1 /*
2 * Copyright (c) 2019-2025 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /*
30 * net_bridge.c
31 * - test if_bridge.c functionality
32 */
33
34 #include <darwintest.h>
35 #include <stdio.h>
36 #include <unistd.h>
37 #include <stddef.h>
38 #include <stdlib.h>
39 #include <string.h>
40 #include <sys/socket.h>
41 #include <arpa/inet.h>
42 #include <sys/event.h>
43 #include <net/if.h>
44 #include <netinet/in.h>
45 #include <netinet6/in6_var.h>
46 #include <netinet6/nd6.h>
47 #include <netinet/in.h>
48 #include <netinet/ip.h>
49 #include <netinet/udp.h>
50 #include <netinet/tcp.h>
51 #include <netinet/if_ether.h>
52 #include <netinet/ip6.h>
53 #include <netinet/icmp6.h>
54 #include <net/if_arp.h>
55 #include <net/bpf.h>
56 #include <net/if_bridgevar.h>
57 #include <net/if_fake_var.h>
58 #include <sys/ioctl.h>
59 #include <sys/types.h>
60 #include <sys/stat.h>
61 #include <errno.h>
62 #include <pthread.h>
63 #include <stdbool.h>
64 #include <TargetConditionals.h>
65 #include <darwintest_utils.h>
66
67 #include "net_test_lib.h"
68 #include "inet_transfer.h"
69 #include "bpflib.h"
70 #include "in_cksum.h"
71
72 static bool S_cleaning_up;
73
74 #define ALL_ADDRS (uint32_t)(-1)
75
76 typedef struct {
77 char ifname[IFNAMSIZ]; /* port we do I/O on */
78 ether_addr_t mac;
79 char member_ifname[IFNAMSIZ]; /* member of bridge */
80 ether_addr_t member_mac;
81 int fd;
82 u_int unit;
83 u_int num_addrs;
84 void * rx_buf;
85 int rx_buf_size;
86 bool mac_nat;
87 struct in_addr ip;
88 struct in6_addr ip6;
89 u_short if_index;
90
91 u_int test_count;
92 u_int test_address_count;
93 uint64_t test_address_present;
94 } switch_port, *switch_port_t;
95
96 typedef struct {
97 u_int size;
98 u_int count;
99 bool mac_nat;
100 switch_port list[1];
101 } switch_port_list, * switch_port_list_t;
102
103 static struct in_addr bridge_ip_addr;
104 static struct in6_addr bridge_ipv6_addr;
105 static u_short bridge_if_index;
106
107 static struct ifbareq *
108 bridge_rt_table_copy(u_int * ret_count);
109
110 static void
111 bridge_rt_table_log(struct ifbareq *rt_table, u_int count);
112
113 static struct ifbrmne *
114 bridge_mac_nat_entries_copy(u_int * ret_count);
115
116 static void
117 bridge_mac_nat_entries_log(struct ifbrmne * entries, u_int count);
118
119 #define SETUP_FLAGS_MAC_NAT 0x01
120 #define SETUP_FLAGS_CHECKSUM_OFFLOAD 0x02
121 #define SETUP_FLAGS_ATTACH_STACK 0x04
122 #define SETUP_FLAGS_TRAILERS 0x08
123 #define SETUP_FLAGS_SHARE_MEMBER_MAC 0x10
124
125 #define s6_addr16 __u6_addr.__u6_addr16
126
127 /**
128 ** Packet creation/display
129 **/
130 #define BOOTP_SERVER_PORT 67
131 #define BOOTP_CLIENT_PORT 68
132
133 #define TEST_SOURCE_PORT 14
134 #define TEST_DEST_PORT 15
135
136 #define EA_UNIT_INDEX 4
137 #define EA_ADDR_INDEX 5
138
139 static void
set_ethernet_address(ether_addr_t * eaddr,u_int unit,u_int addr_index)140 set_ethernet_address(ether_addr_t *eaddr, u_int unit, u_int addr_index)
141 {
142 u_char *a = eaddr->octet;
143
144 a[0] = 0x02;
145 a[2] = 0x00;
