1# $OpenBSD: Makefile,v 1.6 2020/01/08 21:28:00 bluhm Exp $ 2 3# Copyright (c) 2017-2020 Alexander Bluhm <bluhm@openbsd.org> 4# 5# Permission to use, copy, modify, and distribute this software for any 6# purpose with or without fee is hereby granted, provided that the above 7# copyright notice and this permission notice appear in all copies. 8# 9# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17# Set up two loopback interfaces in different routing domains. 18# Try to ping existing and non existing addresses in these domains. 19# Also test pinging to different rdomains via pf. Check that the 20# ttl is decremented while looping though loopback interfaces. 21 22# This test uses routing doamin and interface number 11 and 12. 23# Adjust it here, if you want to use something else. 24N1 = 11 25N2 = 12 26NUMS = ${N1} ${N2} 27 28.include <bsd.own.mk> 29 30.if ! (make(clean) || make(cleandir) || make(obj)) 31 32SYSCTL_FORWARDING != sysctl net.inet.ip.forwarding 33.if ${SYSCTL_FORWARDING:C/.*=//} != 1 34regress: 35 @echo sysctl: "${SYSCTL_FORWARDING}" 36 @echo Set sysctl to 1 to run this regress. 37 @echo SKIPPED 38.endif 39 40PF_STATUS != ${SUDO} pfctl -si | sed -n 's/^Status: \([^ ]*\) .*/\1/p' 41.if empty(PF_STATUS:MEnabled) 42regress: 43 @echo pf status: "${PF_STATUS}" 44 @echo Enable pf to run this regress. 45 @echo SKIPPED 46.endif 47 48PF_SKIP != ${SUDO} pfctl -sI -v | sed -n 's/ (skip)//p' 49.if ! empty(PF_SKIP:Mlo*:Nlo0) 50regress: 51 @echo pf skip: "${PF_SKIP}" 52 @echo Do not set skip on interface lo, lo${N1}, or lo${N2}. 53 @echo SKIPPED 54.endif 55 56PF_ANCHOR != ${SUDO} pfctl -sr | sed -n 's/^anchor "\([^"]*\)" all$$/\1/p' 57.if empty(PF_ANCHOR:Mregress) 58regress: 59 @echo pf anchor: "${PF_ANCHOR}" 60 @echo Need anchor '"regress"' in pf.conf to load additional rules. 61 @echo SKIPPED 62.endif 63 64.endif 65 66.PHONY: busy-rdomains ifconfig unconfig 67 68busy-rdomains: 69 # check if rdomains are busy 70.for n in ${NUMS} 71 @if /sbin/ifconfig | grep -v '^lo${n}:' | grep ' rdomain ${n} '; then\ 72 echo routing domain ${n} is already used >&2; exit 1; fi 73.endfor 74 75ifconfig: unconfig 76 # create and configure loopback interfaces 77.for n in ${NUMS} 78 ${SUDO} ifconfig lo${n} rdomain ${n} 79 ${SUDO} ifconfig lo${n} inet 127.0.0.1/8 80 ${SUDO} ifconfig lo${n} inet 127.0.0.${n} alias 81 ${SUDO} route -n -T ${n} add -inet -host 10.6.6.6 127.0.0.1 82 ${SUDO} route -n -T ${n} add -inet -host 10.7.7.7 127.0.0.1 83.endfor 84 ${SUDO} route -n -T ${N1} add -inet -host 127.0.0.${N2} 127.0.0.1 85 ${SUDO} route -n -T ${N2} add -inet -host 127.0.0.${N1} 127.0.0.1 86 87unconfig: 88 # destroy interfaces 89.for n in ${NUMS} 90 -${SUDO} ifconfig lo${n} 127.0.0.1 delete 91 -${SUDO} ifconfig lo${n} 127.0.0.${n} delete 92.endfor 93 rm -f stamp-setup 94 95stamp-setup: Makefile 96 @echo '\n======== $@ ========' 97 ${.MAKE} -C ${.CURDIR} busy-rdomains ifconfig 98 date >$@ 99 100# Create python include file containing the addresses. 101addr.py: Makefile 102 rm -f $@ $@.tmp 103.for var in N1 N2 104 echo '${var}="${${var}}"' >>$@.tmp 105 echo 'IF_${var}="lo${${var}}"' >>$@.tmp 106 echo 'ADDR_${var}="127.0.0.${${var}}"' >>$@.tmp 107.endfor 108 mv $@.tmp $@ 109 110# Load the pf rules into the kernel. 111stamp-pfctl: addr.py pf.conf stamp-setup 112 @echo '\n======== $@ ========' 113 cat addr.py ${.CURDIR}/pf.conf | /sbin/pfctl -n -f - 114 cat addr.py ${.CURDIR}/pf.conf | ${SUDO} pfctl -a regress -f - 115 @date >$@ 116 117# run tcpdump on lo devices 118DUMPCMD = /usr/sbin/tcpdump -l -e -vvv -s 2048 -ni 119 120stamp-bpf: stamp-bpf-${N1} stamp-bpf-${N2} 121 sleep 2 # XXX 122 @date >$@ 123 124.for n in ${N1} ${N2} 125 126stamp-bpf-${n}: stamp-setup 127 @echo '\n======== $@ ========' 128 rm -f lo${n}.tcpdump 129 ${SUDO} pkill -f '^${DUMPCMD} lo${n}' || true 130 ${SUDO} ${DUMPCMD} lo${n} >lo${n}.tcpdump & 131 rm -f stamp-stop 132 @date >$@ 133 134.endfor 135 136stamp-stop: 137 @echo '\n======== $@ ========' 138 sleep 2 # XXX 139 -${SUDO} pkill -f '^${DUMPCMD}' 140 rm -f stamp-bpf* 141 @date >$@ 142 143.for n in ${N1} ${N2} 144 145REGRESS_TARGETS += run-regress-ping-local-${n} 146run-regress-ping-local-${n}: stamp-setup stamp-bpf 147 @echo '\n======== $@ ========' 148 # Ping localhost in routing domain ${n}. 