diff options
Diffstat (limited to 'contrib/ipfilter/test')
38 files changed, 450 insertions, 24 deletions
diff --git a/contrib/ipfilter/test/Makefile b/contrib/ipfilter/test/Makefile index 16535bf..1923908 100644 --- a/contrib/ipfilter/test/Makefile +++ b/contrib/ipfilter/test/Makefile @@ -21,7 +21,7 @@ first: -mkdir -p results # Filtering tests -ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13 f14 f15 f16 f17 f18 f19 +ftests: f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13 f14 f15 f16 f17 f18 f19 f20 # Rule parsing tests ptests: i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 i12 i13 i14 i15 i16 i17 i18 i19 \ @@ -29,7 +29,8 @@ ptests: i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 i12 i13 i14 i15 i16 i17 i18 i19 \ ntests: n1 n2 n3 n4 n5 n6 n7 n8 n9 n10 n11 n12 n13 n14 -nitests: ni1 ni2 ni3 ni4 ni5 ni6 ni7 ni8 ni9 ni10 ni11 ni12 ni13 ni14 ni15 ni16 +nitests: ni1 ni2 ni3 ni4 ni5 ni6 ni7 ni8 ni9 ni10 ni11 ni12 ni13 ni14 ni15 \ + ni16 ni19 ni20 ni21 intests: in1 in2 in3 in4 in5 in6 @@ -44,7 +45,7 @@ bpf: bpf1 bpf-f1 f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13 f14 f19: @/bin/sh ./dotest `awk "/^$@ / { print; } " test.format` -f15 f16 f17 f18: +f15 f16 f17 f18 f20: @/bin/sh ./mtest `awk "/^$@ / { print; } " test.format` i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 i12 i13 i14 i15 i16 i17 i18 i19 i20 i21 bpf1: @@ -53,10 +54,10 @@ i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 i12 i13 i14 i15 i16 i17 i18 i19 i20 i21 bpf1: n1 n2 n3 n4 n5 n6 n7 n8 n9 n10 n11 n12 n13 n14: @/bin/sh ./nattest `awk "/^$@ / { print; } " test.format` -ni1 ni2 ni3 ni4 ni5 ni7 ni8 ni9 ni10 ni11 ni12 ni13 ni14 ni15 ni16: +ni1 ni2 ni3 ni4 ni5 ni7 ni8 ni9 ni10 ni11 ni12 ni13 ni14 ni15 ni16 ni19 ni20: @/bin/sh ./natipftest single `awk "/^$@ / { print; } " test.format` -ni6: +ni6 ni21: @/bin/sh ./natipftest multi `awk "/^$@ / { print; } " test.format` in1 in2 in3 in4 in5 in6: @@ -78,11 +79,11 @@ bpf-f1: /bin/sh ./bpftest `awk "/^$@ / { print; } " test.format` clean: - /bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13 f14 f15 f16 f17 f18 f19 + /bin/rm -f f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13 f14 f15 f16 f17 f18 f19 f20 /bin/rm -f i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 i12 i13 i14 i15 i16 i17 i18 i19 i20 i21 /bin/rm -f n1 n2 n3 n4 n5 n6 n7 n8 n9 n10 n11 n12 n13 n14 /bin/rm -f ni1 ni2 ni3 ni4 ni5 ni6 ni7 ni8 ni9 - /bin/rm -f ni10 ni11 ni12 ni13 ni14 ni15 ni16 + /bin/rm -f ni10 ni11 ni12 ni13 ni14 ni15 ni16 ni19 ni20 ni21 /bin/rm -f in1 in2 in3 in4 in5 in6 /bin/rm -f p1 p2 p3 ip1 /bin/rm -f l1 diff --git a/contrib/ipfilter/test/expected/f20 b/contrib/ipfilter/test/expected/f20 new file mode 100644 index 0000000..86308a0 --- /dev/null +++ b/contrib/ipfilter/test/expected/f20 @@ -0,0 +1,3 @@ +pass +nomatch +-------- diff --git a/contrib/ipfilter/test/expected/i1 b/contrib/ipfilter/test/expected/i1 index c012af8..74d0f30 100644 --- a/contrib/ipfilter/test/expected/i1 +++ b/contrib/ipfilter/test/expected/i1 @@ -3,12 +3,12 @@ block out all log in all log body in all count in from any to any -pass in from !any to any +pass in from !any to any pps 10 block in from any to !any pass in on ed0(!) from 127.0.0.1/32 to 127.0.0.1/32 pass in on ed0(!),vx0(!) from 127.0.0.1/32 to 127.0.0.1/32 block in log first on lo0(!) from any to any -pass in log body quick from any to any +pass in log body or-block quick from any to any block return-rst in quick on le0(!) proto tcp from any to any block return-icmp in on qe0(!) from any to any block return-icmp(host-unr) in on qe0(!) from any to any diff --git a/contrib/ipfilter/test/expected/i10 b/contrib/ipfilter/test/expected/i10 index 57bd4ef..9e0a5d5 100644 --- a/contrib/ipfilter/test/expected/i10 +++ b/contrib/ipfilter/test/expected/i10 @@ -1,4 +1,5 @@ pass in from 127.0.0.1/32 to 127.0.0.1/32 with opt sec +pass in from 127.0.0.1/32 to 127.0.0.1/32 with opt lsrr not opt sec block in from any to any with not opt sec-class topsecret block in from any to any with not opt sec-class topsecret,secret pass in from any to any with opt sec-class topsecret,confid not opt sec-class unclass diff --git a/contrib/ipfilter/test/expected/i11 b/contrib/ipfilter/test/expected/i11 index 26b8b78..d4a6ec4 100644 --- a/contrib/ipfilter/test/expected/i11 +++ b/contrib/ipfilter/test/expected/i11 @@ -7,4 +7,5 @@ pass in on ed0(!) out-via vx0(!) proto udp from any to any keep state pass out on ppp0(!) in-via