1# 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2020 Kristof Provost <kp@FreeBSD.org> 5# Copyright (c) 2024 Kajetan Staszkiewicz <vegeta@tuxpowered.net> 6# 7# Redistribution and use in source and binary forms, with or without 8# modification, are permitted provided that the following conditions 9# are met: 10# 1. Redistributions of source code must retain the above copyright 11# notice, this list of conditions and the following disclaimer. 12# 2. Redistributions in binary form must reproduce the above copyright 13# notice, this list of conditions and the following disclaimer in the 14# documentation and/or other materials provided with the distribution. 15# 16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26# SUCH DAMAGE. 27 28. $(atf_get_srcdir)/utils.subr 29 30atf_test_case "source_track" "cleanup" 31source_track_head() 32{ 33 atf_set descr 'Basic source tracking test' 34 atf_set require.user root 35} 36 37source_track_body() 38{ 39 pft_init 40 41 epair=$(vnet_mkepair) 42 43 vnet_mkjail alcatraz ${epair}b 44 45 ifconfig ${epair}a 192.0.2.2/24 up 46 jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up 47 48 # Enable pf! 49 jexec alcatraz pfctl -e 50 pft_set_rules alcatraz \ 51 "pass in keep state (source-track)" \ 52 "pass out keep state (source-track)" 53 54 ping -c 3 192.0.2.1 55 atf_check -s exit:0 -o match:'192.0.2.2 -> 0.0.0.0 \( states 1,.*' \ 56 jexec alcatraz pfctl -sS 57 58 # Flush all source nodes 59 jexec alcatraz pfctl -FS 60 61 # We can't find the previous source node any more 62 atf_check -s exit:0 -o not-match:'192.0.2.2 -> 0.0.0.0 \( states 1,.*' \ 63 jexec alcatraz pfctl -sS 64 65 # But we still have the state 66 atf_check -s exit:0 -o match:'all icmp 192.0.2.1:8 <- 192.0.2.2:.*' \ 67 jexec alcatraz pfctl -ss 68} 69 70source_track_cleanup() 71{ 72 pft_cleanup 73} 74 75atf_test_case "kill" "cleanup" 76kill_head() 77{ 78 atf_set descr 'Test killing source nodes' 79 atf_set require.user root 80} 81 82kill_body() 83{ 84 pft_init 85 86 epair=$(vnet_mkepair) 87 vnet_mkjail alcatraz ${epair}b 88 89 ifconfig ${epair}a 192.0.2.2/24 up 90 ifconfig ${epair}a inet alias 192.0.2.3/24 up 91 jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up 92 93 # Enable pf! 94 jexec alcatraz pfctl -e 95 pft_set_rules alcatraz \ 96 "pass in keep state (source-track)" \ 97 "pass out keep state (source-track)" 98 99 # Establish two sources 100 atf_check -s exit:0 -o ignore \ 101 ping -c 1 -S 192.0.2.2 192.0.2.1 102 atf_check -s exit:0 -o ignore \ 103 ping -c 1 -S 192.0.2.3 192.0.2.1 104 105 # Check that both source nodes exist 106 atf_check -s exit:0 -o match:'192.0.2.2 -> 0.0.0.0 \( states 1,.*' \ 107 jexec alcatraz pfctl -sS 108 atf_check -s exit:0 -o match:'192.0.2.3 -> 0.0.0.0 \( states 1,.*' \ 109 jexec alcatraz pfctl -sS 110 111 112jexec alcatraz pfctl -sS 113 114 # Kill the 192.0.2.2 source 115 jexec alcatraz pfctl -K 192.0.2.2 116 117 # The other source still exists 118 atf_check -s exit:0 -o match:'192.0.2.3 -> 0.0.0.0 \( states 1,.*' \ 119 jexec alcatraz pfctl -sS 120 121 # But not the one we killed 122 atf_check -s exit:0 -o not-match:'192.0.2.2 -> 0.0.0.0 \( states 1,.*' \ 123 jexec alcatraz pfctl -sS 124} 125 126kill_cleanup() 127{ 128 pft_cleanup 129} 130 131max_src_conn_rule_head() 132{ 133 atf_set descr 'Max connections per source per rule' 134 atf_set require.user root 135} 136 137max_src_conn_rule_body() 138{ 139 setup_router_server_ipv6 140 141 # Clients will connect from another network behind the router. 142 # This allows for using multiple source addresses and for tester jail 143 # to not respond with RST packets for SYN+ACKs. 144 jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 145 jexec server route add -6 2001:db8:44::0/64 2001:db8:43::1 146 147 pft_set_rules router \ 148 "block" \ 149 "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ 150 "pass in on ${epair_tester}b inet6 proto tcp keep state (max-src-conn 3 source-track rule overload <bad_hosts>)" \ 151 "pass out on ${epair_server}a inet6 proto tcp keep state" 152 153 # Limiting of connections is done for connections which have successfully 154 # finished the 3-way handshake. Once the handshake is done, the state 155 # is moved to CLOSED state. We use pft_ping.py to check that the handshake 156 # was really successful and after that we check what is in pf state table. 157 158 # 3 connections from host ::1 will be allowed. 159 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4201 --fromaddr 2001:db8:44::1 160 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4202 --fromaddr 2001:db8:44::1 161 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4203 --fromaddr 2001:db8:44::1 162 # The 4th connection from host ::1 will have its state killed. 