diff options
| author | rmind <rmind@NetBSD.org> | 2013-11-08 00:38:26 +0000 |
|---|---|---|
| committer | rmind <rmind@NetBSD.org> | 2013-11-08 00:38:26 +0000 |
| commit | d1d2e2c9b05cd0a6ff3487f2022ff26ecb24a91d (patch) | |
| tree | f67e712c15e878d250a44ab2480e3cf6ef308cf8 /usr.sbin | |
| parent | 7c6db3061bd13e1d209c3f71f8e23ff03365f80a (diff) | |
NPF: add support for specifying the interfaces before they are attached.
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections). Once the interface is reattached they will
become active.
Bump NPF_VERSION.
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/npf/npfctl/npf_build.c | 50 | ||||
| -rw-r--r-- | usr.sbin/npf/npfctl/npf_data.c | 47 | ||||
| -rw-r--r-- | usr.sbin/npf/npfctl/npf_parse.y | 44 | ||||
| -rw-r--r-- | usr.sbin/npf/npfctl/npf_show.c | 19 | ||||
| -rw-r--r-- | usr.sbin/npf/npfctl/npfctl.h | 20 | ||||
| -rw-r--r-- | usr.sbin/npf/npftest/libnpftest/npf_bpf_test.c | 4 | ||||
| -rw-r--r-- | usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c | 4 | ||||
| -rw-r--r-- | usr.sbin/npf/npftest/libnpftest/npf_state_test.c | 4 | ||||
| -rw-r--r-- | usr.sbin/npf/npftest/libnpftest/npf_test.h | 9 | ||||
| -rw-r--r-- | usr.sbin/npf/npftest/libnpftest/npf_test_subr.c | 34 | ||||
| -rw-r--r-- | usr.sbin/npf/npftest/npfstream.c | 10 | ||||
| -rw-r--r-- | usr.sbin/npf/npftest/npftest.c | 21 | ||||
| -rw-r--r-- | usr.sbin/npf/npftest/npftest.h | 12 |
13 files changed, 159 insertions, 119 deletions
diff --git a/usr.sbin/npf/npfctl/npf_build.c b/usr.sbin/npf/npfctl/npf_build.c index dd89aad610b..a32343cc6e5 100644 --- a/usr.sbin/npf/npfctl/npf_build.c +++ b/usr.sbin/npf/npfctl/npf_build.c @@ -1,4 +1,4 @@ -/* $NetBSD: npf_build.c,v 1.27 2013/09/20 03:03:52 rmind Exp $ */ +/* $NetBSD: npf_build.c,v 1.28 2013/11/08 00:38:26 rmind Exp $ */ /*- * Copyright (c) 2011-2013 The NetBSD Foundation, Inc. @@ -34,7 +34,7 @@ */ #include <sys/cdefs.h> -__RCSID("$NetBSD: npf_build.c,v 1.27 2013/09/20 03:03:52 rmind Exp $"); +__RCSID("$NetBSD: npf_build.c,v 1.28 2013/11/08 00:38:26 rmind Exp $"); #include <sys/types.h> #include <sys/ioctl.h> @@ -109,22 +109,17 @@ npfctl_rule_ref(void) return the_rule; } -unsigned long +bool npfctl_debug_addif(const char *ifname) { - char tname[] = "npftest"; + const char tname[] = "npftest"; const size_t tnamelen = sizeof(tname) - 1; - if (!npf_debug || strncmp(ifname, tname, tnamelen) != 0) { - return 0; + if (npf_debug) { + _npf_debug_addif(npf_conf, ifname); + return strncmp(ifname, tname, tnamelen) == 0; } - struct ifaddrs ifa = { - .ifa_name = __UNCONST(ifname), - .ifa_flags = 0 - }; - unsigned long if_idx = atol(ifname + tnamelen) + 1; - _npf_debug_addif(npf_conf, &ifa, if_idx); - return if_idx; + return 0; } bool @@ -417,7 +412,7 @@ npfctl_build_rproc(const char *name, npfvar_t *procs) } void -npfctl_build_maprset(const char *name, int attr, u_int if_idx) +npfctl_build_maprset(const char *name, int attr, const char *ifname) { const int attr_di = (NPF_RULE_IN | NPF_RULE_OUT); nl_rule_t *rl; @@ -428,7 +423,7 @@ npfctl_build_maprset(const char *name, int attr, u_int if_idx) } /* Allow only "in/out" attributes. */ attr = NPF_RULE_GROUP | NPF_RULE_GROUP | (attr & attr_di); - rl = npf_rule_create(name, attr, if_idx); + rl = npf_rule_create(name, attr, ifname); npf_nat_insert(npf_conf, rl, NPF_PRI_LAST); } @@ -437,7 +432,7 @@ npfctl_build_maprset(const char *name, int attr, u_int if_idx) * update the