From nobody Wed Mar 02 16:00:50 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 90BDE19E0A4C; Wed, 2 Mar 2022 16:00:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4K7zNy5P7lz3NVm; Wed, 2 Mar 2022 16:00:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646236851; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+UP02IJRZ2NjtagBxjG7Gla9t9T4Xbb04TTzZatSOiU=; b=Vx5hVk+5x25XN7MviupslR/VyCGDBJQYU6jM0s/93V6wxh5HUahS3oCaIwY8Tk3ijfjVDc 159VVcTw+Q5Ovr+bNzPgiZq8IUdsrQf2YUPYUXL6uxAMNvFAoWJNwwF3dMw/ycHyt7KPPT 1g6CrWdgN7vyLZeYssCoBbucgYxpldhMkm4JZ1s0WlkSpJpmCbIwlJ0zEGXsgzAKxfaSpa gSaj8uotuXJ/ZVjTBUaDi11ZOOmRh/xLM/tc6KBV7x2ErLZBM8T7aAGZKtP1gpglyUte0C +Nsyus1cCyMclZ22djlcjQaqYa4mggt2aZxhFk2+gfj7q5lhTcJXT75T0I+6ww== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 68591261CD; Wed, 2 Mar 2022 16:00:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 222G0oXc091156; Wed, 2 Mar 2022 16:00:50 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 222G0om7091155; Wed, 2 Mar 2022 16:00:50 GMT (envelope-from git) Date: Wed, 2 Mar 2022 16:00:50 GMT Message-Id: <202203021600.222G0om7091155@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 792d7a56308b - main - pf tests: Basic captive portal like test List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 792d7a56308bb3a54f852f096f4cdde3f46f103c Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646236851; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+UP02IJRZ2NjtagBxjG7Gla9t9T4Xbb04TTzZatSOiU=; b=Un4uZ3EnXmwt3ka2YMHNdgmIvGgqN4hU9BO2dbvmfSYuHX0lDtdcD4jH1Yu4hTH1o66/ng XfbED0RNFFE2eXgYelAa0ajUNDfveyRE16nq3qG+ruJ3MqKSgOMcDonSTXZp9SrB4Mz4oi y4/HNTFetugFCIqVXNcn9NwhGoMaRYrCYb+OOkJejK5h7qHtEW88KWfLHjeWw6H+Y9j8m0 HapI5znlmn0iV08mJH3qVb+FF5j0Uzk+FrdWe1fRp97/LbPcDenKDn8iTWtQDcMcYwh+Wp WmX2OkjLjYJVqn70W87EaRvWLzayLQIHUM2Tel/qj2UbIIZnLApSDYyjK+6n6A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1646236851; a=rsa-sha256; cv=none; b=DOUPMsutkUjvpAIUqyv2FPi6ebUhOYcZE0DroXEqY73i9iwhr0xwnww71I1DPxYXrsxKsj ILmK7dDTibqwWWnK4ULbNcbiQ3+qjZToMFU/d7m9KBpwwybt0LI6O9swxch3AKxiYk6ldC /D4uArEZly2KsNvZz+KzBkMlCHzpOMi6E23pHklIk+lv1XcBomMPGg5ljkGS5rbH35y9/u BcF+5zlRv4oleIEQpGv/URel2LCqoHNoFssrLh5jkpvHSg6fSpX3tgV4y3QEAace9YQxk4 4+YzUo3polRTjolSl7E5RW+baTghPpEmwWWPxZAU4JrUMkRYLNep8uphYmXjNQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=792d7a56308bb3a54f852f096f4cdde3f46f103c commit 792d7a56308bb3a54f852f096f4cdde3f46f103c Author: Kristof Provost AuthorDate: 2021-02-12 16:01:29 +0000 Commit: Kristof Provost CommitDate: 2022-03-02 16:00:05 +0000 pf tests: Basic captive portal like test Use the ether rules to selectively (i.e. per MAC address) redirect certain connections. Test that tags carry over to the layer-3 pf code. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31746 --- tests/sys/netpfil/pf/ether.sh | 75 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/tests/sys/netpfil/pf/ether.sh b/tests/sys/netpfil/pf/ether.sh index 273c5654afa5..9178a0845773 100644 --- a/tests/sys/netpfil/pf/ether.sh +++ b/tests/sys/netpfil/pf/ether.sh @@ -133,8 +133,83 @@ proto_cleanup() pft_cleanup } +atf_test_case "captive" "cleanup" +captive_head() +{ + atf_set descr 'Test a basic captive portal-like setup' + atf_set require.user root +} + +captive_body() +{ + # Host is client, jail 'gw' is the captive portal gateway, jail 'srv' + # is a random (web)server. We use the echo protocol rather than http + # for the test, because that's easier. + pft_init + + epair_gw=$(vnet_mkepair) + epair_srv=$(vnet_mkepair) + epair_gw_a_mac=$(ifconfig ${epair_gw}a ether | awk '/ether/ { print $2; }') + + vnet_mkjail gw ${epair_gw}b ${epair_srv}a + vnet_mkjail srv ${epair_srv}b + + ifconfig ${epair_gw}a 192.0.2.2/24 up + route add -net 198.51.100.0/24 192.0.2.1 + jexec gw ifconfig ${epair_gw}b 192.0.2.1/24 up + jexec gw ifconfig lo0 127.0.0.1/8 up + jexec gw sysctl net.inet.ip.forwarding=1 + + jexec gw ifconfig ${epair_srv}a 198.51.100.1/24 up + jexec srv ifconfig ${epair_srv}b 198.51.100.2/24 up + jexec srv route add -net 192.0.2.0/24 198.51.100.1 + + # Sanity check + atf_check -s exit:0 -o ignore ping -c 1 -t 1 198.51.100.2 + + pft_set_rules gw \ + "ether pass quick proto 0x0806" \ + "ether pass tag captive" \ + "rdr on ${epair_gw}b proto tcp to port echo tagged captive -> 127.0.0.1 port echo" + jexec gw pfctl -e + + # ICMP should still work, because we don't redirect it. + atf_check -s exit:0 -o ignore ping -c 1 -t 1 198.51.100.2 + + # Run the echo server only on the gw, so we know we've redirectly + # correctly if we get an echo message. + jexec gw /usr/sbin/inetd $(atf_get_srcdir)/echo_inetd.conf + + # Confirm that we're getting redirected + atf_check -s exit:0 -o match:"^foo$" -x "echo foo | nc -N 198.51.100.2 7" + + jexec gw killall inetd + + # Now pretend we've authenticated, so add the client's MAC address + pft_set_rules gw \ + "ether pass quick proto 0x0806" \ + "ether pass quick from ${epair_gw_a_mac}" \ + "ether pass tag captive" \ + "rdr on ${epair_gw}b proto tcp to port echo tagged captive -> 127.0.0.1 port echo" + + # No redirect, so failure. + atf_check -s exit:1 -x "echo foo | nc -N 198.51.100.2 7" + + # Start a server in srv + jexec srv /usr/sbin/inetd $(atf_get_srcdir)/echo_inetd.conf + + # And now we can talk to that one. + atf_check -s exit:0 -o match:"^foo$" -x "echo foo | nc -N 198.51.100.2 7" +} + +captive_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "mac" atf_add_test_case "proto" + atf_add_test_case "captive" }