From nobody Tue Dec 17 10:07:56 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YCCDX6mqNz5h0t4; Tue, 17 Dec 2024 10:07:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YCCDX4b26z49l5; Tue, 17 Dec 2024 10:07:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1734430076; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KnqWwDlPnmePGMgHM6HfUZBzaS5ZG0yxnxDF31iGZZ4=; b=UeXLTeOunZcKEhjWqpSiiCGwJ8aDDnqNrYPcp4BHMWwmdPVrt1pdRIPLGnrA17D3EcBCoV SUCiJEIjhcXEPS/BKpmqJyp7lVQ1mN84uJFzJ8bBEGNxkkz5e0uEdRhqlQj20pmaDJMFKX hxZItgmIM8TdnyutITIT+0VRbc9oCJ4jUIFSZL1mRNL/dexjrBWenX/OCiBN1RDwSBkLl7 uInmyo3bO0/0GKy012+rC22YaSG0bGxNQxP+UlCKd4fgFtk1jjV0Dw+9olues2oGGijuA2 LfwpDNGC4M+PpU/oUsKhdJefcP1bfIcBSMqr/46gu0FnJ2RCxGBQWSV0xGJ1Ww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1734430076; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KnqWwDlPnmePGMgHM6HfUZBzaS5ZG0yxnxDF31iGZZ4=; b=WnM055famU2VnZrnBoGz3EUOl7+ctmBmu/zBfGqg8AeM8yabsBavidRHelFF3vKAvVsvSu HYGSIlXSZuc/DSwPnApTIQ6+8g6DBKWQ8C91P/yRppPgOen6qRNkNowO+RXRl2eotP+aH2 8OFY023yy342/Nm0LCb3dtqWiFwj7bAGDgJ4tB1oyaljdgNUuho1iyf1kYzyOrDvJQEFy7 TTvI2IAuG8zv+EzDhVjz392fSN5CUX7GGlAi/z1GMMV+NGbnpRZ1mjybsvm0tNRKrt2HKV +YBq8VNo3LYEhRsQWzrHHLY60293znlNzH2E2dh5otom0jpw8snGv52HB61EEQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1734430076; a=rsa-sha256; cv=none; b=HDgrg2Zqaz2skEA5E0n08CBSnqxGFpSIoxhefN2ITF3RiaBTW2zJq/xsuxamxdbc8ooBVN F7vJkASI64BWbbiUSqWpCSZO2vN3YhZ4OtGRd0w8za9HBiyd0s88ZQU92TO7H195WbbC5t k/J+b4CxLQgdDb+/XTvdR+BOBuWgWUXFFEbo/sNo6dLRA/LYNgz9kcLoWN/4oiigfpCcOp Z8q0F25NgixoRJo8/dft4FoeCxYT0McNQbQIzBBtIJ3FaXAVlEyjePK18rQMytsNnKHorB MI6bqcviHh1mlOtyVNp+QH0L4CyEEpD7W+tpJhrGtXanM9gIW047zZkFuxEnLw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YCCDX496lzJS1; Tue, 17 Dec 2024 10:07:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4BHA7u5l024045; Tue, 17 Dec 2024 10:07:56 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4BHA7u4d024042; Tue, 17 Dec 2024 10:07:56 GMT (envelope-from git) Date: Tue, 17 Dec 2024 10:07:56 GMT Message-Id: <202412171007.4BHA7u4d024042@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: a4e040329525 - main - pf tests: verify that TCP RST makes it through NAT64 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: a4e0403295254fd72e8e867aceb03805fa7957af Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=a4e0403295254fd72e8e867aceb03805fa7957af commit a4e0403295254fd72e8e867aceb03805fa7957af Author: Kristof Provost AuthorDate: 2024-11-08 14:45:57 +0000 Commit: Kristof Provost CommitDate: 2024-12-17 10:07:15 +0000 pf tests: verify that TCP RST makes it through NAT64 Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D47796 --- tests/sys/netpfil/pf/Makefile | 1 + tests/sys/netpfil/pf/nat64.py | 84 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+) diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile index ec36e93dc634..2edd8e7d2026 100644 --- a/tests/sys/netpfil/pf/Makefile +++ b/tests/sys/netpfil/pf/Makefile @@ -55,6 +55,7 @@ ATF_TESTS_SH+= altq \ ATF_TESTS_PYTEST+= frag6.py ATF_TESTS_PYTEST+= icmp.py +ATF_TESTS_PYTEST+= nat64.py ATF_TESTS_PYTEST+= nat66.py ATF_TESTS_PYTEST+= sctp.py diff --git a/tests/sys/netpfil/pf/nat64.py b/tests/sys/netpfil/pf/nat64.py new file mode 100644 index 000000000000..0053a2401872 --- /dev/null +++ b/tests/sys/netpfil/pf/nat64.py @@ -0,0 +1,84 @@ +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2024 Rubicon Communications, LLC (Netgate) +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +import pytest +from atf_python.sys.net.tools import ToolsHelper +from atf_python.sys.net.vnet import VnetTestTemplate + +class TestNAT64(VnetTestTemplate): + REQUIRED_MODULES = [ "pf" ] + TOPOLOGY = { + "vnet1": {"ifaces": ["if1"]}, + "vnet2": {"ifaces": ["if1", "if2"]}, + "vnet3": {"ifaces": ["if2"]}, + "if1": {"prefixes6": [("2001:db8::2/64", "2001:db8::1/64")]}, + "if2": {"prefixes4": [("192.0.2.1/24", "192.0.2.2/24")]}, + } + + def vnet3_handler(self, vnet): + ToolsHelper.print_output("echo foo | nc -l 1234") + + def vnet2_handler(self, vnet): + ifname = vnet.iface_alias_map["if1"].name + + ToolsHelper.print_output("/sbin/pfctl -e") + ToolsHelper.pf_rules([ + "pass inet6 proto icmp6", + "pass in on %s inet6 af-to inet from 192.0.2.1" % ifname]) + + @pytest.mark.require_user("root") + def test_tcp_rst(self): + ToolsHelper.print_output("/sbin/route -6 add default 2001:db8::1") + + import scapy.all as sp + + # Send a SYN + packet = sp.IPv6(dst="64:ff9b::192.0.2.2") \ + / sp.TCP(dport=1222, flags="S") + + # Get a reply + reply = sp.sr1(packet) + + # We expect to get a RST here. + tcp = reply.getlayer(sp.TCP) + assert tcp + assert "R" in tcp.flags + + # Now try to SYN to an open port + packet = sp.IPv6(dst="64:ff9b::192.0.2.2") \ + / sp.TCP(dport=1234, flags="S") + reply = sp.sr1(packet) + + tcp = reply.getlayer(sp.TCP) + assert tcp + + # We don't get RST + assert "R" not in tcp.flags + + # We do get SYN|ACK + assert "S" in tcp.flags + assert "A" in tcp.flags +