Home | History | Annotate | Line # | Download | only in libnpftest
npf_rule_test.c revision 1.22
      1   1.1     rmind /*
      2  1.16     rmind  * NPF ruleset tests.
      3   1.1     rmind  *
      4   1.1     rmind  * Public Domain.
      5   1.1     rmind  */
      6   1.1     rmind 
      7  1.13  christos #ifdef _KERNEL
      8   1.1     rmind #include <sys/types.h>
      9  1.13  christos #endif
     10   1.1     rmind 
     11   1.1     rmind #include "npf_impl.h"
     12   1.1     rmind #include "npf_test.h"
     13   1.1     rmind 
     14   1.1     rmind #define	RESULT_PASS	0
     15   1.1     rmind #define	RESULT_BLOCK	ENETUNREACH
     16   1.1     rmind 
     17   1.1     rmind static const struct test_case {
     18  1.20  riastrad 	int		af;
     19   1.1     rmind 	const char *	src;
     20   1.1     rmind 	const char *	dst;
     21   1.1     rmind 	const char *	ifname;
     22   1.1     rmind 	int		di;
     23   1.1     rmind 	int		stateful_ret;
     24   1.1     rmind 	int		ret;
     25   1.1     rmind } test_cases[] = {
     26   1.1     rmind 
     27   1.1     rmind 	/* Stateful pass. */
     28   1.1     rmind 	{
     29  1.20  riastrad 		.af = AF_INET,
     30   1.1     rmind 		.src = "10.1.1.1",		.dst = "10.1.1.2",
     31   1.1     rmind 		.ifname = IFNAME_INT,		.di = PFIL_OUT,
     32   1.1     rmind 		.stateful_ret = RESULT_PASS,	.ret = RESULT_PASS
     33   1.1     rmind 	},
     34   1.1     rmind 	{
     35  1.20  riastrad 		.af = AF_INET,
     36   1.1     rmind 		.src = "10.1.1.2",		.dst = "10.1.1.1",
     37   1.1     rmind 		.ifname = IFNAME_INT,		.di = PFIL_IN,
     38   1.1     rmind 		.stateful_ret = RESULT_PASS,	.ret = RESULT_BLOCK
     39   1.1     rmind 	},
     40   1.1     rmind 
     41   1.1     rmind 	/* Pass forwards stream only. */
     42   1.1     rmind 	{
     43  1.20  riastrad 		.af = AF_INET,
     44   1.1     rmind 		.src = "10.1.1.1",		.dst = "10.1.1.3",
     45   1.1     rmind 		.ifname = IFNAME_INT,		.di = PFIL_OUT,
     46   1.1     rmind 		.stateful_ret = RESULT_PASS,	.ret = RESULT_PASS
     47   1.1     rmind 	},
     48   1.1     rmind 	{
     49  1.20  riastrad 		.af = AF_INET,
     50   1.1     rmind 		.src = "10.1.1.3",		.dst = "10.1.1.1",
     51   1.1     rmind 		.ifname = IFNAME_INT,		.di = PFIL_IN,
     52   1.1     rmind 		.stateful_ret = RESULT_BLOCK,	.ret = RESULT_BLOCK
     53   1.1     rmind 	},
     54   1.1     rmind 
     55  1.21  riastrad 	/*
     56  1.22  riastrad 	 * Pass in any of the { fe80::1, fe80::2 } group.
     57  1.21  riastrad 	 */
     58  1.21  riastrad 	{
     59  1.21  riastrad 		.af = AF_INET6,
     60  1.21  riastrad 		.src = "fe80::1", .dst = "fe80::adec:c91c:d116:7592",
     61  1.22  riastrad 		.ifname = IFNAME_INT,		.di = PFIL_IN,
     62  1.21  riastrad 		.stateful_ret = RESULT_PASS,	.ret = RESULT_PASS
     63  1.21  riastrad 	},
     64  1.21  riastrad 	{
     65  1.21  riastrad 		.af = AF_INET6,
     66  1.21  riastrad 		.src = "fe80::2", .dst = "fe80::adec:c91c:d116:7592",
     67  1.22  riastrad 		.ifname = IFNAME_INT,		.di = PFIL_IN,
     68  1.21  riastrad 		.stateful_ret = RESULT_PASS,	.ret = RESULT_PASS
     69  1.21  riastrad 	},
     70  1.21  riastrad 	{
     71  1.21  riastrad 		.af = AF_INET6,
     72  1.21  riastrad 		.src = "fe80::3", .dst = "fe80::adec:c91c:d116:7592",
     73  1.22  riastrad 		.ifname = IFNAME_INT,		.di = PFIL_IN,
     74  1.22  riastrad 		.stateful_ret = RESULT_BLOCK,	.ret = RESULT_BLOCK
     75  1.22  riastrad 	},
     76  1.22  riastrad 
     77  1.22  riastrad 	/*
     78  1.22  riastrad 	 * Pass in anything _not_ in the group { fe80::1, fe80::2 }, as
     79  1.22  riastrad 	 * long as it is to that group.
