diff options
Diffstat (limited to 'fw/test/fwtest.rc')
| -rwxr-xr-x | fw/test/fwtest.rc | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/fw/test/fwtest.rc b/fw/test/fwtest.rc index ffbc6b6..f687295 100755 --- a/fw/test/fwtest.rc +++ b/fw/test/fwtest.rc @@ -261,6 +261,35 @@ echo '== namespace mode' check 'a different port is denied' refused $"r } +echo '== logging and accounting' +# /sys/log/fw is fw's only durable output. syslog(2) does not create +# it, so make it if it is not there and take it away again if we did. +madelog=no +if(! test -f /sys/log/fw){ + >/sys/log/fw + chmod 666 /sys/log/fw + madelog=yes +} +@{ + rfork n + { + echo 'deny=out proto=tcp ip=127.0.0.2 log=yes' + echo 'allow=out proto=tcp ip=127.0.0.1 port='^$port^' log=yes' + } > $tmp/log.ndb + $fw $tmp/log.ndb >[2]/dev/null + + wr /net/tcp/clone 'connect 127.0.0.2!'^$port >/dev/null + wr /net/tcp/clone 'connect 127.0.0.1!'^$port >/dev/null +} +sleep 1 +# the port is this run's, so the whole file can be searched +r=`{grep -c 'deny tcp connect 127.0.0.2!'^$port^': denied by rule 1' /sys/log/fw} +check 'a denied connection is logged, with the rule that said so' 1 $"r +r=`{grep -c 'allow tcp connect 127.0.0.1!'^$port /sys/log/fw} +check 'and a permitted one, when the rule asks' 1 $"r +if(~ $madelog yes) + rm -f /sys/log/fw + echo '== rules: round-trip through ctl' cat > $tmp/ip.ndb <<'!' allow=out proto=tcp ip=10.9.0.0/24 port=80 @@ -324,6 +353,16 @@ echo '== packets, between two stacks' r=`{grep -c . $mtpt/rules} check 'it took one rule to do that' 1 $"r + # A rule edit rebuilds the set, so every count starts at zero; what + # runs next is revalidate, re-checking the live flow against the new + # rules. That is not traffic. Counting it made "how often has this + # rule decided something" answer a different question after every + # edit. + echo -n 'append deny=out proto=udp' > $mtpt/ctl + sleep 1 + r=`{awk '/allow=in/ {print $1}' $mtpt/stats} + check 'rechecking flows after an edit is not a decision' 0 $"r + echo -n 'prepend deny=in proto=tcp lport='^$port > $mtpt/ctl sleep 1 r=`{grep -c $port $mtpt/flows} |