| Age | Commit message (Collapse) | Author |
|---|
|
Fix a typo in the rdr_action_head() test.
Fixes: 685fb4253819 ("pf: Log the intended action when a NAT rule matches a packet")
MFC after: 1 week
|
|
Bump the timeout value (for the third time), to avoid cutoff on emulated
architectures on ci.freebsd.org. One of the runners will take
considerably more time to complete this test.
Reported by: Jenkins
Fixes: a551b0524953 ("tarfs: tests: Increase timeout (again)")
MFC after: 3 days
|
|
|
|
Reviewed by: pouria, ae
Differential Revision: https://reviews.freebsd.org/D54579
|
|
Fixes: 0bfcfb3cb1cbfa383cbd24eff39d39f143eb63ba
|
|
Count input/output packets and bytes on the interface as well, not just
in openvpn-specific counters.
PR: 292464
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Also enumerate and kill individual source addresses.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Bump the timeout value (a little more), to avoid cutoff on emulated
architectures on ci.freebsd.org.
Reported by: Jenkins
Fixes: 47015e454661 ("tests: Increase timeout")
MFC after: 3 days
|
|
Otherwise the tests cannot be run in parallel since they create
identically named jails.
Fixes: dd49816b0d66 ("bpf: avoid panic on multiple readers")
|
|
When one uses SIOCAIFADDR_IN6 to add a v6 address, it's possible to set
the preferred and valid lifetimes of the address. If the address
already exists, this ioctl will recalculate and update the expiry times
based on the provided timestamps.
When adding a new address, the lifetimes are inherited by the prefix as
well, but only if we create a new prefix. If the prefix already exists,
as it will in the case where an address is being updated rather than
being added, we do not touch the prefix lifetimes at all. This means
that the original address lifetime still applies to the route associated
with that prefix, so when the prefix expires, the route goes away.
This behaviour doesn't make a lot of sense: if the admin updates an
address lifetime, we should ensure that the prefix lifetime is updated
too. Make that change, ensuring that we do not shorten the prefix
lifetime, as the prefix might be shared among multiple interface
addresses.
Add a regression test.
Co-authored by: Franco Fichtner <franco@opnsense.org>
Reviewed by: pouria, zlei, ae
MFC after: 2 weeks
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D54562
|
|
MFC After: 1 week
Signed-off-by: CismonX <admin@cismon.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1470
|
|
As reported on the freebsd-announce mailing list[1] FreeBSD is
continuing to retire 32-bit support. Remove powerpcspe from build
infrastructure.
[1] https://lists.freebsd.org/archives/freebsd-announce/2024-February/000117.html
Signed-off-by: Minsoo Choo <minsoochoo0122@proton.me>
Reviewed by: jhibbits, emaste
Pull request: https://github.com/freebsd/freebsd-src/pull/1914
|
|
Bump the timeout value, to avoid cutoff on emulated architectures on
ci.freebsd.org.
Reported by: Jenkins
Reviewed by: ngie
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D54550
|
|
Reported by: Jenkins
Reviewed by: kp, ngie
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D54549
|
|
If we skip the nat:binat_* tests (e.g. because pf.ko isn't loaded) the
inetd_tester.pid file isn't created. We still run the cleanup function,
which tries to use this file to clean up the test environment. This
results in 'broken: Test case cleanup did not terminate successfully'.
Avoid this by checking if the pid file exists before using it.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
After addition of the prot and max_prot values, the old error substring
no longer satisfy the check.
Reviewed by: emaste, mckusick
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D54380
|
|
In general we want to strip subdir components, rather than appending
`..`s.
Reviewed by: lwhsu
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54352
|
|
After being unmounted, the mockfs server would occasionally read from
/dev/fuse again, if the main function didn't exit fast enough, getting
an ENODEV error. Handle that appropriately.
Reported by: Siva Mahadevan <me@svmhdvn.name>
Fixes: d86025c1d49c84c4dc8c3635c83c078ad56e5a53
MFC after: 1 week
Reviewed by: Siva Mahadevan <me@svmhdvn.name>
Differential Revision: https://reviews.freebsd.org/D54331
|
|
Teach the vnet support code to set interface MTU. Some tests make use of
this, so have the framework handle it.
Adapt a few pf tests to use this.
Reviewed by: melifaro
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D54333
|
|
The IN_MOVED_FROM and _TO events only apply to names in a watched
directory, never to a watched directory itself. So, the cookie value
there is always zero, and in particular we should not reset the
caller-provided cookie value, as it may be used later.
Add a regression test.
Reported by: arrowd
MFC after: 1 week
|
|
Commit 66f2f1c83247 ("pf: handle divert packets") missed a case that I
happened to hit while testing something.
Add a regression test for the ICMP case, based on the existing test.
Fix a buglet in the existing test (missing whitespace after "[").
Reviewed by: kp
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D54321
|
|
By default, when ifconfig shows a v6 address derived from a
router-advertised prefix, it shows the initial preferred and valid
lifetimes. When -L is specified, it is supposed to show the remaining
lifetimes, but this was broken in the conversion to netlink.
Fix that, and add a regression test which validates ifconfig output
before and after a short-lived address expires.
Reported by: Franco Fichtner <franco@opnsense.org>
Reviewed by: melifaro, allanjude, Seyed Pouria Mousavizadeh Tehrani
Fixes: 4c91a5dfe483 ("ifconfig: make interface and address listing use Netlink as transport")
MFC after: 2 weeks
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D54294
|
|
No functional change intended.
