xref: /freebsd/tests/sys/netpfil/pf/utils.subr (revision 2b833162)
1# $FreeBSD$
2# Utility functions
3##
4# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
5#
6# Copyright (c) 2017 Kristof Provost <kp@FreeBSD.org>
7# Copyright (c) 2023 Kajetan Staszkiewicz <vegeta@tuxpowered.net>
8#
9# Redistribution and use in source and binary forms, with or without
10# modification, are permitted provided that the following conditions
11# are met:
12# 1. Redistributions of source code must retain the above copyright
13#    notice, this list of conditions and the following disclaimer.
14# 2. Redistributions in binary form must reproduce the above copyright
15#    notice, this list of conditions and the following disclaimer in the
16#    documentation and/or other materials provided with the distribution.
17#
18# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28# SUCH DAMAGE.
29
30. $(atf_get_srcdir)/../../common/vnet.subr
31common_dir=$(atf_get_srcdir)/../common
32
33pft_onerror()
34{
35	status=$?
36
37	echo "Debug log."
38	echo "=========="
39	echo "Test exit status: $?"
40	echo
41
42	if [ -f created_jails.lst ]; then
43		for jailname in `cat created_jails.lst`
44		do
45			echo "Jail ${jailname}"
46			echo "----------------"
47			jexec ${jailname} ifconfig
48			jexec ${jailname} netstat -rn
49			jexec ${jailname} pfctl -sa -v
50		done
51	fi
52
53	echo "Created interfaces:"
54	echo "-------------------"
55	cat created_interfaces.lst
56
57	echo "Host interfaces:"
58	echo "----------------"
59	ifconfig
60}
61
62pft_init()
63{
64	if [ "$1" == "debug" ]
65	then
66		trap pft_onerror EXIT
67	fi
68
69	vnet_init
70
71	if [ ! -c /dev/pf ]; then
72		atf_skip "This test requires pf"
73	fi
74}
75
76pfsynct_init()
77{
78	pft_init
79
80	if ! kldstat -q -m pfsync; then
81		atf_skip "This test requires pfsync"
82	fi
83}
84
85pflog_init()
86{
87	if ! kldstat -q -m pflog; then
88		atf_skip "This test requires pflog"
89	fi
90}
91
92dummynet_init()
93{
94	pft_init
95
96	if ! kldstat -q -m dummynet; then
97		atf_skip "This test requires dummynet"
98	fi
99}
100
101pft_set_rules()
102{
103	jname=$1
104	shift
105
106	if [ $jname == "noflush" ];
107	then
108		jname=$1
109		shift
110	else
111		# Flush all states, rules, fragments, ...
112		jexec ${jname} pfctl -F all
113	fi
114
115	while [ $# -gt 0 ]; do
116		printf "$1\n"
117		shift
118	done | jexec ${jname} pfctl -f -
119	if [ $? -ne 0 ];
120	then
121		atf_fail "Failed to set PF rules in ${jname}"
122	fi
123}
124
125pft_cleanup()
126{
127	vnet_cleanup
128}
129
130pfsynct_cleanup()
131{
132	pft_cleanup
133}
134
135is_altq_supported()
136{
137	sysctl -q kern.features.altq >/dev/null || \
138	    atf_skip "Test requires ALTQ"
139
140	while [ -n "$1" ]
141	do
142		sysctl -q kern.features.altq.${1} >/dev/null || \
143		    atf_skip "Test required ALTQ_${1}"
144		shift
145	done
146}
147
148altq_init()
149{
150	pft_init
151	is_altq_supported
152}
153
154altq_cleanup()
155{
156	pft_cleanup
157}
158
159# Create a bare router jail.
160# This function lacks target configuration.
161setup_router_ipv4()
162{
163	pft_init
164
165	epair_tester=$(vnet_mkepair)
166	epair_server=$(vnet_mkepair)
167
168	net_tester=192.0.2.0/24
169	net_tester_mask=24
170	net_tester_host_router=192.0.2.1
171	net_tester_host_tester=192.0.2.2
172
173	net_server=198.51.100.0/24
174	net_server_mask=24
175	net_server_host_router=198.51.100.1
176	net_server_host_server=198.51.100.2
177
178	vnet_mkjail router ${epair_tester}b ${epair_server}a
179
180	ifconfig ${epair_tester}a ${net_tester_host_tester}/${net_tester_mask} up
181	route add -net ${net_server} ${net_tester_host_router}
182
183	jexec router ifconfig ${epair_tester}b ${net_tester_host_router}/${net_tester_mask} up
184	jexec router sysctl net.inet.ip.forwarding=1
185	jexec router ifconfig ${epair_server}a ${net_server_host_router}/${net_server_mask} up
186
187	jexec router pfctl -e
188}
189
190# Create a router jail.
