Exemplo n.º 1
0
static void test_antispoof_rarp(void)
{
#	include "rarp.c"
	const unsigned char *pkts[] = {pkt1};
	int pkts_size[] = {15};
	uint16_t pkts_nb = 1;
	struct ether_addr inside_mac;
	struct pg_brick *gen_west;
	struct pg_brick *antispoof;
	struct pg_brick *col_east;
	struct pg_error *error = NULL;
	uint16_t packet_count;
	uint16_t i;
	struct rte_mbuf *packet;
	uint64_t filtered_pkts_mask;

	pg_scan_ether_addr(&inside_mac, "00:23:df:ff:c9:23");

	/* [generator>]--[antispoof]--[collector] */
	gen_west = pg_packetsgen_new("gen_west", 1, 1, EAST_SIDE,
				     &packet, 1, &error);
	g_assert(!error);
	antispoof = pg_antispoof_new("antispoof", 1, 1, EAST_SIDE,
				     inside_mac, &error);
	g_assert(!error);
	col_east = pg_collect_new("col_east", 1, 1, &error);
	g_assert(!error);
	pg_brick_link(gen_west, antispoof, &error);
	g_assert(!error);
	pg_brick_link(antispoof, col_east, &error);
	g_assert(!error);

	/* replay traffic */
	for (i = 0; i < pkts_nb; i++) {
		packet = build_packet(pkts[i], pkts_size[i]);
		pg_brick_poll(gen_west, &packet_count, &error);
		g_assert(!error);
		g_assert(packet_count == 1);
		pg_brick_west_burst_get(col_east, &filtered_pkts_mask, &error);
		g_assert(!error);
		g_assert(pg_mask_count(filtered_pkts_mask) == 0);
		rte_pktmbuf_free(packet);
	}
	pg_brick_destroy(gen_west);
	pg_brick_destroy(antispoof);
	pg_brick_destroy(col_east);

}
Exemplo n.º 2
0
static void test_sorting_pmtud(void)
{
	struct pg_error *error = NULL;
	struct pg_brick *pmtud;
	struct pg_brick *col_east;
	struct rte_mbuf **pkts;
	uint64_t pkts_mask;
	struct ether_addr eth = {{0}};

	pkts = pg_packets_append_ether(pg_packets_create(pg_mask_firsts(64)),
				       pg_mask_firsts(64),  &eth, &eth,
				       ETHER_TYPE_IPv4);
	pg_packets_append_ipv4(pkts, pg_mask_firsts(64), 1, 2, 0, 0);
	

	pg_packets_append_blank(pkts,
				pg_mask_firsts(32),
				431 - sizeof(struct ipv4_hdr) -
				sizeof(struct ether_hdr));
	pg_packets_append_blank(pkts,
				pg_mask_firsts(64) & ~pg_mask_firsts(32),
				430 - sizeof(struct ipv4_hdr) -
				sizeof(struct ether_hdr));
	pmtud = pg_pmtud_new("pmtud", PG_WEST_SIDE, 430, &error);
	g_assert(!error);
	col_east = pg_collect_new("col_east", &error);
	g_assert(!error);
	pg_brick_link(pmtud, col_east, &error);
	g_assert(!error);

	pg_brick_burst(pmtud, PG_WEST_SIDE, 0, pkts, pg_mask_firsts(64), &error);
	g_assert(!error);

	pg_brick_west_burst_get(col_east, &pkts_mask, &error);
	g_assert(!error);
	g_assert(pg_mask_count(pkts_mask) == 32);

	pg_brick_destroy(pmtud);
	pg_brick_destroy(col_east);
	pg_packets_free(pkts, pg_mask_firsts(64));
	g_free(pkts);
}
Exemplo n.º 3
0
static void test_sorting_pmtud_df(void)
{
	struct pg_error *error = NULL;
	struct pg_brick *pmtud;
	struct pg_brick *col_east;
	struct rte_mbuf **pkts;
	uint64_t pkts_mask;
	struct ether_addr eth = {{0}};
	uint64_t buff[4] = {0, 0, 0, 0};

	pkts = pg_packets_append_ether(pg_packets_create(pg_mask_firsts(64)),
				       pg_mask_firsts(64),  &eth, &eth,
				       ETHER_TYPE_IPv4);
	pg_packets_append_ipv4(pkts, pg_mask_firsts(32), 1, 2, 0, 0);
	

