xref: /freebsd/tests/sys/netpfil/pf/route_to.sh (revision 95eb4b873b6a8b527c5bd78d7191975dfca38998)
1#
2# SPDX-License-Identifier: BSD-2-Clause
3#
4# Copyright (c) 2018 Kristof Provost <kp@FreeBSD.org>
5#
6# Redistribution and use in source and binary forms, with or without
7# modification, are permitted provided that the following conditions
8# are met:
9# 1. Redistributions of source code must retain the above copyright
10#    notice, this list of conditions and the following disclaimer.
11# 2. Redistributions in binary form must reproduce the above copyright
12#    notice, this list of conditions and the following disclaimer in the
13#    documentation and/or other materials provided with the distribution.
14#
15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25# SUCH DAMAGE.
26
27. $(atf_get_srcdir)/utils.subr
28
29common_dir=$(atf_get_srcdir)/../common
30
31atf_test_case "v4" "cleanup"
32v4_head()
33{
34	atf_set descr 'Basic route-to test'
35	atf_set require.user root
36}
37
38v4_body()
39{
40	pft_init
41
42	epair_send=$(vnet_mkepair)
43	ifconfig ${epair_send}a 192.0.2.1/24 up
44	epair_route=$(vnet_mkepair)
45	ifconfig ${epair_route}a 203.0.113.1/24 up
46
47	vnet_mkjail alcatraz ${epair_send}b ${epair_route}b
48	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
49	jexec alcatraz ifconfig ${epair_route}b 203.0.113.2/24 up
50	jexec alcatraz route add -net 198.51.100.0/24 192.0.2.1
51	jexec alcatraz pfctl -e
52
53	# Attempt to provoke PR 228782
54	pft_set_rules alcatraz "block all" "pass user 2" \
55		"pass out route-to (${epair_route}b 203.0.113.1) from 192.0.2.2 to 198.51.100.1 no state"
56	jexec alcatraz nc -w 3 -s 192.0.2.2 198.51.100.1 22
57
58	# atf wants us to not return an error, but our netcat will fail
59	true
60}
61
62v4_cleanup()
63{
64	pft_cleanup
65}
66
67atf_test_case "v6" "cleanup"
68v6_head()
69{
70	atf_set descr 'Basic route-to test (IPv6)'
71	atf_set require.user root
72}
73
74v6_body()
75{
76	pft_init
77
78	epair_send=$(vnet_mkepair)
79	ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled
80	epair_route=$(vnet_mkepair)
81	ifconfig ${epair_route}a inet6 2001:db8:43::1/64 up no_dad -ifdisabled
82
83	vnet_mkjail alcatraz ${epair_send}b ${epair_route}b
84	jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad
85	jexec alcatraz ifconfig ${epair_route}b inet6 2001:db8:43::2/64 up no_dad
86	jexec alcatraz route add -6 2001:db8:666::/64 2001:db8:42::2
87	jexec alcatraz pfctl -e
88
89	# Attempt to provoke PR 228782
90	pft_set_rules alcatraz "block all" "pass user 2" \
91		"pass out route-to (${epair_route}b 2001:db8:43::1) from 2001:db8:42::2 to 2001:db8:666::1 no state"
92	jexec alcatraz nc -6 -w 3 -s 2001:db8:42::2 2001:db8:666::1 22
93
94	# atf wants us to not return an error, but our netcat will fail
95	true
96}
97
98v6_cleanup()
99{
100	pft_cleanup
101}
102
103atf_test_case "multiwan" "cleanup"
104multiwan_head()
105{
106	atf_set descr 'Multi-WAN redirection / reply-to test'
107	atf_set require.user root
108}
109
110multiwan_body()
111{
112	pft_init
113
114	epair_one=$(vnet_mkepair)
115	epair_two=$(vnet_mkepair)
116	epair_cl_one=$(vnet_mkepair)
117	epair_cl_two=$(vnet_mkepair)
118
119	vnet_mkjail srv ${epair_one}b ${epair_two}b
