From nobody Fri Aug 11 12:13:38 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RMjPb0f6Bz4TjRB; Fri, 11 Aug 2023 12:13:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RMjPZ5hJVz3gkf; Fri, 11 Aug 2023 12:13:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1691756018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9Qnd5owr7NoG8Q4U4dRX039tQhtYRWNcxFqwnwZ+Cgc=; b=GXzj5QHQDB4Grpc0QdHFnrFB//G3eoQzZvU45d+hq14+vM3o1X5HV3WEcAS3B8T8ZbSvBL ERitFNNM23IOxYtGTMQLL6HcgC7LrpGhNzKIiCmcQ/bp9gts9e6/CQP6w8qvzVnPEEB5Ad Bna/AmrQ2eanvUGFDxWxOGamZaMohJP6HlEBEBCB8HEpWNR5aYC2krLcLR6ZT9AI6NpUjM CxRWBheja2hkILAE5hT7m1gkNMLpKTKBKF6ROkadeKVboLD0q/8jzMgFpg2fJ3ic1a68b9 gKnfpntmZUGAEuFgwFecSA1ZHV8COY3IxPCy7aZMr9xbPhGtkeGk/IoOv5MNfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1691756018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9Qnd5owr7NoG8Q4U4dRX039tQhtYRWNcxFqwnwZ+Cgc=; b=iqj3Ok2oJNTxug5B/PzwixLamCJ7TeWgkfpxw3XD2mBdubb2sOGVxJJkj81Bst1dfkUD64 U+KW/E3RHd3VUgGxHfP1KnujMiZ+hSZkMd932n0mMO6wOHZ52L8xqfaN0Jhav4SqehZb0s +dWP0GPSa29BNPpu6zLChhU9ZOTPc32YEi54YQizYh3pOY+FOYn83m7GiJJn+a4oaVvw6A 03tGdG+GKH9yAEkfbxvgOdw/lnsOvyaKuGrBBsyjQetAjgyFYdiVF3YWp3WK8VyuGs86jY GPELi3wHgrLla5hO2i5Y+Kem30ADdvmJODNOrHQT2JDaF76woROoyehTqy2Iyg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1691756018; a=rsa-sha256; cv=none; b=IJDhma+BgFJhm8VQzbk0P1EUNBn+L9snSlK/pQRrSs/YYLrMwSPpByxNwgKiJylL2i7e3k cugxuwJKIN7hoIUkRcxWJw1tJxrcNALBQqi7F9ls7WwoUT2u9zNEJmjhfBmYGd9AGrgCFB 2S8+YMF26tiJpFnLckxrHNbSpceorCWHFCEiZ9NyFxK/S1XMWmd9Qenao4oHh8OSaEVk+U l4PzxfmScSHt0RSNRGBpkJzf6HBIaS8ObVX59cMd4yBlm/aM5Vf2oLVhOi5I8NmEVrTV+B 79zX/ryn3/kl2dror586QDdbMDkDZ6dKGmjH/TO3JzhwaITC2NlVxa2kzAREvw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RMjPZ4lZczfRG; Fri, 11 Aug 2023 12:13:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 37BCDc6e008769; Fri, 11 Aug 2023 12:13:38 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 37BCDci3008766; Fri, 11 Aug 2023 12:13:38 GMT (envelope-from git) Date: Fri, 11 Aug 2023 12:13:38 GMT Message-Id: <202308111213.37BCDci3008766@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: 1cb393fbd4c2 - stable/13 - pf tests: test 'rdr' for SCTP List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 1cb393fbd4c2a272b6e4fadd03cde2cd9d60b240 Auto-Submitted: auto-generated The branch stable/13 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=1cb393fbd4c2a272b6e4fadd03cde2cd9d60b240 commit 1cb393fbd4c2a272b6e4fadd03cde2cd9d60b240 Author: Kristof Provost AuthorDate: 2023-06-01 16:03:07 +0000 Commit: Kristof Provost CommitDate: 2023-08-11 12:13:10 +0000 pf tests: test 'rdr' for SCTP Explicitly test that we cannot change the port number with rdr. That's not a desireable feature on SCTP, because it could break multihomed connections. MFC after: 3 weeks Sponsored by: Orange Business Services Differential Revision: https://reviews.freebsd.org/D40868 (cherry picked from commit 4369a57514f227c989d4de87d1ce54470279ba41) --- tests/sys/netpfil/pf/sctp.sh | 68 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/tests/sys/netpfil/pf/sctp.sh b/tests/sys/netpfil/pf/sctp.sh index 659c11c62113..2c736017f9fa 100644 --- a/tests/sys/netpfil/pf/sctp.sh +++ b/tests/sys/netpfil/pf/sctp.sh @@ -402,6 +402,73 @@ nat_v6_cleanup() pft_cleanup } +atf_test_case "rdr_v4" "cleanup" +rdr_v4_head() +{ + atf_set descr 'Test rdr SCTP over IPv4' + atf_set require.user root +} + +rdr_v4_body() +{ + sctp_init + + j="sctp:rdr_v4" + epair_c=$(vnet_mkepair) + epair_srv=$(vnet_mkepair) + + vnet_mkjail ${j}srv ${epair_srv}a + vnet_mkjail ${j}gw ${epair_srv}b ${epair_c}a + vnet_mkjail ${j}c ${epair_c}b + + jexec ${j}srv ifconfig ${epair_srv}a 198.51.100.1/24 up + # No default route in srv jail, to ensure we're NAT-ing + jexec ${j}gw ifconfig ${epair_srv}b 198.51.100.2/24 up + jexec ${j}gw ifconfig ${epair_c}a 192.0.2.1/24 up + jexec ${j}gw sysctl net.inet.ip.forwarding=1 + jexec ${j}c ifconfig ${epair_c}b 192.0.2.2/24 up + jexec ${j}c route add default 192.0.2.1 + + jexec ${j}gw pfctl -e + pft_set_rules ${j}gw \ + "rdr pass on ${epair_srv}b proto sctp from 198.51.100.0/24 to any port 1234 -> 192.0.2.2 port 1234" \ + "pass" + + echo "foo" | jexec ${j}c nc --sctp -N -l 1234 & + + # Wait for the server to start + sleep 1 + + out=$(jexec ${j}srv nc --sctp -N -w 3 198.51.100.2 1234) + if [ "$out" != "foo" ]; then + atf_fail "SCTP connection failed" + fi + + # Despite configuring port changes pf will not do so. + echo "bar" | jexec ${j}c nc --sctp -N -l 1234 & + + pft_set_rules ${j}gw \ + "rdr pass on ${epair_srv}b proto sctp from 198.51.100.0/24 to any port 1234 -> 192.0.2.2 port 4321" \ + "pass" + + # This will fail + out=$(jexec ${j}srv nc --sctp -N -w 3 198.51.100.2 4321) + if [ "$out" == "bar" ]; then + atf_fail "Port was unexpectedly changed." + fi + + # This succeeds + out=$(jexec ${j}srv nc --sctp -N -w 3 198.51.100.2 1234) + if [ "$out" != "bar" ]; then + atf_fail "Port was unexpectedly changed." + fi +} + +rdr_v4_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "basic_v4" @@ -410,4 +477,5 @@ atf_init_test_cases() atf_add_test_case "abort_v6" atf_add_test_case "nat_v4" atf_add_test_case "nat_v6" + atf_add_test_case "rdr_v4" }