pf: fix double ruleset evaluation for fragments sent to dummynet

The function `pf_setup_pdesc()` handles ruleset evaluation for non-reassembled
packets. Having it called before `pf_mtag` is checked

pf: fix double ruleset evaluation for fragments sent to dummynet

The function `pf_setup_pdesc()` handles ruleset evaluation for non-reassembled
packets. Having it called before `pf_mtag` is checked for flags
`PF_MTAG_FLAG_ROUTE_TO` and `PF_MTAG_FLAG_DUMMYNET` will cause loops for
fragmented packets if reassembly is disabled.

Move `pd` zeroing and `pf_mtag` extraction from `pf_setup_pdesc()` to a separate
function `pf_init_pdesc()` and change the order of function calls: first
call `pf_init_pdesc()`, then check if the currently processed packet has been
reinjected from dummynet, finally call `pf_setup_pdesc()`.

Add functionality of sending UDP packets to `pft_ping.py` with fragmentation
support and fix broken IPv6 reassembly.

Reviewed by: kp
Differential Revision: https://reviews.freebsd.org/D46880

show more ...

pf tests: Add option to send fragmented packets

Add option to send fragmented packets and to properly sniff them by
reassembling them by the sniffer itself.

Reviewed by: kp
Sponsored by: InnoGames

pf tests: Add option to send fragmented packets

Add option to send fragmented packets and to properly sniff them by
reassembling them by the sniffer itself.

Reviewed by: kp
Sponsored by: InnoGames GmbH
Differential Revision: https://reviews.freebsd.org/D42354

show more ...

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.

Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix

show more ...

netpfil tests: improve sniffer.py

Multiple improvements to sniffer.py:

* Remove ambiguity of configuring recvif, it must be now explicitly specified.
* Don't catch exceptions around creating the sn

netpfil tests: improve sniffer.py

Multiple improvements to sniffer.py:

* Remove ambiguity of configuring recvif, it must be now explicitly specified.
* Don't catch exceptions around creating the sniffer, let it properly
fail and display the whole stack trace.
* Count correct packets so that duplicates can be found.

MFC after: 1 week
Sponsored by: InnoGames GmbH
Differential Revision: https://reviews.freebsd.org/D38120

show more ...

tests: make sniffer more robust

The Sniffer class is often used by test tools such as pft_ping to verify
that packets actually get sent where they're expected.

It starts a background thread to capt

tests: make sniffer more robust

The Sniffer class is often used by test tools such as pft_ping to verify
that packets actually get sent where they're expected.

It starts a background thread to capture packets, but this thread needs
some time to start, leading to intermittent test failures when the
capture doesn't start before the relevant packet is sent.

Add a semaphore to ensure the Sniffer constructor doesn't return until
the capture is actually running.

PR: 260461
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

net tests: basic test case for bpf(4)'s ability to set vlan pcp

Use dhclient with its 'vlan-pcp' option to set a VLAN PCP value and
verify that it actually gets set.

MFC after: 1 week
Sponsored by:

net tests: basic test case for bpf(4)'s ability to set vlan pcp

Use dhclient with its 'vlan-pcp' option to set a VLAN PCP value and
verify that it actually gets set.

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D31276

show more ...

pf tests: Test that dup-to doesn't produce extra duplicate packets

netpfil tests: Add missing copyright & license statements

netpfil tests: Move pft_ping.py and sniffer.py to the common test directory

The pft_ping.py and sniffer.py tool is moved from tests/sys/netpfil/pf to
tests/sys/netpfil/common directory because these

netpfil tests: Move pft_ping.py and sniffer.py to the common test directory

The pft_ping.py and sniffer.py tool is moved from tests/sys/netpfil/pf to
tests/sys/netpfil/common directory because these tools are to be used in
common for all the firewalls.

Submitted by: Ahsan Barkati
Reviewed by: kp, thj
Sponsored by: Google, Inc. (GSoC 2019)
Differential Revision: https://reviews.freebsd.org/D21276

show more ...