120	vnet_mkjail wan_one ${epair_one}a ${epair_cl_one}b
121	vnet_mkjail wan_two ${epair_two}a ${epair_cl_two}b
122	vnet_mkjail client ${epair_cl_one}a ${epair_cl_two}a
123
124	jexec client ifconfig ${epair_cl_one}a 203.0.113.1/25
125	jexec wan_one ifconfig ${epair_cl_one}b 203.0.113.2/25
126	jexec wan_one ifconfig ${epair_one}a 192.0.2.1/24 up
127	jexec wan_one sysctl net.inet.ip.forwarding=1
128	jexec srv ifconfig ${epair_one}b 192.0.2.2/24 up
129	jexec client route add 192.0.2.0/24 203.0.113.2
130
131	jexec client ifconfig ${epair_cl_two}a 203.0.113.128/25
132	jexec wan_two ifconfig ${epair_cl_two}b 203.0.113.129/25
133	jexec wan_two ifconfig ${epair_two}a 198.51.100.1/24 up
134	jexec wan_two sysctl net.inet.ip.forwarding=1
135	jexec srv ifconfig ${epair_two}b 198.51.100.2/24 up
136	jexec client route add 198.51.100.0/24 203.0.113.129
137
138	jexec srv ifconfig lo0 127.0.0.1/8 up
139	jexec srv route add default 192.0.2.1
140	jexec srv sysctl net.inet.ip.forwarding=1
141
142	# Run echo server in srv jail
143	jexec srv /usr/sbin/inetd -p ${PWD}/multiwan.pid $(atf_get_srcdir)/echo_inetd.conf
144
145	jexec srv pfctl -e
146	pft_set_rules srv \
147		"nat on ${epair_one}b inet from 127.0.0.0/8 to any -> (${epair_one}b)" \
148		"nat on ${epair_two}b inet from 127.0.0.0/8 to any -> (${epair_two}b)" \
149		"rdr on ${epair_one}b inet proto tcp from any to 192.0.2.2 port 7 -> 127.0.0.1 port 7" \
150		"rdr on ${epair_two}b inet proto tcp from any to 198.51.100.2 port 7 -> 127.0.0.1 port 7" \
151		"block in"	\
152		"block out"	\
153		"pass in quick on ${epair_one}b reply-to (${epair_one}b 192.0.2.1) inet proto tcp from any to 127.0.0.1 port 7" \
154		"pass in quick on ${epair_two}b reply-to (${epair_two}b 198.51.100.1) inet proto tcp from any to 127.0.0.1 port 7"
155
156	# These will always succeed, because we don't change interface to route
157	# correctly here.
158	result=$(echo "one" | jexec wan_one nc -N -w 3 192.0.2.2 7)
159	if [ "${result}" != "one" ]; then
160		atf_fail "Redirect on one failed"
161	fi
162	result=$(echo "two" | jexec wan_two nc -N -w 3 198.51.100.2 7)
163	if [ "${result}" != "two" ]; then
164		atf_fail "Redirect on two failed"
165	fi
166
167	result=$(echo "one" | jexec client nc -N -w 3 192.0.2.2 7)
168	if [ "${result}" != "one" ]; then
169		atf_fail "Redirect from client on one failed"
170	fi
171
172	# This should trigger the issue fixed in 829a69db855b48ff7e8242b95e193a0783c489d9
173	result=$(echo "two" | jexec client nc -N -w 3 198.51.100.2 7)
174	if [ "${result}" != "two" ]; then
175		atf_fail "Redirect from client on two failed"
176	fi
177}
178
179multiwan_cleanup()
180{
181	pft_cleanup
182}
183
184atf_test_case "multiwanlocal" "cleanup"
185multiwanlocal_head()
186{
187	atf_set descr 'Multi-WAN local origin source-based redirection / route-to test'
188	atf_set require.user root
189}
190
191multiwanlocal_body()
192{
193	pft_init
194
195	epair_one=$(vnet_mkepair)
196	epair_two=$(vnet_mkepair)
197	epair_cl_one=$(vnet_mkepair)
198	epair_cl_two=$(vnet_mkepair)
199
200	vnet_mkjail srv1 ${epair_one}b
201	vnet_mkjail srv2 ${epair_two}b
202	vnet_mkjail wan_one ${epair_one}a ${epair_cl_one}b
203	vnet_mkjail wan_two ${epair_two}a ${epair_cl_two}b
204	vnet_mkjail client ${epair_cl_one}a ${epair_cl_two}a
