pf tests: Simplify handling of pfctl -s

Some pf tests check the output of pfctl -s[sSr] to find if relevant
states, source nodes or rules exist and if their counters have proper
values. The output i

pf tests: Simplify handling of pfctl -s

Some pf tests check the output of pfctl -s[sSr] to find if relevant
states, source nodes or rules exist and if their counters have proper
values. The output is multiple lines per entry and contains varying
amount of whitespace. This makes parsing it rather hard.

Provide a function for standardization of output of pfctl -s[sSr] which
converts the output to a single line per entry and reduces whitespace
always to a single space. Adjust existing tests to make use of this
function.

Revieved by: kp
Approved by: kp (mentor)
Differental Revision: https://reviews.freebsd.org/D47435

show more ...

pf tests: use unique pid files for inetd processes

Ensure that we don't conflict with other inetd processes running in other jails
by setting an explicit pid file (rather than relying on the default

pf tests: use unique pid files for inetd processes

Ensure that we don't conflict with other inetd processes running in other jails
by setting an explicit pid file (rather than relying on the default /var/run/
inetd.pid). This could lead to failure to start inetd, which in turn could cause
test failures.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: add a test for max-src-conn

Switch tests using pft_ping.py to inetd. Netcat can only accept a single
connection, we need multiple parallel connections to test max-src-conn. Use the
discard

pf tests: add a test for max-src-conn

Switch tests using pft_ping.py to inetd. Netcat can only accept a single
connection, we need multiple parallel connections to test max-src-conn. Use the
discard service and modify pft_ping.py to use proper port number.

Implement functionality of 3-way handshake test in pft_ping.py. Make send_params
accessible to sniffer, because answers to SYN+ACK packets should be send with
the same parameters as the original SYN packet.

Finally add a test for max-src-conn and overload.

Reviewed by: kp
Differential Revision: https://reviews.freebsd.org/D46798

show more ...

vnet tests: verify that we can load if_epair and if_bridge

We're going to start running many of the vnet tests in nested jails (so they
can run in parallel). That means the tests won't be able to lo

vnet tests: verify that we can load if_epair and if_bridge

We're going to start running many of the vnet tests in nested jails (so they
can run in parallel). That means the tests won't be able to load kernel modules,
which we commonly do for if_epair and if_bridge.

Just assume that all vnet tests need this, because so many of them do that we
don't want to manually annotate all of them.
This is essentially a no-op on non-nested tests.

Do the same for the python test framework.

While here also have pflog_init actually call pft_init. While having pflog
loaded implies we have pf too pft_init also checks for vimage support, and now
for if_epair.

Reviewed by: markj
MFC after: 1 month
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D46039

show more ...

pf tests: initial pflow test case

Basic creation, validation and cleanup test for the new pflow interface.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://revie

pf tests: initial pflow test case

Basic creation, validation and cleanup test for the new pflow interface.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D43109

show more ...

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.

Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix

show more ...

netpfil tests: Add functions for testing routing scenarios

Many pf tests use identical setup where one jail is a router and
optionally another jail is a server. Add functions to create such jails
fo

netpfil tests: Add functions for testing routing scenarios

Many pf tests use identical setup where one jail is a router and
optionally another jail is a server. Add functions to create such jails
for IPv6 and IPv4 and functions to perform tests on such setup.

Add tests using those functions: scrub actions, routing table, tcp
sequence number modulation.

Reviewed by: kp
Sponsored by: InnoGames GmbH
Differential Revision: https://reviews.freebsd.org/D38126

show more ...

pf tests: factor out common dummynet check

Reviewed by: glebius
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D35160

pf tests: Only do post-test logging when specifically enabled

The pf tests have the ability to log state information (pf rules, pf
states, interfaces, ...) on exit (i.e. on success or on error).
Thi

pf tests: Only do post-test logging when specifically enabled

The pf tests have the ability to log state information (pf rules, pf
states, interfaces, ...) on exit (i.e. on success or on error).
This is useful, but only in specific cases. When it's not needed it may
get in the way of clear output.

Test scripts can add 'debug' to the pft_init call to enable this for the
specified test.

Reviewed by: brd
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D34133

show more ...

pf tests: log additional information when a test ends

Log information from the running jails (routing, interfaces and pf) as
well as interfaces on the host.

This information is expected to be usefu

pf tests: log additional information when a test ends

Log information from the running jails (routing, interfaces and pf) as
well as interfaces on the host.

This information is expected to be useful in debugging test failures.

MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf tests: basic test for ridentifier

MFC after: 3 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32751

altq tests: Basic ALTQ test

Activate ALTQ_HFSC, crudely check if it really limits bandwidth as we'd expect.

Reviewed by: donner@
Differential Revision: https://reviews.freebsd.org/D28303

netpfil tests: Add missing copyright & license statements

MFHead @347527

Sponsored by: The FreeBSD Foundation

pf tests: Fail the test if we can't set the rules

The test should fail if pf rules can't be set. This is helpful both
while writing tests and to verify that pfctl works as expected.

MFC after: 1 we

pf tests: Fail the test if we can't set the rules

The test should fail if pf rules can't be set. This is helpful both
while writing tests and to verify that pfctl works as expected.

MFC after: 1 week
Event: Aberdeen hackathon 2019

show more ...

MFHead@r345275

MFhead@r344786

Merge ^/head r344549 through r344775.

tests: Move common (vnet) test functions into a common file

The netipsec and pf tests have a number of common test functions. These
used to be duplicated, but it makes more sense for them to re-use

tests: Move common (vnet) test functions into a common file

The netipsec and pf tests have a number of common test functions. These
used to be duplicated, but it makes more sense for them to re-use the
common functions.

PR: 236223

show more ...

pf tests: Test PR 229241

pfctl has an issue with 'set skip on <group>', which causes inconsistent
behaviour: the set skip directive works initially, but does not take
effect when the same rules are

pf tests: Test PR 229241

pfctl has an issue with 'set skip on <group>', which causes inconsistent
behaviour: the set skip directive works initially, but does not take
effect when the same rules are re-applied.

PR: 229241
MFC after: 1 week

show more ...

Merge ^/head r339813 through r340125.

pf tests: Basic pfsync test

Set up two jails, configure pfsync between them and create state in one
of them, verify that this state is copied to the other jail.

MFC after: 2 weeks
Sponsored by: Ora

pf tests: Basic pfsync test

Set up two jails, configure pfsync between them and create state in one
of them, verify that this state is copied to the other jail.

MFC after: 2 weeks
Sponsored by: Orange Business Services
Differential Revision: https://reviews.freebsd.org/D17504

show more ...

Merge ^/head r323559 through r325504.

MFhead@r325119