diff options
Diffstat (limited to 'ipf/regress')
196 files changed, 1660 insertions, 0 deletions
diff --git a/ipf/regress/Makefile b/ipf/regress/Makefile new file mode 100644 index 000000000000..22e1fe61082d --- /dev/null +++ b/ipf/regress/Makefile @@ -0,0 +1,206 @@ +# $NetBSD: Makefile,v 1.8 2014/07/12 14:37:49 darrenr Exp $ + +TESTSDIR= ${TESTSBASE}/ipf +ATFFILE= no + +FILESDIR= ${TESTSDIR}/regress +FILES=\ +bpf-f1 \ +bpf1 \ +f1 \ +f10 \ +f11 \ +f12 \ +f13 \ +f14 \ +f15 \ +f16 \ +f17 \ +f18 \ +f19 \ +f2 \ +f20 \ +f21 \ +f22 \ +f24 \ +f25 \ +f26 \ +f27 \ +f28.ipf \ +f28.pool \ +f29.ipf \ +f29.pool \ +f3 \ +f30 \ +f4 \ +f5 \ +f6 \ +f7 \ +f8 \ +f9 \ +i1 \ +i10 \ +i11 \ +i12 \ +i13 \ +i14 \ +i15 \ +i16 \ +i17 \ +i18 \ +i19 \ +i2 \ +i20 \ +i21 \ +i22 \ +i23 \ +i3 \ +i4 \ +i5 \ +i6 \ +i7 \ +i8 \ +i9 \ +in1 \ +in1_6 \ +in100 \ +in100_6 \ +in101 \ +in101_6 \ +in102 \ +in102_6 \ +in2 \ +in2_6 \ +in3 \ +in3_6 \ +in4 \ +in4_6 \ +in5 \ +in5_6 \ +in6 \ +in6_6 \ +in7 \ +in8_6 \ +ip1 \ +ip2 \ +ip3 \ +ipv6.1 \ +ipv6.2 \ +ipv6.3 \ +ipv6.4 \ +ipv6.5 \ +ipv6.6 \ +l1 \ +n1 \ +n10 \ +n100 \ +n101 \ +n102 \ +n103 \ +n104 \ +n105 \ +n106 \ +n10_6 \ +n11 \ +n11_6 \ +n12 \ +n12_6 \ +n13 \ +n13_6 \ +n14 \ +n14_6 \ +n15 \ +n15_6 \ +n16 \ +n16_6 \ +n17 \ +n18 \ +n1_6 \ +n2 \ +n200 \ +n2_6 \ +n3 \ +n4 \ +n4_6 \ +n5 \ +n5_6 \ +n6 \ +n6_6 \ +n7 \ +n7_6 \ +n8 \ +n8_6 \ +n9 \ +n9_6 \ +ni1.ipf \ +ni1.nat \ +ni10.ipf \ +ni10.nat \ +ni11.ipf \ +ni11.nat \ +ni12.ipf \ +ni12.nat \ +ni13.ipf \ +ni13.nat \ +ni14.ipf \ +ni14.nat \ +ni15.ipf \ +ni15.nat \ +ni16.ipf \ +ni16.nat \ +ni17.ipf \ +ni17.nat \ +ni18.ipf \ +ni18.nat \ +ni19.ipf \ +ni19.nat \ +ni2.ipf \ +ni2.nat \ +ni20.ipf \ +ni20.nat \ +ni21.ipf \ +ni21.nat \ +ni23.ipf \ +ni23.nat \ +ni3.ipf \ +ni3.nat \ +ni4.ipf \ +ni4.nat \ +ni5.ipf \ +ni5.nat \ +ni6.ipf \ +ni6.nat \ +ni7.ipf \ +ni7.nat \ +ni8.ipf \ +ni8.nat \ +ni9.ipf \ +ni9.nat \ +p1.ipf \ +p1.pool \ +p10.nat \ +p10.pool \ +p11.nat \ +p11.pool \ +p12.nat \ +p12.pool \ +p13.ipf \ +p13.pool \ +p2.ipf \ +p3.ipf \ +p3.pool \ +p4.nat \ +p4.pool \ +p5.ipf \ +p5.pool \ +p6.ipf \ +p6.pool \ +p6.whois \ +p7.nat \ +p7.pool \ +p9.nat \ +p9.pool + +.include <bsd.test.mk> +.include <bsd.files.mk> +.include <bsd.prog.mk> diff --git a/ipf/regress/bpf-f1 b/ipf/regress/bpf-f1 new file mode 100644 index 000000000000..2c8028311a7e --- /dev/null +++ b/ipf/regress/bpf-f1 @@ -0,0 +1,4 @@ +pass in bpf-v4 { "0x20 0 0 0xc 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" } +pass out bpf-v4 { "0x20 0 0 0xc 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" } +pass in bpf-v4 { "0x20 0 0 0x10 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" } +pass out bpf-v4 { "0x20 0 0 0x10 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" } diff --git a/ipf/regress/bpf1 b/ipf/regress/bpf1 new file mode 100644 index 000000000000..5d83b77ed3ce --- /dev/null +++ b/ipf/regress/bpf1 @@ -0,0 +1,4 @@ +pass in bpf-v4 { "0x20 0 0 0xc 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" } +pass out bpf-v4 { "src host 1.1.1.1" } +pass in bpf-v4 { "0x20 0 0 0x10 0x15 0 0x1 0x1010101 0x6 0 0 0x60 0x6 0 0 0" } +pass out bpf-v4 { "dst host 1.1.1.1" } diff --git a/ipf/regress/f1 b/ipf/regress/f1 new file mode 100644 index 000000000000..6a2ede9e31c0 --- /dev/null +++ b/ipf/regress/f1 @@ -0,0 +1,4 @@ +block in all +pass in all +block out all +pass out all diff --git a/ipf/regress/f10 b/ipf/regress/f10 new file mode 100644 index 000000000000..355298308e72 --- /dev/null +++ b/ipf/regress/f10 @@ -0,0 +1,18 @@ +block in from any to any with not ipopts +pass in from any to any with not opt sec-class topsecret +block in from any to any with not opt ssrr,sec-class topsecret +pass in from any to any with not opt ssrr,sec-class topsecret +block in from any to any with not opt ts,sec-class topsecret +pass in from any to any with not opt ts,sec-class topsecret +block in from any to any with not opt sec-class secret +pass in from any to any with not opt sec-class secret +block in from any to any with not opt lsrr,ssrr +pass in from any to any with not opt lsrr,ssrr +pass in from any to any with not ipopts +block in from any to any with not opt lsrr +pass in from any to any with not opt lsrr +block in from any to any with not opt ssrr,ts +pass in from any to any with not opt ssrr,ts +block in from any to any with not opt rr +pass in from any to any with not opt rr +block in from any to any with not opt sec-class topsecret diff --git a/ipf/regress/f11 b/ipf/regress/f11 new file mode 100644 index 000000000000..a71e528c2215 --- /dev/null +++ b/ipf/regress/f11 @@ -0,0 +1,7 @@ +pass in proto tcp from any to any port = 23 flags S/SA keep state +block in proto tcp from any to any port = 23 flags S/SA keep state +pass in proto udp from any to any port = 53 keep frags +block in proto udp from any to any port = 53 keep frags +pass in proto udp from any to any port = 53 keep state +block in proto udp from any to any port = 53 keep state +pass in on e0 proto tcp from any to any port = 25 keep state diff --git a/ipf/regress/f12 b/ipf/regress/f12 new file mode 100644 index 000000000000..c29f839aa502 --- /dev/null +++ b/ipf/regress/f12 @@ -0,0 +1,6 @@ +pass in proto tcp from any port > 1024 to any port = 25 with not short +pass in proto tcp from any port > 1024 to any port = 25 +block in proto tcp from any to any with short +block in proto tcp from any to any with frag +pass in proto udp from any port = 53 to any port = 53 +block in proto udp from any port = 53 to any port = 53 with not short diff --git a/ipf/regress/f13 b/ipf/regress/f13 new file mode 100644 index 000000000000..393a65e9eff0 --- /dev/null +++ b/ipf/regress/f13 @@ -0,0 +1,9 @@ +pass in proto tcp from any to any port = 25 flags S/SA keep frags +block in proto tcp from any to any port = 25 flags S/SA keep frags +pass in proto udp from any to any port = 53 keep frags +block in proto udp from any to any port = 53 keep frags +pass in proto tcp from any to any port = 25 flags S/SA keep state keep frags +block in proto tcp from any to any port = 25 flags S/SA keep state keep frags +pass in proto udp from any to any port = 53 keep frags(strict) +pass in proto tcp from any to any port = 25 keep state(strict) +pass in proto tcp from any to any port = 25 keep state(loose) diff --git a/ipf/regress/f14 b/ipf/regress/f14 new file mode 100644 index 000000000000..06ab51995ea2 --- /dev/null +++ b/ipf/regress/f14 @@ -0,0 +1,8 @@ +block in from !1.1.1.1 to any +pass in from 1.1.1.1 to !any +block in from 1.1.1.0/24 to !any +pass in from !1.1.1.0/24 to any +block in from !1.1.0.0/16 to any +pass in from 1.1.0.0/16 to !1.2.0.0/16 +block in from any to !127.0.0.0/8 +pass in from !any to any diff --git a/ipf/regress/f15 b/ipf/regress/f15 new file mode 100644 index 000000000000..16185e1f3685 --- /dev/null +++ b/ipf/regress/f15 @@ -0,0 +1,8 @@ +block in log quick on hme0 from any to 195.134.65.0/25 head 10 +block return-rst in log quick proto tcp all flags S head 100 group 10 +pass in quick proto tcp from any to any port = 22 keep state group 100 +pass in quick proto tcp from any to any port = 23 keep state group 100 +pass in quick proto tcp from any to any port = 21 keep state group 100 +block return-icmp in quick proto udp all keep state head 110 group 10 +pass in quick proto udp from any to any port = 53 keep state group 110 +block in log quick on hme0 from any to any diff --git a/ipf/regress/f16 b/ipf/regress/f16 new file mode 100644 index 000000000000..920ad8c958d2 --- /dev/null +++ b/ipf/regress/f16 @@ -0,0 +1,10 @@ +pass in all +skip 2 in proto tcp all +block in quick proto tcp all +skip 4 in proto udp all +block in quick proto udp all +pass in quick proto tcp from any to 1.1.1.1 +pass in quick proto tcp from any to 1.1.1.2 port = 22 +block in quick proto udp from any to any port = 53 +pass in quick proto udp from any to any port = 53 +block in all diff --git a/ipf/regress/f17 b/ipf/regress/f17 new file mode 100644 index 000000000000..9a75ae3c1b54 --- /dev/null +++ b/ipf/regress/f17 @@ -0,0 +1,4 @@ +block in all +block out all +pass out quick on ppp0 proto tcp all flags S keep state +block return-rst in quick proto tcp all diff --git a/ipf/regress/f18 b/ipf/regress/f18 new file mode 100644 index 000000000000..acba2b33a813 --- /dev/null +++ b/ipf/regress/f18 @@ -0,0 +1,4 @@ +pass in from 1.1.1.1 to any +pass out from 2.2.2.2 to any +count in from 1.1.1.1 to 3.3.3.3 +count out from 2.2.2.2 to 4.4.4.4 diff --git a/ipf/regress/f19 b/ipf/regress/f19 new file mode 100644 index 000000000000..d7770b8a43e8 --- /dev/null +++ b/ipf/regress/f19 @@ -0,0 +1,2 @@ +pass in quick proto tcp all flags S keep state +pass in quick proto tcp all flags S keep state(limit 1) diff --git a/ipf/regress/f2 b/ipf/regress/f2 new file mode 100644 index 000000000000..e2f02a46e283 --- /dev/null +++ b/ipf/regress/f2 @@ -0,0 +1,6 @@ +block in proto tcp from any to any +pass in proto tcp from any to any +block in proto udp from any to any +pass in proto udp from any to any +block in proto icmp from any to any +pass in proto icmp from any to any diff --git a/ipf/regress/f20 b/ipf/regress/f20 new file mode 100644 index 000000000000..279523e4a9f5 --- /dev/null +++ b/ipf/regress/f20 @@ -0,0 +1,4 @@ +block out quick on de0 head 100 +skip 1 out group 100 +block out quick group 100 +pass out quick group 100 diff --git a/ipf/regress/f21 b/ipf/regress/f21 new file mode 100644 index 000000000000..26ffa87f2386 --- /dev/null +++ b/ipf/regress/f21 @@ -0,0 +1,2 @@ +pass out proto tcp all flags S keep state(icmp-head icmpredir) +block in proto icmp all icmp-type redir group icmpredir diff --git a/ipf/regress/f22 b/ipf/regress/f22 new file mode 100644 index 000000000000..10765db18f06 --- /dev/null +++ b/ipf/regress/f22 @@ -0,0 +1,2 @@ +pass in proto tcp all flags S keep state(icmp-head icmpredir) +block out proto icmp all icmp-type redir group icmpredir diff --git a/ipf/regress/f24 b/ipf/regress/f24 new file mode 100644 index 000000000000..5cb3bab6b8a1 --- /dev/null +++ b/ipf/regress/f24 @@ -0,0 +1 @@ +pass out quick proto udp all keep state keep frags diff --git a/ipf/regress/f25 b/ipf/regress/f25 new file mode 100644 index 000000000000..c018b498dd3a --- /dev/null +++ b/ipf/regress/f25 @@ -0,0 +1 @@ +pass in on hme0 proto udp all with mcast keep state diff --git a/ipf/regress/f26 b/ipf/regress/f26 new file mode 100644 index 000000000000..22357a475cae --- /dev/null +++ b/ipf/regress/f26 @@ -0,0 +1,6 @@ +pass in quick proto tcp from 1.1.1.0/24 to any port = 22 flags S keep state(max-srcs 3) +pass in quick proto tcp from 1.1.1.0/24 to any port = 22 flags S keep state(max-srcs 3, max-per-src 1/32) +pass in quick proto tcp from 1.1.1.0/24 to any port = 22 flags S keep state(max-srcs 3, max-per-src 1/16) +pass in quick proto tcp all flags S keep state(max-srcs 3) +pass in quick proto tcp all flags S keep state(max-srcs 3, max-per-src 1/32) +pass in quick proto tcp all flags S keep state(max-srcs 3, max-per-src 1/16) diff --git a/ipf/regress/f27 b/ipf/regress/f27 new file mode 100644 index 000000000000..22357a475cae --- /dev/null +++ b/ipf/regress/f27 @@ -0,0 +1,6 @@ +pass in quick proto tcp from 1.1.1.0/24 to any port = 22 flags S keep state(max-srcs 3) +pass in quick proto tcp from 1.1.1.0/24 to any port = 22 flags S keep state(max-srcs 3, max-per-src 1/32) +pass in quick proto tcp from 1.1.1.0/24 to any port = 22 flags S keep state(max-srcs 3, max-per-src 1/16) +pass in quick proto tcp all flags S keep state(max-srcs 3) +pass in quick proto tcp all flags S keep state(max-srcs 3, max-per-src 1/32) +pass in quick proto tcp all flags S keep state(max-srcs 3, max-per-src 1/16) diff --git a/ipf/regress/f28.ipf b/ipf/regress/f28.ipf new file mode 100644 index 000000000000..ca427715ac10 --- /dev/null +++ b/ipf/regress/f28.ipf @@ -0,0 +1,2 @@ +block in all +pass in on nic0 to dstlist/spread from 4.4.0.0/16 to any diff --git a/ipf/regress/f28.pool b/ipf/regress/f28.pool new file mode 100644 index 000000000000..499b60344662 --- /dev/null +++ b/ipf/regress/f28.pool @@ -0,0 +1,2 @@ +pool ipf/dstlist (name spread; policy round-robin;) + { nic0:1.1.0.2; nic1:1.1.1.2; nic2:1.1.2.2; nic3:1.1.3.2; }; diff --git a/ipf/regress/f29.ipf b/ipf/regress/f29.ipf new file mode 100644 index 000000000000..e4634cc1fa4d --- /dev/null +++ b/ipf/regress/f29.ipf @@ -0,0 +1,2 @@ +block in all +pass in on nic0 to dstlist/spread from 4.4.0.0/16 to any keep state diff --git a/ipf/regress/f29.pool b/ipf/regress/f29.pool new file mode 100644 index 000000000000..499b60344662 --- /dev/null +++ b/ipf/regress/f29.pool @@ -0,0 +1,2 @@ +pool ipf/dstlist (name spread; policy round-robin;) + { nic0:1.1.0.2; nic1:1.1.1.2; nic2:1.1.2.2; nic3:1.1.3.2; }; diff --git a/ipf/regress/f3 b/ipf/regress/f3 new file mode 100644 index 000000000000..ee80729cfc9b --- /dev/null +++ b/ipf/regress/f3 @@ -0,0 +1,8 @@ +block in from 1.1.1.1 to any +pass in from 1.1.1.1 to any +block in from 1.1.1.1/24 to any +pass in from 1.1.1.1/24 to any +block in from 1.1.1.1/16 to any +pass in from 1.1.1.1/16 to any +block in from 1.1.1.1/0 to any +pass in from 1.1.1.1/0 to any diff --git a/ipf/regress/f30 b/ipf/regress/f30 new file mode 100644 index 000000000000..84a8970eb860 --- /dev/null +++ b/ipf/regress/f30 @@ -0,0 +1,4 @@ +pass in on hme0 proto udp all with not ipopts keep state +pass in on hme0 proto udp all with ipopts keep state +pass in on hme0 proto tcp all flags S with opt rr keep state +pass in on hme0 proto tcp all flags S with opt sec-class secret keep state diff --git a/ipf/regress/f4 b/ipf/regress/f4 new file mode 100644 index 000000000000..bc8af2f0cae2 --- /dev/null +++ b/ipf/regress/f4 @@ -0,0 +1,8 @@ +block in from any to 1.1.1.1 +pass in from any to 1.1.1.1 +block in from any to 1.1.1.1/24 +pass in from any to 1.1.1.1/24 +block in from any to 1.1.1.1/16 +pass in from any to 1.1.1.1/16 +block in from any to 1.1.1.1/0 +pass in from any to 1.1.1.1/0 diff --git a/ipf/regress/f5 b/ipf/regress/f5 new file mode 100644 index 000000000000..998eabd4b10b --- /dev/null +++ b/ipf/regress/f5 @@ -0,0 +1,48 @@ +block in proto tcp from any port = 23 to any +block in proto udp from any port = 23 to any +block in proto tcp/udp from any port = 23 to any +pass in proto tcp from any port <= 1023 to any +pass in proto udp from any port <= 1023 to any +pass in proto tcp/udp from any port <= 1023 to any +block in proto tcp from any port >= 1024 to any +block in proto