The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=b0bf4303109a76eb4224015b9abebf88e96116ef
commit b0bf4303109a76eb4224015b9abebf88e96116ef Author: Kristof Provost <[email protected]> AuthorDate: 2022-10-31 11:15:58 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2022-10-31 17:14:10 +0000 pf tests: verify syncookie status report Verify that pfctl -si -v correctly shows syncookies to be active/inactive. Sponsored by: Rubicon Communications, LLC ("Netgate") --- tests/sys/netpfil/pf/syncookie.sh | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/tests/sys/netpfil/pf/syncookie.sh b/tests/sys/netpfil/pf/syncookie.sh index 36d80b82289b..9ef20fad4554 100644 --- a/tests/sys/netpfil/pf/syncookie.sh +++ b/tests/sys/netpfil/pf/syncookie.sh @@ -29,6 +29,14 @@ common_dir=$(atf_get_srcdir)/../common +syncookie_state() +{ + jail=$1 + + jexec $jail pfctl -si -v | grep -A 2 '^Syncookies' | grep active \ + | awk '{ print($2); }' +} + atf_test_case "basic" "cleanup" basic_head() { @@ -63,6 +71,14 @@ basic_body() then atf_fail "Failed to connect to syncookie protected echo daemon" fi + + + # Check that status shows syncookies as being active + active=$(syncookie_state alcatraz) + if [ "$active" != "active" ]; + then + atf_fail "syncookies not active" + fi } basic_cleanup() @@ -196,12 +212,26 @@ adaptive_body() # Sanity check atf_check -s exit:0 -o ignore ping -c 1 192.0.2.1 + # Check that status shows syncookies as being inactive + active=$(syncookie_state alcatraz) + if [ "$active" != "inactive" ]; + then + atf_fail "syncookies active when they should not be" + fi + # Now syn flood to create many states ${common_dir}/pft_synflood.py \ --sendif ${epair}a \ --to 192.0.2.2 \ --count 100 + # Check that status shows syncookies as being active + active=$(syncookie_state alcatraz) + if [ "$active" != "active" ]; + then + atf_fail "syncookies not active" + fi + # Adaptive mode should kick in and stop us from creating more than # about 10 states states=$(jexec alcatraz pfctl -ss | grep tcp | wc -l)
