static void test_antispoof_rarp(void) { # include "rarp.c" const unsigned char *pkts[] = {pkt1}; int pkts_size[] = {15}; uint16_t pkts_nb = 1; struct ether_addr inside_mac; struct pg_brick *gen_west; struct pg_brick *antispoof; struct pg_brick *col_east; struct pg_error *error = NULL; uint16_t packet_count; uint16_t i; struct rte_mbuf *packet; uint64_t filtered_pkts_mask; pg_scan_ether_addr(&inside_mac, "00:23:df:ff:c9:23"); /* [generator>]--[antispoof]--[collector] */ gen_west = pg_packetsgen_new("gen_west", 1, 1, EAST_SIDE, &packet, 1, &error); g_assert(!error); antispoof = pg_antispoof_new("antispoof", 1, 1, EAST_SIDE, inside_mac, &error); g_assert(!error); col_east = pg_collect_new("col_east", 1, 1, &error); g_assert(!error); pg_brick_link(gen_west, antispoof, &error); g_assert(!error); pg_brick_link(antispoof, col_east, &error); g_assert(!error); /* replay traffic */ for (i = 0; i < pkts_nb; i++) { packet = build_packet(pkts[i], pkts_size[i]); pg_brick_poll(gen_west, &packet_count, &error); g_assert(!error); g_assert(packet_count == 1); pg_brick_west_burst_get(col_east, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 0); rte_pktmbuf_free(packet); } pg_brick_destroy(gen_west); pg_brick_destroy(antispoof); pg_brick_destroy(col_east); }
static void test_sorting_pmtud(void) { struct pg_error *error = NULL; struct pg_brick *pmtud; struct pg_brick *col_east; struct rte_mbuf **pkts; uint64_t pkts_mask; struct ether_addr eth = {{0}}; pkts = pg_packets_append_ether(pg_packets_create(pg_mask_firsts(64)), pg_mask_firsts(64), ð, ð, ETHER_TYPE_IPv4); pg_packets_append_ipv4(pkts, pg_mask_firsts(64), 1, 2, 0, 0); pg_packets_append_blank(pkts, pg_mask_firsts(32), 431 - sizeof(struct ipv4_hdr) - sizeof(struct ether_hdr)); pg_packets_append_blank(pkts, pg_mask_firsts(64) & ~pg_mask_firsts(32), 430 - sizeof(struct ipv4_hdr) - sizeof(struct ether_hdr)); pmtud = pg_pmtud_new("pmtud", PG_WEST_SIDE, 430, &error); g_assert(!error); col_east = pg_collect_new("col_east", &error); g_assert(!error); pg_brick_link(pmtud, col_east, &error); g_assert(!error); pg_brick_burst(pmtud, PG_WEST_SIDE, 0, pkts, pg_mask_firsts(64), &error); g_assert(!error); pg_brick_west_burst_get(col_east, &pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(pkts_mask) == 32); pg_brick_destroy(pmtud); pg_brick_destroy(col_east); pg_packets_free(pkts, pg_mask_firsts(64)); g_free(pkts); }
static void test_sorting_pmtud_df(void) { struct pg_error *error = NULL; struct pg_brick *pmtud; struct pg_brick *col_east; struct rte_mbuf **pkts; uint64_t pkts_mask; struct ether_addr eth = {{0}}; uint64_t buff[4] = {0, 0, 0, 0}; pkts = pg_packets_append_ether(pg_packets_create(pg_mask_firsts(64)), pg_mask_firsts(64), ð, ð, ETHER_TYPE_IPv4); pg_packets_append_ipv4(pkts, pg_mask_firsts(32), 1, 2, 0, 0); /* Initialise ip header to 0, this ensure that DF flag is not set*/ pg_packets_append_buf(pkts, pg_mask_firsts(64) & ~pg_mask_firsts(32), buff, sizeof(uint64_t) * 4); pg_packets_append_blank(pkts, pg_mask_firsts(64), 400); pmtud = pg_pmtud_new("pmtud", PG_WEST_SIDE, 430, &error); g_assert(!error); col_east = pg_collect_new("col_east", &error); g_assert(!error); pg_brick_link(pmtud, col_east, &error); g_assert(!error); pg_brick_burst(pmtud, PG_WEST_SIDE, 0, pkts, pg_mask_firsts(64), &error); g_assert(!error); pg_brick_west_burst_get(col_east, &pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(pkts_mask) == 32); pg_brick_destroy(pmtud); pg_brick_destroy(col_east); pg_packets_free(pkts, pg_mask_firsts(64)); g_free(pkts); }
