1# 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2021 Rubicon Communications, LLC (Netgate) 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26 27. $(atf_get_srcdir)/utils.subr 28 29atf_test_case "get_clear" "cleanup" 30get_clear_head() 31{ 32 atf_set descr 'Test clearing rules counters on get rules' 33 atf_set require.user root 34} 35 36get_clear_body() 37{ 38 pft_init 39 40 epair_send=$(vnet_mkepair) 41 ifconfig ${epair_send}a 192.0.2.1/24 up 42 43 vnet_mkjail alcatraz ${epair_send}b 44 jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up 45 jexec alcatraz pfctl -e 46 47 pft_set_rules alcatraz \ 48 "pass all" 49 50 # Ensure the rule matched packets, so we can verify non-zero counters 51 atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2 52 53 # Expect non-zero counters 54 atf_check -s exit:0 -e ignore \ 55 -o match:'Evaluations: [1-9][0-9]*[[:space:]]*Packets: [1-9][0-9]*[[:space:]]*Bytes: [1-9][0-9]*[[:space:]]*' \ 56 jexec alcatraz pfctl -s r -v 57 58 # We should still see non-zero because we didn't clear on the last 59 # pfctl, but are going to clear now 60 atf_check -s exit:0 -e ignore \ 61 -o match:'Evaluations: [1-9][0-9]*[[:space:]]*Packets: [1-9][0-9]*[[:space:]]*Bytes: [1-9][0-9]*[[:space:]]*' \ 62 jexec alcatraz pfctl -s r -v -z 63 64 # Expect zero counters 65 atf_check -s exit:0 -e ignore \ 66 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \ 67 jexec alcatraz pfctl -s r -v 68} 69 70get_clear_cleanup() 71{ 72 pft_cleanup 73} 74 75atf_test_case "keepcounters" "cleanup" 76keepcounters_head() 77{ 78 atf_set descr 'Test keepcounter functionality' 79 atf_set require.user root 80} 81 82keepcounters_body() 83{ 84 pft_init 85 86 epair_send=$(vnet_mkepair) 87 ifconfig ${epair_send}a 192.0.2.1/24 up 88 89 vnet_mkjail alcatraz ${epair_send}b 90 jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up 91 jexec alcatraz pfctl -e 92 93 pft_set_rules alcatraz \ 94 "pass all" 95 96 # Expect zero counters 97 atf_check -s exit:0 -e ignore \ 98 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \ 99 jexec alcatraz pfctl -s r -v 100 101 # Ensure the rule matched packets, so we can verify non-zero counters 102 atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2 103 104 # Expect non-zero counters 105 atf_check -s exit:0 -e ignore \ 106 -o match:'Evaluations: [1-9][0-9]*[[:space:]]*Packets: [1-9][0-9]*[[:space:]]*Bytes: [1-9][0-9]*[[:space:]]*' \ 107 jexec alcatraz pfctl -s r -v 108 109 # As we set the (same) rules again we'd expect the counters to return 110 # to zero 111 pft_set_rules noflush alcatraz \ 112 "pass all" 113 114 atf_check -s exit:0 -e ignore \ 115 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \ 116 jexec alcatraz pfctl -s r -v 117 118 # Increment rule counters 119 atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2 120 121 # Now set new rules with 'keepcounters' set, so we'd expect nonzero 122 # counters 123 pft_set_rules noflush alcatraz \ 124 "set keepcounters" \ 125 "pass all" 126 127 atf_check -s exit:0 -e ignore \ 128 -o match:'Evaluations: [1-9][0-9]*[[:space:]]*Packets: [1-9][0-9]*[[:space:]]*Bytes: [1-9][0-9]*[[:space:]]*' \ 129 jexec alcatraz pfctl -s r -v 130 131 # However, if we set a different rule it should return to zero 132 pft_set_rules noflush alcatraz \ 133 "set keepcounters" \ 134 "pass inet all" 135 136 atf_check -s exit:0 -e ignore \ 137 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \ 138 jexec alcatraz pfctl -s r -v 139 140 # If we generate traffic and don't set keepcounters we also see zero 141 # counts when setting new rules 142 atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2 143 pft_set_rules noflush alcatraz \ 144 "pass inet all" 145 146 atf_check -s exit:0 -e ignore \ 147 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \ 148 jexec alcatraz pfctl -s r -v 149} 150 151atf_test_case "4G" "cleanup" 1524G_head() 153{ 154 atf_set descr 'Test keepcounter for values above 32 bits' 155 atf_set require.user root 156} 157 1584G_body() 159{ 160 pft_init 161 162 epair=$(vnet_mkepair) 163 ifconfig ${epair}a 192.0.2.1/24 up 164 165 vnet_mkjail alcatraz ${epair}b 166 jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up 167 jexec alcatraz nc -l 1234 >/dev/null & 168 169 jexec alcatraz pfctl -e 170 pft_set_rules alcatraz \ 171 "pass all" 172 173 # Now pass more than 4GB of data 174 dd if=/dev/zero bs=1k count=4M | nc -N 192.0.2.2 1234 175 176 bytes=$(jexec alcatraz pfctl -s r -v | awk '/Bytes:/ { print $7; }') 177 if [ $bytes -lt 4000000000 ]; 178 then 179 atf_fail "Expected to see > 4GB" 180 fi 181 182 # Set new rules, keeping counters 183 pft_set_rules noflush alcatraz \ 184 "set keepcounters" \ 185 "pass all" 186 187 bytes=$(jexec alcatraz pfctl -s r -v | awk '/Bytes:/ { print $7; }') 188 if [ $bytes -lt 4000000000 ]; 189 then 190 atf_fail "Expected to see > 4GB after rule reload" 191 fi 192} 193 1944G_cleanup() 195{ 196 pft_cleanup 197} 198 199keepcounters_cleanup() 200{ 201 pft_cleanup 202} 203 204atf_init_test_cases() 205{ 206 atf_add_test_case "get_clear" 207 atf_add_test_case "keepcounters" 208 atf_add_test_case "4G" 209} 210