xref: /freebsd/tests/sys/netpfil/pf/route_to.sh (revision 9f23cbd6cae82fd77edfad7173432fa8dccd0a95)
1# $FreeBSD$
2#
3# SPDX-License-Identifier: BSD-2-Clause
4#
5# Copyright (c) 2018 Kristof Provost <kp@FreeBSD.org>
6#
7# Redistribution and use in source and binary forms, with or without
8# modification, are permitted provided that the following conditions
9# are met:
10# 1. Redistributions of source code must retain the above copyright
11#    notice, this list of conditions and the following disclaimer.
12# 2. Redistributions in binary form must reproduce the above copyright
13#    notice, this list of conditions and the following disclaimer in the
14#    documentation and/or other materials provided with the distribution.
15#
16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26# SUCH DAMAGE.
27
28. $(atf_get_srcdir)/utils.subr
29
30common_dir=$(atf_get_srcdir)/../common
31
32atf_test_case "v4" "cleanup"
33v4_head()
34{
35	atf_set descr 'Basic route-to test'
36	atf_set require.user root
37}
38
39v4_body()
40{
41	pft_init
42
43	epair_send=$(vnet_mkepair)
44	ifconfig ${epair_send}a 192.0.2.1/24 up
45	epair_route=$(vnet_mkepair)
46	ifconfig ${epair_route}a 203.0.113.1/24 up
47
48	vnet_mkjail alcatraz ${epair_send}b ${epair_route}b
49	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
50	jexec alcatraz ifconfig ${epair_route}b 203.0.113.2/24 up
51	jexec alcatraz route add -net 198.51.100.0/24 192.0.2.1
52	jexec alcatraz pfctl -e
53
54	# Attempt to provoke PR 228782
55	pft_set_rules alcatraz "block all" "pass user 2" \
56		"pass out route-to (${epair_route}b 203.0.113.1) from 192.0.2.2 to 198.51.100.1 no state"
57	jexec alcatraz nc -w 3 -s 192.0.2.2 198.51.100.1 22
58
59	# atf wants us to not return an error, but our netcat will fail
60	true
61}
62
63v4_cleanup()
64{
65	pft_cleanup
66}
67
68atf_test_case "v6" "cleanup"
69v6_head()
70{
71	atf_set descr 'Basic route-to test (IPv6)'
72	atf_set require.user root
73}
74
75v6_body()
76{
77	pft_init
78
79	epair_send=$(vnet_mkepair)
80	ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled
81	epair_route=$(vnet_mkepair)
82	ifconfig ${epair_route}a inet6 2001:db8:43::1/64 up no_dad -ifdisabled
83
84	vnet_mkjail alcatraz ${epair_send}b ${epair_route}b
85	jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad
86	jexec alcatraz ifconfig ${epair_route}b inet6 2001:db8:43::2/64 up no_dad
87	jexec alcatraz route add -6 2001:db8:666::/64 2001:db8:42::2
88	jexec alcatraz pfctl -e
89
90	# Attempt to provoke PR 228782
91	pft_set_rules alcatraz "block all" "pass user 2" \
