diff options
Diffstat (limited to 'tests/sys/netpfil/pf')
| -rw-r--r-- | tests/sys/netpfil/pf/Makefile | 7 | ||||
| -rw-r--r-- | tests/sys/netpfil/pf/anchor.sh | 46 | ||||
| -rw-r--r-- | tests/sys/netpfil/pf/bsnmpd.conf | 47 | ||||
| -rw-r--r-- | tests/sys/netpfil/pf/match.sh | 66 | ||||
| -rw-r--r-- | tests/sys/netpfil/pf/return.py | 153 | ||||
| -rw-r--r-- | tests/sys/netpfil/pf/snmp.sh | 123 | ||||
| -rw-r--r-- | tests/sys/netpfil/pf/table.sh | 55 |
7 files changed, 496 insertions, 1 deletions
diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile index 8a24fae47dcb..e3110d0e5df7 100644 --- a/tests/sys/netpfil/pf/Makefile +++ b/tests/sys/netpfil/pf/Makefile @@ -45,6 +45,7 @@ ATF_TESTS_SH+= altq \ sctp \ set_skip \ set_tos \ + snmp \ src_track \ status \ syncookie \ @@ -57,13 +58,16 @@ ATF_TESTS_PYTEST+= frag6.py ATF_TESTS_PYTEST+= icmp.py ATF_TESTS_PYTEST+= nat64.py ATF_TESTS_PYTEST+= nat66.py +ATF_TESTS_PYTEST+= return.py ATF_TESTS_PYTEST+= sctp.py # Allow tests to run in parallel in their own jails TEST_METADATA+= execenv="jail" TEST_METADATA+= execenv_jail_params="vnet allow.raw_sockets" -${PACKAGE}FILES+= CVE-2019-5597.py \ +${PACKAGE}FILES+= \ + bsnmpd.conf \ + CVE-2019-5597.py \ CVE-2019-5598.py \ daytime_inetd.conf \ echo_inetd.conf \ @@ -79,6 +83,7 @@ ${PACKAGE}FILES+= CVE-2019-5597.py \ rdr-srcport.py \ utils.subr +${PACKAGE}FILESMODE_bsnmpd.conf= 0555 ${PACKAGE}FILESMODE_CVE-2019-5597.py= 0555 ${PACKAGE}FILESMODE_CVE-2019-5598.py= 0555 ${PACKAGE}FILESMODE_fragcommon.py= 0555 diff --git a/tests/sys/netpfil/pf/anchor.sh b/tests/sys/netpfil/pf/anchor.sh index 40e8354a2343..463cd4d475e3 100644 --- a/tests/sys/netpfil/pf/anchor.sh +++ b/tests/sys/netpfil/pf/anchor.sh @@ -316,6 +316,51 @@ counter_cleanup() pft_cleanup } +atf_test_case "nat" "cleanup" +nat_head() +{ + atf_set descr 'Test nested nat anchors' + atf_set require.user root +} + +nat_body() +{ + pft_init + + epair=$(vnet_mkepair) + vnet_mkjail alcatraz ${epair}a + + ifconfig ${epair}b 192.0.2.2/24 up + jexec alcatraz ifconfig ${epair}a 192.0.2.1/24 up + + # Sanity check + atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1 + + jexec alcatraz pfctl -e + pft_set_rules alcatraz \ + "nat-anchor \"foo/*\"" \ + "pass" + + echo "nat log on ${epair}a inet from 192.0.2.0/24 to any port = 53 -> 192.0.2.1" \ + | jexec alcatraz pfctl -a "foo/bar" -g -f - + echo "rdr on ${epair}a proto tcp to port echo -> 127.0.0.1 port echo" \ + | jexec alcatraz pfctl -a "foo/baz" -g -f - + + jexec alcatraz pfctl -sn -a "*" + jexec alcatraz pfctl -sn -a "foo/bar" + jexec alcatraz pfctl -sn -a "foo/baz" + + atf_check -s exit:0 -o match:"nat log on epair0a inet from 192.0.2.0/24 to any port = domain -> 192.0.2.1" \ + jexec alcatraz pfctl -sn -a "*" + atf_check -s exit:0 -o match:"rdr on epair0a inet proto tcp from any to any port = echo -> 127.0.0.1 port 7" \ + jexec alcatraz pfctl -sn -a "*" +} + +nat_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "pr183198" @@ -326,4 +371,5 @@ atf_init_test_cases() atf_add_test_case "quick" atf_add_test_case "quick_nested" atf_add_test_case "counter" + atf_add_test_case "nat" } diff --git a/tests/sys/netpfil/pf/bsnmpd.conf b/tests/sys/netpfil/pf/bsnmpd.conf new file mode 100644 index 000000000000..27abdda6cbd3 --- /dev/null +++ b/tests/sys/netpfil/pf/bsnmpd.conf @@ -0,0 +1,47 @@ +location := "A galaxy far, far away" +contact := "skywalker@Tatooine" +system := 1 + +read := "public" +write := "geheim" +trap := "mytrap" + +NoAuthProtocol := 1.3.6.1.6.3.10.1.1.1 +HMACMD5AuthProtocol := 1.3.6.1.6.3.10.1.1.2 +HMACSHAAuthProtocol := 1.3.6.1.6.3.10.1.1.3 +NoPrivProtocol := 1.3.6.1.6.3.10.1.2.1 +DESPrivProtocol := 1.3.6.1.6.3.10.1.2.2 +AesCfb128Protocol := 1.3.6.1.6.3.10.1.2.4 + +securityModelAny := 0 +securityModelSNMPv1 := 1 +securityModelSNMPv2c := 2 +securityModelUSM := 3 + +MPmodelSNMPv1 := 0 +MPmodelSNMPv2c := 1 +MPmodelSNMPv3 := 3 + +noAuthNoPriv := 1 +authNoPriv := 2 +authPriv := 3 + +%snmpd +begemotSnmpdDebugDumpPdus = 2 +begemotSnmpdDebugSyslogPri = 7 + +begemotSnmpdCommunityString.0.1 = $(read) +begemotSnmpdCommunityDisable = 1 + +begemotSnmpdTransInetStatus.1.4.0.0.0.0.161.1 = 4 +begemotSnmpdTransInetStatus.2.16.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.161.1 = 4 + +begemotSnmpdLocalPortStatus."/var/run/snmpd.sock" = 1 +begemotSnmpdLocalPortType."/var/run/snmpd.sock" = 4 + +sysContact = $(contact) +sysLocation = $(location) +sysObjectId = 1.3.6.1.4.1.12325.1.1.2.1.$(system) + +begemotSnmpdModulePath."mibII" = "/usr/lib/snmp_mibII.so" +begemotSnmpdModulePath."pf" = "/usr/lib/snmp_pf.so" diff --git a/tests/sys/netpfil/pf/match.sh b/tests/sys/netpfil/pf/match.sh index 93b908e62f2d..58c1e021310a 100644 --- a/tests/sys/netpfil/pf/match.sh +++ b/tests/sys/netpfil/pf/match.sh @@ -26,6 +26,8 @@ . $(atf_get_srcdir)/utils.subr +common_dir=$(atf_get_srcdir)/../common + atf_test_case "dummynet" "cleanup" dummynet_head() { @@ -112,8 +114,72 @@ quick_cleanup() pft_cleanup } +atf_test_case "allow_opts" "cleanup" +allow_opts_head() +{ + atf_set descr 'Test allowing IP options via match' + atf_set require.user root + atf_set require.progs python3 scapy +} + +allow_opts_body() +{ + pft_init + + epair=$(vnet_mkepair) + + ifconfig ${epair}b 192.0.2.2/24 up + + vnet_mkjail alcatraz ${epair}a + jexec alcatraz ifconfig ${epair}a 192.0.2.1/24 up + + jexec alcatraz pfctl -e + jexec alcatraz pfctl -x loud + pft_set_rules alcatraz \ + "match proto icmp allow-opts" \ + "pass" + + # Sanity check + atf_check -s exit:0 -o ignore \ + ping -c 1 192.0.2.1 + + atf_check -s exit:0 -o ignore \ + ${common_dir}/pft_ping.py \ + --sendif ${epair}b \ + --to 192.0.2.1 \ + --send-nop \ + --replyif ${epair}b + + # This doesn't work without 'allow-opts' + pft_set_rules alcatraz \ + "match proto icmp" \ + "pass" + atf_check -s exit:1 -o ignore \ + ${common_dir}/pft_ping.py \ + --sendif ${epair}b \ + --to 192.0.2.1 \ + --send-nop \ + --replyif ${epair}b + + # Setting it on a pass rule still works. + pft_set_rules alcatraz \ + "pass allow-opts" + atf_check -s exit:0 -o ignore \ + ${common_dir}/pft_ping.py \ + --sendif ${epair}b \ + --to 192.0.2.1 \ + --send-nop \ + --replyif ${epair}b +} + +allow_opts_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "dummynet" atf_add_test_case "quick" + atf_add_test_case "allow_opts" } diff --git a/tests/sys/netpfil/pf/return.py b/tests/sys/netpfil/pf/return.py new file mode 100644 index 000000000000..753012860764 --- /dev/null +++ b/tests/sys/netpfil/pf/return.py @@ -0,0 +1,153 @@ +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2025 Rubicon Communications, LLC (Netgate) +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +import pytest +import subprocess +import re +from atf_python.sys.net.tools import ToolsHelper +from atf_python.sys.net.vnet import VnetTestTemplate + +def check(cmd): + ps = subprocess.Popen(cmd, shell=True) + ret = ps.wait() + if ret != 0: + raise Exception("Command %s returned %d" % (cmd, ret)) + +class TestReturn(VnetTestTemplate): + REQUIRED_MODULES = [ "pf" ] + TOPOLOGY = { + "vnet1": {"ifaces": ["if1"]}, + "vnet2": {"ifaces": ["if1", "if2"]}, + "vnet3": {"ifaces": ["if2"]}, + "if1": {"prefixes4": [("192.0.2.2/24", "192.0.2.1/24")]}, + "if2": {"prefixes4": [("198.51.100.1/24", "198.51.100.2/24")]}, + } + + def vnet2_handler(self, vnet): + ifname = vnet.iface_alias_map["if1"].name + if2name = vnet.iface_alias_map["if2"].name + + ToolsHelper.print_output("/sbin/pfctl -e") + ToolsHelper.pf_rules([ + "nat on %s inet from 192.0.2.0/24 to any -> (%s)" % (ifname, ifname), + "block return", + "pass inet proto icmp icmp-type echoreq", + ]) + + ToolsHelper.print_output("/sbin/sysctl net.inet.ip.forwarding=1") + ToolsHelper.print_output("/sbin/pfctl -x loud") + + def vnet3_handler(self, vnet): + ToolsHelper.print_output("/sbin/route add default 198.51.100.1") + + def common_setup(self): + ToolsHelper.print_output("/sbin/route add default 192.0.2.1") + + # Sanity check + check("/sbin/ping -c 1 192.0.2.1") + check("/sbin/ping -c 1 198.51.100.1") + check("/sbin/ping -c 2 198.51.100.2") + + @pytest.mark.require_user("root") + @pytest.mark.require_progs(["scapy"]) + def test_tcp(self): + self.common_setup() + + # Import in the correct vnet, so at to not confuse Scapy + import scapy.all as sp + + # Send a TCP SYN, expect a RST + pkt = sp.IP(src="192.0.2.2", dst="198.51.100.2") \ + / sp.TCP(sport=4321, dport=1234, flags="S") + print(pkt) + reply = sp.sr1(pkt, timeout=3, verbose=False) + print(reply) + + ip = reply.getlayer(sp.IP) + tcp = reply.getlayer(sp.TCP) + assert ip + assert ip.src == "198.51.100.2" + assert ip.dst == "192.0.2.2" + assert tcp + assert tcp.sport == 1234 + assert tcp.dport == 4321 + assert "R" in tcp.flags + + @pytest.mark.require_user("root") + @pytest.mark.require_progs(["scapy"]) + def test_udp(self): + self.common_setup() + + # Import