udp from any port >= 1024 to any +block in proto tcp/udp from any port >= 1024 to any +pass in proto tcp from any port >= 1024 to any +pass in proto udp from any port >= 1024 to any +pass in proto tcp/udp from any port >= 1024 to any +block in proto tcp from any port 0 >< 512 to any +block in proto udp from any port 0 >< 512 to any +block in proto tcp/udp from any port 0 >< 512 to any +pass in proto tcp from any port 0 >< 512 to any +pass in proto udp from any port 0 >< 512 to any +pass in proto tcp/udp from any port 0 >< 512 to any +block in proto tcp from any port 6000 <> 6009 to any +block in proto udp from any port 6000 <> 6009 to any +block in proto tcp/udp from any port 6000 <> 6009 to any +pass in proto tcp from any port 6000 <> 6009 to any +pass in proto udp from any port 6000 <> 6009 to any +pass in proto tcp/udp from any port 6000 <> 6009 to any +pass in proto tcp from any port = 23 to any +pass in proto udp from any port = 23 to any +pass in proto tcp/udp from any port = 23 to any +block in proto tcp from any port != 21 to any +block in proto udp from any port != 21 to any +block in proto tcp/udp from any port != 21 to any +pass in proto tcp from any port != 21 to any +pass in proto udp from any port != 21 to any +pass in proto tcp/udp from any port != 21 to any +block in proto tcp from any port < 1024 to any +block in proto udp from any port < 1024 to any +block in proto tcp/udp from any port < 1024 to any +pass in proto tcp from any port < 1024 to any +pass in proto udp from any port < 1024 to any +pass in proto tcp/udp from any port < 1024 to any +block in proto tcp from any port > 1023 to any +block in proto udp from any port > 1023 to any +block in proto tcp/udp from any port > 1023 to any +pass in proto tcp from any port > 1023 to any +pass in proto udp from any port > 1023 to any +pass in proto tcp/udp from any port > 1023 to any +block in proto tcp from any port <= 1023 to any +block in proto udp from any port <= 1023 to any +block in proto tcp/udp from any port <= 1023 to any diff --git a/ipf/regress/f6 b/ipf/regress/f6 new file mode 100644 index 000000000000..291f09adcdbc --- /dev/null +++ b/ipf/regress/f6 @@ -0,0 +1,48 @@ +block in proto tcp from any to any port = 23 +block in proto udp from any to any port = 23 +block in proto tcp/udp from any to any port = 23 +pass in proto tcp from any to any port <= 1023 +pass in proto udp from any to any port <= 1023 +pass in proto tcp/udp from any to any port <= 1023 +block in proto tcp from any to any port >= 1024 +block in proto udp from any to any port >= 1024 +block in proto tcp/udp from any to any port >= 1024 +pass in proto tcp from any to any port >= 1024 +pass in proto udp from any to any port >= 1024 +pass in proto tcp/udp from any to any port >= 1024 +block in proto tcp from any to any port 0 >< 512 +block in proto udp from any to any port 0 >< 512 +block in proto tcp/udp from any to any port 0 >< 512 +pass in proto tcp from any to any port 0 >< 512 +pass in proto udp from any to any port 0 >< 512 +pass in proto tcp/udp from any to any port 0 >< 512 +block in proto tcp from any to any port 6000 <> 6009 +block in proto udp from any to any port 6000 <> 6009 +block in proto tcp/udp from any to any port 6000 <> 6009 +pass in proto tcp from any to any port 6000 <> 6009 +pass in proto udp from any to any port 6000 <> 6009 +pass in proto tcp/udp from any to any port 6000 <> 6009 +pass in proto tcp from any to any port = 23 +pass in proto udp from any to any port = 23 +pass in proto tcp/udp from any to any port = 23 +block in proto tcp from any to any port != 21 +block in proto udp from any to any port != 21 +block in proto tcp/udp from any to any port != 21 +pass in proto tcp from any to any port != 21 +pass in proto udp from any to any port != 21 +pass in proto tcp/udp from any to any port != 21 +block in proto tcp from any to any port < 1024 +block in proto udp from any to any port < 1024 +block in proto tcp/udp from any to any port < 1024 +pass in proto tcp from any to any port < 1024 +pass in proto udp from any to any port < 1024 +pass in proto tcp/udp from any to any port < 1024 +block in proto tcp from any to any port > 1023 +block in proto udp from any to any port > 1023 +block in proto tcp/udp from any to any port > 1023 +pass in proto tcp from any to any port > 1023 +pass in proto udp from any to any port > 1023 +pass in proto tcp/udp from any to any port > 1023 +block in proto tcp from any to any port <= 1023 +block in proto udp from any to any port <= 1023 +block in proto tcp/udp from any to any port <= 1023 diff --git a/ipf/regress/f7 b/ipf/regress/f7 new file mode 100644 index 000000000000..be1b969c8ec2 --- /dev/null +++ b/ipf/regress/f7 @@ -0,0 +1,9 @@ +block in proto icmp from any to any icmp-type echo +pass in proto icmp from any to any icmp-type echo +block in proto icmp from any to any icmp-type unreach code 3 +pass in proto icmp from any to any icmp-type unreach code 3 +block in proto icmp from any to any icmp-type echorep +pass in proto icmp from any to any icmp-type echorep +pass in proto icmp all icmp-type maskreq keep state +pass in proto icmp all icmp-type timest keep state +pass in proto icmp all icmp-type inforeq keep state diff --git a/ipf/regress/f8 b/ipf/regress/f8 new file mode 100644 index 000000000000..0f28fd261148 --- /dev/null +++ b/ipf/regress/f8 @@ -0,0 +1,6 @@ +block in proto tcp from any to any flags S +pass in proto tcp from any to any flags S +block in proto tcp from any to any flags S/SA +pass in proto tcp from any to any flags S/SA +block in proto tcp from any to any flags S/APU +pass in proto tcp from any to any flags S/APU diff --git a/ipf/regress/f9 b/ipf/regress/f9 new file mode 100644 index 000000000000..17bc96737877 --- /dev/null +++ b/ipf/regress/f9 @@ -0,0 +1,18 @@ +block in from any to any with ipopts +pass in from any to any with opt sec-class topsecret +block in from any to any with opt ssrr,sec-class topsecret +pass in from any to any with opt ssrr,sec-class topsecret +block in from any to any with opt ts,sec-class topsecret +pass in from any to any with opt ts,sec-class topsecret +block in from any to any with opt sec-class secret +pass in from any to any with opt sec-class secret +block in from any to any with opt lsrr,ssrr +pass in from any to any with opt lsrr,ssrr +pass in from any to any with ipopts +block in from any to any with opt lsrr +pass in from any to any with opt lsrr +block in from any to any with opt ssrr,ts +pass in from any to any with opt ssrr,ts +block in from any to any with opt rr +pass in from any to any with opt rr +block in from any to any with opt sec-class topsecret diff --git a/ipf/regress/i1 b/ipf/regress/i1 new file mode 100644 index 000000000000..0fd2c6e0c39a --- /dev/null +++ b/ipf/regress/i1 @@ -0,0 +1,18 @@ +pass in all +block out \ +all +log in all +log body in all +count in from any to any +pass in from !any to any pps 10 +block in from any to !any +pass in on ed0 from localhost to localhost +pass in on ed0,vx0 from localhost to localhost +block in log first on lo0 from any to any +pass in log body or-block quick from any to any +block return-rst in quick on le0 proto tcp from any to any +block return-icmp in on qe0 from any to any +block return-icmp(1) in on qe0 from any to any +block return-icmp-as-dest in on le0 from any to any +block return-icmp-as-dest(port-unr) in on qe0 from any to any +pass out on longNICname0 from test.host.dots to test\.host.dots diff --git a/ipf/regress/i10 b/ipf/regress/i10 new file mode 100644 index 000000000000..640ac84ad2af --- /dev/null +++ b/ipf/regress/i10 @@ -0,0 +1,5 @@ +pass in from localhost to localhost with opt sec +pass in from localhost to localhost with opt lsrr not opt sec +block in from any to any with not opt sec-class topsecret +block in from any to any with not opt sec-class topsecret,secret +pass in from any to any with opt sec-class topsecret,confid not opt sec-class unclass diff --git a/ipf/regress/i11 b/ipf/regress/i11 new file mode 100644 index 000000000000..ca65da313b0b --- /dev/null +++ b/ipf/regress/i11 @@ -0,0 +1,12 @@ +pass in on ed0 proto tcp from localhost to localhost port = telnet keep state +block in log first on lo0 proto tcp/udp from any to any port = echo keep state +pass in proto udp from localhost to localhost port = 20499 keep frag +pass in proto udp from localhost to localhost port = 2049 keep frag(strict) +pass in proto udp from localhost to localhost port = 53 keep state keep frags +pass in on ed0 out-via vx0 proto udp from any to any keep state +pass out on ppp0 in-via le0 proto tcp from any to any keep state +pass in on ed0,vx0 out-via vx0,ed0 proto udp from any to any keep state +pass in proto tcp from any port gt 1024 to localhost port eq 1024 keep state +pass in proto tcp all flags S keep state(strict,newisn,no-icmp-err,limit 101,age 600) +pass in proto tcp all flags S keep state(loose,newisn,no-icmp-err,limit 101,age 600) +pass in proto udp all keep state(age 10/20,sync) diff --git a/ipf/regress/i12 b/ipf/regress/i12 new file mode 100644 index 000000000000..f42c2d522b5d --- /dev/null +++ b/ipf/regress/i12 @@ -0,0 +1,10 @@ +pass in from 1.1.1.1/32 to 2.2.2.2/32 +pass in from {2.2.2.2/24,3.3.3.3/32} to 4.4.4.4/32 +pass in from {2.2.2.2/24,3.3.3.3/32} to {5.5.5.5/32,6.6.6.6/32} +pass in from {2.2.2.2/24,3.3.3.3/32} to {5.5.5.5/32,6.6.6.6/32} port = {22,25} +pass in proto tcp from {2.2.2.2/24,3.3.3.3/32} port = {53,9} to {5.5.5.5/32,6.6.6.6/32} +pass in proto udp from {2.2.2.2/24,3.3.3.3/32} to {5.5.5.5/32,6.6.6.6/32} port = {53,9} +pass in from 10.10.10.10 to 11.11.11.11 +pass in from pool/101 to hash/202 +pass in from hash/303 to pool/404 +pass in from pool=(!1.1.1.1,2.2.2.2,!2.2.0.0/16) to pool = ( 1.1.0.0/16 ) diff --git a/ipf/regress/i13 b/ipf/regress/i13 new file mode 100644 index 000000000000..3ba343d1669b --- /dev/null +++ b/ipf/regress/i13 @@ -0,0 +1,8 @@ +a=any; +b="from $a"; +c='to $a'; +d=block; +e="pass in"; +$d in $b $c +f=" $b $c"; +$e${f} diff --git a/ipf/regress/i14 b/ipf/regress/i14 new file mode 100644 index 000000000000..6788af676089 --- /dev/null +++ b/ipf/regress/i14 @@ -0,0 +1,15 @@ +block in on eri0 all head 1 +pass in on eri0 proto icmp all group 1 +pass out on ed0 all head 1000000 +block out on ed0 proto udp all group 1000000 +block in on vm0 proto tcp/udp all head 101 +pass in from 1.1.1.1 to 2.2.2.2 group 101 +pass in proto tcp from 1.0.0.1 to 2.0.0.2 group 101 +pass in proto udp from 2.0.0.2 to 3.0.0.3 group 101 +block in on vm0 proto tcp/udp all head vm0-group +pass in from 1.1.1.1 to 2.2.2.2 group vm0-group +block in on vm0 proto tcp/udp all head vm0-group +pass in from 1.1.1.1 to 2.2.2.2 group vm0-group +pass in from 8f:: to f8:: +block in inet6 proto udp +block in inet6 diff --git a/ipf/regress/i15 b/ipf/regress/i15 new file mode 100644 index 000000000000..0e6b0d12cd59 --- /dev/null +++ b/ipf/regress/i15 @@ -0,0 +1,4 @@ +pass out on fxp0 all set-tag(log=100) +pass out on fxp0 all set-tag(nat=foo) +pass out on fxp0 all set-tag(log=100, nat=200) +pass out on fxp0 all set-tag(log=2147483648, nat=overtherainbowisapotof) diff --git a/ipf/regress/i16 b/ipf/regress/i16 new file mode 100644 index 000000000000..5c9144a99257 --- /dev/null +++ b/ipf/regress/i16 @@ -0,0 +1,3 @@ +0 block out all +100 pass in all +10101 pass out proto tcp all diff --git a/ipf/regress/i17 b/ipf/regress/i17 new file mode 100644 index 000000000000..139b86a8d84a --- /dev/null +++ b/ipf/regress/i17 @@ -0,0 +1,13 @@ +100 pass in all +200 pass in proto tcp all +110 pass in proto udp all +110 pass in from localhost to any +pass in all +pass in from localhost to any +@0 100 pass in from localhost to any +@1 pass in from any to localhost +@0 pass in from 1.1.1.1 to any +@1 110 pass in from 2.2.2.2 to any +@2 pass in from 3.3.3.3 to any +call srcgrpmap/100 out from 10.1.0.0/16 to any +call now dstgrpmap/200 in from 10.2.0.0/16 to any diff --git a/ipf/regress/i18 b/ipf/regress/i18 new file mode 100644 index 000000000000..b55b11a01fe8 --- /dev/null +++ b/ipf/regress/i18 @@ -0,0 +1,3 @@ +pass in tos {80,0x80} all +pass out tos {0x80,80} all +block in ttl {0,1,2,3,4,5,6} all diff --git a/ipf/regress/i19 b/ipf/regress/i19 new file mode 100644 index 000000000000..a09fd56c5104 --- /dev/null +++ b/ipf/regress/i19 @@ -0,0 +1,22 @@ +block in quick log level user.debug proto icmp all +block in quick log level mail.info proto icmp all +block in quick log level daemon.notice proto icmp all +block in quick log level auth.warn proto icmp all +block in quick log level syslog.err proto icmp all +block in quick log level lpr.crit proto icmp all +block in quick log level news.alert proto icmp all +block in quick log level uucp.emerg proto icmp all +block in quick log level cron.debug proto icmp all +block in quick log level ftp.info proto icmp all +block in quick log level authpriv.notice proto icmp all +block in quick log level logalert.warn proto icmp all +block in quick log level local0.err proto icmp all +block in quick log level local1.crit proto icmp all +block in quick log level local2.alert proto icmp all +block in quick log level local3.emerg proto icmp all +block in quick log level local4.debug proto icmp all +block in quick log level local5.info proto icmp all +block in quick log level local6.notice proto icmp all +block in quick log level local7.warn proto icmp all +block in quick log level kern.err proto icmp all +block in quick log level security.emerg proto icmp all diff --git a/ipf/regress/i2 b/ipf/regress/i2 new file mode 100644 index 000000000000..f69e28edb13d --- /dev/null +++ b/ipf/regress/i2 @@ -0,0 +1,9 @@ +log in proto tcp all +pass in proto 6 from any to any +pass in proto udp from localhost to localhost +block in proto ipv6 from any to any +block in proto 17 from any to any +block in proto 250 from any to any +pass in proto tcp/udp from any to any +block in proto tcp-udp from any to any +block in proto tcp-udp from any to any diff --git a/ipf/regress/i20 b/ipf/regress/i20 new file mode 100644 index 000000000000..99039eeaf04c --- /dev/null +++ b/ipf/regress/i20 @@ -0,0 +1,4 @@ +pass in on ppp0 from ppp0/peer to ppp0/32 +block in on hme0 from any to hme0/broadcast +pass in on bge0 from bge0/network to bge0/32 +block in on eri0 from any to eri0/netmasked diff --git a/ipf/regress/i21 b/ipf/regress/i21 new file mode 100644 index 000000000000..237f8fadb648 --- /dev/null +++ b/ipf/regress/i21 @@ -0,0 +1,7 @@ +pass in from port = 10101 +pass out from any to port != 22 +block in from port 20:21 +block out from any to port 10 <> 100 +pass out from any to port = {3,5,7,9} +block in from port = {20,25} +pass in from any port = {11:12, 21:22} to any port = {1:2, 4:5, 8:9} diff --git a/ipf/regress/i22 b/ipf/regress/i22 new file mode 100644 index 000000000000..1ac8d12ba35f --- /dev/null +++ b/ipf/regress/i22 @@ -0,0 +1,5 @@ +pass in exp { "ip.src != 1.1.1.0/24; tcp.dport = 80;" } +pass in exp { "ip.addr = 1.2.3.4,5.6.7.8;" } +block out exp { "ip.dst= 127.0.0.0/8;" } +block in exp { "udp.sport=53;udp.dport=53;" } +pass out exp { "tcp.sport=22; tcp.port=25;" } diff --git a/ipf/regress/i23 b/ipf/regress/i23 new file mode 100644 index 000000000000..792d6005489e --- /dev/null +++ b/ipf/regress/i23 @@ -0,0 +1 @@ +# diff --git a/ipf/regress/i3 b/ipf/regress/i3 new file mode 100644 index 000000000000..390fc3c60e42 --- /dev/null +++ b/ipf/regress/i3 @@ -0,0 +1,14 @@ +log in all +pass in from 128.16/16 to 129.10.10/24 +pass in from 128.0.0.1/24 to 1\ +28\ +.