1 files changed, 58 insertions, 0 deletions
diff --git a/fw/test/fwtest.rc b/fw/test/fwtest.rc
index 8ae3f42..8a5a085 100755
--- a/fw/test/fwtest.rc
+++ b/fw/test/fwtest.rc
@@ -266,6 +266,64 @@ echo '== namespace mode'
 	check 'a different port is denied' refused $"r
 }
 
+echo '== a peer is checked when there is one to check'
+# An announce names no peer - nobody has called yet - so a rule naming
+# one was skipped, and "deny=in ip=..." did nothing here while doing
+# something at the packet layer.  Both rule sets below permit the
+# announce by port; only the second permits the caller.  The machine's
+# own address stands in for a peer, since it has no loopback.
+myip=`{awk '/4u$/ {print $1}' /net/ipselftab | sed 1q}
+if(~ $#myip 0)
+	echo '	skip  no IPv4 address on this machine to call'
+if not {
+	{
+		echo 'deny=in		proto=tcp	ip='^$myip^'	log=yes'
+		echo 'allow=in		proto=tcp	lport='^$port
+		echo 'allow=out		proto=tcp	ip='^$myip^'	port='^$port
+	} > $tmp/peerno.ndb
+	{
+		echo 'allow=in		proto=tcp	lport='^$port^'	log=yes'
+		echo 'allow=out		proto=tcp	ip='^$myip^'	port='^$port
+	} > $tmp/peeryes.ndb
+
+	# listentest <rules>: announce, have somebody call, and let fw
+	# decide.  What it decided is in the log; the announce is logged
+	# too, so the checks look for "listen" and not for the verb alone.
+	fn listentest {
+		@{
+			rfork n
+			$fw $1 >[2]/dev/null
+			@{
+				conv=`{cat /fd/0}
+				echo -n 'announce '^$myip^'!'^$port >[1=0]
+				@{ cat /net/tcp/$conv/listen } >/dev/null >[2]/dev/null
+			} <>[0] /net/tcp/clone >/dev/null &
+			lpid=$apid
+			sleep 2
+			wr /net/tcp/clone 'connect '^$myip^'!'^$port >/dev/null
+			sleep 3
+			@{ echo kill > /proc/$lpid/note } >[2]/dev/null
+		}
+	}
+
+	# differences, not totals: the caller's port is ephemeral, so there
+	# is nothing in the line that belongs to this run, and /sys/log/fw
+	# keeps what earlier runs put there
+	before=`{grep -c 'deny tcp listen '^$myip /sys/log/fw}
+	listentest $tmp/peerno.ndb
+	sleep 1
+	after=`{grep -c 'deny tcp listen '^$myip /sys/log/fw}
+	r=`{echo $before $after | awk '{print $2 - $1}'}
+	check 'a rule naming the caller refuses the connection' 1 $"r
+
+	before=`{grep -c 'allow tcp listen '^$myip /sys/log/fw}
+	listentest $tmp/peeryes.ndb
+	sleep 1
+	after=`{grep -c 'allow tcp listen '^$myip /sys/log/fw}
+	r=`{echo $before $after | awk '{print $2 - $1}'}
+	check 'and one permitting it lets the program have it' 1 $"r
+}
+
 echo '== logging and accounting'
 # /sys/log/fw is fw's only durable output.  syslog(2) does not create
 # it, so make it if it is not there and take it away again if we did.