205
206	jexec client ifconfig ${epair_cl_one}a 203.0.113.1/25
207	jexec wan_one ifconfig ${epair_cl_one}b 203.0.113.2/25
208	jexec wan_one ifconfig ${epair_one}a 192.0.2.1/24 up
209	jexec wan_one sysctl net.inet.ip.forwarding=1
210	jexec srv1 ifconfig ${epair_one}b 192.0.2.2/24 up
211
212	jexec client ifconfig ${epair_cl_two}a 203.0.113.128/25
213	jexec wan_two ifconfig ${epair_cl_two}b 203.0.113.129/25
214	jexec wan_two ifconfig ${epair_two}a 198.51.100.1/24 up
215	jexec wan_two sysctl net.inet.ip.forwarding=1
216	jexec srv2 ifconfig ${epair_two}b 198.51.100.2/24 up
217
218	jexec client route add default 203.0.113.2
219	jexec srv1 route add default 192.0.2.1
220	jexec srv2 route add default 198.51.100.1
221
222	# Run data source in srv1 and srv2
223	jexec srv1 sh -c 'dd if=/dev/zero bs=1024 count=100 | nc -l 7 -w 2 -N &'
224	jexec srv2 sh -c 'dd if=/dev/zero bs=1024 count=100 | nc -l 7 -w 2 -N &'
225
226	jexec client pfctl -e
227	pft_set_rules client \
228		"block in"	\
229		"block out"	\
230		"pass out quick route-to (${epair_cl_two}a 203.0.113.129) inet proto tcp from 203.0.113.128 to any port 7" \
231		"pass out on ${epair_cl_one}a inet proto tcp from any to any port 7" \
232		"set skip on lo"
233
234	# This should work
235	result=$(jexec client nc -N -w 1 192.0.2.2 7 | wc -c)
236	if [ ${result} -ne 102400 ]; then
237		jexec client pfctl -ss
238		atf_fail "Redirect from client on one failed: ${result}"
239	fi
240
241	# This should trigger the issue
242	result=$(jexec client nc -N -w 1 -s 203.0.113.128 198.51.100.2 7 | wc -c)
243	jexec client pfctl -ss
244	if [ ${result} -ne 102400 ]; then
245		atf_fail "Redirect from client on two failed: ${result}"
246	fi
247}
248
249multiwanlocal_cleanup()
250{
251	pft_cleanup
252}
253
254atf_test_case "icmp_nat" "cleanup"
255icmp_nat_head()
256{
257	atf_set descr 'Test that ICMP packets are correct for route-to + NAT'
258	atf_set require.user root
259	atf_set require.progs scapy
260}
261
262icmp_nat_body()
263{
264	pft_init
265
266	epair_one=$(vnet_mkepair)
267	epair_two=$(vnet_mkepair)
268	epair_three=$(vnet_mkepair)
269
270	vnet_mkjail gw ${epair_one}b ${epair_two}a ${epair_three}a
271	vnet_mkjail srv ${epair_two}b
272	vnet_mkjail srv2 ${epair_three}b
273
274	ifconfig ${epair_one}a 192.0.2.2/24 up
275	route add -net 198.51.100.0/24 192.0.2.1
276	jexec gw sysctl net.inet.ip.forwarding=1
277	jexec gw ifconfig ${epair_one}b 192.0.2.1/24 up
278	jexec gw ifconfig ${epair_two}a 198.51.100.1/24 up
279	jexec gw ifconfig ${epair_three}a 203.0.113.1/24 up mtu 500
280	jexec srv ifconfig ${epair_two}b 198.51.100.2/24 up
281	jexec srv route add default 198.51.100.1
282	jexec srv2 ifconfig ${epair_three}b 203.0.113.2/24 up mtu 500
283	jexec srv2 route add default 203.0.113.1
284
285	# Sanity check
286	atf_check -s exit:0 -o ignore ping -c 1 198.51.100.2
287
288	jexec gw pfctl -e
289	pft_set_rules gw \
290		"nat on ${epair_two}a inet from 192.0.2.0/24 to any -> (${epair_two}a)" \
291		"nat on ${epair_three}a inet from 192.0.2.0/24 to any -> (${epair_three}a)" \
292		"pass out route-to (${epair_three}a 203.0.113.2) proto icmp icmp-type echoreq"
293
294	# Now ensure that we get an ICMP error with the correct IP addresses in it.
