Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 13 Jan 2019 05:31:53 +0000 (UTC)
From:      Kristof Provost <kp@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r342990 - head/tests/sys/netpfil/pf
Message-ID:  <201901130531.x0D5VrJP041675@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: kp
Date: Sun Jan 13 05:31:53 2019
New Revision: 342990
URL: https://svnweb.freebsd.org/changeset/base/342990

Log:
  pf tests: Test PR 229241
  
  pfctl has an issue with 'set skip on <group>', which causes inconsistent
  behaviour: the set skip directive works initially, but does not take
  effect when the same rules are re-applied.
  
  PR:		229241
  MFC after:	1 week

Modified:
  head/tests/sys/netpfil/pf/set_skip.sh
  head/tests/sys/netpfil/pf/utils.subr

Modified: head/tests/sys/netpfil/pf/set_skip.sh
==============================================================================
--- head/tests/sys/netpfil/pf/set_skip.sh	Sun Jan 13 05:30:26 2019	(r342989)
+++ head/tests/sys/netpfil/pf/set_skip.sh	Sun Jan 13 05:31:53 2019	(r342990)
@@ -30,7 +30,38 @@ set_skip_group_cleanup()
 	pft_cleanup
 }
 
+atf_test_case "set_skip_group_lo" "cleanup"
+set_skip_group_lo_head()
+{
+	atf_set descr 'Basic set skip test, lo'
+	atf_set require.user root
+}
+
+set_skip_group_lo_body()
+{
+	# See PR 229241
+	pft_init
+
+	pft_mkjail alcatraz
+	jexec alcatraz ifconfig lo0 127.0.0.1/8 up
+	jexec alcatraz pfctl -e
+	pft_set_rules alcatraz "set skip on lo" \
+		"block on lo0"
+
+	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
+	pft_set_rules noflush alcatraz "set skip on lo" \
+		"block on lo0"
+	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
+	jexec alcatraz pfctl -s rules
+}
+
+set_skip_group_lo_cleanup()
+{
+	pft_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "set_skip_group"
+	atf_add_test_case "set_skip_group_lo"
 }

Modified: head/tests/sys/netpfil/pf/utils.subr
==============================================================================
--- head/tests/sys/netpfil/pf/utils.subr	Sun Jan 13 05:30:26 2019	(r342989)
+++ head/tests/sys/netpfil/pf/utils.subr	Sun Jan 13 05:31:53 2019	(r342990)
@@ -49,8 +49,14 @@ pft_set_rules()
 	jname=$1
 	shift
 
-	# Flush all states, rules, fragments, ...
-	jexec ${jname} pfctl -F all
+	if [ $jname == "noflush" ];
+	then
+		jname=$1
+		shift
+	else
+		# Flush all states, rules, fragments, ...
+		jexec ${jname} pfctl -F all
+	fi
 
 	while [ $# -gt 0 ]; do
 		printf "$1\n"



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201901130531.x0D5VrJP041675>