     80  1.22  riastrad 	 */
     81  1.22  riastrad 	{
     82  1.22  riastrad 		.af = AF_INET6,
     83  1.22  riastrad 		.src = "fe80::adec:c91c:d116:7592", .dst = "fe80::1",
     84  1.22  riastrad 		.ifname = IFNAME_INT,		.di = PFIL_IN,
     85  1.22  riastrad 		.stateful_ret = RESULT_PASS,	.ret = RESULT_PASS
     86  1.22  riastrad 	},
     87  1.22  riastrad 	{
     88  1.22  riastrad 		.af = AF_INET6,
     89  1.22  riastrad 		.src = "fe80::adec:c91c:d116:7592", .dst = "fe80::2",
     90  1.22  riastrad 		.ifname = IFNAME_INT,		.di = PFIL_IN,
     91  1.22  riastrad 		.stateful_ret = RESULT_PASS,	.ret = RESULT_PASS
     92  1.22  riastrad 	},
     93  1.22  riastrad 	{
     94  1.22  riastrad 		.af = AF_INET6,
     95  1.22  riastrad 		.src = "fe80::adec:c91c:d116:7592", .dst = "fe80::3",
     96  1.22  riastrad 		.ifname = IFNAME_INT,		.di = PFIL_IN,
     97  1.21  riastrad 		.stateful_ret = RESULT_BLOCK,	.ret = RESULT_BLOCK
     98  1.21  riastrad 	},
     99  1.21  riastrad 
    100   1.1     rmind 	/* Block. */
    101  1.20  riastrad 	{
    102  1.20  riastrad 		.af = AF_INET,
    103  1.20  riastrad 		.src = "10.1.1.1",		.dst = "10.1.1.4",
    104   1.1     rmind 		.ifname = IFNAME_INT,		.di = PFIL_OUT,
    105   1.1     rmind 		.stateful_ret = RESULT_BLOCK,	.ret = RESULT_BLOCK
    106   1.1     rmind 	},
    107   1.1     rmind 
    108   1.1     rmind };
    109   1.1     rmind 
    110   1.1     rmind static int
    111  1.17     rmind run_raw_testcase(unsigned i)
    112   1.1     rmind {
    113  1.17     rmind 	const struct test_case *t = &test_cases[i];
    114  1.13  christos 	npf_t *npf = npf_getkernctx();
    115  1.17     rmind 	npf_cache_t *npc;
    116  1.17     rmind 	struct mbuf *m;
    117   1.1     rmind 	npf_rule_t *rl;
    118  1.17     rmind 	int slock, error;
    119  1.17     rmind 
    120  1.20  riastrad 	m = mbuf_get_pkt(t->af, IPPROTO_UDP, t->src, t->dst, 9000, 9000);
    121  1.17     rmind 	npc = get_cached_pkt(m, t->ifname);
    122   1.1     rmind 
    123  1.19     rmind 	slock = npf_config_read_enter(npf);
    124  1.17     rmind 	rl = npf_ruleset_inspect(npc, npf_config_ruleset(npf), t->di, NPF_LAYER_3);
    125   1.1     rmind 	if (rl) {
    126  1.17     rmind 		npf_match_info_t mi;
    127  1.14  christos 		error = npf_rule_conclude(rl, &mi);
    128   1.1     rmind 	} else {
    129   1.1     rmind 		error = ENOENT;
    130   1.1     rmind 	}
    131  1.19     rmind 	npf_config_read_exit(npf, slock);
    132  1.17     rmind 
    133  1.17     rmind 	put_cached_pkt(npc);
    134   1.1     rmind 	return error;
    135   1.1     rmind }
    136   1.1     rmind 
    137   1.4     rmind static int
    138  1.17     rmind run_handler_testcase(unsigned i)
    139   1.4     rmind {
    140   1.8     rmind 	const struct test_case *t = &test_cases[i];
    141  1.13  christos 	ifnet_t *ifp = npf_test_getif(t->ifname);
    142  1.17     rmind 	npf_t *npf = npf_getkernctx();
    143  1.17     rmind 	struct mbuf *m;
    144   1.4     rmind 	int error;
    145   1.4     rmind 
    146  1.20  riastrad 	m = mbuf_get_pkt(t->af, IPPROTO_UDP, t->src, t->dst, 9000, 9000);
    147  1.18     rmind 	error = npfk_packet_handler(npf, &m, ifp, t->di);
    148  1.17     rmind 	if (m) {
    149  1.17     rmind 		m_freem(m);
    150  1.17     rmind 	}
    151   1.4     rmind 	return error;
    152   1.4     rmind }
    153   1.4     rmind 
    154   1.4     rmind static npf_rule_t *
    155   1.4     rmind npf_blockall_rule(void)
    156   1.4     rmind {
    157  1.13  christos 	npf_t *npf = npf_getkernctx();
    158  1.15     rmind 	nvlist_t *rule = nvlist_create(0);
    159  1.17     rmind 	npf_rule_t *rl;