\ +0.0.1/16 +pass in from 128.0.0.1/0xffffff00 to 128.0.0.1/0xffff0000 +pass in from 128.0.0.1/255.255.255.0 to 128.0.0.1/255.255.0.0 +pass in from 128.0.0.1 mask 0xffffff00 to 128.0.0.1 mask 0xffff0000 +pass in from 128.0.0.1 mask 255.255.255.0 to 128.0.0.1 mask 255.255.0.0 +pass in from localhost to localhost +block in log from 0/0 to 0/0 +block in log level auth.info on hme0 all +log level local5.warn out all diff --git a/ipf/regress/i4 b/ipf/regress/i4 new file mode 100644 index 000000000000..8551f7644915 --- /dev/null +++ b/ipf/regress/i4 @@ -0,0 +1,9 @@ +log in proto tcp from any port > 0 to any +log in proto tcp from any to any port > 0 +pass in proto 6 from any port != 0 to any port 0 >< 65535 +pass in proto 17 from localhost port > 32000 to localhost port < 29000 +block in proto udp from any port != \ntp to any port < echo +block in proto tcp from any port = smtp to any port > 25 +pass in proto tcp/udp from any port 1 >< 3 to any port 1 <> 3 +pass in proto tcp/udp from any port 2:2 to any port 10:20 +pass in log first quick proto tcp from any port > 1023 to any port = 1723 flags S keep state diff --git a/ipf/regress/i5 b/ipf/regress/i5 new file mode 100644 index 000000000000..788f971ae18f --- /dev/null +++ b/ipf/regress/i5 @@ -0,0 +1,9 @@ +log in all +count in tos 0x80 from any to any +pass in on ed0 tos 64 from localhost to localhost +block in log on lo0 ttl 0 from any to any +pass in quick ttl 1 from any to any +skip 3 out from 127.0.0.1 to any +auth out on foo0 proto tcp from any to any port = 80 +preauth out on foo0 proto tcp from any to any port = 22 +nomatch out on foo0 proto tcp from any port < 1024 to any diff --git a/ipf/regress/i6 b/ipf/regress/i6 new file mode 100644 index 000000000000..0b371bd3e761 --- /dev/null +++ b/ipf/regress/i6 @@ -0,0 +1,12 @@ +pass in on lo0 fastroute from any to any +pass in on lo0 to qe0 from localhost to localhost +pass in on le0 to qe0:127.0.0.1 from localhost to localhost +pass in on lo0 dup-to qe0 from localhost to localhost +pass in on le0 dup-to qe0:127.0.0.1 from localhost to localhost +pass in on le0 to hme0:10.1.1.1 dup-to qe0:127.0.0.1 from localhost to localhost +block in quick on qe0 to qe1 from any to any +block in quick to qe1 from any to any +pass out quick dup-to hme0 from any to any +pass out quick on hme0 reply-to hme1 from any to any +pass in on le0 dup-to qe0:127.0.0.1 reply-to hme1:10.10.10.10 all +pass in quick fastroute all diff --git a/ipf/regress/i7 b/ipf/regress/i7 new file mode 100644 index 000000000000..15b88a56dc51 --- /dev/null +++ b/ipf/regress/i7 @@ -0,0 +1,14 @@ +pass in on ed0 proto tcp from localhost to localhost port = 23 flags S/SA +block in on lo0 proto tcp from any to any flags A +pass in on lo0 proto tcp from any to any flags /SAP +block in on lo0 proto tcp from any to any flags 0x80/A +pass in on lo0 proto tcp from any to any flags S/18 +block in on lo0 proto tcp from any to any flags 2/18 +pass in on lo0 proto tcp from any to any flags 2 +block in on lo0 proto tcp from any to any flags /16 +pass in on lo0 proto tcp from any to any flags 2/SA +pass in on lo0 proto tcp from any to any flags S/18 +block in on lo0 proto tcp from any to any flags 2/18 +pass in on lo0 proto tcp from any to any flags 2 +block in on lo0 proto tcp from any to any flags /16 +pass in on lo0 proto tcp from any to any flags 2/SA diff --git a/ipf/regress/i8 b/ipf/regress/i8 new file mode 100644 index 000000000000..abf69d9d30bd --- /dev/null +++ b/ipf/regress/i8 @@ -0,0 +1,62 @@ +pass in proto icmp from localhost to localhost icmp-type timest +block in proto icmp from any to any icmp-type unreach code 1 +pass in proto icmp all icmp-type unreach code cutoff-preced +pass in proto icmp all icmp-type unreach code filter-prohib +pass in proto icmp all icmp-type unreach code isolate +pass in proto icmp all icmp-type unreach code needfrag +pass in proto icmp all icmp-type unreach code net-prohib +pass in proto icmp all icmp-type unreach code net-tos +pass in proto icmp all icmp-type unreach code host-preced +pass in proto icmp all icmp-type unreach code host-prohib +pass in proto icmp all icmp-type unreach code host-tos +pass in proto icmp all icmp-type unreach code host-unk +pass in proto icmp all icmp-type unreach code host-unr +pass in proto icmp all icmp-type unreach code {net-unk,net-unr} +pass in proto icmp all icmp-type unreach code port-unr +pass in proto icmp all icmp-type unreach code proto-unr +pass in proto icmp all icmp-type unreach code srcfail +pass in proto icmp all icmp-type {echo,echorep} +pass in proto icmp all icmp-type inforeq +pass in proto icmp all icmp-type inforep +pass in proto icmp all icmp-type maskrep +pass in proto icmp all icmp-type maskreq +pass in proto icmp all icmp-type paramprob +pass in proto icmp all icmp-type redir +pass in proto icmp all icmp-type unreach +pass in proto icmp all icmp-type routerad +pass in proto icmp all icmp-type routersol +pass in proto icmp all icmp-type squench +pass in proto icmp all icmp-type timest +pass in proto icmp all icmp-type timestrep +pass in proto icmp all icmp-type timex +pass in proto icmp all icmp-type 254 +pass in proto icmp all icmp-type 253 code 254 +pass in proto icmp all icmp-type unreach code cutoff-preced +pass in proto icmp all icmp-type unreach code filter-prohib +pass in proto icmp all icmp-type unreach code isolate +pass in proto icmp all icmp-type unreach code needfrag +pass in proto icmp all icmp-type unreach code net-prohib +pass in proto icmp all icmp-type unreach code net-tos +pass in proto icmp all icmp-type unreach code host-preced +pass in proto icmp all icmp-type unreach code host-prohib +pass in proto icmp all icmp-type unreach code host-tos +pass in proto icmp all icmp-type unreach code host-unk +pass in proto icmp all icmp-type unreach code host-unr +pass in proto icmp all icmp-type unreach code {net-unk,net-unr} +pass in proto icmp all icmp-type unreach code port-unr +pass in proto icmp all icmp-type unreach code proto-unr +pass in proto icmp all icmp-type unreach code srcfail +pass in proto icmp all icmp-type {echo,echorep} +pass in proto icmp all icmp-type inforeq +pass in proto icmp all icmp-type inforep +pass in proto icmp all icmp-type maskrep +pass in proto icmp all icmp-type maskreq +pass in proto icmp all icmp-type paramprob +pass in proto icmp all icmp-type redir +pass in proto icmp all icmp-type unreach +pass in proto icmp all icmp-type routerad +pass in proto icmp all icmp-type routersol +pass in proto icmp all icmp-type squench +pass in proto icmp all icmp-type timest +pass in proto icmp all icmp-type timestrep +pass in proto icmp all icmp-type timex diff --git a/ipf/regress/i9 b/ipf/regress/i9 new file mode 100644 index 000000000000..441cfa9a16b6 --- /dev/null +++ b/ipf/regress/i9 @@ -0,0 +1,17 @@ +pass in from localhost to localhost with short,frags +block in from any to any with ipopts +pass in from any to any with opt nop,rr,zsu +pass in from any to any with opt nop,rr,zsu not opt ssrr,lsrr +pass in from localhost to localhost and not frag +pass in from localhost to localhost with frags,frag-body +pass in proto tcp all flags S with not oow keep state +block in proto tcp all with oow +pass in proto tcp all flags S with not bad,bad-src,bad-nat +block in proto tcp all flags S with bad,not bad-src,not bad-nat +pass in quick all with not short +block in quick all with not nat +pass in quick all with not frag-body +block in quick all with not lowttl +pass in all with mbcast,not bcast,multicast,not state,not ipopts +block in all with not mbcast,bcast,not multicast,state +pass in from any to any with opt mtur,mtup,encode,ts,tr,sec,cipso,satid,ssrr,visa,imitd,eip,finn,dps,sdb,nsapa,rtralrt,ump,addext,e-sec diff --git a/ipf/regress/in1 b/ipf/regress/in1 new file mode 100644 index 000000000000..d5d0cf4c3d19 --- /dev/null +++ b/ipf/regress/in1 @@ -0,0 +1,31 @@ +map le0 0/0 -> 0/32 +map le0 1/32 -> 1/32 +map le0 128.0.0.0/1 -> 0/0 +map le0 10.0.0.0/8 -> 1.2.3.0/24 +map le0 10.0.0.5/8 -> 1.2.3.4/24 +map le0 10.0.0.5/0xff000000 -> 1.2.3.4/24 +map le0 10.0.0.5/0xff -> 1.2.3.4/24 +map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 +map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 +map ppp0 192.168.0.0/16 -> 0/32 portmap udp 20000:29999 +map ppp0 192.168.0.0/16 -> 0/32 portmap tcp/udp 30000:39999 +map ppp0 192.168.0.0/16 -> 0/32 portmap tcp auto +map ppp0 192.168.0.0/16 -> 0/32 portmap udp auto +map ppp0 192.168.0.0/16 -> 0/32 portmap tcpudp auto +map ppp0 192.168.0.0/16 -> 0/32 proxy port ftp ftp/6 +map ppp0 192.168.0.0/16 -> 0/32 proxy port 1010 ftp/tcp +map le0 0/0 -> 0/32 frag +map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag +map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 frag +map ppp0 192.168.0.0/16 -> 0/32 proxy port ftp ftp/tcp frag +map le0 0/0 -> 0/32 age 10 +map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 age 10/20 +map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 age 30 +map le0 0/0 -> 0/32 frag age 10 +map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 frag age 10/20 +map ppp0 192.168.0.0/16 -> 0/32 portmap tcp 10000:19999 frag age 30 +map fxp0 from 192.168.0.0/18 to 0/0 port = 21 -> 1.2.3.4/32 proxy port 21 ftp/tcp +map thisisalonginte 0/0 -> 0/32 mssclamp 1452 tag freddyliveshere +map bar0 0/0 -> 0/32 icmpidmap icmp 1000:2000 +map ppp0,adsl0 0/0 -> 0/32 +map ppp0 from 192.168.0.0/16 to any port = 123 -> 0/32 age 30/1 udp diff --git a/ipf/regress/in100 b/ipf/regress/in100 new file mode 100644 index 000000000000..5e2ab6c91730 --- /dev/null +++ b/ipf/regress/in100 @@ -0,0 +1,3 @@ +rewrite in on bge0 from 1.1.1.1 to 2.2.2.2 -> src 3.3.3.3 dst 4.4.4.4; +rewrite out on bge0 from 1.1.1.1/32 to 2.2.2.2 -> src 3.3.3.0/24 dst 4.4.4.4; +rewrite in on bge0 from 1.1.1.1/32 to 2.2.2.2/32 -> src 3.3.3.0/24 dst 4.4.4.0/24; diff --git a/ipf/regress/in100_6 b/ipf/regress/in100_6 new file mode 100644 index 000000000000..533e2dd63859 --- /dev/null +++ b/ipf/regress/in100_6 @@ -0,0 +1,3 @@ +rewrite in on bge0 inet6 from 1:1:1::1 to 2:2::2:2 -> src 3:3:3::3 dst 4::4:4:4; +rewrite out on bge0 inet6 from 1:1:1::1/128 to 2:2::2:2 -> src 3:3:3::0/96 dst 4::4:4:4; +rewrite in on bge0 inet6 from 1:1:1::1/128 to 2:2::2:2/128 -> src 3:3:3::0/96 dst 4::4:4:4/96; diff --git a/ipf/regress/in101 b/ipf/regress/in101 new file mode 100644 index 000000000000..afef53bc9ab4 --- /dev/null +++ b/ipf/regress/in101 @@ -0,0 +1,4 @@ +rewrite in on bge0 proto icmp from 1.1.1.1 to 2.2.2.2 -> src 3.3.3.3 dst 4.4.4.4; +rewrite in on bge0 proto udp from 1.1.1.1 to 2.2.2.2 -> src 3.3.3.3 dst 4.4.4.4; +rewrite out on bge0 proto tcp from 1.1.1.1/32 to 2.2.2.2 -> src 3.3.3.0/24 dst 4.4.4.4; +rewrite in on bge0 proto tcp/udp from 1.1.1.1/32 to 2.2.2.2/32 -> src 3.3.3.0/24,20202 dst 4.4.4.0/24,10101; diff --git a/ipf/regress/in101_6 b/ipf/regress/in101_6 new file mode 100644 index 000000000000..bb4af3d008c2 --- /dev/null +++ b/ipf/regress/in101_6 @@ -0,0 +1,4 @@ +rewrite in on bge0 proto icmp from 1:1:1::1 to 2:2::2:2 -> src 3:3:3::3 dst 4::4:4:4; +rewrite in on bge0 proto udp from 1:1:1::1 to 2:2::2:2 -> src 3:3:3::3 dst 4::4:4:4; +rewrite out on bge0 proto tcp from 1:1:1::1/128 to 2:2::2:2 -> src 3:3:3::0/24 dst 4::4:4:4; +rewrite in on bge0 proto tcp/udp from 1:1:1::1/128 to 2:2::2:2/32 -> src 3:3:3::0/24,20202 dst 4::4:4:4/24,10101; diff --git a/ipf/regress/in102 b/ipf/regress/in102 new file mode 100644 index 000000000000..57f364566f08 --- /dev/null +++ b/ipf/regress/in102 @@ -0,0 +1,5 @@ +rewrite in on bge0 proto tcp from any to any -> src 0/0 dst dstlist/a; +rewrite in on bge0 proto tcp from 1.1.1.1 to any -> src 0/0 dst dstlist/bee; +rewrite in on bge0 proto tcp from 1.1.1.1 to 2.2.2.2 -> src 0/0 dst dstlist/cat; +rewrite in on bge0 proto tcp from pool/a to 2.2.2.2 -> src 0/0 dst dstlist/bat; +rewrite in on bge0 proto tcp from pool/a to pool/1 -> src 0/0 dst dstlist/ant; diff --git a/ipf/regress/in102_6 b/ipf/regress/in102_6 new file mode 100644 index 000000000000..e11906db77cd --- /dev/null +++ b/ipf/regress/in102_6 @@ -0,0 +1,5 @@ +rewrite in on bge0 inet6 proto tcp from any to any -> src 0/0 dst dstlist/a; +rewrite in on bge0 inet6 proto tcp from 1:1:1::1 to any -> src 0/0 dst dstlist/bee; +rewrite in on bge0 inet6 proto tcp from 1:1:1::1 to 2:2::2:2 -> src 0/0 dst dstlist/cat; +rewrite in on bge0 inet6 proto tcp from pool/a to 2:2::2:2 -> src 0/0 dst dstlist/bat; +rewrite in on bge0 inet6 proto tcp from pool/a to pool/1 -> src 0/0 dst dstlist/ant; diff --git a/ipf/regress/in1_6 b/ipf/regress/in1_6 new file mode 100644 index 000000000000..e5050f867dc6 --- /dev/null +++ b/ipf/regress/in1_6 @@ -0,0 +1,29 @@ +map le0 inet6 0/0 -> 0/128 +map le0 inet6 1/128 -> 1/128 +map le0 inet6 128::/1 -> 0/0 +map le0 inet6 10::0/16 -> 1:2:3::0/96 +map le0 inet6 10::5/16 -> 1:2:3::4/96 +map le0 inet6 192:168::/32 -> range 203:1:1::23-203:1:3::45 +map ppp0 inet6 192:168::/32 -> 0/128 portmap tcp 10000:19999 +map ppp0 inet6 192:168::/32 -> 0/128 portmap udp 20000:29999 +map ppp0 inet6 192:168::/32 -> 0/128 portmap tcp/udp 30000:39999 +map ppp0 inet6 192:168::/32 -> 0/128 portmap tcp auto +map ppp0 inet6 192:168::/32 -> 0/128 portmap udp auto +map ppp0 inet6 192:168::/32 -> 0/128 portmap tcpudp auto +map ppp0 inet6 192:168::/32 -> 0/128 proxy port ftp ftp/6 +map