current group pointer and increase the nesting level. */ void -npfctl_build_group(const char *name, int attr, u_int if_idx, bool def) +npfctl_build_group(const char *name, int attr, const char *ifname, bool def) { const int attr_di = (NPF_RULE_IN | NPF_RULE_OUT); nl_rule_t *rl; @@ -446,7 +441,7 @@ npfctl_build_group(const char *name, int attr, u_int if_idx, bool def) attr |= attr_di; } - rl = npf_rule_create(name, attr | NPF_RULE_GROUP, if_idx); + rl = npf_rule_create(name, attr | NPF_RULE_GROUP, ifname); npf_rule_setprio(rl, NPF_PRI_LAST); if (def) { if (defgroup) { @@ -480,7 +475,7 @@ npfctl_build_group_end(void) * if any, and insert into the ruleset of current group, or set the rule. */ void -npfctl_build_rule(uint32_t attr, u_int if_idx, sa_family_t family, +npfctl_build_rule(uint32_t attr, const char *ifname, sa_family_t family, const opt_proto_t *op, const filt_opts_t *fopts, const char *pcap_filter, const char *rproc) { @@ -488,7 +483,7 @@ npfctl_build_rule(uint32_t attr, u_int if_idx, sa_family_t family, attr |= (npf_conf ? 0 : NPF_RULE_DYNAMIC); - rl = npf_rule_create(NULL, attr, if_idx); + rl = npf_rule_create(NULL, attr, ifname); if (pcap_filter) { npfctl_build_pcap(rl, pcap_filter); } else { @@ -519,7 +514,7 @@ npfctl_build_rule(uint32_t attr, u_int if_idx, sa_family_t family, * type with a given filter options. */ static void -npfctl_build_nat(int type, u_int if_idx, sa_family_t family, +npfctl_build_nat(int type, const char *ifname, sa_family_t family, const addr_port_t *ap, const filt_opts_t *fopts, bool binat) { const opt_proto_t op = { .op_proto = -1, .op_opts = NULL }; @@ -545,7 +540,7 @@ npfctl_build_nat(int type, u_int if_idx, sa_family_t family, */ nat = npf_nat_create(NPF_NATOUT, !binat ? (NPF_NAT_PORTS | NPF_NAT_PORTMAP) : 0, - if_idx, &am->fam_addr, am->fam_family, 0); + ifname, &am->fam_addr, am->fam_family, 0); break; case NPF_NATIN: /* @@ -560,7 +555,7 @@ npfctl_build_nat(int type, u_int if_idx, sa_family_t family, port = npfctl_get_singleport(ap->ap_portrange); } nat = npf_nat_create(NPF_NATIN, !binat ? NPF_NAT_PORTS : 0, - if_idx, &am->fam_addr, am->fam_family, port); + ifname, &am->fam_addr, am->fam_family, port); break; default: assert(false); @@ -574,8 +569,9 @@ npfctl_build_nat(int type, u_int if_idx, sa_family_t family, * npfctl_build_natseg: validate and create NAT policies. */ void -npfctl_build_natseg(int sd, int type, u_int if_idx, const addr_port_t *ap1, - const addr_port_t *ap2, const filt_opts_t *fopts) +npfctl_build_natseg(int sd, int type, const char *ifname, + const addr_port_t *ap1, const addr_port_t *ap2, + const filt_opts_t *fopts) { sa_family_t af = AF_INET; filt_opts_t imfopts; @@ -585,7 +581,7 @@ npfctl_build_natseg(int sd, int type, u_int if_idx, const addr_port_t *ap1, yyerror("static NAT is not yet supported"); } assert(sd == NPFCTL_NAT_DYNAMIC); - assert(if_idx != 0); + assert(ifname != NULL); /* * Bi-directional NAT is a combination of inbound NAT and outbound @@ -607,12 +603,12 @@ npfctl_build_natseg(int sd, int type, u_int if_idx, const addr_port_t *ap1, if (type & NPF_NATIN) { memset(&imfopts, 0, sizeof(filt_opts_t)); memcpy(&imfopts.fo_to, ap2, sizeof(addr_port_t)); - npfctl_build_nat(NPF_NATIN, if_idx, af, ap1, fopts, binat); + npfctl_build_nat(NPF_NATIN, ifname, af, ap1, fopts, binat); } if (type & NPF_NATOUT) { memset(&imfopts, 