netpfil/pf/rdr.sh

3 # SPDX-License-Identifier: BSD-2-Clause
33 #	a <-----> b <-----> c
74 	jexec ${j}a route add -inet6 2001:db8:b::0/64 2001:db8:a::1
75 	jexec ${j}c route add -inet6 2001:db8:a::0/64 2001:db8:b::1
77 	jexec ${j}b pfctl -e
85 	atf_check -s exit:0 -o ignore \
86 	    jexec ${j}a ping -6 -c 1 2001:db8:b::2
89 	jexec ${j}c tcpdump --immediate-mode -w ${PWD}/${j}.pcap tcp and port 8000 &
93 	jexec ${j}c python3 -m http.server &
96 	# http directly from a to c -> a ---> b
97 	atf_check -s exit:0 -o ignore \
98 		jexec ${j}a fetch -T 1 -o /dev/null -q "http://[2001:db8:b::2]:8000"
100 	# http from a to b with a redirect  -> a ---> b
101 	atf_check -s exit:0 -o ignore \
102 		jexec ${j}a fetch -T 1 -o /dev/null -q "http://[2001:db8:a::1]:80"
105 	jexec ${j}c kill -s SIGINT $tcpdumppid
109 	count=$(jexec ${j}c tcpdump -vvvv -r ${PWD}/${j}.pcap | grep incorrect | wc -l)
118 	atf_set require.progs python3
125 		"rdr on ${epair_one}a proto tcp from any to any port 80 -> 2001:db8:b::2 port 8000"
138 	atf_set require.progs python3
145 		"pass in on ${epair_one}a proto tcp from any to any port 80 rdr-to 2001:db8:b::2 port 8000"
157 # - jail d runs a server on port 8888,
158 # - jail a makes connections to the server, routed through jails b and c,
159 # - jail b uses NAT to rewrite source addresses and ports to the same 2-tuple,
161 # - jail c uses a redirect rule to map the destination address to the same
208 	jexec ${j}b pfctl -e
209 	jexec ${j}c pfctl -e
226 	jexec ${j}d python3 $(atf_get_srcdir)/rdr-srcport.py &
229 	echo a | jexec ${j}a nc -w 3 -s 198.51.100.50 -p 1234 198.51.101.3 7777 > port1
231 	jexec ${j}a nc -s 198.51.100.51 -p 1234 198.51.101.4 7777 > port2 &
232 	jexec ${j}a nc -s 198.51.100.52 -p 1234 198.51.101.5 7777 > port3 &
235 	atf_check -o inline:"1234" cat port1
236 	atf_check -o match:"[0-9]+" -o not-inline:"1234" cat port2
237 	atf_check -o match:"[0-9]+" -o not-inline:"1234" cat port3
245 	atf_set require.progs python3
253 		"nat on ${epair2}a inet from 198.51.100.0/24 to any -> ${epair2}a static-port" \
254 		"rdr on ${epair2}b proto tcp from any to ${epair2}b port 7777 -> 203.0.113.50 port 8888"
267 	atf_set require.progs python3
275 		"pass out on ${epair2}a inet from 198.51.100.0/24 to any nat-to ${epair2}a static-port" \
276 		"pass in on ${epair2}b proto tcp from any to ${epair2}b port 7777 rdr-to 203.0.113.50 port 8888"
311 	atf_check -s exit:0 -o ignore \
312 	    ping -c 1 192.0.2.1
313 	atf_check -s exit:0 -o ignore \
314 	    jexec alcatraz ping -c 1 198.51.100.2
316 	jexec alcatraz pfctl -e
318 	    "rdr pass on ${epair}b proto udp from any to 192.0.2.1 port 80 -> 198.51.100.2" \
319 	    "nat on ${epair}b inet from 198.51.100.0/24 to any -> 192.0.2.1" \
323 	echo "foo" | jexec srv nc -u -l 80 &
326 	out=$(echo 1 | nc -u -w 1 192.0.2.1 80)
330 		jexec alcatraz pfctl -sn -vv
331 		jexec alcatraz pfctl -ss -vv
362 	atf_check -s exit:0 -o ignore \
363 	    ping -c 1 192.0.2.1
365 	jexec alcatraz pfctl -e
369 	    "rdr pass inet proto tcp from any to any port 25 -> 127.0.0.1 port 2500"
371 	echo foo | jexec alcatraz nc -N -l 2500 &
374 	reply=$(nc -w 3 -s 192.0.2.2 192.0.2.1 25)
379 	reply=$(nc -w 3 -s 192.0.2.3 192.0.2.1 25)