pfctl tests: fix dependencyEnsure that we rebuild the test binary when we add tests (i.e. modifypfctl_test_list.inc).MFC after: 1 weekSponsored by: Rubicon Communications, LLC ("Netgate")(che
pfctl tests: fix dependencyEnsure that we rebuild the test binary when we add tests (i.e. modifypfctl_test_list.inc).MFC after: 1 weekSponsored by: Rubicon Communications, LLC ("Netgate")(cherry picked from commit 250e074e5f609194e0e4cd0775d99b0a616bfcf3)
show more ...
pfctl: Allow a semicolon (;) as a commentTo make parsing of, for example, Spamhaus' drop.txt and similarfiles that contains semicolons as comments, allow them alsoin file-based tables.Reviewed
pfctl: Allow a semicolon (;) as a commentTo make parsing of, for example, Spamhaus' drop.txt and similarfiles that contains semicolons as comments, allow them alsoin file-based tables.Reviewed by: kpMFC after: 2 weeksDifferential Revision: https://reviews.freebsd.org/D46088(cherry picked from commit a8a95277363be2c92b3c06bd9cd1a32d1c6c6ecd)
pf: support SCTP-specific timeoutsAllow SCTP state timeouts to be configured independently from TCP statetimeouts.Reviewed by: tuexenMFC after: 1 weekSponsored by: Orange Business ServicesDif
pf: support SCTP-specific timeoutsAllow SCTP state timeouts to be configured independently from TCP statetimeouts.Reviewed by: tuexenMFC after: 1 weekSponsored by: Orange Business ServicesDifferential Revision: https://reviews.freebsd.org/D42393(cherry picked from commit ca9dbde88122beb079b55fb4580b200f73044da6)
pfctl: fix incorrect mask on dynamic addressA PF rule using an IPv4 address followed by an IPv6 address and then adynamic address, e.g. "pass from {192.0.2.1 2001:db8::1} to (pppoe0)",will have a
pfctl: fix incorrect mask on dynamic addressA PF rule using an IPv4 address followed by an IPv6 address and then adynamic address, e.g. "pass from {192.0.2.1 2001:db8::1} to (pppoe0)",will have an incorrect /32 mask applied to the dynamic address.MFC after: 3 weeksObtained from: OpenBSDSee also: https://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/007_pfctl.patch.sigSponsored by: Rubicon Communications, LLC ("Netgate")Event: Oslo Hackathon at Modirum(cherry picked from commit 7ce98cf2f87a22240b66e4c38fd887431a25bf7d)
Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Remove $FreeBSD$: one-line .c patternRemove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
Remove $FreeBSD$: two-line .h patternRemove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
pf: introduce ridentifier and labels to ether rulesMake Ethernet rules more similar to the usual layer 3 rules by alsoallowing ridentifier and labels to be set on them.Reviewed by: kpSponsored
pf: introduce ridentifier and labels to ether rulesMake Ethernet rules more similar to the usual layer 3 rules by alsoallowing ridentifier and labels to be set on them.Reviewed by: kpSponsored by: Rubicon Communications, LLC ("Netgate")
pf: allow scrub rules without fragment reassemblescrub rules have defaulted to handling fragments for a long time, butsince we removed "fragment crop" and "fragment drop-ovl" in 64b3b4d611this ha
pf: allow scrub rules without fragment reassemblescrub rules have defaulted to handling fragments for a long time, butsince we removed "fragment crop" and "fragment drop-ovl" in 64b3b4d611this has become less obvious and more expensive ("reassemble" being themore expensive option, even if it's the one the vast majority of usersshould be using).Extend the 'scrub' syntax to allow fragment reassembly to be disabled,while retaining the other scrub behaviour (e.g. TTL changes, random-id,..) using 'scrub fragment no reassemble'.Sponsored by: Rubicon Communications, LLC ("Netgate")Differential Revision: https://reviews.freebsd.org/D37459
pfctl: fix recrusive printing of anchorsFix a couple of problems with printing of anchors, in particular recursiveprinting, both of inline anchors and when requested explicitly with a '*'in the a
