system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-09 12:46:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

pf tests: add a test for killing states by NAT address

Browse Source 
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D42313
This commit is contained in:
Kristof Provost 2023-10-19 15:00:43 +02:00
parent 4f33755051
commit 501b7fbd75
1 changed files with 74 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
tests/sys/netpfil/pf/killstate.sh
View File

@ -30,7 +30,10 @@ common_dir=$(atf_get_srcdir)/../common
find_state()
{
jexec alcatraz pfctl -ss | grep icmp | grep 192.0.2.2
jail=${1:-alcatraz}
ip=${2:-192.0.2.2}
jexec ${jail} pfctl -ss | grep icmp | grep ${ip}
}
find_state_v6()
@ -571,6 +574,75 @@ id_cleanup()
pft_cleanup
}
atf_test_case "nat" "cleanup"
nat_head()
{
atf_set descr 'Test killing states by their NAT-ed IP address'
atf_set require.user root
atf_set require.progs scapy
}
nat_body()
{
pft_init
j="killstate:nat"
epair_c=$(vnet_mkepair)
epair_srv=$(vnet_mkepair)
vnet_mkjail ${j}c ${epair_c}a
ifconfig -j ${j}c ${epair_c}a inet 192.0.2.2/24 up
jexec ${j}c route add default 192.0.2.1
vnet_mkjail ${j}srv ${epair_srv}a
ifconfig -j ${j}srv ${epair_srv}a inet 198.51.100.2/24 up
vnet_mkjail ${j}r ${epair_c}b ${epair_srv}b
ifconfig -j ${j}r ${epair_c}b inet 192.0.2.1/24 up
ifconfig -j ${j}r ${epair_srv}b inet 198.51.100.1/24 up
jexec ${j}r sysctl net.inet.ip.forwarding=1
jexec ${j}r pfctl -e
pft_set_rules ${j}r \
"nat on ${epair_srv}b inet from 192.0.2.0/24 to any -> (${epair_srv}b)"
# Sanity check
atf_check -s exit:0 -o ignore \
jexec ${j}c ping -c 1 192.0.2.1
atf_check -s exit:0 -o ignore \
jexec ${j}srv ping -c 1 198.51.100.1
atf_check -s exit:0 -o ignore \
jexec ${j}c ping -c 1 198.51.100.2
# Establish state
# Note: use pft_ping so we always use the same ID, so pf considers all
# echo requests part of the same flow.
atf_check -s exit:0 -o ignore jexec ${j}c ${common_dir}/pft_ping.py \
--sendif ${epair_c}a \
--to 198.51.100.1 \
--replyif ${epair_c}a
# There's NAT here, so the source IP will be 198.51.100.1
if ! find_state ${j}r 198.51.100.1;
then
atf_fail "Expected state not found"
fi
# By NAT-ed address?
jexec ${j}r pfctl -k nat -k 192.0.2.2
if find_state ${j}r 198.51.100.1;
then
jexec ${j}r pfctl -ss -v
atf_fail "Failed to remove state"
fi
}
nat_cleanup()
{
pft_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "v4"
@ -581,4 +653,5 @@ atf_init_test_cases()
atf_add_test_case "match"
atf_add_test_case "interface"
atf_add_test_case "id"
atf_add_test_case "nat"
}