0, sizeof(filt_opts_t)); memcpy(&imfopts.fo_from, ap1, sizeof(addr_port_t)); - npfctl_build_nat(NPF_NATOUT, if_idx, af, ap2, fopts, binat); + npfctl_build_nat(NPF_NATOUT, ifname, af, ap2, fopts, binat); } } diff --git a/usr.sbin/npf/npfctl/npf_data.c b/usr.sbin/npf/npfctl/npf_data.c index 48f76cacf3a..2cc8f8c2fad 100644 --- a/usr.sbin/npf/npfctl/npf_data.c +++ b/usr.sbin/npf/npfctl/npf_data.c @@ -1,4 +1,4 @@ -/* $NetBSD: npf_data.c,v 1.20 2013/09/19 01:04:45 rmind Exp $ */ +/* $NetBSD: npf_data.c,v 1.21 2013/11/08 00:38:26 rmind Exp $ */ /*- * Copyright (c) 2009-2012 The NetBSD Foundation, Inc. @@ -31,7 +31,7 @@ */ #include <sys/cdefs.h> -__RCSID("$NetBSD: npf_data.c,v 1.20 2013/09/19 01:04:45 rmind Exp $"); +__RCSID("$NetBSD: npf_data.c,v 1.21 2013/11/08 00:38:26 rmind Exp $"); #include <sys/types.h> #include <sys/null.h> @@ -47,7 +47,9 @@ __RCSID("$NetBSD: npf_data.c,v 1.20 2013/09/19 01:04:45 rmind Exp $"); #include <net/if.h> #include <stdlib.h> +#include <stddef.h> #include <string.h> +#include <ctype.h> #include <err.h> #include <errno.h> #include <ifaddrs.h> @@ -57,14 +59,48 @@ __RCSID("$NetBSD: npf_data.c,v 1.20 2013/09/19 01:04:45 rmind Exp $"); static struct ifaddrs * ifs_list = NULL; -unsigned long +void +npfctl_note_interface(const char *ifname) +{ + unsigned long if_idx = if_nametoindex(ifname); + bool testif = npfctl_debug_addif(ifname); + const char *p = ifname; + + /* If such interface exists or if it is a test interface - done. */ + if (if_idx || testif) { + return; + } + + /* + * Minimum sanity check. The interface name shall be non-empty + * string shorter than IFNAMSIZ and alphanumeric only. + */ + if (*p == '\0') { + goto invalid; + } + while (*p) { + const size_t len = (ptrdiff_t)p - (ptrdiff_t)ifname; + + if (!isalnum((unsigned char)*p) || len > IFNAMSIZ) { +invalid: yyerror("illegitimate interface name '%s'", ifname); + } + p++; + } + + /* Throw a warning, so that the user could double check. */ + warnx("warning - unknown interface '%s'", ifname); +} + +static unsigned long npfctl_find_ifindex(const char *ifname) { unsigned long if_idx = if_nametoindex(ifname); + bool testif = npfctl_debug_addif(ifname); if (!if_idx) { - if ((if_idx = npfctl_debug_addif(ifname)) != 0) { - return if_idx; + if (testif) { + static u_int dummy_if_idx = (1 << 15); + return ++dummy_if_idx; } yyerror("unknown interface '%s'", ifname); } @@ -284,6 +320,7 @@ npfctl_parse_ifnet(const char *ifname, const int family) } vpa = npfvar_create(".ifaddrs"); + ifna.ifna_name = estrdup(ifname); ifna.ifna_addrs = vpa; ifna.ifna_index = npfctl_find_ifindex(ifname); assert(ifna.ifna_index != 0); diff --git a/usr.sbin/npf/npfctl/npf_parse.y b/usr.sbin/npf/npfctl/npf_parse.y index 91df977b069..9a417dd426f 100644 --- a/usr.sbin/npf/npfctl/npf_parse.y +++ b/usr.sbin/npf/npfctl/npf_parse.y @@ -1,4 +1,4 @@ -/* $NetBSD: npf_parse.y,v 1.26 2013/09/20 03:03:52 rmind Exp $ */ +/* $NetBSD: npf_parse.y,v 1.27 2013/11/08 00:38:26 rmind Exp $ */ /*- * Copyright (c) 2011-2013 The NetBSD Foundation, Inc. @@ -156,9 +156,8 @@ yyerror(const char *fmt, ...) %token <str> VAR_ID %type <str> addr, some_name, list_elem, table_store, string -%type <str> proc_param_val, opt_apply -%type <num> ifindex, port, opt_final, on_ifindex, number -%type <num> afamily, opt_family +%type <str> proc_param_val, opt_apply, ifname, on_ifname +%type <num> port, opt_final, number, afamily, opt_family %type <num> block_or_pass, rule_dir, group_dir, block_opts %type <num> opt_stateful, icmp_type, table_type, map_sd, map_type %type <var> ifnet, addr_or_ifnet, port_range, icmp_type_and_code @@ -306,17 +305,17 @@ mapseg ; map - : MAP ifindex map_sd mapseg map_type mapseg PASS filt_opts + : MAP ifname map_sd mapseg map_type mapseg PASS filt_opts { npfctl_build_natseg($3, $5, $2, &$4, &$6, &$8); } - | MAP ifindex map_sd mapseg map_type mapseg + | MAP ifname map_sd mapseg map_type mapseg { npfctl_build_natseg($3, $5, $2, &$4, &$6, NULL); } | MAP RULESET group_opts { - npfctl_build_maprset($3.rg_name, $3.rg_attr, $3.rg_ifnum); + npfctl_build_maprset($3.rg_name, $3.rg_attr, $3.rg_ifname); } ; @@ -389,7 +388,7 @@ group { /* Build a group. Increases the nesting level. */ npfctl_build_group($2.rg_name, $2.rg_attr, - $2.rg_ifnum, $2.rg_default); + $2.rg_ifname, $2.rg_default); } ruleset_block { @@ -403,7 +402,7 @@ ruleset { /* Ruleset is a dynamic group. */ npfctl_build_group($2.rg_name, $2.rg_attr | NPF_RULE_DYNAMIC, - $2.rg_ifnum, $2.rg_default); + $2.rg_ifname, $2.rg_default); npfctl_build_group_end(); } ; @@ -419,12 +418,12 @@ group_opts memset(&$$, 0, sizeof(rule_group_t)); $$.rg_default = true; } - | STRING group_dir on_ifindex + | STRING group_dir on_ifname { memset(&$$, 0, sizeof(rule_group_t)); $$.rg_name = $1; $$.rg_attr = $2; - $$.rg_ifnum = $3; + $$.rg_ifname = $3; } ; @@ -445,13 +444,13 @@ rule_group ; rule - : block_or_pass opt_stateful rule_dir opt_final on_ifindex + : block_or_pass opt_stateful rule_dir opt_final on_ifname opt_family opt_proto all_or_filt_opts opt_apply { npfctl_build_rule($1 | $2 | $3 | $4, $5, $6, &$7, &$8, NULL, $9); } - | block_or_pass opt_stateful rule_dir opt_final on_ifindex + | block_or_pass opt_stateful rule_dir opt_final on_ifname PCAP_FILTER STRING opt_apply { npfctl_build_rule($1 | $2 | $3 | $4, $5, @@ -475,9 +474,9 @@ opt_final | { $$ = 0; } ; -on_ifindex - : ON ifindex { $$ = $2; } - | { $$ = 0; } +on_ifname + : ON ifname { $$ = $2; } + | { $$ = NULL; } ; afamily @@ -758,15 +757,17 @@ ifnet } ; -ifindex +ifname : some_name { - $$ = npfctl_find_ifindex($1); + npfctl_note_interface($1); + $$ = $1; } | ifnet { ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); - $$ = ifna->ifna_index; + npfctl_note_interface(ifna->ifna_name); + $$ = ifna->ifna_name; } | VAR_ID { @@ -777,11 +778,11 @@ ifindex switch (type) { case NPFVAR_STRING: case NPFVAR_IDENTIFIER: - $$ = npfctl_find_ifindex(npfvar_expand_string(vp)); + $$ = npfvar_expand_string(vp); break; case NPFVAR_INTERFACE: ifna = npfvar_get_data(vp, type, 0); - $$ = ifna->ifna_index; + $$ = ifna->ifna_name; break; case -1: yyerror("undefined variable '%s' for interface", $1); @@ -791,6 +792,7 @@ ifindex $1, npfvar_type(type)); break; } + npfctl_note_interface($$); } ; diff --git a/usr.sbin/npf/npfctl/npf_show.c b/usr.sbin/npf/npfctl/npf_show.c index 562cefde597..d228abc6d32 100644 --- a/usr.sbin/npf/npfctl/npf_show.c +++ b/usr.sbin/npf/npfctl/npf_show.c @@ -1,4 +1,4 @@ -/* $NetBSD: npf_show.c,v 1.2 2013/09/20 03:03:52 rmind Exp $ */ +/* $NetBSD: npf_show.c,v 1.3 2013/11/08 00:38:26 rmind Exp $ */ /*- * Copyright (c) 2013 The NetBSD Foundation, Inc. @@ -36,7 +36,7 @@ */ #include <sys/cdefs.h> -__RCSID("$NetBSD: npf_show.c,v 1.2 2013/09/20 03:03:52 rmind Exp $"); +__RCSID("$NetBSD: npf_show.c,v 1.3 2013/11/08 00:38:26 rmind Exp $"); #include <sys/socket.h> #include <netinet/in.h> @@ -319,8 +319,7 @@ static void npfctl_print_rule(npf_conf_info_t *ctx, nl_rule_t *rl) { const uint32_t attr = npf_rule_getattr(rl); - const char *rproc, *name; - u_int if_idx; + const char *rproc, *ifname, *name; /* Rule attributes/flags. */ for (u_int i = 0; i < __arraycount(attr_keyword_map); i++) { @@ -333,9 +332,7 @@ npfctl_print_rule(npf_conf_info_t *ctx, nl_rule_t *rl) fprintf(ctx->fp, "%s ", ak->val); } } - if ((if_idx = npf_rule_getinterface(rl)) != 0) { - char ifnamebuf[IFNAMSIZ], *ifname; - ifname = if_indextoname(if_idx, ifnamebuf); + if ((ifname = npf_rule_getinterface(rl)) != NULL) { fprintf(ctx->fp, "on %s ", ifname); } @@ -360,14 +357,14 @@ npfctl_print_nat(npf_conf_info_t *ctx, nl_nat_t *nt) { nl_rule_t *rl = (nl_nat_t *)nt; const char *ifname, *seg1, *seg2, *arrow; - char *seg, ifnamebuf[IFNAMSIZ]; - size_t if_idx, alen; npf_addr_t addr; in_port_t port; + size_t alen; + char *seg; /* Get the interface. */ - if_idx = npf_rule_getinterface(rl); - ifname = if_indextoname(if_idx, ifnamebuf); + ifname = npf_rule_getinterface(rl); + assert(ifname != NULL); /* Get the translation address (and port, if used). */ npf_nat_getmap(nt, &addr, &alen, &port); diff --git a/usr.sbin/npf/npfctl/npfctl.h b/usr.sbin/npf/npfctl/npfctl.h index 6f8c0740bfe..df6f9352716 100644 --- a/usr.sbin/npf/npfctl/npfctl.h +++ b/usr.sbin/npf/npfctl/npfctl.h @@ -1,4 +1,4 @@ -/* $NetBSD: npfctl.h,v 1.33 2013/09/20 03:03:52 rmind Exp $ */ +/* $NetBSD: npfctl.h,v 1.34 2013/11/08 00:38:26 rmind Exp $ */ /*- * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. @@ -58,6 +58,7 @@ typedef struct fam_addr_mask { } fam_addr_mask_t; typedef struct ifnet_addr { + char * ifna_name; unsigned long ifna_index; sa_family_t ifna_family; npfvar_t * ifna_filter; @@ -87,7 +88,7 @@ typedef struct opt_proto { typedef struct rule_group { const char * rg_name; uint32_t rg_attr; - u_int rg_ifnum; + const char * rg_ifname; bool rg_default; } rule_group_t; @@ -110,12 +111,12 @@ void npfctl_parse_string(const char *); void npfctl_print_error(const nl_error_t *); char * npfctl_print_addrmask(int, const npf_addr_t *, npf_netmask_t); +void npfctl_note_interface(const char *); bool npfctl_table_exists_p(const char *); int npfctl_protono(const char *); in_port_t npfctl_portno(const char *); uint8_t npfctl_icmpcode(int, uint8_t, const char *); uint8_t npfctl_icmptype(int, const char *); -unsigned long npfctl_find_ifindex(const char *); npfvar_t * npfctl_parse_ifnet(const char *, const int); npfvar_t * npfctl_parse_tcpflag(const char *); npfvar_t * npfctl_parse_table_id(const char *); @@ -181,18 +182,19 @@ int npfctl_config_show(int); int npfctl_ruleset_show(int, const char *); nl_rule_t * npfctl_rule_ref(void); -unsigned long npfctl_debug_addif(const char *); +bool npfctl_debug_addif(const char *); void npfctl_build_alg(const char *); void npfctl_build_rproc(const char *, npfvar_t *); -void npfctl_build_group(const char *, int, u_int, bool); +void npfctl_build_group(const char *, int, const char *, bool); void npfctl_build_group_end(void); -void npfctl_build_rule(uint32_t, u_int, sa_family_t, +void npfctl_build_rule(uint32_t, const char *, sa_family_t, const opt_proto_t *, const filt_opts_t *, const char *, const char *); -void npfctl_build_natseg(int, int, u_int, const addr_port_t *, - const addr_port_t *, const filt_opts_t *); -void npfctl_build_maprset(const char *, int, u_int); +void npfctl_build_natseg(int, int, const char *, + const addr_port_t *, const addr_port_t *, + const filt_opts_t *); +void npfctl_build_maprset(const char *, int, const