npf_rule_test.c revision 1.22 1 1.1 rmind /*
2 1.16 rmind * NPF ruleset tests.
3 1.1 rmind *
4 1.1 rmind * Public Domain.
5 1.1 rmind */
6 1.1 rmind
7 1.13 christos #ifdef _KERNEL
8 1.1 rmind #include <sys/types.h>
9 1.13 christos #endif
10 1.1 rmind
11 1.1 rmind #include "npf_impl.h"
12 1.1 rmind #include "npf_test.h"
13 1.1 rmind
14 1.1 rmind #define RESULT_PASS 0
15 1.1 rmind #define RESULT_BLOCK ENETUNREACH
16 1.1 rmind
17 1.1 rmind static const struct test_case {
18 1.20 riastrad int af;
19 1.1 rmind const char * src;
20 1.1 rmind const char * dst;
21 1.1 rmind const char * ifname;
22 1.1 rmind int di;
23 1.1 rmind int stateful_ret;
24 1.1 rmind int ret;
25 1.1 rmind } test_cases[] = {
26 1.1 rmind
27 1.1 rmind /* Stateful pass. */
28 1.1 rmind {
29 1.20 riastrad .af = AF_INET,
30 1.1 rmind .src = "10.1.1.1", .dst = "10.1.1.2",
31 1.1 rmind .ifname = IFNAME_INT, .di = PFIL_OUT,
32 1.1 rmind .stateful_ret = RESULT_PASS, .ret = RESULT_PASS
33 1.1 rmind },
34 1.1 rmind {
35 1.20 riastrad .af = AF_INET,
36 1.1 rmind .src = "10.1.1.2", .dst = "10.1.1.1",
37 1.1 rmind .ifname = IFNAME_INT, .di = PFIL_IN,
38 1.1 rmind .stateful_ret = RESULT_PASS, .ret = RESULT_BLOCK
39 1.1 rmind },
40 1.1 rmind
41 1.1 rmind /* Pass forwards stream only. */
42 1.1 rmind {
43 1.20 riastrad .af = AF_INET,
44 1.1 rmind .src = "10.1.1.1", .dst = "10.1.1.3",
45 1.1 rmind .ifname = IFNAME_INT, .di = PFIL_OUT,
46 1.1 rmind .stateful_ret = RESULT_PASS, .ret = RESULT_PASS
47 1.1 rmind },
48 1.1 rmind {
49 1.20 riastrad .af = AF_INET,
50 1.1 rmind .src = "10.1.1.3", .dst = "10.1.1.1",
51 1.1 rmind .ifname = IFNAME_INT, .di = PFIL_IN,
52 1.1 rmind .stateful_ret = RESULT_BLOCK, .ret = RESULT_BLOCK
53 1.1 rmind },
54 1.1 rmind
55 1.21 riastrad /*
56 1.22 riastrad * Pass in any of the { fe80::1, fe80::2 } group.
57 1.21 riastrad */
58 1.21 riastrad {
59 1.21 riastrad .af = AF_INET6,
60 1.21 riastrad .src = "fe80::1", .dst = "fe80::adec:c91c:d116:7592",
61 1.22 riastrad .ifname = IFNAME_INT, .di = PFIL_IN,
62 1.21 riastrad .stateful_ret = RESULT_PASS, .ret = RESULT_PASS
63 1.21 riastrad },
64 1.21 riastrad {
65 1.21 riastrad .af = AF_INET6,
66 1.21 riastrad .src = "fe80::2", .dst = "fe80::adec:c91c:d116:7592",
67 1.22 riastrad .ifname = IFNAME_INT, .di = PFIL_IN,
68 1.21 riastrad .stateful_ret = RESULT_PASS, .ret = RESULT_PASS
69 1.21 riastrad },
70 1.21 riastrad {
71 1.21 riastrad .af = AF_INET6,
72 1.21 riastrad .src = "fe80::3", .dst = "fe80::adec:c91c:d116:7592",
73 1.22 riastrad .ifname = IFNAME_INT, .di = PFIL_IN,
74 1.22 riastrad .stateful_ret = RESULT_BLOCK, .ret = RESULT_BLOCK
75 1.22 riastrad },
76 1.22 riastrad
77 1.22 riastrad /*
78 1.22 riastrad * Pass in anything _not_ in the group { fe80::1, fe80::2 }, as
79 1.22 riastrad * long as it is to that group.
