1 /* $NetBSD: npf_rule_test.c,v 1.10 2013/09/24 02:04:21 rmind Exp $ */ 2 3 /* 4 * NPF ruleset test. 5 * 6 * Public Domain. 7 */ 8 9 #include <sys/types.h> 10 11 #include "npf_impl.h" 12 #include "npf_test.h" 13 14 #define RESULT_PASS 0 15 #define RESULT_BLOCK ENETUNREACH 16 17 static const struct test_case { 18 const char * src; 19 const char * dst; 20 const char * ifname; 21 int di; 22 int stateful_ret; 23 int ret; 24 } test_cases[] = { 25 26 /* Stateful pass. */ 27 { 28 .src = "10.1.1.1", .dst = "10.1.1.2", 29 .ifname = IFNAME_INT, .di = PFIL_OUT, 30 .stateful_ret = RESULT_PASS, .ret = RESULT_PASS 31 }, 32 { 33 .src = "10.1.1.2", .dst = "10.1.1.1", 34 .ifname = IFNAME_INT, .di = PFIL_IN, 35 .stateful_ret = RESULT_PASS, .ret = RESULT_BLOCK 36 }, 37 38 /* Pass forwards stream only. */ 39 { 40 .src = "10.1.1.1", .dst = "10.1.1.3", 41 .ifname = IFNAME_INT, .di = PFIL_OUT, 42 .stateful_ret = RESULT_PASS, .ret = RESULT_PASS 43 }, 44 { 45 .src = "10.1.1.3", .dst = "10.1.1.1", 46 .ifname = IFNAME_INT, .di = PFIL_IN, 47 .stateful_ret = RESULT_BLOCK, .ret = RESULT_BLOCK 48 }, 49 50 /* Block. */ 51 { .src = "10.1.1.1", .dst = "10.1.1.4", 52 .ifname = IFNAME_INT, .di = PFIL_OUT, 53 .stateful_ret = RESULT_BLOCK, .ret = RESULT_BLOCK 54 }, 55 56 }; 57 58 static struct mbuf * 59 fill_packet(const struct test_case *t) 60 { 61 struct mbuf *m; 62 struct ip *ip; 63 struct udphdr *uh; 64 65 m = mbuf_construct(IPPROTO_UDP); 66 uh = mbuf_return_hdrs(m, false, &ip); 67 ip->ip_src.s_addr = inet_addr(t->src); 68 ip->ip_dst.s_addr = inet_addr(t->dst); 69 uh->uh_sport = htons(9000); 70 uh->uh_dport = htons(9000); 71 return m; 72 } 73 74 static int 75 npf_rule_raw_test(bool verbose, struct mbuf *m, ifnet_t *ifp, int di) 76 { 77 npf_cache_t npc = { .npc_info = 0 }; 78 nbuf_t nbuf; 79 npf_rule_t *rl; 80 int retfl, error; 81 82 nbuf_init(&nbuf, m, ifp); 83 npf_cache_all(&npc, &nbuf); 84 85 int slock = npf_config_read_enter(); 86 rl = npf_ruleset_inspect(&npc, &nbuf, npf_config_ruleset(), 87 di, NPF_LAYER_3); 88 if (rl) { 89 error = npf_rule_conclude(rl, &retfl); 90 } else { 91 error = ENOENT; 92 } 93 npf_config_read_exit(slock); 94 return error; 95 } 96 97 static int 98 npf_test_case(u_int i, bool verbose) 99 { 100 const struct test_case *t = &test_cases[i]; 101 ifnet_t *ifp = ifunit(t->ifname); 102 int error; 103 104 struct mbuf *m = fill_packet(t); 105 error = npf_rule_raw_test(verbose, m, ifp, t->di); 106 m_freem(m); 107 return error; 108 } 109 110 static npf_rule_t * 111 npf_blockall_rule(void) 112 { 113 prop_dictionary_t rldict; 114 115 rldict = prop_dictionary_create(); 116 prop_dictionary_set_uint32(rldict, "attributes", 117 NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_DYNAMIC); 118 return npf_rule_alloc(rldict); 119 } 120 121 bool 122 npf_rule_test(bool verbose) 123 { 124 npf_ruleset_t *rlset; 125 npf_rule_t *rl; 126 bool fail = false; 127 uint64_t id; 128 int error; 129 130 for (unsigned i = 0; i < __arraycount(test_cases); i++) { 131 const struct test_case *t = &test_cases[i]; 132 ifnet_t *ifp = ifunit(t->ifname); 133 int serror; 134 135 if (ifp == NULL) { 136 printf("Interface %s is not configured.\n", t->ifname); 137 return false; 138 } 139 140 struct mbuf *m = fill_packet(t); 141 error = npf_rule_raw_test(verbose, m, ifp, t->di); 142 serror = npf_packet_handler(NULL, &m, ifp, t->di); 143 144 if (m) { 145 m_freem(m); 146 } 147 148 if (verbose) { 149 printf("Rule test %d, expected %d (stateful) and %d \n" 150 "-> returned %d and %d.\n", 151 i + 1, t->stateful_ret, t->ret, serror, error); 152 } 153 fail |= (serror != t->stateful_ret || error != t->ret); 154 } 155 156 /* 157 * Test dynamic NPF rules. 158 */ 159 160 error = npf_test_case(0, verbose); 161 assert(error == RESULT_PASS); 162 163 npf_config_enter(); 164 rlset = npf_config_ruleset(); 165 166 rl = npf_blockall_rule(); 167 error = npf_ruleset_add(rlset, "test-rules", rl); 168 fail |= error != 0; 169 170 error = npf_test_case(0, verbose); 171 fail |= (error != RESULT_BLOCK); 172 173 id = npf_rule_getid(rl); 174 error = npf_ruleset_remove(rlset, "test-rules", id); 175 fail |= error != 0; 176 177 npf_config_exit(); 178 179 error = npf_test_case(0, verbose); 180 fail |= (error != RESULT_PASS); 181 182 return !fail; 183 } 184