pf tests: use unique pid files for inetd processes

Ensure that we don't conflict with other inetd processes running in other jails
by setting an explicit pid file (rather than relying on the default

pf tests: use unique pid files for inetd processes

Ensure that we don't conflict with other inetd processes running in other jails
by setting an explicit pid file (rather than relying on the default /var/run/
inetd.pid). This could lead to failure to start inetd, which in turn could cause
test failures.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: ensure temporary files end up in the atf working directory

Many of the tests create temporary files. pid files, log files, tcpdump
captures, ... We should take care to ensure they're store

pf tests: ensure temporary files end up in the atf working directory

Many of the tests create temporary files. pid files, log files, tcpdump
captures, ... We should take care to ensure they're stored in the temporary
working directory Kyua creates rather than in the root directory.

This ensures there are no conflicts between simultaneously running tests, and
also keeps the root directory clean.

MFC after: 1 month
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: make ether:dummynet test a little more robust

Allow slightly more bandwidth, but cause ping to give up sooner.

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.

Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix

show more ...

pf tests: bridge-to test case

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D37194

pf tests: require scapy for ether:short_pkt

The pft_ether.py script requires both python and scapy to be installed.
Check for this so we properly skip the test when it is unavailable.

Reviewed by:

pf tests: require scapy for ether:short_pkt

The pft_ether.py script requires both python and scapy to be installed.
Check for this so we properly skip the test when it is unavailable.

Reviewed by: kp
Fixes: 07ffa50ba075d ("pf tests: test short packets")
Differential Revision: https://reviews.freebsd.org/D36561

show more ...

pf tests: support packet size range in pft_ether.py

Teach pft_ether.py to send a range of packet sizes. Use this to move the
size sweep into Python, removing the repeated Python startup overhead
and

pf tests: support packet size range in pft_ether.py

Teach pft_ether.py to send a range of packet sizes. Use this to move the
size sweep into Python, removing the repeated Python startup overhead
and greatly speeding up the pf.ether.short_pkt test.

This should fix test timeouts seen on ci.freebsd.org.

While here also extend the range of packet sizes tested, because it adds
very little runtime now.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf: handle dummynet for non-IP packets

Do not panic if we try to dummynet an Ethernet packet that's not IPv4 or
IPv6. Simply give it to dummynet.

Sponsored by: Rubicon Communications, LLC ("Netgate

pf: handle dummynet for non-IP packets

Do not panic if we try to dummynet an Ethernet packet that's not IPv4 or
IPv6. Simply give it to dummynet.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: test short packets

Test sending very short packets (i.e. too short for an IP header)
packets in the Ethernet filtering code.

Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: basic 'tagged' test for Ethernet rules

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D35364

pf tests: basic 'tagged' test for Ethernet rules

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D35363

pf tests: extend ethernet dummynet test

Extend the existing ethernet dummynet test to also test dummynet on the
outbound direction.
This used to be a problem as traffic shaping wasn't done in the et

pf tests: extend ethernet dummynet test

Extend the existing ethernet dummynet test to also test dummynet on the
outbound direction.
This used to be a problem as traffic shaping wasn't done in the ethernet
code. It merely tagged the packet and left shaping up to the layer 3 pf
code. This works in the inbound direction, but not for outbound traffic
where we hit the L3 code first and only then the L2 code.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D35258

show more ...

pf tests: factor out common dummynet check

Reviewed by: glebius
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D35160

pf: allow the use of tables in ethernet rules

Allow tables to be used for the l3 source/destination matching.
This requires taking the PF_RULES read lock.

Sponsored by: Rubicon Communications, LLC

pf: allow the use of tables in ethernet rules

Allow tables to be used for the l3 source/destination matching.
This requires taking the PF_RULES read lock.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D34917

show more ...

pf: support listing ethernet anchors

Sponsored by: Rubicon Communications, LLC ("Netgate")

pf: ether l3 rules can only use addresses

Disallow the use of tables in ethernet rules. Using tables requires
taking the PF_RULES lock. Moreover, the current table code isn't ready
to deal with ethe

pf: ether l3 rules can only use addresses

Disallow the use of tables in ethernet rules. Using tables requires
taking the PF_RULES lock. Moreover, the current table code isn't ready
to deal with ethernet rules.

Disallow their use for now.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: Test new L3 inspection for pf 'ether' rules

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D34483

pf tests: extend ether test to verify mac address masks

Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: Ensure 'pfctl -F ethernet' works

Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: slightly more complect captive portal setup

Combine anchor, dummynet and rdr to produce a more complex captive
portal setup.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differen

pf tests: slightly more complect captive portal setup

Combine anchor, dummynet and rdr to produce a more complex captive
portal setup.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32484

show more ...

pf tests: basic test for ether anchors

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32483

pfctl: support lists of mac addresses

Teach the 'ether' rules to accept { mac1, mac2, ... } lists, similar to
the lists of interfaces or IP addresses we already supported for layer 3
filtering.

Spo

pfctl: support lists of mac addresses

Teach the 'ether' rules to accept { mac1, mac2, ... } lists, similar to
the lists of interfaces or IP addresses we already supported for layer 3
filtering.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32481

show more ...

pf tests: test dummynet for ether traffic

Test that we can set dummynet information on L2, which is processed by
L3 later (assuming it's not overruled by L3 rules, of course).

Sponsored by: Rubicon

pf tests: test dummynet for ether traffic

Test that we can set dummynet information on L2, which is processed by
L3 later (assuming it's not overruled by L3 rules, of course).

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32223

show more ...

pf tests: Test ether direction

Test that we correctly match inbound ('in') or outbound ('out') Ethernet
packets.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https:/

pf tests: Test ether direction

Test that we correctly match inbound ('in') or outbound ('out') Ethernet
packets.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D31747

show more ...