295	atf_check -s exit:0 ${common_dir}/pft_icmp_check.py \
296		--to 198.51.100.2 \
297		--fromaddr 192.0.2.2 \
298		--recvif ${epair_one}a \
299		--sendif ${epair_one}a
300
301	# ping reports the ICMP error, so check of that too.
302	atf_check -s exit:2 -o match:'frag needed and DF set' \
303		ping -D -c 1 -s 1000 198.51.100.2
304}
305
306icmp_nat_cleanup()
307{
308	pft_cleanup
309}
310
311atf_test_case "dummynet" "cleanup"
312dummynet_head()
313{
314	atf_set descr 'Test that dummynet applies to route-to packets'
315	atf_set require.user root
316}
317
318dummynet_body()
319{
320	dummynet_init
321
322	epair_srv=$(vnet_mkepair)
323	epair_gw=$(vnet_mkepair)
324
325	vnet_mkjail srv ${epair_srv}a
326	jexec srv ifconfig ${epair_srv}a 192.0.2.1/24 up
327	jexec srv route add default 192.0.2.2
328
329	vnet_mkjail gw ${epair_srv}b ${epair_gw}a
330	jexec gw ifconfig ${epair_srv}b 192.0.2.2/24 up
331	jexec gw ifconfig ${epair_gw}a 198.51.100.1/24 up
332	jexec gw sysctl net.inet.ip.forwarding=1
333
334	ifconfig ${epair_gw}b 198.51.100.2/24 up
335	route add -net 192.0.2.0/24 198.51.100.1
336
337	# Sanity check
338	atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.1
339
340	jexec gw dnctl pipe 1 config delay 1200
341	pft_set_rules gw \
342		"pass out route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe 1"
343	jexec gw pfctl -e
344
345	# The ping request will pass, but take 1.2 seconds
346	# So this works:
347	atf_check -s exit:0 -o ignore ping -c 1 -t 2 192.0.2.1
348	# But this times out:
349	atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1
350
351	# return path dummynet
352	pft_set_rules gw \
353		"pass out route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe (0, 1)"
354
355	# The ping request will pass, but take 1.2 seconds
356	# So this works:
357	atf_check -s exit:0 -o ignore ping -c 1 -t 2 192.0.2.1
358	# But this times out:
359	atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1
360}
361
362dummynet_cleanup()
363{
364	pft_cleanup
365}
366
367atf_test_case "dummynet_in" "cleanup"
368dummynet_in_head()
369{
370	atf_set descr 'Thest that dummynet works as expected on pass in route-to packets'
371	atf_set require.user root
372}
373
374dummynet_in_body()
375{
376	dummynet_init
377
378	epair_srv=$(vnet_mkepair)
379	epair_gw=$(vnet_mkepair)
380
381	vnet_mkjail srv ${epair_srv}a
382	jexec srv ifconfig ${epair_srv}a 192.0.2.1/24 up
383	jexec srv route add default 192.0.2.2
384
385	vnet_mkjail gw ${epair_srv}b ${epair_gw}a
386	jexec gw ifconfig ${epair_srv}b 192.0.2.2/24 up
387	jexec gw ifconfig ${epair_gw}a 198.51.100.1/24 up
388	jexec gw sysctl net.inet.ip.forwarding=1
389
390	ifconfig ${epair_gw}b 198.51.100.2/24 up
391	route add -net 192.0.2.0/24 198.51.100.1
392
393	# Sanity check
394	atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.1
395
396	jexec gw dnctl pipe 1 config delay 1200
397	pft_set_rules gw \
398		"pass in route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe 1"
399	jexec gw pfctl -e
400
401	# The ping request will pass, but take 1.2 seconds