146 a[3] = 0x00;
147 a[1] = 0x00;
148 a[EA_UNIT_INDEX] = (u_char)unit;
149 a[EA_ADDR_INDEX] = (u_char)addr_index;
150 }
151
152 #define TEN_NET 0x0a000000
153 #define TEN_1_NET (TEN_NET | 0x010000)
154
155 static void
get_ipv4_address(u_int unit,u_int addr_index,struct in_addr * ip)156 get_ipv4_address(u_int unit, u_int addr_index, struct in_addr *ip)
157 {
158 /* up to 255 units, 255 addresses */
159 ip->s_addr = htonl(TEN_1_NET | (unit << 8) | addr_index);
160 return;
161 }
162
163 #define IN6ADDR_ULA_INIT \
164 {{{ 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
165 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }}}
166
167 static struct in6_addr ula_address = IN6ADDR_ULA_INIT;
168
169 #define ULA_UNIT_INDEX 14
170 #define ULA_ADDR_INDEX 15
171
172 static void
get_ipv6_ula_address(u_int unit,u_int addr_index,struct in6_addr * ip)173 get_ipv6_ula_address(u_int unit, u_int addr_index, struct in6_addr *ip)
174 {
175 *ip = ula_address;
176 /* up to 255 units, 255 addresses */
177 ip->s6_addr[ULA_UNIT_INDEX] = (uint8_t)unit;
178 ip->s6_addr[ULA_ADDR_INDEX] = (uint8_t)addr_index;
179 }
180
181 #define ND6_EUI64_GBIT 0x01
182 #define ND6_EUI64_UBIT 0x02
183
184 #define ND6_EUI64_TO_IFID(in6) \
185 do {(in6)->s6_addr[8] ^= ND6_EUI64_UBIT; } while (0)
186 static void
get_ipv6_ll_address(const ether_addr_t * mac,struct in6_addr * in6)187 get_ipv6_ll_address(const ether_addr_t *mac, struct in6_addr * in6)
188 {
189 const u_char * addr = mac->octet;
190
191 bzero(in6, sizeof(*in6));
192 in6->s6_addr16[0] = htons(0xfe80);
193 in6->s6_addr[8] = addr[0];
194 in6->s6_addr[9] = addr[1];
195 in6->s6_addr[10] = addr[2];
196 in6->s6_addr[11] = 0xff;
197 in6->s6_addr[12] = 0xfe;
198 in6->s6_addr[13] = addr[3];
199 in6->s6_addr[14] = addr[4];
200 in6->s6_addr[15] = addr[5];
201 ND6_EUI64_TO_IFID(in6);
202 return;
203 }
204
205 static void
get_ip_address(uint8_t af,u_int unit,u_int addr_index,union ifbrip * ip)206 get_ip_address(uint8_t af, u_int unit, u_int addr_index, union ifbrip *ip)
207 {
208 switch (af) {
209 case AF_INET:
210 get_ipv4_address(unit, addr_index, &ip->ifbrip_addr);
211 break;
212 case AF_INET6:
213 get_ipv6_ula_address(unit, addr_index, &ip->ifbrip_addr6);
214 break;
215 default:
216 T_FAIL("unrecognized address family %u", af);
217 break;
218 }
219 }
220
221 static bool
ip_addresses_are_equal(uint8_t af,union ifbrip * ip1,union ifbrip * ip2)222 ip_addresses_are_equal(uint8_t af, union ifbrip * ip1, union ifbrip * ip2)
223 {
224 bool equal;
225
226 switch (af) {
227 case AF_INET:
228 equal = (ip1->ifbrip_addr.s_addr == ip2->ifbrip_addr.s_addr);
229 break;
230 case AF_INET6:
231 equal = IN6_ARE_ADDR_EQUAL(&ip1->ifbrip_addr6,
232 &ip2->ifbrip_addr6);
233 break;
234 default:
235 T_FAIL("unrecognized address family %u", af);
236 equal = false;
237 break;
238 }
239 return equal;
240 }
241
242 static ether_addr_t ether_external = {
243 { 0x80, 0x00, 0x00, 0x00, 0x00, 0x01 }
244 };
245
246 static inline struct in_addr
get_external_ipv4_address(void)247 get_external_ipv4_address(void)