80 1.22 riastrad */
81 1.22 riastrad {
82 1.22 riastrad .af = AF_INET6,
83 1.22 riastrad .src = "fe80::adec:c91c:d116:7592", .dst = "fe80::1",
84 1.22 riastrad .ifname = IFNAME_INT, .di = PFIL_IN,
85 1.22 riastrad .stateful_ret = RESULT_PASS, .ret = RESULT_PASS
86 1.22 riastrad },
87 1.22 riastrad {
88 1.22 riastrad .af = AF_INET6,
89 1.22 riastrad .src = "fe80::adec:c91c:d116:7592", .dst = "fe80::2",
90 1.22 riastrad .ifname = IFNAME_INT, .di = PFIL_IN,
91 1.22 riastrad .stateful_ret = RESULT_PASS, .ret = RESULT_PASS
92 1.22 riastrad },
93 1.22 riastrad {
94 1.22 riastrad .af = AF_INET6,
95 1.22 riastrad .src = "fe80::adec:c91c:d116:7592", .dst = "fe80::3",
96 1.22 riastrad .ifname = IFNAME_INT, .di = PFIL_IN,
97 1.21 riastrad .stateful_ret = RESULT_BLOCK, .ret = RESULT_BLOCK
98 1.21 riastrad },
99 1.21 riastrad
100 1.1 rmind /* Block. */
101 1.20 riastrad {
102 1.20 riastrad .af = AF_INET,
103 1.20 riastrad .src = "10.1.1.1", .dst = "10.1.1.4",
104 1.1 rmind .ifname = IFNAME_INT, .di = PFIL_OUT,
105 1.1 rmind .stateful_ret = RESULT_BLOCK, .ret = RESULT_BLOCK
106 1.1 rmind },
107 1.1 rmind
108 1.1 rmind };
109 1.1 rmind
110 1.1 rmind static int
111 1.17 rmind run_raw_testcase(unsigned i)
112 1.1 rmind {
113 1.17 rmind const struct test_case *t = &test_cases[i];
114 1.13 christos npf_t *npf = npf_getkernctx();
115 1.17 rmind npf_cache_t *npc;
116 1.17 rmind struct mbuf *m;
117 1.1 rmind npf_rule_t *rl;
118 1.17 rmind int slock, error;
119 1.17 rmind
120 1.20 riastrad m = mbuf_get_pkt(t->af, IPPROTO_UDP, t->src, t->dst, 9000, 9000);
121 1.17 rmind npc = get_cached_pkt(m, t->ifname);
122 1.1 rmind
123 1.19 rmind slock = npf_config_read_enter(npf);
124 1.17 rmind rl = npf_ruleset_inspect(npc, npf_config_ruleset(npf), t->di, NPF_LAYER_3);
125 1.1 rmind if (rl) {
126 1.17 rmind npf_match_info_t mi;
127 1.14 christos error = npf_rule_conclude(rl, &mi);
128 1.1 rmind } else {
129 1.1 rmind error = ENOENT;
130 1.1 rmind }
131 1.19 rmind npf_config_read_exit(npf, slock);
132 1.17 rmind
133 1.17 rmind put_cached_pkt(npc);
134 1.1 rmind return error;
135 1.1 rmind }
136 1.1 rmind
137 1.4 rmind static int
138 1.17 rmind run_handler_testcase(unsigned i)
139 1.4 rmind {
140 1.8 rmind const struct test_case *t = &test_cases[i];
141 1.13 christos ifnet_t *ifp = npf_test_getif(t->ifname);
142 1.17 rmind npf_t *npf = npf_getkernctx();
143 1.17 rmind struct mbuf *m;
144 1.4 rmind int error;
145 1.4 rmind
146 1.20 riastrad m = mbuf_get_pkt(t->af, IPPROTO_UDP, t->src, t->dst, 9000, 9000);
147 1.18 rmind error = npfk_packet_handler(npf, &m, ifp, t->di);
148 1.17 rmind if (m) {
149 1.17 rmind m_freem(m);
150 1.17 rmind }
151 1.4 rmind return error;
152 1.4 rmind }
153 1.4 rmind
154 1.4 rmind static npf_rule_t *
155 1.4 rmind npf_blockall_rule(void)
156 1.4 rmind {
157 1.13 christos npf_t *npf = npf_getkernctx();
