Date: Tue, 1 Nov 2022 17:47:52 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 45258e1bc71b - main - pf tests: make killstate tests more robust Message-ID: <202211011747.2A1HlqEW086267@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=45258e1bc71b1dc4ec28e5d37c3ca6c02de61857 commit 45258e1bc71b1dc4ec28e5d37c3ca6c02de61857 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2022-11-01 17:03:50 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2022-11-01 17:47:05 +0000 pf tests: make killstate tests more robust Rather than using a Scapy-based Python script only check if the state still exists. Scapy tends to be slow to start, it appears because it lists all interfaces and gets their (IPv6) addresses a couple of times at startup. This can be sufficient for the ICMP state to time out and the test to fail. We now only check if the state exists or is removed as expected, which makes things faster, and should mean the test is more robust on slower machines (such as CI VMs). Sponsored by: Rubicon Communications, LLC ("Netgate") --- tests/sys/netpfil/pf/killstate.sh | 252 +++++++++++++++++--------------------- 1 file changed, 115 insertions(+), 137 deletions(-) diff --git a/tests/sys/netpfil/pf/killstate.sh b/tests/sys/netpfil/pf/killstate.sh index a2b20d6d7cbf..61edec8252eb 100644 --- a/tests/sys/netpfil/pf/killstate.sh +++ b/tests/sys/netpfil/pf/killstate.sh @@ -29,6 +29,17 @@ common_dir=$(atf_get_srcdir)/../common +find_state() +{ + jexec alcatraz pfctl -ss | grep icmp | grep 192.0.2.2 +} + +find_state_v6() +{ + jexec alcatraz pfctl -ss | grep icmp | grep 2001:db8::2 +} + + atf_test_case "v4" "cleanup" v4_head() { @@ -52,8 +63,6 @@ v4_body() "pass in proto icmp" # Sanity check & establish state - # Note: use pft_ping so we always use the same ID, so pf considers all - # echo requests part of the same flow. atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ @@ -61,39 +70,31 @@ v4_body() # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" - - # Established state means we can still ping alcatraz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Setting new rules removed the state." + fi # Killing with the wrong IP doesn't affect our state jexec alcatraz pfctl -k 192.0.2.3 - - # So we can still ping - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Killing with the wrong IP removed our state." + fi # Killing with one correct address and one incorrect doesn't kill the state jexec alcatraz pfctl -k 192.0.2.1 -k 192.0.2.3 - - # So we can still ping - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Killing with one wrong IP removed our state." + fi # Killing with correct address does remove the state jexec alcatraz pfctl -k 192.0.2.1 - - # Now the ping fails - atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if find_state; + then + atf_fail "Killing with the correct IP did not remove our state." + fi } v4_cleanup() @@ -128,8 +129,6 @@ v6_body() "pass in proto icmp6" # Sanity check & establish state - # Note: use pft_ping so we always use the same ID, so pf considers all - # echo requests part of the same flow. atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --ip6 \ --sendif ${epair}a \ @@ -138,38 +137,31 @@ v6_body() # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" - - # Established state means we can still ping alcatraz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --ip6 \ - --sendif ${epair}a \ - --to 2001:db8::2 \ - --replyif ${epair}a + if ! find_state_v6; + then + atf_fail "Setting new rules removed the state." + fi # Killing with the wrong IP doesn't affect our state jexec alcatraz pfctl -k 2001:db8::3 - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --ip6 \ - --sendif ${epair}a \ - --to 2001:db8::2 \ - --replyif ${epair}a + if ! find_state_v6; + then + atf_fail "Killing with the wrong IP removed our state." + fi # Killing with one correct address and one incorrect doesn't kill the state jexec alcatraz pfctl -k 2001:db8::1 -k 2001:db8::3 - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --ip6 \ - --sendif ${epair}a \ - --to 2001:db8::2 \ - --replyif ${epair}a + if ! find_state_v6; + then + atf_fail "Killing with one wrong IP removed our state." + fi # Killing with correct address does remove the state jexec alcatraz pfctl -k 2001:db8::1 - atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ - --ip6 \ - --sendif ${epair}a \ - --to 2001:db8::2 \ - --replyif ${epair}a - + if find_state_v6; + then + atf_fail "Killing with the correct IP did not remove our state." + fi } v6_cleanup() @@ -201,8 +193,6 @@ label_body() "pass in proto icmp label foo" # Sanity check & establish state - # Note: use pft_ping so we always use the same ID, so pf considers all - # echo requests part of the same flow. atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ @@ -210,33 +200,31 @@ label_body() # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" - - # Established state means we can still ping alcatraz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Setting new rules removed the state." + fi # Killing a