tests: Require python3 when using Scapy

python3 is a symbolic link that points to the current python 3.X
version.

It is possible for a system to have python (python 3.X) without the
python3 (symlin

tests: Require python3 when using Scapy

python3 is a symbolic link that points to the current python 3.X
version.

It is possible for a system to have python (python 3.X) without the
python3 (symlink) package.

Test scripts that use Scapy are invoked using python3, so add it as a
required program.

Reviewed by: ngie, asomers
Approved by: emaste (mentor)
Differential Revision: https://reviews.freebsd.org/D49007

show more ...

pf tests: extend set-tos test

Verify that we can set-tos on pass rules, and that this still works even if a
'scrub' option is present on the pass rule.

Sponsored by: Rubicon Communications, LLC ("N

pf tests: extend set-tos test

Verify that we can set-tos on pass rules, and that this still works even if a
'scrub' option is present on the pass rule.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.

Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix

show more ...

netpfil tests: improve pft_ping.py

Multiple improvements to pft_ping.py:

* Automatically use IPv6 when IPv6 addresses are used, --ip6 is not needed.
* Building of ping requests and parsing of ping

netpfil tests: improve pft_ping.py

Multiple improvements to pft_ping.py:

* Automatically use IPv6 when IPv6 addresses are used, --ip6 is not needed.
* Building of ping requests and parsing of ping replies is done layer by
layer. This way most arguments are available both for IPv6 and IPv4,
for ICMP and TCP.
* Use argument groups for improved readability.
* Change ToS and TTL argument name to TC and HL to reflect the modern
IPv6 nomenclature. The argument still set related IPv4 header fields
properly.
* Instead of sniffing for the very specific case of duplicated packets,
allow for sniffing on multiple interfaces.
* Report which sniffer has failed by setting bits of error code.
* Raise meaningful exceptions when irrecoverable errors happen.
* Make IPv4 fragmentation flags configurable.
* Make IPv6 HL / IPv4 TTL configurable.
* Make TCP MSS configurable.
* Make TCP sequence number configurable.
* Make ICMP payload size configurable.
* Add debug output.
* Move command line argument parsing out of network functions.
* Make the code somehow PEP-8 compliant.

MFC after: 1 week
Sponsored by: InnoGames GmbH
Differential Revision: https://reviews.freebsd.org/D38122

show more ...

tests: sys.netpfil.pf.set_tos.v6 fails in CI

sys.netpfil.pf.set_tos.v6 has been failing for a while in CI now. File
a bug and disable.

PR: 260459
Sponsored by: Netflix

pf: implement set-tos for IPv6

Extend the existing set-tos keyword to also be able to set traffic class
on IPv6 traffic.
Add tests for this as well.

Reviewed by: kp
Differential Revision: https://r

pf: implement set-tos for IPv6

Extend the existing set-tos keyword to also be able to set traffic class
on IPv6 traffic.
Add tests for this as well.

Reviewed by: kp
Differential Revision: https://reviews.freebsd.org/D31564

show more ...

Remove the svn:executable property from some pf test files.

The test makefiles will handle setting mode bits during install. Also,
Phabricator gets upset when uploading an executable plain-text fil

Remove the svn:executable property from some pf test files.

The test makefiles will handle setting mode bits during install. Also,
Phabricator gets upset when uploading an executable plain-text file
without a shebang.

MFC after: 1 week

show more ...

Reenable netinet6 and netpfil tests on i386, net/scapy 2.4.3_2 contains the fix

PR: 239380
Sponsored by: The FreeBSD Foundation

netpfil tests: Add missing copyright & license statements

netpfil tests: Move pft_ping.py and sniffer.py to the common test directory

The pft_ping.py and sniffer.py tool is moved from tests/sys/netpfil/pf to
tests/sys/netpfil/common directory because these

netpfil tests: Move pft_ping.py and sniffer.py to the common test directory

The pft_ping.py and sniffer.py tool is moved from tests/sys/netpfil/pf to
tests/sys/netpfil/common directory because these tools are to be used in
common for all the firewalls.

Submitted by: Ahsan Barkati
Reviewed by: kp, thj
Sponsored by: Google, Inc. (GSoC 2019)
Differential Revision: https://reviews.freebsd.org/D21276

show more ...

MFHead @r350386

Sponsored by: The FreeBSD Foundation

Temporarily skip sys.netpfil.pf.forward.{v4,v6} and sys.netpfil.pf.set_tos.v4
on i386 as they are flakey on it

PR: 239380
Sponsored by: The FreeBSD Foundation

MFHead@r345275

MFhead@r344786

Merge ^/head r344549 through r344775.

tests: Move common (vnet) test functions into a common file

The netipsec and pf tests have a number of common test functions. These
used to be duplicated, but it makes more sense for them to re-use

tests: Move common (vnet) test functions into a common file

The netipsec and pf tests have a number of common test functions. These
used to be duplicated, but it makes more sense for them to re-use the
common functions.

PR: 236223

show more ...

Merge ^/head r323559 through r325504.

MFhead@r324837

While here, diff reduce some of the changes in sys/boot by moving
MK_COVERAGE=no to sys/boot/Makefile.inc .

pf tests: Use pft_set_rules everywhere

We now have a utility function to set pf rules in the jail. Use it
whenever we need to set the pf rules in the test jail.

pf: test set-tos

Introduce tests for the set-tos feature of pf. Teach pft_ping.py to send
and verify ToS flags.