pfctl: fix recrusive printing of anchorsFix a couple of problems with printing of anchors, in particular recursiveprinting, both of inline anchors and when requested explicitly with a '*'in the anchor.- Correct recursive printing of wildcard anchors (recurse into child anchorsrather than rules, which don't exist)- Print multi-part anchor paths correctly (pr6065)- Fix comments and prevent users from specifying multi-component names forinline anchors.tested by phesslerok henningAlso fix the relevant pfctl test case to reflect the new (and nowcorrect) behaviour).MFC after: 3 weeksObtained from: OpenBSD (mcbride, f9a568a27c740528301ca3419316c85a9fc7f1de)Sponsored by: Rubicon Communications, LLC ("Netgate")Differential Revision: https://reviews.freebsd.org/D36416
pfctl tests: test case for the POM_STICKYADDRESS fixIn 1e73fbd8b we fixed an issue with POM_STICKYADDRESS being checked inthe wrong struct.Add a basic test case for this fix.MFC after: 2 weeks
pfctl tests: test case for the POM_STICKYADDRESS fixIn 1e73fbd8b we fixed an issue with POM_STICKYADDRESS being checked inthe wrong struct.Add a basic test case for this fix.MFC after: 2 weeksSponsored by: Rubicon Communications, LLC ("Netgate")
pfctl tests: fix Ethernet output expectationsSince a16732d670 we always print the l3 src/destination for Ethernetrules. Update the tests to account for this.Sponsored by: Rubicon Communications,
pfctl tests: fix Ethernet output expectationsSince a16732d670 we always print the l3 src/destination for Ethernetrules. Update the tests to account for this.Sponsored by: Rubicon Communications, LLC ("Netgate")
pfctl tests: Ethernet rule parsing testsA few basic test cases for Ethernet rule parsing.Sponsored by: Rubicon Communications, LLC ("Netgate")
pfctl tests: Test fairq configurationWe used to have a bug where pfctl could crash setting fairq queues. Testthis case and ensure it does not crash pfctl.Reviewed by: donnerMFC after: 1 weekSp
pfctl tests: Test fairq configurationWe used to have a bug where pfctl could crash setting fairq queues. Testthis case and ensure it does not crash pfctl.Reviewed by: donnerMFC after: 1 weekSponsored by: Rubicon Communications, LLC ("Netgate")Differential Revision: https://reviews.freebsd.org/D30348
sbin/pfctl: fix tests after recent output changesThe output now contains http-alt instead of 8080 and personal-agentinstead of 5555.This was probably caused by 228e2087a32847fa51168f3f0c58f931cb2
sbin/pfctl: fix tests after recent output changesThe output now contains http-alt instead of 8080 and personal-agentinstead of 5555.This was probably caused by 228e2087a32847fa51168f3f0c58f931cb2cb0f8.Reviewed By: kpDifferential Revision: https://reviews.freebsd.org/D28481
[pfctl_tests] Add missing void to empty function declarationOur gcc-6.4 flags require non-empty function declarations.Fix this to match the rest of the codebase.Tested:* compiled on gcc-6.4 fo
[pfctl_tests] Add missing void to empty function declarationOur gcc-6.4 flags require non-empty function declarations.Fix this to match the rest of the codebase.Tested:* compiled on gcc-6.4 for amd64Reviewed by: impDifferential Revision: https://reviews.freebsd.org/D26795
Rewrite pfctl_test in C to reduce testsuite run timeThe new C test takes 25 seconds on QEMU-RISC-V, wheras the shell versiontakes 332 seconds.Even with the latest optimizations to atf-sh this te
Rewrite pfctl_test in C to reduce testsuite run timeThe new C test takes 25 seconds on QEMU-RISC-V, wheras the shell versiontakes 332 seconds.Even with the latest optimizations to atf-sh this test still takes a fewseconds to startup in QEMU. Re-writing it in C reduces the runtime for asingle test from about 2-3 seconds to less than .5 seconds. Since thereare ~80 tests, this adds up to about 3-4 minutes.This may not seem like a big speedup, but before the recent optimizationsto avoid atf_get_srcdir, each test took almost 100 seconds on QEMU RISC-Vinstead of 3. This also significantly reduces the time it takes to listthe available test cases, which speeds up running the tests via kyua:```root@qemu-riscv64-alex:~ # /usr/bin/time kyua test -k /usr/tests/sbin/pfctl/Kyuafile pfctl_test_old...158/158 passed (0 failed) 332.08 real 42.58 user 286.17 sysroot@qemu-riscv64-alex:~ # /usr/bin/time kyua test -k /usr/tests/sbin/pfctl/Kyuafile pfctl_test158/158 passed (0 failed) 24.96 real 9.75 user 14.26 sysroot@qemu-riscv64-alex:/usr/tests/sbin/pfctl # /usr/bin/time ./pfctl_test pf1001pfctl_test: WARNING: Running test cases outside of kyua(1) is unsupportedpfctl_test: WARNING: No isolation nor timeout control is being applied; you may get unexpected failures; see atf-test-case(4)Running pfctl -o none -nvf /usr/tests/sbin/pfctl/./files/pf1001.in---binat on em0 inet6 from fc00::/64 to any -> fc00:0:0:1::/64binat on em0 inet6 from any to fc00:0:0:1::/64 -> fc00::/64---passed 0.17 real 0.06 user 0.08 sysroot@qemu-riscv64-alex:/usr/tests/sbin/pfctl # /usr/bin/time ./pfctl_test_old pf1001pfctl_test_old: WARNING: Running test cases outside of kyua(1) is unsupportedpfctl_test_old: WARNING: No isolation nor timeout control is being applied; you may get unexpected failures; see atf-test-case(4)Id Refs Name141 1 pfExecuting command [ pfctl -o none -nvf - ]passed 1.73 real 0.25 user 1.41 sysroot@qemu-riscv64-alex:/usr/tests/sbin/pfctl # /usr/bin/time ./pfctl_test_old -l > /dev/null 24.36 real 2.26 user 21.86 sysroot@qemu-riscv64-alex:/usr/tests/sbin/pfctl # /usr/bin/time ./pfctl_test -l > /dev/null 0.04 real 0.02 user 0.01 sys```The speedups are even more noticeable on CHERI-RISC-V (since QEMU runsslower when emulating CHERI instructions):```root@qemu-cheri-alex:/usr/tests/sbin/pfctl # /usr/bin/time ./pfctl_test_new -l > /dev/null 0.51 real 0.49 user 0.00 sysroot@qemu-cheri-alex:/usr/tests/sbin/pfctl # /usr/bin/time ./pfctl_test -l > /dev/null 34.20 real 32.69 user 0.16 sysroot@qemu-cheri-alex:/usr/tests/sbin/pfctl # /usr/bin/time ./pfctl_test pf1001pfctl_test: WARNING: Running test cases outside of kyua(1) is unsupportedpfctl_test: WARNING: No isolation nor timeout control is being applied; you may get unexpected failures; see atf-test-case(4)Id Refs Name147 1 pfExecuting command [ pfctl -o none -nvf - ]passed 5.74 real 5.41 user 0.03 sysroot@qemu-cheri-alex:/usr/tests/sbin/pfctl # /usr/bin/time ./pfctl_test_new pf1001pfctl_test_new: WARNING: Running test cases outside of kyua(1) is unsupportedpfctl_test_new: WARNING: No isolation nor timeout control is being applied; you may get unexpected failures; see atf-test-case(4)Running pfctl -o none -nvf /usr/tests/sbin/pfctl/./files/pf1001.in---binat on em0 inet6 from fc00::/64 to any -> fc00:0:0:1::/64binat on em0 inet6 from any to fc00:0:0:1::/64 -> fc00::/64---passed 0.68 real 0.66 user 0.00 sysroot@qemu-cheri-alex:/usr/tests/sbin/pfctl #```Reviewed By: kpDifferential Revision: https://reviews.freebsd.org/D26779
pfctl_test: avoid 200 calls to atf_get_srcdirI have been trying to reduce the time that testsuite runs take for CheriBSDon QEMU (currently about 22 hours). One of the slowest tests is pfctl_test:
pfctl_test: avoid 200 calls to atf_get_srcdirI have been trying to reduce the time that testsuite runs take for CheriBSDon QEMU (currently about 22 hours). One of the slowest tests is pfctl_test:Just listing the available test cases currently takes 98 seconds on aCheriBSD RISC-V system due to all the processes being spawned. This trivialpatch reduces the time to 92 seconds. The better solution would be torewrite the test in C/C++ which I may do as a follow-up change.Reviewed By: kpDifferential Revision: https://reviews.freebsd.org/D26417
Fix test cases after r358448sbin.pfctl.pfctl_test.pf0087sbin.pfctl.pfctl_test.selfpf0087MFC with: r358448Sponsored by: The FreeBSD Foundation
pkgbase: pfctl: tests: Put tests files in the FreeBSD-tests packageReviewed by: kp, gjbDifferential Revision: https://reviews.freebsd.org/D21521
pfctl test: Add a test for macro names with a space in it
pf tests: Fix incorrect test for PR 231323Fix r339466. The test result file did not list the rdr rule.Additionally, the route-to rule needs a redirection address.X-MFC-with: 339466
pfctl tests: Basic test case for PR 231323PR: 231323MFC after: 2 weeksDifferential Revision: https://reviews.freebsd.org/D17508
Convert bsd.files.mk to support DIRS and simplify by only having one installtarget.Also update the pfctl tests Makefile to work with this change.Approved by: bapt (mentor)Differential Revision:
Convert bsd.files.mk to support DIRS and simplify by only having one installtarget.Also update the pfctl tests Makefile to work with this change.Approved by: bapt (mentor)Differential Revision: https://reviews.freebsd.org/D16430
Skip the pftcl(8) tests if pf isn't loaded.Previously, they would simply fail.MFC after: 2 weeks
12