system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-09-06 17:18:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

pf tests: test per-rule pflow

Browse source 
Test that we can enable pflow on a per-rule basis.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2024-01-11 14:54:09 +01:00
parent c4d97a9487
commit d086b9f77c
1 changed files with 49 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
tests/sys/netpfil/pf/pflow.sh
View file

@ -234,10 +234,59 @@ nat_cleanup()
pft_cleanup
}
atf_test_case "rule" "cleanup"
rule_head()
{
atf_set descr 'Test per-rule pflow option'
atf_set require.user root
atf_set require.progs scapy
}
rule_body()
{
pflow_init
epair=$(vnet_mkepair)
ifconfig ${epair}a 192.0.2.2/24 up
ifconfig ${epair}a alias 192.0.2.3/24 up
vnet_mkjail alcatraz ${epair}b
jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up
# Sanity check
atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1
jexec alcatraz pfctl -e
pft_set_rules alcatraz \
"pass in from 192.0.2.2 keep state (pflow)" \
"pass in from 192.0.2.3 keep state"
pflow=$(jexec alcatraz pflowctl -c)
jexec alcatraz pflowctl -s ${pflow} dst 192.0.2.2:2055
# No flow is generated if we ping from 192.0.2.3
ping -c 1 -S 192.0.2.3 192.0.2.1
atf_check -o match:"No data" \
$(atf_get_srcdir)/pft_read_ipfix.py --recvif ${epair}a --port 2055
# But there is one if we ping from 192.0.2.2
ping -c 1 -S 192.0.2.2 192.0.2.1
atf_check -o match:".*v=5.*" \
$(atf_get_srcdir)/pft_read_ipfix.py --recvif ${epair}a --port 2055
}
rule_cleanup()
{
pft_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "basic"
atf_add_test_case "state_defaults"
atf_add_test_case "v6"
atf_add_test_case "nat"
atf_add_test_case "rule"
}