402	# So this works:
403	echo "Expect 1.2 s"
404	ping -c 1 192.0.2.1
405	atf_check -s exit:0 -o ignore ping -c 1 -t 2 192.0.2.1
406	# But this times out:
407	atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1
408
409	# return path dummynet
410	pft_set_rules gw \
411		"pass in route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe (0, 1)"
412
413	# The ping request will pass, but take 1.2 seconds
414	# So this works:
415	echo "Expect 1.2 s"
416	ping -c 1 192.0.2.1
417	atf_check -s exit:0 -o ignore ping -c 1 -t 2 192.0.2.1
418	# But this times out:
419	atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1
420}
421
422dummynet_in_cleanup()
423{
424	pft_cleanup
425}
426
427atf_test_case "ifbound" "cleanup"
428ifbound_head()
429{
430	atf_set descr 'Test that route-to states bind the expected interface'
431	atf_set require.user root
432}
433
434ifbound_body()
435{
436	pft_init
437
438	j="route_to:ifbound"
439
440	epair_one=$(vnet_mkepair)
441	epair_two=$(vnet_mkepair)
442	ifconfig ${epair_one}b up
443
444	vnet_mkjail ${j}2 ${epair_two}b
445	jexec ${j}2 ifconfig ${epair_two}b inet 198.51.100.2/24 up
446	jexec ${j}2 ifconfig ${epair_two}b inet alias 203.0.113.1/24
447	jexec ${j}2 route add default 198.51.100.1
448
449	vnet_mkjail $j ${epair_one}a ${epair_two}a
450	jexec $j ifconfig ${epair_one}a 192.0.2.1/24 up
451	jexec $j ifconfig ${epair_two}a 198.51.100.1/24 up
452	jexec $j route add default 192.0.2.2
453
454	jexec $j pfctl -e
455	pft_set_rules $j \
456		"set state-policy if-bound" \
457		"block" \
458		"pass out route-to (${epair_two}a 198.51.100.2)"
459
460	atf_check -s exit:0 -o ignore \
461	    jexec $j ping -c 3 203.0.113.1
462}
463
464ifbound_cleanup()
465{
466	pft_cleanup
467}
468
469atf_test_case "ifbound_v6" "cleanup"
470ifbound_v6_head()
471{
472	atf_set descr 'Test that route-to states for IPv6 bind the expected interface'
473	atf_set require.user root
474}
475
476ifbound_v6_body()
477{
478	pft_init
479
480	j="route_to:ifbound_v6"
481
482	epair_one=$(vnet_mkepair)
483	epair_two=$(vnet_mkepair)
484	ifconfig ${epair_one}b up
485
486	vnet_mkjail ${j}2 ${epair_two}b
487	jexec ${j}2 ifconfig ${epair_two}b inet6 2001:db8:1::2/64 up no_dad
488	jexec ${j}2 ifconfig ${epair_two}b inet6 alias 2001:db8:2::1/64 no_dad
489	jexec ${j}2 route -6 add default 2001:db8:1::1
490
491	vnet_mkjail $j ${epair_one}a ${epair_two}a
492	jexec $j ifconfig ${epair_one}a inet6 2001:db8::1/64 up no_dad
493	jexec $j ifconfig ${epair_two}a inet6 2001:db8:1::1/64 up no_dad
494	jexec $j route -6 add default 2001:db8::2
495
496	jexec $j ping6 -c 3 2001:db8:1::2
497
498	jexec $j pfctl -e
499	pft_set_rules $j \
500		"set state-policy if-bound" \
501		"block" \
502		"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
503		"pass out route-to (${epair_two}a 2001:db8:1::2)"
504
505	atf_check -s exit:0 -o ignore \
506	    jexec $j ping6 -c 3 2001:db8:2::1
507}
508
509ifbound_v6_cleanup()
510{
511	pft_cleanup
512}
513
514atf_test_case "ifbound_reply_to" "cleanup"
515ifbound_reply_to_head()
516{