static void test_pg_antispoof_arp_disable(void) { # include "arp_request.c" const unsigned char *pkts[] = {pkt1}; int pkts_size[] = {42}; uint16_t pkts_nb = 1; struct ether_addr inside_mac; uint32_t inside_ip; struct pg_brick *gen_west; struct pg_brick *antispoof; struct pg_brick *col_east; struct pg_error *error = NULL; uint16_t packet_count; uint16_t i; struct rte_mbuf *packet; uint64_t filtered_pkts_mask; struct rte_mbuf **filtered_pkts; pg_scan_ether_addr(&inside_mac, "00:e0:81:d5:02:91"); inside_ip = htobe32(IPv4(0, 0, 0, 42)); /* [generator>]--[antispoof]--[collector] */ gen_west = pg_packetsgen_new("gen_west", 1, 1, EAST_SIDE, &packet, 1, &error); g_assert(!error); antispoof = pg_antispoof_new("antispoof", 1, 1, EAST_SIDE, inside_mac, &error); g_assert(!error); col_east = pg_collect_new("col_east", 1, 1, &error); g_assert(!error); pg_brick_link(gen_west, antispoof, &error); g_assert(!error); pg_brick_link(antispoof, col_east, &error); g_assert(!error); /* enable ARP antispoof with a wrong IP */ pg_antispoof_arp_enable(antispoof, inside_ip); /* replay traffic */ for (i = 0; i < pkts_nb; i++) { packet = build_packet(pkts[i], pkts_size[i]); pg_brick_poll(gen_west, &packet_count, &error); g_assert(!error); g_assert(packet_count == 1); filtered_pkts = pg_brick_west_burst_get(col_east, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 0); pg_packets_free(filtered_pkts, filtered_pkts_mask); rte_pktmbuf_free(packet); } /* disable ARP antispoof, should now pass */ pg_antispoof_arp_disable(antispoof); /* replay traffic */ for (i = 0; i < pkts_nb; i++) { packet = build_packet(pkts[i], pkts_size[i]); pg_brick_poll(gen_west, &packet_count, &error); g_assert(!error); g_assert(packet_count == 1); filtered_pkts = pg_brick_west_burst_get(col_east, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 1); pg_packets_free(filtered_pkts, filtered_pkts_mask); rte_pktmbuf_free(packet); } pg_brick_destroy(gen_west); pg_brick_destroy(antispoof); pg_brick_destroy(col_east); }
static void test_antispoof_generic(const unsigned char **pkts, int *pkts_size, uint16_t pkts_nb, struct ether_addr inside_mac, uint32_t inside_ip) { struct pg_brick *gen_west; struct pg_brick *antispoof; struct pg_brick *col_east; struct pg_error *error = NULL; uint16_t packet_count; uint16_t i; struct rte_mbuf *packet; uint64_t filtered_pkts_mask; struct rte_mbuf **filtered_pkts; /* [generator>]--[antispoof]--[collector] */ gen_west = pg_packetsgen_new("gen_west", 1, 1, EAST_SIDE, &packet, 1, &error); g_assert(!error); antispoof = pg_antispoof_new("antispoof", 1, 1, EAST_SIDE, inside_mac, &error); g_assert(!error); col_east = pg_collect_new("col_east", 1, 1, &error); g_assert(!error); pg_brick_link(gen_west, antispoof, &error); g_assert(!error); pg_brick_link(antispoof, col_east, &error); g_assert(!error); /* enable ARP antispoof with the correct IP */ pg_antispoof_arp_enable(antispoof, inside_ip); /* replay traffic */ for (i = 0; i < pkts_nb; i++) { packet = build_packet(pkts[i], pkts_size[i]); pg_brick_poll(gen_west, &packet_count, &error); g_assert(!error); g_assert(packet_count == 1); filtered_pkts = pg_brick_west_burst_get(col_east, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 1); pg_packets_free(filtered_pkts, filtered_pkts_mask); rte_pktmbuf_free(packet); } /* set another