ppp0 inet6 192:168::/32 -> 0/128 proxy port 1010 ftp/tcp +map le0 inet6 0/0 -> 0/128 frag +map le0 inet6 192:168::/32 -> range 203:1:1::23-203:1:3::45 frag +map ppp0 inet6 192:168::/32 -> 0/128 portmap tcp 10000:19999 frag +map ppp0 inet6 192:168::/32 -> 0/128 proxy port ftp ftp/tcp frag +map le0 inet6 0/0 -> 0/128 age 10 +map le0 inet6 192:168::/32 -> range 203:1:1::23-203:1:3::45 age 10/20 +map ppp0 inet6 192:168::/32 -> 0/128 portmap tcp 10000:19999 age 30 +map le0 inet6 0/0 -> 0/128 frag age 10 +map le0 inet6 192:168::/32 -> range 203:1:1::23-203:1:3::45 frag age 10/20 +map ppp0 inet6 192:168::/32 -> 0/128 portmap tcp 10000:19999 frag age 30 +map fxp0 inet6 from 192:168::/18 to 0/0 port = 21 -> 1:2:3::4/128 proxy port 21 ftp/tcp +map thisisalonginte inet6 0/0 -> 0/128 mssclamp 1452 tag freddyliveshere +map bar0 inet6 0/0 -> 0/128 icmpidmap ipv6-icmp 1000:2000 +map ppp0,adsl0 inet6 0/0 -> 0/128 +map ppp0 inet6 from 192:168::/32 to any port = 123 -> 0/128 age 30/1 udp diff --git a/ipf/regress/in2 b/ipf/regress/in2 new file mode 100644 index 000000000000..58556c048543 --- /dev/null +++ b/ipf/regress/in2 @@ -0,0 +1,71 @@ +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 tcp +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 255 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp +rdr le0 9.8.7.6/32 -> 1.1.1.1 ip +rdr le0 9.8.7.6/0xff000000 -> 1.1.1.1 ip +rdr le0 9.8.7.6/0xffff0000 -> 1.1.1.1 ip +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp +rdr le0 9.8.7.6/32 port 80 -> 0/0 port 80 tcp +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 udp +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp/udp +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcpudp frag +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag +rdr le0 9.8.7.6/32 -> 1.1.1.1 ip frag age 10 +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag age 10/20 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag age 10 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag age 20 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag age 30 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag age 40 +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip sticky +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag sticky +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag sticky +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag sticky +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag sticky +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag sticky +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag age 10 sticky +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag age 10/20 sticky +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag age 10 sticky +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag age 20 sticky +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag age 30 sticky +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag age 40 sticky +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip mssclamp 1000 +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag age 10 sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag age 10/20 sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag age 10 sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag age 20 sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag age 30 sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag age 40 sticky mssclamp 1000 +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip tag nattagcacheline +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag age 10 sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 0 -> 1.1.1.1 port 0 ip frag age 10/20 sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 icmp frag age 10 sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp frag age 20 sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1 port 80 tcp round-robin frag age 30 sticky mssclamp 1000 tag nattagcacheline +rdr le0 9.8.7.6/32 port 80 -> 1.1.1.1,1.1.1.2 port 80 tcp round-robin frag age 40 sticky mssclamp 1000 tag nattagcacheline +rdr ge0 9.8.7.6/32 -> 1.1.1.1 proxy port 21 ftp/tcp +rdr ge0 9.8.7.6/32 port 21 -> 1.1.1.1 port 21 tcp proxy ftp +rdr le0 9.8.7.6/32 port 1000-2000 -> 1.1.1.1 port 5555 tcp +rdr le0 9.8.7.6/32 port 1000-2000 -> 1.1.1.1 port = 5555 tcp +rdr le0 0/0 -> test.host.dots +rdr le0 any -> test.host.dots,test.host.dots +rdr adsl0,ppp0 9.8.7.6/32 port 1000-2000 -> 1.1.1.1 port 5555-7777 tcp diff --git a/ipf/regress/in2_6 b/ipf/regress/in2_6 new file mode 100644 index 000000000000..1ee1f067b0ca --- /dev/null +++ b/ipf/regress/in2_6 @@ -0,0 +1,71 @@ +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 tcp +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 255 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp +rdr le0 inet6 9:8:7::6/128 -> 1:1:1::1 ip +rdr le0 inet6 9:8:7::6/32 -> 1:1:1::1 ip +rdr le0 inet6 9:8:7::6/64 -> 1:1:1::1 ip +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp +rdr le0 inet6 9:8:7::6/128 port 80 -> 0/0 port 80 tcp +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 udp +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp/udp +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp frag +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcpudp frag +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin frag +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin frag +rdr le0 inet6 9:8:7::6/128 -> 1:1:1::1 ip frag age 10 +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag age 10/20 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp frag age 10 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp frag age 20 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin frag age 30 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin frag age 40 +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip sticky +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag sticky +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp frag sticky +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp frag sticky +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin frag sticky +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin frag sticky +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag age 10 sticky +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag age 10/20 sticky +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp frag age 10 sticky +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp frag age 20 sticky +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin frag age 30 sticky +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin frag age 40 sticky +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp frag sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp frag sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin frag sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin frag sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag age 10 sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag age 10/20 sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp frag age 10 sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp frag age 20 sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin frag age 30 sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin frag age 40 sticky mssclamp 1000 +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin frag sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag age 10 sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 0 -> 1:1:1::1 port 0 ip frag age 10/20 sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 icmp frag age 10 sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp frag age 20 sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1 port 80 tcp round-robin frag age 30 sticky mssclamp 1000 tag nattagcacheline +rdr le0 inet6 9:8:7::6/128 port 80 -> 1:1:1::1,1:1:1::2 port 80 tcp round-robin frag age 40 sticky mssclamp 1000 tag nattagcacheline +rdr ge0 9:8:7::6/128 -> 1:1:1::1 proxy port 21 ftp/tcp +rdr ge0 9:8:7::6/128 port 21 -> 1:1:1::1 port 21 tcp proxy ftp +rdr le0 inet6 9:8:7::6/128 port 1000-2000 -> 1:1:1::1 port 5555 tcp +rdr le0 inet6 9:8:7::6/128 port 1000-2000 -> 1:1:1::1 port = 5555 tcp +rdr le0 inet6 0/0 -> test.host.dots +rdr le0 inet6 any -> test.host.dots,test.host.dots +rdr adsl0,ppp0 9:8:7::6/128 port 1000-2000 -> 1:1:1::1 port 5555-7777 tcp diff --git a/ipf/regress/in3 b/ipf/regress/in3 new file mode 100644 index 000000000000..d8016b69e916 --- /dev/null +++ b/ipf/regress/in3 @@ -0,0 +1,5 @@ +bimap le0 0/0 -> 0/32 +bimap le0 1/32 -> 1/32 +bimap le0 128.0.0.0/1 -> 0/0 +bimap le0 10.0.0.0/8 -> 1.2.3.0/24 +bimap le0 10.0.5.6/24 -> 1.2.3.4/24 diff --git a/ipf/regress/in3_6 b/ipf/regress/in3_6 new file mode 100644 index 000000000000..a82ff09b24da --- /dev/null +++ b/ipf/regress/in3_6 @@ -0,0 +1,5 @@ +bimap le0 inet6 0/0 -> 0/128 +bimap le0 inet6 1/128 -> 1/128 +bimap le0 inet6 128::/1 -> 0/0 +bimap le0 inet6 10::/16 -> 1:2:3::0/96 +bimap le0 inet6 10:0:5::6/96 -> 1:2:3::4/96 diff --git a/ipf/regress/in4 b/ipf/regress/in4 new file mode 100644 index 000000000000..46bbd81012dc --- /dev/null +++ b/ipf/regress/in4 @@ -0,0 +1,5 @@ +map-block le0 10.0.0.0/24 -> 203.1.1.0/24 +map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports 0 +map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports 256 +map-block le0 10.0.0.0/24 -> 203.1.1.0/24 ports auto +map-block le0 10.0.0.0/16 -> 203.1.1.0/24 ports auto diff --git a/ipf/regress/in4_6 b/ipf/regress/in4_6 new file mode 100644 index 000000000000..b6b78c085590 --- /dev/null +++ b/ipf/regress/in4_6 @@ -0,0 +1,5 @@ +map-block le0 inet6 10::/96 -> 203:1:1::/96 +map-block le0 inet6 10::/96 -> 203:1:1::/96 ports 0 +map-block le0 inet6 10::/96 -> 203:1:1::/96 ports 256 +map-block le0 inet6 10::/96 -> 203:1:1::/96 ports auto +map-block le0 inet6 10::/16 -> 203:1:1::/96 ports auto diff --git a/ipf/regress/in5 b/ipf/regress/in5 new file mode 100644 index 000000000000..766c3e3df104 --- /dev/null +++ b/ipf/regress/in5 @@ -0,0 +1,24 @@ +map le0 from 9.8.7.6/32 port > 1024 to any -> 1.1.1.1 portmap 10000:20000 tcp +map le0 from 9.8.7.6/32 port > 1024 to ! 1.2.3.4 -> 1.1.1.1 portmap 10000:20000 tcp +rdr le0 from any to 9.8.7.6/32 port = 0 -> 1.1.1.1 port 0 tcp +rdr le0 from any to 9.8.7.6/0xffffffff port = 0 -> 1.1.1.1 port 0 ip +rdr le0 ! from 1.2.3.4 to 9.8.7.6 port = 8888 -> 1.1.1.1 port 888 tcp +rdr le0 from any to 9.8.7.6/255.255.255.255 port = 8888 -> 1.1.1.1 port 888 ip +rdr le0 from any to 9.8.7.6 mask 0xffffffff port = 8888 -> 1.1.1.1 port 888 tcp +rdr le0 from any to 9.8.7.6 mask 255.255.255.255 port = 8888 -> 1.1.1.1 port 888 udp +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp/udp +rdr le0 from any to 9.8.7.6/32 -> 1.1.1.1 port 888 icmp +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1,1.1.1.2 port 888 tcp +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp round-robin +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1,1.1.1.2 port 888 tcp round-robin +rdr le0 from any to 9.8.7.6/32 -> 1.1.1.1 port 0 ip frag +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 icmp frag +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1,1.1.1.2 port 888 tcp frag +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp round-robin frag +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1,1.1.1.2 port 888 tcp round-robin frag +rdr le0 from any to 9.8.7.6/32 -> 1.1.1.1 port 0 ip frag age 10 +rdr le0 from any to 9.8.7.6/32 port = 0 -> 1.1.1.1 port 0 ip frag age 10/20 +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 icmp frag age 10 +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1,1.1.1.2 port 888 tcp frag age 20 +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1 port 888 tcp round-robin frag age 30 +rdr le0 from any to 9.8.7.6/32 port = 8888 -> 1.1.1.1,1.1.1.2 port 888 tcp round-robin frag age 40 diff --git a/ipf/regress/in5_6 b/ipf/regress/in5_6 new file mode 100644 index 000000000000..f39d819acc91 --- /dev/null +++ b/ipf/regress/in5_6 @@ -0,0 +1,24 @@ +map le0 inet6 from 9:8:7::6/128 port > 1024 to any -> 1:1:1::1 portmap 10000:20000 tcp +map le0 inet6 from 9:8:7::6/128 port > 1024 to ! 1:2:3::4 -> 1:1:1::1 portmap 10000:20000 tcp +rdr le0 inet6 from any to 9:8:7::6/128 port = 0 -> 1:1:1::1 port 0 tcp +rdr le0 inet6 from any to 9:8:7::6/128 port = 0 -> 1:1:1::1 port 0 ip +rdr le0 inet6 ! from 1:2:3::4 to 9:8:7::6 port = 8888 -> 1:1:1::1 port 888 tcp +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 ip +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 tcp +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 udp +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 tcp/udp +rdr le0 inet6 from any to 9:8:7::6/128 -> 1:1:1::1 port 888 icmp +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1,1:1:1::2 port 888 tcp +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 tcp round-robin +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1,1:1:1::2 port 888 tcp round-robin +rdr le0 inet6 from any to 9:8:7::6/128 -> 1:1:1::1 port 0 ip frag +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 icmp frag +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1,1:1:1::2 port 888 tcp frag +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 tcp round-robin frag +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1,1:1:1::2 port 888 tcp round-robin frag +rdr le0 inet6 from any to 9:8:7::6/128 -> 1:1:1::1 port 0 ip frag age 10 +rdr le0 inet6 from any to 9:8:7::6/128 port = 0 -> 1:1:1::1 port 0 ip frag age 10/20 +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 icmp frag age 10 +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1,1:1:1::2 port 888 tcp frag age 20 +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1 port 888 tcp round-robin frag age 30 +rdr le0 inet6 from any to 9:8:7::6/128 port = 8888 -> 1:1:1::1,1:1:1::2 port 888 tcp round-robin frag age 40 diff --git a/ipf/regress/in6 b/ipf/regress/in6 new file mode 100644 index 000000000000..70e71ddeb16b --- /dev/null +++ b/ipf/regress/in6 @@ -0,0 +1,8 @@ +map foo0 from any port = 1 to any port != 0 -> 0/32 udp +map foo0 from any port eq 1 to any port ne 0 -> 0/32 udp +map foo0 from any port < 1 to any port > 0 -> 0/32 tcp +map foo0 from any port lt 1 to any port gt 0 -> 0/32 tcp +map foo0 from any port <= 1 to any port >= 0 -> 0/32 tcp/udp +map foo0 from any port le 1 to any port ge 0 -> 0/32 tcp/udp +map foo0 from any port 1 >< 20 to any port 20 <> 40 -> 0/32 tcp/udp +map foo0 from any port 10:20 to any port 30:40 -> 0/32 tcp/udp diff --git a/ipf/regress/in6_6 b/ipf/regress/in6_6 new file mode 100644 index 000000000000..556015d10287 --- /dev/null +++ b/ipf/regress/in6_6 @@ -0,0 +1,8 @@ +map foo0 inet6 from any port = 1 to any port != 0 -> 0/32 udp +map foo0 inet6 from any port eq 1 to any port ne 0 -> 0/32 udp +map foo0 inet6 from any port < 1 to any port > 0 -> 0/32 tcp +map foo0 inet6 from any port lt 1 to any port gt 0 -> 0/32 tcp +map foo0 inet6 from any port <= 1 to any port >= 0 -> 0/32 tcp/udp +map foo0 inet6 from any port le 1 to any port ge 0 -> 0/32 tcp/udp +map foo0 inet6 from any port 1 >< 20 to any port 20 <> 40 -> 0/32 tcp/udp +map foo0 inet6 from any port 10:20 to any port 30:40 -> 0/32 tcp/udp diff --git a/ipf/regress/in7 b/ipf/regress/in7 new file mode 100644 index 000000000000..792d6005489e --- /dev/null +++ b/ipf/regress/in7 @@ -0,0 +1 @@ +# diff --git a/ipf/regress/in8_6 b/ipf/regress/in8_6 new file mode 100644 index 000000000000..ab23b84476d2 --- /dev/null +++ b/ipf/regress/in8_6 @@ -0,0 +1,6 @@ +map zx0 inet6 10:1::1:1/128 -> 10:2:2::2/128 purge +map zx0 inet6 10:1::1:1/128 -> 10:2:2::2/128 tcp purge +map zx0 inet6 10:1::1:1/128 -> 10:2:2::2/128 mssclamp 1000 purge +map zx0 inet6 10:1::1:1/128 -> 10:2:2::2/128 portmap tcp/udp 10000:11000 purge +map zx0 inet6 10:1::1:1/128 -> 10:2:2::2/128 portmap tcp/udp 10000:11000 sequential purge +map zx0 inet6 10:1::1:1/128 -> 10:2:2::2/128 portmap tcp/udp 10000:11000 sequential purge diff --git a/ipf/regress/ip1 b/ipf/regress/ip1 new file mode 100644 index 000000000000..c31ba251bf2e --- /dev/null +++ b/ipf/regress/ip1 @@ -0,0 +1,78 @@ +#:%s/ \(number = [0-9]*\) \(type = [a-z]*\)/ \2 \1/g + +table role = ipf type = tree number = 1 + {; }; +table role = ipf type = tree number = 100 + { 1.2.3.4/32; !2.2.0.0/16; 2.2.2.0/24; }; +table role = nat type = tree number = 110 + { 1.2.3.4/32; !2.2.0.0/16; 2.2.2.0/24; }; +table role = auth type = tree number = 120 + { 1.2.3.4/32; !2.2.0.0/16; 2.2.2.0/24; }; +table role = count type = tree number = 130 + { 1.2.3.4; !2.2.0.0/16; 2.2.2.0/24; }; + +table role = ipf type = hash number = 2 + {; }; +table role = ipf type = hash number = 200 + { 0/0; 1/32; 1.2.3.4/32; }; +table role = nat type = hash number = 210 + { 0/0; 2/32; 1.2.3.4/32; }; +table role = auth type = hash number = 220 + { 0/0; 3/32; 1.2.3.4/32; }; +table role = count type = hash number = 230 + { 0/0; 4/32; 1.2.3.4/32; }; + +table role = ipf type = hash number = 240 seed = 101 + { 0/0; 1/32; 1.2.3.4/32; }; +table role = nat type = hash number = 250 seed = 101 + { 0/0; 2/32; 1.2.3.4/32; }; +table role = auth type = hash number = 260 seed = 101 + { 0/0; 3/32; 1.2.3.4/32; }; +table role = count type = hash number = 270 seed = 101 + { 0/0; 4/32; 1.2.3.4/32; }; + +table role = ipf type = hash number = 2000 size = 1001 + { 0/0; 1/32; 1.2.3.4/32; }; +table role = nat type = hash number = 2000 size = 1001 + { 0/0; 2/32; 1.2.3.4/32; }; +table role = auth type = hash number = 2000 size = 1001 + { 0/0; 3/32; 1.2.3.4/32; }; +table role = count type = hash number = 2000 size = 1001 + { 0/0; 4/32; 1.2.3.4/32; }; + +table role = ipf type = hash number = 100 size = 1001 seed = 101 + { 0/0; 1/32; 1.2.3.4/32; }; +table role = nat type = hash number = 100 size = 1001 seed = 101 + { 0/0; 2/32; 1.2.3.4/32; }; +table role = auth type = hash number = 100 size = 1001 seed = 101 + { 0/0; 3/32; 1.2.3.4/32; }; +table role = count type = hash number = 100 size = 1001 seed = 101 + { 0/0; 4/32; 1.2.3.4/32; }; + +group-map in role = ipf number = 300 group = 303 + { 0/0; 5/32; 1.2.3.4/32; }; +group-map in role = nat number = 300 group = 303 + { 0/0; 6/32; 1.2.3.4/32; }; +group-map in role = auth number = 300 group = 303 + { 0/0; 7/32; 1.2.3.4/32; }; +group-map in role = count number = 300 group = 303 + { 0/0; 8/32; 1.2.3.4/32; }; + +group-map out role = ipf number = 400 group = 303 + { 0/0; 5/32; 1.2.3.4/32, group = 606; }; +group-map out role = nat number = 400 group = 303 + { 0/0; 6/32; 1.2.3.4/32, group = 606; }; +group-map out role = auth number = 400 group = 303 + { 0/0; 7/32; 1.2.3.4/32, group = 606; }; +group-map out role = count number = 400 group = 303 + { 0/0; 8/32; 1.2.3.4/32, group = 606; }; + +group-map in role = ipf number = 500 + { 0/0, group = 10; 5/32, group = 800; 1.2.3.4/32, group = 606; }; +group-map in role = nat number = 500 + { 0/0, group = 10; 6/32, group = 800; 1.2.3.4/32, group = 606; }; +group-map in role = auth number = 500 + { 0/0, group = 10; 7/32, group = 800; 1.2.3.4/32, group = 606; }; +group-map in role = count number = 500 + { 0/0, group = 10; 8/32, group = 800; 1.2.3.4/32, group = 606; }; + diff --git a/ipf/regress/ip2 b/ipf/regress/ip2 new file mode 100644 index 000000000000..76f31b60f9d4 --- /dev/null +++ b/ipf/regress/ip2 @@ -0,0 +1,2 @@ +table role = ipf type = tree name = letters + { "file://input/ip2.data"; }; diff --git a/ipf/regress/ip3 b/ipf/regress/ip3 new file mode 100644 index 000000000000..98d2b0b94555 --- /dev/null +++ b/ipf/regress/ip3 @@ -0,0 +1,14 @@ +pool ipf/dstlist (name fred; policy round-robin;) + { 3.3.3.3; }; +pool ipf/dstlist (name jack; policy weighted connection;) + { 4.4.4.4; bge0:5.5.5.5;}; +pool ipf/dstlist (name jill; policy random;) + { 1.1.1.1; bge0:2.2.2.2;}; +pool nat/hash (name noproxy; size 17;) + { 1.1.1.1; 2.2.2.2;}; +pool nat/tree (name raw;) + { 1.1.1.1; 2.2.2.2;}; +pool all/dstlist (name jill; policy random;) + { 1.1.1.1; bge0:2.2.2.2;}; +pool all/hash (name noproxy; size 17;) + { 1.1.1.1; 2.2.2.2;}; diff --git a/ipf/regress/ipv6.1 b/ipf/regress/ipv6.1 new file mode 100644 index 000000000000..fc532b677c7f --- /dev/null +++ b/ipf/regress/ipv6.1 @@ -0,0 +1 @@ +pass out log quick on gif0 proto udp from ef00:1001:2002::/48 to any port 33433 >< 34000 keep state diff --git a/ipf/regress/ipv6.2 b/ipf/regress/ipv6.2 new file mode 100644 index 000000000000..814dfd6cd664 --- /dev/null +++ b/ipf/regress/ipv6.2 @@ -0,0 +1,3 @@ +block in all +block out all +pass out proto 58 all keep state diff --git a/ipf/regress/ipv6.3 b/ipf/regress/ipv6.3 new file mode 100644 index 000000000000..6dc9e937a995 --- /dev/null +++ b/ipf/regress/ipv6.3 @@ -0,0 +1 @@ +pass out log quick on gif0 proto ipv6-icmp from any to any icmp-type 128 keep state diff --git a/ipf/regress/ipv6.4 b/ipf/regress/ipv6.4 new file mode 100644 index 000000000000..b2217446d39e --- /dev/null +++ b/ipf/regress/ipv6.4 @@ -0,0 +1,3 @@ +pass in proto ipv6-icmp all icmp-type echo keep frags +pass in proto ipv6-icmp all icmp-type echo keep frags keep state +pass in proto tcp all keep frags keep state diff --git a/ipf/regress/ipv6.5 b/ipf/regress/ipv6.5 new file mode 100644 index 000000000000..d9ae23b2fbd7 --- /dev/null +++ b/ipf/regress/ipv6.5 @@ -0,0 +1,2 @@ +pass out family inet6 all with v6hdr routing +block out family inet6 proto tcp all with v6hdr routing diff --git a/ipf/regress/ipv6.6 b/ipf/regress/ipv6.6 new file mode 100644 index 000000000000..19a4df972334 --- /dev/null +++ b/ipf/regress/ipv6.6 @@ -0,0 +1,2 @@ +pass out on gif0 proto udp all keep frag +block out all with bad diff --git a/ipf/regress/l1 b/ipf/regress/l1 new file mode 100644 index 000000000000..88cca58039f9 --- /dev/null +++ b/ipf/regress/l1 @@ -0,0 +1,6 @@ +log in all +pass in on anon0 all head 100 +pass in log quick from 3.3.3.3 to any group 100 +pass in log body quick from 2.2.2.2 to any +pass in log quick proto tcp from 1.1.1.1 to any flags S keep state +pass in log first quick proto tcp from 1.1.1.1 to any flags S keep state diff --git a/ipf/regress/n1 b/ipf/regress/n1 new file mode 100644 index 000000000000..9bcf29be7ccf --- /dev/null +++ b/ipf/regress/n1 @@ -0,0 +1,3 @@ +map zx0 10.1.1.1/32 -> 10.2.2.2/32 +map zx0 10.1.1.0/24 -> 10.3.4.5/32 +map zx0 10.1.1.0/24 -> 10.3.4.0/24 diff --git a/ipf/regress/n10 b/ipf/regress/n10 new file mode 100644 index 000000000000..0f4819217f7a --- /dev/null +++ b/ipf/regress/n10 @@ -0,0 +1,3 @@ +map ppp0 0/0 -> 203.203.203.203/32 mssclamp 100 +map ppp0 0/0 -> 203.203.203.203/32 mssclamp 1000 +map ppp0 0/0 -> 203.203.203.203/32 mssclamp 10000 diff --git a/ipf/regress/n100 b/ipf/regress/n100 new file mode 100644 index 000000000000..a8b6deeb52e3 --- /dev/null +++ b/ipf/regress/n100 @@ -0,0 +1 @@ +rewrite out on zx0 from 0/0 to 2.2.0.0/16 -> src 4.4.4.4/32 dst 6.6.0.0/16; diff --git a/ipf/regress/n101 b/ipf/regress/n101 new file mode 100644 index 000000000000..2f5fcd98c9ce --- /dev/null +++ b/ipf/regress/n101 @@ -0,0 +1 @@ +rewrite out on zx0 proto tcp from 0/0 to 2.2.0.0/16 -> src 4.4.4.4/32 dst 6.6.0.0/16; diff --git a/ipf/regress/n102 b/ipf/regress/n102 new file mode 100644 index 000000000000..f056633dd23b --- /dev/null +++ b/ipf/regress/n102 @@ -0,0 +1 @@ +rewrite out on zx0 proto tcp from 0/0 to 2.2.0.0/16 -> src 4.4.4.4/32,1000:2000 dst 6.6.0.0/16; diff --git a/ipf/regress/n103 b/ipf/regress/n103 new file mode 100644 index 000000000000..c3c27d60dd8f --- /dev/null +++ b/ipf/regress/n103 @@ -0,0 +1 @@ +rewrite out on zx0 proto tcp from 0/0 to 2.2.0.0/16 -> src 4.4.4.4/32,1000-1001 dst 6.6.0.0/16,4000:4001; diff --git a/ipf/regress/n104 b/ipf/regress/n104 new file mode 100644 index 000000000000..785f0ada244b --- /dev/null +++ b/ipf/regress/n104 @@ -0,0 +1 @@ +rewrite out on zx0 proto tcp from 0/0 to 2.2.0.0/16 -> src 4.4.0.0/24,1000-1001 dst 6.6.0.0/16,4000:4001; diff --git a/ipf/regress/n105 b/ipf/regress/n105 new file mode 100644 index 000000000000..afe89660a728 --- /dev/null +++ b/ipf/regress/n105 @@ -0,0 +1 @@ +rewrite in on zx0 proto tcp from 0/0 to 2.2.0.0/16 port = 80 -> src 4.4.4.4/32,1000-1001 dst 6.6.0.0/16 port = 3128; diff --git a/ipf/regress/n106 b/ipf/regress/n106 new file mode 100644 index 000000000000..6074ab0b4cc4 --- /dev/null +++ b/ipf/regress/n106 @@ -0,0 +1 @@ +rewrite out on zx0 proto tcp from 0/0 to 2.2.0.0/16 port = 80 -> src 4.4.4.4/32,1000-1001 dst 6.6.0.0/16 port = 3128; diff --git a/ipf/regress/n10_6 b/ipf/regress/n10_6 new file mode 100644 index 000000000000..738152df62ab --- /dev/null +++ b/ipf/regress/n10_6 @@ -0,0 +1,3 @@ +map ppp0 any -> 203.203.203.203/128 mssclamp 100 +map ppp0 any -> 203.203.203.203/128 mssclamp 1000 +map ppp0 any -> 203.203.203.203/128 mssclamp 10000 diff --git a/ipf/regress/n11 b/ipf/regress/n11 new file mode 100644 index 000000000000..8cdf7fcf4627 --- /dev/null +++ b/ipf/regress/n11 @@ -0,0 +1,3 @@ +bimap zx0 10.1.1.1/32 -> 1.6.7.8/32 +bimap zx0 10.1.1.0/24 -> 10.2.2.2/32 +bimap zx0 10.1.1.0/24 -> 10.3.4.5/24 diff --git a/ipf/regress/n11_6 b/ipf/regress/n11_6 new file mode 100644 index 000000000000..7b428cc23925 --- /dev/null +++ b/ipf/regress/n11_6 @@ -0,0 +1,3 @@ +bimap zx0 10:1:1::1/128 -> 1::6:7:8/128 +bimap zx0 10:1:1::/112 -> 10::2:2:2/128 +bimap zx0 10:1:1::/112 -> 10::3:4:5/112 diff --git a/ipf/regress/n12 b/ipf/regress/n12 new file mode 100644 index 000000000000..933856bc710b --- /dev/null +++ b/ipf/regress/n12 @@ -0,0 +1 @@ +map le0 192.168.126.0/24 -> 0/32 portmap tcp/udp 10000:20000 sequential diff --git a/ipf/regress/n12_6 b/ipf/regress/n12_6 new file mode 100644 index 000000000000..bf218489d051 --- /dev/null +++ b/ipf/regress/n12_6 @@ -0,0 +1 @@ +map le0 c0a8:7e00::/112 -> 0/128 portmap tcp/udp 10000:20000 diff --git a/ipf/regress/n13 b/ipf/regress/n13 new file mode 100644 index 000000000000..804793004050 --- /dev/null +++ b/ipf/regress/n13 @@ -0,0 +1 @@ +map le0 192.168.0.0/16 -> range 203.1.1.23-203.1.3.45 diff --git a/ipf/regress/n13_6 b/ipf/regress/n13_6 new file mode 100644 index 000000000000..c1d1646d2ddb --- /dev/null +++ b/ipf/regress/n13_6 @@ -0,0 +1 @@ +map le0 192:168:1::0/48 -> range 203:0:1::1:23-203:0:1::3:45 diff --git a/ipf/regress/n14 b/ipf/regress/n14 new file mode 100644 index 000000000000..6f5d571d606e --- /dev/null +++ b/ipf/regress/n14 @@ -0,0 +1 @@ +rdr gre0 0/0 port 80 -> 10.1.1.254,10.1.1.253 port 80 tcp sticky diff --git a/ipf/regress/n14_6 b/ipf/regress/n14_6 new file mode 100644 index 000000000000..64e88ee4c7fe --- /dev/null +++ b/ipf/regress/n14_6 @@ -0,0 +1 @@ +rdr gre0 any port 80 -> 10:1:1::254,10:1:1::253 port 80 tcp sticky diff --git a/ipf/regress/n15 b/ipf/regress/n15 new file mode 100644 index 000000000000..062b766c9aba --- /dev/null +++ b/ipf/regress/n15 @@ -0,0 +1,2 @@ +rdr le0 0/0 port 80 -> 3.3.3.3 port 80 tcp +rdr le0 0/0 port 80 -> 3.3.3.3 port 80-88 tcp diff --git a/ipf/regress/n15_6 b/ipf/regress/n15_6 new file mode 100644 index 000000000000..e82dd8232760 --- /dev/null +++ b/ipf/regress/n15_6 @@ -0,0 +1,2 @@ +rdr le0 any port 80 -> 3:0:3::3:3 port 80 tcp +rdr le0 any port 80 -> 3:0:3::3:3 port 80-88 tcp diff --git a/ipf/regress/n16 b/ipf/regress/n16 new file mode 100644 index 000000000000..ff8958cad869 --- /dev/null +++ b/ipf/regress/n16 @@ -0,0 +1 @@ +rdr vlan0 from any to 69.248.79.193 port = 38136 -> 172.31.83.24 port 2013 udp diff --git a/ipf/regress/n16_6 b/ipf/regress/n16_6 new file mode 100644 index 000000000000..ff8958cad869 --- /dev/null +++ b/ipf/regress/n16_6 @@ -0,0 +1 @@ +rdr vlan0 from any to 69.248.79.193 port = 38136 -> 172.31.83.24 port 2013 udp diff --git a/ipf/regress/n17 b/ipf/regress/n17 new file mode 100644 index 000000000000..213f51f079b5 --- /dev/null +++ b/ipf/regress/n17 @@ -0,0 +1 @@ +bimap zx0 0/0 -> 1.1.1.3 diff --git a/ipf/regress/n18 b/ipf/regress/n18 new file mode 100644 index 000000000000..792f136b76c1 --- /dev/null +++ b/ipf/regress/n18 @@ -0,0 +1,3 @@ +map z0 0/0 -> 1.1.1.1/32 portmap tcp/udp 1:4 sequential +map z0 0/0 -> 1.1.1.1/32 portmap tcp/udp 1000:5000 sequential +map z0 0/0 -> 1.1.1.1/32 portmap tcp/udp 1000:50000 sequential diff --git a/ipf/regress/n1_6 b/ipf/regress/n1_6 new file mode 100644 index 000000000000..341f13651b98 --- /dev/null +++ b/ipf/regress/n1_6 @@ -0,0 +1,3 @@ +map zx0 10:1:1::1/128 -> 10::2:2:2/128 +map zx0 10:1:1::/112 -> 10::3:4:5/128 +map zx0 10:1:1::/112 -> 10::3:4:0/112 diff --git a/ipf/regress/n2 b/ipf/regress/n2 new file mode 100644 index 000000000000..39a4d724dedf --- /dev/null +++ b/ipf/regress/n2 @@ -0,0 +1,4 @@ +map zx0 10.1.1.1/32 -> 10.2.2.2/32 portmap tcp 10000:20000 sequential +map zx0 10.1.1.0/24 -> 10.3.4.5/32 portmap udp 10000:20000 sequential +map zx0 10.1.0.0/16 -> 10.3.4.0/24 portmap tcp/udp 10000:20000 sequential +map zx0 10.1.1.0/24 -> 10.3.4.5/32 portmap tcp/udp 40000:40001 sequential diff --git a/ipf/regress/n200 b/ipf/regress/n200 