1# 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2018 Kristof Provost <kp@FreeBSD.org> 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26 27. $(atf_get_srcdir)/utils.subr 28 29atf_test_case "pr183198" "cleanup" 30pr183198_head() 31{ 32 atf_set descr 'Test tables referenced by rules in anchors' 33 atf_set require.user root 34} 35 36pr183198_body() 37{ 38 pft_init 39 40 epair=$(vnet_mkepair) 41 vnet_mkjail alcatraz ${epair}b 42 jexec alcatraz pfctl -e 43 44 # Forward with pf enabled 45 pft_set_rules alcatraz \ 46 "table <test> { 10.0.0.1, 10.0.0.2, 10.0.0.3 }" \ 47 "block in" \ 48 "anchor \"epair\" on ${epair}b { \n\ 49 pass in from <test> \n\ 50 }" 51 52 atf_check -s exit:0 -o ignore jexec alcatraz pfctl -sr -a '*' 53 atf_check -s exit:0 -o ignore jexec alcatraz pfctl -t test -T show 54} 55 56pr183198_cleanup() 57{ 58 pft_cleanup 59} 60 61atf_test_case "nested_anchor" "cleanup" 62nested_anchor_head() 63{ 64 atf_set descr 'Test setting and retrieving nested anchors' 65 atf_set require.user root 66} 67 68nested_anchor_body() 69{ 70 pft_init 71 72 epair=$(vnet_mkepair) 73 vnet_mkjail alcatraz ${epair}a 74 75 pft_set_rules alcatraz \ 76 "anchor \"foo\" { \n\ 77 anchor \"bar\" { \n\ 78 pass on ${epair}a \n\ 79 } \n\ 80 }" 81 82 atf_check -s exit:0 -o inline:"anchor \"foo\" all { 83 anchor \"bar\" all { 84 pass on ${epair}a all flags S/SA keep state 85 } 86} 87" jexec alcatraz pfctl -sr -a "*" 88} 89 90nested_anchor_cleanup() 91{ 92 pft_cleanup 93} 94 95atf_test_case "wildcard" "cleanup" 96wildcard_head() 97{ 98 atf_set descr 'Test wildcard anchors for functionality' 99 atf_set require.user root 100} 101 102wildcard_body() 103{ 104 pft_init 105 106 epair=$(vnet_mkepair) 107 vnet_mkjail alcatraz ${epair}a 108 109 ifconfig ${epair}b 192.0.2.2/24 up 110 jexec alcatraz ifconfig ${epair}a 192.0.2.1/24 up 111 112 # Sanity check 113 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1 114 115 jexec alcatraz pfctl -e 116 pft_set_rules alcatraz \ 117 "block" \ 118 "anchor \"foo/*\"" 119 120 atf_check -s exit:2 -o ignore ping -c 1 192.0.2.1 121 122 echo "pass" | jexec alcatraz pfctl -g -f - -a "foo/bar" 123 124 jexec alcatraz pfctl -sr -a "*" 125 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1 126} 127 128wildcard_cleanup() 129{ 130 pft_cleanup 131} 132 133atf_test_case "nested_label" "cleanup" 134nested_label_head() 135{ 136 atf_set descr "Test recursive listing of labels" 137 atf_set require.user root 138} 139 140nested_label_body() 141{ 142 pft_init 143 144 vnet_mkjail alcatraz 145 146 pft_set_rules alcatraz \ 147 "anchor \"foo\" { \n\ 148 pass in quick proto icmp label \"passicmp\"\n\ 149 anchor \"bar\" { \n\ 150 pass in proto tcp label \"passtcp\"\n\ 151 } \n\ 152 }" \ 153 "pass quick from any to any label \"anytoany\"" 154 155 atf_check -s exit:0 \ 156 -o inline:"passicmp 0 0 0 0 0 0 0 0 157passtcp 0 0 0 0 0 0 0 0 158anytoany 0 0 0 0 0 0 0 0 159" jexec alcatraz pfctl -sl -a* 160} 161 162nested_label_cleanup() 163{ 164 pft_cleanup 165} 166 167atf_init_test_cases() 168{ 169 atf_add_test_case "pr183198" 170 atf_add_test_case "nested_anchor" 171 atf_add_test_case "wildcard" 172 atf_add_test_case "nested_label" 173} 174