git: b1b8f5a15fc0 - stable/13 - pf tests: verify syncookie status report

The branch stable/13 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=b1b8f5a15fc0fde1aea5eea5d1ecb7cfbee89d19

commit b1b8f5a15fc0fde1aea5eea5d1ecb7cfbee89d19
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2022-10-31 11:15:58 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2023-08-28 08:17:18 +0000

    pf tests: verify syncookie status report
    
    Verify that pfctl -si -v correctly shows syncookies to be
    active/inactive.
    
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    
    (cherry picked from commit b0bf4303109a76eb4224015b9abebf88e96116ef)
---
 tests/sys/netpfil/pf/syncookie.sh | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tests/sys/netpfil/pf/syncookie.sh b/tests/sys/netpfil/pf/syncookie.sh
index eb9f8c737476..290b61817471 100644
--- a/tests/sys/netpfil/pf/syncookie.sh
+++ b/tests/sys/netpfil/pf/syncookie.sh
@@ -28,6 +28,14 @@
 
 common_dir=$(atf_get_srcdir)/../common
 
+syncookie_state()
+{
+	jail=$1
+
+	jexec $jail pfctl -si -v | grep -A 2 '^Syncookies' | grep active \
+	    | awk '{ print($2); }'
+}
+
 atf_test_case "basic" "cleanup"
 basic_head()
 {
@@ -62,6 +70,14 @@ basic_body()
 	then
 		atf_fail "Failed to connect to syncookie protected echo daemon"
 	fi
+
+
+	# Check that status shows syncookies as being active
+	active=$(syncookie_state alcatraz)
+	if [ "$active" != "active" ];
+	then
+		atf_fail "syncookies not active"
+	fi
 }
 
 basic_cleanup()
@@ -195,12 +211,26 @@ adaptive_body()
 	# Sanity check
 	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1
 
+	# Check that status shows syncookies as being inactive
+	active=$(syncookie_state alcatraz)
+	if [ "$active" != "inactive" ];
+	then
+		atf_fail "syncookies active when they should not be"
+	fi
+
 	# Now syn flood to create many states
 	${common_dir}/pft_synflood.py \
 		--sendif ${epair}a \
 		--to 192.0.2.2 \
 		--count 100
 
+	# Check that status shows syncookies as being active
+	active=$(syncookie_state alcatraz)
+	if [ "$active" != "active" ];
+	then
+		atf_fail "syncookies not active"
+	fi
+
 	# Adaptive mode should kick in and stop us from creating more than
 	# about 10 states
 	states=$(jexec alcatraz pfctl -ss | grep tcp | wc -l)