label on a different rules keeps the state jexec alcatraz pfctl -k label -k bar - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Killing a different label removed the state." + fi # Killing a non-existing label keeps the state jexec alcatraz pfctl -k label -k baz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Killing a non-existing label removed the state." + fi # Killing the correct label kills the state jexec alcatraz pfctl -k label -k foo - atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if find_state; + then + atf_fail "Killing the state did not remove it." + fi } label_cleanup() @@ -267,8 +255,6 @@ multilabel_body() "pass in proto icmp label foo label bar" # Sanity check & establish state - # Note: use pft_ping so we always use the same ID, so pf considers all - # echo requests part of the same flow. atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ @@ -276,26 +262,24 @@ multilabel_body() # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" - - # Established state means we can still ping alcatraz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Setting new rules removed the state." + fi # Killing a label on a different rules keeps the state jexec alcatraz pfctl -k label -k baz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Killing a different label removed the state." + fi # Killing the state with the last label works jexec alcatraz pfctl -k label -k bar - atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if find_state; + then + atf_fail "Killing with the last label did not remove the state." + fi pft_set_rules alcatraz "block all" \ "pass in proto icmp label foo label bar" @@ -308,13 +292,17 @@ multilabel_body() # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" + if ! find_state; + then + atf_fail "Setting new rules removed the state." + fi # Killing with the first label works too jexec alcatraz pfctl -k label -k foo - atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if find_state; + then + atf_fail "Killing with the first label did not remove the state." + fi } multilabel_cleanup() @@ -354,26 +342,24 @@ gateway_body() # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" - - # Established state means we can still ping alcatraz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Setting new rules removed the state." + fi # Killing with a different gateway does not affect our state jexec alcatraz pfctl -k gateway -k 192.0.2.2 - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Killing with a different gateway removed the state." + fi # Killing states with the relevant gateway does terminate our state jexec alcatraz pfctl -k gateway -k 192.0.2.1 - atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if find_state; + then + atf_fail "Killing with the gateway did not remove the state." + fi } gateway_cleanup() @@ -487,8 +473,6 @@ interface_body() "pass in proto icmp" # Sanity check & establish state - # Note: use pft_ping so we always use the same ID, so pf considers all - # echo requests part of the same flow. atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ @@ -496,26 +480,24 @@ interface_body() # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" - - # Established state means we can still ping alcatraz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Setting new rules removed the state." + fi # Flushing states on a different interface doesn't affect our state jexec alcatraz pfctl -i ${epair}a -Fs - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Flushing on a different interface removed the state." + fi # Flushing on the correct interface does (even with floating states) jexec alcatraz pfctl -i ${epair}b -Fs - atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if find_state; + then + atf_fail "Flushing on a the interface did not remove the state." + fi } interface_cleanup() @@ -547,8 +529,6 @@ id_body() "pass in proto icmp" # Sanity check & establish state - # Note: use pft_ping so we always use the same ID, so pf considers all - # echo requests part of the same flow. atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ --sendif ${epair}a \ --to 192.0.2.2 \ @@ -556,12 +536,10 @@ id_body() # Change rules to now deny the ICMP traffic pft_set_rules noflush alcatraz "block all" - - # Established state means we can still ping alcatraz - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Setting new rules removed the state." + fi # Get the state ID id=$(jexec alcatraz pfctl -ss -vvv | grep -A 3 icmp | @@ -569,17 +547,17 @@ id_body() # Kill the wrong ID jexec alcatraz pfctl -k id -k 1 - atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if ! find_state; + then + atf_fail "Killing a different ID removed the state." + fi # Kill the correct ID jexec alcatraz pfctl -k id -k ${id} - atf_check -s exit:1 -o ignore ${common_dir}/pft_ping.py \ - --sendif ${epair}a \ - --to 192.0.2.2 \ - --replyif ${epair}a + if find_state; + then + atf_fail "Killing the state did not remove it." + fi } id_cleanup()
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202211011747.2A1HlqEW086267>