4 files changed, 129 insertions, 3 deletions

diff --git a/tests/sys/net/Makefile b/tests/sys/net/Makefile
index bc8f9c5e9c80..e390c6e8059d 100644
--- a/tests/sys/net/Makefile
+++ b/tests/sys/net/Makefile
@@ -6,7 +6,6 @@ BINDIR=		${TESTSDIR}
 ATF_TESTS_C+=	if_epair
 ATF_TESTS_SH+=	if_epair_test
 ATF_TESTS_SH+=	if_bridge_test
-TEST_METADATA.if_bridge_test+=	required_programs="python"
 TEST_METADATA.if_bridge_test+=	execenv="jail"
 TEST_METADATA.if_bridge_test+=	execenv_jail_params="vnet allow.raw_sockets"
 ATF_TESTS_SH+=	if_clone_test
@@ -41,6 +40,7 @@ ${PACKAGE}FILESMODE_stp.py=		0555
 
 MAN=
 PROGS+=		randsleep
+PROGS+=		transient_tuntap
 
 CFLAGS+=        -I${.CURDIR:H:H}
 
diff --git a/tests/sys/net/if_bridge_test.sh b/tests/sys/net/if_bridge_test.sh
index 906f586d2483..0c19903714b1 100755
--- a/tests/sys/net/if_bridge_test.sh
+++ b/tests/sys/net/if_bridge_test.sh
@@ -899,7 +899,7 @@ member_ifaddrs_vlan_cleanup()
 atf_test_case "vlan_pvid" "cleanup"
 vlan_pvid_head()
 {
-	atf_set descr 'bridge with two ports with pvid set'
+	atf_set descr 'bridge with two ports with pvid and vlanfilter set'
 	atf_set require.user root
 }
 
@@ -1327,6 +1327,56 @@ bridge_svi_in_bridge_cleanup()
 	vnet_cleanup
 }
 
+atf_test_case "vlan_untagged" "cleanup"
+vlan_untagged_head()
+{
+	atf_set descr 'bridge with two ports with untagged set'
+	atf_set require.user root
+}
+
+vlan_untagged_body()
+{
+	vnet_init
+	vnet_init_bridge
+
+	epone=$(vnet_mkepair)
+	eptwo=$(vnet_mkepair)
+
+	vnet_mkjail one ${epone}b
+	vnet_mkjail two ${eptwo}b
+
+	jexec one ifconfig ${epone}b 192.0.2.1/24 up
+	jexec two ifconfig ${eptwo}b 192.0.2.2/24 up
+
+	bridge=$(vnet_mkbridge)
+
+	ifconfig ${bridge} up
+	ifconfig ${epone}a up
+	ifconfig ${eptwo}a up
+	ifconfig ${bridge} addm ${epone}a untagged 20
+	ifconfig ${bridge} addm ${eptwo}a untagged 30
+
+	# With two ports on different VLANs, traffic should not be passed.
+	atf_check -s exit:2 -o ignore jexec one ping -c 3 -t 1 192.0.2.2
+	atf_check -s exit:2 -o ignore jexec two ping -c 3 -t 1 192.0.2.1
+
+	# Move the second port to VLAN 20; now traffic should be passed.
+	atf_check -s exit:0 ifconfig ${bridge} ifuntagged ${eptwo}a 20
+	atf_check -s exit:0 -o ignore jexec one ping -c 3 -t 1 192.0.2.2
+	atf_check -s exit:0 -o ignore jexec two ping -c 3 -t 1 192.0.2.1
+
+	# Remove the first's port untagged config, now traffic should
+	# not pass again.
+	atf_check -s exit:0 ifconfig ${bridge} -ifuntagged ${epone}a
+	atf_check -s exit:2 -o ignore jexec one ping -c 3 -t 1 192.0.2.2
+	atf_check -s exit:2 -o ignore jexec two ping -c 3 -t 1 192.0.2.1
+}
+
+vlan_untagged_cleanup()
+{
+	vnet_cleanup
+}
+
 atf_test_case "vlan_defuntagged" "cleanup"
 vlan_defuntagged_head()
 {
@@ -1340,7 +1390,6 @@ vlan_defuntagged_body()
 	vnet_init_bridge
 
 	bridge=$(vnet_mkbridge)
-	atf_check -s exit:0 ifconfig ${bridge} vlanfilter
 
 	# Invalid VLAN IDs
 	atf_check -s exit:1 -ematch:"invalid vlan id: 0" \
@@ -1407,6 +1456,7 @@ atf_init_test_cases()
 	atf_add_test_case "vlan_ifconfig_iftagged"
 	atf_add_test_case "vlan_svi"
 	atf_add_test_case "vlan_qinq"
+	atf_add_test_case "vlan_untagged"
 	atf_add_test_case "vlan_defuntagged"
 	atf_add_test_case "bridge_svi_in_bridge"
 }
diff --git a/tests/sys/net/if_tun_test.sh b/tests/sys/net/if_tun_test.sh
index a4ffe66e04ce..f4ce7800272e 100755
--- a/tests/sys/net/if_tun_test.sh
+++ b/tests/sys/net/if_tun_test.sh
@@ -56,8 +56,30 @@ basic_cleanup()
 	vnet_cleanup
 }
 
+atf_test_case "transient" "cleanup"
+transient_head()
+{
+	atf_set descr "Test transient tunnel support"
+	atf_set require.user root
+}
+transient_body()
+{
+	vnet_init
+	vnet_mkjail one
+
+	tun=$(jexec one ifconfig tun create)
+	atf_check -s exit:0 -o not-empty jexec one ifconfig ${tun}
+	jexec one $(atf_get_srcdir)/transient_tuntap /dev/${tun}
+	atf_check -s not-exit:0 -e not-empty jexec one ifconfig ${tun}
+}
+transient_cleanup()
+{
+	vnet_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "235704"
 	atf_add_test_case "basic"
+	atf_add_test_case "transient"
 }
diff --git a/tests/sys/net/transient_tuntap.c b/tests/sys/net/transient_tuntap.c
new file mode 100644
index 000000000000..b0cf43064317
--- /dev/null
+++ b/tests/sys/net/transient_tuntap.c
@@ -0,0 +1,54 @@
+/*-
+ * Copyright (c) 2024 Kyle Evans <kevans@FreeBSD.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+/*
+ * This test simply configures the tunnel as transient and exits.  By the time
+ * we return, the tunnel should be gone because the last reference disappears.
+ */
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <net/if_tun.h>
+#include <net/if_tap.h>
+
+#include <assert.h>
+#include <err.h>
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+
+int
+main(int argc, char *argv[])
+{
+	unsigned long tunreq;
+	const char *tundev;
+	int one = 1, tunfd;
+
+	assert(argc > 1);
+	tundev = argv[1];
+
+	tunfd = open(tundev, O_RDWR);
+	assert(tunfd >= 0);
+
+	/*
+	 * These are technically the same request, but we'll use the technically
+	 * correct one just in case.
+	 */
+	if (strstr(tundev, "tun") != NULL) {
+		tunreq = TUNSTRANSIENT;
+	} else {
+		assert(strstr(tundev, "tap") != NULL);
+		tunreq = TAPSTRANSIENT;
+	}
+
+	if (ioctl(tunfd, tunreq, &one) == -1)
+		err(1, "ioctl");
+
+	/* Final close should destroy the tunnel automagically. */
+	close(tunfd);
+
+	return (0);
+}