1# 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2025 Rubicon Communications, LLC (Netgate) 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26 27import pytest 28from atf_python.sys.net.tools import ToolsHelper 29from atf_python.sys.net.vnet import VnetTestTemplate 30 31class TestNAT44(VnetTestTemplate): 32 REQUIRED_MODULES = [ "pf" ] 33 TOPOLOGY = { 34 "vnet1": {"ifaces": ["if1"]}, 35 "vnet2": {"ifaces": ["if1", "if2"]}, 36 "vnet3": {"ifaces": ["if2"]}, 37 "if1": {"prefixes4": [("192.0.2.2/24", "192.0.2.1/24")]}, 38 "if2": {"prefixes4": [("198.51.100.1/24", "198.51.100.2")]}, 39 } 40 41 def vnet2_handler(self, vnet): 42 outifname = vnet.iface_alias_map["if2"].name 43 ToolsHelper.print_output("/sbin/sysctl net.inet.ip.forwarding=1") 44 45 ToolsHelper.print_output("/sbin/pfctl -e") 46 ToolsHelper.print_output("/sbin/pfctl -x loud") 47 ToolsHelper.pf_rules([ 48 "set reassemble yes", 49 "nat on {} inet from 192.0.2.0/24 -> ({})".format(outifname, outifname), 50 "pass"]) 51 52 def vnet3_handler(self, vnet): 53 pass 54 55 @pytest.mark.require_user("root") 56 @pytest.mark.require_progs(["scapy"]) 57 def test_nat_igmp(self): 58 "Verify that NAT translation of !(TCP|UDP|SCTP|ICMP) doesn't panic" 59 ToolsHelper.print_output("/sbin/route add default 192.0.2.1") 60 ToolsHelper.print_output("ping -c 3 198.51.100.2") 61 62 # Import in the correct vnet, so at to not confuse Scapy 63 import scapy.all as sp 64 import scapy.contrib as sc 65 import scapy.contrib.igmp 66 67 pkt = sp.IP(dst="198.51.100.2", ttl=64) \ 68 / sc.igmp.IGMP(type=0x11, mrcode=1) 69 sp.send(pkt) 70 71 # This time we'll hit an existing state 72 pkt = sp.IP(dst="198.51.100.2", ttl=64) \ 73 / sc.igmp.IGMP(type=0x11, mrcode=1) 74 reply = sp.sr1(pkt, timeout=3) 75 if reply: 76 reply.show() 77