system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-22 02:37:15 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

pf tests: test that reassembly is or is not performed as expected

Browse source 
We can now tell scrub rules to not reassemble packets. Test that this
affects packets being passed or dropped as expected.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2022-11-24 10:25:40 +01:00
parent 88e858e57c
commit 7a6bcfb44d
1 changed files with 59 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
tests/sys/netpfil/pf/fragmentation.sh
View file

@ -269,6 +269,64 @@ overlimit_cleanup()
pft_cleanup
}
atf_test_case "reassemble" "cleanup"
reassemble_head()
{
atf_set descr 'Test reassembly'
atf_set require.user root
}
reassemble_body()
{
pft_init
epair=$(vnet_mkepair)
vnet_mkjail alcatraz ${epair}a
ifconfig ${epair}b inet 192.0.2.1/24 up
jexec alcatraz ifconfig ${epair}a 192.0.2.2/24 up
# Sanity check
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
jexec alcatraz pfctl -e
pft_set_rules alcatraz \
"pass out" \
"block in" \
"pass in inet proto icmp all icmp-type echoreq"
# Single fragment passes
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
# But a fragmented ping does not
atf_check -s exit:2 -o ignore ping -c 1 -s 2000 192.0.2.2
pft_set_rules alcatraz \
"scrub in" \
"pass out" \
"block in" \
"pass in inet proto icmp all icmp-type echoreq"
# Both single packet & fragmented pass when we scrub
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
atf_check -s exit:0 -o ignore ping -c 1 -s 2000 192.0.2.2
pft_set_rules alcatraz \
"scrub in fragment no reassemble" \
"pass out" \
"block in" \
"pass in inet proto icmp all icmp-type echoreq"
# And the fragmented ping doesn't pass if we do not reassemble
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
atf_check -s exit:2 -o ignore ping -c 1 -s 2000 192.0.2.2
}
reassemble_cleanup()
{
pft_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "too_many_fragments"
@ -277,4 +335,5 @@ atf_init_test_cases()
atf_add_test_case "overreplace"
atf_add_test_case "overindex"
atf_add_test_case "overlimit"
atf_add_test_case "reassemble"
}