IP, should not pass */ inside_ip = htobe32(IPv4(42, 0, 42, 0)); pg_antispoof_arp_enable(antispoof, inside_ip); /* replay traffic */ for (i = 0; i < pkts_nb; i++) { packet = build_packet(pkts[i], pkts_size[i]); pg_brick_poll(gen_west, &packet_count, &error); g_assert(!error); g_assert(packet_count == 1); filtered_pkts = pg_brick_west_burst_get(col_east, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 0); pg_packets_free(filtered_pkts, filtered_pkts_mask); rte_pktmbuf_free(packet); } pg_brick_destroy(gen_west); pg_brick_destroy(antispoof); pg_brick_destroy(col_east); }
static void test_icmp_pmtud(void) { struct pg_error *error = NULL; struct pg_brick *pmtud; struct pg_brick *col_east; struct pg_brick *col_west; /* struct pg_brick *print_east; */ /* struct pg_brick *print_west; */ /* FILE *east_file = fopen("east_file.pcap", "w+"); */ /* FILE *west_file = fopen("west_file.pcap", "w+"); */ struct rte_mbuf **pkts; struct rte_mbuf *tmp; uint64_t pkts_mask; struct ether_addr eth_s = {{2}}; struct ether_addr eth_d = {{4}}; pkts = pg_packets_append_ether(pg_packets_create(pg_mask_firsts(64)), pg_mask_firsts(64), ð_s, ð_d, ETHER_TYPE_IPv4); pg_packets_append_ipv4(pkts, pg_mask_firsts(64), 1, 2, 0, 0); /* 10 caracter with the \0*/ pg_packets_append_str(pkts, pg_mask_firsts(64), "siegzeon "); pg_packets_append_blank(pkts, pg_mask_firsts(32), 421 - sizeof(struct ipv4_hdr) - sizeof(struct ether_hdr)); pg_packets_append_blank(pkts, pg_mask_firsts(64) & ~pg_mask_firsts(32), 420 - sizeof(struct ipv4_hdr) - sizeof(struct ether_hdr)); /* * [col_west] -- [print_west] -- [pmtud] -- [print_east] -- [col_east] */ pmtud = pg_pmtud_new("pmtud", PG_WEST_SIDE, 430, &error); g_assert(!error); col_east = pg_collect_new("col_east", &error); g_assert(col_east); g_assert(!error); col_west = pg_collect_new("col_west", &error); g_assert(!error); g_assert(col_west); /* print_east = pg_print_new("print_east", 1, 1, east_file, */ /* PG_PRINT_FLAG_PCAP, NULL, &error); */ /* g_assert(col_east); */ /* g_assert(!error); */ /* print_west = pg_print_new("print_west", 1, 1, west_file, */ /* PG_PRINT_FLAG_PCAP, NULL, &error); */ /* g_assert(!error); */ /* g_assert(col_west); */ /* pg_brick_chained_links(&error, col_west, print_west, pmtud, */ /* print_east, col_east); */ /* g_assert(!error); */ pg_brick_chained_links(&error, col_west, pmtud, col_east); g_assert(!error); pg_brick_burst_to_east(pmtud, 0, pkts, pg_mask_firsts(64), &error); g_assert(!error); pg_brick_west_burst_get(col_east, &pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(pkts_mask) == 32); g_assert(pg_brick_pkts_count_get(pmtud, PG_EAST_SIDE) == 64); g_assert(pg_brick_pkts_count_get(col_east, PG_EAST_SIDE) == 32); g_assert(pg_brick_pkts_count_get(col_west, PG_WEST_SIDE) == 32); tmp = pg_brick_east_burst_get(col_west, &pkts_mask, &error)[0]; g_assert(pkts_mask == 1); g_assert(tmp); pg_brick_destroy(col_west); pg_brick_destroy(pmtud); pg_brick_destroy(col_east); pg_packets_free(pkts, pg_mask_firsts(64)); /* fclose(east_file); */ /* fclose(west_file); */ g_free(pkts); return; }