248 {
249 struct in_addr ip;
250
251 /* IP 10.1.255.1 */
252 ip.s_addr = htonl(TEN_1_NET | 0xff01);
253 return ip;
254 }
255
256 static inline void
get_external_ip_address(uint8_t af,union ifbrip * ip)257 get_external_ip_address(uint8_t af, union ifbrip * ip)
258 {
259 switch (af) {
260 case AF_INET:
261 /* IP 10.1.255.1 */
262 ip->ifbrip_addr = get_external_ipv4_address();
263 break;
264 case AF_INET6:
265 /* fd80::1 */
266 ip->ifbrip_addr6 = ula_address;
267 ip->ifbrip_addr6.s6_addr[1] = 0x80;
268 ip->ifbrip_addr6.s6_addr[15] = 0x01;
269 break;
270 default:
271 T_FAIL("unrecognized address family %u", af);
272 break;
273 }
274 }
275
276 static inline void
get_broadcast_ip_address(uint8_t af,union ifbrip * ip)277 get_broadcast_ip_address(uint8_t af, union ifbrip * ip)
278 {
279 switch (af) {
280 case AF_INET:
281 ip->ifbrip_addr.s_addr = INADDR_BROADCAST;
282 break;
283 case AF_INET6:
284 /* 0xff0e::0 linklocal scope multicast */
285 ip->ifbrip_addr6 = in6addr_any;
286 ip->ifbrip_addr6.s6_addr[0] = 0xff;
287 ip->ifbrip_addr6.s6_addr[1] = __IPV6_ADDR_SCOPE_LINKLOCAL;
288 break;
289 default:
290 T_FAIL("unrecognized address family %u", af);
291 break;
292 }
293 }
294
295 #define ETHER_NTOA_BUFSIZE (ETHER_ADDR_LEN * 3)
296 static const char *
ether_ntoa_buf(const ether_addr_t * n,char * buf,int buf_size)297 ether_ntoa_buf(const ether_addr_t *n, char * buf, int buf_size)
298 {
299 char * str;
300
301 str = ether_ntoa(n);
302 strlcpy(buf, str, buf_size);
303 return buf;
304 }
305
306 static const char *
inet_ptrtop(int af,const void * ptr,char * buf,socklen_t buf_size)307 inet_ptrtop(int af, const void * ptr, char * buf, socklen_t buf_size)
308 {
309 union {
310 struct in_addr ip;
311 struct in6_addr ip6;
312 } u;
313
314 switch (af) {
315 case AF_INET:
316 bcopy(ptr, &u.ip, sizeof(u.ip));
317 break;
318 case AF_INET6:
319 bcopy(ptr, &u.ip6, sizeof(u.ip6));
320 break;
321 default:
322 return NULL;
323 }
324 return inet_ntop(af, &u, buf, buf_size);
325 }
326
327 static __inline__ char *
arpop_name(u_int16_t op)328 arpop_name(u_int16_t op)
329 {
330 switch (op) {
331 case ARPOP_REQUEST:
332 return "ARP REQUEST";
333 case ARPOP_REPLY:
334 return "ARP REPLY";
335 case ARPOP_REVREQUEST:
336 return "REVARP REQUEST";
337 case ARPOP_REVREPLY:
338 return "REVARP REPLY";
339 default:
340 break;
341 }
342 return "<unknown>";
343 }
344
345 static void
arp_frame_validate(const struct ether_arp * earp,u_int len,bool dump)346 arp_frame_validate(const struct ether_arp * earp, u_int len, bool dump)
347 {
348 const struct arphdr * arp_p;
349 int arphrd;
350 char buf_sender_ether[ETHER_NTOA_BUFSIZE];
351 char buf_sender_ip[INET_ADDRSTRLEN];
352 char buf_target_ether[ETHER_NTOA_BUFSIZE];
353 char buf_target_ip[INET_ADDRSTRLEN];
354
355 T_QUIET;
356 T_ASSERT_GE(len, (u_int)sizeof(*earp),
357 "%s ARP packet size %u need %u",
358 __func__, len, (u_int)sizeof(*earp));
359 if (!dump) {
360 return;
361 }
362 arp_p = &earp->ea_hdr;
363 arphrd = ntohs(arp_p->ar_hrd);