le0(!) proto tcp from any to any keep state pass in on ed0(!),vx0(!) out-via vx0(!),ed0(!) proto udp from any to any keep state pass in proto tcp from any port > 1024 to 127.0.0.1/32 port = 1024 keep state -pass in proto tcp from any to any flags S/FSRPAU keep state (limit 101,strict,newisn,no-icmp-err) +pass in proto tcp from any to any flags S/FSRPAU keep state (limit 101,strict,newisn,no-icmp-err,age 600/600) +pass in proto udp from any to any keep state (sync,age 10/20) diff --git a/contrib/ipfilter/test/expected/i18 b/contrib/ipfilter/test/expected/i18 index 1aaa04f..88fca47 100644 --- a/contrib/ipfilter/test/expected/i18 +++ b/contrib/ipfilter/test/expected/i18 @@ -1,6 +1,7 @@ pass in tos 0x50 from any to any pass in tos 0x80 from any to any -pass in tos 0x28 from any to any +pass in tos 0x80 from any to any +pass in tos 0x50 from any to any block in ttl 0 from any to any block in ttl 1 from any to any block in ttl 2 from any to any diff --git a/contrib/ipfilter/test/expected/i5 b/contrib/ipfilter/test/expected/i5 index 6947ad3..edf9865 100644 --- a/contrib/ipfilter/test/expected/i5 +++ b/contrib/ipfilter/test/expected/i5 @@ -3,3 +3,7 @@ count in tos 0x80 from any to any pass in on ed0(!) tos 0x40 from 127.0.0.1/32 to 127.0.0.1/32 block in log on lo0(!) ttl 0 from any to any pass in quick ttl 1 from any to any +skip 3 out from 127.0.0.1/32 to any +auth out on foo0(!) proto tcp from any to any port = 80 +preauth out on foo0(!) proto tcp from any to any port = 22 +nomatch out on foo0(!) proto tcp from any port < 1024 to any diff --git a/contrib/ipfilter/test/expected/i8 b/contrib/ipfilter/test/expected/i8 index 5533a7d..f033e6b 100644 --- a/contrib/ipfilter/test/expected/i8 +++ b/contrib/ipfilter/test/expected/i8 @@ -31,3 +31,5 @@ pass in proto icmp from any to any icmp-type squench pass in proto icmp from any to any icmp-type timest pass in proto icmp from any to any icmp-type timestrep pass in proto icmp from any to any icmp-type timex +pass in proto icmp from any to any icmp-type 254 +pass in proto icmp from any to any icmp-type 253 code 254 diff --git a/contrib/ipfilter/test/expected/i9 b/contrib/ipfilter/test/expected/i9 index bb4e54f..2d46454 100644 --- a/contrib/ipfilter/test/expected/i9 +++ b/contrib/ipfilter/test/expected/i9 @@ -5,8 +5,13 @@ pass in from any to any with opt nop,rr,zsu not opt lsrr,ssrr pass in from 127.0.0.1/32 to 127.0.0.1/32 with not frag pass in from 127.0.0.1/32 to 127.0.0.1/32 with frag,frag-body pass in proto tcp from any to any flags S/FSRPAU with not oow keep state +block in proto tcp from any to any with oow pass in proto tcp from any to any flags S/FSRPAU with not bad,bad-src,bad-nat +block in proto tcp from any to any flags S/FSRPAU with bad,not bad-src,not bad-nat +pass in quick from any to any with not short block in quick from any to any with not nat +pass in quick from any to any with not frag-body block in quick from any to any with not lowttl -pass in from any to any with mbcast,not bcast,mcast,not state +pass in from any to any with not ipopts,mbcast,not bcast,mcast,not state +block in from any to any with not mbcast,bcast,not mcast,state pass in from any to any with opt mtup,mtur,encode,ts,tr,sec,e-sec,cipso,satid,ssrr,addext,visa,imitd,eip,finn,dps,sdb,nsapa,rtralrt,ump diff --git a/contrib/ipfilter/test/expected/in2 b/contrib/ipfilter/test/expected/in2 index 1dc7b68..f1239b1 100644 --- a/contrib/ipfilter/test/expected/in2 +++ b/contrib/ipfilter/test/expected/in2 @@ -1,5 +1,5 @@ rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 tcp -rdr le0 9.8.7.6/32 -> 1.1.1.1 ip +rdr le0 9.8.7.6/32 -> 1.1.1.1 255 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp rdr le0 9.8.7.6/32 -> 1.1.1.1 ip rdr le0 9.0.0.0/8 -> 1.1.1.1 ip diff --git a/contrib/ipfilter/test/expected/in5 b/contrib/ipfilter/test/expected/in5 index f371b35..e77de71 100644 --- a/contrib/ipfilter/test/expected/in5 +++ b/contrib/ipfilter/test/expected/in5 @@ -1,7 +1,8 @@ map le0 from 9.8.7.6/32 port > 1024 to any -> 1.1.1.1/32 portmap tcp 10000:20000 +map le0 from 9.8.7.6/32 port > 1024 ! to 1.2.3.4/32 -> 1.1.1.1/32 portmap tcp 10000:20000 rdr le0 from any to 9.8.7.6/32 port = 0 -> 1.1.1.1 port 0 tcp rdr le0 from any to 9.8.7.6/32 -> 1.1.1.1 ip -rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp +rdr le0 ! from 1.2.3.4/32 to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp rdr le0 from any to 9.8.7.6/32 -> 1.1.1.1 ip rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 