char *); void npfctl_build_table(const char *, u_int, const char *); #endif diff --git a/usr.sbin/npf/npftest/libnpftest/npf_bpf_test.c b/usr.sbin/npf/npftest/libnpftest/npf_bpf_test.c index fb386b7cf36..9f977275214 100644 --- a/usr.sbin/npf/npftest/libnpftest/npf_bpf_test.c +++ b/usr.sbin/npf/npftest/libnpftest/npf_bpf_test.c @@ -1,4 +1,4 @@ -/* $NetBSD: npf_bpf_test.c,v 1.1 2013/09/19 01:04:45 rmind Exp $ */ +/* $NetBSD: npf_bpf_test.c,v 1.2 2013/11/08 00:38:27 rmind Exp $ */ /*- * Copyright (c) 2013 The NetBSD Foundation, Inc. @@ -59,8 +59,8 @@ fill_packet(int proto) static int test_bpf_code(const void *code) { + ifnet_t *dummy_ifp = npf_test_addif(IFNAME_TEST, false, false); npf_cache_t npc = { .npc_info = 0 }; - const void *dummy_ifp = (void *)0xdeadbeef; struct mbuf *m; nbuf_t nbuf; int ret; diff --git a/usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c b/usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c index 358fafc42e9..07840c0eaeb 100644 --- a/usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c +++ b/usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c @@ -1,4 +1,4 @@ -/* $NetBSD: npf_nbuf_test.c,v 1.4 2013/01/20 18:45:57 rmind Exp $ */ +/* $NetBSD: npf_nbuf_test.c,v 1.5 2013/11/08 00:38:27 rmind Exp $ */ /* * NPF nbuf interface test. @@ -30,7 +30,7 @@ mbuf_consistency_check(nbuf_t *nbuf) static char * parse_nbuf_chain(struct mbuf *m) { - const void *dummy_ifp = (void *)0xdeadbeef; + ifnet_t *dummy_ifp = npf_test_addif(IFNAME_TEST, false, false); char *s = kmem_zalloc(MBUF_CHAIN_LEN + 1, KM_SLEEP); nbuf_t nbuf; void *nptr; diff --git a/usr.sbin/npf/npftest/libnpftest/npf_state_test.c b/usr.sbin/npf/npftest/libnpftest/npf_state_test.c index d1f32197720..560711e1bbf 100644 --- a/usr.sbin/npf/npftest/libnpftest/npf_state_test.c +++ b/usr.sbin/npf/npftest/libnpftest/npf_state_test.c @@ -1,4 +1,4 @@ -/* $NetBSD: npf_state_test.c,v 1.4 2012/12/24 19:05:49 rmind Exp $ */ +/* $NetBSD: npf_state_test.c,v 1.5 2013/11/08 00:38:27 rmind Exp $ */ /* * NPF state tracking test. @@ -133,6 +133,7 @@ construct_packet(const tcp_meta_t *p) static bool process_packet(const int i, npf_state_t *nst, bool *snew) { + ifnet_t *dummy_ifp = npf_test_addif(IFNAME_TEST, false, false); const tcp_meta_t *p = &packet_sequence[i]; npf_cache_t npc = { .npc_info = 0 }; nbuf_t nbuf; @@ -144,7 +145,6 @@ process_packet(const int i, npf_state_t *nst, bool *snew) return true; } - const void *dummy_ifp = (void *)0xdeadbeef; nbuf_init(&nbuf, construct_packet(p), dummy_ifp); ret = npf_cache_all(&npc, &nbuf); KASSERT((ret & NPC_IPFRAG) == 0); diff --git a/usr.sbin/npf/npftest/libnpftest/npf_test.h b/usr.sbin/npf/npftest/libnpftest/npf_test.h index 2e03b386f04..1b337d20f2e 100644 --- a/usr.sbin/npf/npftest/libnpftest/npf_test.h +++ b/usr.sbin/npf/npftest/libnpftest/npf_test.h @@ -1,4 +1,4 @@ -/* $NetBSD: npf_test.h,v 1.10 2013/09/24 02:44:20 rmind Exp $ */ +/* $NetBSD: npf_test.h,v 1.11 2013/11/08 00:38:27 rmind Exp $ */ /* * Public Domain. @@ -27,6 +27,7 @@ /* Test interfaces and IP addresses. */ #define IFNAME_EXT "npftest0" #define IFNAME_INT "npftest1" +#define IFNAME_TEST "npftest2" #define LOCAL_IP1 "10.1.1.1" #define LOCAL_IP2 "10.1.1.2" @@ -40,10 +41,10 @@ void npf_test_init(void); int npf_test_load(const void *); -unsigned npf_test_addif(const char *, unsigned, bool); -unsigned npf_test_getif(const char *); +ifnet_t * npf_test_addif(const char *, bool, bool); +ifnet_t * npf_test_getif(const char *); -int npf_test_statetrack(const void *, size_t, unsigned, +int npf_test_statetrack(const void *, size_t, ifnet_t *, bool, int64_t *); void npf_test_conc(bool, unsigned); diff --git a/usr.sbin/npf/npftest/libnpftest/npf_test_subr.c b/usr.sbin/npf/npftest/libnpftest/npf_test_subr.c index bbec0c1d26b..b04c844f5bb 100644 --- a/usr.sbin/npf/npftest/libnpftest/npf_test_subr.c +++ b/usr.sbin/npf/npftest/libnpftest/npf_test_subr.c @@ -1,4 +1,4 @@ -/* $NetBSD: npf_test_subr.c,v 1.5 2013/09/24 02:04:21 rmind Exp $ */ +/* $NetBSD: npf_test_subr.c,v 1.6 2013/11/08 00:38:27 rmind Exp $ */ /* * NPF initialisation and handler routines. @@ -33,30 +33,37 @@ npf_test_load(const void *xml) return npfctl_reload(0, npf_dict); } -unsigned -npf_test_addif(const char *ifname, unsigned if_idx, bool verbose) +ifnet_t * +npf_test_addif(const char *ifname, bool reg, bool verbose) { ifnet_t *ifp = if_alloc(IFT_OTHER); /* * This is a "fake" interface with explicitly set index. + * Note: test modules may not setup pfil(9) hooks and if_attach() + * may not trigger npf_ifmap_attach(), so we call it manually. */ strlcpy(ifp->if_xname, ifname, sizeof(ifp->if_xname)); - if (verbose) { - printf("+ Interface %s\n", ifp->if_xname); - } ifp->if_dlt = DLT_NULL; + ifp->if_index = 0; if_attach(ifp); - ifp->if_index = if_idx; if_alloc_sadl(ifp); - return if_idx; + + npf_ifmap_attach(ifp); + if (reg) { + npf_ifmap_register(ifname); + } + + if (verbose) { + printf("+ Interface %s\n", ifname); + } + return ifp; } -unsigned +ifnet_t * npf_test_getif(const char *ifname) { - ifnet_t *ifp = ifunit(ifname); - return ifp ? ifp->if_index : 0; + return ifunit(ifname); } /* @@ -72,15 +79,14 @@ npf_state_sample(npf_state_t *nst, bool retval) } int -npf_test_statetrack(const void *data, size_t len, unsigned idx, +npf_test_statetrack(const void *data, size_t len, ifnet_t *ifp, bool forw, int64_t *result) { - ifnet_t ifp = { .if_index = idx }; struct mbuf *m; int i = 0, error; m = mbuf_getwithdata(data, len); - error = npf_packet_handler(NULL, &m, &ifp, forw ? PFIL_OUT : PFIL_IN); + error = npf_packet_handler(NULL, &m, ifp, forw ? PFIL_OUT : PFIL_IN); if (error) { assert(m == NULL); return error; diff --git a/usr.sbin/npf/npftest/npfstream.c b/usr.sbin/npf/npftest/npfstream.c index 0c48a559ae7..34a318f7641 100644 --- a/usr.sbin/npf/npftest/npfstream.c +++ b/usr.sbin/npf/npftest/npfstream.c @@ -1,4 +1,4 @@ -/* $NetBSD: npfstream.c,v 1.5 2013/09/24 02:04:21 rmind Exp $ */ +/* $NetBSD: npfstream.c,v 1.6 2013/11/08 00:38:26 rmind Exp $ */ /* * NPF stream processor. @@ -33,7 +33,7 @@ static int snd_packet_no = 0; static int rcv_packet_no = 0; static void -process_tcpip(const void *data, size_t len, FILE *fp, unsigned idx) +process_tcpip(const void *data, size_t len, FILE *fp, ifnet_t *ifp) { const struct ether_header *eth = data; const struct ip *ip; @@ -71,7 +71,7 @@ process_tcpip(const void *data, size_t len, FILE *fp, unsigned idx) memset(result, 0, sizeof(result)); len = ntohs(ip->ip_len); - error = rumpns_npf_test_statetrack(ip, len, idx, forw, result); + error = rumpns_npf_test_statetrack(ip, len, ifp, forw, result); fprintf(fp, "%s%2x %5d %3d %11u %11u %11u %11u %12" PRIxPTR, forw ? ">" : "<", (th->th_flags & (TH_SYN | TH_ACK | TH_FIN)), @@ -85,7 +85,7 @@ process_tcpip(const void *data, size_t len, FILE *fp, unsigned idx) } int -process_stream(const char *input, const char *output, unsigned