517	atf_set descr 'Test that reply-to states bind to the expected interface'
518	atf_set require.user root
519}
520
521ifbound_reply_to_body()
522{
523	pft_init
524
525	j="route_to:ifbound_reply_to"
526
527	epair_one=$(vnet_mkepair)
528	epair_two=$(vnet_mkepair)
529	ifconfig ${epair_one}b inet 192.0.2.2/24 up
530	ifconfig ${epair_two}b up
531
532	vnet_mkjail $j ${epair_one}a ${epair_two}a
533	jexec $j ifconfig ${epair_one}a 192.0.2.1/24 up
534	jexec $j ifconfig ${epair_two}a 198.51.100.1/24 up
535	jexec $j route add default 198.51.100.254
536
537	jexec $j pfctl -e
538	pft_set_rules $j \
539		"set state-policy if-bound" \
540		"block" \
541		"pass in on ${epair_one}a reply-to (${epair_one}a 192.0.2.2) inet from any to 192.0.2.0/24 keep state"
542
543	atf_check -s exit:0 -o ignore \
544	    ping -c 3 192.0.2.1
545
546	atf_check -s exit:0 \
547	    ${common_dir}/pft_ping.py \
548	    --to 192.0.2.1 \
549	    --from 203.0.113.2 \
550	    --sendif ${epair_one}b \
551	    --replyif ${epair_one}b
552
553	# pft_ping uses the same ID every time, so this will look like more traffic in the same state
554	atf_check -s exit:0 \
555	    ${common_dir}/pft_ping.py \
556	    --to 192.0.2.1 \
557	    --from 203.0.113.2 \
558	    --sendif ${epair_one}b \
559	    --replyif ${epair_one}b
560
561	jexec $j pfctl -ss -vv
562}
563
564ifbound_reply_to_cleanup()
565{
566	pft_cleanup
567}
568
569atf_test_case "ifbound_reply_to_v6" "cleanup"
570ifbound_reply_to_v6_head()
571{
572	atf_set descr 'Test that reply-to states bind to the expected interface for IPv6'
573	atf_set require.user root
574}
575
576ifbound_reply_to_v6_body()
577{
578	pft_init
579
580	j="route_to:ifbound_reply_to_v6"
581
582	epair_one=$(vnet_mkepair)
583	epair_two=$(vnet_mkepair)
584
585	vnet_mkjail ${j}s ${epair_one}b ${epair_two}b
586	jexec ${j}s ifconfig ${epair_one}b inet6 2001:db8::2/64 up no_dad
587	jexec ${j}s ifconfig ${epair_two}b up
588	#jexec ${j}s route -6 add default 2001:db8::1
589
590	vnet_mkjail $j ${epair_one}a ${epair_two}a
591	jexec $j ifconfig ${epair_one}a inet6 2001:db8::1/64 up no_dad
592	jexec $j ifconfig ${epair_two}a inet6 2001:db8:1::1/64 up no_dad
593	jexec $j route -6 add default 2001:db8:1::254
594
595	jexec $j pfctl -e
596	pft_set_rules $j \
597		"set state-policy if-bound" \
598		"block" \
599		"pass quick inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \
600		"pass in on ${epair_one}a reply-to (${epair_one}a 2001:db8::2) inet6 from any to 2001:db8::/64 keep state"
601
602	atf_check -s exit:0 -o ignore \
603	    jexec ${j}s ping6 -c 3 2001:db8::1
604
605	atf_check -s exit:0 \
606	    jexec ${j}s ${common_dir}/pft_ping.py \
607	    --to 2001:db8::1 \
608	    --from 2001:db8:2::2 \
609	    --sendif ${epair_one}b \
610	    --replyif ${epair_one}b
611
612	# pft_ping uses the same ID every time, so this will look like more traffic in the same state
613	atf_check -s exit:0 \
614	    jexec ${j}s ${common_dir}/pft_ping.py \
615	    --to 2001:db8::1 \
616	    --from 2001:db8:2::2 \
617	    --sendif ${epair_one}b \
618	    --replyif ${epair_one}b
