Page MenuHomeFreeBSD
Files F148042912

D42314.1785198403.diff
No OneTemporary
Actions

Size
12 KB
Referenced Files
None
Subscribers
None

D42314.1785198403.diff
View Options

diff --git a/tests/sys/netpfil/common/Makefile b/tests/sys/netpfil/common/Makefile
--- a/tests/sys/netpfil/common/Makefile
+++ b/tests/sys/netpfil/common/Makefile
@@ -2,6 +2,7 @@
PACKAGE= tests
TESTSDIR= ${TESTSBASE}/sys/netpfil/common
+BINDIR= ${TESTSDIR}
ATF_TESTS_SH+= \
@@ -16,6 +17,8 @@
# Tests reuse jail names and so cannot run in parallel.
TEST_METADATA+= is_exclusive=true
+PROGS= divapp
+
${PACKAGE}FILES+= \
utils.subr \
runner.subr \
diff --git a/tests/sys/netpfil/pf/divapp.c b/tests/sys/netpfil/common/divapp.c
rename from tests/sys/netpfil/pf/divapp.c
rename to tests/sys/netpfil/common/divapp.c
--- a/tests/sys/netpfil/pf/divapp.c
+++ b/tests/sys/netpfil/common/divapp.c
@@ -25,7 +25,7 @@
* SUCH DAMAGE.
*/
-/* Used by tests like divert-to.sh */
+/* Used by divert(4) related tests */
#include <errno.h>
#include <stdlib.h>
diff --git a/tests/sys/netpfil/ipfw/Makefile b/tests/sys/netpfil/ipfw/Makefile
--- a/tests/sys/netpfil/ipfw/Makefile
+++ b/tests/sys/netpfil/ipfw/Makefile
@@ -2,7 +2,9 @@
TESTSDIR= ${TESTSBASE}/sys/netpfil/ipfw
-ATF_TESTS_SH+= fwd
+ATF_TESTS_SH+= fwd \
+ divert
+
${PACKAGE}FILES+= fwd_inetd.conf
.include <bsd.test.mk>
diff --git a/tests/sys/netpfil/ipfw/divert.sh b/tests/sys/netpfil/ipfw/divert.sh
new file mode 100644
--- /dev/null
+++ b/tests/sys/netpfil/ipfw/divert.sh
@@ -0,0 +1,300 @@
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+# Copyright (c) 2023 Igor Ostapenko <pm@igoro.pro>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in the
+# documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+#
+# ipfw divert action test cases
+#
+# -----------| |-- |----| ----| |-----------
+# ( ) inbound |ipfw| ) -> |host| -> ( ) |ipfw| outbound )
+# -----------| | |-- |----| ----| | |-----------
+# | |
+# \|/ \|/
+# |------| |------|
+# |divapp| |divapp|
+# |------| |------|
+#
+# The basic cases:
+# - inbound > diverted | divapp terminated
+# - inbound > diverted > inbound | host terminated
+# - inbound > diverted > outbound | network terminated
+# - outbound > diverted | divapp terminated
+# - outbound > diverted > outbound | network terminated
+# - outbound > diverted > inbound | e.g. host terminated
+#
+# When a packet is diverted, forwarded, and possibly diverted again:
+# - inbound > diverted > inbound > forwarded
+# > outbound | network terminated
+# - inbound > diverted > inbound > forwarded
+# > outbound > diverted > outbound | network terminated
+#
+# Test case naming legend:
+# in - inbound
+# div - diverted
+# out - outbound
+# fwd - forwarded
+#
+
+. $(atf_get_srcdir)/../common/utils.subr
+
+execenv_jail()
+{
+ atf_set execenv.jail vnet allow.raw_sockets \"exec.prepare=kldload -n if_epair\"
+}
+execenv_jail_init()
+{
+ ipfw add 65534 allow all from any to any
+}
+
+divert_init()
+{
+ if ! kldstat -q -m ipdivert; then
+ atf_skip "This test requires ipdivert"
+ fi
+}
+
+atf_test_case "in_div" "cleanup"
+in_div_head()
+{
+ atf_set descr 'Test inbound > diverted | divapp terminated'
+ atf_set require.user root
+ execenv_jail
+}
+in_div_body()
+{
+ firewall_init "ipfw"
+ divert_init
+ execenv_jail_init
+
+ epair=$(vnet_mkepair)
+ vnet_mkjail div ${epair}b
+ ifconfig ${epair}a 192.0.2.1/24 up
+ jexec div ifconfig ${epair}b 192.0.2.2/24 up
+ jexec div ipfw add 65534 allow all from any to any
+
+ # Sanity check
+ atf_check -s exit:0 -o ignore ping -c3 192.0.2.2
+
+ jexec div ipfw add 100 divert 2000 icmp from any to any in icmptypes 8
+
+ jexec div $(atf_get_srcdir)/../common/divapp 2000 &
+ divapp_pid=$!