udp diff --git a/contrib/ipfilter/test/expected/ni19 b/contrib/ipfilter/test/expected/ni19 new file mode 100644 index 0000000..a75c583 --- /dev/null +++ b/contrib/ipfilter/test/expected/ni19 @@ -0,0 +1,25 @@ +4500 0040 e3fc 4000 4006 40b5 0a01 0101 0a01 0104 03f1 0202 6523 90b2 0000 0000 b002 8000 a431 0000 0204 05b4 0103 0300 0402 0101 0101 080a 0000 0000 0000 0000 +4500 0034 0000 4000 4006 fe13 0a01 0104 c0a8 7103 0202 03f1 915a a5c4 6523 90b3 8012 16d0 e89c 0000 0204 05b4 0101 0402 0103 0302 +4500 0028 e3fd 4000 4006 40cc 0a01 0101 0a01 0104 03f1 0202 6523 90b3 915a a5c5 5010 832c e3b7 0000 +4500 002d e3fe 4000 4006 40c6 0a01 0101 0a01 0104 03f1 0202 6523 90b3 915a a5c5 5018 832c 8242 0000 3130 3038 00 +4500 0028 7ce5 4000 4006 813a 0a01 0104 c0a8 7103 0202 03f1 915a a5c5 6523 90b8 5010 05b4 3a81 0000 +4500 003c 1186 4000 4006 ec85 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a2 0000 0000 a002 16d0 b8c0 0000 0204 05b4 0402 080a 0039 d924 0000 0000 0103 0302 +4500 0040 e3ff 4000 4006 40b2 0a01 0101 0a01 0104 03f0 03ff 66e5 b810 91d4 c8a3 b012 8000 452f 0000 0204 05b4 0103 0300 0101 080a 0000 0000 0039 d924 0402 0101 +4500 0034 1188 4000 4006 ec8b 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a3 66e5 b811 8010 05b4 d99b 0000 0101 080a 0039 d925 0000 0000 +4500 0030 e400 4000 4006 40c1 0a01 0101 0a01 0104 03f1 0202 6523 90b8 915a a5c5 5018 832c 3560 0000 6461 7272 656e 7200 +4500 0028 7ce7 4000 4006 8138 0a01 0104 c0a8 7103 0202 03f1 915a a5c5 6523 90c0 5010 05b4 3a79 0000 +4500 0053 e401 4000 4006 409d 0a01 0101 0a01 0104 03f1 0202 6523 90c0 915a a5c5 5018 832c cce7 0000 6461 7272 656e 7200 7368 202d 6320 2265 6368 6f20 666f 6f20 3e26 313b 2065 6368 6f20 6261 7220 3e26 3222 00 +4500 0028 7ce9 4000 4006 8136 0a01 0104 c0a8 7103 0202 03f1 915a a5c5 6523 90eb 5010 05b4 3a4e 0000 +4500 0029 7ceb 4000 4006 8133 0a01 0104 c0a8 7103 0202 03f1 915a a5c5 6523 90eb 5018 05b4 3a45 0000 00 +4500 0028 e403 4000 4006 40c6 0a01 0101 0a01 0104 03f1 0202 6523 90eb 915a a5c6 5010 832c e37e 0000 +4500 002c 7ced 4000 4006 812e 0a01 0104 c0a8 7103 0202 03f1 915a a5c6 6523 90eb 5018 05b4 64c7 0000 666f 6f0a +4500 0038 118a 4000 4006 ec85 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a3 66e5 b811 8018 05b4 00dd 0000 0101 080a 0039 dd6c 0000 0000 6261 720a +4500 0028 7cef 4000 4006 8130 0a01 0104 c0a8 7103 0202 03f1 915a a5ca 6523 90eb 5011 05b4 3a48 0000 +4500 0034 118c 4000 4006 ec87 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a7 66e5 b811 8011 05b4 d54e 0000 0101 080a 0039 dd6d 0000 0000 +4500 0028 e404 4000 4006 1a1b c0a8 7103 0a01 0104 03f1 0202 6523 90eb 915a a5cb 5010 8328 bcd3 0000 +4500 0034 e405 4000 4006 1a0e c0a8 7103 0a01 0104 03f0 03ff 66e5 b811 91d4 c8a8 8010 8328 57d7 0000 0101 080a 0000 0004 0039 dd6c +4500 0028 e40a 4000 4006 1a15 c0a8 7103 0a01 0104 03f1 0202 6523 90eb 915a a5cb 5011 832c bcce 0000 +4500 0034 e40b 4000 4006 1a08 c0a8 7103 0a01 0104 03f0 03ff 66e5 b811 91d4 c8a8 8011 832c 57d2 0000 0101 080a 0000 0004 0039 dd6c +4500 0028 0004 4000 4006 fe1b 0a01 0104 c0a8 7103 0202 03f1 915a a5cb 6523 90ec 5010 05b4 3a47 0000 +4500 0034 118e 4000 4006 ec85 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a8 66e5 b812 8010 05b4 d548 0000 0101 080a 0039 dd6e 0000 0004 +------------------------------- diff --git a/contrib/ipfilter/test/expected/ni20 b/contrib/ipfilter/test/expected/ni20 new file mode 100644 index 0000000..46833bd --- /dev/null +++ b/contrib/ipfilter/test/expected/ni20 @@ -0,0 +1,25 @@ +4500 0040 e3fc 4000 4006 f362 c0a8 7103 c0a8 7104 03f1 0202 6523 90b2 0000 0000 b002 8000 56df 0000 0204 05b4 0103 0300 0402 0101 0101 080a 0000 0000 0000 0000 +4500 0034 0000 4000 4006 fe13 0a01 0104 c0a8 7103 0202 03f1 915a a5c4 6523 90b3 8012 16d0 e89c 0000 0204 05b4 0101 0402 0103 0302 +4500 0028 e3fd 4000 4006 f379 c0a8 7103 c0a8 7104 03f1 0202 6523 90b3 915a a5c5 5010 832c 9665 0000 +4500 002d e3fe 4000 4006 f373 c0a8 7103 c0a8 7104 03f1 0202 6523 90b3 915a a5c5 5018 832c 34f0 0000 3130 3038 00 +4500 0028 7ce5 4000 4006 813a 0a01 0104 c0a8 7103 0202 03f1 915a a5c5 6523 90b8 5010 05b4 3a81 0000 +4500 003c 1186 4000 4006 ec85 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a2 0000 0000 a002 16d0 b8c0 0000 0204 05b4 0402 080a 0039 d924 0000 0000 0103 0302 +4500 0040 e3ff 4000 4006 f35f c0a8 7103 c0a8 7104 03f0 03ff 66e5 b810 91d4 c8a3 b012 8000 f7dc 0000 0204 05b4 0103 0300 0101 080a 0000 0000 0039 d924 0402 0101 +4500 0034 1188 4000 4006 