2 # SPDX-License-Identifier: BSD-2-Clause
4 # Copyright (c) 2021 Rubicon Communications, LLC (Netgate)
6 # Redistribution and use in source and binary forms, with or without
7 # modification, are permitted provided that the following conditions
9 # 1. Redistributions of source code must retain the above copyright
10 # notice, this list of conditions and the following disclaimer.
11 # 2. Redistributions in binary form must reproduce the above copyright
12 # notice, this list of conditions and the following disclaimer in the
13 # documentation and/or other materials provided with the distribution.
15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 . $(atf_get_srcdir)/utils.subr
29 atf_test_case "get_clear" "cleanup"
32 atf_set descr 'Test clearing rules counters on get rules'
33 atf_set require.user root
40 epair_send=$(vnet_mkepair)
41 ifconfig ${epair_send}a 192.0.2.1/24 up
43 vnet_mkjail alcatraz ${epair_send}b
44 jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
45 jexec alcatraz pfctl -e
47 pft_set_rules alcatraz \
50 # Ensure the rule matched packets, so we can verify non-zero counters
51 atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2
53 # Expect non-zero counters
54 atf_check -s exit:0 -e ignore \
55 -o match:'Evaluations: [1-9][0-9]*[[:space:]]*Packets: [1-9][0-9]*[[:space:]]*Bytes: [1-9][0-9]*[[:space:]]*' \
56 jexec alcatraz pfctl -s r -v
58 # We should still see non-zero because we didn't clear on the last
59 # pfctl, but are going to clear now
60 atf_check -s exit:0 -e ignore \
61 -o match:'Evaluations: [1-9][0-9]*[[:space:]]*Packets: [1-9][0-9]*[[:space:]]*Bytes: [1-9][0-9]*[[:space:]]*' \
62 jexec alcatraz pfctl -s r -v -z
64 # Expect zero counters
65 atf_check -s exit:0 -e ignore \
66 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \
67 jexec alcatraz pfctl -s r -v
75 atf_test_case "keepcounters" "cleanup"
78 atf_set descr 'Test keepcounter functionality'
79 atf_set require.user root
86 epair_send=$(vnet_mkepair)
87 ifconfig ${epair_send}a 192.0.2.1/24 up
89 vnet_mkjail alcatraz ${epair_send}b
90 jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
91 jexec alcatraz pfctl -e
93 pft_set_rules alcatraz \
96 # Expect zero counters
97 atf_check -s exit:0 -e ignore \
98 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \
99 jexec alcatraz pfctl -s r -v
101 # Ensure the rule matched packets, so we can verify non-zero counters
102 atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2
104 # Expect non-zero counters
105 atf_check -s exit:0 -e ignore \
106 -o match:'Evaluations: [1-9][0-9]*[[:space:]]*Packets: [1-9][0-9]*[[:space:]]*Bytes: [1-9][0-9]*[[:space:]]*' \
107 jexec alcatraz pfctl -s r -v
109 # As we set the (same) rules again we'd expect the counters to return
111 pft_set_rules noflush alcatraz \
114 atf_check -s exit:0 -e ignore \
115 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \
116 jexec alcatraz pfctl -s r -v
118 # Increment rule counters
119 atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2
121 # Now set new rules with 'keepcounters' set, so we'd expect nonzero
123 pft_set_rules noflush alcatraz \
127 atf_check -s exit:0 -e ignore \
128 -o match:'Evaluations: [1-9][0-9]*[[:space:]]*Packets: [1-9][0-9]*[[:space:]]*Bytes: [1-9][0-9]*[[:space:]]*' \
129 jexec alcatraz pfctl -s r -v
131 # However, if we set a different rule it should return to zero
132 pft_set_rules noflush alcatraz \
136 atf_check -s exit:0 -e ignore \
137 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \
138 jexec alcatraz pfctl -s r -v
140 # If we generate traffic and don't set keepcounters we also see zero
141 # counts when setting new rules
142 atf_check -s exit:0 -o ignore ping -c 3 192.0.2.2
143 pft_set_rules noflush alcatraz \
146 atf_check -s exit:0 -e ignore \
147 -o match:'Evaluations: 0[[:space:]]*Packets: 0*[[:space:]]*Bytes: 0*[[:space:]]*' \
148 jexec alcatraz pfctl -s r -v
151 keepcounters_cleanup()
156 atf_init_test_cases()
158 atf_add_test_case "get_clear"
159 atf_add_test_case "keepcounters"