xref: /freebsd/tests/sys/netpfil/pf/anchor.sh (revision d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf) 
1#
2# SPDX-License-Identifier: BSD-2-Clause
3#
4# Copyright (c) 2018 Kristof Provost <kp@FreeBSD.org>
5#
6# Redistribution and use in source and binary forms, with or without
7# modification, are permitted provided that the following conditions
8# are met:
9# 1. Redistributions of source code must retain the above copyright
10#    notice, this list of conditions and the following disclaimer.
11# 2. Redistributions in binary form must reproduce the above copyright
12#    notice, this list of conditions and the following disclaimer in the
13#    documentation and/or other materials provided with the distribution.
14#
15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25# SUCH DAMAGE.
26
27. $(atf_get_srcdir)/utils.subr
28
29atf_test_case "pr183198" "cleanup"
30pr183198_head()
31{
32	atf_set descr 'Test tables referenced by rules in anchors'
33	atf_set require.user root
34}
35
36pr183198_body()
37{
38	pft_init
39
40	epair=$(vnet_mkepair)
41	vnet_mkjail alcatraz ${epair}b
42	jexec alcatraz pfctl -e
43
44	# Forward with pf enabled
45	pft_set_rules alcatraz  \
46		"table <test> { 10.0.0.1, 10.0.0.2, 10.0.0.3 }" \
47		"block in" \
48		"anchor \"epair\" on ${epair}b { \n\
49			pass in from <test> \n\
50		}"
51
52	atf_check -s exit:0 -o ignore jexec alcatraz pfctl -sr -a '*'
53	atf_check -s exit:0 -o ignore jexec alcatraz pfctl -t test -T show
54}
55
56pr183198_cleanup()
57{
58	pft_cleanup
59}
60
61atf_test_case "nested_anchor" "cleanup"
62nested_anchor_head()
63{
64	atf_set descr 'Test setting and retrieving nested anchors'
65	atf_set require.user root
66}
67
68nested_anchor_body()
69{
70	pft_init
71
72	epair=$(vnet_mkepair)
73	vnet_mkjail alcatraz ${epair}a
74
75	pft_set_rules alcatraz \
76		"anchor \"foo\" { \n\
77			anchor \"bar\" { \n\
78				pass on ${epair}a \n\
79			} \n\
80		}"
81
82	atf_check -s exit:0 -o inline:"anchor \"foo\" all {
83  anchor \"bar\" all {
84    pass on ${epair}a all flags S/SA keep state
85  }
86}
87" jexec alcatraz pfctl -sr -a "*"
88}
89
90nested_anchor_cleanup()
91{
92	pft_cleanup
93}
94
95atf_test_case "wildcard" "cleanup"
96wildcard_head()
97{
98	atf_set descr 'Test wildcard anchors for functionality'
99	atf_set require.user root
100}
101
102wildcard_body()
103{
104	pft_init
105
106	epair=$(vnet_mkepair)
107	vnet_mkjail alcatraz ${epair}a
108
109	ifconfig ${epair}b 192.0.2.2/24 up
110	jexec alcatraz ifconfig ${epair}a 192.0.2.1/24 up
111
112	# Sanity check
113	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1
114
115	jexec alcatraz pfctl -e
116	pft_set_rules alcatraz \
117		"block" \
118		"anchor \"foo/*\""
119
120	atf_check -s exit:2 -o ignore ping -c 1 192.0.2.1
121
122	echo "pass" | jexec alcatraz pfctl -g -f - -a "foo/bar"
123
124	jexec alcatraz pfctl -sr -a "*"
125	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1
126}
127
128wildcard_cleanup()
129{
130	pft_cleanup
131}
132
133atf_init_test_cases()
134{
135	atf_add_test_case "pr183198"
136	atf_add_test_case "nested_anchor"
137	atf_add_test_case "wildcard"
138}
139