Training courses

Kernel and Embedded Linux

Bootlin training courses

Embedded Linux, kernel,
Yocto Project, Buildroot, real-time,
graphics, boot time, debugging...

Bootlin logo

Elixir Cross Referencer

Open Menu /tests/sys/netpfil/pf/forward.sh 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
# $FreeBSD$

. $(atf_get_srcdir)/utils.subr

atf_test_case "v4" "cleanup"
v4_head()
{
	atf_set descr 'Basic forwarding test'
	atf_set require.user root

	# We need scapy to be installed for out test scripts to work
	atf_set require.progs scapy
}

v4_body()
{
	pft_init

	epair_send=$(pft_mkepair)
	ifconfig ${epair_send}a 192.0.2.1/24 up

	epair_recv=$(pft_mkepair)
	ifconfig ${epair_recv}a up

	pft_mkjail alcatraz ${epair_send}b ${epair_recv}b
	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
	jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up
	jexec alcatraz sysctl net.inet.ip.forwarding=1
	jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05
	route add -net 198.51.100.0/24 192.0.2.2

	# Sanity check, can we forward ICMP echo requests without pf?
	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
		--sendif ${epair_send}a \
		--to 198.51.100.3 \
		--recvif ${epair_recv}a

	jexec alcatraz pfctl -e

	# Forward with pf enabled
	pft_set_rules alcatraz "block in"
	atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
		--sendif ${epair_send}a \
		--to 198.51.100.3 \
		--recvif ${epair_recv}a

	pft_set_rules alcatraz "block out"
	atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
		--sendif ${epair_send}a \
		--to 198.51.100.3 \
		--recv ${epair_recv}a

	# Allow ICMP
	pft_set_rules alcatraz "block in" "pass in proto icmp"
	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
		--sendif ${epair_send}a \
		--to 198.51.100.3 \
		--recvif ${epair_recv}a
}

v4_cleanup()
{
	pft_cleanup
}

atf_test_case "v6" "cleanup"
v6_head()
{
	atf_set descr 'Basic IPv6 forwarding test'
	atf_set require.user root
	atf_set require.progs scapy
}

v6_body()
{
	pft_init

	epair_send=$(pft_mkepair)
	epair_recv=$(pft_mkepair)

	ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled
	ifconfig ${epair_recv}a up

	pft_mkjail alcatraz ${epair_send}b ${epair_recv}b

	jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad
	jexec alcatraz ifconfig ${epair_recv}b inet6 2001:db8:43::2/64 up no_dad
	jexec alcatraz sysctl net.inet6.ip6.forwarding=1
	jexec alcatraz ndp -s 2001:db8:43::3 00:01:02:03:04:05
	route add -6 2001:db8:43::/64 2001:db8:42::2

	# Sanity check, can we forward ICMP echo requests without pf?
	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
		--ip6 \
		--sendif ${epair_send}a \
		--to 2001:db8:43::3 \
		--recvif ${epair_recv}a

	jexec alcatraz pfctl -e

	# Block incoming echo request packets
	pft_set_rules alcatraz \
		"block in inet6 proto icmp6 icmp6-type echoreq"
	atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
		--ip6 \
		--sendif ${epair_send}a \
		--to 2001:db8:43::3 \
		--recvif ${epair_recv}a

	# Block outgoing echo request packets
	pft_set_rules alcatraz \
		"block out inet6 proto icmp6 icmp6-type echoreq"
	atf_check -s exit:1 -e ignore $(atf_get_srcdir)/pft_ping.py \
		--ip6 \
		--sendif ${epair_send}a \
		--to 2001:db8:43::3 \
		--recvif ${epair_recv}a

	# Allow ICMPv6 but nothing else
	pft_set_rules alcatraz \
		"block out" \
		"pass out inet6 proto icmp6"
	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
		--ip6 \
		--sendif ${epair_send}a \
		--to 2001:db8:43::3 \
		--recvif ${epair_recv}a

	# Allowing ICMPv4 does not allow ICMPv6
	pft_set_rules alcatraz \
		"block out inet6 proto icmp6 icmp6-type echoreq" \
		"pass in proto icmp"
	atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
		--ip6 \
		--sendif ${epair_send}a \
		--to 2001:db8:43::3 \
		--recvif ${epair_recv}a
}

v6_cleanup()
{
	pft_cleanup
}

atf_init_test_cases()
{
	atf_add_test_case "v4"
	atf_add_test_case "v6"
}