic pfsync test Set up two jails, configure pfsync between them and create state in one of them, verify that this state is copied to the other jail. MFC after: 2 weeks Sponsored by: Orange Business Services Differential Revision: https://reviews.freebsd.org/D17504
2018-11-02 16:59:55 +00:00
set_skip \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
set_tos \
src_track \
pf tests: Forwarding syncookie test Test syncookies on a forwarding host. That is, in a setup where the machine (or vnet) running pf is not the same as the machine (or vnet) running the server it's protecting. MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31141
2021-06-02 16:16:03 +00:00
syncookie \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
synproxy \
pf tests: Test tos/dscp matching MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29078
2021-03-03 20:15:39 +00:00
table \
pf tests: test that we validate sequence numbers on TCP RST MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate")
2023-11-29 12:51:39 +00:00
tcp \
pf tests: Test tos/dscp matching MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29078
2021-03-03 20:15:39 +00:00
tos
pf: Basic automated test using VIMAGE If VIMAGE is present we can start jails with their own pf instance. This makes it fairly easy to run tests. For example, this basic test verifies that drop/pass and icmp classification works. It's a basic sanity test for pf, and hopefully an example on how to write more pf tests. The tests are skipped if VIMAGE is not enabled. This work is inspired by the GSoC work of Panagiotes Mousikides. Differential Revision: https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00
pf: test rules evaluation in the face of multiple IPv6 fragment headers Send an ICMPv6 echo request packet with multiple IPv6 fragment headers. Set rules to pass all packets, except for ICMPv6 echo requests. pf ought to drop the echo request, but doesn't because it reassembles the packet, and then doesn't handle the second fragment header. In other words: it fails to detect the ICMPv6 echo header. Reported by: Enrico Bassetti bassetti@di.uniroma1.it (NetSecurityLab @ Sapienza University of Rome) MFC after: instant Sponsored by: Rubicon Communications, LLC ("Netgate")
2023-07-13 06:34:54 +00:00
ATF_TESTS_PYTEST+= frag6.py
pf tests: basic SCTP multihoming test The SCTP server will announce multiple addresses. Block one of them with pf, connect to the other have the client use the blocked address. pf is expected to have created state for all of the addresses announced by the server. In a separate test case add the secondary (client) IP after the connection has been established. The intent is to verify the functionality of the ASCONF chunk parsing. MFC after: 3 weeks Sponsored by: Orange Business Services Differential Revision: https://reviews.freebsd.org/D41638
2023-08-02 08:44:52 +00:00
ATF_TESTS_PYTEST+= sctp.py
pf: test rules evaluation in the face of multiple IPv6 fragment headers Send an ICMPv6 echo request packet with multiple IPv6 fragment headers. Set rules to pass all packets, except for ICMPv6 echo requests. pf ought to drop the echo request, but doesn't because it reassembles the packet, and then doesn't handle the second fragment header. In other words: it fails to detect the ICMPv6 echo header. Reported by: Enrico Bassetti bassetti@di.uniroma1.it (NetSecurityLab @ Sapienza University of Rome) MFC after: instant Sponsored by: Rubicon Communications, LLC ("Netgate")
2023-07-13 06:34:54 +00:00
pf tests: Serialize These tests reuse jail names and cannot run in parallel. Until this is fixed - which is desirable since these takes take a while to run - tell kyua to serialize them. MFC after: 1 week
2023-03-25 12:55:41 +00:00
# Tests reuse jail names and so cannot run in parallel.
TEST_METADATA+= is_exclusive=true
pf: fix pf divert-to loop Resolved conflict between ipfw and pf if both are used and pf wants to do divert(4) by having separate mtags for pf and ipfw. Also fix the incorrect 'rulenum' check, which caused the reported loop. While here add a few test cases to ensure that divert-to works as expected, even if ipfw is loaded. divert(4) PR: 272770 MFC after: 3 weeks Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D42142
2023-10-19 10:12:15 +00:00
PROGS= divapp
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
${PACKAGE}FILES+= CVE-2019-5597.py \
CVE-2019-5598.py \
pf tests: slightly more complect captive portal setup Combine anchor, dummynet and rdr to produce a more complex captive portal setup. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32484
2021-10-13 13:21:43 +00:00
daytime_inetd.conf \
pf tests: Basic synproxy test A very basic syncproxy test: set up a connection via a synproxy rule. This triggeres the panic fixed in r336273.
