xref: /freebsd/tests/sys/netpfil/pf/set_tos.sh (revision cfd6422a5217410fbd66f7a7a8a64d9d85e61229)
1# $FreeBSD$
2#
3# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4#
5# Copyright (c) 2017 Kristof Provost <kp@FreeBSD.org>
6#
7# Redistribution and use in source and binary forms, with or without
8# modification, are permitted provided that the following conditions
9# are met:
10# 1. Redistributions of source code must retain the above copyright
11#    notice, this list of conditions and the following disclaimer.
12# 2. Redistributions in binary form must reproduce the above copyright
13#    notice, this list of conditions and the following disclaimer in the
14#    documentation and/or other materials provided with the distribution.
15#
16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26# SUCH DAMAGE.
27
28. $(atf_get_srcdir)/utils.subr
29
30common_dir=$(atf_get_srcdir)/../common
31
32atf_test_case "v4" "cleanup"
33v4_head()
34{
35	atf_set descr 'set-tos test'
36	atf_set require.user root
37
38	# We need scapy to be installed for out test scripts to work
39	atf_set require.progs scapy
40}
41
42v4_body()
43{
44	pft_init
45
46	epair_send=$(vnet_mkepair)
47	ifconfig ${epair_send}a 192.0.2.1/24 up
48
49	epair_recv=$(vnet_mkepair)
50	ifconfig ${epair_recv}a up
51
52	vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b
53	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
54	jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up
55	jexec alcatraz sysctl net.inet.ip.forwarding=1
56	jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05
57	route add -net 198.51.100.0/24 192.0.2.2
58
59	jexec alcatraz pfctl -e
60
61	# No change is done if not requested
62	pft_set_rules alcatraz "scrub out proto icmp"
63	atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \
64		--sendif ${epair_send}a \
65		--to 198.51.100.3 \
66		--recvif ${epair_recv}a \
67		--expect-tos 42
68
69	# The requested ToS is set
70	pft_set_rules alcatraz "scrub out proto icmp set-tos 42"
71	atf_check -s exit:0 ${common_dir}/pft_ping.py \
72		--sendif ${epair_send}a \
73		--to 198.51.100.3 \
74		--recvif ${epair_recv}a \
75		--expect-tos 42
76
77	# ToS is not changed if the scrub rule does not match
78	pft_set_rules alcatraz "scrub out proto tcp set-tos 42"
79	atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \
80		--sendif ${epair_send}a \
81		--to 198.51.100.3 \
82		--recvif ${epair_recv}a \
83		--expect-tos 42
84
85	# Multiple scrub rules match as expected
86	pft_set_rules alcatraz "scrub out proto tcp set-tos 13" \
87		"scrub out proto icmp set-tos 14"
88	atf_check -s exit:0 ${common_dir}/pft_ping.py \
89		--sendif ${epair_send}a \
90		--to 198.51.100.3 \
91		--recvif ${epair_recv}a \
92		--expect-tos 14
93
94	# And this works even if the packet already has ToS values set
95	atf_check -s exit:0 ${common_dir}/pft_ping.py \
96		--sendif ${epair_send}a \
97		--to 198.51.100.3 \
98		--recvif ${epair_recv}a \
99		--send-tos 42 \
100		--expect-tos 14
101
102	# ToS values are unmolested if the packets do not match a scrub rule
103	pft_set_rules alcatraz "scrub out proto tcp set-tos 13"
104	atf_check -s exit:0 ${common_dir}/pft_ping.py \
105		--sendif ${epair_send}a \
106		--to 198.51.100.3 \
107		--recvif ${epair_recv}a \
108		--send-tos 42 \
109		--expect-tos 42
110}
111
112v4_cleanup()
113{
114	pft_cleanup
115}
116
117atf_init_test_cases()
118{
119	atf_add_test_case "v4"
120}
121