pf: cope with SCTP port re-use

Some SCTP implementations will abort connections and then later re-use the same
port numbers (i.e. both src and dst) for a new connection, before pf has fully
purged t

pf: cope with SCTP port re-use

Some SCTP implementations will abort connections and then later re-use the same
port numbers (i.e. both src and dst) for a new connection, before pf has fully
purged the old connection.

Apply the same hack we already have for similarly misbehaving TCP
implementations and forcibly remove the old state so we can create a new one.

MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: fix sctp:timeout test

The test body somehow wound up in the cleanup function.

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

pf tests: test setting and retrieving timeout values

vnet tests: check for if_bridge.ko

A number of tests create a bridge, but did not check if if_bridge.ko is loaded.

We usually get away with that, because `ifconfig bridge create` autoloads the
modu

vnet tests: check for if_bridge.ko

A number of tests create a bridge, but did not check if if_bridge.ko is loaded.

We usually get away with that, because `ifconfig bridge create` autoloads the
module, but if we run the tests in a jail (e.g. because of kyua's upcoming
execenv.jail.params feature) we can't load the module and these tests can fail.

Check if the module is loaded, skip the test if it is not.

Reviewed by: markj
MFC after: 1 week
Event: Kitchener-Waterloo Hackathon 202406
Differential Revision: https://reviews.freebsd.org/D45487

show more ...

pf tests: fix typos in the abort_v6 test case head / cleanup function name

MFC after: 1 week

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

pf tests: test SCTP pfsync

Ensure that SCTP connections survive a failover to the backup pf
instance.

MFC after: 3 weeks
Sponsored by: Orange Business Services
Differential Revision: https://review

pf tests: test SCTP pfsync

Ensure that SCTP connections survive a failover to the backup pf
instance.

MFC after: 3 weeks
Sponsored by: Orange Business Services
Differential Revision: https://reviews.freebsd.org/D40869

show more ...

pf tests: test 'rdr' for SCTP

Explicitly test that we cannot change the port number with rdr.
That's not a desireable feature on SCTP, because it could break
multihomed connections.

MFC after: 3 we

pf tests: test 'rdr' for SCTP

Explicitly test that we cannot change the port number with rdr.
That's not a desireable feature on SCTP, because it could break
multihomed connections.

MFC after: 3 weeks
Sponsored by: Orange Business Services
Differential Revision: https://reviews.freebsd.org/D40868

show more ...

pf tests: test SCTP NAT

MFC after: 3 weeks
Sponsored by: Orange Business Services
Differential Revision: https://reviews.freebsd.org/D40867

pf tests: test SCTP 'return'

Ensure that we send a correct abort message for 'block return' rules.

Test this by validating that nc doesn't sit around waiting for a
connection. It should give up imm

pf tests: test SCTP 'return'

Ensure that we send a correct abort message for 'block return' rules.

Test this by validating that nc doesn't sit around waiting for a
connection. It should give up immediately when it receives the abort.

MFC after: 3 weeks
Sponsored by: Orange Business Services
Differential Revision: https://reviews.freebsd.org/D40865

show more ...

pf tests: basic SCTP connection test

pf can now inspect SCTP. Check that we can set up a connection.
IPv4 and IPv6 tests.

MFC after: 3 weeks
Sponsored by: Orange Business Services
Differential Revi

pf tests: basic SCTP connection test

pf can now inspect SCTP. Check that we can set up a connection.
IPv4 and IPv6 tests.

MFC after: 3 weeks
Sponsored by: Orange Business Services
Differential Revision: https://reviews.freebsd.org/D40863

show more ...