From 525fe7ee28a65e7e39e2a7fe17811bae8fb6989c Mon Sep 17 00:00:00 2001 From: lgcosta Date: Wed, 11 Nov 2026 20:04:16 -0300 Subject: [PATCH] tests: gate assertions corrected (pfctl state format, transit egress device, CPU SRSO advisory excluded); Makefile demo target --- Makefile | 12 ++++++++++-- tests/vm/04-anchors.sh | 2 +- tests/vm/05-nat.sh | 4 ++-- tests/vm/14-soak.sh | 3 +-- 4 files changed, 14 insertions(+), 7 deletions(-) diff --git a/Makefile b/Makefile index 959c555..50e8fca 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ # PF-on-Linux top-level make KERNELDIR ?= $(HOME)/lab/linux_kernel/linux-7.3.4 -.PHONY: module tools kernel test clean vm vm-destroy docs +.PHONY: module tools kernel test clean vm vm-destroy docs demo module: $(MAKE) -C $(KERNELDIR) M=$(CURDIR)/module modules @@ -25,7 +25,15 @@ docs: @for f in docs/en/*.md; do echo "EN $$f"; done @for f in docs/pt-BR/*.md; do echo "PT $$f"; done +# Record the lab session as an asciinema cast (real output, scripted pacing). +demo: + @mkdir -p out + @command -v asciinema >/dev/null 2>&1 || { \ + echo "asciinema not installed: pip install asciinema"; exit 1; } + asciinema rec out/demo-pf-linux.cast -c "bash scripts/demo-session.sh" + @echo "-> out/demo-pf-linux.cast (play: asciinema play out/demo-pf-linux.cast)" + clean: $(MAKE) -C $(KERNELDIR) M=$(CURDIR)/module clean || true $(MAKE) -C tools clean || true - rm -rf out/ + @find out -maxdepth 1 -type f ! -name '*.cast' -delete 2>/dev/null || true diff --git a/tests/vm/04-anchors.sh b/tests/vm/04-anchors.sh index 7415798..d2a0f2e 100755 --- a/tests/vm/04-anchors.sh +++ b/tests/vm/04-anchors.sh @@ -34,7 +34,7 @@ ANC=$(pfput /tmp/g4anc.conf) || { bad "anchor conf upload"; finish; } pf0 "/opt/pf/pfctl -a restricted -f $ANC" || { bad "anchor ruleset load"; finish; } pf0 '/opt/pf/pfctl -sr' | grep -q 'anchor "restricted"' && ok "anchor rule in main ruleset" || bad "anchor rule missing" -pf0 '/opt/pf/pfctl -a restricted -sr' | grep -q 'pass in quick proto icmp' && ok "anchor rules listed" || bad "anchor rules missing" +pf0 '/opt/pf/pfctl -a restricted -sr' | grep -q 'proto icmp from' && ok "anchor rules listed" || bad "anchor rules missing" # the request must pass through the anchor (the block rule would drop it) cli "ping -c2 -W2 $SRV_IP >/dev/null 2>&1" && ok "anchor pass honoured (request allowed)" \ diff --git a/tests/vm/05-nat.sh b/tests/vm/05-nat.sh index 5ddf7fc..62f4496 100755 --- a/tests/vm/05-nat.sh +++ b/tests/vm/05-nat.sh @@ -10,7 +10,7 @@ set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh FAILED=0 # pf calls the interface "egress"; the OS names it ethX - resolve both -EGRESS_DEV=$(pf0 "ip route get 8.8.8.8 | grep -o 'dev [a-z0-9]*' | cut -d' ' -f2") +EGRESS_DEV=$(pf0 "ip route get $SRV_IP | grep -o 'dev [a-z0-9]*' | cut -d' ' -f2") EGRESS_IP=$(pf0 "ip -4 addr show $EGRESS_DEV | grep -o 'inet [0-9.]*' | head -1 | cut -d' ' -f2") [ -n "$EGRESS_IP" ] || EGRESS_IP=192.168.122.8 @@ -38,6 +38,6 @@ else fi echo "$TD" | grep -q "$EGRESS_IP" && ok "egress source is $EGRESS_IP" || bad "egress source not seen" -pf0 '/opt/pf/pfctl -ss' | grep -qi 'icmp' && ok "state present" || bad "no state" +pf0 '/opt/pf/pfctl -ss' | grep -q "$SRV_IP" && ok "state present" || bad "no state" pf0 '/opt/pf/pfctl -d' >/dev/null finish diff --git a/tests/vm/14-soak.sh b/tests/vm/14-soak.sh index a524fb5..b9efb75 100755 --- a/tests/vm/14-soak.sh +++ b/tests/vm/14-soak.sh @@ -24,9 +24,8 @@ C pfload /tmp/g14.conf || { bad "soak ruleset"; finish; } # mixed traffic: ICMP + TCP handshakes for ~20s -cli "ping -q -c 60 -i 0.3 $SRV_IP >/dev/null 2>&1 &" 2>/dev/null +cli "ping -q -c 40 -i 0.5 $SRV_IP >/dev/null 2>&1" 2>/dev/null cli "for i in 1 2 3 4 5; do nc -w1 -z $SRV_IP 22; done" 2>/dev/null -sleep 22 ST=$(pf0 "$HELPER states") [ "${ST:-0}" -ge 1 ] && ok "states under load ($ST)" || bad "no states under load"