364 T_LOG("%s type=0x%x proto=0x%x", arpop_name(ntohs(arp_p->ar_op)),
365 arphrd, ntohs(arp_p->ar_pro));
366 if (arp_p->ar_hln == sizeof(earp->arp_sha)) {
367 ether_ntoa_buf((const ether_addr_t *)earp->arp_sha,
368 buf_sender_ether,
369 sizeof(buf_sender_ether));
370 ether_ntoa_buf((const ether_addr_t *)earp->arp_tha,
371 buf_target_ether,
372 sizeof(buf_target_ether));
373 T_LOG("Sender H/W\t%s", buf_sender_ether);
374 T_LOG("Target H/W\t%s", buf_target_ether);
375 }
376 inet_ptrtop(AF_INET, earp->arp_spa,
377 buf_sender_ip, sizeof(buf_sender_ip));
378 inet_ptrtop(AF_INET, earp->arp_tpa,
379 buf_target_ip, sizeof(buf_target_ip));
380 T_LOG("Sender IP\t%s", buf_sender_ip);
381 T_LOG("Target IP\t%s", buf_target_ip);
382 return;
383 }
384
385 static void
ip_frame_validate(const void * buf,u_int buf_len,bool dump)386 ip_frame_validate(const void * buf, u_int buf_len, bool dump)
387 {
388 char buf_dst[INET_ADDRSTRLEN];
389 char buf_src[INET_ADDRSTRLEN];
390 const ip_udp_header_t * ip_udp;
391 u_int ip_len;
392
393 T_QUIET;
394 T_ASSERT_GE(buf_len, (u_int)sizeof(struct ip), NULL);
395 ip_udp = (const ip_udp_header_t *)buf;
396 ip_len = ntohs(ip_udp->ip.ip_len);
397 inet_ptrtop(AF_INET, &ip_udp->ip.ip_src,
398 buf_src, sizeof(buf_src));
399 inet_ptrtop(AF_INET, &ip_udp->ip.ip_dst,
400 buf_dst, sizeof(buf_dst));
401 if (dump) {
402 T_LOG("ip src %s dst %s len %u id %d",
403 buf_src, buf_dst, ip_len,
404 ntohs(ip_udp->ip.ip_id));
405 }
406 T_QUIET;
407 T_ASSERT_GE(buf_len, ip_len, NULL);
408 T_QUIET;
409 T_ASSERT_EQ((u_int)ip_udp->ip.ip_v, IPVERSION, NULL);
410 T_QUIET;
411 T_ASSERT_EQ((u_int)(ip_udp->ip.ip_hl << 2),
412 (u_int)sizeof(struct ip), NULL);
413 if (ip_udp->ip.ip_p == IPPROTO_UDP) {
414 u_int udp_len;
415 u_int data_len;
416
417 T_QUIET;
418 T_ASSERT_GE(buf_len, (u_int)sizeof(*ip_udp), NULL);
419 udp_len = ntohs(ip_udp->udp.uh_ulen);
420 T_QUIET;
421 T_ASSERT_GE(udp_len, (u_int)sizeof(ip_udp->udp), NULL);
422 data_len = udp_len - (u_int)sizeof(ip_udp->udp);
423 if (dump) {
424 T_LOG("udp src 0x%x dst 0x%x len %u"
425 " csum 0x%x datalen %u",
426 ntohs(ip_udp->udp.uh_sport),
427 ntohs(ip_udp->udp.uh_dport),
428 udp_len,
429 ntohs(ip_udp->udp.uh_sum),
430 data_len);
431 }
432 }
433 }
434
435 static void
ip6_frame_validate(const void * buf,u_int buf_len,bool dump)436 ip6_frame_validate(const void * buf, u_int buf_len, bool dump)
437 {
438 char buf_dst[INET6_ADDRSTRLEN];
439 char buf_src[INET6_ADDRSTRLEN];
440 const struct ip6_hdr * ip6;
441 u_int ip6_len;
442
443 T_QUIET;
444 T_ASSERT_GE(buf_len, (u_int)sizeof(struct ip6_hdr), NULL);
445 ip6 = (const struct ip6_hdr *)buf;
446 ip6_len = ntohs(ip6->ip6_plen);
447 inet_ptrtop(AF_INET6, &ip6->ip6_src, buf_src, sizeof(buf_src));
448 inet_ptrtop(AF_INET6, &ip6->ip6_dst, buf_dst, sizeof(buf_dst));
449 if (dump) {
450 T_LOG("ip6 src %s dst %s len %u", buf_src, buf_dst, ip6_len);
451 }
452 T_QUIET;
453 T_ASSERT_GE(buf_len, ip6_len + (u_int)sizeof(struct ip6_hdr), NULL);
454 T_QUIET;
455 T_ASSERT_EQ((ip6->ip6_vfc & IPV6_VERSION_MASK),
