The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=3ec4fbdd98f21463c8d12f1468a07f45100680cf
commit 3ec4fbdd98f21463c8d12f1468a07f45100680cf Author: Kajetan Staszkiewicz <[email protected]> AuthorDate: 2024-09-28 21:24:47 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2024-09-30 07:48:40 +0000 pf tests: Add test for max-src-states Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D46840 --- tests/sys/netpfil/pf/src_track.sh | 66 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/tests/sys/netpfil/pf/src_track.sh b/tests/sys/netpfil/pf/src_track.sh index eb053dd84a90..2038393a240e 100755 --- a/tests/sys/netpfil/pf/src_track.sh +++ b/tests/sys/netpfil/pf/src_track.sh @@ -120,8 +120,74 @@ max_src_conn_rule_cleanup() pft_cleanup } +max_src_states_rule_head() +{ + atf_set descr 'Max states per source per rule' + atf_set require.user root +} + +max_src_states_rule_body() +{ + setup_router_server_ipv6 + + # Clients will connect from another network behind the router. + # This allows for using multiple source addresses and for tester jail + # to not respond with RST packets for SYN+ACKs. + jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 + jexec server route add -6 2001:db8:44::0/64 2001:db8:43::1 + + pft_set_rules router \ + "block" \ + "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ + "pass in on ${epair_tester}b inet6 proto tcp from port 4210:4219 keep state (max-src-states 3 source-track rule) label rule_A" \ + "pass in on ${epair_tester}b inet6 proto tcp from port 4220:4229 keep state (max-src-states 3 source-track rule) label rule_B" \ + "pass out on ${epair_server}a keep state" + + # The option max-src-states prevents even the initial SYN packet going + # through. It's enough that we check ping_server_check_reply, no need to + # bother checking created states. + + # 2 connections from host ::1 matching rule_A will be allowed, 1 will fail to create a state. + ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4211 --fromaddr 2001:db8:44::1 + ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4212 --fromaddr 2001:db8:44::1 + ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4213 --fromaddr 2001:db8:44::1 + + # 2 connections from host ::1 matching rule_B will be allowed, 1 will fail to create a state. + # Limits from rule_A don't interfere with rule_B. + ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4221 --fromaddr 2001:db8:44::1 + ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4222 --fromaddr 2001:db8:44::1 + ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4223 --fromaddr 2001:db8:44::1 + + # 2 connections from host ::2 matching rule_B will be allowed, 1 will fail to create a state. + # Limits for host ::1 will not interfere with host ::2. + ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4224 --fromaddr 2001:db8:44::2 + ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4225 --fromaddr 2001:db8:44::2 + ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4226 --fromaddr 2001:db8:44::2 + + # We will check the resulting source nodes, though. + # Order of source nodes in output is not guaranteed, find each one separately. + nodes=$(mktemp) || exit 1 + jexec router pfctl -qvsS > $nodes + for node_regexp in \ + '2001:db8:44::1 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 3' \ + '2001:db8:44::1 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 4' \ + '2001:db8:44::2 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 4' \ + ; do + cat $nodes | tr '\n' ' ' | grep -qE "$node_regexp" || atf_fail "Source nodes not matching expected output" + done + + # Check if limit counters have been properly set. + jexec router pfctl -qvvsi | grep -qE 'max-src-states\s+3\s+' || atf_fail "max-src-states not set to 3" +} + +max_src_states_rule_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "source_track" atf_add_test_case "max_src_conn_rule" + atf_add_test_case "max_src_states_rule" }