in the correct vnet, so at to not confuse Scapy + import scapy.all as sp + + # Send a UDP packet, expect ICMP error + pkt = sp.IP(dst="198.51.100.2") \ + / sp.UDP(sport=4321, dport=1234) + print(pkt) + reply = sp.sr1(pkt, timeout=3, verbose=False) + print(reply) + ip = reply.getlayer(sp.IP) + icmp = reply.getlayer(sp.ICMP) + udp = reply.getlayer(sp.UDPerror) + + assert ip + assert ip.src == "192.0.2.1" + assert ip.dst == "192.0.2.2" + assert icmp + assert icmp.type == 3 + assert icmp.code == 3 + assert udp + assert udp.sport == 4321 + assert udp.dport == 1234 + + @pytest.mark.require_user("root") + @pytest.mark.require_progs(["scapy"]) + def test_sctp(self): + self.common_setup() + + # Import in the correct vnet, so at to not confuse Scapy + import scapy.all as sp + + # Send an SCTP init, expect an SCTP abort + pkt = sp.IP(dst="198.51.100.2") \ + / sp.SCTP(sport=1111, dport=2222) \ + / sp.SCTPChunkInit(init_tag=1, n_in_streams=1, n_out_streams=1, a_rwnd=1500) + print(pkt) + reply = sp.sr1(pkt, timeout=3, verbose=False) + print(reply) + ip = reply.getlayer(sp.IP) + sctp = reply.getlayer(sp.SCTP) + abort = reply.getlayer(sp.SCTPChunkAbort) + print(sctp) + + assert ip + assert ip.src == "198.51.100.2" + assert ip.dst == "192.0.2.2" + assert sctp + assert sctp.sport == 2222 + assert sctp.dport == 1111 + assert(abort) diff --git a/tests/sys/netpfil/pf/snmp.sh b/tests/sys/netpfil/pf/snmp.sh new file mode 100644 index 000000000000..37cc4b75cf92 --- /dev/null +++ b/tests/sys/netpfil/pf/snmp.sh @@ -0,0 +1,123 @@ +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2025 Kristof Provost <kp@FreeBSD.org> +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +. $(atf_get_srcdir)/utils.subr + +atf_test_case "basic" "cleanup" +basic_head() +{ + atf_set descr 'Basic pf_snmp test' + atf_set require.user root +} + +basic_body() +{ + pft_init + + epair=$(vnet_mkepair) + + ifconfig ${epair}b 192.0.2.2/24 up + + vnet_mkjail alcatraz ${epair}a + jexec alcatraz ifconfig ${epair}a 192.0.2.1/24 up + + # Start bsnmpd + jexec alcatraz bsnmpd -c $(atf_get_srcdir)/bsnmpd.conf + + jexec alcatraz pfctl -e + pft_set_rules alcatraz \ + "pass" + + # Sanity check, and create state + atf_check -s exit:0 -o ignore \ + ping -c 1 192.0.2.1 + + # pf should be enabled + atf_check -s exit:0 -o match:'pfStatusRunning.0 = true' \ + bsnmpwalk -s public@192.0.2.1 -i pf_tree.def begemot +} + +basic_cleanup() +{ + pft_cleanup +} + +atf_test_case "table" "cleanup" +table_head() +{ + atf_set descr 'Test tables and pf_snmp' + atf_set require.user root +} + +table_body() +{ + pft_init + + epair=$(vnet_mkepair) + + ifconfig ${epair}b 192.0.2.2/24 up + + vnet_mkjail alcatraz ${epair}a + jexec alcatraz ifconfig ${epair}a 192.0.2.1/24 up + + jexec alcatraz pfctl -e + pft_set_rules alcatraz \ + "table <foo> counters { 192.0.2.0/24 }" \ + "pass in from <foo>" + + # Start bsnmpd after creating the table so we don't have to wait for + # a refresh timeout + jexec alcatraz bsnmpd -c $(atf_get_srcdir)/bsnmpd.conf + + # Sanity check, and create state + atf_check -s exit:0 -o ignore \ + ping -c 1 192.0.2.1 + + # We should have one table + atf_check -s exit:0 -o match:'pfTablesTblNumber.0 = 1' \ + bsnmpwalk -s public@192.0.2.1 -i pf_tree.def begemot + + # We have the 'foo' table + atf_check -s exit:0 -o match:'pfTablesTblDescr.