From nobody Mon Oct 23 16:41:47 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SDgvH4pxvz4yFs3; Mon, 23 Oct 2023 16:41:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4SDgvH43pRz4T5W; Mon, 23 Oct 2023 16:41:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1698079307; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tuZRTEKdZF4aoUlcuU+t40TUFpenidZrzkhjZncuV+o=; b=J7rQBZmLzoiNcNx/HfEHh2c75DYEoYP6pQ2i/GGsyOZZdx+EqA+eeNVTy//RGCbHAhCMlX L1bS7Nk9MLbPqE8jc0DiHvnPjMAuKwJ5ShthampctOENTKHoJMDdSbkGF2+pvwCqSxUcte zfBC+qD2cKnJ/upPOhAoKRyx+dIpD3p0X1JEzXgTpg+lqtK1XTQaJgCIDDIk/UBa+csGjV /5olyzQtDuf08zFWjVc986Jh6D+MCUUR82UoGbP+D5+AuDI5bzRMA4EdHnvew++XZzCAp1 55TuHMOmRiTzhTxis2Qjmwr1RfL7jahqPVrmrpiWMVPDtB/jfEq/IbG1kU3Srw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1698079307; a=rsa-sha256; cv=none; b=kJWn4+s9+XmG6ro/rVrGoZ/rzCy68i67t4A1aONV9fQuTb1h8n/UKLY0rNZJvW2JgLgbtY L/JPjc7euDyPS51daa6Tq4stZiPbQeV29/+TKvWxMxKIJMVc4RD3LNkDsukLXecVI8X6li m95YigYq6NSx71oLKkcPL5Hbh33PeTJffCI1c260xEyxj2blM+fNwh0PAW/aaUnhPkhxcs 1EiSoq0zEV7MoK62q0RZuL9B8gOB3aSLY/bVQxX8SR37XdVeiHL8+JvVu3T67G63xTZwpV prmyvm9oUhcoit9FxjL/1WTh4n9KzBsIlgtN4VpeezYWOgDRKAaCtgQMtUIxkQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1698079307; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tuZRTEKdZF4aoUlcuU+t40TUFpenidZrzkhjZncuV+o=; b=dO5vYLGkqXAFBs7ix4u17yiHrUYDB6OCdIFzJOeGa0lKOiFVxPe23EjofGo4Kw2t7WWNYy hS/eo+JlhZYLFsysxMibCXfvHG11ANzmze5l2T5kvB7jreqOfLSs94fh6wy81m4Fw0A7k6 Vbp2MM5w4UIoX4cFTer/yeltUDG5npQDXFiBa/7JxQKbWreSjBLRrKDma3CK5svGAKVtc0 z+VXL+WMuT/mdWuIqNrXrE1Fbe/gy0qXP78lYLbYMtf2hfISPvX3dme9TwaMt7oRhr69W/ dgRRs4molL4BCTsbChqOO0hjxOshhZfRhhvJlj6aSkOz4UQGvQGGk1OlmY0+cg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4SDgvH2thJznT7; Mon, 23 Oct 2023 16:41:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 39NGflXh093777; Mon, 23 Oct 2023 16:41:47 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 39NGflBq093774; Mon, 23 Oct 2023 16:41:47 GMT (envelope-from git) Date: Mon, 23 Oct 2023 16:41:47 GMT Message-Id: <202310231641.39NGflBq093774@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 501b7fbd75cb - main - pf tests: add a test for killing states by NAT address List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 501b7fbd75cbc321227930d38a52394194170f5b Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=501b7fbd75cbc321227930d38a52394194170f5b commit 501b7fbd75cbc321227930d38a52394194170f5b Author: Kristof Provost AuthorDate: 2023-10-19 13:00:43 +0000 Commit: Kristof Provost CommitDate: 2023-10-23 14:37:05 +0000 pf tests: add a test for killing states by NAT address Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D42313 --- tests/sys/netpfil/pf/killstate.sh | 75 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 74 insertions(+), 1 deletion(-) diff --git a/tests/sys/netpfil/pf/killstate.sh b/tests/sys/netpfil/pf/killstate.sh index 72f8d9d29fc2..046d640ed355 100644 --- a/tests/sys/netpfil/pf/killstate.sh +++ b/tests/sys/netpfil/pf/killstate.sh @@ -30,7 +30,10 @@ common_dir=$(atf_get_srcdir)/../common find_state() { - jexec alcatraz pfctl -ss | grep icmp | grep 192.0.2.2 + jail=${1:-alcatraz} + ip=${2:-192.0.2.2} + + jexec ${jail} pfctl -ss | grep icmp | grep ${ip} } find_state_v6() @@ -571,6 +574,75 @@ id_cleanup() pft_cleanup } +atf_test_case "nat" "cleanup" +nat_head() +{ + atf_set descr 'Test killing states by their NAT-ed IP address' + atf_set require.user root + atf_set require.progs scapy +} + +nat_body() +{ + pft_init + j="killstate:nat" + + epair_c=$(vnet_mkepair) + epair_srv=$(vnet_mkepair) + + vnet_mkjail ${j}c ${epair_c}a + ifconfig -j ${j}c ${epair_c}a inet 192.0.2.2/24 up + jexec ${j}c route add default 192.0.2.1 + + vnet_mkjail ${j}srv ${epair_srv}a + ifconfig -j ${j}srv ${epair_srv}a inet 198.51.100.2/24 up + + vnet_mkjail ${j}r ${epair_c}b ${epair_srv}b + ifconfig -j ${j}r ${epair_c}b inet 192.0.2.1/24 up + ifconfig -j ${j}r ${epair_srv}b inet 198.51.100.1/24 up + jexec ${j}r sysctl net.inet.ip.forwarding=1 + + jexec ${j}r pfctl -e + pft_set_rules ${j}r \ + "nat on ${epair_srv}b inet from 192.0.2.0/24 to any -> (${epair_srv}b)" + + # Sanity check + atf_check -s exit:0 -o ignore \ + jexec ${j}c ping -c 1 192.0.2.1 + atf_check -s exit:0 -o ignore \ + jexec ${j}srv ping -c 1 198.51.100.1 + atf_check -s exit:0 -o ignore \ + jexec ${j}c ping -c 1 198.51.100.2 + + # Establish state + # Note: use pft_ping so we always use the same ID, so pf considers all + # echo requests part of the same flow. + atf_check -s exit:0 -o ignore jexec ${j}c ${common_dir}/pft_ping.py \ + --sendif ${epair_c}a \ + --to 198.51.100.1 \ + --replyif ${epair_c}a + + # There's NAT here, so the source IP will be 198.51.100.1 + if ! find_state ${j}r 198.51.100.1; + then + atf_fail "Expected state not found" + fi + + # By NAT-ed address? + jexec ${j}r pfctl -k nat -k 192.0.2.2 + + if find_state ${j}r 198.51.100.1; + then + jexec ${j}r pfctl -ss -v + atf_fail "Failed to remove state" + fi +} + +nat_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "v4" @@ -581,4 +653,5 @@ atf_init_test_cases() atf_add_test_case "match" atf_add_test_case "interface" atf_add_test_case "id" + atf_add_test_case "nat" }