	/* Initialise ip header to 0, this ensure that DF flag is not set*/
	pg_packets_append_buf(pkts,
			      pg_mask_firsts(64) & ~pg_mask_firsts(32),
			      buff, sizeof(uint64_t) * 4);
	pg_packets_append_blank(pkts, pg_mask_firsts(64), 400);
	pmtud = pg_pmtud_new("pmtud", PG_WEST_SIDE, 430, &error);
	g_assert(!error);
	col_east = pg_collect_new("col_east", &error);
	g_assert(!error);
	pg_brick_link(pmtud, col_east, &error);
	g_assert(!error);

	pg_brick_burst(pmtud, PG_WEST_SIDE, 0, pkts, pg_mask_firsts(64), &error);
	g_assert(!error);

	pg_brick_west_burst_get(col_east, &pkts_mask, &error);
	g_assert(!error);
	g_assert(pg_mask_count(pkts_mask) == 32);

	pg_brick_destroy(pmtud);
	pg_brick_destroy(col_east);
	pg_packets_free(pkts, pg_mask_firsts(64));
	g_free(pkts);
}
Exemplo n.º 4
0
static void test_brick_flow_west(void)
{
	struct pg_brick_config *config = pg_brick_config_new("mybrick", 4, 4);
	struct pg_brick *brick1, *brick2, *collect_west, *collect_east;
	struct rte_mbuf mbufs[NB_PKTS];
	struct rte_mbuf **result_pkts;
	struct rte_mbuf *pkts[NB_PKTS];
	uint16_t i;
	uint64_t pkts_mask;
	struct pg_error *error = NULL;

	/* prepare the packets to send */
	for (i = 0; i < NB_PKTS; i++) {
		mbufs[i].udata64 = i;
		pkts[i] = &mbufs[i];
	}

	/* create a chain of a few nop brick with collectors on each sides */
	brick1 = pg_brick_new("nop", config, &error);
	g_assert(!error);
	brick2 = pg_brick_new("nop", config, &error);
	g_assert(!error);
	collect_west = pg_brick_new("collect", config, &error);
	g_assert(!error);
	g_assert(collect_west);
	collect_east = pg_brick_new("collect", config, &error);
	g_assert(!error);
	g_assert(collect_east);

	pg_brick_link(collect_west, brick1, &error);
	g_assert(!error);
	pg_brick_link(brick1, brick2, &error);
	g_assert(!error);
	pg_brick_link(brick2, collect_east, &error);
	g_assert(!error);

	/* send a pkts to the west from the eastest nope brick */
	pg_brick_burst_to_west(brick2, 0, pkts, NB_PKTS,
			       pg_mask_firsts(NB_PKTS), &error);
	g_assert(!error);

	/* check pkts counter */
	g_assert(pg_brick_pkts_count_get(collect_east, WEST_SIDE) == 0);
	g_assert(pg_brick_pkts_count_get(collect_east, EAST_SIDE) == 0);
	g_assert(pg_brick_pkts_count_get(collect_west, WEST_SIDE) == 3);
	g_assert(pg_brick_pkts_count_get(collect_west, EAST_SIDE) == 0);
	g_assert(pg_brick_pkts_count_get(brick1, WEST_SIDE) == 3);
	g_assert(pg_brick_pkts_count_get(brick1, EAST_SIDE) == 0);
	g_assert(pg_brick_pkts_count_get(brick2, WEST_SIDE) == 3);
	g_assert(pg_brick_pkts_count_get(brick2, EAST_SIDE) == 0);

	/* check no packet ended on the east */
	result_pkts = pg_brick_west_burst_get(collect_east, &pkts_mask, &error);
	g_assert(!error);
	g_assert(!pkts_mask);
	g_assert(!result_pkts);
	result_pkts = pg_brick_east_burst_get(collect_east, &pkts_mask, &error);
	g_assert(!error);
	g_assert(!pkts_mask);
	g_assert(!result_pkts);

	/* collect pkts on the west */
	result_pkts = pg_brick_west_burst_get(collect_west, &pkts_mask, &error);
	g_assert(!error);
	g_assert(!pkts_mask);
	g_assert(!result_pkts);

	result_pkts = pg_brick_east_burst_get(collect_west, &pkts_mask, &error);
	g_assert(!error);
	g_assert(pkts_mask == pg_mask_firsts(NB_PKTS));
	g_assert(result_pkts);
	for (i = 0; i < NB_PKTS; i++)
		g_assert(result_pkts[i]->udata64 == i);

	/* break the chain */
	pg_brick_unlink(brick1, &error);
	g_assert(!error);
	pg_brick_unlink(brick2, &error);
	g_assert(!error);
	pg_brick_unlink(collect_west, &error);
	g_assert(!error);
	pg_brick_unlink(collect_east, &error);
	g_assert(!error);

