1# 2# 3# SPDX-License-Identifier: BSD-2-Clause 4# 5# Copyright © 2023 Tom Jones <thj@freebsd.org> 6# 7# Redistribution and use in source and binary forms, with or without 8# modification, are permitted provided that the following conditions 9# are met: 10# 1. Redistributions of source code must retain the above copyright 11# notice, this list of conditions and the following disclaimer. 12# 2. Redistributions in binary form must reproduce the above copyright 13# notice, this list of conditions and the following disclaimer in the 14# documentation and/or other materials provided with the distribution. 15# 16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26# SUCH DAMAGE. 27 28. $(atf_get_srcdir)/utils.subr 29 30atf_test_case "tcp_v6" "cleanup" 31tcp_v6_head() 32{ 33 atf_set descr 'TCP rdr with IPv6' 34 atf_set require.user root 35 atf_set require.progs scapy python3 36} 37 38# 39# Test that rdr works for TCP with IPv6. 40# 41# a <-----> b <-----> c 42# 43# Test configures three jails (a, b and c) and connects them together with b as 44# a router between a and c. 45# 46# TCP traffic to b on port 80 is redirected to c on port 8000 47# 48# Test for incorrect checksums after the rewrite by looking at a packet capture (see bug 210860) 49# 50tcp_v6_body() 51{ 52 pft_init 53 54 j="rdr:tcp_v6" 55 epair_one=$(vnet_mkepair) 56 epair_two=$(vnet_mkepair) 57 58 echo $epair_one 59 echo $epair_two 60 61 vnet_mkjail ${j}a ${epair_one}b 62 vnet_mkjail ${j}b ${epair_one}a ${epair_two}a 63 vnet_mkjail ${j}c ${epair_two}b 64 65 # configure addresses for b 66 jexec ${j}b ifconfig lo0 up 67 jexec ${j}b ifconfig ${epair_one}a inet6 2001:db8:a::1/64 up no_dad 68 jexec ${j}b ifconfig ${epair_two}a inet6 2001:db8:b::1/64 up no_dad 69 70 # configure addresses for a 71 jexec ${j}a ifconfig lo0 up 72 jexec ${j}a ifconfig ${epair_one}b inet6 2001:db8:a::2/64 up no_dad 73 74 # configure addresses for c 75 jexec ${j}c ifconfig lo0 up 76 jexec ${j}c ifconfig ${epair_two}b inet6 2001:db8:b::2/64 up no_dad 77 78 # enable forwarding in the b jail 79 jexec ${j}b sysctl net.inet6.ip6.forwarding=1 80 81 # add routes so a and c can find each other 82 jexec ${j}a route add -inet6 2001:db8:b::0/64 2001:db8:a::1 83 jexec ${j}c route add -inet6 2001:db8:a::0/64 2001:db8:b::1 84 85 jexec ${j}b pfctl -e 86 87 pft_set_rules ${j}b \ 88 "rdr on ${epair_one}a proto tcp from any to any port 80 -> 2001:db8:b::2 port 8000" 89 90 # Check that a can reach c over the router 91 atf_check -s exit:0 -o ignore \ 92 jexec ${j}a ping -6 -c 1 2001:db8:b::2 93 94 # capture packets on c so we can look for incorrect checksums 95 jexec ${j}c tcpdump --immediate-mode -w ${PWD}/${j}.pcap tcp and port 8000 & 96 tcpdumppid=$! 97 98 # start a web server and give it a second to start 99 jexec ${j}c python3 -m http.server & 100 sleep 1 101 102 # http directly from a to c -> a ---> b 103 atf_check -s exit:0 -o ignore \ 104 jexec ${j}a fetch -T 1 -o /dev/null -q "http://[2001:db8:b::2]:8000" 105 106 # http from a to b with a redirect -> a ---> b 107 atf_check -s exit:0 -o ignore \ 108 jexec ${j}a fetch -T 1 -o /dev/null -q "http://[2001:db8:a::1]:80" 109 110 # ask tcpdump to stop so we can check the packet capture 111 jexec ${j}c kill -s SIGINT $tcpdumppid 112 113 # Check for 'incorrect' in packet capture, this should tell us if 114 # checksums are bad with rdr rules 115 count=$(jexec ${j}c tcpdump -vvvv -r ${PWD}/${j}.pcap | grep incorrect | wc -l) 116 atf_check_equal " 0" "$count" 117} 118 119tcp_v6_cleanup() 120{ 121 pft_cleanup 122} 123 124 125atf_test_case "srcport" "cleanup" 126srcport_head() 127{ 128 atf_set descr 'TCP rdr srcport modulation' 129 atf_set require.user root 130 atf_set require.progs python3 131 atf_set timeout 9999 132} 133 134# 135# Test that rdr works for multiple TCP with same srcip and srcport. 