The branch stable/13 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=b1b8f5a15fc0fde1aea5eea5d1ecb7cfbee89d19
commit b1b8f5a15fc0fde1aea5eea5d1ecb7cfbee89d19 Author: Kristof Provost <[email protected]> AuthorDate: 2022-10-31 11:15:58 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2023-08-28 08:17:18 +0000 pf tests: verify syncookie status report Verify that pfctl -si -v correctly shows syncookies to be active/inactive. Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit b0bf4303109a76eb4224015b9abebf88e96116ef) --- tests/sys/netpfil/pf/syncookie.sh | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/tests/sys/netpfil/pf/syncookie.sh b/tests/sys/netpfil/pf/syncookie.sh index eb9f8c737476..290b61817471 100644 --- a/tests/sys/netpfil/pf/syncookie.sh +++ b/tests/sys/netpfil/pf/syncookie.sh @@ -28,6 +28,14 @@ common_dir=$(atf_get_srcdir)/../common +syncookie_state() +{ + jail=$1 + + jexec $jail pfctl -si -v | grep -A 2 '^Syncookies' | grep active \ + | awk '{ print($2); }' +} + atf_test_case "basic" "cleanup" basic_head() { @@ -62,6 +70,14 @@ basic_body() then atf_fail "Failed to connect to syncookie protected echo daemon" fi + + + # Check that status shows syncookies as being active + active=$(syncookie_state alcatraz) + if [ "$active" != "active" ]; + then + atf_fail "syncookies not active" + fi } basic_cleanup() @@ -195,12 +211,26 @@ adaptive_body() # Sanity check atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1 + # Check that status shows syncookies as being inactive + active=$(syncookie_state alcatraz) + if [ "$active" != "inactive" ]; + then + atf_fail "syncookies active when they should not be" + fi + # Now syn flood to create many states ${common_dir}/pft_synflood.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --count 100 + # Check that status shows syncookies as being active + active=$(syncookie_state alcatraz) + if [ "$active" != "active" ]; + then + atf_fail "syncookies not active" + fi + # Adaptive mode should kick in and stop us from creating more than # about 10 states states=$(jexec alcatraz pfctl -ss | grep tcp | wc -l)