+ # Wait for the divapp to be ready
+ sleep 1
+
+ # divapp is expected to "eat" the packet
+ atf_check -s not-exit:0 -o ignore ping -c1 192.0.2.2
+
+ wait $divapp_pid
+}
+in_div_cleanup()
+{
+ firewall_cleanup "ipfw"
+}
+
+atf_test_case "in_div_in" "cleanup"
+in_div_in_head()
+{
+ atf_set descr 'Test inbound > diverted > inbound | host terminated'
+ atf_set require.user root
+ execenv_jail
+}
+in_div_in_body()
+{
+ firewall_init "ipfw"
+ divert_init
+ execenv_jail_init
+
+ epair=$(vnet_mkepair)
+ vnet_mkjail div ${epair}b
+ ifconfig ${epair}a 192.0.2.1/24 up
+ jexec div ifconfig ${epair}b 192.0.2.2/24 up
+ jexec div ipfw add 65534 allow all from any to any
+
+ # Sanity check
+ atf_check -s exit:0 -o ignore ping -c3 192.0.2.2
+
+ jexec div ipfw add 100 divert 2000 icmp from any to any in icmptypes 8
+
+ jexec div $(atf_get_srcdir)/../common/divapp 2000 divert-back &
+ divapp_pid=$!
+ # Wait for the divapp to be ready
+ sleep 1
+
+ # divapp is NOT expected to "eat" the packet
+ atf_check -s exit:0 -o ignore ping -c1 192.0.2.2
+
+ wait $divapp_pid
+}
+in_div_in_cleanup()
+{
+ firewall_cleanup "ipfw"
+}
+
+atf_test_case "out_div" "cleanup"
+out_div_head()
+{
+ atf_set descr 'Test outbound > diverted | divapp terminated'
+ atf_set require.user root
+ execenv_jail
+}
+out_div_body()
+{
+ firewall_init "ipfw"
+ divert_init
+ execenv_jail_init
+
+ epair=$(vnet_mkepair)
+ vnet_mkjail div ${epair}b
+ ifconfig ${epair}a 192.0.2.1/24 up
+ jexec div ifconfig ${epair}b 192.0.2.2/24 up
+ jexec div ipfw add 65534 allow all from any to any
+
+ # Sanity check
+ atf_check -s exit:0 -o ignore ping -c3 192.0.2.2
+
+ jexec div ipfw add 100 divert 2000 icmp from any to any out icmptypes 0
+
+ jexec div $(atf_get_srcdir)/../common/divapp 2000 &
+ divapp_pid=$!
+ # Wait for the divapp to be ready
+ sleep 1
+
+ # divapp is expected to "eat" the packet
+ atf_check -s not-exit:0 -o ignore ping -c1 192.0.2.2
+
+ wait $divapp_pid
+}
+out_div_cleanup()
+{
+ firewall_cleanup "ipfw"
+}
+
+atf_test_case "out_div_out" "cleanup"
+out_div_out_head()
+{
+ atf_set descr 'Test outbound > diverted > outbound | network terminated'
+ atf_set require.user root
+ execenv_jail
+}
+out_div_out_body()
+{
+ firewall_init "ipfw"
+ divert_init
+ execenv_jail_init
+
+ epair=$(vnet_mkepair)
+ vnet_mkjail div ${epair}b
+ ifconfig ${epair}a 192.0.2.1/24 up
+ jexec div ifconfig ${epair}b 192.0.2.2/24 up
+ jexec div ipfw add 65534 allow all from any to any
+
+ # Sanity check
+ atf_check -s exit:0 -o ignore ping -c3 192.0.2.2
+
+ jexec div ipfw add 100 divert 2000 icmp from any to any out icmptypes 0
+
+ jexec div $(atf_get_srcdir)/../common/divapp 2000 divert-back &
+ divapp_pid=$!
+ # Wait for the divapp to be ready
+ sleep 1
+
+ # divapp is NOT expected to "eat" the packet
+ atf_check -s exit:0 -o ignore ping -c1 192.0.2.2
+
+ wait $divapp_pid
+}
+out_div_out_cleanup()
+{
+ firewall_cleanup "ipfw"
+}
+
+atf_test_case "in_div_in_fwd_out_div_out" "cleanup"
+in_div_in_fwd_out_div_out_head()
+{
+ atf_set descr 'Test inbound > diverted > inbound > forwarded > outbound > diverted > outbound | network terminated'
+ atf_set require.user root
+ execenv_jail
+}
+in_div_in_fwd_out_div_out_body()
+{
+ firewall_init "ipfw"
+ divert_init
+ execenv_jail_init
+
+ # host <a--epair0--b> router <a--epair1--b> site
+ epair0=$(vnet_mkepair)
+ epair1=$(vnet_mkepair)
+
+ vnet_mkjail router ${epair0}b ${epair1}a
+ ifconfig ${epair0}a 192.0.2.1/24 up
+ jexec router sysctl net.inet.ip.forwarding=1
+ jexec router ifconfig ${epair0}b 192.0.2.2/24 up
+ jexec router ifconfig ${epair1}a 198.51.100.1/24 up
+ jexec router ipfw add 65534 allow all from any to any
+
+ vnet_mkjail site ${epair1}b
+ jexec site ifconfig ${epair1}b 198.51.100.2/24 up
