xref: /freebsd/tests/sys/netpfil/pf/forward.sh (revision 924226fba12cc9a228c73b956e1b7fa24c60b055)
1# $FreeBSD$
2#
3# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4#
5# Copyright (c) 2017 Kristof Provost <kp@FreeBSD.org>
6#
7# Redistribution and use in source and binary forms, with or without
8# modification, are permitted provided that the following conditions
9# are met:
10# 1. Redistributions of source code must retain the above copyright
11#    notice, this list of conditions and the following disclaimer.
12# 2. Redistributions in binary form must reproduce the above copyright
13#    notice, this list of conditions and the following disclaimer in the
14#    documentation and/or other materials provided with the distribution.
15#
16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26# SUCH DAMAGE.
27
28. $(atf_get_srcdir)/utils.subr
29
30common_dir=$(atf_get_srcdir)/../common
31
32atf_test_case "v4" "cleanup"
33v4_head()
34{
35	atf_set descr 'Basic forwarding test'
36	atf_set require.user root
37
38	# We need scapy to be installed for out test scripts to work
39	atf_set require.progs scapy
40}
41
42v4_body()
43{
44	pft_init
45
46	epair_send=$(vnet_mkepair)
47	ifconfig ${epair_send}a 192.0.2.1/24 up
48
49	epair_recv=$(vnet_mkepair)
50	ifconfig ${epair_recv}a up
51
52	vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b
53	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
54	jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up
55	jexec alcatraz sysctl net.inet.ip.forwarding=1
56	jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05
57	route add -net 198.51.100.0/24 192.0.2.2
58
59	# Sanity check, can we forward ICMP echo requests without pf?
60	atf_check -s exit:0 ${common_dir}/pft_ping.py \
61		--sendif ${epair_send}a \
62		--to 198.51.100.3 \
63		--recvif ${epair_recv}a
64
65	jexec alcatraz pfctl -e
66
67	# Forward with pf enabled
68	pft_set_rules alcatraz "block in"
69	atf_check -s exit:1 ${common_dir}/pft_ping.py \
70		--sendif ${epair_send}a \
71		--to 198.51.100.3 \
72		--recvif ${epair_recv}a
73
74	pft_set_rules alcatraz "block out"
75	atf_check -s exit:1 ${common_dir}/pft_ping.py \
76		--sendif ${epair_send}a \
77		--to 198.51.100.3 \
78		--recv ${epair_recv}a
79
80	# Allow ICMP
81	pft_set_rules alcatraz "block in" "pass in proto icmp"
82	atf_check -s exit:0 ${common_dir}/pft_ping.py \
83		--sendif ${epair_send}a \
84		--to 198.51.100.3 \
85		--recvif ${epair_recv}a
86}
87
88v4_cleanup()
89{
90	pft_cleanup
91}
92
93atf_test_case "v6" "cleanup"
94v6_head()
95{
96	atf_set descr 'Basic IPv6 forwarding test'
97	atf_set require.user root
98	atf_set require.progs scapy
99}
100
101v6_body()
102{
103	pft_init
104
105	if [ "$(atf_config_get ci false)" = "true" ]; then
106		atf_skip "https://bugs.freebsd.org/260460"
107	fi
108
109	epair_send=$(vnet_mkepair)
110	epair_recv=$(vnet_mkepair)
111
112	ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled
113	ifconfig ${epair_recv}a up
114
115	vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b
116
117	jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad
118	jexec alcatraz ifconfig ${epair_recv}b inet6 2001:db8:43::2/64 up no_dad
119	jexec alcatraz sysctl net.inet6.ip6.forwarding=1
120	jexec alcatraz ndp -s 2001:db8:43::3 00:01:02:03:04:05
121	route add -6 2001:db8:43::/64 2001:db8:42::2
122
123	# Sanity check, can we forward ICMP echo requests without pf?
124	atf_check -s exit:0 ${common_dir}/pft_ping.py \
125		--ip6 \
126		--sendif ${epair_send}a \
127		--to 2001:db8:43::3 \
128		--recvif ${epair_recv}a
129
130	jexec alcatraz pfctl -e
131
132	# Block incoming echo request packets
133	pft_set_rules alcatraz \
134		"block in inet6 proto icmp6 icmp6-type echoreq"
135	atf_check -s exit:1 ${common_dir}/pft_ping.py \
136		--ip6 \
137		--sendif ${epair_send}a \
138		--to 2001:db8:43::3 \
139		--recvif ${epair_recv}a
140
141	# Block outgoing echo request packets
142	pft_set_rules alcatraz \
143		"block out inet6 proto icmp6 icmp6-type echoreq"
144	atf_check -s exit:1 -e ignore ${common_dir}/pft_ping.py \
145		--ip6 \
146		--sendif ${epair_send}a \
147		--to 2001:db8:43::3 \
148		--recvif ${epair_recv}a
149
150	# Allow ICMPv6 but nothing else
151	pft_set_rules alcatraz \
152		"block out" \
153		"pass out inet6 proto icmp6"
154	atf_check -s exit:0 ${common_dir}/pft_ping.py \
155		--ip6 \
156		--sendif ${epair_send}a \
157		--to 2001:db8:43::3 \
158		--recvif ${epair_recv}a
159
160	# Allowing ICMPv4 does not allow ICMPv6
161	pft_set_rules alcatraz \
162		"block out inet6 proto icmp6 icmp6-type echoreq" \
163		"pass in proto icmp"
164	atf_check -s exit:1 ${common_dir}/pft_ping.py \
165		--ip6 \
166		--sendif ${epair_send}a \
167		--to 2001:db8:43::3 \
168		--recvif ${epair_recv}a
169}
170
171v6_cleanup()
172{
173	pft_cleanup
174}
175
176atf_init_test_cases()
177{
178	atf_add_test_case "v4"
179	atf_add_test_case "v6"
180}
181