From nobody Thu Oct 17 14:04:23 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XTqMW5GLsz5Z2r6; Thu, 17 Oct 2024 14:04:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XTqMW4chLz4q9s; Thu, 17 Oct 2024 14:04:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1729173863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6Vx+rW3PDzRvpxO6zKPpD7xNj5tXhcxAEE0urk75eCU=; b=Z5MZaPUZicnLx+UwNRMpYAVozJFFUFlRbh/ksRVz7kBlV6/EY9ESbrPm7cRLRlIG7K0yq4 ddCOHjXCw6dMIH8sd01ZuaVobcoy7prDRmOx2bUl6fN4cJyxAYjMdxLf3OU0EImjqx3zRl FIoJ6MeiFg9VBdgppKU8EGgScos/aaZUuAs5FP/UKOoEKgHIJnnNDh5Vx2kIgHwrPzYahU JkOCO72oVW3U3B3fj2L3Y1vNJnLGsvX0CpmKs5a/q1kc9kLRPnQPoYRItxg+aZjqsA2wZ0 JLvpZo5B//vlS4th9Si01ncboDiURA9G6JXEqnJM+Tl55duOF0fKWvNIJ0JFRQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1729173863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6Vx+rW3PDzRvpxO6zKPpD7xNj5tXhcxAEE0urk75eCU=; b=WafFbkWGMgVwkEtOgtPaO0DeW665o/K8BUjpTNhhQbBrgO6oEwWPOvKSvcAPrZHcRxcLHC 0PG7vYyP05SRY7bxIF8iTUsSp4O8jn1AjRvsmDdFNnJ0UZsd7H1KPzClr+aayKod22U3yx w+MClLfJKCR2/E5bGajt5uEPnBUzsGjgiKZ5UmNW1zqUrkW/6nPSvXEtWnsvdTT/eI5EL+ BqlM0pn11QLeSAXNyub73LFioaARYNHnG6UzS8nDhrES21HrTzCNg2Y6H6hk383pXD+TBO 7mH2UfloEdXPBgaE5q8Z8//myMGQeajPdD5kwgJ5CW8Bo1NUfCMIgAPDq/xIHQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1729173863; a=rsa-sha256; cv=none; b=C4xI8n7fh9GvAQHAejUvrbA3P5LZ9PwvlQ+l0Q1axpKZXeUBTXc4Cc1dYKXpMle3Bt/FWv 7+kpHv82KNXxhFJnNel7uhjtJijYOy02Pry/Xv4wAiqd5tFDOw49N7ny80KYYhpb67HFv7 EInt+TIMmWSilN4b2YFNfHZQlmv0fHiqkcoYqYQXBK7+fsF5mVOS6FmlYRqlPMpZrIT/as vs8ceQDPrhjqPXjStJJg0fMFuxYQI+ancgc1iNIJ0lIU8++P8DGBxiM70rItkFf9feM2X2 3YxGSUSAYE98SvwLVxcY9KlBioBqGg88Ydzs1+0M+eoSbe44NV5L1J+W7Lp8Tw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XTqMW48WLzsp1; Thu, 17 Oct 2024 14:04:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 49HE4N9a079576; Thu, 17 Oct 2024 14:04:23 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 49HE4NfZ079573; Thu, 17 Oct 2024 14:04:23 GMT (envelope-from git) Date: Thu, 17 Oct 2024 14:04:23 GMT Message-Id: <202410171404.49HE4NfZ079573@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Igor Ostapenko Subject: git: cc7ec8fe3bca - main - ipfw tests: Add basic coverage of divert(4) use cases List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: igoro X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: cc7ec8fe3bca7dbf643639b02d81a0b7f3c92198 Auto-Submitted: auto-generated The branch main has been updated by igoro: URL: https://cgit.FreeBSD.org/src/commit/?id=cc7ec8fe3bca7dbf643639b02d81a0b7f3c92198 commit cc7ec8fe3bca7dbf643639b02d81a0b7f3c92198 Author: Igor Ostapenko AuthorDate: 2024-10-17 14:02:27 +0000 Commit: Igor Ostapenko CommitDate: 2024-10-17 14:02:27 +0000 ipfw tests: Add basic coverage of divert(4) use cases Reviewed by: kp Approved by: kp (mentor) Differential Revision: https://reviews.freebsd.org/D47163 --- tests/sys/netpfil/ipfw/Makefile | 4 +- tests/sys/netpfil/ipfw/divert.sh | 281 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 284 insertions(+), 1 deletion(-) diff --git a/tests/sys/netpfil/ipfw/Makefile b/tests/sys/netpfil/ipfw/Makefile index 78882ef51aec..d4dbdb00f251 100644 --- a/tests/sys/netpfil/ipfw/Makefile +++ b/tests/sys/netpfil/ipfw/Makefile @@ -2,7 +2,9 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/netpfil/ipfw -ATF_TESTS_SH+= fwd +ATF_TESTS_SH+= fwd \ + divert + ${PACKAGE}FILES+= fwd_inetd.conf # Allow tests to