ec8b 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a3 66e5 b811 8010 05b4 d99b 0000 0101 080a 0039 d925 0000 0000 +4500 0030 e400 4000 4006 f36e c0a8 7103 c0a8 7104 03f1 0202 6523 90b8 915a a5c5 5018 832c e80d 0000 6461 7272 656e 7200 +4500 0028 7ce7 4000 4006 8138 0a01 0104 c0a8 7103 0202 03f1 915a a5c5 6523 90c0 5010 05b4 3a79 0000 +4500 0053 e401 4000 4006 f34a c0a8 7103 c0a8 7104 03f1 0202 6523 90c0 915a a5c5 5018 832c 7f95 0000 6461 7272 656e 7200 7368 202d 6320 2265 6368 6f20 666f 6f20 3e26 313b 2065 6368 6f20 6261 7220 3e26 3222 00 +4500 0028 7ce9 4000 4006 8136 0a01 0104 c0a8 7103 0202 03f1 915a a5c5 6523 90eb 5010 05b4 3a4e 0000 +4500 0029 7ceb 4000 4006 8133 0a01 0104 c0a8 7103 0202 03f1 915a a5c5 6523 90eb 5018 05b4 3a45 0000 00 +4500 0028 e403 4000 4006 f373 c0a8 7103 c0a8 7104 03f1 0202 6523 90eb 915a a5c6 5010 832c 962c 0000 +4500 002c 7ced 4000 4006 812e 0a01 0104 c0a8 7103 0202 03f1 915a a5c6 6523 90eb 5018 05b4 64c7 0000 666f 6f0a +4500 0038 118a 4000 4006 ec85 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a3 66e5 b811 8018 05b4 00dd 0000 0101 080a 0039 dd6c 0000 0000 6261 720a +4500 0028 7cef 4000 4006 8130 0a01 0104 c0a8 7103 0202 03f1 915a a5ca 6523 90eb 5011 05b4 3a48 0000 +4500 0034 118c 4000 4006 ec87 0a01 0104 c0a8 7103 03ff 03f0 91d4 c8a7 66e5 b811 8011 05b4 d54e 0000 0101 080a 0039 dd6d 0000 0000 +4500 0028 e404 4000 4006 f372 c0a8 7103 c0a8 7104 03f1 0202 6523 90eb 915a a5cb 5010 8328 962b 0000 +4500 0034 e405 4000 4006 f365 c0a8 7103 c0a8 7104 03f0 03ff 66e5 b811 91d4 c8a8 8010 8328 312f 0000 0101 080a 0000 0004 0039 dd6c +4500 0028 e40a 4000 4006 f36c c0a8 7103 c0a8 7104 03f1 0202 6523 90eb 915a a5cb 5011 832c 9626 0000 +4500 0034 e40b 4000 4006 f35f c0a8 7103 c0a8 7104 03f0 03ff 66e5 b811 91d4 c8a8 8011 832c 312a 0000 0101 080a 0000 0004 0039 dd6c +4500 0028 0004 4000 4006 d773 c0a8 7104 c0a8 7103 0202 03f1 915a a5cb 6523 90ec 5010 05b4 139f 0000 +4500 0034 118e 4000 4006 c5dd c0a8 7104 c0a8 7103 03ff 03f0 91d4 c8a8 66e5 b812 8010 05b4 aea0 0000 0101 080a 0039 dd6e 0000 0004 +------------------------------- diff --git a/contrib/ipfilter/test/expected/ni21 b/contrib/ipfilter/test/expected/ni21 new file mode 100644 index 0000000..349ae23 --- /dev/null +++ b/contrib/ipfilter/test/expected/ni21 @@ -0,0 +1,4 @@ +ip #0 20(20) 0 4.4.4.4 > 3.3.3.3 +ip #0 20(20) 0 3.3.3.3 > 2.2.2.2 +ip #0 20(20) 0 4.4.4.4 > 3.3.3.3 +------------------------------- diff --git a/contrib/ipfilter/test/input/f2 b/contrib/ipfilter/test/input/f2 index d168af0..f4e9d23 100644 --- a/contrib/ipfilter/test/input/f2 +++ b/contrib/ipfilter/test/input/f2 @@ -1,5 +1,5 @@ -in tcp 127.0.0.1,1 127.0.0.1,21 -in tcp 1.1.1.1,1 1.2.1.1,21 +in tcp 127.0.0.1,1 127.0.0.1,ftp +in tcp 1.1.1.1,1 1.2.1.1,ftp in udp 127.0.0.1,1 127.0.0.1,21 in udp 1.1.1.1,1 1.2.1.1,21 in icmp 127.0.0.1 127.0.0.1 diff --git a/contrib/ipfilter/test/input/f20 b/contrib/ipfilter/test/input/f20 new file mode 100644 index 0000000..605ba7c --- /dev/null +++ b/contrib/ipfilter/test/input/f20 @@ -0,0 +1,2 @@ +out on de0 1.1.1.1 2.2.2.2 +out on ab0 1.1.1.1 2.2.2.2 diff --git a/contrib/ipfilter/test/input/ni19 b/contrib/ipfilter/test/input/ni19 new file mode 100644 index 0000000..d95e68a --- /dev/null +++ b/contrib/ipfilter/test/input/ni19 @@ -0,0 +1,157 @@ +# 192.168.113.3.1009 > 10.1.1.4.shell: SYN win 32768 <mss 1460,nop,wscale 0,sackOK,nop,nop,nop,nop,timestamp 0 0> +[out,bge0] +4500 0040 e3fc 4000 4006 1a0b c0a8 7103 +0a01 0104 03f1 0202 6523 90b2 0000 0000 +b002 8000 7d87 0000 0204 05b4 0103 0300 +0402 0101 0101 080a 0000 0000 0000 0000 + +# 10.1.1.4.shell > 10.1.1.1.1009: SYN win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 2> +[in,bge0] +4500 0034 0000 4000 4006 24be 0a01 0104 +0a01 0101 0202 03f1 915a a5c4 6523 90b3 +8012 16d0 0f47 0000 0204 05b4 0101 0402 +0103 0302 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[out,bge0] +4500 0028 e3fd 4000 4006 1a22 c0a8 7103 +0a01 0104 03f1 0202 6523 90b3 915a a5c5 +5010 832c bd0d 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[out,bge0] +4500 002d e3fe 4000 4006 1a1c c0a8 7103 +0a01 0104 03f1 0202 6523 90b3 915a a5c5 +5018 832c 5b98 0000 3130 3038 00 + +# 10.1.1.4.shell > 10.1.1.1.1009 +[in,bge0] +4500 0028 7ce5 4000 4006 a7e4 0a01 0104 +0a01 0101 0202 03f1 915a a5c5 6523 90b8 +5010 05b4 612b 0000 0000 0000 0000 + +# 10.1.1.4.1023 > 10.1.1.1.1008: SYN win 5840 <mss 1460,sackOK,timestamp 3791140 0,nop,wscale 2> +[in,bge0] +4500 003c 1186 4000 4006 