static void firewall_replay(const unsigned char *pkts[], int pkts_nb, int *pkts_size) { struct pg_brick *gen_west, *gen_east; struct pg_brick *fw; struct pg_brick *col_west, *col_east; struct pg_error *error = NULL; uint16_t i, packet_count; struct rte_mbuf *packet; struct ether_hdr *eth; uint64_t filtered_pkts_mask; struct rte_mbuf **filtered_pkts; struct ether_addr tmp_addr; int ret; /* have some collectors and generators on each sides * [collector]--[generator>]--[firewall]--[<generator]--[collector] * 10.0.2.15 173.194.40.111 * 8:0:27:b6:5:16 52:54:0:12:35:2 */ gen_west = pg_packetsgen_new("gen_west", 1, 1, EAST_SIDE, &packet, 1, &error); g_assert(!error); gen_east = pg_packetsgen_new("gen_east", 1, 1, WEST_SIDE, &packet, 1, &error); g_assert(!error); fw = pg_firewall_new("fw", 1, 1, PG_NONE, &error); g_assert(!error); col_west = pg_collect_new("col_west", 1, 1, &error); g_assert(!error); col_east = pg_collect_new("col_east", 1, 1, &error); g_assert(!error); pg_brick_link(col_west, gen_west, &error); g_assert(!error); pg_brick_link(gen_west, fw, &error); g_assert(!error); pg_brick_link(fw, gen_east, &error); g_assert(!error); pg_brick_link(gen_east, col_east, &error); g_assert(!error); /* open all traffic of 10.0.2.15 from the west side of the firewall * returning traffic should be allowed due to STATEFUL option */ ret = pg_firewall_rule_add(fw, "src host 10.0.2.15", WEST_SIDE, 1, &error); g_assert(!error); g_assert(ret == 0); ret = pg_firewall_reload(fw, &error); g_assert(!error); g_assert(ret < 0); /* replay traffic */ for (i = 0; i < pkts_nb; i++) { struct ip *ip; packet = build_packet(pkts[i], pkts_size[i]); eth = rte_pktmbuf_mtod(packet, struct ether_hdr*); ip = (struct ip *)(eth + 1); if (ip->ip_src.s_addr == inet_addr("10.0.2.15")) { pg_brick_poll(gen_west, &packet_count, &error); g_assert(!error); g_assert(packet_count == 1); filtered_pkts = pg_brick_west_burst_get(col_east, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 1); /* check eth source address */ eth = rte_pktmbuf_mtod(filtered_pkts[0], struct ether_hdr*); pg_scan_ether_addr(&tmp_addr, "08:00:27:b6:05:16"); g_assert(is_same_ether_addr(ð->s_addr, &tmp_addr)); /* check ip source address */ ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("10.0.2.15")); } else if (ip->ip_src.s_addr == inet_addr("173.194.40.111")) {
static void firewall_filter_rules(enum pg_side dir) { struct pg_brick *gen; struct pg_brick *fw; struct pg_brick *col; struct pg_error *error = NULL; uint16_t i; int ret; static uint16_t nb = 30; struct rte_mbuf *packets[nb]; uint64_t filtered_pkts_mask; struct rte_mbuf **filtered_pkts; uint64_t bit; uint16_t packet_count; struct ip *ip; struct ether_hdr *eth; /* create and connect 3 bricks: generator -> firewall -> collector */ gen = pg_packetsgen_new("gen", 2, 2, pg_flip_side(dir), packets, nb, &error); g_assert(!error); fw = pg_firewall_new("fw", 2, 2, PG_NONE, &error); g_assert(!error); col = pg_collect_new("col", 2, 2, &error); g_assert(!error); /* revert link if needed */ if (dir == WEST_SIDE) { pg_brick_link(gen, fw, &error); g_assert(!error); pg_brick_link(fw, col, &error); g_assert(!error); } else { pg_brick_link(col, fw, &error); g_assert(!error); pg_brick_link(fw, gen, &error); g_assert(!error); } /* build some UDP packets mixed sources */ for (i = 0; i < nb; i++) switch (i % 3) { case 0: packets[i] = build_ip_packet("10.0.0.1", "10.0.0.255", i); break; case 1: packets[i] = build_ip_packet("10.0.0.2", "10.0.0.255", i); break; case 2: packets[i] = build_ip_packet("10.0.0.3", "10.0.0.255", i); break; } /* configure firewall to allow traffic from 10.0.0.1 */ ret = pg_firewall_rule_add(fw, "src host 10.0.0.1", dir, 0, &error); g_assert(!error); g_assert(ret == 0); ret = pg_firewall_reload(fw, &error); g_assert(ret < 0); g_assert(!error); /* let's burst ! */ pg_brick_poll(gen, &packet_count, &error); g_assert(!error); g_assert(packet_count == nb); /* check collect brick */ if (dir == WEST_SIDE) filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask, &error); else filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == nb / 3); for (; filtered_pkts_mask;) { pg_low_bit_iterate_full(filtered_pkts_mask, bit, i); g_assert(i % 3 == 0); eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*); ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1")); } /* now allow packets from 10.0.0.2 */ ret = pg_firewall_rule_add(fw, "src host 10.0.0.2", dir, 0, &error); g_assert(!error); g_assert(ret == 0); ret = pg_firewall_reload(fw, &error); g_assert(ret < 0); g_assert(!error); /* let it goooo */ pg_brick_poll(gen, &packet_count, &error); g_assert(!error); g_assert(packet_count == nb); /* check collect brick */ if (dir == WEST_SIDE) filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask, &error); else filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == nb * 2 / 3); for (; filtered_pkts_mask;) { pg_low_bit_iterate_full(filtered_pkts_mask, bit, i); g_assert(i % 3 == 0 || i % 3 == 1); eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*); ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1") || ip->ip_src.s_addr == inet_addr("10.0.0.2")); } /* test that flush really blocks */ pg_firewall_rule_flush(fw); ret = pg_firewall_reload(fw, &error); g_assert(!error); g_assert(ret < 0); /* let it goooo */ pg_brick_poll(gen, &packet_count, &error); g_assert(!error); g_assert(packet_count == nb); /* check collect brick */ if (dir == WEST_SIDE) filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask, &error); else filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 0); /* flush and only allow packets from 10.0.0.2 */ pg_firewall_rule_flush(fw); ret = pg_firewall_rule_add(fw, "src host 10.0.0.2", dir, 0, &error); g_assert(!error); g_assert(ret == 0); ret = pg_firewall_reload(fw, &error); g_assert(ret < 0); g_assert(!error); /* let it goooo */ pg_brick_poll(gen, &packet_count, &error); g_assert(!error); g_assert(packet_count == nb); /* check collect brick */ if (dir == WEST_SIDE) filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask, &error); else filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == nb / 3); for (; filtered_pkts_mask;) { pg_low_bit_iterate_full(filtered_pkts_mask, bit, i); g_assert(i % 3 == 1); eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*); ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.2")); } /* flush and make two rules in one */ pg_firewall_rule_flush(fw); ret = pg_firewall_rule_add(fw, "src host (10.0.0.1 or 10.0.0.2)", dir, 0, &error); g_assert(!error); g_assert(ret == 0); ret = pg_firewall_reload(fw, &error); g_assert(ret < 0); g_assert(!error); /* let it goooo */ pg_brick_poll(gen, &packet_count, &error); g_assert(!error); g_assert(packet_count == nb); /* check collect brick */ if (dir == WEST_SIDE) filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask, &error); else filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == nb * 2 / 3); for (; filtered_pkts_mask;) { pg_low_bit_iterate_full(filtered_pkts_mask, bit, i); g_assert(i % 3 == 0 || i % 3 == 1); eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*); ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1") || ip->ip_src.s_addr == inet_addr("10.0.0.2")); } /* flush and revert rules, packets should not pass */ pg_firewall_rule_flush(fw); ret = pg_firewall_rule_add(fw, "src host (10.0.0.1)", pg_flip_side(dir), 0, &error); g_assert(!error); g_assert(ret == 0); ret = pg_firewall_reload(fw, &error); g_assert(ret < 0); g_assert(!error); /* let it goooo */ pg_brick_poll(gen, &packet_count, &error); g_assert(!error); g_assert(packet_count == nb); /* check collect brick */ if (dir == WEST_SIDE) filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask, &error); else filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 0); /* flush and allow packets from both sides */ pg_firewall_rule_flush(fw); ret = pg_firewall_rule_add(fw, "src host (10.0.0.1)", MAX_SIDE, 0, &error); g_assert(!error); g_assert(ret == 0); ret = pg_firewall_reload(fw, &error); g_assert(ret < 0); g_assert(!error); /* let it goooo */ pg_brick_poll(gen, &packet_count, &error); g_assert(!error); g_assert(packet_count == nb); if (dir == WEST_SIDE) filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask, &error); else filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == nb / 3); for (; filtered_pkts_mask;) { pg_low_bit_iterate_full(filtered_pkts_mask, bit, i); g_assert(i % 3 == 0); eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*); ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1")); } /* inverse generator and collector to test both sides */ pg_brick_unlink(fw, &error); g_assert(!error); if (dir == WEST_SIDE) { pg_brick_link(col, fw, &error); g_assert(!error); pg_brick_link(fw, gen, &error); g_assert(!error); } else { pg_brick_link(gen, fw, &error); g_assert(!error); pg_brick_link(fw, col, &error); g_assert(!error); } /* let it goooo */ pg_brick_poll(gen, &packet_count, &error); g_assert(!error); g_assert(packet_count == nb); if (dir == WEST_SIDE) filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask, &error); else filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == nb / 3); for (; filtered_pkts_mask;) { pg_low_bit_iterate_full(filtered_pkts_mask, bit, i); g_assert(i % 3 == 0); eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*); ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1")); } /* clean */ for (i = 0; i < nb; i++) rte_pktmbuf_free(packets[i]); pg_brick_destroy(gen); pg_brick_destroy(fw); pg_brick_destroy(col); }
/* check eth source address */ eth = rte_pktmbuf_mtod(filtered_pkts[0], struct ether_hdr*); pg_scan_ether_addr(&tmp_addr, "08:00:27:b6:05:16"); g_assert(is_same_ether_addr(ð->s_addr, &tmp_addr)); /* check ip source address */ ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("10.0.2.15")); } else if (ip->ip_src.s_addr == inet_addr("173.194.40.111")) { pg_brick_poll(gen_east, &packet_count, &error); g_assert(!error); g_assert(packet_count == 1); filtered_pkts = pg_brick_east_burst_get(col_west, &filtered_pkts_mask, &error); g_assert(!error); g_assert(pg_mask_count(filtered_pkts_mask) == 1); /* check eth source address */ eth = rte_pktmbuf_mtod(filtered_pkts[0], struct ether_hdr*); pg_scan_ether_addr(&tmp_addr, "52:54:00:12:35:02"); g_assert(is_same_ether_addr(ð->s_addr, &tmp_addr)); /* check ip source address */ ip = (struct ip *)(eth + 1); g_assert(ip->ip_src.s_addr == inet_addr("173.194.40.111")); } else g_assert(0); rte_pktmbuf_free(packet); /* ensure that connexion is tracked even when reloading */ ret = pg_firewall_rule_add(fw, "src host 6.6.6.6", WEST_SIDE, 0,