158 1.15 rmind nvlist_t *rule = nvlist_create(0);
159 1.17 rmind npf_rule_t *rl;
160 1.4 rmind
161 1.15 rmind nvlist_add_number(rule, "attr",
162 1.7 rmind NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_DYNAMIC);
163 1.17 rmind rl = npf_rule_alloc(npf, rule);
164 1.17 rmind nvlist_destroy(rule);
165 1.17 rmind return rl;
166 1.4 rmind }
167 1.4 rmind
168 1.17 rmind static bool
169 1.17 rmind test_static(bool verbose)
170 1.1 rmind {
171 1.1 rmind for (unsigned i = 0; i < __arraycount(test_cases); i++) {
172 1.1 rmind const struct test_case *t = &test_cases[i];
173 1.17 rmind int error, serror;
174 1.1 rmind
175 1.17 rmind if (npf_test_getif(t->ifname) == NULL) {
176 1.1 rmind printf("Interface %s is not configured.\n", t->ifname);
177 1.1 rmind return false;
178 1.1 rmind }
179 1.1 rmind
180 1.17 rmind error = run_raw_testcase(i);
181 1.17 rmind serror = run_handler_testcase(i);
182 1.1 rmind
183 1.1 rmind if (verbose) {
184 1.16 rmind printf("rule test %d:\texpected %d (stateful) and %d\n"
185 1.16 rmind "\t\t-> returned %d and %d\n",
186 1.1 rmind i + 1, t->stateful_ret, t->ret, serror, error);
187 1.1 rmind }
188 1.17 rmind CHECK_TRUE(error == t->ret);
189 1.17 rmind CHECK_TRUE(serror == t->stateful_ret)
190 1.1 rmind }
191 1.17 rmind return true;
192 1.17 rmind }
193 1.17 rmind
194 1.17 rmind static bool
195 1.17 rmind test_dynamic(void)
196 1.17 rmind {
197 1.17 rmind npf_t *npf = npf_getkernctx();
198 1.17 rmind npf_ruleset_t *rlset;
199 1.17 rmind npf_rule_t *rl;
200 1.17 rmind uint64_t id;
201 1.17 rmind int error;
202 1.4 rmind
203 1.8 rmind /*
204 1.8 rmind * Test dynamic NPF rules.
205 1.8 rmind */
206 1.8 rmind
207 1.17 rmind error = run_raw_testcase(0);
208 1.16 rmind CHECK_TRUE(error == RESULT_PASS);
209 1.4 rmind
210 1.13 christos npf_config_enter(npf);
211 1.13 christos rlset = npf_config_ruleset(npf);
212 1.4 rmind
213 1.4 rmind rl = npf_blockall_rule();
214 1.4 rmind error = npf_ruleset_add(rlset, "test-rules", rl);
215 1.16 rmind CHECK_TRUE(error == 0);
216 1.4 rmind
217 1.17 rmind error = run_raw_testcase(0);
218 1.16 rmind CHECK_TRUE(error == RESULT_BLOCK);
219 1.4 rmind
220 1.6 rmind id = npf_rule_getid(rl);
221 1.6 rmind error = npf_ruleset_remove(rlset, "test-rules", id);
222 1.16 rmind CHECK_TRUE(error == 0);
223 1.4 rmind
224 1.13 christos npf_config_exit(npf);
225 1.4 rmind
226 1.17 rmind error = run_raw_testcase(0);
227 1.16 rmind CHECK_TRUE(error == RESULT_PASS);
228 1.4 rmind
229 1.16 rmind return true;
230 1.1 rmind }
231 1.17 rmind
232 1.17 rmind bool
233 1.17 rmind npf_rule_test(bool verbose)
234 1.17 rmind {
235 1.17 rmind bool ok;
236 1.17 rmind
237 1.17 rmind ok = test_static(verbose);
238 1.17 rmind CHECK_TRUE(ok);
239 1.17 rmind
240 1.17 rmind ok = test_dynamic();
241 1.17 rmind CHECK_TRUE(ok);
242 1.17 rmind
243 1.17 rmind return true;
244 1.17 rmind }
245