149 /sbin/ping -n -w 1 -c 1 -V ${n} 127.0.0.1 150 151REGRESS_TARGETS += run-regress-ping-loop-${n} 152run-regress-ping-loop-${n}: stamp-setup stamp-bpf 153 @echo '\n======== $@ ========' 154 # Ping non existing address with loopback route in routing domain ${n}. 155 ! /sbin/ping -n -w 1 -c 1 -V ${n} 10.6.6.6 156 157REGRESS_TARGETS += run-regress-ping-address-${n} 158run-regress-ping-address-${n}: stamp-setup stamp-pfctl 159 @echo '\n======== $@ ========' 160 # Ping local address in routing domain ${n}. 161 /sbin/ping -n -w 1 -c 1 -V ${n} 127.0.0.${n} 162 163.endfor 164 165REGRESS_TARGETS += run-regress-ping-rdomain-pass 166run-regress-ping-rdomain-pass: stamp-setup stamp-pfctl 167 @echo '\n======== $@ ========' 168 # Pass ping packets between routing domains with pf rule. 169 /sbin/ping -n -w 1 -c 1 -V ${N1} 127.0.0.${N2} 170 171REGRESS_TARGETS += run-regress-ping-rdomain-block 172run-regress-ping-rdomain-block: stamp-setup stamp-pfctl 173 @echo '\n======== $@ ========' 174 # Check that reverse direction without pf rule is not allowed. 175 ! /sbin/ping -n -w 1 -c 1 -V ${N2} 127.0.0.${N1} 176 177REGRESS_TARGETS += run-regress-ping-rdomain-loop 178run-regress-ping-rdomain-loop: stamp-setup stamp-pfctl stamp-bpf 179 @echo '\n======== $@ ========' 180 # Ping non existing address and loop between routing domains. 181 ! /sbin/ping -n -w 1 -c 1 -V ${N1} 10.7.7.7 182 183.for n in ${N1} ${N2} 184 185REGRESS_TARGETS += run-regress-bpf-local-${n} 186run-regress-bpf-local-${n}: stamp-stop 187 @echo '\n======== $@ ========' 188 # Check that the ping packet went through loopback. 189 grep '127.0.0.1 > 127.0.0.1: icmp: echo request' lo${n}.tcpdump 190 191REGRESS_TARGETS += run-regress-bpf-loop-${n} 192run-regress-bpf-loop-${n}: stamp-stop 193 @echo '\n======== $@ ========' 194 # Check that the ping packet went multiple times through loopback. 195 grep '[0-9] 127.0.0.1 > 10.6.6.6: icmp: echo request .*ttl 255,' \ 196 lo${n}.tcpdump 197 grep '[0-9] 127.0.0.1 > 10.6.6.6: icmp: echo request .* \[ttl 1\]' \ 198 lo${n}.tcpdump 199 200.endfor 201 202REGRESS_TARGETS += run-regress-bpf-rdomain-loop-${N1} 203run-regress-bpf-rdomain-loop-${N1}: stamp-stop 204 @echo '\n======== $@ ========' 205 # Check the ping packet went multiple times in routing domains. 206 grep '[0-9] 127.0.0.1 > 10.7.7.7: icmp: echo request .*ttl 255,' \ 207 lo${N1}.tcpdump 208 ! grep '[0-9] 127.0.0.1 > 10.7.7.7: icmp: echo request .*ttl 254,' \ 209 lo${N1}.tcpdump 210 grep '[0-9] 127.0.0.1 > 10.7.7.7: icmp: echo request .* \[ttl 1\]' \ 211 lo${N1}.tcpdump 212 213REGRESS_TARGETS += run-regress-bpf-rdomain-loop-${N2} 214run-regress-bpf-rdomain-loop-${N2}: stamp-stop 215 @echo '\n======== $@ ========' 216 # Check the ping packet went multiple times in routing domains. 217 grep '[0-9] 127.0.0.1 > 10.7.7.7: icmp: echo request .*ttl 254,' \ 218 lo${N2}.tcpdump 219 grep '[0-9] 127.0.0.1 > 10.7.7.7: icmp: echo request .*ttl 2,' \ 220 lo${N2}.tcpdump 221 ! grep '[0-9] 127.0.0.1 > 10.7.7.7: icmp: echo request .* \[ttl 1\]' \ 222 lo${N2}.tcpdump 223 224REGRESS_TARGETS += run-regress-cleanup 225run-regress-cleanup: stamp-stop 226 @echo '\n======== $@ ========' 227 ${.MAKE} -C ${.CURDIR} unconfig 228 229CLEANFILES += addr.py *.pyc *.tcpdump *.log stamp-* 230 231.include <bsd.regress.mk> 232