	/* destroy */
	pg_brick_decref(brick1, &error);
	g_assert(!error);
	pg_brick_decref(brick2, &error);
	g_assert(!error);
	pg_brick_decref(collect_west, &error);
	g_assert(!error);
	pg_brick_decref(collect_east, &error);
	g_assert(!error);

	pg_brick_config_free(config);
}
Exemplo n.º 5
0
static void test_queue_reset(void)
{
#	define NB_PKTS 64
	struct pg_error *error = NULL;
	struct pg_brick *queue1, *queue2, *collect;
	struct rte_mbuf **result_pkts;
	struct rte_mbuf *pkts[NB_PKTS];
	uint64_t pkts_mask, i, j;
	uint16_t count = 0;
	struct rte_mempool *mbuf_pool = pg_get_mempool();

	/**
	 * Burst packets in queue1 and test reset of queue1
	 * [queue1] ~ [queue2]----[collect]
	 */
	queue1 = pg_queue_new("q1", 10, &error);
	CHECK_ERROR(error);
	queue2 = pg_queue_new("q2", 10, &error);
	CHECK_ERROR(error);
	collect = pg_collect_new("collect", 1, 1, &error);
	CHECK_ERROR(error);

	pg_brick_link(queue2, collect, &error);
	CHECK_ERROR(error);
	g_assert(!pg_queue_friend(queue1, queue2, &error));
	CHECK_ERROR(error);

	for (i = 0; i < NB_PKTS; i++) {
		pkts[i] = rte_pktmbuf_alloc(mbuf_pool);
		g_assert(pkts[i]);
		pkts[i]->udata64 = i;
		pg_set_mac_addrs(pkts[i],
				 "F0:F1:F2:F3:F4:F5",
				 "E0:E1:E2:E3:E4:E5");
	}

	for (j = 0; j < 100; j++) {
		for (i = 0; i < NB_PKTS; i++)
			pkts[i]->udata64 = i * j;
		/* burst and reset */
		pg_brick_burst_to_east(queue1, 0, pkts, pg_mask_firsts(NB_PKTS),
				       &error);
		CHECK_ERROR(error);
		g_assert(pg_queue_pressure(queue1) > 0);
		g_assert(!pg_brick_reset(queue1, &error));
		g_assert(pg_queue_get_friend(queue1) == NULL);
		g_assert(pg_queue_get_friend(queue2) == NULL);
		g_assert(pg_queue_pressure(queue1) == 0);
		g_assert(pg_queue_pressure(queue2) == 0);
		pg_brick_poll(queue2, &count, &error);
		g_assert(!error);
		g_assert(count == 0);

		/* refriend and burst ok */
		g_assert(!pg_queue_friend(queue1, queue2, &error));
		g_assert(!error);
		g_assert(pg_queue_are_friend(queue1, queue2));
		g_assert(!error);

		pg_brick_burst_to_east(queue1, 0, pkts, pg_mask_firsts(NB_PKTS),
				       &error);
		CHECK_ERROR(error);
		g_assert(pg_queue_pressure(queue1) > 0);
		pg_brick_poll(queue2, &count, &error);
		g_assert(count == NB_PKTS);
		result_pkts = pg_brick_west_burst_get(collect, &pkts_mask,
						      &error);
		CHECK_ERROR(error);
		g_assert(pkts_mask == pg_mask_firsts(NB_PKTS));
		for (i = 0; i < NB_PKTS; i++) {
			g_assert(result_pkts[i]);
			g_assert(result_pkts[i]->udata64 == i * j);
		}
		pg_brick_reset(collect, &error);
		CHECK_ERROR(error);
	}

	/* clean */
	for (i = 0; i < NB_PKTS; i++)
		rte_pktmbuf_free(pkts[i]);
	pg_brick_decref(queue1, &error);
	CHECK_ERROR(error);
	pg_brick_decref(queue2, &error);
	CHECK_ERROR(error);
	pg_brick_decref(collect, &error);
	CHECK_ERROR(error);
#	undef NB_PKTS
}
Exemplo n.º 6
0
static void test_pg_antispoof_arp_disable(void)
{
#	include "arp_request.c"
	const unsigned char *pkts[] = {pkt1};
	int pkts_size[] = {42};
	uint16_t pkts_nb = 1;
	struct ether_addr inside_mac;
	uint32_t inside_ip;
	struct pg_brick *gen_west;
	struct pg_brick *antispoof;
	struct pg_brick *col_east;
	struct pg_error *error = NULL;
	uint16_t packet_count;
	uint16_t i;
	struct rte_mbuf *packet;
	uint64_t filtered_pkts_mask;
	struct rte_mbuf **filtered_pkts;

	pg_scan_ether_addr(&inside_mac, "00:e0:81:d5:02:91");
	inside_ip = htobe32(IPv4(0, 0, 0, 42));

