mirror of
https://github.com/lgcosta/pf-linux-port.git
synced 2026-11-12 20:15:36 -03:00
52 lines
2.4 KiB
Bash
Executable File
52 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# M4 gate: route-to / dup-to — forced forwarding path (pf_route).
|
|
#
|
|
# Lab: cli (10.0.1.10) pings srv (10.0.2.20). Without the rule pf0 forwards it
|
|
# straight out eth2. With `route-to { 10.0.3.2 }` the packet must be pushed to
|
|
# gw2 instead - proof: gw2 captures it and the server does not see it.
|
|
# Then `dup-to { 10.0.3.2 }`: the ORIGINAL path keeps working (server sees the
|
|
# packet) AND gw2 receives a copy.
|
|
set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
|
|
|
|
pf0 'insmod /opt/pf/pf.ko 2>/dev/null || insmod /tmp/pf.ko; true'
|
|
pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
|
|
|
|
GW2_DEV=$(gw2 "ip route get $CLI_IP | grep -o 'dev [a-z0-9]*' | cut -d' ' -f2")
|
|
[ -n "$GW2_DEV" ] || GW2_DEV=eth1
|
|
|
|
capture_gw2() { gw2 "(tcpdump -ni $GW2_DEV -c 4 -e icmp > /tmp/gw2.td 2>&1 &)" 2>/dev/null; }
|
|
capture_srv() { srv "(tcpdump -ni eth1 -c 4 -e icmp > /tmp/srv.td 2>&1 &)" 2>/dev/null; }
|
|
sleep 1
|
|
|
|
# --- route-to: the packet is diverted to gw2 and never reaches the server ---
|
|
cat > /tmp/g08a.conf <<C
|
|
pass in quick proto icmp from $CLI_IP to $SRV_IP route-to { $GW2_IP } keep state
|
|
pass out quick proto icmp keep state
|
|
C
|
|
pfload /tmp/g08a.conf || { bad "route-to rule load"; finish; }
|
|
pf0 '/opt/pf/pfctl -sr' | grep -q 'route-to' && ok "route-to rule listed" || bad "route-to not listed"
|
|
capture_gw2; capture_srv
|
|
cli "ping -c2 -W2 $SRV_IP >/dev/null 2>&1"
|
|
sleep 2
|
|
gw2 'cat /tmp/gw2.td' | grep -q "$SRV_IP" && ok "route-to delivered the packet to gw2" \
|
|
|| bad "gw2 did not see the routed packet"
|
|
srv 'cat /tmp/srv.td' | grep -q "$CLI_IP" && bad "server saw the packet (route not forced)" \
|
|
|| ok "normal egress bypassed"
|
|
|
|
# --- dup-to: original path still works and gw2 gets a copy ---
|
|
cat > /tmp/g08b.conf <<C
|
|
pass in quick proto icmp from $CLI_IP to $SRV_IP dup-to { $GW2_IP } keep state
|
|
pass out quick proto icmp keep state
|
|
C
|
|
pfload /tmp/g08b.conf || { bad "dup-to rule load"; finish; }
|
|
pf0 '/opt/pf/pfctl -sr' | grep -q 'dup-to' && ok "dup-to rule listed" || bad "dup-to not listed"
|
|
capture_gw2; capture_srv
|
|
cli "ping -c2 -W2 $SRV_IP >/dev/null 2>&1" && ok "dup-to did not break the flow" \
|
|
|| bad "dup-to broke the transit ping"
|
|
sleep 2
|
|
srv 'cat /tmp/srv.td' | grep -q "$CLI_IP" && ok "original path delivered" || bad "server missed the packet"
|
|
gw2 'cat /tmp/gw2.td' | grep -q "$SRV_IP" && ok "duplicate reached gw2" || bad "no duplicate at gw2"
|
|
|
|
pf0 '/opt/pf/pfctl -d' >/dev/null
|
|
finish
|