ipfw: fix IPv6 flow label matching* do not require just only ip6 proto for flow-id opcode in ipfw(8). ipv6-icmp, tcp, udp should be fine too.* fix off-by-one bug leading to out-of-bounds read.*
ipfw: fix IPv6 flow label matching* do not require just only ip6 proto for flow-id opcode in ipfw(8). ipv6-icmp, tcp, udp should be fine too.* fix off-by-one bug leading to out-of-bounds read.* apply IPV6_FLOWLABEL_MASK before comparison in flow6id_match(), so flow-id opcode will match a specified flow label. No need to take protocol version and traffic class into account.* add the test to verify that opcode is working correctly.Reviewed by: pouriaObtained from: Yandex LLCMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D56869
show more ...
tests/ipfw: Make tests run more reliably in parallel- Don't use /dev/null as the pidfile for inetd, that doesn't work properly. Create a pidfile in the per-test scratch directory.- Use atf_chec
tests/ipfw: Make tests run more reliably in parallel- Don't use /dev/null as the pidfile for inetd, that doesn't work properly. Create a pidfile in the per-test scratch directory.- Use atf_check to validate results from setup commands.MFC after: 1 week
ipfw: add support for masked ip-address lookupsCurrent radix-based implementation of lookup tables in ipfw doesnot support non-contiguous prefixes while this type of lookup isneeded to write CPU-
ipfw: add support for masked ip-address lookupsCurrent radix-based implementation of lookup tables in ipfw doesnot support non-contiguous prefixes while this type of lookup isneeded to write CPU-effective firewall configurations.For some of the cases we can reach the goal using a masked tablelookup by adding masked (e.g. zero non-significant bits) recordsinto a table and then zero non-significant bits in lookup keyprior to making a table lookup.Obtained from: Yandex LLCMFC after: 3 weeksRelnotes: yesSponsored by: Yandex LLCDifferential Revision: https://reviews.freebsd.org/D53694
tests/ipfw: fix log:bpf test flakynessThere were several problems:o Using 'netstat -B' is not a reliable way to make sure that all tcpdumps have attached to bpf(4). The problem is that tcpdump
tests/ipfw: fix log:bpf test flakynessThere were several problems:o Using 'netstat -B' is not a reliable way to make sure that all tcpdumps have attached to bpf(4). The problem is that tcpdump (via libpcap) does several ioctl(2)s after the attach including two BIOCSETF. Each of them flushes the input buffer. So we can see tcpdump attached in 'netstat -B' and start sending packets and the packet will be captured by bpf(4) before BIOCSETF and freed and tcpdump won't read anything. Instead of using netstat(1), use ps(1) and make sure each tcpdump is blocked on the "bpf" wait channel, which guarantees it is done with ioctl(2)s and is now blocked in read(2).o Using 'nc -w 0' sets timeout not only on the connect(2) (as documented) but also on poll(2), which is not documented. There is a race in shell that will make stdin not yet filled by 'echo foo' when nc(1) does poll(2). With zero timeout, this poll(2) will immediately return and nc will exit.o The waiting loop had two errors: using wrong variable name as well as invoking a subshell, that actually can't wait on the pid.o The reading tcpdump was lacking '-q' option, that prevents any protocol interpretations. Sometimes, when random port chosen by nc(1) would match some well-known (to tcpdump) port, the output would differ from the expected.PR: 293241
tests/ipfw: add a test for ipfw(4) log rules that write to bpf(4)
tests/ipfw: add a simple fuzzing test for ipfw tablesReviewed by: pouria, aeDifferential Revision: https://reviews.freebsd.org/D54579
ipfw tests: Add basic coverage of divert(4) use casesReviewed by: kpApproved by: kp (mentor)Differential Revision: https://reviews.freebsd.org/D47163
netpfil tests: run in parallelRun these tests in their own (vnet) jail so we don't have to worry about IPrange or jail name conflicts.Reviewed by: markjSponsored by: Rubicon Communications, LLC
netpfil tests: run in parallelRun these tests in their own (vnet) jail so we don't have to worry about IPrange or jail name conflicts.Reviewed by: markjSponsored by: Rubicon Communications, LLC ("Netgate")Differential Revision: https://reviews.freebsd.org/D46040
spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDThe SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catchup to that fact and revert to their recommended match of
spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDThe SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catchup to that fact and revert to their recommended match of BSD-2-Clause.Discussed with: pfgMFC After: 3 daysSponsored by: Netflix
tests: add test for ipfw fwd localaddr,portChecks basic forward to local address, also with presence ofa listener that matches original port (see aab8c844b91). Basedon non-ATF test case written b
tests: add test for ipfw fwd localaddr,portChecks basic forward to local address, also with presence ofa listener that matches original port (see aab8c844b91). Basedon non-ATF test case written by Pavel Polyakov.Reviewed by: kp, melifaroDifferential revision: https://reviews.freebsd.org/D37960