MFC after: 2 weeks
|
|
Reported by: Marcos Mendoza <mmendoza@netgate.com>
See also: https://redmine.pfsense.org/issues/16588
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
This adds support for renaming a symbolic link found on the lower fs,
which necessitates copying it to the upper fs, as well as basic tests.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: olce, siderop1_netapp.com, jah
Differential Revision: https://reviews.freebsd.org/D54229
|
|
When we are using Cirrus-CI and using a PR branch it creates a filename
in the form "pull/XXXX" which becomes a path seperator and the file
creation process fails.
Fails to complete the process with the following:
/bin/sh: cannot create
/tmp/meta.hUNGUq/ci-FreeBSD-16.0-pull/1932-amd64-nullhash-GENERIC.env:
No such file or directory
For future also apply the same regex for OSRELEASE and VOLUME_LABEL.
|
|
For reproducing errors or test results it is important to gather
environment information. These environments are divided into two parts.
One part is in which environment the artifacts were built into and the
second part is in which environment the tests were run.
This patch collects thesee information and saves into a .env file in
the metadir. After this patch lands we will also need to change our
jenkins job where we are uploading the artifact to a central location.
This environment file should also be stored along with the artifact.
For easier location the image basename and the environment basename are
kept same.
Approved by: lwhsu
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54247
|
|
This is now consistently passing with 100+ consecutive runs.
Signed-off-by: Siva Mahadevan <me@svmhdvn.name>
PR: 244170
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
|
|
This testcase passes consistently (in 100+ runs) now.
Signed-off-by: Siva Mahadevan <me@svmhdvn.name>
PR: 244163, 251726
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
|
|
This test now consistently passes (300+ consecutive runs).
Signed-off-by: Siva Mahadevan <me@svmhdvn.name>
PR: 244172
Sponsored by: The FreeBSD Foundation
|
|
If we have both af-to and min-ttl or set-tos on a single rule we didn't
apply the new ttl or tos.
That's because the scrub code still applied the change, but we
subsequently create a new header for the new address family. That's done
based on the ttl/tos saved in the struct pf_pdesc, which are the values
from the incoming packet, before the scrub modification(s).
Also update the struct pf_pdesc values when we update packets.
Reported by: Marek Zarychta
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
If the TTL (or hop limit) expires during nat64 translation we may
need to send the error message in the original address family (i.e.
pre-translation).
We'd usually handle this in pf_route()/pf_route6(), but at that point we
have already translated the packet, making it difficult to include it in
the generated ICMP message.
Check for this case in pf_translate_af() and send icmp errors directly
from it.
PR: 291527
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D54166
|
|
This makes them "skip" instead of "fail" if the module is not present.
|
|
Extend the test case to verify this works as expected.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
for all scenarios where both jails have same priority/advskew. There is a
tiny chance that on both sides carp_master_down() will be executed in
parallel and advertisements will also fly through the bridge(4) in
parallel, thus both sides will switch to MASTER before receiving the
announcement from peer. This makes the test to fail. So far this
flakyness was observed for carp:vrrp_v4 only, but in theory it is possible
for any of the patched scenarios.
Note that this sleep does not prolong execution of the tests, as the first
jail is already configured, and if we slept before configuring the second,
we would sleep less in wait_for_carp().
|
|
Makes tests to finish slightly faster.
|
|
Allow only tables to be loaded from a file, rather than everything (i.e.
including options, rules).
Add a test case for this.
PR: 291318
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Turn off IPv6 on all interfaces to avoid having multicast listener
reports generated that might turn up in out pflog output, disrupting
the test.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
We've seen failures due to pft_ping.py selecting the wrong source address.
Explicitly use 2001:db8::1 as source, to match the tests's expectations.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Use 'no_dad' when assigning a v6 address, because otherwise we may try
to use it before it becomes usable.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
Allow neighbor discovery/advertisement packets, but don't create state
for them. This ensures that the destination jail can respond to our
echo requests, and that we don't create extra states that would confuse
the test.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
When checking vnet test prerequisites we check if if_epair and if_bridge are
available, but we only checked for loadable modules. It's possible for these to
be built into the kernel instead.
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
pf was too strict when validating SCTP tags. When a server receives a
retransmitted INIT it will reply with a random initiate tag every time.
However, pf saves the first initiate tag and expects every subsequent INIT_ACK
retransmission to have the same tag. This is not the case, leading to endless
INIT/INIT_ACK cycles.
Allow the tag to be updated as long as we've not gone past COOKIE_WAIT.
Add a test case to verify this.
MFC after: 2 weeks
See also: https://redmine.pfsense.org/issues/16516
Sponsored by: Rubicon Communications, LLC ("Netgate")
|
|
A test helper program pcap-test allows to capture, inject and compare.
Build a simple test case on top of it. More test cases can be easily
constructed.
|
|
In c12013f5bb38 we fixed udp_mapping cleanup issues in pf_get_sport(), but
missed the static-port case (i.e. low == 0 && high == 0). We could still exit
pf_get_sport() without either inserting the udp_mapping or freeing it.
Address this and add a test case to provoke the problem.
Reviewed by: thj
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D53856
|
|
If we fail to obtain a new source port (pf_get_sport()) while we've
created a udp_mapping (for 'endpoint independent nat') we must free the
udp_mapping in pf_get_sport(). Otherwise the calling function will call
pf_udp_mapping_release(). This will then attempt to remove the udp_mapping from
a list it's not in, and crash.
Actually free the udp_mapping in all failure cases. While here sprinkle in a few
more assertions to ensure we don't forget leak udp_mappings and add a test case
to provoke this problem.
Reviewed by: thj
MFC after: 1 week
See also: https://redmine.pfsense.org/issues/16517
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D53737
|