new file mode 100644 index 000000000000..c792e5406754 --- /dev/null +++ b/ipf/regress/n200 @@ -0,0 +1 @@ +divert in on bar0 from any to any -> src 127.0.0.1,10101 dst 127.0.0.1,10101 udp; diff --git a/ipf/regress/n2_6 b/ipf/regress/n2_6 new file mode 100644 index 000000000000..3a04f33ae740 --- /dev/null +++ b/ipf/regress/n2_6 @@ -0,0 +1,4 @@ +map zx0 10:1:1::1/128 -> 10::2:2:2/128 portmap tcp 10000:20000 sequential +map zx0 10:1:1::/112 -> 10::3:4:5/128 portmap udp 10000:20000 sequential +map zx0 10:1::/32 -> 10::3:4:0/112 portmap tcp/udp 10000:20000 sequential +map zx0 10:1:1::/112 -> 10::3:4:5/128 portmap tcp/udp 40000:40001 sequential diff --git a/ipf/regress/n3 b/ipf/regress/n3 new file mode 100644 index 000000000000..82c83dd6acc5 --- /dev/null +++ b/ipf/regress/n3 @@ -0,0 +1,2 @@ +map zz0 10.1.0.0/16 -> 192.168.2.0/24 portmap tcp/udp auto +map-block zz0 10.1.0.0/16 -> 192.168.1.0/24 ports 252 diff --git a/ipf/regress/n4 b/ipf/regress/n4 new file mode 100644 index 000000000000..e7c03145e677 --- /dev/null +++ b/ipf/regress/n4 @@ -0,0 +1,6 @@ +rdr zx0 10.1.1.1/32 port 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 10.1.1.0/24 port 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 0/0 port 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 10.1.1.0/24 port 53 -> 10.2.2.1 port 10053 udp +rdr zx0 10.1.1.0/24 port 0 -> 10.2.2.1 port 0 tcp +rdr zx0 10.1.1.0/24 port 0 -> 10.2.2.1 port 0 ip diff --git a/ipf/regress/n4_6 b/ipf/regress/n4_6 new file mode 100644 index 000000000000..72dad4c11217 --- /dev/null +++ b/ipf/regress/n4_6 @@ -0,0 +1,6 @@ +rdr zx0 10:1:1::1/128 port 23 -> 10::2:2:1 port 10023 tcp +rdr zx0 10:1:1::/112 port 23 -> 10::2:2:1 port 10023 tcp +rdr zx0 any port 23 -> 10::2:2:1 port 10023 tcp +rdr zx0 10:1:1::/112 port 53 -> 10::2:2:1 port 10053 udp +rdr zx0 10:1:1::/112 port 0 -> 10::2:2:1 port 0 tcp +rdr zx0 10:1:1::/112 port 0 -> 10::2:2:1 port 0 ip diff --git a/ipf/regress/n5 b/ipf/regress/n5 new file mode 100644 index 000000000000..d9f1a8885f8d --- /dev/null +++ b/ipf/regress/n5 @@ -0,0 +1,6 @@ +map zx0 10.1.1.1/32 -> 10.2.2.2/32 +map zx0 from 10.1.1.0/24 to 10.1.0.0/16 -> 10.3.4.5/32 +map zx0 from 10.1.1.0/24 ! to 10.1.0.0/16 -> 10.3.4.0/24 +map zx0 10.1.1.0/24 -> 10.3.4.5/32 portmap udp 10000:20000 sequential +map zx0 10.1.0.0/16 -> 10.3.4.0/24 portmap tcp/udp 10000:20000 sequential +map zx0 10.1.1.0/24 -> 10.3.4.5/32 portmap tcp/udp 40000:40001 sequential diff --git a/ipf/regress/n5_6 b/ipf/regress/n5_6 new file mode 100644 index 000000000000..acefd7b18a73 --- /dev/null +++ b/ipf/regress/n5_6 @@ -0,0 +1,6 @@ +map zx0 10:1:1::1/128 -> 10::2:2:2/128 +map zx0 from 10:1:1::/112 to 10:1::/32 -> 10::3:4:5/128 +map zx0 from 10:1:1::/112 ! to 10:1::/32 -> 10::3:4:0/112 +map zx0 10:1:1::/112 -> 10::3:4:5/128 portmap udp 10000:20000 sequential +map zx0 10:1::/32 -> 10::3:4:0/112 portmap tcp/udp 10000:20000 sequential +map zx0 10:1:1::/112 -> 10::3:4:5/128 portmap tcp/udp 40000:40001 sequential diff --git a/ipf/regress/n6 b/ipf/regress/n6 new file mode 100644 index 000000000000..79f11a40d88a --- /dev/null +++ b/ipf/regress/n6 @@ -0,0 +1,5 @@ +rdr zx0 10.1.1.1/32 port 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 from any to 10.1.1.0/24 port = 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 from 10.2.0.0/16 to 10.1.1.0/24 port = 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 from 10.3.0.0/16 to 10.1.0.0/16 port = 23 -> 10.2.2.1 port 10023 tcp +rdr zx0 ! from 10.2.0.0/16 to 10.1.1.0/24 port = 53 -> 10.2.2.1 port 10053 udp diff --git a/ipf/regress/n6_6 b/ipf/regress/n6_6 new file mode 100644 index 000000000000..3491c6b3e039 --- /dev/null +++ b/ipf/regress/n6_6 @@ -0,0 +1,5 @@ +rdr zx0 10:1:1::1/128 port 23 -> 10::2:2:1 port 10023 tcp +rdr zx0 from any to 10:1:1::/112 port = 23 -> 10::2:2:1 port 10023 tcp +rdr zx0 from 10::/32 to 10:1:1::/112 port = 23 -> 10::2:2:1 port 10023 tcp +rdr zx0 from 10:3::/32 to 10:1::/32 port = 23 -> 10::2:2:1 port 10023 tcp +rdr zx0 ! from 10::/32 to 10:1:1::/112 port = 53 -> 10::2:2:1 port 10053 udp diff --git a/ipf/regress/n7 b/ipf/regress/n7 new file mode 100644 index 000000000000..be995c2fe030 --- /dev/null +++ b/ipf/regress/n7 @@ -0,0 +1,3 @@ +rdr zx0 10.1.1.1/32 port 23-79 -> 10.2.2.1 port 10023 tcp +rdr zx0 10.1.1.1/32 port 23-79 -> 10.2.2.1 port = 10023 tcp +rdr zx0 10.1.1.0/24 port 80 -> 10.2.2.1,1.2.2.129 port 3128 tcp diff --git a/ipf/regress/n7_6 b/ipf/regress/n7_6 new file mode 100644 index 000000000000..88055f69ab30 --- /dev/null +++ b/ipf/regress/n7_6 @@ -0,0 +1,3 @@ +rdr zx0 10:1:1::1/128 port 23-79 -> 10::2:2:1 port 10023 tcp +rdr zx0 10:1:1::1/128 port 23-79 -> 10::2:2:1 port = 10023 tcp +rdr zx0 10:1:1::/112 port 80 -> 10::2:2:1,1::2:2:129 port 3128 tcp diff --git a/ipf/regress/n8 b/ipf/regress/n8 new file mode 100644 index 000000000000..bf0e94f73544 --- /dev/null +++ b/ipf/regress/n8 @@ -0,0 +1 @@ +map icmp0 2.2.2.0/24 -> 10.10.10.0/24 diff --git a/ipf/regress/n8_6 b/ipf/regress/n8_6 new file mode 100644 index 000000000000..2f96be05d003 --- /dev/null +++ b/ipf/regress/n8_6 @@ -0,0 +1 @@ +map icmp0 2::2:2:0/112 -> 10:10:10::/112 diff --git a/ipf/regress/n9 b/ipf/regress/n9 new file mode 100644 index 000000000000..81a7ccd8c815 --- /dev/null +++ b/ipf/regress/n9 @@ -0,0 +1 @@ +rdr icmp0 4.4.4.0/24 port 0 -> 10.10.10.1 port 0 ip diff --git a/ipf/regress/n9_6 b/ipf/regress/n9_6 new file mode 100644 index 000000000000..31e4615f1327 --- /dev/null +++ b/ipf/regress/n9_6 @@ -0,0 +1 @@ +rdr icmp0 4:4:4::/112 port 0 -> 10:10:10::1 port 0 ip diff --git a/ipf/regress/ni1.ipf b/ipf/regress/ni1.ipf new file mode 100644 index 000000000000..c7e5797185dc --- /dev/null +++ b/ipf/regress/ni1.ipf @@ -0,0 +1,4 @@ +block in all +block out all +pass out proto udp from any to any keep state +pass out proto tcp from any to any flags S keep state diff --git a/ipf/regress/ni1.nat b/ipf/regress/ni1.nat new file mode 100644 index 000000000000..077aab1a1f26 --- /dev/null +++ b/ipf/regress/ni1.nat @@ -0,0 +1,3 @@ +map df0 from 2.2.2.2/32 port 20000 >< 25000 to any -> 6.6.6.8/32 portmap udp 2000:2500 sequential +map df0 from 2.2.2.2/32 port 2000 >< 2500 to any -> 6.6.6.7/32 portmap udp 20000:25000 sequential +map df0 from 2.2.2.2/32 to any -> 6.6.6.6/32 diff --git a/ipf/regress/ni10.ipf b/ipf/regress/ni10.ipf new file mode 100644 index 000000000000..4151b6e666eb --- /dev/null +++ b/ipf/regress/ni10.ipf @@ -0,0 +1,4 @@ +block in all +block out all +pass in proto udp from any to any keep state +pass in proto tcp from any to any flags S keep state diff --git a/ipf/regress/ni10.nat b/ipf/regress/ni10.nat new file mode 100644 index 000000000000..2a04ef7948d0 --- /dev/null +++ b/ipf/regress/ni10.nat @@ -0,0 +1 @@ +rdr df0 2.2.2.2/32 -> 6.6.6.6 diff --git a/ipf/regress/ni11.ipf b/ipf/regress/ni11.ipf new file mode 100644 index 000000000000..4151b6e666eb --- /dev/null +++ b/ipf/regress/ni11.ipf @@ -0,0 +1,4 @@ +block in all +block out all +pass in proto udp from any to any keep state +pass in proto tcp from any to any flags S keep state diff --git a/ipf/regress/ni11.nat b/ipf/regress/ni11.nat new file mode 100644 index 000000000000..1d0018cb34fa --- /dev/null +++ b/ipf/regress/ni11.nat @@ -0,0 +1 @@ +rdr df0 10.0.0.0/8 port 1000:2000 -> 1.1.1.1 port 40000 tcp/udp diff --git a/ipf/regress/ni12.ipf b/ipf/regress/ni12.ipf new file mode 100644 index 000000000000..4151b6e666eb --- /dev/null +++ b/ipf/regress/ni12.ipf @@ -0,0 +1,4 @@ +block in all +block out all +pass in proto udp from any to any keep state +pass in proto tcp from any to any flags S keep state diff --git a/ipf/regress/ni12.nat b/ipf/regress/ni12.nat new file mode 100644 index 000000000000..8c36bc8701a5 --- /dev/null +++ b/ipf/regress/ni12.nat @@ -0,0 +1 @@ +rdr df0 10.0.0.0/8 port 1000:2000 -> 1.1.1.1 port = 40000 tcp/udp diff --git a/ipf/regress/ni13.ipf b/ipf/regress/ni13.ipf new file mode 100644 index 000000000000..04b6d137e504 --- /dev/null +++ b/ipf/regress/ni13.ipf @@ -0,0 +1,3 @@ +pass in quick on pcn1 proto tcp from any to any port = 1723 keep state +block in all +block out all diff --git a/ipf/regress/ni13.nat b/ipf/regress/ni13.nat new file mode 100644 index 000000000000..ac2be49d61f8 --- /dev/null +++ b/ipf/regress/ni13.nat @@ -0,0 +1 @@ +rdr pcn1 192.168.113.3/32 port 1723 -> 0.0.0.0 port 1723 tcp proxy pptp diff --git a/ipf/regress/ni14.ipf b/ipf/regress/ni14.ipf new file mode 100644 index 000000000000..04b6d137e504 --- /dev/null +++ b/ipf/regress/ni14.ipf @@ -0,0 +1,3 @@ +pass in quick on pcn1 proto tcp from any to any port = 1723 keep state +block in all +block out all diff --git a/ipf/regress/ni14.nat b/ipf/regress/ni14.nat new file mode 100644 index 000000000000..72a8a4a2759e --- /dev/null +++ b/ipf/regress/ni14.nat @@ -0,0 +1 @@ +rdr pcn1 192.168.113.3/32 port 1723 -> 127.0.0.1 port 1723 tcp proxy pptp diff --git a/ipf/regress/ni15.ipf b/ipf/regress/ni15.ipf new file mode 100644 index 000000000000..1b9a013f5299 --- /dev/null +++ b/ipf/regress/ni15.ipf @@ -0,0 +1,3 @@ +pass out quick on pcn1 proto tcp from any to any port = 1723 keep state +block in all +block out all diff --git a/ipf/regress/ni15.nat b/ipf/regress/ni15.nat new file mode 100644 index 000000000000..420c7b722673 --- /dev/null +++ b/ipf/regress/ni15.nat @@ -0,0 +1 @@ +map pcn1 0/0 -> 0/0 proxy port 1723 pptp/tcp diff --git a/ipf/regress/ni16.ipf b/ipf/regress/ni16.ipf new file mode 100644 index 000000000000..1b9a013f5299 --- /dev/null +++ b/ipf/regress/ni16.ipf @@ -0,0 +1,3 @@ +pass out quick on pcn1 proto tcp from any to any port = 1723 keep state +block in all +block out all diff --git a/ipf/regress/ni16.nat b/ipf/regress/ni16.nat new file mode 100644 index 000000000000..5fad3cdb20b0 --- /dev/null +++ b/ipf/regress/ni16.nat @@ -0,0 +1 @@ +map pcn1 10.2.2.2/32 -> 0/32 proxy port 1723 pptp/tcp diff --git a/ipf/regress/ni17.ipf b/ipf/regress/ni17.ipf new file mode 100644 index 000000000000..e69de29bb2d1 --- /dev/null +++ b/ipf/regress/ni17.ipf diff --git a/ipf/regress/ni17.nat b/ipf/regress/ni17.nat new file mode 100644 index 000000000000..3da63383a7b8 --- /dev/null +++ b/ipf/regress/ni17.nat @@ -0,0 +1,4 @@ +rdr le0 0/0 port 80 -> 10.1.1.252 port 3128 tcp round-robin +rdr le0 0/0 port 80 -> 10.1.2.252 port 3128 tcp round-robin +rdr le0 0/0 port 80 -> 10.1.3.252 port 3128 tcp round-robin sticky +rdr le0 0/0 port 80 -> 10.1.1.253,10.1.2.253 port 3128 tcp round-robin sticky diff --git a/ipf/regress/ni18.ipf b/ipf/regress/ni18.ipf new file mode 100644 index 000000000000..e69de29bb2d1 --- /dev/null +++ b/ipf/regress/ni18.ipf diff --git a/ipf/regress/ni18.nat b/ipf/regress/ni18.nat new file mode 100644 index 000000000000..40113c1c32c2 --- /dev/null +++ b/ipf/regress/ni18.nat @@ -0,0 +1,4 @@ +rdr hme0 192.168.1.0/24 port 80 -> 1.1.1.1 port 80 tcp; +no rdr hme0 192.168.1.1 port 80 tcp; +map hme1 10.1.0.0/16 -> 203.1.1.1/32 portmap tcp/udp 10000:20000 +no map hme1 10.1.1.0/24 tcp; diff --git a/ipf/regress/ni19.ipf b/ipf/regress/ni19.ipf new file mode 100644 index 000000000000..c6fcec1c32f3 --- /dev/null +++ b/ipf/regress/ni19.ipf @@ -0,0 +1,3 @@ +block in all +pass out quick on bge0 proto tcp from any to any port = shell flags S keep state +block out all diff --git a/ipf/regress/ni19.nat b/ipf/regress/ni19.nat new file mode 100644 index 000000000000..56b81a9e0cb9 --- /dev/null +++ b/ipf/regress/ni19.nat @@ -0,0 +1 @@ +map bge0 192.168.113.0/24 -> 10.1.1.1/32 proxy port shell rcmd/tcp diff --git a/ipf/regress/ni2.ipf b/ipf/regress/ni2.ipf new file mode 100644 index 000000000000..5956cf9f929c --- /dev/null +++ b/ipf/regress/ni2.ipf @@ -0,0 +1 @@ +pass out quick proto tcp from any to any flags S/SAFR keep state diff --git a/ipf/regress/ni2.nat b/ipf/regress/ni2.nat new file mode 100644 index 000000000000..43d2c83b0c9b --- /dev/null +++ b/ipf/regress/ni2.nat @@ -0,0 +1 @@ +map xl0 10.0.0.0/8 -> 1.1.1.1/32 portmap tcp/udp 40000:60000 sequential diff --git a/ipf/regress/ni20.ipf b/ipf/regress/ni20.ipf new file mode 100644 index 000000000000..c6f6d8444c41 --- /dev/null +++ b/ipf/regress/ni20.ipf @@ -0,0 +1,3 @@ +block in all +pass in quick on bge0 proto tcp from any to any port = shell flags S keep state +block out all diff --git a/ipf/regress/ni20.nat b/ipf/regress/ni20.nat new file mode 100644 index 000000000000..f2dd0a7e729d --- /dev/null +++ b/ipf/regress/ni20.nat @@ -0,0 +1 @@ +rdr bge0 10.1.1.4/32 port shell -> 192.168.113.4 port shell tcp proxy rcmd diff --git a/ipf/regress/ni21.ipf b/ipf/regress/ni21.ipf new file mode 100644 index 000000000000..6d6ed081787f --- /dev/null +++ b/ipf/regress/ni21.ipf @@ -0,0 +1 @@ +pass out on lan0 to eri0:1.1.1.1 from 2.2.2.2 to any diff --git a/ipf/regress/ni21.nat b/ipf/regress/ni21.nat new file mode 100644 index 000000000000..6b2d46a9fb99 --- /dev/null +++ b/ipf/regress/ni21.nat @@ -0,0 +1 @@ +map lan0,eri0 2.2.2.2 -> 4.4.4.4 diff --git a/ipf/regress/ni23.ipf b/ipf/regress/ni23.ipf new file mode 100644 index 000000000000..49ebcf708766 --- /dev/null +++ b/ipf/regress/ni23.ipf @@ -0,0 +1,3 @@ +block out all +block in all +pass in on le0,hme0 out-via ppp0,bge0 to ppp0:3.3.3.254 proto udp all keep state diff --git a/ipf/regress/ni23.nat b/ipf/regress/ni23.nat new file mode 100644 index 000000000000..094d377c00dc --- /dev/null +++ b/ipf/regress/ni23.nat @@ -0,0 +1,2 @@ +rdr le0,bge0 1.1.0.0/16 -> 2.2.2.2 +map hme0,ppp0 3.3.3.0/24 -> 4.4.4.4/32 diff --git a/ipf/regress/ni3.ipf b/ipf/regress/ni3.ipf new file mode 100644 index 000000000000..c7e5797185dc --- /dev/null +++ b/ipf/regress/ni3.ipf @@ -0,0 +1,4 @@ +block in all +block out all +pass out proto udp from any to any keep state +pass out proto tcp from any to any flags S keep state diff --git a/ipf/regress/ni3.nat b/ipf/regress/ni3.nat new file mode 100644 index 000000000000..4306f4b45d3d --- /dev/null +++ b/ipf/regress/ni3.nat @@ -0,0 +1 @@ +map df0 2.2.2.2/32 -> 6.6.6.6/32 diff --git a/ipf/regress/ni4.ipf b/ipf/regress/ni4.ipf new file mode 100644 index 000000000000..c7e5797185dc --- /dev/null +++ b/ipf/regress/ni4.ipf @@ -0,0 +1,4 @@ +block in all +block out all +pass out proto udp from any to any keep state +pass out proto tcp from any to any flags S keep state diff --git a/ipf/regress/ni4.nat b/ipf/regress/ni4.nat new file mode 100644 index 000000000000..e9d5cc1ce8d3 --- /dev/null +++ b/ipf/regress/ni4.nat @@ -0,0 +1 @@ +map df0 2.2.2.2/32 -> 6.6.6.6/32 portmap tcp/udp 40000:60000 sequential diff --git a/ipf/regress/ni5.ipf