pf tests: ensure temporary files end up in the atf working directory

Many of the tests create temporary files. pid files, log files, tcpdump
captures, ... We should take care to ensure they're store

pf tests: ensure temporary files end up in the atf working directory

Many of the tests create temporary files. pid files, log files, tcpdump
captures, ... We should take care to ensure they're stored in the temporary
working directory Kyua creates rather than in the root directory.

This ensures there are no conflicts between simultaneously running tests, and
also keeps the root directory clean.

MFC after: 1 month
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: test syncookies on IPv6

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.

Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix

show more ...

pf tests: test fast port re-use with syncookies

When a src/dst ip/port tuple is re-used before the pf state fully
expires we clean up the state and create a new one, unless syncookies
are enabled.

pf tests: test fast port re-use with syncookies

When a src/dst ip/port tuple is re-used before the pf state fully
expires we clean up the state and create a new one, unless syncookies
are enabled.

Test this, by running two back-to-back nc sessions, with a fixed source
port. Move the interface and IP to a different (vnet) jail, to trick the
network stack into letting us do this.

MFC after: 2 weeks
Event: Aberdeen hackathon 2022
Differential Revision: https://reviews.freebsd.org/D36886

show more ...

pf tests: verify syncookie status report

Verify that pfctl -si -v correctly shows syncookies to be
active/inactive.

Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: syncookie limits test

Test that we can successfuly set syncookie high/low watermarks for very
low or very high state limits.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differen

pf tests: syncookie limits test

Test that we can successfuly set syncookie high/low watermarks for very
low or very high state limits.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D36498

show more ...

pf tests: Basic adaptive mode syncookie test

MFC after: 1 week
Sponsored by: Modirum MDPay
Differential Revision: https://reviews.freebsd.org/D32139

pf tests: Basic syncookie test

MFC after: 1 week
Sponsored by: Modirum MDPay
Differential Revision: https://reviews.freebsd.org/D32138

pf tests: ensure syncookie does not create state

Test that with syncookies enabled pf does not create state for
connections before the remote peer has replied to the SYN|ACK message.

MFC after: 1 w

pf tests: ensure syncookie does not create state

Test that with syncookies enabled pf does not create state for
connections before the remote peer has replied to the SYN|ACK message.

MFC after: 1 week
Sponsored by: Modirum MDPay
Differential Revision: https://reviews.freebsd.org/D31142

show more ...

pf tests: Forwarding syncookie test

Test syncookies on a forwarding host. That is, in a setup where the
machine (or vnet) running pf is not the same as the machine (or vnet)
running the server it's

pf tests: Forwarding syncookie test

Test syncookies on a forwarding host. That is, in a setup where the
machine (or vnet) running pf is not the same as the machine (or vnet)
running the server it's protecting.

MFC after: 1 week
Sponsored by: Modirum MDPay
Differential Revision: https://reviews.freebsd.org/D31141

show more ...