diff options
Diffstat (limited to 'fw/test')
| -rwxr-xr-x | fw/test/fwtest.rc | 58 |
1 files changed, 58 insertions, 0 deletions
diff --git a/fw/test/fwtest.rc b/fw/test/fwtest.rc index 8ae3f42..8a5a085 100755 --- a/fw/test/fwtest.rc +++ b/fw/test/fwtest.rc @@ -266,6 +266,64 @@ echo '== namespace mode' check 'a different port is denied' refused $"r } +echo '== a peer is checked when there is one to check' +# An announce names no peer - nobody has called yet - so a rule naming +# one was skipped, and "deny=in ip=..." did nothing here while doing +# something at the packet layer. Both rule sets below permit the +# announce by port; only the second permits the caller. The machine's +# own address stands in for a peer, since it has no loopback. +myip=`{awk '/4u$/ {print $1}' /net/ipselftab | sed 1q} +if(~ $#myip 0) + echo ' skip no IPv4 address on this machine to call' +if not { + { + echo 'deny=in proto=tcp ip='^$myip^' log=yes' + echo 'allow=in proto=tcp lport='^$port + echo 'allow=out proto=tcp ip='^$myip^' port='^$port + } > $tmp/peerno.ndb + { + echo 'allow=in proto=tcp lport='^$port^' log=yes' + echo 'allow=out proto=tcp ip='^$myip^' port='^$port + } > $tmp/peeryes.ndb + + # listentest <rules>: announce, have somebody call, and let fw + # decide. What it decided is in the log; the announce is logged + # too, so the checks look for "listen" and not for the verb alone. + fn listentest { + @{ + rfork n + $fw $1 >[2]/dev/null + @{ + conv=`{cat /fd/0} + echo -n 'announce '^$myip^'!'^$port >[1=0] + @{ cat /net/tcp/$conv/listen } >/dev/null >[2]/dev/null + } <>[0] /net/tcp/clone >/dev/null & + lpid=$apid + sleep 2 + wr /net/tcp/clone 'connect '^$myip^'!'^$port >/dev/null + sleep 3 + @{ echo kill > /proc/$lpid/note } >[2]/dev/null + } + } + + # differences, not totals: the caller's port is ephemeral, so there + # is nothing in the line that belongs to this run, and /sys/log/fw + # keeps what earlier runs put there + before=`{grep -c 'deny tcp listen '^$myip /sys/log/fw} + listentest $tmp/peerno.ndb + sleep 1 + after=`{grep -c 'deny tcp listen '^$myip /sys/log/fw} + r=`{echo $before $after | awk '{print $2 - $1}'} + check 'a rule naming the caller refuses the connection' 1 $"r + + before=`{grep -c 'allow tcp listen '^$myip /sys/log/fw} + listentest $tmp/peeryes.ndb + sleep 1 + after=`{grep -c 'allow tcp listen '^$myip /sys/log/fw} + r=`{echo $before $after | awk '{print $2 - $1}'} + check 'and one permitting it lets the program have it' 1 $"r +} + echo '== logging and accounting' # /sys/log/fw is fw's only durable output. syslog(2) does not create # it, so make it if it is not there and take it away again if we did. |