From f038a398da3053d2d9ce6dcd098588aee813bcb7 Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Mon, 16 Oct 2017 15:05:32 +0000 Subject: [PATCH] pf tests: Use pft_set_rules everywhere We now have a utility function to set pf rules in the jail. Use it whenever we need to set the pf rules in the test jail. --- tests/sys/netpfil/pf/forward.sh | 8 +++++--- tests/sys/netpfil/pf/pass_block.sh | 10 +++++----- tests/sys/netpfil/pf/set_tos.sh | 15 ++++++++------- 3 files changed, 18 insertions(+), 15 deletions(-) diff --git a/tests/sys/netpfil/pf/forward.sh b/tests/sys/netpfil/pf/forward.sh index 78bdef6b360..a41ff8934a8 100755 --- a/tests/sys/netpfil/pf/forward.sh +++ b/tests/sys/netpfil/pf/forward.sh @@ -35,21 +35,23 @@ v4_body() --to 198.51.100.3 \ --recvif ${epair_recv}a + jexec alcatraz pfctl -e + # Forward with pf enabled - printf "block in\n" | jexec alcatraz pfctl -ef - + pft_set_rules alcatraz "block in" atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recvif ${epair_recv}a - printf "block out\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "block out" atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ --recv ${epair_recv}a # Allow ICMP - printf "block in\npass in proto icmp\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "block in" "pass in proto icmp" atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ diff --git a/tests/sys/netpfil/pf/pass_block.sh b/tests/sys/netpfil/pf/pass_block.sh index abb481d40e5..9eeb89b1703 100755 --- a/tests/sys/netpfil/pf/pass_block.sh +++ b/tests/sys/netpfil/pf/pass_block.sh @@ -28,11 +28,11 @@ v4_body() atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2 # Block everything - printf "block in\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "block in" atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.2 # Block everything but ICMP - printf "block in\npass in proto icmp\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "block in" "pass in proto icmp" atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2 } @@ -67,15 +67,15 @@ v6_body() atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2 # Block everything - printf "block in\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "block in" atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2 # Block everything but ICMP - printf "block in\npass in proto icmp6\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "block in" "pass in proto icmp6" atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2 # Allowing ICMPv4 does not allow ICMPv6 - printf "block in\npass in proto icmp\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "block in" "pass in proto icmp" atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2 } diff --git a/tests/sys/netpfil/pf/set_tos.sh b/tests/sys/netpfil/pf/set_tos.sh index 4916d939ca5..5e56b7ceb65 100755 --- a/tests/sys/netpfil/pf/set_tos.sh +++ b/tests/sys/netpfil/pf/set_tos.sh @@ -29,8 +29,10 @@ v4_body() jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05 route add -net 198.51.100.0/24 192.0.2.2 + jexec alcatraz pfctl -e + # No change is done if not requested - printf "scrub out proto icmp\n" | jexec alcatraz pfctl -ef - + pft_set_rules alcatraz "scrub out proto icmp" atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ @@ -38,7 +40,7 @@ v4_body() --expect-tos 42 # The requested ToS is set - printf "scrub out proto icmp set-tos 42\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "scrub out proto icmp set-tos 42" atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ @@ -46,7 +48,7 @@ v4_body() --expect-tos 42 # ToS is not changed if the scrub rule does not match - printf "scrub out proto tcp set-tos 42\n" | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "scrub out proto tcp set-tos 42" atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ @@ -54,8 +56,8 @@ v4_body() --expect-tos 42 # Multiple scrub rules match as expected - printf "scrub out proto tcp set-tos 13\nscrub out proto icmp set-tos 14\n" \ - | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "scrub out proto tcp set-tos 13" \ + "scrub out proto icmp set-tos 14" atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \ @@ -71,8 +73,7 @@ v4_body() --expect-tos 14 # ToS values are unmolested if the packets do not match a scrub rule - printf "scrub out proto tcp set-tos 13\n" \ - | jexec alcatraz pfctl -f - + pft_set_rules alcatraz "scrub out proto tcp set-tos 13" atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \ --sendif ${epair_send}a \ --to 198.51.100.3 \