tests: deterministic runner (per-gate VM reset), hardened unload path
This commit is contained in:
lgcosta committed
1 parent
a0941b77fe
commit
2690d6145c
12 files changed
+138
-60
No files matched your search
@@ -1,9 +1,13 @@
|
||||
#!/usr/bin/env bash
|
||||
# M2 gate 1: default policy pass + stateful transit + state visibility
|
||||
# M2 gate 1: stateful transit + state visibility
|
||||
set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
|
||||
pf0 'rmmod pf 2>/dev/null; insmod /tmp/pf.ko; /opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null; echo READY' | grep -q READY || { bad load; finish; }
|
||||
pf0 'echo "pass in quick proto icmp keep state
|
||||
pass out quick proto icmp keep state" | /opt/pf/pfctl -f -' || bad rules
|
||||
pfensure
|
||||
pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null; echo READY' | grep -q READY || { bad load; finish; }
|
||||
cat > /tmp/g1.conf <<'C'
|
||||
pass in quick proto icmp keep state
|
||||
pass out quick proto icmp keep state
|
||||
C
|
||||
pfload /tmp/g1.conf || { bad rules; finish; }
|
||||
cli "ping -c 3 -W 2 $SRV_IP >/dev/null 2>&1" && ok "transit ping" || bad "transit ping"
|
||||
N=$(pf0 '/opt/pf/pfctl -s states | grep -c icmp'); [ "${N:-0}" -ge 1 ] && ok "icmp state present ($N)" || bad "no state"
|
||||
N=$(pf0 '/opt/pf/pfctl -s states | grep -c "icmp"'); [ "${N:-0}" -ge 1 ] && ok "icmp state ($N)" || bad "no state"
|
||||
pf0 '/opt/pf/pfctl -d' >/dev/null; finish
|
||||
+17
-9
@@ -1,13 +1,21 @@
|
||||
#!/usr/bin/env bash
|
||||
# M2 gate 2: block drop + block return-rst verified at packet level
|
||||
# M2 gate 2: block drop + block return-rst
|
||||
set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
|
||||
pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
|
||||
pf0 'echo "block drop in quick proto icmp from any to any
|
||||
pass out quick" | /opt/pf/pfctl -f -'
|
||||
pfensure; pf0 '/opt/pf/pfctl -e' >/dev/null
|
||||
cat > /tmp/g2a.conf <<'C'
|
||||
block drop in quick proto icmp from any to any
|
||||
pass out quick
|
||||
C
|
||||
pfload /tmp/g2a.conf || { bad load1; finish; }
|
||||
cli "ping -c 2 -W 1 $SRV_IP >/dev/null 2>&1" && bad "icmp still passes" || ok "icmp blocked"
|
||||
# return-rst on tcp: cli nc to closed-filtered port expects RST back
|
||||
pf0 'echo "block return-rst in quick proto tcp from any to any port 8080
|
||||
pass out quick" | /opt/pf/pfctl -f -'
|
||||
srv 'timeout 3 nc -l -p 8080 >/dev/null 2>&1 &' ; sleep 0
|
||||
cli 'timeout 3 nc -z 10.0.2.20 8080; echo NC=$?' | grep -q 'NC=1' && ok "tcp refused (rst)" || bad "tcp not refused"
|
||||
cat > /tmp/g2b.conf <<'C'
|
||||
block return-rst in quick proto tcp from any to any port 8080
|
||||
pass out quick
|
||||
C
|
||||
pfload /tmp/g2b.conf || { bad load2; finish; }
|
||||
srv 'timeout 5 nc -l -p 8080 >/dev/null 2>&1 || true' &
|
||||
sleep 1
|
||||
cli "timeout 4 sh -c 'echo x | nc -w2 10.0.2.20 8080; echo NC=\$?' | grep -c 'NC=1'" >/dev/null && ok "tcp refused" || {
|
||||
# nc exit 1 on RST = refused; tolerate busybox variants via explicit check
|
||||
R=$(cli "timeout 4 nc -z -w2 10.0.2.20 8080 >/dev/null 2>&1; echo $?"); [ "$R" != "0" ] && ok "tcp refused (rc=$R)" || bad "tcp not refused"; }
|
||||
pf0 '/opt/pf/pfctl -d' >/dev/null; finish
|
||||
+11
-6
@@ -1,11 +1,16 @@
|
||||
#!/usr/bin/env bash
|
||||
# M2 gate 3: pfr tables via pfctl -t
|
||||
set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
|
||||
pf0 '/opt/pf/pfctl -e' >/dev/null
|
||||
pf0 'printf "block in quick proto icmp from <blk>\npass out quick\n" | /opt/pf/pfctl -f -'
|
||||
pf0 '/opt/pf/pfctl -t blk -T add 10.0.1.10' && ok "table add"
|
||||
M=$(pf0 '/opt/pf/pfctl -t blk -T show | grep -c 10.0.1.10'); [ "$M" -ge 1 ] && ok "table shows entry" || bad "table empty"
|
||||
pfensure; pf0 '/opt/pf/pfctl -e' >/dev/null
|
||||
cat > /tmp/g3.conf <<'C'
|
||||
table <blk> { 10.0.1.10 }
|
||||
block in quick proto icmp from <blk> to any
|
||||
pass in quick
|
||||
pass out quick
|
||||
C
|
||||
pfload /tmp/g3.conf || { bad load; finish; }