619
620	jexec $j pfctl -ss -vv
621}
622
623ifbound_reply_to_v6_cleanup()
624{
625	pft_cleanup
626}
627
628atf_test_case "ifbound_reply_to_rdr_dummynet" "cleanup"
629ifbound_reply_to_rdr_dummynet_head()
630{
631	atf_set descr 'Test that reply-to states bind to the expected non-default-route interface after rdr and dummynet'
632	atf_set require.user root
633}
634
635ifbound_reply_to_rdr_dummynet_body()
636{
637	dummynet_init
638
639	j="route_to:ifbound_reply_to_rdr_dummynet"
640
641	epair_one=$(vnet_mkepair)
642	epair_two=$(vnet_mkepair)
643	ifconfig ${epair_one}b inet 192.0.2.2/24 up
644	ifconfig ${epair_two}b up
645
646	vnet_mkjail $j ${epair_one}a ${epair_two}a
647	jexec $j ifconfig lo0 inet 127.0.0.1/8 up
648	jexec $j ifconfig ${epair_one}a 192.0.2.1/24 up
649	jexec $j ifconfig ${epair_two}a 198.51.100.1/24 up
650	jexec $j route add default 198.51.100.254
651
652	jexec $j pfctl -e
653	jexec $j dnctl pipe 1 config delay 1
654	pft_set_rules $j \
655		"set state-policy if-bound" \
656		"rdr on ${epair_one}a proto icmp from any to 192.0.2.1 -> 127.0.0.1" \
657		"rdr on ${epair_two}a proto icmp from any to 198.51.100.1 -> 127.0.0.1" \
658		"match in on ${epair_one}a inet all dnpipe (1, 1)" \
659		"pass in on ${epair_one}a reply-to (${epair_one}a 192.0.2.2) inet from any to 127.0.0.1 keep state"
660
661	atf_check -s exit:0 -o ignore \
662	    ping -c 3 192.0.2.1
663
664	atf_check -s exit:0 \
665	    ${common_dir}/pft_ping.py \
666	    --to 192.0.2.1 \
667	    --from 203.0.113.2 \
668	    --sendif ${epair_one}b \
669	    --replyif ${epair_one}b
670
671	# pft_ping uses the same ID every time, so this will look like more traffic in the same state
672	atf_check -s exit:0 \
673	    ${common_dir}/pft_ping.py \
674	    --to 192.0.2.1 \
675	    --from 203.0.113.2 \
676	    --sendif ${epair_one}b \
677	    --replyif ${epair_one}b
678
679	jexec $j pfctl -sr -vv
680	jexec $j pfctl -ss -vv
681}
682
683ifbound_reply_to_rdr_dummynet_cleanup()
684{
685	pft_cleanup
686}
687
688atf_test_case "dummynet_frag" "cleanup"
689dummynet_frag_head()
690{
691	atf_set descr 'Test fragmentation with route-to and dummynet'
692	atf_set require.user root
693}
694
695dummynet_frag_body()
696{
697	pft_init
698	dummynet_init
699
700	epair_one=$(vnet_mkepair)
701	epair_two=$(vnet_mkepair)
702
703	ifconfig ${epair_one}a 192.0.2.1/24 up
704
705	vnet_mkjail alcatraz ${epair_one}b ${epair_two}a
706	jexec alcatraz ifconfig ${epair_one}b 192.0.2.2/24 up
707	jexec alcatraz ifconfig ${epair_two}a 198.51.100.1/24 up
708	jexec alcatraz sysctl net.inet.ip.forwarding=1
709
710	vnet_mkjail singsing ${epair_two}b
711	jexec singsing ifconfig ${epair_two}b 198.51.100.2/24 up
712	jexec singsing route add default 198.51.100.1
713
714	route add 198.51.100.0/24 192.0.2.2
715
716	jexec alcatraz dnctl pipe 1 config bw 1000Byte/s burst 4500
717	jexec alcatraz dnctl pipe 2 config
718	# This second pipe ensures that the pf_test(PF_OUT) call in pf_route() doesn't
719	# delay packets in dummynet (by inheriting pipe 1 from the input rule).