2018-07-14 21:32:32 +00:00
echo_inetd.conf \
pf tests: Test cases for fragment reassembly Obtained from: Alexander Bluhm, OpenBSD
2021-02-25 08:50:57 +00:00
fragcommon.py \
frag-overindex.py \
frag-overlimit.py \
frag-overreplace.py \
pf tests: more thorough pfsync defer test Add a somewhat more extensive pfsync defer mode test. Ensure that pfsync actually delays the state creating packet until after it has sent the pfsync update and given the peer time to create the state. Ideally the test should validate the pfsync state update and generate an ack message, but to keep the test simple we rely on the timeout of the deferred packet instead. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D33245
2021-12-02 17:47:40 +00:00
pfsync_defer.py \
pf tests: test short packets Test sending very short packets (i.e. too short for an IP header) packets in the Ethernet filtering code. Sponsored by: Rubicon Communications, LLC ("Netgate")
2022-06-23 15:52:52 +00:00
pft_ether.py \
pf tests: pflow functionality test Test that we actually send netflow messages when configured to do so. We do not yet inspect the generated netflow messages. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D43111
2023-12-04 15:11:35 +00:00
pft_read_ipfix.py \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
utils.subr
pf: Very basic forwarding test This test illustrates the use of scapy to test pf. Differential Revision: https://reviews.freebsd.org/D12581
2017-10-06 20:51:32 +00:00
pf tests: Test CVE-2019-5597 Generate a fragmented packet with different header chains, to provoke the incorrect behaviour of pf. Without the fix this will trigger a panic. Obtained from: Corentin Bayet, Nicolas Collignon, Luca Moro at Synacktiv
2019-03-01 07:39:55 +00:00
${PACKAGE}FILESMODE_CVE-2019-5597.py= 0555
pf tests: Test CVE-2019-5598 Verify that pf correctly drops inconsistent ICMP packets (i.e. where the IP src/dst do not match the IP src/dst in the ICMP packet.
2019-03-22 07:39:28 +00:00
${PACKAGE}FILESMODE_CVE-2019-5598.py= 0555
pf tests: Test cases for fragment reassembly Obtained from: Alexander Bluhm, OpenBSD
2021-02-25 08:50:57 +00:00
${PACKAGE}FILESMODE_fragcommon.py= 0555
${PACKAGE}FILESMODE_frag-overindex.py= 0555
${PACKAGE}FILESMODE_frag-overlimit.py= 0555
${PACKAGE}FILESMODE_frag-overreplace.py= 0555
pf tests: more thorough pfsync defer test Add a somewhat more extensive pfsync defer mode test. Ensure that pfsync actually delays the state creating packet until after it has sent the pfsync update and given the peer time to create the state. Ideally the test should validate the pfsync state update and generate an ack message, but to keep the test simple we rely on the timeout of the deferred packet instead. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D33245
2021-12-02 17:47:40 +00:00
${PACKAGE}FILESMODE_pfsync_defer.py= 0555
pf tests: test short packets Test sending very short packets (i.e. too short for an IP header) packets in the Ethernet filtering code. Sponsored by: Rubicon Communications, LLC ("Netgate")
2022-06-23 15:52:52 +00:00
${PACKAGE}FILESMODE_pft_ether.py= 0555
pf tests: pflow functionality test Test that we actually send netflow messages when configured to do so. We do not yet inspect the generated netflow messages. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D43111
2023-12-04 15:11:35 +00:00
${PACKAGE}FILESMODE_pft_read_ipfix.py= 0555
pf: Basic automated test using VIMAGE If VIMAGE is present we can start jails with their own pf instance. This makes it fairly easy to run tests. For example, this basic test verifies that drop/pass and icmp classification works. It's a basic sanity test for pf, and hopefully an example on how to write more pf tests. The tests are skipped if VIMAGE is not enabled. This work is inspired by the GSoC work of Panagiotes Mousikides. Differential Revision: https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00
.include <bsd.test.mk>
Reference in a new issue Copy permalink