1# 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2021 Rubicon Communications, LLC (Netgate) 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26 27. $(atf_get_srcdir)/utils.subr 28 29common_dir=$(atf_get_srcdir)/../common 30 31atf_test_case "v4" "cleanup" 32v4_head() 33{ 34 atf_set descr 'Test killing states by IPv4 address' 35 atf_set require.user root 36 atf_set require.progs scapy 37} 38 39v4_body() 40{ 41 pft_init 42 43 epair=$(vnet_mkepair) 44 ifconfig ${epair}a 192.0.2.1/24 up 45 46 vnet_mkjail alcatraz ${epair}b 47 jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up 48 jexec alcatraz pfctl -e 49 50 pft_set_rules alcatraz "block all" \ 51 "pass in proto icmp" \ 52 "set skip on lo" 53 54 # Sanity check & establish state 55 # Note: use pft_ping so we always use the same ID, so pf considers all 56 # echo requests part of the same flow. 57 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 58 --sendif ${epair}a \ 59 --to 192.0.2.2 \ 60 --replyif ${epair}a 61 62 # Change rules to now deny the ICMP traffic 63 pft_set_rules noflush alcatraz "block all" 64 65 # Established state means we can still ping alcatraz 66 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 67 --sendif ${epair}a \ 68 --to 192.0.2.2 \ 69 --replyif ${epair}a 70 71 # Killing with the wrong IP doesn't affect our state 72 jexec alcatraz pfctl -k 192.0.2.3 73 74 # So we can still ping 75 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 76 --sendif ${epair}a \ 77 --to 192.0.2.2 \ 78 --replyif ${epair}a 79 80 # Killing with one correct address and one incorrect doesn't kill the state 81 jexec alcatraz pfctl -k 192.0.2.1 -k 192.0.2.3 82 83 # So we can still ping 84 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 85 --sendif ${epair}a \ 86 --to 192.0.2.2 \ 87 --replyif ${epair}a 88 89 # Killing with correct address does remove the state 90 jexec alcatraz pfctl -k 192.0.2.1 91 92 # Now the ping fails 93 atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ 94 --sendif ${epair}a \ 95 --to 192.0.2.2 \ 96 --replyif ${epair}a 97} 98 99v4_cleanup() 100{ 101 pft_cleanup 102} 103 104atf_test_case "v6" "cleanup" 105v6_head() 106{ 107 atf_set descr 'Test killing states by IPv6 address' 108 atf_set require.user root 109 atf_set require.progs scapy 110} 111 112v6_body() 113{ 114 pft_init 115 116 epair=$(vnet_mkepair) 117 ifconfig ${epair}a inet6 2001:db8::1/64 up no_dad 118 119 vnet_mkjail alcatraz ${epair}b 120 jexec alcatraz ifconfig ${epair}b inet6 2001:db8::2/64 up no_dad 121 jexec alcatraz pfctl -e 122 123 pft_set_rules alcatraz "block all" \ 124 "pass in proto icmp6" \ 125 "set skip on lo" 126 127 # Sanity check & establish state 128 # Note: use pft_ping so we always use the same ID, so pf considers all 129 # echo requests part of the same flow. 130 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 131 --sendif ${epair}a \ 132 --to 2001:db8::2 \ 133 --replyif ${epair}a 134 135 # Change rules to now deny the ICMP traffic 136 pft_set_rules noflush alcatraz "block all" 137 138 # Established state means we can still ping alcatraz 139 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 140 --sendif ${epair}a \ 141 --to 2001:db8::2 \ 142 --replyif ${epair}a 143 144 # Killing with the wrong IP doesn't affect our state 145 jexec alcatraz pfctl -k 2001:db8::3 146 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 147 --sendif ${epair}a \ 148 --to 2001:db8::2 \ 149 --replyif ${epair}a 150 151 # Killing with one correct address and one incorrect doesn't kill the state 152 jexec alcatraz pfctl -k 2001:db8::1 -k 2001:db8::3 153 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 154 --sendif ${epair}a \ 155 --to 2001:db8::2 \ 156 --replyif ${epair}a 157 158 # Killing with correct address does remove the state 159 jexec alcatraz pfctl -k 2001:db8::1 160 atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ 161 --sendif ${epair}a \ 162 --to 2001:db8::2 \ 163 --replyif ${epair}a 164 165} 166 167v6_cleanup() 168{ 169 pft_cleanup 170} 171 172atf_test_case "label" "cleanup" 173label_head() 174{ 175 atf_set descr 'Test killing states by label' 176 atf_set require.user root 177 atf_set require.progs scapy 178} 179 180label_body() 181{ 182 pft_init 183 184 epair=$(vnet_mkepair) 185 ifconfig ${epair}a 192.0.2.1/24 up 186 187 vnet_mkjail alcatraz ${epair}b 188 jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up 189 jexec alcatraz pfctl -e 190 191 pft_set_rules alcatraz "block all" \ 192 "pass in proto tcp label bar" \ 193 "pass in proto icmp label foo" \ 194 "set skip on lo" 195 196 # Sanity check & establish state 197 # Note: use pft_ping so we always use the same ID, so pf considers all 198 # echo requests part of the same flow. 199 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 200 --sendif ${epair}a \ 201 --to 192.0.2.2 \ 202 --replyif ${epair}a 203 204 # Change rules to now deny the ICMP traffic 205 pft_set_rules noflush alcatraz "block all" 206 207 # Established state means we can still ping alcatraz 208 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 209 --sendif ${epair}a \ 210 --to 192.0.2.2 \ 211 --replyif ${epair}a 212 213 # Killing a label on a different rules keeps the state 214 jexec alcatraz pfctl -k label -k bar 215 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 216 --sendif ${epair}a \ 217 --to 192.0.2.2 \ 218 --replyif ${epair}a 219 220 # Killing a non-existing label keeps the state 221 jexec alcatraz pfctl -k label -k baz 222 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 223 --sendif ${epair}a \ 224 --to 192.0.2.2 \ 225 --replyif ${epair}a 226 227 # Killing the correct label kills the state 228 jexec alcatraz pfctl -k label -k foo 229 atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ 230 --sendif ${epair}a \ 231 --to 192.0.2.2 \ 232 --replyif ${epair}a 233} 234 235label_cleanup() 236{ 237 pft_cleanup 238} 239 240atf_test_case "multilabel" "cleanup" 241multilabel_head() 242{ 243 atf_set descr 'Test killing states with multiple labels by label' 244 atf_set require.user root 245 atf_set require.progs scapy 246} 247 248multilabel_body() 249{ 250 pft_init 251 252 epair=$(vnet_mkepair) 253 ifconfig ${epair}a 192.0.2.1/24 up 254 255 vnet_mkjail alcatraz ${epair}b 256 jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up 257 jexec alcatraz pfctl -e 258 259 pft_set_rules alcatraz "block all" \ 260 "pass in proto icmp label foo label bar" \ 261 "set skip on lo" 262 263 # Sanity check & establish state 264 # Note: use pft_ping so we always use the same ID, so pf considers all 265 # echo requests part of the same flow. 266 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 267 --sendif ${epair}a \ 268 --to 192.0.2.2 \ 269 --replyif ${epair}a 270 271 # Change rules to now deny the ICMP traffic 272 pft_set_rules noflush alcatraz "block all" 273 274 # Established state means we can still ping alcatraz 275 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 276 --sendif ${epair}a \ 277 --to 192.0.2.2 \ 278 --replyif ${epair}a 279 280 # Killing a label on a different rules keeps the state 281 jexec alcatraz pfctl -k label -k baz 282 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 283 --sendif ${epair}a \ 284 --to 192.0.2.2 \ 285 --replyif ${epair}a 286 287 # Killing the state with the last label works 288 jexec alcatraz pfctl -k label -k bar 289 atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ 290 --sendif ${epair}a \ 291 --to 192.0.2.2 \ 292 --replyif ${epair}a 293 294 pft_set_rules alcatraz "block all" \ 295 "pass in proto icmp label foo label bar" \ 296 "set skip on lo" 297 298 # Reestablish state 299 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 300 --sendif ${epair}a \ 301 --to 192.0.2.2 \ 302 --replyif ${epair}a 303 304 # Change rules to