svn commit: r343230 - stable/12/tests/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Sun Jan 20 22:03:43 2019
New Revision: 343230
URL: https://svnweb.freebsd.org/changeset/base/343230

Log:
  MFC r342990
  
  pf tests: Test PR 229241
  
  pfctl has an issue with 'set skip on <group>', which causes inconsistent
  behaviour: the set skip directive works initially, but does not take
  effect when the same rules are re-applied.
  
  PR:		229241

Modified:
  stable/12/tests/sys/netpfil/pf/set_skip.sh
  stable/12/tests/sys/netpfil/pf/utils.subr
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/tests/sys/netpfil/pf/set_skip.sh
==============================================================================
--- stable/12/tests/sys/netpfil/pf/set_skip.sh	Sun Jan 20 22:01:41 2019	(r343229)
+++ stable/12/tests/sys/netpfil/pf/set_skip.sh	Sun Jan 20 22:03:43 2019	(r343230)
@@ -30,7 +30,38 @@ set_skip_group_cleanup()
 	pft_cleanup
 }
 
+atf_test_case "set_skip_group_lo" "cleanup"
+set_skip_group_lo_head()
+{
+	atf_set descr 'Basic set skip test, lo'
+	atf_set require.user root
+}
+
+set_skip_group_lo_body()
+{
+	# See PR 229241
+	pft_init
+
+	pft_mkjail alcatraz
+	jexec alcatraz ifconfig lo0 127.0.0.1/8 up
+	jexec alcatraz pfctl -e
+	pft_set_rules alcatraz "set skip on lo" \
+		"block on lo0"
+
+	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
+	pft_set_rules noflush alcatraz "set skip on lo" \
+		"block on lo0"
+	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
+	jexec alcatraz pfctl -s rules
+}
+
+set_skip_group_lo_cleanup()
+{
+	pft_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "set_skip_group"
+	atf_add_test_case "set_skip_group_lo"
 }

Modified: stable/12/tests/sys/netpfil/pf/utils.subr
==============================================================================
--- stable/12/tests/sys/netpfil/pf/utils.subr	Sun Jan 20 22:01:41 2019	(r343229)
+++ stable/12/tests/sys/netpfil/pf/utils.subr	Sun Jan 20 22:03:43 2019	(r343230)
@@ -49,8 +49,14 @@ pft_set_rules()
 	jname=$1
 	shift
 
-	# Flush all states, rules, fragments, ...
-	jexec ${jname} pfctl -F all
+	if [ $jname == "noflush" ];
+	then
+		jname=$1
+		shift
+	else
+		# Flush all states, rules, fragments, ...
+		jexec ${jname} pfctl -F all
+	fi
 
 	while [ $# -gt 0 ]; do
 		printf "$1\n"