	/* [generator>]--[antispoof]--[collector] */
	gen_west = pg_packetsgen_new("gen_west", 1, 1, EAST_SIDE,
				     &packet, 1, &error);
	g_assert(!error);
	antispoof = pg_antispoof_new("antispoof", 1, 1, EAST_SIDE,
				     inside_mac, &error);
	g_assert(!error);
	col_east = pg_collect_new("col_east", 1, 1, &error);
	g_assert(!error);
	pg_brick_link(gen_west, antispoof, &error);
	g_assert(!error);
	pg_brick_link(antispoof, col_east, &error);
	g_assert(!error);

	/* enable ARP antispoof with a wrong IP */
	pg_antispoof_arp_enable(antispoof, inside_ip);

	/* replay traffic */
	for (i = 0; i < pkts_nb; i++) {
		packet = build_packet(pkts[i], pkts_size[i]);
		pg_brick_poll(gen_west, &packet_count, &error);
		g_assert(!error);
		g_assert(packet_count == 1);
		filtered_pkts = pg_brick_west_burst_get(col_east,
							&filtered_pkts_mask,
							&error);
		g_assert(!error);
		g_assert(pg_mask_count(filtered_pkts_mask) == 0);
		pg_packets_free(filtered_pkts, filtered_pkts_mask);
		rte_pktmbuf_free(packet);
	}

	/* disable ARP antispoof, should now pass */
	pg_antispoof_arp_disable(antispoof);

	/* replay traffic */
	for (i = 0; i < pkts_nb; i++) {
		packet = build_packet(pkts[i], pkts_size[i]);
		pg_brick_poll(gen_west, &packet_count, &error);
		g_assert(!error);
		g_assert(packet_count == 1);
		filtered_pkts = pg_brick_west_burst_get(col_east,
							&filtered_pkts_mask,
							&error);
		g_assert(!error);
		g_assert(pg_mask_count(filtered_pkts_mask) == 1);
		pg_packets_free(filtered_pkts, filtered_pkts_mask);
		rte_pktmbuf_free(packet);
	}

	pg_brick_destroy(gen_west);
	pg_brick_destroy(antispoof);
	pg_brick_destroy(col_east);
}
Exemplo n.º 7
0
static void test_antispoof_generic(const unsigned char **pkts,
				   int *pkts_size,
				   uint16_t pkts_nb,
				   struct ether_addr inside_mac,
				   uint32_t inside_ip)
{
	struct pg_brick *gen_west;
	struct pg_brick *antispoof;
	struct pg_brick *col_east;
	struct pg_error *error = NULL;
	uint16_t packet_count;
	uint16_t i;
	struct rte_mbuf *packet;
	uint64_t filtered_pkts_mask;
	struct rte_mbuf **filtered_pkts;

	/* [generator>]--[antispoof]--[collector] */
	gen_west = pg_packetsgen_new("gen_west", 1, 1, EAST_SIDE,
				     &packet, 1, &error);
	g_assert(!error);
	antispoof = pg_antispoof_new("antispoof", 1, 1, EAST_SIDE,
				     inside_mac, &error);
	g_assert(!error);
	col_east = pg_collect_new("col_east", 1, 1, &error);
	g_assert(!error);
	pg_brick_link(gen_west, antispoof, &error);
	g_assert(!error);
	pg_brick_link(antispoof, col_east, &error);
	g_assert(!error);

	/* enable ARP antispoof with the correct IP */
	pg_antispoof_arp_enable(antispoof, inside_ip);

	/* replay traffic */
	for (i = 0; i < pkts_nb; i++) {
		packet = build_packet(pkts[i], pkts_size[i]);
		pg_brick_poll(gen_west, &packet_count, &error);
		g_assert(!error);
		g_assert(packet_count == 1);
		filtered_pkts = pg_brick_west_burst_get(col_east,
							&filtered_pkts_mask,
							&error);
		g_assert(!error);
		g_assert(pg_mask_count(filtered_pkts_mask) == 1);
		pg_packets_free(filtered_pkts, filtered_pkts_mask);
		rte_pktmbuf_free(packet);
	}