1330 0a01 0104 +0a01 0101 03ff 03f0 91d4 c8a2 0000 0000 +a002 16d0 df6a 0000 0204 05b4 0402 080a +0039 d924 0000 0000 0103 0302 + +# 192.168.113.3.1008 > 10.1.1.4.1023: SYN win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 3791140,sackOK,nop,nop> +[out,bge0] +4500 0040 e3ff 4000 4006 1a08 c0a8 7103 +0a01 0104 03f0 03ff 66e5 b810 91d4 c8a3 +b012 8000 1e85 0000 0204 05b4 0103 0300 +0101 080a 0000 0000 0039 d924 0402 0101 + +# 10.1.1.4.1023 > 10.1.1.1.1008 +[in,bge0] +4500 0034 1188 4000 4006 1336 0a01 0104 +0a01 0101 03ff 03f0 91d4 c8a3 66e5 b811 +8010 05b4 0046 0000 0101 080a 0039 d925 +0000 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[out,bge0] +4500 0030 e400 4000 4006 1a17 c0a8 7103 +0a01 0104 03f1 0202 6523 90b8 915a a5c5 +5018 832c 0eb6 0000 6461 7272 656e 7200 + +# 10.1.1.4.shell > 10.1.1.1.1009 +[in,bge0] +4500 0028 7ce7 4000 4006 a7e2 0a01 0104 +0a01 0101 0202 03f1 915a a5c5 6523 90c0 +5010 05b4 6123 0000 0000 0000 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[out,bge0] +4500 0053 e401 4000 4006 19f3 c0a8 7103 +0a01 0104 03f1 0202 6523 90c0 915a a5c5 +5018 832c a63d 0000 6461 7272 656e 7200 +7368 202d 6320 2265 6368 6f20 666f 6f20 +3e26 313b 2065 6368 6f20 6261 7220 3e26 +3222 00 + +# 10.1.1.4.shell > 10.1.1.1.1009 +[in,bge0] +4500 0028 7ce9 4000 4006 a7e0 0a01 0104 +0a01 0101 0202 03f1 915a a5c5 6523 90eb +5010 05b4 60f8 0000 0000 0000 0000 + +# 10.1.1.4.shell > 10.1.1.1.1009 +[in,bge0] +4500 0029 7ceb 4000 4006 a7dd 0a01 0104 +0a01 0101 0202 03f1 915a a5c5 6523 90eb +5018 05b4 60ef 0000 0000 0000 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[out,bge0] +4500 0028 e403 4000 4006 1a1c c0a8 7103 +0a01 0104 03f1 0202 6523 90eb 915a a5c6 +5010 832c bcd4 0000 + +# 10.1.1.4.shell > 10.1.1.1.1009 +[in,bge0] +4500 002c 7ced 4000 4006 a7d8 0a01 0104 +0a01 0101 0202 03f1 915a a5c6 6523 90eb +5018 05b4 8b71 0000 666f 6f0a 0000 + +# 10.1.1.4.1023 > 10.1.1.1.1008 +[in,bge0] +4500 0038 118a 4000 4006 1330 0a01 0104 +0a01 0101 03ff 03f0 91d4 c8a3 66e5 b811 +8018 05b4 2787 0000 0101 080a 0039 dd6c +0000 0000 6261 720a + +# 10.1.1.4.shell > 10.1.1.1.1009 +[in,bge0] +4500 0028 7cef 4000 4006 a7da 0a01 0104 +0a01 0101 0202 03f1 915a a5ca 6523 90eb +5011 05b4 60f2 0000 0000 0000 0000 + +# 10.1.1.4.1023 > 10.1.1.1.1008 +[in,bge0] +4500 0034 118c 4000 4006 1332 0a01 0104 +0a01 0101 03ff 03f0 91d4 c8a7 66e5 b811 +8011 05b4 fbf8 0000 0101 080a 0039 dd6d +0000 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[out,bge0] +4500 0028 e404 4000 4006 1a1b c0a8 7103 +0a01 0104 03f1 0202 6523 90eb 915a a5cb +5010 8328 bcd3 0000 + +# 192.168.113.3.1008 > 10.1.1.4.1023 +[out,bge0] +4500 0034 e405 4000 4006 1a0e c0a8 7103 +0a01 0104 03f0 03ff 66e5 b811 91d4 c8a8 +8010 8328 57d7 0000 0101 080a 0000 0004 +0039 dd6c + +# 192.168.113.3.1009 > 10.1.1.4.shell +[out,bge0] +4500 0028 e40a 4000 4006 1a15 c0a8 7103 +0a01 0104 03f1 0202 6523 90eb 915a a5cb +5011 832c bcce 0000 + +# 192.168.113.3.1008 > 10.1.1.4.1023 +[out,bge0] +4500 0034 e40b 4000 4006 1a08 c0a8 7103 +0a01 0104 03f0 03ff 66e5 b811 91d4 c8a8 +8011 832c 57d2 0000 0101 080a 0000 0004 +0039 dd6c + +# 10.1.1.4.shell > 10.1.1.1.1009 +[in,bge0] +4500 0028 0004 4000 4006 24c6 0a01 0104 +0a01 0101 0202 03f1 915a a5cb 6523 90ec +5010 05b4 60f1 0000 0000 0000 0000 + +# 10.1.1.4.1023 > 10.1.1.1.1008 +[in,bge0] +4500 0034 118e 4000 4006 1330 0a01 0104 +0a01 0101 03ff 03f0 91d4 c8a8 66e5 b812 +8010 05b4 fbf2 0000 0101 080a 0039 dd6e +0000 0004 + diff --git a/contrib/ipfilter/test/input/ni20 b/contrib/ipfilter/test/input/ni20 new file mode 100644 index 0000000..4c2b87e --- /dev/null +++ b/contrib/ipfilter/test/input/ni20 @@ -0,0 +1,157 @@ +# 192.168.113.3.1009 > 10.1.1.4.shell: SYN win 32768 <mss 1460,nop,wscale 0,sackOK,nop,nop,nop,nop,timestamp 0 0> +[in,bge0] +4500 0040 e3fc 4000 4006 1a0b c0a8 7103 +0a01 0104 03f1 0202 6523 90b2 0000 0000 +b002 8000 7d87 0000 0204 05b4 0103 0300 +0402 0101 0101 080a 0000 0000 0000 0000 + +# 192.168.113.4.shell > 192.168.113.3.1009: SYN win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 2> +[out,bge0] +4500 0034 0000 4000 4006 d76b c0a8 7104 +c0a8 7103 0202 03f1 915a a5c4 6523 90b3 +8012 16d0 c1f4 0000 0204 05b4 0101 0402 +0103 0302 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[in,bge0] +4500 0028 e3fd 4000 4006 1a22 c0a8 7103 +0a01 0104 03f1 0202 6523 90b3 915a a5c5 +5010 832c bd0d 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[in,bge0] +4500 002d e3fe 4000 4006 1a1c