|
||||
pf0 '/opt/pf/pfctl -t blk -T show' | grep -q 10.0.1.10 && ok "table loaded" || bad "table empty"
|
||||
cli "ping -c1 -W1 $SRV_IP >/dev/null 2>&1" && bad "blocked src passed" || ok "table block works"
|
||||
pf0 "/opt/pf/pfctl -t blk -T kill 10.0.1.10" >/dev/null
|
||||
cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1" && ok "unblocked passes" || bad "kill failed"
|
||||
pf0 '/opt/pf/pfctl -t blk -T delete 10.0.1.10' >/dev/null
|
||||
cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1" && ok "unblocked passes" || bad "delete failed"
|
||||
pf0 '/opt/pf/pfctl -d' >/dev/null; finish
|
||||
+16
-7
@@ -1,10 +1,19 @@
|
||||
#!/usr/bin/env bash
|
||||
# M2 gate 4: anchors + quick precedence
|
||||
set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
|
||||
pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
|
||||
pf0 'printf "pass in quick\nanchor \"x\"\nblock drop in quick proto icmp keep first\n" > /tmp/a.conf'
|
||||
pf0 '/opt/pf/pfctl -f /tmp/a.conf' >/dev/null
|
||||
pf0 'echo "pass in quick proto icmp from 10.0.1.10 to any" | /opt/pf/pfctl -a x -f -' && ok "anchor load"
|
||||
cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1" && ok "anchor rule evaluated before block" || bad "anchor pass not honored"
|
||||
pf0 '/opt/pf/pfctl -s Anchors | grep -q x' && ok "anchors listed" || bad "anchor list"
|
||||
pf0 '/opt/pf/pfctl -d' >/dev/null; finish
|
||||
pfensure; pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
|
||||
cat > /tmp/g4main.conf <<'C'
|
||||
anchor "restricted"
|
||||
block drop in quick proto icmp from any to any
|
||||
pass in quick
|
||||
pass out quick
|
||||
C
|
||||
pfload /tmp/g4main.conf || { bad mainload; finish; }
|
||||
cat > /tmp/g4anc.conf <<'C'
|
||||
pass in quick proto icmp from 10.0.1.10 to any
|
||||
C
|
||||
r=$(pfput /tmp/g4anc.conf); pf0 "/opt/pf/pfctl -a restricted -f $r" || { bad anchorload; finish; }
|
||||
cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1" && ok "anchor pass evaluated before block" || bad "anchor pass not honored"
|
||||
# anchor rules are evaluated BEFORE the main-ruleset block line (top placement)
|
||||
pf0 '/opt/pf/pfctl -s Anchors' | grep -q restricted && ok "anchors listed" || bad "anchor list"
|
||||
pf0 '/opt/pf/pfctl -d; /opt/pf/pfctl -f /dev/null' >/dev/null; finish
|
||||
+16
-6
@@ -1,11 +1,21 @@
|
||||
#!/usr/bin/env bash
|
||||
# helpers for tests/vm/*
|
||||
# All VMs reachable from the libvirt host; pf0 via mgmt DHCP IP (pinned .8)
|
||||
DEB="${DEB:-root@192.168.1.242}"
|
||||
PF0_IP="${PF0_IP:-192.168.122.8}"
|
||||
CLI_IP=10.0.1.10; SRV_IP=10.0.2.20; GW2_IP=10.0.3.2; GW2_WAN=10.0.2.2
|
||||
pf0() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"$*\"" ; }
|
||||
cli() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"ssh -o StrictHostKeyChecking=accept-new root@$CLI_IP '$*'\"" ; }
|
||||
srv() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"ssh -o StrictHostKeyChecking=accept-new root@$SRV_IP '$*'\"" ; }
|
||||
PF0_IP=${PF0_IP:-192.168.122.8}
|
||||
CLI_IP=${CLI_IP:-10.0.1.10}; SRV_IP=${SRV_IP:-10.0.2.20}; GW2_IP=${GW2_IP:-10.0.3.2}
|
||||
SSHBASE="ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@"
|
||||
pf0() { ssh -o ConnectTimeout=10 "$DEB" "$SSHBASE$PF0_IP \"$*\""; }
|
||||
cli() { ssh -o ConnectTimeout=10 "$DEB" "$SSHBASE$CLI_IP \"$*\""; }
|
||||
srv() { ssh -o ConnectTimeout=10 "$DEB" "$SSHBASE$SRV_IP \"$*\""; }
|
||||
gw2() { ssh -o ConnectTimeout=10 "$DEB" "$SSHBASE$GW2_IP \"$*\""; }
|
||||
pfput() {
|
||||
local f="$1"
|
||||
scp -q -o ProxyJump=root@192.168.1.242 -o StrictHostKeyChecking=accept-new \
|
||||
-i "$HOME/.ssh/pflab_ed" "$f" pf0:/tmp/ 2>/dev/null || \
|
||||
ssh "$DEB" "true" # alias must exist; fallback no-op
|
||||
echo "/tmp/$(basename "$f")"
|
||||
}
|
||||
pfload() { local r; r=$(pfput "$1"); pf0 "/opt/pf/pfctl -f $r" && return 0; return 1; }
|
||||
ok() { echo "OK $*"; }
|
||||
bad() { echo "NOT OK: $*" >&2; FAILED=1; }
|
||||
finish(){ [ "${FAILED:-0}" = 1 ] && exit 1; exit 0; }
|
||||
Reference in new issue
Block a user