456 IPV6_VERSION, NULL);
457 T_QUIET;
458 switch (ip6->ip6_nxt) {
459 case IPPROTO_UDP: {
460 u_int data_len;
461 const ip6_udp_header_t *ip6_udp;
462 u_int udp_len;
463
464 ip6_udp = (const ip6_udp_header_t *)buf;
465 T_QUIET;
466 T_ASSERT_GE(buf_len, (u_int)sizeof(*ip6_udp), NULL);
467 udp_len = ntohs(ip6_udp->udp.uh_ulen);
468 T_QUIET;
469 T_ASSERT_GE(udp_len, (u_int)sizeof(ip6_udp->udp), NULL);
470 data_len = udp_len - (u_int)sizeof(ip6_udp->udp);
471 if (dump) {
472 T_LOG("udp src 0x%x dst 0x%x len %u"
473 " csum 0x%x datalen %u",
474 ntohs(ip6_udp->udp.uh_sport),
475 ntohs(ip6_udp->udp.uh_dport),
476 udp_len,
477 ntohs(ip6_udp->udp.uh_sum),
478 data_len);
479 }
480 break;
481 }
482 case IPPROTO_ICMPV6: {
483 const struct icmp6_hdr *icmp6;
484 u_int icmp6_len;
485
486 icmp6_len = buf_len - sizeof(*ip6);
487 T_QUIET;
488 T_ASSERT_GE(buf_len, icmp6_len, NULL);
489 icmp6 = (const struct icmp6_hdr *)(ip6 + 1);
490 switch (icmp6->icmp6_type) {
491 case ND_NEIGHBOR_SOLICIT:
492 if (dump) {
493 T_LOG("neighbor solicit");
494 }
495 break;
496 case ND_NEIGHBOR_ADVERT:
497 if (dump) {
498 T_LOG("neighbor advert");
499 }
500 break;
501 case ND_ROUTER_SOLICIT:
502 if (dump) {
503 T_LOG("router solicit");
504 }
505 break;
506 default:
507 if (dump) {
508 T_LOG("icmp6 code 0x%x", icmp6->icmp6_type);
509 }
510 break;
511 }
512 break;
513 }
514 default:
515 break;
516 }
517 }
518
519 static void
ethernet_frame_validate(const void * buf,u_int buf_len,bool dump)520 ethernet_frame_validate(const void * buf, u_int buf_len, bool dump)
521 {
522 char ether_dst[ETHER_NTOA_BUFSIZE];
523 char ether_src[ETHER_NTOA_BUFSIZE];
524 uint16_t ether_type;
525 const ether_header_t * eh_p;
526
527 T_QUIET;
528 T_ASSERT_GE(buf_len, (u_int)sizeof(*eh_p), NULL);
529 eh_p = (const ether_header_t *)buf;
530 ether_type = ntohs(eh_p->ether_type);
531 ether_ntoa_buf((const ether_addr_t *)&eh_p->ether_dhost,
532 ether_dst, sizeof(ether_dst));
533 ether_ntoa_buf((const ether_addr_t *)&eh_p->ether_shost,
534 ether_src, sizeof(ether_src));
535 if (dump) {
536 T_LOG("ether dst %s src %s type 0x%x",
537 ether_dst, ether_src, ether_type);
538 }
539 switch (ether_type) {
540 case ETHERTYPE_IP:
541 ip_frame_validate(eh_p + 1, (u_int)(buf_len - sizeof(*eh_p)),
542 dump);
543 break;
544 case ETHERTYPE_ARP:
545 arp_frame_validate((const struct ether_arp *)(eh_p + 1),
546 (u_int)(buf_len - sizeof(*eh_p)),
547 dump);
548 break;
549 case ETHERTYPE_IPV6:
550 ip6_frame_validate(eh_p + 1, (u_int)(buf_len - sizeof(*eh_p)),
551 dump);
552 break;
553 default:
554 T_FAIL("unrecognized ethertype 0x%x", ether_type);
555 break;
556 }
557 }
558
559 static u_int
ethernet_udp_frame_populate(void * buf,size_t buf_len,uint8_t af,const ether_addr_t * src,union ifbrip * src_ip,uint16_t src_port,const ether_addr_t * dst,union ifbrip * dst_ip,uint16_t dst_port,const void * data,u_int data_len)560 ethernet_udp_frame_populate(void * buf, size_t buf_len,
561 uint8_t af,
562 const ether_addr_t * src,
563 union ifbrip * src_ip,
