lgcosta/pf-linux-port
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tests: gate assertions corrected (pfctl state format, transit egress device, CPU SRSO advisory excluded); Makefile demo target

Browse Source
This commit is contained in:
lgcosta committed 2026-11-11 20:04:16 -03:00
1 parent 18c0a69f74
commit 525fe7ee28
4 files changed
+14 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Makefile
+10 -2
View File
@@ -1,7 +1,7 @@
# PF-on-Linux top-level make # PF-on-Linux top-level make
KERNELDIR ?= $(HOME)/lab/linux_kernel/linux-7.3.4 KERNELDIR ?= $(HOME)/lab/linux_kernel/linux-7.3.4
.PHONY: module tools kernel test clean vm vm-destroy docs .PHONY: module tools kernel test clean vm vm-destroy docs demo
module: module:
$(MAKE) -C $(KERNELDIR) M=$(CURDIR)/module modules $(MAKE) -C $(KERNELDIR) M=$(CURDIR)/module modules
@@ -25,7 +25,15 @@ docs:
@for f in docs/en/*.md; do echo "EN $$f"; done @for f in docs/en/*.md; do echo "EN $$f"; done
@for f in docs/pt-BR/*.md; do echo "PT $$f"; done @for f in docs/pt-BR/*.md; do echo "PT $$f"; done
# Record the lab session as an asciinema cast (real output, scripted pacing).
demo:
@mkdir -p out
@command -v asciinema >/dev/null 2>&1 || { \
echo "asciinema not installed: pip install asciinema"; exit 1; }
asciinema rec out/demo-pf-linux.cast -c "bash scripts/demo-session.sh"
@echo "-> out/demo-pf-linux.cast (play: asciinema play out/demo-pf-linux.cast)"
clean: clean:
$(MAKE) -C $(KERNELDIR) M=$(CURDIR)/module clean || true $(MAKE) -C $(KERNELDIR) M=$(CURDIR)/module clean || true
$(MAKE) -C tools clean || true $(MAKE) -C tools clean || true
rm -rf out/ @find out -maxdepth 1 -type f ! -name '*.cast' -delete 2>/dev/null || true
tests/vm/04-anchors.sh
+1 -1
View File
@@ -34,7 +34,7 @@ ANC=$(pfput /tmp/g4anc.conf) || { bad "anchor conf upload"; finish; }
pf0 "/opt/pf/pfctl -a restricted -f $ANC" || { bad "anchor ruleset load"; finish; } pf0 "/opt/pf/pfctl -a restricted -f $ANC" || { bad "anchor ruleset load"; finish; }
pf0 '/opt/pf/pfctl -sr' | grep -q 'anchor "restricted"' && ok "anchor rule in main ruleset" || bad "anchor rule missing" pf0 '/opt/pf/pfctl -sr' | grep -q 'anchor "restricted"' && ok "anchor rule in main ruleset" || bad "anchor rule missing"
pf0 '/opt/pf/pfctl -a restricted -sr' | grep -q 'pass in quick proto icmp' && ok "anchor rules listed" || bad "anchor rules missing" pf0 '/opt/pf/pfctl -a restricted -sr' | grep -q 'proto icmp from' && ok "anchor rules listed" || bad "anchor rules missing"
# the request must pass through the anchor (the block rule would drop it) # the request must pass through the anchor (the block rule would drop it)
cli "ping -c2 -W2 $SRV_IP >/dev/null 2>&1" && ok "anchor pass honoured (request allowed)" \ cli "ping -c2 -W2 $SRV_IP >/dev/null 2>&1" && ok "anchor pass honoured (request allowed)" \
tests/vm/05-nat.sh
+2 -2
View File
@@ -10,7 +10,7 @@ set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
FAILED=0 FAILED=0
# pf calls the interface "egress"; the OS names it ethX - resolve both # pf calls the interface "egress"; the OS names it ethX - resolve both
EGRESS_DEV=$(pf0 "ip route get 8.8.8.8 | grep -o 'dev [a-z0-9]*' | cut -d' ' -f2") EGRESS_DEV=$(pf0 "ip route get $SRV_IP | grep -o 'dev [a-z0-9]*' | cut -d' ' -f2")
EGRESS_IP=$(pf0 "ip -4 addr show $EGRESS_DEV | grep -o 'inet [0-9.]*' | head -1 | cut -d' ' -f2") EGRESS_IP=$(pf0 "ip -4 addr show $EGRESS_DEV | grep -o 'inet [0-9.]*' | head -1 | cut -d' ' -f2")
[ -n "$EGRESS_IP" ] || EGRESS_IP=192.168.122.8 [ -n "$EGRESS_IP" ] || EGRESS_IP=192.168.122.8
@@ -38,6 +38,6 @@ else
fi fi
echo "$TD" | grep -q "$EGRESS_IP" && ok "egress source is $EGRESS_IP" || bad "egress source not seen" echo "$TD" | grep -q "$EGRESS_IP" && ok "egress source is $EGRESS_IP" || bad "egress source not seen"
pf0 '/opt/pf/pfctl -ss' | grep -qi 'icmp' && ok "state present" || bad "no state" pf0 '/opt/pf/pfctl -ss' | grep -q "$SRV_IP" && ok "state present" || bad "no state"
pf0 '/opt/pf/pfctl -d' >/dev/null pf0 '/opt/pf/pfctl -d' >/dev/null
finish finish
tests/vm/14-soak.sh
+1 -2
View File
@@ -24,9 +24,8 @@ C
pfload /tmp/g14.conf || { bad "soak ruleset"; finish; } pfload /tmp/g14.conf || { bad "soak ruleset"; finish; }
# mixed traffic: ICMP + TCP handshakes for ~20s # mixed traffic: ICMP + TCP handshakes for ~20s
cli "ping -q -c 60 -i 0.3 $SRV_IP >/dev/null 2>&1 &" 2>/dev/null cli "ping -q -c 40 -i 0.5 $SRV_IP >/dev/null 2>&1" 2>/dev/null
cli "for i in 1 2 3 4 5; do nc -w1 -z $SRV_IP 22; done" 2>/dev/null cli "for i in 1 2 3 4 5; do nc -w1 -z $SRV_IP 22; done" 2>/dev/null
sleep 22
ST=$(pf0 "$HELPER states") ST=$(pf0 "$HELPER states")
[ "${ST:-0}" -ge 1 ] && ok "states under load ($ST)" || bad "no states under load" [ "${ST:-0}" -ge 1 ] && ok "states under load ($ST)" || bad "no states under load"