136# 137# Four jails, a, b, c, d, are used: 138# - jail d runs a server on port 8888, 139# - jail a makes connections to the server, routed through jails b and c, 140# - jail b uses NAT to rewrite source addresses and ports to the same 2-tuple, 141# avoiding the need to use SO_REUSEADDR in jail a, 142# - jail c uses a redirect rule to map the destination address to the same 143# address and port, resulting in a NAT state conflict. 144# 145# In this case, the rdr rule should also rewrite the source port (again) to 146# resolve the state conflict. 147# 148srcport_body() 149{ 150 pft_init 151 152 j="rdr:srcport" 153 epair1=$(vnet_mkepair) 154 epair2=$(vnet_mkepair) 155 epair3=$(vnet_mkepair) 156 157 echo $epair_one 158 echo $epair_two 159 160 vnet_mkjail ${j}a ${epair1}a 161 vnet_mkjail ${j}b ${epair1}b ${epair2}a 162 vnet_mkjail ${j}c ${epair2}b ${epair3}a 163 vnet_mkjail ${j}d ${epair3}b 164 165 # configure addresses for a 166 jexec ${j}a ifconfig lo0 up 167 jexec ${j}a ifconfig ${epair1}a inet 198.51.100.50/24 up 168 jexec ${j}a ifconfig ${epair1}a inet alias 198.51.100.51/24 169 jexec ${j}a ifconfig ${epair1}a inet alias 198.51.100.52/24 170 171 # configure addresses for b 172 jexec ${j}b ifconfig lo0 up 173 jexec ${j}b ifconfig ${epair1}b inet 198.51.100.1/24 up 174 jexec ${j}b ifconfig ${epair2}a inet 198.51.101.2/24 up 175 176 # configure addresses for c 177 jexec ${j}c ifconfig lo0 up 178 jexec ${j}c ifconfig ${epair2}b inet 198.51.101.3/24 up 179 jexec ${j}c ifconfig ${epair2}b inet alias 198.51.101.4/24 180 jexec ${j}c ifconfig ${epair2}b inet alias 198.51.101.5/24 181 jexec ${j}c ifconfig ${epair3}a inet 203.0.113.1/24 up 182 183 # configure addresses for d 184 jexec ${j}d ifconfig lo0 up 185 jexec ${j}d ifconfig ${epair3}b inet 203.0.113.50/24 up 186 187 jexec ${j}b sysctl net.inet.ip.forwarding=1 188 jexec ${j}c sysctl net.inet.ip.forwarding=1 189 jexec ${j}b pfctl -e 190 jexec ${j}c pfctl -e 191 192 pft_set_rules ${j}b \ 193 "set debug misc" \ 194 "nat on ${epair2}a inet from 198.51.100.0/24 to any -> ${epair2}a static-port" 195 196 pft_set_rules ${j}c \ 197 "set debug misc" \ 198 "rdr on ${epair2}b proto tcp from any to ${epair2}b port 7777 -> 203.0.113.50 port 8888" 199 200 jexec ${j}a route add default 198.51.100.1 201 jexec ${j}c route add 198.51.100.0/24 198.51.101.2 202 jexec ${j}d route add 198.51.101.0/24 203.0.113.1 203 204 jexec ${j}d python3 $(atf_get_srcdir)/rdr-srcport.py & 205 sleep 1 206 207 echo a | jexec ${j}a nc -w 3 -s 198.51.100.50 -p 1234 198.51.101.3 7777 > port1 208 209 jexec ${j}a nc -s 198.51.100.51 -p 1234 198.51.101.4 7777 > port2 & 210 jexec ${j}a nc -s 198.51.100.52 -p 1234 198.51.101.5 7777 > port3 & 211 sleep 1 212 213 atf_check -o inline:"1234" cat port1 214 atf_check -o match:"[0-9]+" -o not-inline:"1234" cat port2 215 atf_check -o match:"[0-9]+" -o not-inline:"1234" cat port3 216} 217 218srcport_cleanup() 219{ 220 pft_cleanup 221} 222 223atf_init_test_cases() 224{ 225 atf_add_test_case "tcp_v6" 226 atf_add_test_case "srcport" 227} 228