system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-04 23:50:27 +00:00
Code Issues Packages Projects Releases Wiki Activity
freebsd-src/tests/sys/netpfil/pf/Makefile

55 lines
961 B
Makefile
Raw Normal View History

pf: Basic automated test using VIMAGE If VIMAGE is present we can start jails with their own pf instance. This makes it fairly easy to run tests. For example, this basic test verifies that drop/pass and icmp classification works. It's a basic sanity test for pf, and hopefully an example on how to write more pf tests. The tests are skipped if VIMAGE is not enabled. This work is inspired by the GSoC work of Panagiotes Mousikides. Differential Revision: https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00
# $FreeBSD$
PACKAGE= tests
TESTSDIR= ${TESTSBASE}/sys/netpfil/pf
pf tests: Basic ioctl validation tests Validate the DIOCRADDTABLES and DIOCRDELTABLES ioctls with invalid size values. All of these requests should fail. MFC after: 1 week
2018-04-06 15:03:48 +00:00
TESTS_SUBDIRS+= ioctl
pf: Basic automated test using VIMAGE If VIMAGE is present we can start jails with their own pf instance. This makes it fairly easy to run tests. For example, this basic test verifies that drop/pass and icmp classification works. It's a basic sanity test for pf, and hopefully an example on how to write more pf tests. The tests are skipped if VIMAGE is not enabled. This work is inspired by the GSoC work of Panagiotes Mousikides. Differential Revision: https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00
altq tests: Basic ALTQ test Activate ALTQ_HFSC, crudely check if it really limits bandwidth as we'd expect. Reviewed by: donner@ Differential Revision: https://reviews.freebsd.org/D28303
2021-01-23 09:37:03 +00:00
ATF_TESTS_SH+= altq \
anchor \
pf tests: Verify (tcp) checksum modification on unaligned options It turns out pf incorrectly updates the TCP checksum if the TCP option we're modifying is not 2-byte algined with respect to the start of the packet. Create a TCP packet with such an option and throw it through a scrub rule, which will update timestamps and modify the packet. PR: 240416 MFC after: 1 week Differential revision: https://reviews.freebsd.org/D27688
2020-12-19 15:06:03 +00:00
checksum \
pf tests: Test that dup-to doesn't produce extra duplicate packets
2021-01-28 10:02:20 +00:00
dup \
pf: test set-tos Introduce tests for the set-tos feature of pf. Teach pft_ping.py to send and verify ToS flags.
2017-10-16 15:01:49 +00:00
forward \
pf tests: Fragmentation (v6) test Test fragmentation handling (i.e. scrub fragment reassemble) code for IPv6. Two simple tests: Ping a host (jail) and test forwarding of fragmented packets.
2017-10-26 20:54:52 +00:00
fragmentation \
pf tests: Stress state retrieval Create and retrieve 20.000 states. There have been issues with nvlists causing very slow state retrieval. We don't impose a specific limit on the time required to retrieve the states, but do log it. In excessive cases the Kyua timeout will fail this test. Reviewed by: donner MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30943
2021-06-28 10:48:20 +00:00
get_state \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
icmp \
pf tests: Test cases for the 'kill state(s)' feature MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29796
2021-04-16 15:33:17 +00:00
killstate \
pf tests: ensure that $nr expansion is correct Test the $nr expansion in labels is correct, even if the optimiser reduces the rule count. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D32489
2021-10-03 16:07:04 +00:00
macro \
pf: Implement the NAT source port selection of MAP-E Customer Edge MAP-E (RFC 7597) requires special care for selecting source ports in NAT operation on the Customer Edge because a part of bits of the port numbers are used by the Border Relay to distinguish another side of the IPv4-over-IPv6 tunnel. PR: 254577 Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D29468
2021-04-13 08:50:00 +00:00
map_e \
pf tests: Test name handling Provoke a situation where two interfaces have the same name, and verify pf's reaction to this.
2018-12-01 09:59:32 +00:00
names \
pf tests: NAT exhaustion test It's been reported that pf doesn't handle running out of available ports for NAT correctly. It freezes until a state expires and it can find a free port. Test for this, by setting up a situation where only two ports are available for NAT and then attempting to create three connections. If successful the third connection will fail immediately. In an incorrect case the connection attempt will freeze, also freezing all interaction with pf through pfctl and trigger timeout. PR: 233867 MFC after: 2 weeks
2018-12-12 20:19:18 +00:00
nat \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
pass_block \
pfsync \
pf tests: ftp-proxy test Basic test case for ftp-proxy PR: 256917 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate")
2021-07-01 15:15:36 +00:00
proxy \
pf tests: Basic rdr test MFC after: 2 weeks
2018-12-12 20:19:56 +00:00
rdr \
pf tests: basic test for ridentifier MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D32751
2021-10-29 15:52:59 +00:00
ridentifier \
pf tests: Basic synproxy test A very basic syncproxy test: set up a connection via a synproxy rule. This triggeres the panic fixed in r336273.