c0a8 7103 +0a01 0104 03f1 0202 6523 90b3 915a a5c5 +5018 832c 5b98 0000 3130 3038 00 + +# 192.168.113.4.shell > 192.168.113.3.1009 +[out,bge0] +4500 0028 7ce5 4000 4006 5a92 c0a8 7104 +c0a8 7103 0202 03f1 915a a5c5 6523 90b8 +5010 05b4 13d9 0000 0000 0000 0000 + +# 192.168.113.4.1023 > 192.168.113.3.1008: SYN win 5840 <mss 1460,sackOK,timestamp 3791140 0,nop,wscale 2> +[out,bge0] +4500 003c 1186 4000 4006 c5dd c0a8 7104 +c0a8 7103 03ff 03f0 91d4 c8a2 0000 0000 +a002 16d0 9218 0000 0204 05b4 0402 080a +0039 d924 0000 0000 0103 0302 + +# 192.168.113.3.1008 > 10.1.1.4.1023: SYN win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 3791140,sackOK,nop,nop> +[in,bge0] +4500 0040 e3ff 4000 4006 1a08 c0a8 7103 +0a01 0104 03f0 03ff 66e5 b810 91d4 c8a3 +b012 8000 1e85 0000 0204 05b4 0103 0300 +0101 080a 0000 0000 0039 d924 0402 0101 + +# 192.168.113.4.1023 > 192.168.113.3.1008 +[out,bge0] +4500 0034 1188 4000 4006 c5e3 c0a8 7104 +c0a8 7103 03ff 03f0 91d4 c8a3 66e5 b811 +8010 05b4 b2f3 0000 0101 080a 0039 d925 +0000 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[in,bge0] +4500 0030 e400 4000 4006 1a17 c0a8 7103 +0a01 0104 03f1 0202 6523 90b8 915a a5c5 +5018 832c 0eb6 0000 6461 7272 656e 7200 + +# 192.168.113.4.shell > 192.168.113.3.1009 +[out,bge0] +4500 0028 7ce7 4000 4006 5a90 c0a8 7104 +c0a8 7103 0202 03f1 915a a5c5 6523 90c0 +5010 05b4 13d1 0000 0000 0000 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[in,bge0] +4500 0053 e401 4000 4006 19f3 c0a8 7103 +0a01 0104 03f1 0202 6523 90c0 915a a5c5 +5018 832c a63d 0000 6461 7272 656e 7200 +7368 202d 6320 2265 6368 6f20 666f 6f20 +3e26 313b 2065 6368 6f20 6261 7220 3e26 +3222 00 + +# 192.168.113.4.shell > 192.168.113.3.1009 +[out,bge0] +4500 0028 7ce9 4000 4006 5a8e c0a8 7104 +c0a8 7103 0202 03f1 915a a5c5 6523 90eb +5010 05b4 13a6 0000 0000 0000 0000 + +# 192.168.113.4.shell > 192.168.113.3.1009 +[out,bge0] +4500 0029 7ceb 4000 4006 5a8b c0a8 7104 +c0a8 7103 0202 03f1 915a a5c5 6523 90eb +5018 05b4 139d 0000 0000 0000 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[in,bge0] +4500 0028 e403 4000 4006 1a1c c0a8 7103 +0a01 0104 03f1 0202 6523 90eb 915a a5c6 +5010 832c bcd4 0000 + +# 192.168.113.4.shell > 192.168.113.3.1009 +[out,bge0] +4500 002c 7ced 4000 4006 5a86 c0a8 7104 +c0a8 7103 0202 03f1 915a a5c6 6523 90eb +5018 05b4 3e1f 0000 666f 6f0a 0000 + +# 192.168.113.4.1023 > 192.168.113.3.1008 +[out,bge0] +4500 0038 118a 4000 4006 c5dd c0a8 7104 +c0a8 7103 03ff 03f0 91d4 c8a3 66e5 b811 +8018 05b4 da34 0000 0101 080a 0039 dd6c +0000 0000 6261 720a + +# 192.168.113.4.shell > 192.168.113.3.1009 +[out,bge0] +4500 0028 7cef 4000 4006 5a88 c0a8 7104 +c0a8 7103 0202 03f1 915a a5ca 6523 90eb +5011 05b4 13a0 0000 0000 0000 0000 + +# 192.168.113.4.1023 > 192.168.113.3.1008 +[out,bge0] +4500 0034 118c 4000 4006 c5df c0a8 7104 +c0a8 7103 03ff 03f0 91d4 c8a7 66e5 b811 +8011 05b4 aea6 0000 0101 080a 0039 dd6d +0000 0000 + +# 192.168.113.3.1009 > 10.1.1.4.shell +[in,bge0] +4500 0028 e404 4000 4006 1a1b c0a8 7103 +0a01 0104 03f1 0202 6523 90eb 915a a5cb +5010 8328 bcd3 0000 + +# 192.168.113.3.1008 > 10.1.1.4.1023 +[in,bge0] +4500 0034 e405 4000 4006 1a0e c0a8 7103 +0a01 0104 03f0 03ff 66e5 b811 91d4 c8a8 +8010 8328 57d7 0000 0101 080a 0000 0004 +0039 dd6c + +# 192.168.113.3.1009 > 10.1.1.4.shell +[in,bge0] +4500 0028 e40a 4000 4006 1a15 c0a8 7103 +0a01 0104 03f1 0202 6523 90eb 915a a5cb +5011 832c bcce 0000 + +# 192.168.113.3.1008 > 10.1.1.4.1023 +[in,bge0] +4500 0034 e40b 4000 4006 1a08 c0a8 7103 +0a01 0104 03f0 03ff 66e5 b811 91d4 c8a8 +8011 832c 57d2 0000 0101 080a 0000 0004 +0039 dd6c + +# 192.168.113.4.shell > 192.168.113.3.1009 +[out,bge0] +4500 0028 0004 4000 4006 d773 c0a8 7104 +c0a8 7103 0202 03f1 915a a5cb 6523 90ec +5010 05b4 139f 0000 0000 0000 0000 + +# 192.168.113.4.1023 > 192.168.113.3.1008 +[out,bge0] +4500 0034 118e 4000 4006 c5dd c0a8 7104 +c0a8 7103 03ff 03f0 91d4 c8a8 66e5 b812 +8010 05b4 aea0 0000 0101 080a 0039 dd6e +0000 0004 + diff --git a/contrib/ipfilter/test/input/ni21 b/contrib/ipfilter/test/input/ni21 new file mode 100644 index 0000000..daf741e --- /dev/null +++ b/contrib/ipfilter/test/input/ni21 @@ -0,0 +1,3 @@ +out on lan0 2.2.2.2 3.3.3.3 +in on lan0 3.3.3.3 4.4.4.4 +out on lan0 2.2.2.2 3.3.3.3 diff --git a/contrib/ipfilter/test/regress/f20 b/contrib/ipfilter/test/regress/f20 new file mode 100644 index 0000000..279523e --- /dev/null +++ b/contrib/ipfilter/test/regress/f20 @@ -0,0 +1,4 @@ +block out quick on