b/ipf/regress/ni5.ipf new file mode 100644 index 000000000000..8f11424f4c33 --- /dev/null +++ b/ipf/regress/ni5.ipf @@ -0,0 +1,3 @@ +block in all +pass out quick on ppp0 proto tcp from any to any port = ftp flags S keep state +block out all diff --git a/ipf/regress/ni5.nat b/ipf/regress/ni5.nat new file mode 100644 index 000000000000..8e80d2248f19 --- /dev/null +++ b/ipf/regress/ni5.nat @@ -0,0 +1 @@ +map ppp0 192.168.1.0/24 -> 1.1.1.1/32 proxy port ftp ftp/tcp diff --git a/ipf/regress/ni6.ipf b/ipf/regress/ni6.ipf new file mode 100644 index 000000000000..f5b83b29ff3a --- /dev/null +++ b/ipf/regress/ni6.ipf @@ -0,0 +1,9 @@ +block out log quick on qfe0 from 192.168.7.0/24 to any +block out log quick on nf0 from 192.168.6.0/24 to any +pass in quick on nf0 proto tcp from any to any port = 111 flags S keep state +pass in quick on nf0 proto udp from any to any port = 111 keep state +block return-rst in log quick on nf0 proto tcp from any to any +block in log quick on nf0 from 192.168.7.0/24 to any +block return-rst in log quick on qfe0 proto tcp from any to any +block in log quick on qfe0 from 192.168.6.0/24 to any + diff --git a/ipf/regress/ni6.nat b/ipf/regress/ni6.nat new file mode 100644 index 000000000000..00d57d07cb2c --- /dev/null +++ b/ipf/regress/ni6.nat @@ -0,0 +1,3 @@ +rdr nf0 192.168.6.2 port 111 -> 192.168.7.1 port 111 udp proxy rpcbu +rdr nf0 192.168.6.2 port 111 -> 192.168.7.1 port 111 tcp proxy rpcbt +map qfe0 192.168.6.0/24 -> 192.168.7.2/32 diff --git a/ipf/regress/ni7.ipf b/ipf/regress/ni7.ipf new file mode 100644 index 000000000000..4151b6e666eb --- /dev/null +++ b/ipf/regress/ni7.ipf @@ -0,0 +1,4 @@ +block in all +block out all +pass in proto udp from any to any keep state +pass in proto tcp from any to any flags S keep state diff --git a/ipf/regress/ni7.nat b/ipf/regress/ni7.nat new file mode 100644 index 000000000000..2a04ef7948d0 --- /dev/null +++ b/ipf/regress/ni7.nat @@ -0,0 +1 @@ +rdr df0 2.2.2.2/32 -> 6.6.6.6 diff --git a/ipf/regress/ni8.ipf b/ipf/regress/ni8.ipf new file mode 100644 index 000000000000..66662419934e --- /dev/null +++ b/ipf/regress/ni8.ipf @@ -0,0 +1 @@ +pass in quick proto tcp from any to any flags S/SAFR keep state diff --git a/ipf/regress/ni8.nat b/ipf/regress/ni8.nat new file mode 100644 index 000000000000..1d0018cb34fa --- /dev/null +++ b/ipf/regress/ni8.nat @@ -0,0 +1 @@ +rdr df0 10.0.0.0/8 port 1000:2000 -> 1.1.1.1 port 40000 tcp/udp diff --git a/ipf/regress/ni9.ipf b/ipf/regress/ni9.ipf new file mode 100644 index 000000000000..66662419934e --- /dev/null +++ b/ipf/regress/ni9.ipf @@ -0,0 +1 @@ +pass in quick proto tcp from any to any flags S/SAFR keep state diff --git a/ipf/regress/ni9.nat b/ipf/regress/ni9.nat new file mode 100644 index 000000000000..8c36bc8701a5 --- /dev/null +++ b/ipf/regress/ni9.nat @@ -0,0 +1 @@ +rdr df0 10.0.0.0/8 port 1000:2000 -> 1.1.1.1 port = 40000 tcp/udp diff --git a/ipf/regress/p1.ipf b/ipf/regress/p1.ipf new file mode 100644 index 000000000000..acaf639ac1fb --- /dev/null +++ b/ipf/regress/p1.ipf @@ -0,0 +1 @@ +pass in from pool/100 to any diff --git a/ipf/regress/p1.pool b/ipf/regress/p1.pool new file mode 100644 index 000000000000..aa262a7704ce --- /dev/null +++ b/ipf/regress/p1.pool @@ -0,0 +1,2 @@ +table role = ipf type = tree number = 100 + { 1.1.1.1/32; !2.2.0.0/16; 2.2.2.0/24; ef00::5/128; }; diff --git a/ipf/regress/p10.nat b/ipf/regress/p10.nat new file mode 100644 index 000000000000..3c3fa7c1874f --- /dev/null +++ b/ipf/regress/p10.nat @@ -0,0 +1 @@ +rewrite in on bge0 proto tcp from any to any port = 80 -> src 0/0 dst dstlist/servers; diff --git a/ipf/regress/p10.pool b/ipf/regress/p10.pool new file mode 100644 index 000000000000..2be554aadc82 --- /dev/null +++ b/ipf/regress/p10.pool @@ -0,0 +1,2 @@ +pool nat/dstlist (name servers; policy hash;) + { 1.1.1.2; 1.1.1.4; 1.1.1.5; 1.1.1.9; }; diff --git a/ipf/regress/p11.nat b/ipf/regress/p11.nat new file mode 100644 index 000000000000..3c3fa7c1874f --- /dev/null +++ b/ipf/regress/p11.nat @@ -0,0 +1 @@ +rewrite in on bge0 proto tcp from any to any port = 80 -> src 0/0 dst dstlist/servers; diff --git a/ipf/regress/p11.pool b/ipf/regress/p11.pool new file mode 100644 index 000000000000..a79d9ea58098 --- /dev/null +++ b/ipf/regress/p11.pool @@ -0,0 +1,2 @@ +pool nat/dstlist (name servers; policy dst-hash;) + { 1.1.1.2; 1.1.1.4; 1.1.1.5; 1.1.1.9; }; diff --git a/ipf/regress/p12.nat b/ipf/regress/p12.nat new file mode 100644 index 000000000000..3c3fa7c1874f --- /dev/null +++ b/ipf/regress/p12.nat @@ -0,0 +1 @@ +rewrite in on bge0 proto tcp from any to any port = 80 -> src 0/0 dst dstlist/servers; diff --git a/ipf/regress/p12.pool b/ipf/regress/p12.pool new file mode 100644 index 000000000000..c9afcda840cd --- /dev/null +++ b/ipf/regress/p12.pool @@ -0,0 +1,2 @@ +pool nat/dstlist (name servers; policy src-hash;) + { 1.1.1.2; 1.1.1.4; 1.1.1.5; 1.1.1.9; }; diff --git a/ipf/regress/p13.ipf b/ipf/regress/p13.ipf new file mode 100644 index 000000000000..acaf639ac1fb --- /dev/null +++ b/ipf/regress/p13.ipf @@ -0,0 +1 @@ +pass in from pool/100 to any diff --git a/ipf/regress/p13.pool b/ipf/regress/p13.pool new file mode 100644 index 000000000000..de80f72d5b8b --- /dev/null +++ b/ipf/regress/p13.pool @@ -0,0 +1,2 @@ +table role = all type = tree number = 100 + { 1.1.1.1/32; !2.2.0.0/16; 2.2.2.0/24; ef00::5/128; }; diff --git a/ipf/regress/p2.ipf b/ipf/regress/p2.ipf new file mode 100644 index 000000000000..4cfb388e82d6 --- /dev/null +++ b/ipf/regress/p2.ipf @@ -0,0 +1,2 @@ +pass out from hash=(127.0.0.1,4.4.0.0/16) to any +block in from hash=(127.0.0.1,4.4.0.0/16) to any diff --git a/ipf/regress/p3.ipf b/ipf/regress/p3.ipf new file mode 100644 index 000000000000..a598d88168c9 --- /dev/null +++ b/ipf/regress/p3.ipf @@ -0,0 +1,6 @@ +call now srcgrpmap/1010 in all +call now dstgrpmap/2010 out all +pass in all group 1020 +block in all group 1030 +pass out all group 2020 +block out all group 2040 diff --git a/ipf/regress/p3.pool b/ipf/regress/p3.pool new file mode 100644 index 000000000000..3fadd59d3e1c --- /dev/null +++ b/ipf/regress/p3.pool @@ -0,0 +1,4 @@ +group-map in role = ipf number = 1010 + { 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; }; +group-map out role = ipf number = 2010 group = 2020 + { 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; }; diff --git a/ipf/regress/p4.nat b/ipf/regress/p4.nat new file mode 100644 index 000000000000..d504ac90c467 --- /dev/null +++ b/ipf/regress/p4.nat @@ -0,0 +1 @@ +map * from pool/100 to any -> 1.2.3.4/32 diff --git a/ipf/regress/p4.pool b/ipf/regress/p4.pool new file mode 100644 index 000000000000..6ed0e499ac5a --- /dev/null +++ b/ipf/regress/p4.pool @@ -0,0 +1,2 @@ +table role = nat type = tree number = 100 + { 1.1.1.1/32; !2.2.0.0/16; 2.2.2.0/24; }; diff --git a/ipf/regress/p5.ipf b/ipf/regress/p5.ipf new file mode 100644 index 000000000000..ada9f56f0f72 --- /dev/null +++ b/ipf/regress/p5.ipf @@ -0,0 +1 @@ +pass in from pool/letters to any diff --git a/ipf/regress/p5.pool b/ipf/regress/p5.pool new file mode 100644 index 000000000000..9a8eaa3003d7 --- /dev/null +++ b/ipf/regress/p5.pool @@ -0,0 +1,2 @@ +table role = ipf type = tree name = letters + { 1.1.1.1/32; !2.2.0.0/16; 2.2.2.0/24; }; diff --git a/ipf/regress/p6.ipf b/ipf/regress/p6.ipf new file mode 100644 index 000000000000..b9b89374eede --- /dev/null +++ b/ipf/regress/p6.ipf @@ -0,0 +1 @@ +block in from pool/microsoft to any diff --git a/ipf/regress/p6.pool b/ipf/regress/p6.pool new file mode 100644 index 000000000000..83e818ced5b0 --- /dev/null +++ b/ipf/regress/p6.pool @@ -0,0 +1 @@ +pool ipf/tree (name microsoft;) { whois file "regress/p6.whois"; }; diff --git a/ipf/regress/p6.whois b/ipf/regress/p6.whois new file mode 100644 index 000000000000..284244e11b8f --- /dev/null +++ b/ipf/regress/p6.whois @@ -0,0 +1,241 @@ +# This query resulted in more than 256 records. Remaining results +# have been truncated. For more specific results, go to +# http://ws.arin.net/whois for help in refining your query. +Microsoft Corp (MSFT) +Microsoft Corp., MSN Operations (MCMO) +MICROSOFT CORPORATION (MICRO-101) +MICROSOFT CORPORATION (MICRO-97) +MICROSOFT CORPORATION (MICRO-100) +Microsoft Corporation (MICRO-111) +MICROSOFT CORPORATION (MICRO-117) +Microsoft Corporation (ZM23-ARIN) noc@microsoft.com +1-425-882-8080 +Microsoft (ZM39-ARIN) noc@microsoft.com +1-425-882-8080 +Microsoft Corp (AS8068) MICROSOFT-CORP---MSN-AS-BLOCK 8068 - 8075 +Microsoft Corp (AS13811) MSLI 13811 +Microsoft Corp (AS14719) MICROSOFT-CORP-BCENTRAL 14719 +Microsoft Corp (AS3598) MICROSOFT-CORP-AS 3598 +Microsoft Corp (AS5761) MICROSOFT-CORP---MSN-AS---SATURN 5761 +Microsoft Corp (AS6182) MICROSOFT-CORP--MSN-AS-4 6182 +Microsoft Corp (AS6194) MICROSOFT-CORP--MSN-AS-3 6194 +Microsoft Corp (AS6291) MICROSOFT-CORP---MSN-AS 6291 +Microsoft Corp (AS13399) MICROSOFT-CORP---MSN-AS-2 13399 +Microsoft Corp (AS23468) MICROSOFT-CORP-XBOX-ONLINE 23468 +Microsoft Corp MICROSOFT (NET-131-107-0-0-1) 131.107.0.0 - 131.107.255.255 +Microsoft Corp MICROSOFT-VEXCEL (NET-192-92-90-0-1) 192.92.90.0 - 192.92.90.255 +Microsoft Corp NETBLK-MSOFT-NET (NET-198-105-232-0-1) 198.105.232.0 - 198.105.235.255 +Microsoft Corp MICROSOFT19-NET58 (NET-204-231-58-0-1) 204.231.58.0 - 204.231.58.255 +Microsoft Corp MICROSOFT15 (NET-204-140-77-0-1) 204.140.77.0 - 204.140.77.255 +Microsoft Corp MICROSOFT16 (NET-204-140-80-0-1) 204.140.80.0 - 204.140.83.255 +Microsoft Corp MICROSOFT-CORP-MSN-1 (NET-199-60-28-0-1) 199.60.28.0 - 199.60.28.255 +Microsoft Corp MICROSOFT-1 (NET-199-103-90-0-1) 199.103.90.0 - 199.103.91.255 +Microsoft Corp MICROSOFT-CORP-MSN-3 (NET-199-103-122-0-1) 199.103.122.0 - 199.103.122.255 +Microsoft Corp MICROSOFT8 (NET-204-79-101-0-1) 204.79.101.0 - 204.79.101.255 +Microsoft Corp MICROSOFT18 (NET-192-237-67-0-1) 192.237.67.0 - 192.237.67.255 +Microsoft Corp MICROSOFT19 (NET-198-137-97-0-1) 198.137.97.0 - 198.137.97.255 +Microsoft Corp MICROSOFT-HK (NET-204-79-135-0-1) 204.79.135.0 - 204.79.135.255 +Microsoft Corp MICROSOFT-PLACEWARE-1 (NET-204-79-179-0-1) 204.79.179.0 - 204.79.179.255 +Microsoft Corp MICROSOFT11 (NET-204-79-180-0-1) 204.79.180.0 - 204.79.181.255 +Microsoft Corp MICROSOFT-PLACEWARE-2 (NET-204-79-188-0-1) 204.79.188.0 - 204.79.188.255 +Microsoft Corp MICROSOFT13 (NET-204-79-195-0-1) 204.79.195.0 - 204.79.197.255 +Microsoft Corp MICROSOFT17 (NET-199-6-92-0-1) 199.6.92.0 - 199.6.94.255 +Microsoft Corp MICROSOFT-2 (NET-204-79-7-0-1) 204.79.7.0 - 204.79.7.255 +Microsoft Corp MICROSOFT-NET1 (NET-204-79-27-0-1) 204.79.27.0 - 204.79.27.255 +Microsoft Corp MICROSOFT2 (NET-198-180-74-0-1) 198.180.74.0 - 198.180.75.255 +Microsoft Corp MICROSOFT3 (NET-198-180-95-0-1) 198.180.95.0 - 198.180.97.255 +Microsoft Corp MICROSOFT28 (NET-204-231-236-0-1) 204.231.236.0 - 204.231.236.255 +Microsoft Corp MICROSOFT29 (NET-205-248-10-0-1) 205.248.10.0 - 205.248.15.255 +Microsoft Corp SPRINT-CDA33F (NET-205-163-63-0-1) 205.163.63.0 - 205.163.63.255 +Microsoft Corp SPRINT-CDA33E (NET-205-163-62-0-1) 205.163.62.0 - 205.163.62.255 +Microsoft Corp SPRINT-CDA39F (NET-205-163-144-0-1) 205.163.144.0 - 205.163.159.255 +Microsoft Corp MICROSOFT30 (NET-205-248-41-0-1) 205.248.41.0 - 205.248.43.255 +Microsoft Corp MICROSOFT31 (NET-205-248-50-0-1) 205.248.50.0 - 205.248.51.255 +Microsoft Corp MICROSOFT32 (NET-205-248-61-0-1) 205.248.61.0 - 205.248.63.255 +Microsoft Corp MICROSOFT34 (NET-205-248-72-0-1) 205.248.72.0 - 205.248.72.255 +Microsoft Corp MICROSOFT35 (NET-205-248-212-0-1) 205.248.212.0 - 205.248.215.255 +Microsoft Corp MICROSOFT36 (NET-205-248-228-0-1) 205.248.228.0 - 205.248.228.255 +Microsoft Corp MICROSOFT37 (NET-205-248-235-0-1) 205.248.235.0 - 205.248.235.255 +Microsoft Corp MICROSOFT20 (NET-204-231-76-0-1) 204.231.76.0 - 204.231.76.255 +Microsoft Corp MICROSOFT26 (NET-204-231-192-0-1) 204.231.192.0 - 204.231.192.255 +Microsoft Corp MICROSOFT27 (NET-204-231-194-0-1) 204.231.194.0 - 204.231.223.255 +Microsoft Corp SOCRATIC (NET-207-78-80-0-1) 207.78.80.0 - 207.78.80.255 +Microsoft Corp DAVELADD (NET-207-78-81-0-1) 207.78.81.0 - 207.78.81.255 +Microsoft Corp RSEGAL (NET-207-78-82-0-1) 207.78.82.0 - 207.78.82.255 +Microsoft Corp MICROSOFT44 (NET-205-248-243-0-1) 205.248.243.0 - 205.248.244.255 +Microsoft Corp MICROSOFT48 (NET-207-117-3-0-1) 207.117.3.0 - 207.117.3.255 +Microsoft Corp UU-207-18-117 (NET-207-18-117-0-1) 207.18.117.0 - 207.18.117.255 +Microsoft Corp CW-208-139-27-B (NET-208-139-27-0-1) 208.139.27.0 - 208.139.27.255 +Microsoft Corp MICROSOFT55 (NET-209-28-213-0-1) 209.28.213.0 - 209.28.213.255 +Microsoft Corp MICROSOFT50 (NET-207-209-68-0-1) 207.209.68.0 - 207.209.68.255 +Microsoft Corp SPRINT-CC5F6F (NET-204-95-96-0-1) 204.95.96.0 - 204.95.111.255 +Microsoft Corp CYBR-LCCLAB (NET-207-158-93-192-1) 207.158.93.192 - 207.158.93.223 +Microsoft Corp MSBPN-2 (NET-207-240-123-192-1) 207.240.123.192 - 207.240.123.223 +Microsoft Corp SPRINT-D01ACD (NET-208-26-205-0-1) 208.26.205.0 - 208.26.205.255 +Microsoft Corp MICROSOFT-CORP-MSN-2 (NET-192-197-157-0-1) 192.197.157.0 - 192.197.157.255 +Microsoft Corp MICROSOFTDENVER (NET-204-133-231-0-1) 204.133.231.0 - 204.133.231.255 +Microsoft Corp MICROSOFTG1-COM (NET-216-72-96-0-1) 216.72.96.0 - 216.72.99.255 +Microsoft Corp EACT-CUST-JLEZNEK (NET-207-229-166-152-1) 207.229.166.152 - 207.229.166.159 +Microsoft Corp SPRINT-CC5F95-8 (NET-204-95-149-0-1) 204.95.149.0 - 204.95.149.255 +Microsoft Corp NET-CSAMSI (NET-209-192-213-72-1) 209.192.213.72 - 209.192.213.79 +Microsoft Corp MICROSOFT57 (NET-206-73-203-0-1) 206.73.203.0 - 206.73.203.255 +Microsoft Corp MICROSOFT56 (NET-206-73-118-0-1) 206.73.118.0 - 206.73.118.255 +Microsoft Corp QWEST-208-45-54-16 (NET-208-45-54-16-1) 208.45.54.16 - 208.45.54.23 +Microsoft Corp QWEST-208-45-54-8 (NET-208-45-54-8-1) 208.45.54.8 - 208.45.54.15 +Microsoft Corp MICROSOFT58 (NET-206-73-31-0-1) 206.73.31.0 - 206.73.31.255 +Microsoft Corp SPRINT-3FA132 (NET-63-161-50-128-1) 63.161.50.128 - 63.161.50.255 +Microsoft Corp SPRINT-3FA132-6 (NET-63-161-50-0-1) 63.161.50.0 - 63.161.50.127 +Microsoft Corp MICROSOFT-8-18 (NET-207-240-8-224-1) 207.240.8.224 - 207.240.8.239 +Microsoft Corp MICROSOFT-BBLK (NET-157-54-0-0-1) 157.54.0.0 - 157.60.255.255 +Microsoft Corp QWEST-208-45-89-248A (NET-208-45-89-248-1) 208.45.89.248 - 208.45.89.255 +Microsoft Corp MICROSOFT61 (NET-206-182-69-0-1) 206.182.69.0 - 206.182.69.255 +Microsoft Corp MICROSOFT63 (NET-206-182-240-0-1) 