xref: /netbsd-src/usr.sbin/npf/npftest/libnpftest/npf_rule_test.c (revision 6d322f2f4598f0d8a138f10ea648ec4fabe41f8b)
1 /*	$NetBSD: npf_rule_test.c,v 1.10 2013/09/24 02:04:21 rmind Exp $	*/
2 
3 /*
4  * NPF ruleset test.
5  *
6  * Public Domain.
7  */
8 
9 #include <sys/types.h>
10 
11 #include "npf_impl.h"
12 #include "npf_test.h"
13 
14 #define	RESULT_PASS	0
15 #define	RESULT_BLOCK	ENETUNREACH
16 
17 static const struct test_case {
18 	const char *	src;
19 	const char *	dst;
20 	const char *	ifname;
21 	int		di;
22 	int		stateful_ret;
23 	int		ret;
24 } test_cases[] = {
25 
26 	/* Stateful pass. */
27 	{
28 		.src = "10.1.1.1",		.dst = "10.1.1.2",
29 		.ifname = IFNAME_INT,		.di = PFIL_OUT,
30 		.stateful_ret = RESULT_PASS,	.ret = RESULT_PASS
31 	},
32 	{
33 		.src = "10.1.1.2",		.dst = "10.1.1.1",
34 		.ifname = IFNAME_INT,		.di = PFIL_IN,
35 		.stateful_ret = RESULT_PASS,	.ret = RESULT_BLOCK
36 	},
37 
38 	/* Pass forwards stream only. */
39 	{
40 		.src = "10.1.1.1",		.dst = "10.1.1.3",
41 		.ifname = IFNAME_INT,		.di = PFIL_OUT,
42 		.stateful_ret = RESULT_PASS,	.ret = RESULT_PASS
43 	},
44 	{
45 		.src = "10.1.1.3",		.dst = "10.1.1.1",
46 		.ifname = IFNAME_INT,		.di = PFIL_IN,
47 		.stateful_ret = RESULT_BLOCK,	.ret = RESULT_BLOCK
48 	},
49 
50 	/* Block. */
51 	{	.src = "10.1.1.1",		.dst = "10.1.1.4",
52 		.ifname = IFNAME_INT,		.di = PFIL_OUT,
53 		.stateful_ret = RESULT_BLOCK,	.ret = RESULT_BLOCK
54 	},
55 
56 };
57 
58 static struct mbuf *
59 fill_packet(const struct test_case *t)
60 {
61 	struct mbuf *m;
62 	struct ip *ip;
63 	struct udphdr *uh;
64 
65 	m = mbuf_construct(IPPROTO_UDP);
66 	uh = mbuf_return_hdrs(m, false, &ip);
67 	ip->ip_src.s_addr = inet_addr(t->src);
68 	ip->ip_dst.s_addr = inet_addr(t->dst);
69 	uh->uh_sport = htons(9000);
70 	uh->uh_dport = htons(9000);
71 	return m;
72 }
73 
74 static int
75 npf_rule_raw_test(bool verbose, struct mbuf *m, ifnet_t *ifp, int di)
76 {
77 	npf_cache_t npc = { .npc_info = 0 };
78 	nbuf_t nbuf;
79 	npf_rule_t *rl;
80 	int retfl, error;
81 
82 	nbuf_init(&nbuf, m, ifp);
83 	npf_cache_all(&npc, &nbuf);
84 
85 	int slock = npf_config_read_enter();
86 	rl = npf_ruleset_inspect(&npc, &nbuf, npf_config_ruleset(),
87 	    di, NPF_LAYER_3);
88 	if (rl) {
89 		error = npf_rule_conclude(rl, &retfl);
90 	} else {
91 		error = ENOENT;
92 	}
93 	npf_config_read_exit(slock);
94 	return error;
95 }
96 
97 static int
98 npf_test_case(u_int i, bool verbose)
99 {
100 	const struct test_case *t = &test_cases[i];
101 	ifnet_t *ifp = ifunit(t->ifname);
102 	int error;
103 
104 	struct mbuf *m = fill_packet(t);
105 	error = npf_rule_raw_test(verbose, m, ifp, t->di);
106 	m_freem(m);
107 	return error;
108 }
109 
110 static npf_rule_t *
111 npf_blockall_rule(void)
112 {
113 	prop_dictionary_t rldict;
114 
115 	rldict = prop_dictionary_create();
116 	prop_dictionary_set_uint32(rldict, "attributes",
117 	    NPF_RULE_IN | NPF_RULE_OUT | NPF_RULE_DYNAMIC);
118 	return npf_rule_alloc(rldict);
119 }
120 
121 bool
122 npf_rule_test(bool verbose)
123 {
124 	npf_ruleset_t *rlset;
125 	npf_rule_t *rl;
126 	bool fail = false;
127 	uint64_t id;
128 	int error;
129 
130 	for (unsigned i = 0; i < __arraycount(test_cases); i++) {
131 		const struct test_case *t = &test_cases[i];
132 		ifnet_t *ifp = ifunit(t->ifname);
133 		int serror;
134 
135 		if (ifp == NULL) {
136 			printf("Interface %s is not configured.\n", t->ifname);
137 			return false;
138 		}
139 
140 		struct mbuf *m = fill_packet(t);
141 		error = npf_rule_raw_test(verbose, m, ifp, t->di);
142 		serror = npf_packet_handler(NULL, &m, ifp, t->di);
143 
144 		if (m) {
145 			m_freem(m);
146 		}
147 
148 		if (verbose) {
149 			printf("Rule test %d, expected %d (stateful) and %d \n"
150 			    "-> returned %d and %d.\n",
151 			    i + 1, t->stateful_ret, t->ret, serror, error);
152 		}
153 		fail |= (serror != t->stateful_ret || error != t->ret);
154 	}
155 
156 	/*
157 	 * Test dynamic NPF rules.
158 	 */
159 
160 	error = npf_test_case(0, verbose);
161 	assert(error == RESULT_PASS);
162 
163 	npf_config_enter();
164 	rlset = npf_config_ruleset();
165 
166 	rl = npf_blockall_rule();
167 	error = npf_ruleset_add(rlset, "test-rules", rl);
168 	fail |= error != 0;
169 
170 	error = npf_test_case(0, verbose);
171 	fail |= (error != RESULT_BLOCK);
172 
173 	id = npf_rule_getid(rl);
174 	error = npf_ruleset_remove(rlset, "test-rules", id);
175 	fail |= error != 0;
176 
177 	npf_config_exit();
178 
179 	error = npf_test_case(0, verbose);
180 	fail |= (error != RESULT_PASS);
181 
182 	return !fail;
183 }
184