aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKristof Provost <kp@FreeBSD.org>2024-11-11 16:48:49 +0000
committerKristof Provost <kp@FreeBSD.org>2024-12-17 10:07:15 +0000
commit373d6dbf34a8c4c506ccaa6ac3f7cc42493d8b48 (patch)
treef032b752995a6888697062da8f25244616367018
parentbc66cb3bfa9be8a99805a3109c72420c22e72f3b (diff)
pf tests: verify that ICMP destination unreachable makes it through NAT64
Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D47798
-rw-r--r--tests/sys/netpfil/pf/nat64.py23
1 files changed, 23 insertions, 0 deletions
diff --git a/tests/sys/netpfil/pf/nat64.py b/tests/sys/netpfil/pf/nat64.py
index a3bd6048028e..12793662c171 100644
--- a/tests/sys/netpfil/pf/nat64.py
+++ b/tests/sys/netpfil/pf/nat64.py
@@ -39,11 +39,13 @@ class TestNAT64(VnetTestTemplate):
}
def vnet3_handler(self, vnet):
+ ToolsHelper.print_output("/sbin/sysctl net.inet.ip.forwarding=1")
ToolsHelper.print_output("echo foo | nc -l 1234 &")
def vnet2_handler(self, vnet):
ifname = vnet.iface_alias_map["if1"].name
+ ToolsHelper.print_output("/sbin/route add default 192.0.2.2")
ToolsHelper.print_output("/sbin/pfctl -e")
ToolsHelper.pf_rules([
"pass inet6 proto icmp6",
@@ -102,3 +104,24 @@ class TestNAT64(VnetTestTemplate):
udp = reply.getlayer(sp.UDPerror)
assert udp
assert udp.dport == 1222
+
+ @pytest.mark.require_user("root")
+ def test_address_unreachable(self):
+ ToolsHelper.print_output("/sbin/route -6 add default 2001:db8::1")
+
+ import scapy.all as sp
+
+ packet = sp.IPv6(dst="64:ff9b::198.51.100.3") \
+ / sp.UDP(dport=1222) / sp.Raw("bar")
+ reply = sp.sr1(packet, timeout=3)
+ print(reply.show())
+
+ # We expect an ICMPv6 error, not a UDP reply
+ assert not reply.getlayer(sp.UDP)
+ icmp = reply.getlayer(sp.ICMPv6DestUnreach)
+ assert icmp
+ assert icmp.type == 1
+ assert icmp.code == 0
+ udp = reply.getlayer(sp.UDPerror)
+ assert udp
+ assert udp.dport == 1222