upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf tests: ensure that we generate all permutations for SCTP multihome

Browse source 
The initial multihome implementation was a little simplistic, and failed
to create all of the required states. Given a client with IP 1 and 2 and
a server with IP 3 and 4 we end up creating states for 1 - 3 and 2 - 3,
as well as 3 - 1 and 4 - 1, but not for 2 - 4.

Check for this.

MFC after:	1 week
Sponsored by:	Orange Business Services
Differential Revision:	https://reviews.freebsd.org/D42362

(cherry picked from commit 483d5c4075e06e52d5daa23aef2b4f4a2eb64443)
This commit is contained in:
Kristof Provost 2023-10-10 11:56:15 +02:00
parent 7afd7a7687
commit d322e5d76a
1 changed files with 61 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

61
tests/sys/netpfil/pf/sctp.py
View file

@ -360,6 +360,37 @@ class TestSCTP(VnetTestTemplate):
states = ToolsHelper.get_output("/sbin/pfctl -ss")
assert re.search(r"all sctp 192.0.2.1:.*192.0.2.3:1234.*SHUTDOWN", states)
@pytest.mark.require_user("root")
def test_permutation(self):
# Test that we generate all permutations of src/dst addresses.
# Assign two addresses to each end, and check for the expected states
srv_vnet = self.vnet_map["vnet2"]
ifname = self.vnet_map["vnet1"].iface_alias_map["if1"].name
ToolsHelper.print_output("/sbin/ifconfig %s inet alias 192.0.2.4/24" % ifname)
ToolsHelper.print_output("/sbin/pfctl -e")
ToolsHelper.pf_rules([
"block proto sctp",
"pass inet proto sctp to 192.0.2.0/24"])
# Sanity check, we can communicate with the primary address.
client = SCTPClient("192.0.2.3", 1234)
client.send(b"hello", 0)
rcvd = self.wait_object(srv_vnet.pipe)
print(rcvd)
assert rcvd['ppid'] == 0
assert rcvd['data'] == "hello"
# Check that we have a state for 192.0.2.3 and 192.0.2.2 to 192.0.2.1, but also to 192.0.2.4
states = ToolsHelper.get_output("/sbin/pfctl -ss")
print(states)
assert re.search(r"all sctp 192.0.2.1:.*192.0.2.3:1234", states)
assert re.search(r"all sctp 192.0.2.1:.*192.0.2.2:1234", states)
assert re.search(r"all sctp 192.0.2.4:.*192.0.2.3:1234", states)
assert re.search(r"all sctp 192.0.2.4:.*192.0.2.2:1234", states)
class TestSCTPv6(VnetTestTemplate):
REQUIRED_MODULES = ["sctp", "pf"]
TOPOLOGY = {
@ -476,3 +507,33 @@ class TestSCTPv6(VnetTestTemplate):
# Verify that the state is closing
states = ToolsHelper.get_output("/sbin/pfctl -ss")
assert re.search(r"all sctp 2001:db8::1\[.*2001:db8::3\[1234\].*SHUTDOWN", states)
@pytest.mark.require_user("root")
def test_permutation(self):
# Test that we generate all permutations of src/dst addresses.
# Assign two addresses to each end, and check for the expected states
srv_vnet = self.vnet_map["vnet2"]
ifname = self.vnet_map["vnet1"].iface_alias_map["if1"].name
ToolsHelper.print_output("/sbin/ifconfig %s inet6 alias 2001:db8::4/64" % ifname)
ToolsHelper.print_output("/sbin/pfctl -e")
ToolsHelper.pf_rules([
"block proto sctp",
"pass inet6 proto sctp to 2001:db8::0/64"])
# Sanity check, we can communicate with the primary address.
client = SCTPClient("2001:db8::3", 1234)
client.send(b"hello", 0)
rcvd = self.wait_object(srv_vnet.pipe)
print(rcvd)
assert rcvd['ppid'] == 0
assert rcvd['data'] == "hello"
# Check that we have a state for 2001:db8::3 and 2001:db8::2 to 2001:db8::1, but also to 2001:db8::4
states = ToolsHelper.get_output("/sbin/pfctl -ss")
print(states)
assert re.search(r"all sctp 2001:db8::1\[.*2001:db8::2\[1234\]", states)
assert re.search(r"all sctp 2001:db8::1\[.*2001:db8::3\[1234\]", states)
assert re.search(r"all sctp 2001:db8::4\[.*2001:db8::2\[1234\]", states)
assert re.search(r"all sctp 2001:db8::4\[.*2001:db8::3\[1234\]", states)