now deny the ICMP traffic 305 pft_set_rules noflush alcatraz "block all" 306 307 # Killing with the first label works too 308 jexec alcatraz pfctl -k label -k foo 309 atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ 310 --sendif ${epair}a \ 311 --to 192.0.2.2 \ 312 --replyif ${epair}a 313} 314 315multilabel_cleanup() 316{ 317 pft_cleanup 318} 319 320atf_test_case "gateway" "cleanup" 321gateway_head() 322{ 323 atf_set descr 'Test killing states by route-to/reply-to address' 324 atf_set require.user root 325 atf_set require.progs scapy 326} 327 328gateway_body() 329{ 330 pft_init 331 332 epair=$(vnet_mkepair) 333 ifconfig ${epair}a 192.0.2.1/24 up 334 335 vnet_mkjail alcatraz ${epair}b 336 jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up 337 jexec alcatraz pfctl -e 338 339 pft_set_rules alcatraz "block all" \ 340 "pass in reply-to (${epair}b 192.0.2.1) proto icmp" \ 341 "set skip on lo" 342 343 # Sanity check & establish state 344 # Note: use pft_ping so we always use the same ID, so pf considers all 345 # echo requests part of the same flow. 346 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 347 --sendif ${epair}a \ 348 --to 192.0.2.2 \ 349 --replyif ${epair}a 350 351 # Change rules to now deny the ICMP traffic 352 pft_set_rules noflush alcatraz "block all" 353 354 # Established state means we can still ping alcatraz 355 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 356 --sendif ${epair}a \ 357 --to 192.0.2.2 \ 358 --replyif ${epair}a 359 360 # Killing with a different gateway does not affect our state 361 jexec alcatraz pfctl -k gateway -k 192.0.2.2 362 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 363 --sendif ${epair}a \ 364 --to 192.0.2.2 \ 365 --replyif ${epair}a 366 367 # Killing states with the relevant gateway does terminate our state 368 jexec alcatraz pfctl -k gateway -k 192.0.2.1 369 atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ 370 --sendif ${epair}a \ 371 --to 192.0.2.2 \ 372 --replyif ${epair}a 373} 374 375gateway_cleanup() 376{ 377 pft_cleanup 378} 379 380atf_test_case "match" "cleanup" 381match_head() 382{ 383 atf_set descr 'Test killing matching states' 384 atf_set require.user root 385} 386 387wait_for_state() 388{ 389 jail=$1 390 addr=$2 391 392 while ! jexec $jail pfctl -s s | grep $addr >/dev/null; 393 do 394 sleep .1 395 done 396} 397 398match_body() 399{ 400 pft_init 401 402 epair_one=$(vnet_mkepair) 403 ifconfig ${epair_one}a 192.0.2.1/24 up 404 405 epair_two=$(vnet_mkepair) 406 407 vnet_mkjail alcatraz ${epair_one}b ${epair_two}a 408 jexec alcatraz ifconfig ${epair_one}b 192.0.2.2/24 up 409 jexec alcatraz ifconfig ${epair_two}a 198.51.100.1/24 up 410 jexec alcatraz sysctl net.inet.ip.forwarding=1 411 jexec alcatraz pfctl -e 412 413 vnet_mkjail singsing ${epair_two}b 414 jexec singsing ifconfig ${epair_two}b 198.51.100.2/24 up 415 jexec singsing route add default 198.51.100.1 416 jexec singsing /usr/sbin/inetd -p ${PWD}/inetd-echo.pid \ 417 $(atf_get_srcdir)/echo_inetd.conf 418 419 route add 198.51.100.0/24 192.0.2.2 420 421 pft_set_rules alcatraz \ 422 "nat on ${epair_two}a from 192.0.2.0/24 -> (${epair_two}a)" \ 423 "pass all" 424 425 nc 198.51.100.2 7 & 426 wait_for_state alcatraz 192.0.2.1 427 428 # Expect two states 429 states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l) 430 if [ $states -ne 2 ] ; 431 then 432 atf_fail "Expected two states, found $states" 433 fi 434 435 # If we don't kill the matching NAT state one should be left 436 jexec alcatraz pfctl -k 192.0.2.1 437 states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l) 438 if [ $states -ne 1 ] ; 439 then 440 atf_fail "Expected one states, found $states" 441 fi 442 443 # Flush 444 jexec alcatraz pfctl -F states 445 446 nc 198.51.100.2 7 & 447 wait_for_state alcatraz 192.0.2.1 448 449 # Kill matching states, expect all of them to be gone 450 jexec alcatraz