1# 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2020 Kristof Provost <kp@FreeBSD.org> 5# Copyright (c) 2024 Kajetan Staszkiewicz <vegeta@tuxpowered.net> 6# 7# Redistribution and use in source and binary forms, with or without 8# modification, are permitted provided that the following conditions 9# are met: 10# 1. Redistributions of source code must retain the above copyright 11# notice, this list of conditions and the following disclaimer. 12# 2. Redistributions in binary form must reproduce the above copyright 13# notice, this list of conditions and the following disclaimer in the 14# documentation and/or other materials provided with the distribution. 15# 16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26# SUCH DAMAGE. 27 28. $(atf_get_srcdir)/utils.subr 29 30atf_test_case "source_track" "cleanup" 31source_track_head() 32{ 33 atf_set descr 'Basic source tracking test' 34 atf_set require.user root 35} 36 37source_track_body() 38{ 39 pft_init 40 41 epair=$(vnet_mkepair) 42 43 vnet_mkjail alcatraz ${epair}b 44 45 ifconfig ${epair}a 192.0.2.2/24 up 46 jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up 47 48 # Enable pf! 49 jexec alcatraz pfctl -e 50 pft_set_rules alcatraz \ 51 "pass in keep state (source-track)" \ 52 "pass out keep state (source-track)" 53 54 ping -c 3 192.0.2.1 55 jexec alcatraz pfctl -s all -v 56} 57 58source_track_cleanup() 59{ 60 pft_cleanup 61} 62 63 64max_src_conn_rule_head() 65{ 66 atf_set descr 'Max connections per source per rule' 67 atf_set require.user root 68} 69 70max_src_conn_rule_body() 71{ 72 setup_router_server_ipv6 73 74 # Clients will connect from another network behind the router. 75 # This allows for using multiple source addresses and for tester jail 76 # to not respond with RST packets for SYN+ACKs. 77 jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 78 jexec server route add -6 2001:db8:44::0/64 2001:db8:43::1 79 80 pft_set_rules router \ 81 "block" \ 82 "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ 83 "pass in on ${epair_tester}b inet6 proto tcp keep state (max-src-conn 3 source-track rule overload <bad_hosts>)" \ 84 "pass out on ${epair_server}a inet6 proto tcp keep state" 85 86 # Limiting of connections is done for connections which have successfully 87 # finished the 3-way handshake. Once the handshake is done, the state 88 # is moved to CLOSED state. We use pft_ping.py to check that the handshake 89 # was really successful and after that we check what is in pf state table. 90 91 # 3 connections from host ::1 will be allowed. 92 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4201 --fromaddr 2001:db8:44::1 93 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4202 --fromaddr 2001:db8:44::1 94 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4203 --fromaddr 2001:db8:44::1 95 # The 4th connection from host ::1 will have its state killed. 96 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4204 --fromaddr 2001:db8:44::1 97 # A connection from host :2 is will be allowed. 98 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4205 --fromaddr 2001:db8:44::2 99 100 states=$(mktemp) || exit 1 101 jexec router pfctl -qss | grep 'tcp 2001:db8:43::2\[9\] <-' > $states 102 103 grep -qE '2001:db8:44::1\[4201\]\s+ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4201 not found or not established" 104 grep -qE '2001:db8:44::1\[4202\]\s+ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4202 not found or not established" 105 grep -qE '2001:db8:44::1\[4203\]\s+ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4203 not found or not established" 106 grep -qE '2001:db8:44::2\[4205\]\s+ESTABLISHED:ESTABLISHED' $states || atf_fail "State for port 4205 not found or not established" 107 108 if ( 109 grep -qE '2001:db8:44::1\[4204\]\s+' $states && 110 ! grep -qE '2001:db8:44::1\[4204\]\s+CLOSED:CLOSED' $states 111 ); then 112 atf_fail "State for port 4204 found but not closed" 113 fi 114 115 jexec router pfctl -T test -t bad_hosts 2001:db8:44::1 || atf_fail "Host not found in overload table" 116} 117 118max_src_conn_rule_cleanup() 119{ 120 pft_cleanup 121} 122 123max_src_states_rule_head() 124{ 125 atf_set descr 'Max states per source per rule' 126 atf_set require.user root 127} 128 129max_src_states_rule_body() 130{ 131 setup_router_server_ipv6 132 133 # Clients will connect from another network behind the router. 134 # This allows for using multiple source addresses and for tester jail 135 # to not respond with RST packets for SYN+ACKs. 136 jexec router route add -6 2001:db8:44::0/64 2001:db8:42::2 137 jexec server route add -6 2001:db8:44::0/64 2001:db8:43::1 138 139 pft_set_rules router \ 140 "block" \ 141 "pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ 142 "pass in on ${epair_tester}b inet6 proto tcp from port 4210:4219 keep state (max-src-states 3 source-track rule) label rule_A" \ 143 "pass in on ${epair_tester}b inet6 proto tcp from port 4220:4229 keep state (max-src-states 3 source-track rule) label rule_B" \ 144 "pass out on ${epair_server}a keep state" 145 146 # The option max-src-states prevents even the initial SYN packet going 147 # through. It's enough that we check ping_server_check_reply, no need to 148 # bother checking created states. 149 150 # 2 connections from host ::1 matching rule_A will be allowed, 1 will fail to create a state. 151 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4211 --fromaddr 2001:db8:44::1 152 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4212 --fromaddr 2001:db8:44::1 153 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4213 --fromaddr 2001:db8:44::1 154 155 # 2 connections from host ::1 matching rule_B will be allowed, 1 will fail to create a state. 156 # Limits from rule_A don't interfere with rule_B. 157 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4221 --fromaddr 2001:db8:44::1 158 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4222 --fromaddr 2001:db8:44::1 159 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4223 --fromaddr 2001:db8:44::1 160 161 # 2 connections from host ::2 matching rule_B will be allowed, 1 will fail to create a state. 162 # Limits for host ::1 will not interfere with host ::2. 163 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4224 --fromaddr 2001:db8:44::2 164 ping_server_check_reply exit:0 --ping-type=tcp3way --send-sport=4225 --fromaddr 2001:db8:44::2 165 ping_server_check_reply exit:1 --ping-type=tcp3way --send-sport=4226 --fromaddr 2001:db8:44::2 166 167 # We will check the resulting source nodes, though. 168 # Order of source nodes in output is not guaranteed, find each one separately. 169 nodes=$(mktemp) || exit 1 170 jexec router pfctl -qvsS > $nodes 171 for node_regexp in \ 172 '2001:db8:44::1 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 3' \ 173 '2001:db8:44::1 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 4' \ 174 '2001:db8:44::2 -> :: \( states 2, connections 2, rate [0-9/\.]+s \)\s+age [0-9:]+, 6 pkts, [0-9]+ bytes, filter rule 4' \ 175 ; do 176 cat $nodes | tr '\n' ' ' | grep -qE "$node_regexp" || atf_fail "Source nodes not matching expected output" 177 done 178 179 # Check if limit counters have been properly set. 180 jexec router pfctl -qvvsi | grep -qE 'max-src-states\s+3\s+' || atf_fail "max-src-states not set to 3" 181} 182 183max_src_states_rule_cleanup() 184{ 185 pft_cleanup 186} 187 188atf_init_test_cases() 189{ 190 atf_add_test_case "source_track" 191 atf_add_test_case "max_src_conn_rule" 192 atf_add_test_case "max_src_states_rule" 193} 194