92		"pass out route-to (${epair_route}b 2001:db8:43::1) from 2001:db8:42::2 to 2001:db8:666::1 no state"
93	jexec alcatraz nc -6 -w 3 -s 2001:db8:42::2 2001:db8:666::1 22
94
95	# atf wants us to not return an error, but our netcat will fail
96	true
97}
98
99v6_cleanup()
100{
101	pft_cleanup
102}
103
104atf_test_case "multiwan" "cleanup"
105multiwan_head()
106{
107	atf_set descr 'Multi-WAN redirection / reply-to test'
108	atf_set require.user root
109}
110
111multiwan_body()
112{
113	pft_init
114
115	epair_one=$(vnet_mkepair)
116	epair_two=$(vnet_mkepair)
117	epair_cl_one=$(vnet_mkepair)
118	epair_cl_two=$(vnet_mkepair)
119
120	vnet_mkjail srv ${epair_one}b ${epair_two}b
121	vnet_mkjail wan_one ${epair_one}a ${epair_cl_one}b
122	vnet_mkjail wan_two ${epair_two}a ${epair_cl_two}b
123	vnet_mkjail client ${epair_cl_one}a ${epair_cl_two}a
124
125	jexec client ifconfig ${epair_cl_one}a 203.0.113.1/25
126	jexec wan_one ifconfig ${epair_cl_one}b 203.0.113.2/25
127	jexec wan_one ifconfig ${epair_one}a 192.0.2.1/24 up
128	jexec wan_one sysctl net.inet.ip.forwarding=1
129	jexec srv ifconfig ${epair_one}b 192.0.2.2/24 up
130	jexec client route add 192.0.2.0/24 203.0.113.2
131
132	jexec client ifconfig ${epair_cl_two}a 203.0.113.128/25
133	jexec wan_two ifconfig ${epair_cl_two}b 203.0.113.129/25
134	jexec wan_two ifconfig ${epair_two}a 198.51.100.1/24 up
135	jexec wan_two sysctl net.inet.ip.forwarding=1
136	jexec srv ifconfig ${epair_two}b 198.51.100.2/24 up
137	jexec client route add 198.51.100.0/24 203.0.113.129
138
139	jexec srv ifconfig lo0 127.0.0.1/8 up
140	jexec srv route add default 192.0.2.1
141	jexec srv sysctl net.inet.ip.forwarding=1
142
143	# Run echo server in srv jail
144	jexec srv /usr/sbin/inetd -p multiwan.pid $(atf_get_srcdir)/echo_inetd.conf
145
146	jexec srv pfctl -e
147	pft_set_rules srv \
148		"nat on ${epair_one}b inet from 127.0.0.0/8 to any -> (${epair_one}b)" \
149		"nat on ${epair_two}b inet from 127.0.0.0/8 to any -> (${epair_two}b)" \
150		"rdr on ${epair_one}b inet proto tcp from any to 192.0.2.2 port 7 -> 127.0.0.1 port 7" \
151		"rdr on ${epair_two}b inet proto tcp from any to 198.51.100.2 port 7 -> 127.0.0.1 port 7" \
152		"block in"	\
153		"block out"	\
154		"pass in quick on ${epair_one}b reply-to (${epair_one}b 192.0.2.1) inet proto tcp from any to 127.0.0.1 port 7" \
155		"pass in quick on ${epair_two}b reply-to (${epair_two}b 198.51.100.1) inet proto tcp from any to 127.0.0.1 port 7"
156
157	# These will always succeed, because we don't change interface to route
158	# correctly here.