564 uint16_t src_port,
565 const ether_addr_t * dst,
566 union ifbrip * dst_ip,
567 uint16_t dst_port,
568 const void * data, u_int data_len)
569 {
570 u_int len;
571
572 switch (af) {
573 case AF_INET:
574 len = ethernet_udp4_frame_populate(buf, buf_len,
575 src,
576 src_ip->ifbrip_addr,
577 src_port,
578 dst,
579 dst_ip->ifbrip_addr,
580 dst_port,
581 data, data_len);
582 break;
583 case AF_INET6:
584 len = ethernet_udp6_frame_populate(buf, buf_len,
585 src,
586 &src_ip->ifbrip_addr6,
587 src_port,
588 dst,
589 &dst_ip->ifbrip_addr6,
590 dst_port,
591 data, data_len);
592 break;
593 default:
594 T_FAIL("unrecognized address family %u", af);
595 len = 0;
596 break;
597 }
598 return len;
599 }
600
601 static u_int
ethernet_arp_frame_populate(void * buf,u_int buf_len,uint16_t op,const ether_addr_t * sender_hw,struct in_addr sender_ip,const ether_addr_t * target_hw,struct in_addr target_ip)602 ethernet_arp_frame_populate(void * buf, u_int buf_len,
603 uint16_t op,
604 const ether_addr_t * sender_hw,
605 struct in_addr sender_ip,
606 const ether_addr_t * target_hw,
607 struct in_addr target_ip)
608 {
609 ether_header_t * eh_p;
610 struct ether_arp * earp;
611 struct arphdr * arp_p;
612 u_int frame_length;
613
614 frame_length = sizeof(*earp) + sizeof(*eh_p);
615 T_QUIET;
616 T_ASSERT_GE(buf_len, frame_length,
617 "%s buffer size %u needed %u",
618 __func__, buf_len, frame_length);
619
620 /* ethernet_header */
621 eh_p = (ether_header_t *)buf;
622 bcopy(sender_hw, eh_p->ether_shost, ETHER_ADDR_LEN);
623 if (target_hw != NULL) {
624 bcopy(target_hw, eh_p->ether_dhost,
625 sizeof(eh_p->ether_dhost));
626 } else {
627 bcopy(ðer_broadcast, eh_p->ether_dhost,
628 sizeof(eh_p->ether_dhost));
629 }
630 eh_p->ether_type = htons(ETHERTYPE_ARP);
631
632 /* ARP payload */
633 earp = (struct ether_arp *)(void *)(eh_p + 1);
634 arp_p = &earp->ea_hdr;
635 arp_p->ar_hrd = htons(ARPHRD_ETHER);
636 arp_p->ar_pro = htons(ETHERTYPE_IP);
637 arp_p->ar_hln = sizeof(earp->arp_sha);
638 arp_p->ar_pln = sizeof(struct in_addr);
639 arp_p->ar_op = htons(op);
640 bcopy(sender_hw, earp->arp_sha, sizeof(earp->arp_sha));
641 bcopy(&sender_ip, earp->arp_spa, sizeof(earp->arp_spa));
642 if (target_hw != NULL) {
643 bcopy(target_hw, earp->arp_tha, sizeof(earp->arp_tha));
644 } else {
645 bzero(earp->arp_tha, sizeof(earp->arp_tha));
646 }
647 bcopy(&target_ip, earp->arp_tpa, sizeof(earp->arp_tpa));
648 return frame_length;
649 }
650
651 static uint32_t G_generation;
652
653 static uint32_t
next_generation(void)654 next_generation(void)
655 {
656 return G_generation++;
657 }
658
659 static const void *
ethernet_frame_get_udp4_payload(void * buf,u_int buf_len,u_int * ret_payload_length)660 ethernet_frame_get_udp4_payload(void * buf, u_int buf_len,
661 u_int * ret_payload_length)
662 {
663 ether_header_t * eh_p;
664 uint16_t ether_type;
665 ip_udp_header_t * ip_udp;
666 u_int ip_len;
667 u_int left;
668 const void * payload = NULL;
669 u_int payload_length = 0;
670 u_int udp_len;
671
672 T_QUIET;