    160   1.4     rmind 
    161  1.15     rmind 	nvlist_add_number(rule, "attr",
    162   1.7     rmind 	    NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_DYNAMIC);
    163  1.17     rmind 	rl = npf_rule_alloc(npf, rule);
    164  1.17     rmind 	nvlist_destroy(rule);
    165  1.17     rmind 	return rl;
    166   1.4     rmind }
    167   1.4     rmind 
    168  1.17     rmind static bool
    169  1.17     rmind test_static(bool verbose)
    170   1.1     rmind {
    171   1.1     rmind 	for (unsigned i = 0; i < __arraycount(test_cases); i++) {
    172   1.1     rmind 		const struct test_case *t = &test_cases[i];
    173  1.17     rmind 		int error, serror;
    174   1.1     rmind 
    175  1.17     rmind 		if (npf_test_getif(t->ifname) == NULL) {
    176   1.1     rmind 			printf("Interface %s is not configured.\n", t->ifname);
    177   1.1     rmind 			return false;
    178   1.1     rmind 		}
    179   1.1     rmind 
    180  1.17     rmind 		error = run_raw_testcase(i);
    181  1.17     rmind 		serror = run_handler_testcase(i);
    182   1.1     rmind 
    183   1.1     rmind 		if (verbose) {
    184  1.16     rmind 			printf("rule test %d:\texpected %d (stateful) and %d\n"
    185  1.16     rmind 			    "\t\t-> returned %d and %d\n",
    186   1.1     rmind 			    i + 1, t->stateful_ret, t->ret, serror, error);
    187   1.1     rmind 		}
    188  1.17     rmind 		CHECK_TRUE(error == t->ret);
    189  1.17     rmind 		CHECK_TRUE(serror == t->stateful_ret)
    190   1.1     rmind 	}
    191  1.17     rmind 	return true;
    192  1.17     rmind }
    193  1.17     rmind 
    194  1.17     rmind static bool
    195  1.17     rmind test_dynamic(void)
    196  1.17     rmind {
    197  1.17     rmind 	npf_t *npf = npf_getkernctx();
    198  1.17     rmind 	npf_ruleset_t *rlset;
    199  1.17     rmind 	npf_rule_t *rl;
    200  1.17     rmind 	uint64_t id;
    201  1.17     rmind 	int error;
    202   1.4     rmind 
    203   1.8     rmind 	/*
    204   1.8     rmind 	 * Test dynamic NPF rules.
    205   1.8     rmind 	 */
    206   1.8     rmind 
    207  1.17     rmind 	error = run_raw_testcase(0);
    208  1.16     rmind 	CHECK_TRUE(error == RESULT_PASS);
    209   1.4     rmind 
    210  1.13  christos 	npf_config_enter(npf);
    211  1.13  christos 	rlset = npf_config_ruleset(npf);
    212   1.4     rmind 
    213   1.4     rmind 	rl = npf_blockall_rule();
    214   1.4     rmind 	error = npf_ruleset_add(rlset, "test-rules", rl);
    215  1.16     rmind 	CHECK_TRUE(error == 0);
    216   1.4     rmind 
    217  1.17     rmind 	error = run_raw_testcase(0);
    218  1.16     rmind 	CHECK_TRUE(error == RESULT_BLOCK);
    219   1.4     rmind 
    220   1.6     rmind 	id = npf_rule_getid(rl);
    221   1.6     rmind 	error = npf_ruleset_remove(rlset, "test-rules", id);
    222  1.16     rmind 	CHECK_TRUE(error == 0);
    223   1.4     rmind 
    224  1.13  christos 	npf_config_exit(npf);
    225   1.4     rmind 
    226  1.17     rmind 	error = run_raw_testcase(0);
    227  1.16     rmind 	CHECK_TRUE(error == RESULT_PASS);
    228   1.4     rmind 
    229  1.16     rmind 	return true;
    230   1.1     rmind }
    231  1.17     rmind 
    232  1.17     rmind bool
    233  1.17     rmind npf_rule_test(bool verbose)
    234  1.17     rmind {
    235  1.17     rmind 	bool ok;
    236  1.17     rmind 
    237  1.17     rmind 	ok = test_static(verbose);
    238  1.17     rmind 	CHECK_TRUE(ok);
    239  1.17     rmind 
    240  1.17     rmind 	ok = test_dynamic();
    241  1.17     rmind 	CHECK_TRUE(ok);
    242  1.17     rmind 
    243  1.17     rmind 	return true;
    244  1.17     rmind }
    245