From b9dee1ff021a1b0b98f40af2acb1638caf6b2f74 Mon Sep 17 00:00:00 2001
From: Kristof Provost <kp@FreeBSD.org>
Date: Sun, 13 Jan 2019 05:31:53 +0000
Subject: [PATCH] pf tests: Test PR 229241

pfctl has an issue with 'set skip on <group>', which causes inconsistent
behaviour: the set skip directive works initially, but does not take
effect when the same rules are re-applied.

PR:		229241
MFC after:	1 week
---
 tests/sys/netpfil/pf/set_skip.sh | 31 +++++++++++++++++++++++++++++++
 tests/sys/netpfil/pf/utils.subr  | 10 ++++++++--
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/tests/sys/netpfil/pf/set_skip.sh b/tests/sys/netpfil/pf/set_skip.sh
index b234a8043cc3..611eca9d6710 100755
--- a/tests/sys/netpfil/pf/set_skip.sh
+++ b/tests/sys/netpfil/pf/set_skip.sh
@@ -30,7 +30,38 @@ set_skip_group_cleanup()
 	pft_cleanup
 }
 
+atf_test_case "set_skip_group_lo" "cleanup"
+set_skip_group_lo_head()
+{
+	atf_set descr 'Basic set skip test, lo'
+	atf_set require.user root
+}
+
+set_skip_group_lo_body()
+{
+	# See PR 229241
+	pft_init
+
+	pft_mkjail alcatraz
+	jexec alcatraz ifconfig lo0 127.0.0.1/8 up
+	jexec alcatraz pfctl -e
+	pft_set_rules alcatraz "set skip on lo" \
+		"block on lo0"
+
+	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
+	pft_set_rules noflush alcatraz "set skip on lo" \
+		"block on lo0"
+	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 127.0.0.1
+	jexec alcatraz pfctl -s rules
+}
+
+set_skip_group_lo_cleanup()
+{
+	pft_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "set_skip_group"
+	atf_add_test_case "set_skip_group_lo"
 }
diff --git a/tests/sys/netpfil/pf/utils.subr b/tests/sys/netpfil/pf/utils.subr
index 8816a45ccffd..50a7de0611f8 100644
--- a/tests/sys/netpfil/pf/utils.subr
+++ b/tests/sys/netpfil/pf/utils.subr
@@ -49,8 +49,14 @@ pft_set_rules()
 	jname=$1
 	shift
 
-	# Flush all states, rules, fragments, ...
-	jexec ${jname} pfctl -F all
+	if [ $jname == "noflush" ];
+	then
+		jname=$1
+		shift
+	else
+		# Flush all states, rules, fragments, ...
+		jexec ${jname} pfctl -F all
+	fi
 
 	while [ $# -gt 0 ]; do
 		printf "$1\n"