xref: /freebsd/tests/sys/netpfil/pf/set_skip.sh (revision c03c5b1c) 
1# $FreeBSD$
2#
3# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4#
5# Copyright (c) 2018 Kristof Provost <kp@FreeBSD.org>
6#
7# Redistribution and use in source and binary forms, with or without
8# modification, are permitted provided that the following conditions
9# are met:
10# 1. Redistributions of source code must retain the above copyright
11#    notice, this list of conditions and the following disclaimer.
12# 2. Redistributions in binary form must reproduce the above copyright
13#    notice, this list of conditions and the following disclaimer in the
14#    documentation and/or other materials provided with the distribution.
15#
16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26# SUCH DAMAGE.
27
28. $(atf_get_srcdir)/utils.subr
29
30atf_test_case "set_skip_group" "cleanup"
31set_skip_group_head()
32{
33	atf_set descr 'Basic set skip test'
34	atf_set require.user root
35}
36
37set_skip_group_body()
38{
39	# See PR 229241
40	pft_init
41
42	vnet_mkjail alcatraz
43	jexec alcatraz ifconfig lo0 127.0.0.1/8 up
44	jexec alcatraz ifconfig lo0 group foo
45	jexec alcatraz pfctl -e
46	pft_set_rules alcatraz "set skip on foo" \
47		"block in proto icmp"
48
49	jexec alcatraz ifconfig
50	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
51}
52
53set_skip_group_cleanup()
54{
55	pft_cleanup
56}
57
58atf_test_case "set_skip_group_lo" "cleanup"
59set_skip_group_lo_head()
60{
61	atf_set descr 'Basic set skip test, lo'
62	atf_set require.user root
63}
64
65set_skip_group_lo_body()
66{
67	# See PR 229241
68	pft_init
69
70	vnet_mkjail alcatraz
71	jexec alcatraz ifconfig lo0 127.0.0.1/8 up
72	jexec alcatraz pfctl -e
73	pft_set_rules alcatraz "set skip on lo" \
74		"block on lo0"
75
76	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
77	pft_set_rules noflush alcatraz "set skip on lo" \
78		"block on lo0"
79	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
80	jexec alcatraz pfctl -s rules
81}
82
83set_skip_group_lo_cleanup()
84{
85	pft_cleanup
86}
87
88atf_test_case "set_skip_dynamic" "cleanup"
89set_skip_dynamic_head()
90{
91	atf_set descr "Cope with group changes"
92	atf_set require.user root
93}
94
95set_skip_dynamic_body()
96{
97	pft_init
98
99	set -x
100
101	vnet_mkjail alcatraz
102	jexec alcatraz pfctl -e
103	pft_set_rules alcatraz "set skip on epair" \
104		"block"
105
106	epair=$(vnet_mkepair)
107	ifconfig ${epair}a 192.0.2.2/24 up
108	vnet_ifmove ${epair}b alcatraz
109
110	jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up
111
112	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 192.0.2.2
113}
114
115set_skip_dynamic_cleanup()
116{
117	pft_cleanup
118}
119
120atf_test_case "pr255852" "cleanup"
121pr255852_head()
122{
123	atf_set descr "PR 255852"
124	atf_set require.user root
125}
126
127pr255852_body()
128{
129	pft_init
130
131	epair=$(vnet_mkepair)
132
133	ifconfig ${epair}a 192.0.2.1/24 up
134
135	vnet_mkjail alcatraz ${epair}b
136	jexec alcatraz ifconfig lo0 127.0.0.1/8 up
137	jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up
138
139	# Sanity check
140	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
141
142	jexec alcatraz pfctl -e
143	pft_set_rules alcatraz "set skip on { lo0, epair }" \
144		"block"
145	jexec alcatraz pfctl -vsI
146
147	# We're skipping on epair, so this should work
148	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
149
150	# Note: flushing avoid the issue
151	pft_set_rules noflush alcatraz "set skip on { lo0 }" \
152		"block"
153
154	jexec alcatraz pfctl -vsI
155
156	# No longer skipping, so this should fail
157	atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.2
158}
159
160pr255852_cleanup()
161{
162	pft_cleanup
163}
164
165atf_init_test_cases()
166{
167	atf_add_test_case "set_skip_group"
168	atf_add_test_case "set_skip_group_lo"
169	atf_add_test_case "set_skip_dynamic"
170	atf_add_test_case "pr255852"
171}
172