720
721	jexec alcatraz pfctl -e
722	pft_set_rules alcatraz \
723		"set reassemble yes" \
724		"pass in route-to (${epair_two}a 198.51.100.2) inet proto icmp all icmp-type echoreq dnpipe 1" \
725		"pass out dnpipe 2"
726
727
728	atf_check -s exit:0 -o ignore ping -c 1 198.51.100.2
729	atf_check -s exit:0 -o ignore ping -c 1 -s 4000 198.51.100.2
730}
731
732dummynet_frag_cleanup()
733{
734	pft_cleanup
735}
736
737atf_test_case "dummynet_double" "cleanup"
738dummynet_double_head()
739{
740	atf_set descr 'Ensure dummynet is not applied multiple times'
741	atf_set require.user root
742}
743
744dummynet_double_body()
745{
746	pft_init
747	dummynet_init
748
749	epair_one=$(vnet_mkepair)
750	epair_two=$(vnet_mkepair)
751
752	ifconfig ${epair_one}a 192.0.2.1/24 up
753
754	vnet_mkjail alcatraz ${epair_one}b ${epair_two}a
755	jexec alcatraz ifconfig ${epair_one}b 192.0.2.2/24 up
756	jexec alcatraz ifconfig ${epair_two}a 198.51.100.1/24 up
757	jexec alcatraz sysctl net.inet.ip.forwarding=1
758
759	vnet_mkjail singsing ${epair_two}b
760	jexec singsing ifconfig ${epair_two}b 198.51.100.2/24 up
761	jexec singsing route add default 198.51.100.1
762
763	route add 198.51.100.0/24 192.0.2.2
764
765	jexec alcatraz dnctl pipe 1 config delay 800
766
767	jexec alcatraz pfctl -e
768	pft_set_rules alcatraz \
769		"set reassemble yes" \
770		"nat on ${epair_two}a from 192.0.2.0/24 -> (${epair_two}a)" \
771		"pass in route-to (${epair_two}a 198.51.100.2) inet proto icmp all icmp-type echoreq dnpipe (1, 1)" \
772		"pass out route-to (${epair_two}a 198.51.100.2) inet proto icmp all icmp-type echoreq"
773
774	ping -c 1 198.51.100.2
775	jexec alcatraz pfctl -sr -vv
776	jexec alcatraz pfctl -ss -vv
777
778	# We expect to be delayed 1.6 seconds, so timeout of two seconds passes, but
779	# timeout of 1 does not.
780	atf_check -s exit:0 -o ignore ping -t 2 -c 1 198.51.100.2
781	atf_check -s exit:2 -o ignore ping -t 1 -c 1 198.51.100.2
782}
783
784dummynet_double_cleanup()
785{
786	pft_cleanup
787}
788
789atf_init_test_cases()
790{
791	atf_add_test_case "v4"
792	atf_add_test_case "v6"
793	atf_add_test_case "multiwan"
794	atf_add_test_case "multiwanlocal"
795	atf_add_test_case "icmp_nat"
796	atf_add_test_case "dummynet"
797	atf_add_test_case "dummynet_in"
798	atf_add_test_case "ifbound"
799	atf_add_test_case "ifbound_v6"
800	atf_add_test_case "ifbound_reply_to"
801	atf_add_test_case "ifbound_reply_to_v6"
802	atf_add_test_case "ifbound_reply_to_rdr_dummynet"
803	atf_add_test_case "dummynet_frag"
804	atf_add_test_case "dummynet_double"
805}
806