netpfil/pf/killstate.sh

2 # SPDX-License-Identifier: BSD-2-Clause
33 	jail=${1:-alcatraz}
34 	ip=${2:-192.0.2.2}
36 	jexec ${jail} pfctl -ss | grep icmp | grep ${ip}
41 	jexec alcatraz pfctl -ss | grep icmp | grep 2001:db8::2
50 	atf_set require.progs python3 scapy
62 	jexec alcatraz pfctl -e
69 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
70 		--sendif ${epair}a \
71 		--to 192.0.2.2 \
72 		--replyif ${epair}a
82 	jexec alcatraz pfctl -k 192.0.2.3
89 	jexec alcatraz pfctl -k 192.0.2.1 -k 192.0.2.3
96 	jexec alcatraz pfctl -k 192.0.2.1
113 	atf_set require.progs python3 scapy
125 	jexec alcatraz pfctl -e
132 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
133 		--sendif ${epair}a \
134 		--to 192.0.2.2 \
135 		--replyif ${epair}a
145 	jexec alcatraz pfctl -k 192.0.2.3 -k 192.0.2.2
152 	jexec alcatraz pfctl -k 192.0.2.1 -k 192.0.2.3
159 	jexec alcatraz pfctl -k 192.0.2.1 -k 192.0.2.2
176 	atf_set require.progs python3 scapy
188 	jexec alcatraz pfctl -e
191 		"pass quick inet6 proto ipv6-icmp all icmp6-type { neighbrsol, neighbradv } no state" \
196 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
197 		--sendif ${epair}a \
198 		--fromaddr 2001:db8::1 \
199 		--to 2001:db8::2 \
200 		--replyif ${epair}a
210 	jexec alcatraz pfctl -k 2001:db8::3
217 	jexec alcatraz pfctl -k 2001:db8::1 -k 2001:db8::3
224 	jexec alcatraz pfctl -k 2001:db8::1
241 	atf_set require.progs python3 scapy
253 	jexec alcatraz pfctl -e
261 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
262 		--sendif ${epair}a \
263 		--to 192.0.2.2 \
264 		--replyif ${epair}a
274 	jexec alcatraz pfctl -k label -k bar
280 	# Killing a non-existing label keeps the state
281 	jexec alcatraz pfctl -k label -k baz
284 		atf_fail "Killing a non-existing label removed the state."
288 	jexec alcatraz pfctl -k label -k foo
305 	atf_set require.progs python3 scapy
317 	jexec alcatraz pfctl -e
324 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
325 		--sendif ${epair}a \
326 		--to 192.0.2.2 \
327 		--replyif ${epair}a
337 	jexec alcatraz pfctl -k label -k baz
344 	jexec alcatraz pfctl -k label -k bar
355 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
356 		--sendif ${epair}a \
357 		--to 192.0.2.2 \
358 		--replyif ${epair}a
368 	jexec alcatraz pfctl -k label -k foo
383 	atf_set descr 'Test killing states by route-to/reply-to address'
385 	atf_set require.progs python3 scapy
397 	jexec alcatraz pfctl -e
400 		"pass in reply-to (${epair}b 192.0.2.1) proto icmp" \
406 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
407 		--sendif ${epair}a \
408 		--to 192.0.2.2 \
409 		--replyif ${epair}a
419 	jexec alcatraz pfctl -k gateway -k 192.0.2.2
426 	jexec alcatraz pfctl -k gateway -k 192.0.2.1
450 	while ! jexec $jail pfctl -s s | grep $addr >/dev/null;
469 	jexec alcatraz pfctl -e
474 	jexec singsing /usr/sbin/inetd -p ${PWD}/inetd-echo.pid \
480 		"nat on ${epair_two}a from 192.0.2.0/24 -> (${epair_two}a)" \
487 	states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l)
488 	if [ $states -ne 2 ] ;
494 	jexec alcatraz pfctl -k 192.0.2.1
495 	states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l)
496 	if [ $states -ne 1 ] ;
502 	jexec alcatraz pfctl -F states
508 	jexec alcatraz pfctl -M -k 192.0.2.1
509 	states=$(jexec alcatraz pfctl -s s | grep 192.0.2.1 | wc -l)
510 	if [ $states -ne 0 ] ;
526 	atf_set require.progs python3 scapy
538 	jexec alcatraz pfctl -e
545 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
546 		--sendif ${epair}a \
547 		--to 192.0.2.2 \
548 		--replyif ${epair}a
558 	jexec alcatraz pfctl -i ${epair}a -Fs
565 	jexec alcatraz pfctl -i ${epair}b -Fs
582 	atf_set require.progs python3 scapy
594 	jexec alcatraz pfctl -e
602 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
603 		--sendif ${epair}a \
604 		--to 192.0.2.2 \
605 		--replyif ${epair}a
615 	id=$(jexec alcatraz pfctl -ss -vvv | grep -A 3 icmp |
616 	    grep -A 3 192.0.2.2 | awk '/id:/ { printf("%s/%s", $2, $4); }')
619 	jexec alcatraz pfctl -k id -k 1
626 	jexec alcatraz pfctl -k id -k ${id}
643 	atf_set require.progs python3 scapy
655 	jexec alcatraz pfctl -e
663 	atf_check -s exit:0 -o ignore ${common_dir}/pft_ping.py \
664 		--sendif ${epair}a \
665 		--to 192.0.2.2 \
666 		--replyif ${epair}a
669 	key=$(jexec alcatraz pfctl -ss -vvv | awk '/icmp/ { print($2 " " $3 " " $4 " " $5); }')
673 	atf_check -s exit:0 -e "match:killed 0 states" \
674 	    jexec alcatraz pfctl -k key -k "${bad_key}"
681 	atf_check -s exit:0 -e "match:killed 1 states" \
682 	    jexec alcatraz pfctl -k key -k "${key}"
697 	atf_set descr 'Test killing states by their NAT-ed IP address'
699 	atf_set require.progs python3 scapy
711 	ifconfig -j ${j}c ${epair_c}a inet 192.0.2.2/24 up
715 	ifconfig -j ${j}srv ${epair_srv}a inet 198.51.100.2/24 up
718 	ifconfig -j ${j}r ${epair_c}b inet 192.0.2.1/24 up
719 	ifconfig -j ${j}r ${epair_srv}b inet 198.51.100.1/24 up
722 	jexec ${j}r pfctl -e
724 		"nat on ${epair_srv}b inet from 192.0.2.0/24 to any -> (${epair_srv}b)"
727 	atf_check -s exit:0 -o ignore \
728 	    jexec ${j}c ping -c 1 192.0.2.1
729 	atf_check -s exit:0 -o ignore \
730 	    jexec ${j}srv ping -c 1 198.51.100.1
731 	atf_check -s exit:0 -o ignore \
732 	    jexec ${j}c ping -c 1 198.51.100.2
737 	atf_check -s exit:0 -o ignore jexec ${j}c ${common_dir}/pft_ping.py \
738 		--sendif ${epair_c}a \
739 		--to 198.51.100.1 \
740 		--replyif ${epair_c}a
748 	# By NAT-ed address?
749 	jexec ${j}r pfctl -k nat -k 192.0.2.2
753 		jexec ${j}r pfctl -ss -v