pfctl -M -k 192.0.2.1 451 states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l) 452 if [ $states -ne 0 ] ; 453 then 454 atf_fail "Expected zero states, found $states" 455 fi 456} 457 458match_cleanup() 459{ 460 pft_cleanup 461} 462 463atf_test_case "interface" "cleanup" 464interface_head() 465{ 466 atf_set descr 'Test killing states based on interface' 467 atf_set require.user root 468 atf_set require.progs scapy 469} 470 471interface_body() 472{ 473 pft_init 474 475 epair=$(vnet_mkepair) 476 ifconfig ${epair}a 192.0.2.1/24 up 477 478 vnet_mkjail alcatraz ${epair}b 479 jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up 480 jexec alcatraz pfctl -e 481 482 pft_set_rules alcatraz "block all" \ 483 "pass in proto icmp" \ 484 "set skip on lo" 485 486 # Sanity check & establish state 487 # Note: use pft_ping so we always use the same ID, so pf considers all 488 # echo requests part of the same flow. 489 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 490 --sendif ${epair}a \ 491 --to 192.0.2.2 \ 492 --replyif ${epair}a 493 494 # Change rules to now deny the ICMP traffic 495 pft_set_rules noflush alcatraz "block all" 496 497 # Established state means we can still ping alcatraz 498 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 499 --sendif ${epair}a \ 500 --to 192.0.2.2 \ 501 --replyif ${epair}a 502 503 # Flushing states on a different interface doesn't affect our state 504 jexec alcatraz pfctl -i ${epair}a -Fs 505 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 506 --sendif ${epair}a \ 507 --to 192.0.2.2 \ 508 --replyif ${epair}a 509 510 # Flushing on the correct interface does (even with floating states) 511 jexec alcatraz pfctl -i ${epair}b -Fs 512 atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ 513 --sendif ${epair}a \ 514 --to 192.0.2.2 \ 515 --replyif ${epair}a 516} 517 518interface_cleanup() 519{ 520 pft_cleanup 521} 522 523atf_test_case "id" "cleanup" 524id_head() 525{ 526 atf_set descr 'Test killing states by id' 527 atf_set require.user root 528 atf_set require.progs scapy 529} 530 531id_body() 532{ 533 pft_init 534 535 epair=$(vnet_mkepair) 536 ifconfig ${epair}a 192.0.2.1/24 up 537 538 vnet_mkjail alcatraz ${epair}b 539 jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up 540 jexec alcatraz pfctl -e 541 542 pft_set_rules alcatraz "block all" \ 543 "pass in proto tcp" \ 544 "pass in proto icmp" \ 545 "set skip on lo" 546 547 # Sanity check & establish state 548 # Note: use pft_ping so we always use the same ID, so pf considers all 549 # echo requests part of the same flow. 550 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 551 --sendif ${epair}a \ 552 --to 192.0.2.2 \ 553 --replyif ${epair}a 554 555 # Change rules to now deny the ICMP traffic 556 pft_set_rules noflush alcatraz "block all" 557 558 # Established state means we can still ping alcatraz 559 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 560 --sendif ${epair}a \ 561 --to 192.0.2.2 \ 562 --replyif ${epair}a 563 564 # Get the state ID 565 id=$(jexec alcatraz pfctl -ss -vvv | grep -A 3 icmp | 566 grep -A 3 192.0.2.2 | awk '/id:/ { printf("%s/%s", $2, $4); }') 567 568 # Kill the wrong ID 569 jexec alcatraz pfctl -k id -k 1 570 atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ 571 --sendif ${epair}a \ 572 --to 192.0.2.2 \ 573 --replyif ${epair}a 574 575 # Kill the correct ID 576 jexec alcatraz pfctl -k id -k ${id} 577 atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ 578 --sendif ${epair}a \ 579 --to 192.0.2.2 \ 580 --replyif ${epair}a 581} 582 583id_cleanup() 584{ 585 pft_cleanup 586} 587 588atf_init_test_cases() 589{ 590 atf_add_test_case "v4" 591 atf_add_test_case "v6" 592 atf_add_test_case "label" 593 atf_add_test_case "multilabel" 594 atf_add_test_case "gateway" 595 atf_add_test_case "match" 596 atf_add_test_case "interface" 597 atf_add_test_case "id" 598} 599