de0 head 100 +skip 1 out group 100 +block out quick group 100 +pass out quick group 100 diff --git a/contrib/ipfilter/test/regress/i1 b/contrib/ipfilter/test/regress/i1 index c86c320..0fd2c6e 100644 --- a/contrib/ipfilter/test/regress/i1 +++ b/contrib/ipfilter/test/regress/i1 @@ -4,12 +4,12 @@ all log in all log body in all count in from any to any -pass in from !any to any +pass in from !any to any pps 10 block in from any to !any pass in on ed0 from localhost to localhost pass in on ed0,vx0 from localhost to localhost block in log first on lo0 from any to any -pass in log body quick from any to any +pass in log body or-block quick from any to any block return-rst in quick on le0 proto tcp from any to any block return-icmp in on qe0 from any to any block return-icmp(1) in on qe0 from any to any diff --git a/contrib/ipfilter/test/regress/i10 b/contrib/ipfilter/test/regress/i10 index ece2712..640ac84 100644 --- a/contrib/ipfilter/test/regress/i10 +++ b/contrib/ipfilter/test/regress/i10 @@ -1,4 +1,5 @@ pass in from localhost to localhost with opt sec +pass in from localhost to localhost with opt lsrr not opt sec block in from any to any with not opt sec-class topsecret block in from any to any with not opt sec-class topsecret,secret pass in from any to any with opt sec-class topsecret,confid not opt sec-class unclass diff --git a/contrib/ipfilter/test/regress/i11 b/contrib/ipfilter/test/regress/i11 index 89b3589..cb7d683 100644 --- a/contrib/ipfilter/test/regress/i11 +++ b/contrib/ipfilter/test/regress/i11 @@ -7,4 +7,5 @@ pass in on ed0 out-via vx0 proto udp from any to any keep state pass out on ppp0 in-via le0 proto tcp from any to any keep state pass in on ed0,vx0 out-via vx0,ed0 proto udp from any to any keep state pass in proto tcp from any port gt 1024 to localhost port eq 1024 keep state -pass in proto tcp all flags S keep state(strict,newisn,no-icmp-err,limit 101) +pass in proto tcp all flags S keep state(strict,newisn,no-icmp-err,limit 101,age 600) +pass in proto udp all keep state(age 10/20,sync) diff --git a/contrib/ipfilter/test/regress/i15 b/contrib/ipfilter/test/regress/i15 index 5268ec35..0e6b0d1 100644 --- a/contrib/ipfilter/test/regress/i15 +++ b/contrib/ipfilter/test/regress/i15 @@ -2,4 +2,3 @@ pass out on fxp0 all set-tag(log=100) pass out on fxp0 all set-tag(nat=foo) pass out on fxp0 all set-tag(log=100, nat=200) pass out on fxp0 all set-tag(log=2147483648, nat=overtherainbowisapotof) - diff --git a/contrib/ipfilter/test/regress/i17 b/contrib/ipfilter/test/regress/i17 index a995ae5..e399248 100644 --- a/contrib/ipfilter/test/regress/i17 +++ b/contrib/ipfilter/test/regress/i17 @@ -9,3 +9,5 @@ pass in from localhost to any @0 pass in from 1.1.1.1 to any @1 110 pass in from 2.2.2.2 to any @2 pass in from 3.3.3.3 to any +call fr_srcgrpmap/100 out from 10.1.0.0/16 to any +call now fr_dstgrpmap/200 in from 10.2.0.0/16 to any diff --git a/contrib/ipfilter/test/regress/i18 b/contrib/ipfilter/test/regress/i18 index c2845d1..03ce713 100644 --- a/contrib/ipfilter/test/regress/i18 +++ b/contrib/ipfilter/test/regress/i18 @@ -1,2 +1,3 @@ -pass in tos (80,0x80,40) all +pass in tos (80,0x80) all +pass in tos (0x80,80) all block in ttl (0,1,2,3,4,5,6) all diff --git a/contrib/ipfilter/test/regress/i5 b/contrib/ipfilter/test/regress/i5 index 38482f3..788f971 100644 --- a/contrib/ipfilter/test/regress/i5 +++ b/contrib/ipfilter/test/regress/i5 @@ -3,3 +3,7 @@ count in tos 0x80 from any to any pass in on ed0 tos 64 from localhost to localhost block in log on lo0 ttl 0 from any to any pass in quick ttl 1 from any to any +skip 3 out from 127.0.0.1 to any +auth out on foo0 proto tcp from any to any port = 80 +preauth out on foo0 proto tcp from any to any port = 22 +nomatch out on foo0 proto tcp from any port < 1024 to any diff --git a/contrib/ipfilter/test/regress/i8 b/contrib/ipfilter/test/regress/i8 index cc984b2..c30f8bd 100644 --- a/contrib/ipfilter/test/regress/i8 +++ b/contrib/ipfilter/test/regress/i8 @@ -29,3 +29,5 @@ pass in proto icmp all icmp-type squench pass in proto icmp all icmp-type timest pass in proto icmp all icmp-type timestrep pass in proto icmp all icmp-type timex +pass in proto icmp all icmp-type 254 +pass in proto icmp all icmp-type 253 code 254 diff --git a/contrib/ipfilter/test/regress/i9 b/contrib/ipfilter/test/regress/i9 index a966bed..441cfa9 100644 --- a/contrib/ipfilter/test/regress/i9 +++ b/contrib/ipfilter/test/regress/i9 @@ -5,8 +5,13 @@ pass in from any