159	result=$(echo "one" | jexec wan_one nc -N -w 3 192.0.2.2 7)
160	if [ "${result}" != "one" ]; then
161		atf_fail "Redirect on one failed"
162	fi
163	result=$(echo "two" | jexec wan_two nc -N -w 3 198.51.100.2 7)
164	if [ "${result}" != "two" ]; then
165		atf_fail "Redirect on two failed"
166	fi
167
168	result=$(echo "one" | jexec client nc -N -w 3 192.0.2.2 7)
169	if [ "${result}" != "one" ]; then
170		atf_fail "Redirect from client on one failed"
171	fi
172
173	# This should trigger the issue fixed in 829a69db855b48ff7e8242b95e193a0783c489d9
174	result=$(echo "two" | jexec client nc -N -w 3 198.51.100.2 7)
175	if [ "${result}" != "two" ]; then
176		atf_fail "Redirect from client on two failed"
177	fi
178}
179
180multiwan_cleanup()
181{
182	rm -f multiwan.pid
183	pft_cleanup
184}
185
186atf_test_case "multiwanlocal" "cleanup"
187multiwanlocal_head()
188{
189	atf_set descr 'Multi-WAN local origin source-based redirection / route-to test'
190	atf_set require.user root
191}
192
193multiwanlocal_body()
194{
195	pft_init
196
197	epair_one=$(vnet_mkepair)
198	epair_two=$(vnet_mkepair)
199	epair_cl_one=$(vnet_mkepair)
200	epair_cl_two=$(vnet_mkepair)
201
202	vnet_mkjail srv1 ${epair_one}b
203	vnet_mkjail srv2 ${epair_two}b
204	vnet_mkjail wan_one ${epair_one}a ${epair_cl_one}b
205	vnet_mkjail wan_two ${epair_two}a ${epair_cl_two}b
206	vnet_mkjail client ${epair_cl_one}a ${epair_cl_two}a
207
208	jexec client ifconfig ${epair_cl_one}a 203.0.113.1/25
209	jexec wan_one ifconfig ${epair_cl_one}b 203.0.113.2/25
210	jexec wan_one ifconfig ${epair_one}a 192.0.2.1/24 up
211	jexec wan_one sysctl net.inet.ip.forwarding=1
212	jexec srv1 ifconfig ${epair_one}b 192.0.2.2/24 up
213
214	jexec client ifconfig ${epair_cl_two}a 203.0.113.128/25
215	jexec wan_two ifconfig ${epair_cl_two}b 203.0.113.129/25
216	jexec wan_two ifconfig ${epair_two}a 198.51.100.1/24 up
217	jexec wan_two sysctl net.inet.ip.forwarding=1
218	jexec srv2 ifconfig ${epair_two}b 198.51.100.2/24 up
219
220	jexec client route add default 203.0.113.2
221	jexec srv1 route add default 192.0.2.1
222	jexec srv2 route add default 198.51.100.1
223
224	# Run data source in srv1 and srv2
225	jexec srv1 sh -c 'dd if=/dev/zero bs=1024 count=100 | nc -l 7 -w 2 -N &'
226	jexec srv2 sh -c 'dd if=/dev/zero bs=1024 count=100 | nc -l 7 -w 2 -N &'
227
228	jexec client pfctl -e
229	pft_set_rules client \
230		"block in"	\
231		"block out"	\
232		"pass out quick route-to (${epair_cl_two}a 203.0.113.129) inet proto tcp from 203.0.113.128 to any port 7" \
233		"pass out on ${epair_cl_one}a inet proto tcp from any to any port 7" \
234		"set skip on lo"
235
236	# This should work
237	result=$(jexec client nc -N -w 1 192.0.2.2 7 | wc -c)
238	if [ ${result} -ne 102400 ]; then
239		jexec client pfctl -ss
240		atf_fail "Redirect from client on one failed: ${result}"
241	fi
242
243	# This should trigger the issue
244	result=$(jexec client nc -N -w 1 -s 203.0.113.128 198.51.100.2 7 | wc -c)
245	jexec client pfctl -ss
246	if [ ${result} -ne 102400 ]; then
247		atf_fail "Redirect from client on two failed: ${result}"
248	fi
249}
250
251multiwanlocal_cleanup()
252{
253	pft_cleanup
254}
255
256atf_test_case "icmp_nat" "cleanup"
257icmp_nat_head()
258{
259	atf_set descr 'Test that ICMP packets are correct for route-to + NAT'
260	atf_set require.user root
261	atf_set require.progs scapy
262}
263
264icmp_nat_body()
265{
266	pft_init
267