206.182.240.0 - 206.182.240.255 +Microsoft Corp MICROSOFT64 (NET-206-182-241-0-1) 206.182.241.0 - 206.182.241.255 +Microsoft Corp MICROSOFT59 (NET-206-73-67-0-1) 206.73.67.0 - 206.73.67.255 +Microsoft Corp MICROSOFT66 (NET-206-182-251-0-1) 206.182.251.0 - 206.182.251.255 +Microsoft Corp MICROSOFT65 (NET-206-182-247-0-1) 206.182.247.0 - 206.182.247.255 +Microsoft Corp MICROSOFT62 (NET-206-182-236-0-1) 206.182.236.0 - 206.182.236.255 +Microsoft Corp QWEST-63-236-198-64 (NET-63-236-198-64-1) 63.236.198.64 - 63.236.198.71 +Microsoft Corp QWEST-63-236-198-152 (NET-63-236-198-152-1) 63.236.198.152 - 63.236.198.159 +Microsoft Corp ERMS-6799349 (NET-165-121-253-232-1) 165.121.253.232 - 165.121.253.239 +Microsoft Corp QWEST-63-236-170-64 (NET-63-236-170-64-1) 63.236.170.64 - 63.236.170.71 +Microsoft Corp QWEST-63-236-186-64 (NET-63-236-186-64-1) 63.236.186.64 - 63.236.186.71 +Microsoft Corp QWEST-63-236-187-104 (NET-63-236-187-104-1) 63.236.187.104 - 63.236.187.111 +Microsoft Corp QWEST-63-236-187-128 (NET-63-236-187-128-1) 63.236.187.128 - 63.236.187.135 +Microsoft Corp QWEST-63-236-187-160 (NET-63-236-187-160-1) 63.236.187.160 - 63.236.187.167 +Microsoft Corp FON-3338832128690 (NET-199-2-137-0-1) 199.2.137.0 - 199.2.137.255 +Microsoft Corp CUST-86-24614 (NET-216-222-104-224-1) 216.222.104.224 - 216.222.104.239 +Microsoft Corp QWEST-63-151-87-64 (NET-63-151-87-64-1) 63.151.87.64 - 63.151.87.71 +Microsoft Corp HP-64-77-82-96 (NET-64-77-82-96-1) 64.77.82.96 - 64.77.82.103 +Microsoft Corp HP-64-77-93-80 (NET-64-77-93-80-1) 64.77.93.80 - 64.77.93.95 +Microsoft Corp MICROSOFT-1BLK (NET-65-52-0-0-1) 65.52.0.0 - 65.55.255.255 +Microsoft Corp MICROSOFT-GLOBAL-NET (NET-207-46-0-0-1) 207.46.0.0 - 207.46.255.255 +Microsoft Corp MICROSOFT-CORP-MSN-BLK (NET-207-68-128-0-1) 207.68.128.0 - 207.68.207.255 +Microsoft Corp FON-343451648081865 (NET-204-182-144-0-1) 204.182.144.0 - 204.182.159.255 +Microsoft Corp FON-346312755281299 (NET-206-107-34-0-1) 206.107.34.0 - 206.107.34.255 +Microsoft Corp FON-34550983681918 (NET-205-240-158-0-1) 205.240.158.0 - 205.240.159.255 +Microsoft Corp MICROSOFT-PLACEWARE-2 (NET-204-79-252-0-1) 204.79.252.0 - 204.79.252.255 +Microsoft Corp WLCO-TWC1057147-MICROSOFT (NET-64-200-211-16-1) 64.200.211.16 - 64.200.211.31 +Microsoft Corp MICROSOF81-163-0 (NET-12-178-163-0-1) 12.178.163.0 - 12.178.163.31 +Microsoft Corp WLCO-TWC1057147-MICROSOFT-1 (NET-69-44-126-80-1) 69.44.126.80 - 69.44.126.95 +Microsoft Corp SPRINTLINK (NET-63-173-42-128-1) 63.173.42.128 - 63.173.42.255 +Microsoft Corp MICROSOF33-108-0 (NET-12-28-108-0-1) 12.28.108.0 - 12.28.108.127 +Microsoft Corp SPRINTLINK (NET-65-170-29-0-1) 65.170.29.0 - 65.170.29.7 +Microsoft Corp Q0903-67-132-133-96 (NET-67-132-133-96-1) 67.132.133.96 - 67.132.133.103 +Microsoft Corp MICROSOFT-IPV6-BLK (NET6-2001-4898-1) 2001:4898:0000:0000:0000:0000:0000:0000 - 2001:4898:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF +Microsoft Corp LVLT-MSFT-8-6-176 (NET-8-6-176-0-1) 8.6.176.0 - 8.6.176.255 +Microsoft Corp MICROSOFT33 (NET-205-248-80-0-1) 205.248.80.0 - 205.248.129.255 +Microsoft Corp Q0523-63-148-123-240 (NET-63-148-123-240-1) 63.148.123.240 - 63.148.123.247 +Microsoft Corp SAVV-S233608-1 (NET-64-41-193-0-1) 64.41.193.0 - 64.41.193.255 +Microsoft Corp SAVV-S233053-1 (NET-64-85-70-32-1) 64.85.70.32 - 64.85.70.47 +Microsoft Corp SAVV-S233053-2 (NET-64-85-81-96-1) 64.85.81.96 - 64.85.81.103 +Microsoft Corp SAVV-S233053-3 (NET-64-85-81-104-1) 64.85.81.104 - 64.85.81.111 +Microsoft Corp SAVV-S233053-7 (NET-216-32-168-224-1) 216.32.168.224 - 216.32.168.255 +Microsoft Corp SAVV-S233053-6 (NET-206-79-74-32-1) 206.79.74.32 - 206.79.74.47 +Microsoft Corp SAVV-S233053-8 (NET-216-32-175-224-1) 216.32.175.224 - 216.32.175.255 +Microsoft Corp SAVV-S233053-9 (NET-216-32-180-0-1) 216.32.180.0 - 216.32.183.255 +Microsoft Corp SAVV-S233053-11 (NET-216-33-229-224-1) 216.33.229.224 - 216.33.229.255 +Microsoft Corp SAVV-S233053-12 (NET-216-33-236-0-1) 216.33.236.0 - 216.33.239.255 +Microsoft Corp SAVV-S233053-13 (NET-216-33-240-0-1) 216.33.240.0 - 216.33.243.255 +Microsoft Corp SAVV-S233053-10 (NET-216-32-240-0-1) 216.32.240.0 - 216.32.243.255 +Microsoft Corp SAVV-S233608-3 (NET-216-34-51-0-1) 216.34.51.0 - 216.34.51.255 +Microsoft Corp SAVV-S233053-4 (NET-209-1-112-0-1) 209.1.112.0 - 209.1.112.255 +Microsoft Corp SAVV-S233053-5 (NET-209-1-113-0-1) 209.1.113.0 - 209.1.113.255 +Microsoft Corp SAVV-S233608-2 (NET-209-1-15-0-1) 209.1.15.0 - 209.1.15.255 +Microsoft Corp SAVV-S233608-4 (NET-216-34-53-176-1) 216.34.53.176 - 216.34.53.191 +Microsoft Corp SAVV-S233608-5 (NET-216-35-8-224-1) 216.35.8.224 - 216.35.8.239 +Microsoft Corp SAVV-S233053-14 (NET-209-185-128-0-1) 209.185.128.0 - 209.185.131.255 +Microsoft Corp Q0112-65-114-175-128 (NET-65-114-175-128-1) 65.114.175.128 - 65.114.175.159 +Microsoft Corp SAVV-S233053-15 (NET-64-15-229-96-1) 64.15.229.96 - 64.15.229.127 +Microsoft Corp SAVV-S233050-5 (NET-64-15-177-0-1) 64.15.177.0 - 64.15.177.255 +Microsoft Corp SAVV-S233050-4 (NET-64-15-170-192-1) 64.15.170.192 - 64.15.170.199 +Microsoft Corp SAVV-S233050-2 (NET-209-143-238-0-1) 209.143.238.0 - 209.143.238.255 +Microsoft Corp SAVV-S233050-6 (NET-64-15-178-0-1) 64.15.178.0 - 64.15.178.255 +Microsoft Corp SAVV-S232995-2 (NET-66-35-209-120-1) 66.35.209.120 - 66.35.209.127 +Microsoft Corp SAVV-S232995-3 (NET-66-35-211-128-1) 66.35.211.128 - 66.35.211.191 +Microsoft Corp SAVV-S232995-1 (NET-66-35-208-48-1) 66.35.208.48 - 66.35.208.63 +Microsoft Corp SAVV-S233053-16 (NET-216-33-148-0-1) 216.33.148.0 - 216.33.151.255 +Microsoft Corp., MSN Operations SAVV-S233052-4 (NET-216-35-66-88-1) 216.35.66.88 - 216.35.66.95 +MICROSOFT CORPORATION MICROSOF32-32-160 (NET-12-230-32-160-1) 12.230.32.160 - 12.230.32.167 +MICROSOFT CORPORATION MICROSOF43-124-0 (NET-12-53-124-0-1) 12.53.124.0 - 12.53.124.31 +MICROSOFT CORPORATION MICROSOF82-18-96 (NET-12-232-18-96-1) 12.232.18.96 - 12.232.18.127 +MICROSOFT CORPORATION MICROSOF25-158 (NET-12-190-158-0-1) 12.190.158.0 - 12.190.158.255 +MICROSOFT CORPORATION MICROSOF61-196-32 (NET-12-71-196-32-1) 12.71.196.32 - 12.71.196.47 +Microsoft Corporation MICROSOFT-ONLINE-SERVICES (NET-209-240-192-0-1) 209.240.192.0 - 209.240.223.255 +Microsoft Corporation MICROSOFT-DYNAMIC-HOSTING (NET-70-37-0-0-1) 70.37.0.0 - 70.37.191.255 +Microsoft Corporation MS-ONLINE-SERVICES-NJ (NET-70-37-128-0-1) 70.37.128.0 - 70.37.129.255 +Microsoft Corporation MS-GLOBAL-ONLINE-SERVICES (NET-70-37-135-0-1) 70.37.135.0 - 70.37.135.255 +MICROSOFT CORPORATION MICROSOF82-87-192 (NET-12-49-87-192-1) 12.49.87.192 - 12.49.87.255 +Microsoft MICROSOFT (NET-74-93-205-144-1) 74.93.205.144 - 74.93.205.151 +Microsoft MICROSOFT (NET-74-93-205-152-1) 74.93.205.152 - 74.93.205.159 +Microsoft MICROSOFT (NET-74-93-206-64-1) 74.93.206.64 - 74.93.206.71 +Microsoft MICROSOFT (NET-70-89-139-120-1) 70.89.139.120 - 70.89.139.127 +Microsoft DIRECP-NET1-206-71-11 (NET-206-71-119-0-1) 206.71.119.0 - 206.71.119.255 +Microsoft DIRECP-NET1-117 (NET-206-71-117-0-1) 206.71.117.0 - 206.71.117.255 +Microsoft DIRECP-NET1-118 (NET-206-71-118-0-1) 206.71.118.0 - 206.71.118.255 +Microsoft UUHIL-BLK1-C155-112 (NET-209-154-155-112-1) 209.154.155.112 - 209.154.155.119 +Microsoft SBCIS-101411-164355 (NET-65-68-62-152-1) 65.68.62.152 - 65.68.62.159 +MICROSOFT SBC067039208168020503 (NET-67-39-208-168-1) 67.39.208.168 - 67.39.208.175 +Microsoft UU-65-242-67 (NET-65-242-67-0-1) 65.242.67.0 - 65.242.67.255 +Microsoft CW-204-71-191-0 (NET-204-71-191-0-1) 204.71.191.0 - 204.71.191.255 +Microsoft SBC063194155144021023 (NET-63-194-155-144-1) 63.194.155.144 - 63.194.155.151 +Microsoft SBC066136085192030113 (NET-66-136-85-192-1) 66.136.85.192 - 66.136.85.199 +MICROSOFT MFN-T280-64-124-184-72-29 (NET-64-124-184-72-1) 64.124.184.72 - 64.124.184.79 +MICROSOFT MFN-T133-216-200-206-0-24 (NET-216-200-206-0-1) 216.200.206.0 - 216.200.206.255 +Microsoft UU-63-80-93-D4 (NET-63-80-93-0-1) 63.80.93.0 - 63.80.93.127 +Microsoft RSPC-1218167167199384 (NET-67-192-225-208-1) 67.192.225.208 - 67.192.225.223 +Microsoft CVNET-454AA20 (NET-69-74-162-0-1) 69.74.162.0 - 69.74.162.255 +Microsoft UU-65-221-5 (NET-65-221-5-0-1) 65.221.5.0 - 65.221.5.255 +Microsoft - Partner Campaign Builder (PCB) MICROSOFT-PARTNER-CAMPAIGN-BUILDER-PCB (NET-216-182-89-192-1) 216.182.89.192 - 216.182.89.207 +Microsoft - Partner Campaign Builder (PCB) MICROSOFT-PARTNER-CAMPAIGN-BUILDER-PCB (NET-216-182-89-48-1) 216.182.89.48 - 216.182.89.63 +MICROSOFT AUSTIN-STO UU-65-248-85-D4 (NET-65-248-85-0-1) 65.248.85.0 - 65.248.85.255 +Microsoft Canada MIC0923-CA (NET-199-243-157-192-1) 199.243.157.192 - 199.243.157.223 +Microsoft Canada MIC0702-CA (NET-199-243-157-112-1) 199.243.157.112 - 199.243.157.119 +Microsoft Corp UU-65-194-210-224 (NET-65-194-210-224-1) 65.194.210.224 - 65.194.210.255 +Microsoft Corp UU-208-194-139 (NET-208-194-139-0-1) 208.194.139.0 - 208.194.139.255 +Microsoft Corp UU-208-204-49-128-B (NET-208-204-49-128-1) 208.204.49.128 - 208.204.49.255 +Microsoft Corp UU-208-205-26 (NET-208-205-26-0-1) 208.205.26.0 - 208.205.26.255 +Microsoft Corp UU-208-217-184-D1 (NET-208-217-184-0-1) 208.217.184.0 - 208.217.187.255 +Microsoft Corp UU-208-222-172 (NET-208-222-172-0-1) 208.222.172.0 - 208.222.172.255 +Microsoft Corp UU-208-224-200-64 (NET-208-224-200-64-1) 208.224.200.64 - 208.224.200.95 +Microsoft Corp UU-208-229-100-D1 (NET-208-229-100-0-1) 208.229.100.0 - 208.229.101.255 +Microsoft Corp UU-208-241-19 (NET-208-241-19-0-1) 208.241.19.0 - 208.241.19.15 +Microsoft Corp UU-208-241-19-16 (NET-208-241-19-16-1) 208.241.19.16 - 208.241.19.31 +Microsoft Corp UU-208-241-9-224 (NET-208-241-9-224-1) 208.241.9.224 - 208.241.9.239 +Microsoft Corp UU-208-244-108-D2 (NET-208-244-108-0-1) 208.244.108.0 - 208.244.108.15 +Microsoft Corp UU-208-245-16 (NET-208-245-16-0-1) 208.245.16.0 - 208.245.16.31 +Microsoft Corp UU-208-249-17-160 (NET-208-249-17-160-1) 208.249.17.160 - 208.249.17.175 +Microsoft Corp UU-63-104-216-D2 (NET-63-104-216-0-1) 63.104.216.0 - 63.104.216.127 +Microsoft Corp UU-63-69-245 (NET-63-69-245-0-1) 63.69.245.0 - 63.69.245.255 +Microsoft Corp SBC068090141072031030 (NET-68-90-141-72-1) 68.90.141.72 - 68.90.141.79 +Microsoft Corp 10825385 SBC06319812316029040317151513 (NET-63-198-123-160-1) 63.198.123.160 - 63.198.123.167 +MICROSOFT CORP-040821020257 SBC06824804806429040821020303 (NET-68-248-48-64-1) 68.248.48.64 - 68.248.48.71 +MICROSOFT CORP-040821020338 SBC06824804807229040821020347 (NET-68-248-48-72-1) 68.248.48.72 - 68.248.48.79 +MICROSOFT CORP-081024181821 SBC-99-49-8-248-29-0810241850 (NET-99-49-8-248-1) 99.49.8.248 - 99.49.8.255 +Microsoft Corp. HUGE-65-38-172-72-29 (NET-65-38-172-72-1) 65.38.172.72 - 65.38.172.79 +Microsoft Corp. HUGE-65-38-172-96-28 (NET-65-38-172-96-1) 65.38.172.96 - 65.38.172.111 +Microsoft Corporation MICROSOFT-CORPORATION (NET-75-149-174-16-1) 75.149.174.16 - 75.149.174.23 +Microsoft Corporation MICROSOFT-CORPORATION (NET-75-151-100-240-1) 75.151.100.240 - 75.151.100.255 +Microsoft Corporation SPEK-647057-0 (NET-64-81-8-96-1) 64.81.8.96 - 64.81.8.127 +Microsoft Corporation SBC067112255144030130 (NET-67-112-255-144-1) 67.112.255.144 - 67.112.255.151 +Microsoft Corporation ATTENS-010075-004522 (NET-63-240-201-176-1) 63.240.201.176 - 63.240.201.191 +Microsoft Corporation ATTENS-010075-004523 (NET-206-16-209-208-1) 206.16.209.208 - 206.16.209.223 +Microsoft Corporation ATTENS-010075-004525 (NET-63-240-195-208-1) 63.240.195.208 - 63.240.195.223 +Microsoft Corporation ATTENS-010075-004526 (NET-206-16-204-64-1) 206.16.204.64 - 206.16.204.79 +Microsoft Corporation ATTENS-010075-004450 (NET-206-16-223-0-1) 206.16.223.0 - 206.16.223.255 +Microsoft Corporation ATTENS-010075-005028 (NET-63-240-216-0-1) 63.240.216.0 - 63.240.219.255 +Microsoft Corporation ATTENS-010075-005057 (NET-63-240-220-0-1) 63.240.220.0 - 63.240.223.255 +Microsoft Corporation ATTENS-010075-005135 (NET-206-16-246-24-1) 206.16.246.24 - 206.16.246.31 +Microsoft Corporation ATTENS-010075-004524 (NET-63-240-195-192-1) 63.240.195.192 - 63.240.195.207 +Microsoft Corporation ATTENS-010075-005880 (NET-206-16-224-160-1) 206.16.224.160 - 206.16.224.191 +Microsoft Corporation (managed segment) RSPC-1229444888833780 (NET-98-129-187-144-1) 98.129.187.144 - 98.129.187.151 +Microsoft Corporation - Secure Dimensions ( RSPC-33955-12072007 (NET-67-192-39-48-1) 67.192.39.48 - 67.192.39.63 +Microsoft Corporation - Whale RSPC-108457-1170047010 (NET-72-32-240-160-1) 72.32.240.160 - 72.32.240.175 +Microsoft Corporation - Whale RSPC-108456-1173386392 (NET-72-32-201-152-1) 72.32.201.152 - 72.32.201.159 +MICROSOFT CROP SBC067039081152020503 (NET-67-39-81-152-1) 67.39.81.152 - 67.39.81.159 +Microsoft Education Programs RSPC-48725-1096578571 (NET-69-20-127-32-1) 69.20.127.32 - 69.20.127.39 +Microsoft License PNAP-SFJ-MSLI-RM-01 (NET-216-52-28-0-1) 216.52.28.0 - 216.52.28.255 +Microsoft License INAP-PHX003-MSLICENSE-25271 (NET-70-42-230-0-1) 70.42.230.0 - 70.42.231.255 +Microsoft License INAP-SFJ-MSLICENSE-13982 (NET-63-251-97-0-1) 63.251.97.0 - 63.251.97.255 +Microsoft Licensing SBC067120132128020815 (NET-67-120-132-128-1) 67.120.132.128 - 67.120.132.135 +Microsoft Licensing SBC067120132152020815 (NET-67-120-132-152-1) 67.120.132.152 - 67.120.132.159 +Microsoft Licensing SBC067120132192020816 (NET-67-120-132-192-1) 67.120.132.192 - 67.120.132.207 +Microsoft Licensing SBC0671201322080208 diff --git a/ipf/regress/p7.nat b/ipf/regress/p7.nat new file mode 100644 index 000000000000..3c3fa7c1874f --- /dev/null +++ b/ipf/regress/p7.nat @@ -0,0 +1 @@ +rewrite in on bge0 proto tcp from any to any port = 80 -> src 0/0 dst dstlist/servers; diff --git a/ipf/regress/p7.pool b/ipf/regress/p7.pool new file mode 100644 index 000000000000..451b374dfd1f --- /dev/null +++ b/ipf/regress/p7.pool @@ -0,0 +1,2 @@ +pool nat/dstlist (name servers; policy weighted connection;) + { 1.1.1.2; 1.1.1.4; 1.1.1.5; 1.1.1.9; }; diff --git a/ipf/regress/p9.nat b/ipf/regress/p9.nat new file mode 100644 index 000000000000..3c3fa7c1874f --- /dev/null +++ b/ipf/regress/p9.nat @@ -0,0 +1 @@ +rewrite in on bge0 proto tcp from any to any port = 80 -> src 0/0 dst dstlist/servers; diff --git a/ipf/regress/p9.pool b/ipf/regress/p9.pool new file mode 100644 index 000000000000..c452ffc681b6 --- /dev/null +++ b/ipf/regress/p9.pool @@ -0,0 +1,2 @@ +pool nat/dstlist (name servers; policy round-robin;) + { 1.1.1.2; 1.1.1.4; 1.1.1.5; 1.1.1.9; }; |