Author: kp
Date: Mon Oct 16 15:01:49 2017
New Revision: 324662
URL: https://svnweb.freebsd.org/changeset/base/324662
Log:
pf: test set-tos
Introduce tests for the set-tos feature of pf. Teach pft_ping.py to send
and verify ToS flags.
Added:
head/tests/sys/netpfil/pf/set_tos.sh (contents, props changed)
Modified:
head/tests/sys/netpfil/pf/Makefile
head/tests/sys/netpfil/pf/pft_ping.py
Modified: head/tests/sys/netpfil/pf/Makefile
==============================================================================
--- head/tests/sys/netpfil/pf/Makefile Mon Oct 16 12:54:53 2017
(r324661)
+++ head/tests/sys/netpfil/pf/Makefile Mon Oct 16 15:01:49 2017
(r324662)
@@ -5,7 +5,8 @@ PACKAGE= tests
TESTSDIR= ${TESTSBASE}/sys/netpfil/pf
ATF_TESTS_SH+= pass_block \
- forward
+ forward \
+ set_tos
${PACKAGE}FILES+= utils.subr \
pft_ping.py
Modified: head/tests/sys/netpfil/pf/pft_ping.py
==============================================================================
--- head/tests/sys/netpfil/pf/pft_ping.py Mon Oct 16 12:54:53 2017
(r324661)
+++ head/tests/sys/netpfil/pf/pft_ping.py Mon Oct 16 15:01:49 2017
(r324662)
@@ -18,7 +18,7 @@ class Sniffer(threading.Thread):
def run(self):
self.packets = sp.sniff(iface=self._recvif, timeout=3)
-def check_ping_request(packet, dst_ip):
+def check_ping_request(packet, dst_ip, args):
"""
Verify that the packet matches what we'd have sent
"""
@@ -40,13 +40,27 @@ def check_ping_request(packet, dst_ip):
if raw.load != str(PAYLOAD_MAGIC):
return False
+ # Wait to check expectations until we've established this is the packet
we
+ # sent.
+ if args.expect_tos:
+ if ip.tos != int(args.expect_tos[0]):
+ print "Unexpected ToS value %d, expected %s" \
+ % (ip.tos, args.expect_tos[0])
+ return False
+
+
return True
-def ping(send_if, dst_ip):
- req = sp.Ether() \
- / sp.IP(dst=dst_ip) \
- / sp.ICMP(type='echo-request') \
- / sp.Raw(PAYLOAD_MAGIC)
+def ping(send_if, dst_ip, args):
+ ether = sp.Ether()
+ ip = sp.IP(dst=dst_ip)
+ icmp = sp.ICMP(type='echo-request')
+ raw = sp.Raw(PAYLOAD_MAGIC)
+
+ if args.send_tos:
+ ip.tos = int(args.send_tos[0])
+
+ req = ether / ip / icmp / raw
sp.sendp(req, iface=send_if, verbose=False)
def main():
@@ -61,19 +75,27 @@ def main():
required=True,
help='The destination IP address for the ICMP echo request')
+ # Packet settings
+ parser.add_argument('--send-tos', nargs=1,
+ help='Set the ToS value for the transmitted packet')
+
+ # Expectations
+ parser.add_argument('--expect-tos', nargs=1,
+ help='The expected ToS value in the received packet')
+
args = parser.parse_args()
sniffer = None
if not args.recvif is None:
sniffer = Sniffer(args.recvif[0])
- ping(args.sendif[0], args.to[0])
+ ping(args.sendif[0], args.to[0], args)
if sniffer:
sniffer.join()
for packet in sniffer.packets:
- if check_ping_request(packet, args.to[0]):
+ if check_ping_request(packet, args.to[0], args):
sys.exit(0)
# We did not get the packet we expected
Added: head/tests/sys/netpfil/pf/set_tos.sh
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/tests/sys/netpfil/pf/set_tos.sh Mon Oct 16 15:01:49 2017
(r324662)
@@ -0,0 +1,92 @@
+# $FreeBSD$
+
+. $(atf_get_srcdir)/utils.subr
+
+atf_test_case "v4" "cleanup"
+v4_head()
+{
+ atf_set descr 'set-tos test'
+ atf_set require.user root
+
+ # We need scapy to be installed for out test scripts to work
+ atf_set require.progs scapy
+}
+
+v4_body()
+{
+ pft_init
+
+ epair_send=$(pft_mkepair)
+ ifconfig ${epair_send}a 192.0.2.1/24 up
+
+ epair_recv=$(pft_mkepair)
+ ifconfig ${epair_recv}a up
+
+ pft_mkjail alcatraz ${epair_send}b ${epair_recv}b
+ jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
+ jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up
+ jexec alcatraz sysctl net.inet.ip.forwarding=1
+ jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05
+ route add -net 198.51.100.0/24 192.0.2.2
+
+ # No change is done if not requested
+ printf "scrub out proto icmp\n" | jexec alcatraz pfctl -ef -
+ atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \
+ --sendif ${epair_send}a \
+ --to 198.51.100.3 \
+ --recvif ${epair_recv}a \
+ --expect-tos 42
+
+ # The requested ToS is set
+ printf "scrub out proto icmp set-tos 42\n" | jexec alcatraz pfctl -f -
+ atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
+ --sendif ${epair_send}a \
+ --to 198.51.100.3 \
+ --recvif ${epair_recv}a \
+ --expect-tos 42
+
+ # ToS is not changed if the scrub rule does not match
+ printf "scrub out proto tcp set-tos 42\n" | jexec alcatraz pfctl -f -
+ atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \
+ --sendif ${epair_send}a \
+ --to 198.51.100.3 \
+ --recvif ${epair_recv}a \
+ --expect-tos 42
+
+ # Multiple scrub rules match as expected
+ printf "scrub out proto tcp set-tos 13\nscrub out proto icmp set-tos
14\n" \
+ | jexec alcatraz pfctl -f -
+ atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
+ --sendif ${epair_send}a \
+ --to 198.51.100.3 \
+ --recvif ${epair_recv}a \
+ --expect-tos 14
+
+ # And this works even if the packet already has ToS values set
+ atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
+ --sendif ${epair_send}a \
+ --to 198.51.100.3 \
+ --recvif ${epair_recv}a \
+ --send-tos 42 \
+ --expect-tos 14
+
+ # ToS values are unmolested if the packets do not match a scrub rule
+ printf "scrub out proto tcp set-tos 13\n" \
+ | jexec alcatraz pfctl -f -
+ atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
+ --sendif ${epair_send}a \
+ --to 198.51.100.3 \
+ --recvif ${epair_recv}a \
+ --send-tos 42 \
+ --expect-tos 42
+}
+
+v4_cleanup()
+{
+ pft_cleanup
+}
+
+atf_init_test_cases()
+{
+ atf_add_test_case "v4"
+}
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