* = foo' \ + bsnmpwalk -s public@192.0.2.1 -i pf_tree.def pfTables + + # Which contains address 192.0.2.0/24 + atf_check -s exit:0 -o match:'pfTablesAddrNet.* = 192.0.2.0' \ + bsnmpwalk -s public@192.0.2.1 -i pf_tree.def pfTables + atf_check -s exit:0 -o match:'pfTablesAddrPrefix.* = 24' \ + bsnmpwalk -s public@192.0.2.1 -i pf_tree.def pfTables +} + +table_cleanup() +{ + pft_cleanup +} + +atf_init_test_cases() +{ + atf_add_test_case "basic" + atf_add_test_case "table" +} diff --git a/tests/sys/netpfil/pf/table.sh b/tests/sys/netpfil/pf/table.sh index a3d00f8cdb14..78320375db7c 100644 --- a/tests/sys/netpfil/pf/table.sh +++ b/tests/sys/netpfil/pf/table.sh @@ -236,6 +236,60 @@ zero_one_cleanup() pft_cleanup } +atf_test_case "zero_all" "cleanup" +zero_all_head() +{ + atf_set descr 'Test zeroing all table entries' + atf_set require.user root +} + +zero_all_body() +{ + pft_init + + epair_send=$(vnet_mkepair) + ifconfig ${epair_send}a 192.0.2.1/24 up + ifconfig ${epair_send}a inet alias 192.0.2.3/24 + + vnet_mkjail alcatraz ${epair_send}b + jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + pft_set_rules alcatraz \ + "table <foo> counters { 192.0.2.1, 192.0.2.3 }" \ + "block all" \ + "pass in from <foo> to any" \ + "pass out from any to <foo>" \ + "set skip on lo" + + atf_check -s exit:0 -o ignore ping -c 3 -S 192.0.2.1 192.0.2.2 + atf_check -s exit:0 -o ignore ping -c 3 -S 192.0.2.3 192.0.2.2 + + jexec alcatraz pfctl -t foo -T show -vv + atf_check -s exit:0 -e ignore \ + -o match:'In/Block:.*'"$TABLE_STATS_ZERO_REGEXP" \ + -o match:'In/Pass:.*'"$TABLE_STATS_NONZERO_REGEXP" \ + -o match:'Out/Block:.*'"$TABLE_STATS_ZERO_REGEXP" \ + -o match:'Out/Pass:.*'"$TABLE_STATS_NONZERO_REGEXP" \ + jexec alcatraz pfctl -t foo -T show -vv + + atf_check -s exit:0 -e ignore \ + jexec alcatraz pfctl -t foo -T zero + + jexec alcatraz pfctl -t foo -T show -vv + atf_check -s exit:0 -e ignore \ + -o match:'In/Pass:.*'"$TABLE_STATS_ZERO_REGEXP" \ + -o match:'Out/Pass:.*'"$TABLE_STATS_ZERO_REGEXP" \ + -o match:'In/Pass:.*'"$TABLE_STATS_ZERO_REGEXP" \ + -o match:'Out/Pass:.*'"$TABLE_STATS_ZERO_REGEXP" \ + jexec alcatraz pfctl -t foo -T show -vv +} + +zero_all_cleanup() +{ + pft_cleanup +} + atf_test_case "reset_nonzero" "cleanup" reset_nonzero_head() { @@ -534,6 +588,7 @@ atf_init_test_cases() atf_add_test_case "v6_counters" atf_add_test_case "match_counters" atf_add_test_case "zero_one" + atf_add_test_case "zero_all" atf_add_test_case "reset_nonzero" atf_add_test_case "pr251414" atf_add_test_case "automatic" |