673 T_ASSERT_GE(buf_len, (u_int)(sizeof(*eh_p) + sizeof(*ip_udp)), NULL);
674 left = buf_len;
675 eh_p = (ether_header_t *)buf;
676 ether_type = ntohs(eh_p->ether_type);
677 T_QUIET;
678 T_ASSERT_EQ((int)ether_type, ETHERTYPE_IP, NULL);
679 ip_udp = (ip_udp_header_t *)(void *)(eh_p + 1);
680 left -= sizeof(*eh_p);
681 ip_len = ntohs(ip_udp->ip.ip_len);
682 T_QUIET;
683 T_ASSERT_GE(left, ip_len, NULL);
684 T_QUIET;
685 T_ASSERT_EQ((int)ip_udp->ip.ip_v, IPVERSION, NULL);
686 T_QUIET;
687 T_ASSERT_EQ((u_int)ip_udp->ip.ip_hl << 2, (u_int)sizeof(struct ip),
688 NULL);
689 T_QUIET;
690 T_ASSERT_EQ((int)ip_udp->ip.ip_p, IPPROTO_UDP, NULL);
691 T_QUIET;
692 T_ASSERT_GE(buf_len, (u_int)sizeof(*ip_udp), NULL);
693 udp_len = ntohs(ip_udp->udp.uh_ulen);
694 T_QUIET;
695 T_ASSERT_GE(udp_len, (u_int)sizeof(ip_udp->udp), NULL);
696 payload_length = udp_len - (int)sizeof(ip_udp->udp);
697 if (payload_length > 0) {
698 payload = (ip_udp + 1);
699 }
700 if (payload == NULL) {
701 payload_length = 0;
702 }
703 *ret_payload_length = payload_length;
704 return payload;
705 }
706
707 static const void *
ethernet_frame_get_udp6_payload(void * buf,u_int buf_len,u_int * ret_payload_length)708 ethernet_frame_get_udp6_payload(void * buf, u_int buf_len,
709 u_int * ret_payload_length)
710 {
711 ether_header_t * eh_p;
712 uint16_t ether_type;
713 ip6_udp_header_t * ip6_udp;
714 u_int ip6_len;
715 u_int left;
716 const void * payload = NULL;
717 u_int payload_length = 0;
718 u_int udp_len;
719
720 T_QUIET;
721 T_ASSERT_GE(buf_len, (u_int)(sizeof(*eh_p) + sizeof(*ip6_udp)), NULL);
722 left = buf_len;
723 eh_p = (ether_header_t *)buf;
724 ether_type = ntohs(eh_p->ether_type);
725 T_QUIET;
726 T_ASSERT_EQ((int)ether_type, ETHERTYPE_IPV6, NULL);
727 ip6_udp = (ip6_udp_header_t *)(void *)(eh_p + 1);
728 left -= sizeof(*eh_p);
729 ip6_len = ntohs(ip6_udp->ip6.ip6_plen);
730 T_QUIET;
731 T_ASSERT_GE(left, ip6_len + (u_int)sizeof(struct ip6_hdr), NULL);
732 T_QUIET;
733 T_ASSERT_EQ((int)(ip6_udp->ip6.ip6_vfc & IPV6_VERSION_MASK),
734 IPV6_VERSION, NULL);
735 T_QUIET;
736 T_ASSERT_EQ((int)ip6_udp->ip6.ip6_nxt, IPPROTO_UDP, NULL);
737 T_QUIET;
738 T_ASSERT_GE(buf_len, (u_int)sizeof(*ip6_udp), NULL);
739 udp_len = ntohs(ip6_udp->udp.uh_ulen);
740 T_QUIET;
741 T_ASSERT_GE(udp_len, (u_int)sizeof(ip6_udp->udp), NULL);
742 payload_length = udp_len - (int)sizeof(ip6_udp->udp);
743 if (payload_length > 0) {
744 payload = (ip6_udp + 1);
745 }
746 if (payload == NULL) {
747 payload_length = 0;
748 }
749 *ret_payload_length = payload_length;
750 return payload;
751 }
752
753 static const void *
ethernet_frame_get_udp_payload(uint8_t af,void * buf,u_int buf_len,u_int * ret_payload_length)754 ethernet_frame_get_udp_payload(uint8_t af, void * buf, u_int buf_len,
755 u_int * ret_payload_length)
756 {
757 const void * payload;
758
759 switch (af) {
760 case AF_INET:
761 payload = ethernet_frame_get_udp4_payload(buf, buf_len,
762 ret_payload_length);
763 break;
764 case AF_INET6:
765 payload = ethernet_frame_get_udp6_payload(buf, buf_len,