	/* set another IP, should not pass */
	inside_ip = htobe32(IPv4(42, 0, 42, 0));
	pg_antispoof_arp_enable(antispoof, inside_ip);

	/* replay traffic */
	for (i = 0; i < pkts_nb; i++) {
		packet = build_packet(pkts[i], pkts_size[i]);
		pg_brick_poll(gen_west, &packet_count, &error);
		g_assert(!error);
		g_assert(packet_count == 1);
		filtered_pkts = pg_brick_west_burst_get(col_east,
							&filtered_pkts_mask,
							&error);
		g_assert(!error);
		g_assert(pg_mask_count(filtered_pkts_mask) == 0);
		pg_packets_free(filtered_pkts, filtered_pkts_mask);
		rte_pktmbuf_free(packet);
	}

	pg_brick_destroy(gen_west);
	pg_brick_destroy(antispoof);
	pg_brick_destroy(col_east);
}
Exemplo n.º 8
0
static void test_icmp_pmtud(void)
{
	struct pg_error *error = NULL;
	struct pg_brick *pmtud;
	struct pg_brick *col_east;
	struct pg_brick *col_west;
	/* struct pg_brick *print_east; */
	/* struct pg_brick *print_west; */
	/* FILE *east_file = fopen("east_file.pcap", "w+"); */
	/* FILE *west_file = fopen("west_file.pcap", "w+"); */
	struct rte_mbuf **pkts;
	struct rte_mbuf *tmp;
	uint64_t pkts_mask;
	struct ether_addr eth_s = {{2}};
	struct ether_addr eth_d = {{4}};

	pkts = pg_packets_append_ether(pg_packets_create(pg_mask_firsts(64)),
				       pg_mask_firsts(64),  &eth_s, &eth_d,
				       ETHER_TYPE_IPv4);
	pg_packets_append_ipv4(pkts, pg_mask_firsts(64), 1, 2, 0, 0);
	

	/* 10 caracter with the \0*/
	pg_packets_append_str(pkts, pg_mask_firsts(64), "siegzeon ");
	pg_packets_append_blank(pkts,
				pg_mask_firsts(32),
				421 - sizeof(struct ipv4_hdr) -
				sizeof(struct ether_hdr));
	pg_packets_append_blank(pkts,
				pg_mask_firsts(64) & ~pg_mask_firsts(32),
				420 - sizeof(struct ipv4_hdr) -
				sizeof(struct ether_hdr));

	/*
	 * [col_west] -- [print_west] -- [pmtud] -- [print_east] -- [col_east]
	 */

	pmtud = pg_pmtud_new("pmtud", PG_WEST_SIDE, 430, &error);
	g_assert(!error);
	col_east = pg_collect_new("col_east", &error);
	g_assert(col_east);
	g_assert(!error);
	col_west = pg_collect_new("col_west", &error);
	g_assert(!error);
	g_assert(col_west);

	/* print_east = pg_print_new("print_east", 1, 1, east_file, */
	/* 			PG_PRINT_FLAG_PCAP,  NULL, &error); */
	/* g_assert(col_east); */
	/* g_assert(!error); */
	/* print_west = pg_print_new("print_west", 1, 1, west_file, */
	/* 			PG_PRINT_FLAG_PCAP, NULL, &error); */
	/* g_assert(!error); */
	/* g_assert(col_west); */


	/* pg_brick_chained_links(&error, col_west, print_west, pmtud, */
	/* 		       print_east, col_east); */
	/* g_assert(!error); */

	pg_brick_chained_links(&error, col_west, pmtud, col_east);
	g_assert(!error);

	pg_brick_burst_to_east(pmtud, 0, pkts, pg_mask_firsts(64), &error);
	g_assert(!error);

	pg_brick_west_burst_get(col_east, &pkts_mask, &error);
	g_assert(!error);
	g_assert(pg_mask_count(pkts_mask) == 32);

	g_assert(pg_brick_pkts_count_get(pmtud, PG_EAST_SIDE) == 64);
	g_assert(pg_brick_pkts_count_get(col_east, PG_EAST_SIDE) == 32);
	g_assert(pg_brick_pkts_count_get(col_west, PG_WEST_SIDE) == 32);
	tmp = pg_brick_east_burst_get(col_west, &pkts_mask, &error)[0];
	g_assert(pkts_mask == 1);
	g_assert(tmp);

	pg_brick_destroy(col_west);
	pg_brick_destroy(pmtud);
	pg_brick_destroy(col_east);
	pg_packets_free(pkts, pg_mask_firsts(64));
	/* fclose(east_file); */
	/* fclose(west_file); */
	g_free(pkts);
	return;
}
Exemplo n.º 9
0
static void firewall_replay(const unsigned char *pkts[],
			    int pkts_nb, int *pkts_size)
{
	struct pg_brick *gen_west, *gen_east;
	struct pg_brick *fw;
	struct pg_brick *col_west, *col_east;
	struct pg_error *error = NULL;
	uint16_t i, packet_count;
	struct rte_mbuf *packet;
	struct ether_hdr *eth;
	uint64_t filtered_pkts_mask;
	struct rte_mbuf **filtered_pkts;
	struct ether_addr tmp_addr;
	int ret;