2018-07-14 21:32:32 +00:00
route_to \
pf tests: Test clearing rules counters This was briefly broken, so ensure that we can read and clear rules counters. MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29728
2021-04-12 15:29:19 +00:00
rules_counter \
pf tests: Basic pfsync test Set up two jails, configure pfsync between them and create state in one of them, verify that this state is copied to the other jail. MFC after: 2 weeks Sponsored by: Orange Business Services Differential Revision: https://reviews.freebsd.org/D17504
2018-11-02 16:59:55 +00:00
set_skip \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
set_tos \
src_track \
pf tests: Forwarding syncookie test Test syncookies on a forwarding host. That is, in a setup where the machine (or vnet) running pf is not the same as the machine (or vnet) running the server it's protecting. MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31141
2021-06-02 16:16:03 +00:00
syncookie \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
synproxy \
pf tests: Test tos/dscp matching MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29078
2021-03-03 20:15:39 +00:00
table \
tos
pf: Basic automated test using VIMAGE If VIMAGE is present we can start jails with their own pf instance. This makes it fairly easy to run tests. For example, this basic test verifies that drop/pass and icmp classification works. It's a basic sanity test for pf, and hopefully an example on how to write more pf tests. The tests are skipped if VIMAGE is not enabled. This work is inspired by the GSoC work of Panagiotes Mousikides. Differential Revision: https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
${PACKAGE}FILES+= CVE-2019-5597.py \
CVE-2019-5598.py \
pf tests: Basic synproxy test A very basic syncproxy test: set up a connection via a synproxy rule. This triggeres the panic fixed in r336273.
2018-07-14 21:32:32 +00:00
echo_inetd.conf \
pf tests: Test cases for fragment reassembly Obtained from: Alexander Bluhm, OpenBSD
2021-02-25 08:50:57 +00:00
fragcommon.py \
frag-overindex.py \
frag-overlimit.py \
frag-overreplace.py \
pf tests: more thorough pfsync defer test Add a somewhat more extensive pfsync defer mode test. Ensure that pfsync actually delays the state creating packet until after it has sent the pfsync update and given the peer time to create the state. Ideally the test should validate the pfsync state update and generate an ack message, but to keep the test simple we rely on the timeout of the deferred packet instead. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D33245
2021-12-02 17:47:40 +00:00
pfsync_defer.py \
pf tests: Sort Makefile entries MFC after: 1 week
2020-12-19 14:27:33 +00:00
utils.subr
pf: Very basic forwarding test This test illustrates the use of scapy to test pf. Differential Revision: https://reviews.freebsd.org/D12581
2017-10-06 20:51:32 +00:00
pf tests: Test CVE-2019-5597 Generate a fragmented packet with different header chains, to provoke the incorrect behaviour of pf. Without the fix this will trigger a panic. Obtained from: Corentin Bayet, Nicolas Collignon, Luca Moro at Synacktiv
2019-03-01 07:39:55 +00:00
${PACKAGE}FILESMODE_CVE-2019-5597.py= 0555
pf tests: Test CVE-2019-5598 Verify that pf correctly drops inconsistent ICMP packets (i.e. where the IP src/dst do not match the IP src/dst in the ICMP packet.
2019-03-22 07:39:28 +00:00
${PACKAGE}FILESMODE_CVE-2019-5598.py= 0555
pf tests: Test cases for fragment reassembly Obtained from: Alexander Bluhm, OpenBSD
2021-02-25 08:50:57 +00:00
${PACKAGE}FILESMODE_fragcommon.py= 0555
${PACKAGE}FILESMODE_frag-overindex.py= 0555
${PACKAGE}FILESMODE_frag-overlimit.py= 0555
${PACKAGE}FILESMODE_frag-overreplace.py= 0555
pf tests: more thorough pfsync defer test Add a somewhat more extensive pfsync defer mode test. Ensure that pfsync actually delays the state creating packet until after it has sent the pfsync update and given the peer time to create the state. Ideally the test should validate the pfsync state update and generate an ack message, but to keep the test simple we rely on the timeout of the deferred packet instead. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D33245
2021-12-02 17:47:40 +00:00
${PACKAGE}FILESMODE_pfsync_defer.py= 0555
pf: Basic automated test using VIMAGE If VIMAGE is present we can start jails with their own pf instance. This makes it fairly easy to run tests. For example, this basic test verifies that drop/pass and icmp classification works. It's a basic sanity test for pf, and hopefully an example on how to write more pf tests. The tests are skipped if VIMAGE is not enabled. This work is inspired by the GSoC work of Panagiotes Mousikides. Differential Revision: https://reviews.freebsd.org/D12580
2017-10-06 20:43:14 +00:00
.include <bsd.test.mk>
Reference in a new issue Copy permalink