run in parallel in their own jails diff --git a/tests/sys/netpfil/ipfw/divert.sh b/tests/sys/netpfil/ipfw/divert.sh new file mode 100644 index 000000000000..62db3f8fce98 --- /dev/null +++ b/tests/sys/netpfil/ipfw/divert.sh @@ -0,0 +1,281 @@ +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2023 Igor Ostapenko +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +# +# ipfw divert action test cases +# +# -----------| |-- |----| ----| |----------- +# ( ) inbound |ipfw| ) -> |host| -> ( ) |ipfw| outbound ) +# -----------| | |-- |----| ----| | |----------- +# | | +# \|/ \|/ +# |------| |------| +# |divapp| |divapp| +# |------| |------| +# +# The basic cases: +# - inbound > diverted | divapp terminated +# - inbound > diverted > inbound | host terminated +# - inbound > diverted > outbound | network terminated +# - outbound > diverted | divapp terminated +# - outbound > diverted > outbound | network terminated +# - outbound > diverted > inbound | e.g. host terminated +# +# When a packet is diverted, forwarded, and possibly diverted again: +# - inbound > diverted > inbound > forwarded +# > outbound | network terminated +# - inbound > diverted > inbound > forwarded +# > outbound > diverted > outbound | network terminated +# +# Test case naming legend: +# in - inbound +# div - diverted +# out - outbound +# fwd - forwarded +# + +. $(atf_get_srcdir)/../common/utils.subr + +divert_init() +{ + if ! kldstat -q -m ipdivert; then + atf_skip "This test requires ipdivert" + fi +} + +atf_test_case "in_div" "cleanup" +in_div_head() +{ + atf_set descr 'Test inbound > diverted | divapp terminated' + atf_set require.user root +} +in_div_body() +{ + firewall_init "ipfw" + divert_init + + epair=$(vnet_mkepair) + vnet_mkjail div ${epair}b + ifconfig ${epair}a 192.0.2.1/24 up + jexec div ifconfig ${epair}b 192.0.2.2/24 up + jexec div ipfw add 65534 allow all from any to any + + # Sanity check + atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 + + jexec div ipfw add 100 divert 2000 icmp from any to any in icmptypes 8 + + jexec div $(atf_get_srcdir)/../common/divapp 2000 & + divapp_pid=$! + # Wait for the divapp to be ready + sleep 1 + + # divapp is expected to "eat" the packet + atf_check -s not-exit:0 -o ignore ping -c1 -t1 192.0.2.2 + + wait $divapp_pid +} +in_div_cleanup() +{ + firewall_cleanup "ipfw" +} + +atf_test_case "in_div_in" "cleanup" +in_div_in_head() +{ + atf_set descr 'Test inbound > diverted > inbound | host terminated' + atf_set require.user root +} +in_div_in_body() +{ + firewall_init "ipfw" + divert_init + + epair=$(vnet_mkepair) + vnet_mkjail div ${epair}b + ifconfig ${epair}a 192.0.2.1/24 up + jexec div ifconfig ${epair}b 192.0.2.2/24 up + jexec div ipfw add 65534 allow all from any to any + + # Sanity check + atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 + + jexec div ipfw add 100 divert 2000 icmp from any to any in icmptypes 8 + + jexec div $(atf_get_srcdir)/../common/divapp 2000 divert-back & + divapp_pid=$! + # Wait for the divapp to be ready + sleep 1 + + # divapp is NOT expected to "eat" the packet + atf_check -s exit:0 -o ignore ping -c1 192.0.2.2 + + wait $divapp_pid +} +in_div_in_cleanup() +{ + firewall_cleanup "ipfw" +} + +atf_test_case "out_div" "cleanup" +out_div_head() +{ + atf_set descr 'Test outbound > diverted | divapp terminated' + atf_set require.user root +} +out_div_body() +{ + firewall_init "ipfw" + divert_init + + epair=$(vnet_mkepair) + vnet_mkjail div ${epair}b + ifconfig ${epair}a 192.0.2.1/24 up + jexec div ifconfig ${epair}b 192.0.2.2/24 up + jexec div ipfw add 65534 allow all from any to any + + # Sanity check + atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 + + jexec div ipfw add 100 divert 2000 icmp from any to any out icmptypes 0 + + jexec div $(atf_get_srcdir)/../common/divapp 2000 & + divapp_pid=$! + # Wait for the divapp to be ready + sleep 1 + + # divapp is expected to "eat" the packet + atf_check -s not-exit:0 -o ignore ping -c1 -t1 192.0.2.2 + + wait $divapp_pid +} +out_div_cleanup() +{ + firewall_cleanup "ipfw" +} + +atf_test_case "out_div_out" "cleanup" +out_div_out_head() +{ + atf_set descr 'Test outbound > diverted > outbound | network terminated' + atf_set require.user root +} +out_div_out_body() +{ + firewall_init "ipfw" + divert_init + + epair=$(vnet_mkepair) + vnet_mkjail div ${epair}b + ifconfig ${epair}a 192.0.2.1/24 up + jexec div ifconfig ${epair}b 192.0.2.2/24 up + jexec div ipfw add 65534 allow all from any to any + + # Sanity check + atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 + + jexec div ipfw add 100 divert 2000 icmp from any to any out icmptypes 0 + + jexec div $(atf_get_srcdir)/../common/divapp 2000 divert-back & + divapp_pid=$! + # Wait for the divapp to be ready + sleep 1 + + # divapp is NOT expected to "eat" the packet + atf_check -s exit:0 -o ignore ping -c1 192.0.2.2 + + wait $divapp_pid +} +out_div_out_cleanup() +{ + firewall_cleanup "ipfw" +} + +atf_test_case "in_div_in_fwd_out_div_out" "cleanup" +in_div_in_fwd_out_div_out_head() +{ + atf_set descr 'Test inbound > diverted > inbound > forwarded > outbound > diverted > outbound | network terminated' + atf_set require.user root +} +in_div_in_fwd_out_div_out_body() +{ + firewall_init "ipfw" + divert_init + + # host router site + epair0=$(vnet_mkepair) + epair1=$(vnet_mkepair) + + vnet_mkjail router ${epair0}b ${epair1}a + ifconfig ${epair0}a 192.0.2.1/24 up + jexec router sysctl net.inet.ip.forwarding=1 + jexec router ifconfig ${epair0}b 192.0.2.2/24 up + jexec router ifconfig ${epair1}a 198.51.100.1/24 up + jexec router ipfw add 65534 allow all from any to any + + vnet_mkjail site ${epair1}b + jexec site ifconfig ${epair1}b 198.51.100.2/24 up + jexec site ipfw add 65534 allow all from any to any + jexec site route add default 198.51.100.1 + + route add -net 198.51.100.0/24 192.0.2.2 + + # Sanity check + atf_check -s exit:0 -o ignore ping -c3 192.0.2.2 + + # Should be routed without diversion + atf_check -s exit:0 -o ignore ping -c3 198.51.100.2 + + jexec router ipfw add 100 divert 2001 icmp from any to any in icmptypes 8 + jexec router ipfw add 200 divert 2002 icmp from any to any out icmptypes 8 + + jexec router $(atf_get_srcdir)/../common/divapp 2001 divert-back & + indivapp_pid=$! + jexec router $(atf_get_srcdir)/../common/divapp 2002 divert-back & + outdivapp_pid=$! + # Wait for the divappS to be ready + sleep 1 + + # Both divappS are NOT expected to "eat" the packet + atf_check -s exit:0 -o ignore ping -c1 198.51.100.2 + + wait $indivapp_pid && wait $outdivapp_pid +} +in_div_in_fwd_out_div_out_cleanup() +{ + firewall_cleanup "ipfw" +} + +atf_init_test_cases() +{ + atf_add_test_case "in_div" + atf_add_test_case "in_div_in" + + atf_add_test_case "out_div" + atf_add_test_case "out_div_out" + + atf_add_test_case "in_div_in_fwd_out_div_out" +}