The pf IPv4 option and IPv6 extension header filter has stricter

checks for IGMP and ICMP6 MLD packets.  Use ttl, hlim, link-local,
and multicast features in test where necessary.

diff --git a/regress/sys/net/pf_opts/Makefile b/regress/sys/net/pf_opts/Makefile
index 55088a8..ade0b5f 100644 (file)
--- a/regress/sys/net/pf_opts/Makefile
+++ b/regress/sys/net/pf_opts/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.5 2022/04/29 18:58:33 bluhm Exp $
+# $OpenBSD: Makefile,v 1.6 2022/05/16 16:54:18 bluhm Exp $
 
 # Copyright (c) 2022 Alexander Bluhm <bluhm@openbsd.org>
 #
@@ -85,6 +85,7 @@ ifconfig: unconfig
        ${SUDO} /sbin/ifconfig lo$n inet 127.0.0.$n alias
        ${SUDO} /sbin/ifconfig lo$n inet6 ::1/128
        ${SUDO} /sbin/ifconfig lo$n inet6 fe80::$n/64
+       ${SUDO} /sbin/route -n -T $n add -inet 224.0.0.0/4 127.0.0.1
 .endfor
        # Wait until IPv6 addresses are no longer tentative.
        for i in `jot 50`; do\
@@ -316,12 +317,16 @@ run-icmp6-mld: stamp-bpf
 REGRESS_TARGETS +=     run-bpf-mcast
 run-bpf-mcast: stamp-stop
        # Check that multicast protocol packet with router alert passed
-       grep ' 127.0.0.${N2}: igmp query .* IPOPT-148{4}' lo${N2}.tcpdump
-       grep ' fe80::${N2}: HBH (rtalert:.* icmp6: multicast ' lo${N2}.tcpdump
+       grep '127.0.0.${N2} > 224.0.0.1:\
+           igmp query .* IPOPT-148{4}' lo${N2}.tcpdump
+       grep 'fe80::${N2} > ff02::1:\
+           HBH (rtalert:.* icmp6: multicast ' lo${N2}.tcpdump
        ! grep '127.0.0.${N1}' pflog0.tcpdump
        ! grep 'fe80::${N1}' pflog0.tcpdump
        ! grep '127.0.0.${N2}' pflog0.tcpdump
        ! grep 'fe80::${N2}' pflog0.tcpdump
+       ! grep '224.0.0.1' pflog0.tcpdump
+       ! grep 'ff02::1' pflog0.tcpdump
 
 REGRESS_TARGETS +=     run-igmp-bad
 run-igmp-bad: stamp-bpf
@@ -336,8 +341,10 @@ run-icmp6-mld-bad: stamp-bpf
 REGRESS_TARGETS +=     run-bpf-mcast-bad
 run-bpf-mcast-bad: stamp-stop
        # Check that multicast protocol packet with options were blocked
-       grep ' 127.0.0.${N2}: igmp query .* IPOPT-3{4}' pflog0.tcpdump
-       grep ' fe80::${N2}: HBH (type 0x03:.* icmp6: multicast ' pflog0.tcpdump
+       grep '127.0.0.${N2} > 224.0.0.1:\
+           igmp query .* IPOPT-3{4}' pflog0.tcpdump
+       grep 'fe80::${N2} > ff02::1:\
+           HBH (type 0x03:.* icmp6: multicast ' pflog0.tcpdump
        ! grep '127.0.0.${N1}' pflog0.tcpdump
        ! grep 'fe80::${N1}' pflog0.tcpdump
 

diff --git a/regress/sys/net/pf_opts/icmp6_mld_bad.py b/regress/sys/net/pf_opts/icmp6_mld_bad.py
index db11587..9182cca 100644 (file)
--- a/regress/sys/net/pf_opts/icmp6_mld_bad.py
+++ b/regress/sys/net/pf_opts/icmp6_mld_bad.py
@@ -18,7 +18,7 @@ ADDR6=eval("ADDR6_"+N);
 
 pid=os.getpid()
 eid=pid & 0xffff
-packet=IPv6(src=ADDR6, dst=ADDR6)/ \
+packet=IPv6(src=ADDR6, dst="ff02::1", hlim=1)/ \
     IPv6ExtHdrHopByHop(options=HBHOptUnknown(otype=3))/ \
     ICMPv6MLQuery()
 

diff --git a/regress/sys/net/pf_opts/icmp6_mld_ra.py b/regress/sys/net/pf_opts/icmp6_mld_ra.py
index a156796..b540a03 100644 (file)
--- a/regress/sys/net/pf_opts/icmp6_mld_ra.py
+++ b/regress/sys/net/pf_opts/icmp6_mld_ra.py
@@ -18,7 +18,7 @@ ADDR6=eval("ADDR6_"+N);
 
 pid=os.getpid()
 eid=pid & 0xffff
-packet=IPv6(src=ADDR6, dst=ADDR6)/ \
+packet=IPv6(src=ADDR6, dst="ff02::1", hlim=1)/ \
     IPv6ExtHdrHopByHop(options=RouterAlert())/ \
     ICMPv6MLQuery()
 

diff --git a/regress/sys/net/pf_opts/igmp_bad.py b/regress/sys/net/pf_opts/igmp_bad.py
index 7520939..58714f2 100644 (file)
--- a/regress/sys/net/pf_opts/igmp_bad.py
+++ b/regress/sys/net/pf_opts/igmp_bad.py
@@ -18,7 +18,7 @@ ADDR=eval("ADDR_"+N);
 
 pid=os.getpid()
 eid=pid & 0xffff
-packet=IP(src=ADDR, dst=ADDR, options=b"\003\004\000\000")/ \
+packet=IP(src=ADDR, dst="224.0.0.1", ttl=1, options=b"\003\004\000\000")/ \
     IGMP(type=0x11)
 
 send(packet, iface=IF)

diff --git a/regress/sys/net/pf_opts/igmp_ra.py b/regress/sys/net/pf_opts/igmp_ra.py
index 8ac0b0e..92a2ebc 100644 (file)
--- a/regress/sys/net/pf_opts/igmp_ra.py
+++ b/regress/sys/net/pf_opts/igmp_ra.py
@@ -18,7 +18,7 @@ ADDR=eval("ADDR_"+N);
 
 pid=os.getpid()
 eid=pid & 0xffff
-packet=IP(src=ADDR, dst=ADDR, options=b"\224\004\000\000")/ \
+packet=IP(src=ADDR, dst="224.0.0.1", ttl=1, options=b"\224\004\000\000")/ \
     IGMP(type=0x11)
 
 send(packet, iface=IF)