+ jexec site ipfw add 65534 allow all from any to any
+ jexec site route add default 198.51.100.1
+
+ route add -net 198.51.100.0/24 192.0.2.2
+
+ # Sanity check
+ atf_check -s exit:0 -o ignore ping -c3 192.0.2.2
+
+ # Should be routed without diversion
+ atf_check -s exit:0 -o ignore ping -c3 198.51.100.2
+
+ jexec router ipfw add 100 divert 2001 icmp from any to any in icmptypes 8
+ jexec router ipfw add 200 divert 2002 icmp from any to any out icmptypes 8
+
+ jexec router $(atf_get_srcdir)/../common/divapp 2001 divert-back &
+ indivapp_pid=$!
+ jexec router $(atf_get_srcdir)/../common/divapp 2002 divert-back &
+ outdivapp_pid=$!
+ # Wait for the divappS to be ready
+ sleep 1
+
+ # Both divappS are NOT expected to "eat" the packet
+ atf_check -s exit:0 -o ignore ping -c1 198.51.100.2
+
+ wait $indivapp_pid && wait $outdivapp_pid
+}
+in_div_in_fwd_out_div_out_cleanup()
+{
+ firewall_cleanup "ipfw"
+}
+
+atf_init_test_cases()
+{
+ atf_add_test_case "in_div"
+ atf_add_test_case "in_div_in"
+
+ atf_add_test_case "out_div"
+ atf_add_test_case "out_div_out"
+
+ atf_add_test_case "in_div_in_fwd_out_div_out"
+}
diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile
--- a/tests/sys/netpfil/pf/Makefile
+++ b/tests/sys/netpfil/pf/Makefile
@@ -2,7 +2,6 @@
PACKAGE= tests
TESTSDIR= ${TESTSBASE}/sys/netpfil/pf
-BINDIR= ${TESTSDIR}
TESTS_SUBDIRS+= ioctl
ATF_TESTS_SH+= altq \
@@ -47,8 +46,6 @@
# Tests reuse jail names and so cannot run in parallel.
TEST_METADATA+= is_exclusive=true
-PROGS= divapp
-
${PACKAGE}FILES+= CVE-2019-5597.py \
CVE-2019-5598.py \
daytime_inetd.conf \
diff --git a/tests/sys/netpfil/pf/divert-to.sh b/tests/sys/netpfil/pf/divert-to.sh
--- a/tests/sys/netpfil/pf/divert-to.sh
+++ b/tests/sys/netpfil/pf/divert-to.sh
@@ -110,7 +110,7 @@
"pass all" \
"pass in inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2000"
- jexec div $(atf_get_srcdir)/divapp 2000 &
+ jexec div $(atf_get_srcdir)/../common/divapp 2000 &
divapp_pid=$!
# Wait for the divapp to be ready
sleep 1
@@ -169,7 +169,7 @@
"pass all" \
"pass in inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2000 no state"
- jexec div $(atf_get_srcdir)/divapp 2000 divert-back &
+ jexec div $(atf_get_srcdir)/../common/divapp 2000 divert-back &
divapp_pid=$!
# Wait for the divapp to be ready
sleep 1
@@ -229,7 +229,7 @@
"pass in inet proto icmp icmp-type echoreq no state" \
"pass out inet proto icmp icmp-type echorep divert-to 127.0.0.1 port 2000 no state"
- jexec div $(atf_get_srcdir)/divapp 2000 &
+ jexec div $(atf_get_srcdir)/../common/divapp 2000 &
divapp_pid=$!
# Wait for the divapp to be ready
sleep 1
@@ -289,7 +289,7 @@
"pass in inet proto icmp icmp-type echoreq no state" \
"pass out inet proto icmp icmp-type echorep divert-to 127.0.0.1 port 2000 no state"
- jexec div $(atf_get_srcdir)/divapp 2000 divert-back &
+ jexec div $(atf_get_srcdir)/../common/divapp 2000 divert-back &
divapp_pid=$!
# Wait for the divapp to be ready
sleep 1
@@ -364,9 +364,9 @@
"pass in inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2001 no state" \
"pass out inet proto icmp icmp-type echoreq divert-to 127.0.0.1 port 2002 no state"
- jexec router $(atf_get_srcdir)/divapp 2001 divert-back &
+ jexec router $(atf_get_srcdir)/../common/divapp 2001 divert-back &
indivapp_pid=$!
- jexec router $(atf_get_srcdir)/divapp 2002 divert-back &
+ jexec router $(atf_get_srcdir)/../common/divapp 2002 divert-back &
outdivapp_pid=$!
# Wait for the divappS to be ready
sleep 1

File Metadata

Mime Type
text/plain
Expires
Tue, Jul 28, 12:26 AM (2 h, 58 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
29284094
Default Alt Text
D42314.1785198403.diff (12 KB)

Event Timeline