	/* have some collectors and generators on each sides
	 * [collector]--[generator>]--[firewall]--[<generator]--[collector]
	 * 10.0.2.15                                         173.194.40.111
	 * 8:0:27:b6:5:16                                   52:54:0:12:35:2
	 */
	gen_west = pg_packetsgen_new("gen_west", 1, 1, EAST_SIDE, &packet, 1,
				  &error);
	g_assert(!error);
	gen_east = pg_packetsgen_new("gen_east", 1, 1, WEST_SIDE, &packet, 1,
				  &error);
	g_assert(!error);
	fw = pg_firewall_new("fw", 1, 1, PG_NONE, &error);
	g_assert(!error);
	col_west = pg_collect_new("col_west", 1, 1, &error);
	g_assert(!error);
	col_east = pg_collect_new("col_east", 1, 1, &error);
	g_assert(!error);
	pg_brick_link(col_west, gen_west, &error);
	g_assert(!error);
	pg_brick_link(gen_west, fw, &error);
	g_assert(!error);
	pg_brick_link(fw, gen_east, &error);
	g_assert(!error);
	pg_brick_link(gen_east, col_east, &error);
	g_assert(!error);

	/* open all traffic of 10.0.2.15 from the west side of the firewall
	 * returning traffic should be allowed due to STATEFUL option
	 */
	ret = pg_firewall_rule_add(fw, "src host 10.0.2.15", WEST_SIDE, 1, &error);
	g_assert(!error);
	g_assert(ret == 0);
	ret = pg_firewall_reload(fw, &error);
	g_assert(!error);
	g_assert(ret < 0);

	/* replay traffic */
	for (i = 0; i < pkts_nb; i++) {
		struct ip *ip;

		packet = build_packet(pkts[i], pkts_size[i]);
		eth = rte_pktmbuf_mtod(packet, struct ether_hdr*);
		ip = (struct ip *)(eth + 1);

		if (ip->ip_src.s_addr == inet_addr("10.0.2.15")) {
			pg_brick_poll(gen_west, &packet_count, &error);
			g_assert(!error);
			g_assert(packet_count == 1);
			filtered_pkts = pg_brick_west_burst_get(col_east,
				&filtered_pkts_mask, &error);
			g_assert(!error);
			g_assert(pg_mask_count(filtered_pkts_mask) == 1);
			/* check eth source address */
			eth = rte_pktmbuf_mtod(filtered_pkts[0],
					       struct ether_hdr*);
			pg_scan_ether_addr(&tmp_addr, "08:00:27:b6:05:16");
			g_assert(is_same_ether_addr(&eth->s_addr, &tmp_addr));
			/* check ip source address */
			ip = (struct ip *)(eth + 1);
			g_assert(ip->ip_src.s_addr == inet_addr("10.0.2.15"));
		} else if (ip->ip_src.s_addr == inet_addr("173.194.40.111")) {
Exemplo n.º 10
0
static void firewall_filter_rules(enum pg_side dir)
{
	struct pg_brick *gen;
	struct pg_brick *fw;
	struct pg_brick *col;
	struct pg_error *error = NULL;
	uint16_t i;
	int ret;
	static uint16_t nb = 30;
	struct rte_mbuf *packets[nb];
	uint64_t filtered_pkts_mask;
	struct rte_mbuf **filtered_pkts;
	uint64_t bit;
	uint16_t packet_count;
	struct ip *ip;
	struct ether_hdr *eth;

	/* create and connect 3 bricks: generator -> firewall -> collector */
	gen = pg_packetsgen_new("gen", 2, 2, pg_flip_side(dir), packets, nb, &error);
	g_assert(!error);
	fw = pg_firewall_new("fw", 2, 2, PG_NONE, &error);
	g_assert(!error);
	col = pg_collect_new("col", 2, 2, &error);
	g_assert(!error);
	/* revert link if needed */
	if (dir == WEST_SIDE) {
		pg_brick_link(gen, fw, &error);
		g_assert(!error);
		pg_brick_link(fw, col, &error);
		g_assert(!error);
	} else {
		pg_brick_link(col, fw, &error);
		g_assert(!error);
		pg_brick_link(fw, gen, &error);
		g_assert(!error);
	}