163 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4204 --fromaddr 2001:db8:44::1 164 # A connection from host :2 is will be allowed. 165 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4205 --fromaddr 2001:db8:44::2 166 167 states=$(mktemp) || exit 1 168 jexec router pfctl -qss | grep 'tcp 2001:db8:43::2\[9\] <-' > $states 169 170 grep -qE '2001:db8:44::1\[4201\]\s+ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4201 not found or not established" 171 grep -qE '2001:db8:44::1\[4202\]\s+ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4202 not found or not established" 172 grep -qE '2001:db8:44::1\[4203\]\s+ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4203 not found or not established" 173 grep -qE '2001:db8:44::2\[4205\]\s+ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4205 not found or not established" 174 175 if ( 176 grep -qE '2001:db8:44::1\[4204\]\s+' $states && 177 ! grep -qE '2001:db8:44::1\[4204\]\s+CLOSED:CLOSED' $states 178 ); then 179 atf_fail "State for port 4204 found but not closed" 180 fi 181 182 jexec router pfctl -T test -t bad_hosts 2001:db8:44::1 || atf_fail "Host not found in overload table" 183} 184 185max_src_conn_rule_cleanup() 186{ 187 pft_cleanup 188} 189 190max_src_states_rule_head() 191{ 192 atf_set descr 'Max states per source per rule' 193 atf_set require.user root 194} 195 196max_src_states_rule_body() 197{ 198 setup_router_server_ipv6 199 200 # Clients will connect from another network behind the router. 201 # This allows for using multiple source addresses and for tester jail 202 # to not respond with RST packets for SYN+ACKs. 203 jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 204 jexec server route add -6 2001:db8:44::0/64 2001:db8:43::1 205 206 pft_set_rules router \ 207 "block" \ 208 "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ 209 "pass in on ${epair_tester}b inet6 proto tcp from port 4210:4219 keep state (max-src-states 3 source-track rule) label rule_A" \ 210 "pass in on ${epair_tester}b inet6 proto tcp from port 4220:4229 keep state (max-src-states 3 source-track rule) label rule_B" \ 211 "pass out on ${epair_server}a keep state" 212 213 # The option max-src-states prevents even the initial SYN packet going 214 # through. It's enough that we check ping_server_check_reply, no need to 215 # bother checking created states. 216 217 # 2 connections from host ::1 matching rule_A will be allowed, 1 will fail to create a state. 218 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4211 --fromaddr 2001:db8:44::1 219 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4212 --fromaddr 2001:db8:44::1 220 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4213 --fromaddr 2001:db8:44::1 221 222 # 2 connections from host ::1 matching rule_B will be allowed, 1 will fail to create a state. 223 # Limits from rule_A don't interfere with rule_B. 224 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4221 --fromaddr 2001:db8:44::1 225 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4222 --fromaddr 2001:db8:44::1 226 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4223 --fromaddr 2001:db8:44::1 227 228 # 2 connections from host ::2 matching rule_B will be allowed, 1 will fail to create a state. 229 # Limits for host ::1 will not interfere with host ::2. 230 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4224 --fromaddr 2001:db8:44::2 231 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4225 --fromaddr 2001:db8:44::2 232 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4226 --fromaddr 2001:db8:44::2 233 234 # We will check the resulting source nodes, though. 235 # Order of source nodes in output is not guaranteed, find each one separately. 236 nodes=$(mktemp) || exit 1 237 jexec router pfctl -qvsS > $nodes 238 for node_regexp in \ 239 '2001:db8:44::1 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 3' \ 240 '2001:db8:44::1 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 4' \ 241 '2001:db8:44::2 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 4' \ 242 ; do 243 cat $nodes | tr '\n' ' ' | grep -qE "$node_regexp" || atf_fail "Source nodes not matching expected output" 244 done 245 246 # Check if limit counters have been properly set. 247 jexec router pfctl -qvvsi | grep -qE 'max-src-states\s+3\s+' || atf_fail "max-src-states not set to 3" 248} 249 250max_src_states_rule_cleanup() 251{ 252 pft_cleanup 253} 254 255atf_init_test_cases() 256{ 257 atf_add_test_case "source_track" 258 atf_add_test_case "kill" 259 atf_add_test_case "max_src_conn_rule" 260 atf_add_test_case "max_src_states_rule" 261} 262