aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKristof Provost <kp@FreeBSD.org>2024-11-08 16:34:56 +0000
committerKristof Provost <kp@FreeBSD.org>2024-12-17 10:07:15 +0000
commitbc66cb3bfa9be8a99805a3109c72420c22e72f3b (patch)
treeeb947e1d52ebc96230d8c1dd740fe0361463ccf4
parenta4e0403295254fd72e8e867aceb03805fa7957af (diff)
pf tests: verify that ICMP port unreachable makes it through NAT64
Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D47797
-rw-r--r--tests/sys/netpfil/pf/nat64.py22
1 files changed, 21 insertions, 1 deletions
diff --git a/tests/sys/netpfil/pf/nat64.py b/tests/sys/netpfil/pf/nat64.py
index 0053a2401872..a3bd6048028e 100644
--- a/tests/sys/netpfil/pf/nat64.py
+++ b/tests/sys/netpfil/pf/nat64.py
@@ -39,7 +39,7 @@ class TestNAT64(VnetTestTemplate):
}
def vnet3_handler(self, vnet):
- ToolsHelper.print_output("echo foo | nc -l 1234")
+ ToolsHelper.print_output("echo foo | nc -l 1234 &")
def vnet2_handler(self, vnet):
ifname = vnet.iface_alias_map["if1"].name
@@ -82,3 +82,23 @@ class TestNAT64(VnetTestTemplate):
assert "S" in tcp.flags
assert "A" in tcp.flags
+ @pytest.mark.require_user("root")
+ def test_udp_port_closed(self):
+ ToolsHelper.print_output("/sbin/route -6 add default 2001:db8::1")
+
+ import scapy.all as sp
+
+ packet = sp.IPv6(dst="64:ff9b::192.0.2.2") \
+ / sp.UDP(dport=1222) / sp.Raw("bar")
+ reply = sp.sr1(packet, timeout=3)
+ print(reply.show())
+
+ # We expect an ICMPv6 error, not a UDP reply
+ assert not reply.getlayer(sp.UDP)
+ icmp = reply.getlayer(sp.ICMPv6DestUnreach)
+ assert icmp
+ assert icmp.type == 1
+ assert icmp.code == 4
+ udp = reply.getlayer(sp.UDPerror)
+ assert udp
+ assert udp.dport == 1222