268	epair_one=$(vnet_mkepair)
269	epair_two=$(vnet_mkepair)
270	epair_three=$(vnet_mkepair)
271
272	vnet_mkjail gw ${epair_one}b ${epair_two}a ${epair_three}a
273	vnet_mkjail srv ${epair_two}b
274	vnet_mkjail srv2 ${epair_three}b
275
276	ifconfig ${epair_one}a 192.0.2.2/24 up
277	route add -net 198.51.100.0/24 192.0.2.1
278	jexec gw sysctl net.inet.ip.forwarding=1
279	jexec gw ifconfig ${epair_one}b 192.0.2.1/24 up
280	jexec gw ifconfig ${epair_two}a 198.51.100.1/24 up
281	jexec gw ifconfig ${epair_three}a 203.0.113.1/24 up mtu 500
282	jexec srv ifconfig ${epair_two}b 198.51.100.2/24 up
283	jexec srv route add default 198.51.100.1
284	jexec srv2 ifconfig ${epair_three}b 203.0.113.2/24 up mtu 500
285	jexec srv2 route add default 203.0.113.1
286
287	# Sanity check
288	atf_check -s exit:0 -o ignore ping -c 1 198.51.100.2
289
290	jexec gw pfctl -e
291	pft_set_rules gw \
292		"nat on ${epair_two}a inet from 192.0.2.0/24 to any -> (${epair_two}a)" \
293		"nat on ${epair_three}a inet from 192.0.2.0/24 to any -> (${epair_three}a)" \
294		"pass out route-to (${epair_three}a 203.0.113.2) proto icmp icmp-type echoreq"
295
296	# Now ensure that we get an ICMP error with the correct IP addresses in it.
297	atf_check -s exit:0 ${common_dir}/pft_icmp_check.py \
298		--to 198.51.100.2 \
299		--fromaddr 192.0.2.2 \
300		--recvif ${epair_one}a \
301		--sendif ${epair_one}a
302
303	# ping reports the ICMP error, so check of that too.
304	atf_check -s exit:2 -o match:'frag needed and DF set' \
305		ping -D -c 1 -s 1000 198.51.100.2
306}
307
308icmp_nat_cleanup()
309{
310	pft_cleanup
311}
312
313atf_test_case "dummynet" "cleanup"
314dummynet_head()
315{
316	atf_set descr 'Test that dummynet applies to route-to packets'
317	atf_set require.user root
318}
319
320dummynet_body()
321{
322	dummynet_init
323
324	epair_srv=$(vnet_mkepair)
325	epair_gw=$(vnet_mkepair)
326
327	vnet_mkjail srv ${epair_srv}a
328	jexec srv ifconfig ${epair_srv}a 192.0.2.1/24 up
329	jexec srv route add default 192.0.2.2
330
331	vnet_mkjail gw ${epair_srv}b ${epair_gw}a
332	jexec gw ifconfig ${epair_srv}b 192.0.2.2/24 up
333	jexec gw ifconfig ${epair_gw}a 198.51.100.1/24 up
334	jexec gw sysctl net.inet.ip.forwarding=1
335
336	ifconfig ${epair_gw}b 198.51.100.2/24 up
337	route add -net 192.0.2.0/24 198.51.100.1
338
339	# Sanity check
340	atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.1
341
342	jexec gw dnctl pipe 1 config delay 1200
343	pft_set_rules gw \
344		"pass out route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe 1"
345	jexec gw pfctl -e
346
347	# The ping request will pass, but take 1.2 seconds
348	# So this works:
349	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1
350	# But this times out:
351	atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1
352
353	# return path dummynet
354	pft_set_rules gw \
355		"pass out route-to (${epair_srv}b 192.0.2.1) to 192.0.2.1 dnpipe (0, 1)"
356
357	# The ping request will pass, but take 1.2 seconds
358	# So this works:
359	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1
360	# But this times out:
361	atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.1
362}
363
364dummynet_cleanup()
365{
366	pft_cleanup
367}
368
369atf_init_test_cases()
370{
371	atf_add_test_case "v4"
372	atf_add_test_case "v6"
373	atf_add_test_case "multiwan"
374	atf_add_test_case "multiwanlocal"
375	atf_add_test_case "icmp_nat"
376	atf_add_test_case "dummynet"
377}
378