191# The target for tests does not exist but a static ARP entry does
192# so packets to it can be properly routed.
193setup_router_dummy_ipv4()
194{
195	setup_router_ipv4
196	jexec router arp -s ${net_server_host_server} 00:01:02:03:04:05
197	ifconfig ${epair_server}b up
198}
199
200# Create a router and a server jail.
201# The server is capable of responding to pings from the tester.
202setup_router_server_ipv4()
203{
204	setup_router_ipv4
205	vnet_mkjail server ${epair_server}b
206	jexec server ifconfig ${epair_server}b ${net_server_host_server}/${net_server_mask} up
207	jexec server route add -net ${net_tester} ${net_server_host_router}
208	jexec server nc -4l 666 &
209	sleep 1 # Give nc time to start and listen
210}
211
212# Create a bare router jail.
213# This function lacks target configuration.
214setup_router_ipv6()
215{
216	pft_init
217
218	epair_tester=$(vnet_mkepair)
219	epair_server=$(vnet_mkepair)
220
221	net_tester=2001:db8:42::/64
222	net_tester_mask=64
223	net_tester_host_router=2001:db8:42::1
224	net_tester_host_tester=2001:db8:42::2
225
226	net_server=2001:db8:43::/64
227	net_server_mask=64
228	net_server_host_router=2001:db8:43::1
229	net_server_host_server=2001:db8:43::2
230
231	vnet_mkjail router ${epair_tester}b ${epair_server}a
232
233	ifconfig ${epair_tester}a inet6 ${net_tester_host_tester}/${net_tester_mask}up no_dad
234	route add -6 ${net_server} ${net_tester_host_router}
235
236	jexec router ifconfig ${epair_tester}b inet6 ${net_tester_host_router}/${net_tester_mask} up no_dad
237	jexec router sysctl net.inet6.ip6.forwarding=1
238	jexec router ifconfig ${epair_server}a inet6 ${net_server_host_router}/${net_server_mask} up no_dad
239
240	jexec router pfctl -e
241}
242
243# Create a router jail.
244# The target for tests does not exist but a static NDP entry does
245# so packets to it can be properly routed.
246setup_router_dummy_ipv6()
247{
248	setup_router_ipv6
249	jexec router ndp -s ${net_server_host_server} 00:01:02:03:04:05
250	ifconfig ${epair_server}b up
251}
252
253# Create a router and a server jail.
254# The server is capable of responding to pings from tester.
255setup_router_server_ipv6()
256{
257	setup_router_ipv6
258	vnet_mkjail server ${epair_server}b
259	jexec server ifconfig ${epair_server}b inet6 ${net_server_host_server}/${net_server_mask} up no_dad
260	jexec server route add -6 ${net_tester} ${net_server_host_router}
261	jexec server nc -6l 666 &
262	sleep 1 # Give nc time to start and listen
263}
264
265# Ping the dummy static NDP target.
266# Check for pings being forwarded through the router towards the target.
267ping_dummy_check_request()
268{
269	exit_condition=$1
270	shift
271	params=$@
272	atf_check -s ${exit_condition} ${common_dir}/pft_ping.py \
273	    --sendif ${epair_tester}a \
274	    --to ${net_server_host_server} \
275	    --recvif ${epair_server}b \
276	$params
277}
278
279# Ping the server jail.
280# Check for responses coming back throught the router back to the tester.
281ping_server_check_reply()
282{
283	exit_condition=$1
284	shift
285	params=$@
286	atf_check -s ${exit_condition} ${common_dir}/pft_ping.py \
287	    --sendif ${epair_tester}a \
288	    --to ${net_server_host_server} \
289	    --replyif ${epair_tester}a \
290	$params
291}
292