idx) +process_stream(const char *input, const char *output, ifnet_t *ifp) { pcap_t *pcap; char pcap_errbuf[PCAP_ERRBUF_SIZE]; @@ -111,7 +111,7 @@ process_stream(const char *input, const char *output, unsigned idx) if (phdr->len != phdr->caplen) { warnx("process_stream: truncated packet"); } - process_tcpip(data, phdr->caplen, fp, idx); + process_tcpip(data, phdr->caplen, fp, ifp); } pcap_close(pcap); fclose(fp); diff --git a/usr.sbin/npf/npftest/npftest.c b/usr.sbin/npf/npftest/npftest.c index 4b2d77bdc0d..6c1ddd6bbcf 100644 --- a/usr.sbin/npf/npftest/npftest.c +++ b/usr.sbin/npf/npftest/npftest.c @@ -1,4 +1,4 @@ -/* $NetBSD: npftest.c,v 1.12 2013/09/24 02:44:20 rmind Exp $ */ +/* $NetBSD: npftest.c,v 1.13 2013/11/08 00:38:26 rmind Exp $ */ /* * NPF testing framework. @@ -75,19 +75,15 @@ result(const char *testcase, bool ok) static void load_npf_config_ifs(prop_dictionary_t dbg_dict) { + prop_array_t iflist = prop_dictionary_get(dbg_dict, "interfaces"); + prop_object_iterator_t it = prop_array_iterator(iflist); prop_dictionary_t ifdict; - prop_object_iterator_t it; - prop_array_t iflist; - iflist = prop_dictionary_get(dbg_dict, "interfaces"); - it = prop_array_iterator(iflist); while ((ifdict = prop_object_iterator_next(it)) != NULL) { - const char *ifname; - unsigned if_idx; + const char *ifname = NULL; prop_dictionary_get_cstring_nocopy(ifdict, "name", &ifname); - prop_dictionary_get_uint32(ifdict, "idx", &if_idx); - (void)rumpns_npf_test_addif(ifname, if_idx, verbose); + (void)rumpns_npf_test_addif(ifname, true, verbose); } prop_object_iterator_release(it); } @@ -140,7 +136,8 @@ main(int argc, char **argv) bool test, ok, fail, tname_matched; char *benchmark, *config, *interface, *stream, *testname; unsigned nthreads = 0; - int idx = -1, ch; + ifnet_t *ifp = NULL; + int ch; benchmark = NULL; test = false; @@ -224,7 +221,7 @@ main(int argc, char **argv) if (config) { load_npf_config(config); } - if (interface && (idx = rumpns_npf_test_getif(interface)) == 0) { + if (interface && (ifp = rumpns_npf_test_getif(interface)) == 0) { errx(EXIT_FAILURE, "failed to find the interface"); } @@ -272,7 +269,7 @@ main(int argc, char **argv) } if (stream) { - process_stream(stream, NULL, idx); + process_stream(stream, NULL, ifp); } if (benchmark) { diff --git a/usr.sbin/npf/npftest/npftest.h b/usr.sbin/npf/npftest/npftest.h index d3d5b89ae69..2e529cec073 100644 --- a/usr.sbin/npf/npftest/npftest.h +++ b/usr.sbin/npf/npftest/npftest.h @@ -1,4 +1,4 @@ -/* $NetBSD: npftest.h,v 1.9 2013/09/24 02:44:20 rmind Exp $ */ +/* $NetBSD: npftest.h,v 1.10 2013/11/08 00:38:27 rmind Exp $ */ /* * Public Domain. @@ -10,13 +10,15 @@ #include <inttypes.h> #include <stdbool.h> +#include <net/if.h> + void rumpns_npf_test_init(void); int rumpns_npf_test_load(const void *); -unsigned rumpns_npf_test_addif(const char *, unsigned, bool); -unsigned rumpns_npf_test_getif(const char *); +ifnet_t * rumpns_npf_test_addif(const char *, bool, bool); +ifnet_t * rumpns_npf_test_getif(const char *); int rumpns_npf_test_statetrack(const void *, size_t, - unsigned, bool, int64_t *); + ifnet_t *, bool, int64_t *); void rumpns_npf_test_conc(bool, unsigned); bool rumpns_npf_nbuf_test(bool); @@ -27,6 +29,6 @@ bool rumpns_npf_state_test(bool); bool rumpns_npf_rule_test(bool); bool rumpns_npf_nat_test(bool); -int process_stream(const char *, const char *, unsigned); +int process_stream(const char *, const char *, ifnet_t *); #endif |
