hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-25 10:01:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

pf tests: test the new log(matches) feature

Browse Source 
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D46589
This commit is contained in:
Kristof Provost 2024-09-03 17:59:44 +02:00
parent f3ab00c2b6
commit 7309c551a5
4 changed files with 61 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sbin/pfctl/tests/files/pf1023.in Normal file
View File

@ -0,0 +1,3 @@
match log(matches) inet proto tcp
match log(matches) inet from 192.0.2.0/24
pass

3
sbin/pfctl/tests/files/pf1023.ok Normal file
View File

@ -0,0 +1,3 @@
match log (matches) inet proto tcp all
match log (matches) inet from 192.0.2.0/24 to any
pass all flags S/SA keep state

1
sbin/pfctl/tests/pfctl_test_list.inc
View File

@ -131,3 +131,4 @@ PFCTL_TEST(1019, "Test pflow option")
PFCTL_TEST(1020, "Test hashmark and semicolon comment")
PFCTL_TEST(1021, "Endpoint-independent")
PFCTL_TEST(1022, "Test received-on")
PFCTL_TEST(1023, "Test match log(matches)")

54
tests/sys/netpfil/pf/pflog.sh
View File

@ -79,7 +79,61 @@ malformed_cleanup()
pft_cleanup
}
atf_test_case "matches" "cleanup"
matches_head()
{
atf_set descr 'Test the pflog matches keyword'
atf_set require.user root
}
matches_body()
{
pflog_init
epair=$(vnet_mkepair)
vnet_mkjail alcatraz ${epair}a
jexec alcatraz ifconfig ${epair}a 192.0.2.1/24 up
ifconfig ${epair}b 192.0.2.2/24 up
# Sanity check
atf_check -s exit:0 -o ignore \
ping -c 1 192.0.2.1
jexec alcatraz pfctl -e
jexec alcatraz ifconfig pflog0 up
pft_set_rules alcatraz \
"match log(matches) inet proto icmp" \
"match log(matches) inet from 192.0.2.2" \
"pass"
jexec alcatraz tcpdump -n -e -ttt --immediate-mode -l -U -i pflog0 >> ${PWD}/pflog.txt &
sleep 1 # Wait for tcpdump to start
atf_check -s exit:0 -o ignore \
ping -c 1 192.0.2.1
echo "Rules"
jexec alcatraz pfctl -sr -vv
echo "States"
jexec alcatraz pfctl -ss -vv
echo "Log"
cat ${PWD}/pflog.txt
atf_check -o match:".*rule 0/0\(match\): match in on ${epair}a: 192.0.2.2 > 192.0.2.1: ICMP echo request.*" \
cat pflog.txt
atf_check -o match:".*rule 1/0\(match\): match in on ${epair}a: 192.0.2.2 > 192.0.2.1: ICMP echo request.*" \
cat pflog.txt
}
matches_cleanup()
{
pft_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "malformed"
atf_add_test_case "matches"
}