to any with opt nop,rr,zsu not opt ssrr,lsrr pass in from localhost to localhost and not frag pass in from localhost to localhost with frags,frag-body pass in proto tcp all flags S with not oow keep state +block in proto tcp all with oow pass in proto tcp all flags S with not bad,bad-src,bad-nat +block in proto tcp all flags S with bad,not bad-src,not bad-nat +pass in quick all with not short block in quick all with not nat +pass in quick all with not frag-body block in quick all with not lowttl -pass in all with mbcast,not bcast,multicast,not state +pass in all with mbcast,not bcast,multicast,not state,not ipopts +block in all with not mbcast,bcast,not multicast,state pass in from any to any with opt mtur,mtup,encode,ts,tr,sec,cipso,satid,ssrr,visa,imitd,eip,finn,dps,sdb,nsapa,rtralrt,ump,addext,e-sec diff --git a/contrib/ipfilter/test/regress/in2 b/contrib/ipfilter/test/regress/in2 index 4a86de7..83a2ca5 100644 --- a/contrib/ipfilter/test/regress/in2 +++ b/contrib/ipfilter/test/regress/in2 @@ -1,5 +1,5 @@ rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 tcp -rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 255 rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp rdr le0 9.8.7.6/32 -> 1.1.1.1 ip rdr le0 9.8.7.6/0xff000000 -> 1.1.1.1 ip diff --git a/contrib/ipfilter/test/regress/in5 b/contrib/ipfilter/test/regress/in5 index c539b03..766c3e3 100644 --- a/contrib/ipfilter/test/regress/in5 +++ b/contrib/ipfilter/test/regress/in5 @@ -1,7 +1,8 @@ map le0 from 9.8.7.6/32 port > 1024 to any -> 1.1.1.1 portmap 10000:20000 tcp +map le0 from 9.8.7.6/32 port > 1024 to ! 1.2.3.4 -> 1.1.1.1 portmap 10000:20000 tcp rdr le0 from any to 9.8.7.6/32 port = 0 -> 1.1.1.1 port 0 tcp rdr le0 from any to 9.8.7.6/0xffffffff port = 0 -> 1.1.1.1 port 0 ip -rdr le0 from any to 9.8.7.6 port = 8888 -> 1.1.1.1 port 888 tcp +rdr le0 ! from 1.2.3.4 to 9.8.7.6 port = 8888 -> 1.1.1.1 port 888 tcp rdr le0 from any to 9.8.7.6/255.255.255.255 port = 8888 -> 1.1.1.1 port 888 ip rdr le0 from any to 9.8.7.6 mask 0xffffffff port = 8888 -> 1.1.1.1 port 888 tcp rdr le0 from any to 9.8.7.6 mask 255.255.255.255 port = 8888 -> 1.1.1.1 port 888 udp diff --git a/contrib/ipfilter/test/regress/ni19.ipf b/contrib/ipfilter/test/regress/ni19.ipf new file mode 100644 index 0000000..c6fcec1 --- /dev/null +++ b/contrib/ipfilter/test/regress/ni19.ipf @@ -0,0 +1,3 @@ +block in all +pass out quick on bge0 proto tcp from any to any port = shell flags S keep state +block out all diff --git a/contrib/ipfilter/test/regress/ni19.nat b/contrib/ipfilter/test/regress/ni19.nat new file mode 100644 index 0000000..56b81a9 --- /dev/null +++ b/contrib/ipfilter/test/regress/ni19.nat @@ -0,0 +1 @@ +map bge0 192.168.113.0/24 -> 10.1.1.1/32 proxy port shell rcmd/tcp diff --git a/contrib/ipfilter/test/regress/ni20.ipf b/contrib/ipfilter/test/regress/ni20.ipf new file mode 100644 index 0000000..c6f6d84 --- /dev/null +++ b/contrib/ipfilter/test/regress/ni20.ipf @@ -0,0 +1,3 @@ +block in all +pass in quick on bge0 proto tcp from any to any port = shell flags S keep state +block out all diff --git a/contrib/ipfilter/test/regress/ni20.nat b/contrib/ipfilter/test/regress/ni20.nat new file mode 100644 index 0000000..f2dd0a7 --- /dev/null +++ b/contrib/ipfilter/test/regress/ni20.nat @@ -0,0 +1 @@ +rdr bge0 10.1.1.4/32 port shell -> 192.168.113.4 port shell tcp proxy rcmd diff --git a/contrib/ipfilter/test/regress/ni21.ipf b/contrib/ipfilter/test/regress/ni21.ipf new file mode 100644 index 0000000..6d6ed08 --- /dev/null +++ b/contrib/ipfilter/test/regress/ni21.ipf @@ -0,0 +1 @@ +pass out on lan0 to eri0:1.1.1.1 from 2.2.2.2 to any diff --git a/contrib/ipfilter/test/regress/ni21.nat b/contrib/ipfilter/test/regress/ni21.nat new file mode 100644 index 0000000..6b2d46a --- /dev/null +++ b/contrib/ipfilter/test/regress/ni21.nat @@ -0,0 +1 @@ +map lan0,eri0 2.2.2.2 -> 4.4.4.4 diff --git a/contrib/ipfilter/test/test.format b/contrib/ipfilter/test/test.format index f284542..4bb1851 100644 --- a/contrib/ipfilter/test/test.format +++ b/contrib/ipfilter/test/test.format @@ -20,6 +20,7 @@ f16 text text f17 hex hex f18 text text f19 text text fr_statemax=3 +f20 text text i1 text ipf i2 text ipf i3 text ipf @@ -82,6 +83,9 @@ ni13 hex hex fr_update_ipid=1 ni14 hex hex fr_update_ipid=1 ni15 hex hex fr_update_ipid=1 ni16 hex hex fr_update_ipid=1 +ni19 hex hex fr_update_ipid=0 +ni20 hex hex fr_update_ipid=0 +ni21 text text p1 text text p2 text text p3 text text |