	/* build some UDP packets mixed sources */
	for (i = 0; i < nb; i++)
		switch (i % 3) {
		case 0:
			packets[i] = build_ip_packet("10.0.0.1",
						     "10.0.0.255", i);
			break;
		case 1:
			packets[i] = build_ip_packet("10.0.0.2",
						     "10.0.0.255", i);
			break;
		case 2:
			packets[i] = build_ip_packet("10.0.0.3",
						     "10.0.0.255", i);
			break;
		}

	/* configure firewall to allow traffic from 10.0.0.1 */
	ret = pg_firewall_rule_add(fw, "src host 10.0.0.1", dir, 0, &error);
	g_assert(!error);
	g_assert(ret == 0);
	ret = pg_firewall_reload(fw, &error);
	g_assert(ret < 0);
	g_assert(!error);

	/* let's burst ! */
	pg_brick_poll(gen, &packet_count, &error);
	g_assert(!error);
	g_assert(packet_count == nb);

	/* check collect brick */
	if (dir == WEST_SIDE)
		filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask,
						     &error);
	else
		filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask,
						     &error);
	g_assert(!error);
	g_assert(pg_mask_count(filtered_pkts_mask) == nb / 3);
	for (; filtered_pkts_mask;) {
		pg_low_bit_iterate_full(filtered_pkts_mask, bit, i);
		g_assert(i % 3 == 0);
		eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*);
		ip = (struct ip *)(eth + 1);
		g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1"));
	}

	/* now allow packets from 10.0.0.2 */
	ret = pg_firewall_rule_add(fw, "src host 10.0.0.2", dir, 0, &error);
	g_assert(!error);
	g_assert(ret == 0);
	ret = pg_firewall_reload(fw, &error);
	g_assert(ret < 0);
	g_assert(!error);

	/* let it goooo */
	pg_brick_poll(gen, &packet_count, &error);
	g_assert(!error);
	g_assert(packet_count == nb);

	/* check collect brick */
	if (dir == WEST_SIDE)
		filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask,
						     &error);
	else
		filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask,
						     &error);
	g_assert(!error);
	g_assert(pg_mask_count(filtered_pkts_mask) == nb * 2 / 3);
	for (; filtered_pkts_mask;) {
		pg_low_bit_iterate_full(filtered_pkts_mask, bit, i);
		g_assert(i % 3 == 0 || i % 3 == 1);
		eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*);
		ip = (struct ip *)(eth + 1);
		g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1") ||
			 ip->ip_src.s_addr == inet_addr("10.0.0.2"));
	}

	/* test that flush really blocks */
	pg_firewall_rule_flush(fw);
	ret = pg_firewall_reload(fw, &error);
	g_assert(!error);
	g_assert(ret < 0);

	/* let it goooo */
	pg_brick_poll(gen, &packet_count, &error);
	g_assert(!error);
	g_assert(packet_count == nb);

	/* check collect brick */
	if (dir == WEST_SIDE)
		filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask,
						     &error);
	else
		filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask,
						     &error);
	g_assert(!error);
	g_assert(pg_mask_count(filtered_pkts_mask) == 0);

	/* flush and only allow packets from 10.0.0.2 */
	pg_firewall_rule_flush(fw);
	ret = pg_firewall_rule_add(fw, "src host 10.0.0.2", dir, 0, &error);
	g_assert(!error);
	g_assert(ret == 0);
	ret = pg_firewall_reload(fw, &error);
	g_assert(ret < 0);
	g_assert(!error);

	/* let it goooo */
	pg_brick_poll(gen, &packet_count, &error);
	g_assert(!error);
	g_assert(packet_count == nb);

	/* check collect brick */
	if (dir == WEST_SIDE)
		filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask,
						     &error);
	else
		filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask,
						     &error);
	g_assert(!error);
	g_assert(pg_mask_count(filtered_pkts_mask) == nb / 3);
	for (; filtered_pkts_mask;) {
		pg_low_bit_iterate_full(filtered_pkts_mask, bit, i);
		g_assert(i % 3 == 1);
		eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*);
		ip = (struct ip *)(eth + 1);
		g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.2"));
	}

