static int nfct_parse_labels(const struct nlattr *attr, struct nf_conntrack *ct) { uint16_t len = mnl_attr_get_payload_len(attr); struct nfct_bitmask *mask; uint32_t *bits; if (len == 0) return 0; mask = nfct_bitmask_new((len * CHAR_BIT) - 1); if (!mask) return -1; bits = mnl_attr_get_payload(attr); memcpy(mask->bits, bits, len); nfct_set_attr(ct, ATTR_CONNLABELS, mask); return 0; }
int main(void) { int ret, i; struct nf_conntrack *ct, *ct2, *tmp; struct nf_expect *exp, *tmp_exp; char data[256]; const char *val; int status; struct nfct_bitmask *b, *b2; srand(time(NULL)); /* initialize fake data for testing purposes */ for (i=0; i<sizeof(data); i++) data[i] = 0x01; ct = nfct_new(); if (!ct) { perror("nfct_new"); return 0; } tmp = nfct_new(); if (!tmp) { perror("nfct_new"); return 0; } printf("== test set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_set_attr(ct, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } b = nfct_bitmask_new(rand() & 0xffff); assert(b); b2 = nfct_bitmask_new(rand() & 0xffff); assert(b2); for (i=0; i<ATTR_MAX; i++) { switch (i) { case ATTR_CONNLABELS: nfct_set_attr(ct, i, b); break; case ATTR_CONNLABELS_MASK: nfct_set_attr(ct, i, b2); break; default: nfct_set_attr(ct, i, data); break; } } printf("== test get API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_get_attr(ct, i); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) { if (attr_is_readonly(i)) continue; switch(i) { /* These attributes require special handling */ case ATTR_HELPER_INFO: nfct_set_attr_l(ct, i, data, sizeof(data)); break; case ATTR_CONNLABELS: case ATTR_CONNLABELS_MASK: /* already set above */ break; default: data[0] = (uint8_t) i; nfct_set_attr(ct, i, data); } val = nfct_get_attr(ct, i); switch (i) { case ATTR_CONNLABELS: assert((void *) val == b); continue; case ATTR_CONNLABELS_MASK: assert((void *) val == b2); continue; } if (val[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, val[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } printf("== test copy API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_copy_attr(tmp, ct, i); exit(0); } else { wait(&status); eval_sigterm(status); } ret = fork(); if (ret == 0) { test_nfct_cmp_api(tmp, ct); exit(0); } else { wait(&status); eval_sigterm(status); } exp = nfexp_new(); if (!exp) { perror("nfexp_new"); return 0; } tmp_exp = nfexp_new(); if (!tmp_exp) { perror("nfexp_new"); return 0; } printf("== test expect set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) nfexp_set_attr(exp, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } for (i=0; i<ATTR_EXP_MAX; i++) nfexp_set_attr(exp, i, data); printf("== test expect get API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) nfexp_get_attr(exp, i); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate expect set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) { data[0] = (uint8_t) i; nfexp_set_attr(exp, i, data); val = nfexp_get_attr(exp, i); if (val[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, val[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } ret = fork(); if (ret == 0) { test_nfexp_cmp_api(tmp_exp, exp); exit(0); } else { wait(&status); eval_sigterm(status); } ct2 = nfct_new(); if (!ct2) { perror("nfct_new"); return 0; } printf("== test set grp API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_GRP_MAX; i++) nfct_set_attr_grp(ct2, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } for (i=0; i<ATTR_GRP_MAX; i++) nfct_set_attr_grp(ct2, i, data); printf("== test get grp API ==\n"); ret = fork(); if (ret == 0) { char buf[32]; /* IPv6 group address is 16 bytes * 2 */ for (i=0; i<ATTR_GRP_MAX; i++) nfct_get_attr_grp(ct2, i, buf); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate set grp API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_GRP_MAX; i++) { char buf[32]; /* IPv6 group address is 16 bytes */ data[0] = (uint8_t) i; nfct_set_attr_grp(ct2, i, data); nfct_get_attr_grp(ct2, i, buf); /* These attributes cannot be set, ignore them. */ switch(i) { case ATTR_GRP_ORIG_COUNTERS: case ATTR_GRP_REPL_COUNTERS: case ATTR_GRP_ORIG_ADDR_SRC: case ATTR_GRP_ORIG_ADDR_DST: case ATTR_GRP_REPL_ADDR_SRC: case ATTR_GRP_REPL_ADDR_DST: continue; } if (buf[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, buf[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } nfct_destroy(ct2); printf("== destroy cloned ct entry ==\n"); nfct_destroy(ct); nfct_destroy(tmp); nfexp_destroy(exp); nfexp_destroy(tmp_exp); printf("OK\n"); test_nfct_bitmask(); return EXIT_SUCCESS; }
static void test_nfct_bitmask(void) { struct nfct_bitmask *a, *b; unsigned short int maxb, i; struct nf_conntrack *ct1, *ct2; printf("== test nfct_bitmask_* API ==\n"); maxb = rand() & 0xffff; a = nfct_bitmask_new(maxb); assert(!nfct_bitmask_test_bit(a, maxb + 32)); nfct_bitmask_set_bit(a, maxb + 32); assert(!nfct_bitmask_test_bit(a, maxb + 32)); for (i = 0; i <= maxb; i++) assert(!nfct_bitmask_test_bit(a, i)); for (i = 0; i <= maxb; i++) { if (rand() & 1) { assert(!nfct_bitmask_test_bit(a, i)); continue; } nfct_bitmask_set_bit(a, i); assert(nfct_bitmask_test_bit(a, i)); } b = nfct_bitmask_clone(a); assert(b); for (i = 0; i <= maxb; i++) { if (nfct_bitmask_test_bit(a, i)) assert(nfct_bitmask_test_bit(b, i)); else assert(!nfct_bitmask_test_bit(b, i)); } nfct_bitmask_destroy(a); for (i = 0; i <= maxb; i++) { if (rand() & 1) continue; nfct_bitmask_unset_bit(b, i); assert(!nfct_bitmask_test_bit(b, i)); } /* nfct_bitmask_clear() */ for (i = 0; i < maxb; i++) { nfct_bitmask_set_bit(b, i); assert(nfct_bitmask_test_bit(b, i)); nfct_bitmask_clear(b); assert(!nfct_bitmask_test_bit(b, i)); } for (i = 0; i < maxb; i++) nfct_bitmask_set_bit(b, i); nfct_bitmask_clear(b); for (i = 0; i < maxb; i++) assert(!nfct_bitmask_test_bit(b, i)); /* nfct_bitmask_equal() */ for (i = 0; i < maxb / 32 * 32; i += 32) { a = nfct_bitmask_new(i); assert(!nfct_bitmask_equal(a, b)); nfct_bitmask_destroy(a); } a = nfct_bitmask_clone(b); assert(nfct_bitmask_equal(a, b)); for (i = 0; i < maxb; i++) { if (nfct_bitmask_test_bit(a, i)) { nfct_bitmask_unset_bit(a, i); assert(!nfct_bitmask_equal(a, b)); nfct_bitmask_set_bit(a, i); } else { nfct_bitmask_set_bit(a, i); assert(!nfct_bitmask_equal(a, b)); nfct_bitmask_unset_bit(a, i); } assert(nfct_bitmask_equal(a, b)); } nfct_bitmask_destroy(a); nfct_bitmask_destroy(b); ct1 = nfct_new(); ct2 = nfct_new(); maxb = rand() & 0xff; maxb += 128; maxb /= 2; a = nfct_bitmask_new(maxb * 2); b = nfct_bitmask_new(maxb); nfct_set_attr(ct1, ATTR_CONNLABELS, a); nfct_set_attr(ct2, ATTR_CONNLABELS, b); assert(nfct_cmp(ct1, ct2, NFCT_CMP_ALL) == 1); nfct_bitmask_set_bit(a, maxb); nfct_bitmask_set_bit(b, maxb); assert(nfct_cmp(ct1, ct2, NFCT_CMP_ALL) == 1); nfct_bitmask_set_bit(a, maxb * 2); assert(nfct_cmp(ct1, ct2, NFCT_CMP_ALL) == 0); nfct_destroy(ct1); nfct_destroy(ct2); printf("OK\n"); }