	/* flush and make two rules in one */
	pg_firewall_rule_flush(fw);
	ret = pg_firewall_rule_add(fw, "src host (10.0.0.1 or 10.0.0.2)", dir, 0,
				&error);
	g_assert(!error);
	g_assert(ret == 0);
	ret = pg_firewall_reload(fw, &error);
	g_assert(ret < 0);
	g_assert(!error);

	/* let it goooo */
	pg_brick_poll(gen, &packet_count, &error);
	g_assert(!error);
	g_assert(packet_count == nb);

	/* check collect brick */
	if (dir == WEST_SIDE)
		filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask,
						     &error);
	else
		filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask,
						     &error);
	g_assert(!error);
	g_assert(pg_mask_count(filtered_pkts_mask) == nb * 2 / 3);
	for (; filtered_pkts_mask;) {
		pg_low_bit_iterate_full(filtered_pkts_mask, bit, i);
		g_assert(i % 3 == 0 || i % 3 == 1);
		eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*);
		ip = (struct ip *)(eth + 1);
		g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1") ||
			 ip->ip_src.s_addr == inet_addr("10.0.0.2"));
	}

	/* flush and revert rules, packets should not pass */
	pg_firewall_rule_flush(fw);
	ret = pg_firewall_rule_add(fw, "src host (10.0.0.1)", pg_flip_side(dir), 0,
				&error);
	g_assert(!error);
	g_assert(ret == 0);
	ret = pg_firewall_reload(fw, &error);
	g_assert(ret < 0);
	g_assert(!error);

	/* let it goooo */
	pg_brick_poll(gen, &packet_count, &error);
	g_assert(!error);
	g_assert(packet_count == nb);

	/* check collect brick */
	if (dir == WEST_SIDE)
		filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask,
						     &error);
	else
		filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask,
						     &error);
	g_assert(!error);
	g_assert(pg_mask_count(filtered_pkts_mask) == 0);

	/* flush and allow packets from both sides */
	pg_firewall_rule_flush(fw);
	ret = pg_firewall_rule_add(fw, "src host (10.0.0.1)", MAX_SIDE, 0, &error);
	g_assert(!error);
	g_assert(ret == 0);
	ret = pg_firewall_reload(fw, &error);
	g_assert(ret < 0);
	g_assert(!error);

	/* let it goooo */
	pg_brick_poll(gen, &packet_count, &error);
	g_assert(!error);
	g_assert(packet_count == nb);

	if (dir == WEST_SIDE)
		filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask,
						     &error);
	else
		filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask,
						     &error);
	g_assert(!error);
	g_assert(pg_mask_count(filtered_pkts_mask) == nb / 3);
	for (; filtered_pkts_mask;) {
		pg_low_bit_iterate_full(filtered_pkts_mask, bit, i);
		g_assert(i % 3 == 0);
		eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*);
		ip = (struct ip *)(eth + 1);
		g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1"));
	}

	/* inverse generator and collector to test both sides */
	pg_brick_unlink(fw, &error);
	g_assert(!error);
	if (dir == WEST_SIDE) {
		pg_brick_link(col, fw, &error);
		g_assert(!error);
		pg_brick_link(fw, gen, &error);
		g_assert(!error);
	} else {
		pg_brick_link(gen, fw, &error);
		g_assert(!error);
		pg_brick_link(fw, col, &error);
		g_assert(!error);
	}

	/* let it goooo */
	pg_brick_poll(gen, &packet_count, &error);
	g_assert(!error);
	g_assert(packet_count == nb);

	if (dir == WEST_SIDE)
		filtered_pkts = pg_brick_west_burst_get(col, &filtered_pkts_mask,
						     &error);
	else
		filtered_pkts = pg_brick_east_burst_get(col, &filtered_pkts_mask,
						     &error);
	g_assert(!error);
	g_assert(pg_mask_count(filtered_pkts_mask) == nb / 3);
	for (; filtered_pkts_mask;) {
		pg_low_bit_iterate_full(filtered_pkts_mask, bit, i);
		g_assert(i % 3 == 0);
		eth = rte_pktmbuf_mtod(filtered_pkts[i], struct ether_hdr*);
		ip = (struct ip *)(eth + 1);
		g_assert(ip->ip_src.s_addr == inet_addr("10.0.0.1"));
	}

	/* clean */
	for (i = 0; i < nb; i++)
		rte_pktmbuf_free(packets[i]);
	pg_brick_destroy(gen);
	pg_brick_destroy(fw);
	pg_brick_destroy(col);
}