766 ret_payload_length);
767 break;
768 default:
769 T_FAIL("unrecognized address family %u", af);
770 payload = NULL;
771 break;
772 }
773 return payload;
774 }
775
776 #define MIN_ICMP6_LEN ((u_int)(sizeof(ether_header_t) + \
777 sizeof(struct ip6_hdr) + \
778 sizeof(struct icmp6_hdr)))
779 #define ALIGNED_ND_OPT_LEN 8
780 #define SET_ND_OPT_LEN(a) (u_int)((a) >> 3)
781 #define GET_ND_OPT_LEN(a) (u_int)((a) << 3)
782 #define ALIGN_ND_OPT(a) (u_int)roundup(a, ALIGNED_ND_OPT_LEN)
783 #define LINKADDR_OPT_LEN (ALIGN_ND_OPT(sizeof(struct nd_opt_hdr) + \
784 sizeof(ether_addr_t)))
785 #define ETHER_IPV6_LEN (sizeof(*eh_p) + sizeof(*ip6))
786
787
788
789 static u_int
ethernet_nd6_frame_populate(void * buf,u_int buf_len,uint8_t type,const ether_addr_t * sender_hw,struct in6_addr * sender_ip,const ether_addr_t * dest_ether,const ether_addr_t * target_hw,struct in6_addr * target_ip)790 ethernet_nd6_frame_populate(void * buf, u_int buf_len,
791 uint8_t type,
792 const ether_addr_t * sender_hw,
793 struct in6_addr * sender_ip,
794 const ether_addr_t * dest_ether,
795 const ether_addr_t * target_hw,
796 struct in6_addr * target_ip)
797 {
798 u_int data_len = 0;
799 ether_header_t * eh_p;
800 u_int frame_length;
801 struct icmp6_hdr * icmp6;
802 struct ip6_hdr * ip6;
803 struct nd_opt_hdr * nd_opt;
804
805 switch (type) {
806 case ND_ROUTER_SOLICIT:
807 case ND_NEIGHBOR_ADVERT:
808 case ND_NEIGHBOR_SOLICIT:
809 break;
810 default:
811 T_FAIL("%s: unsupported type %u", __func__, type);
812 return 0;
813 }
814
815 T_QUIET;
816 T_ASSERT_GE(buf_len, MIN_ICMP6_LEN, NULL);
817
818 eh_p = (ether_header_t *)buf;
819 ip6 = (struct ip6_hdr *)(void *)(eh_p + 1);
820 icmp6 = (struct icmp6_hdr *)(void *)(ip6 + 1);
821 frame_length = sizeof(*eh_p) + sizeof(*ip6);
822 switch (type) {
823 case ND_NEIGHBOR_SOLICIT: {
824 struct nd_neighbor_solicit * nd_ns;
825 bool sender_is_specified;
826
827 sender_is_specified = !IN6_IS_ADDR_UNSPECIFIED(sender_ip);
828 data_len = sizeof(*nd_ns);
829 if (sender_is_specified) {
830 data_len += LINKADDR_OPT_LEN;
831 }
832 frame_length += data_len;
833 T_QUIET;
834 T_ASSERT_GE(buf_len, frame_length, NULL);
835 nd_ns = (struct nd_neighbor_solicit *)(void *)icmp6;
836 if (sender_is_specified) {
837 /* add the source lladdr option */
838 nd_opt = (struct nd_opt_hdr *)(nd_ns + 1);
839 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
840 nd_opt->nd_opt_len = SET_ND_OPT_LEN(LINKADDR_OPT_LEN);
841 bcopy(sender_hw, (nd_opt + 1), sizeof(*sender_hw));
842 }
843 bcopy(target_ip, &nd_ns->nd_ns_target,
844 sizeof(nd_ns->nd_ns_target));
845 break;
846 }
847 case ND_NEIGHBOR_ADVERT: {
848 struct nd_neighbor_advert * nd_na;
849
850 data_len = sizeof(*nd_na) + LINKADDR_OPT_LEN;
851 frame_length += data_len;
852 T_QUIET;
853 T_ASSERT_GE(buf_len, frame_length, NULL);
854
855 nd_na = (struct nd_neighbor_advert *)(void *)icmp6;
856 bcopy(target_ip, &nd_na->nd_na_target,
857 sizeof(nd_na->nd_na_target));
858 /* add the target lladdr option */
859 nd_opt = (struct nd_opt_hdr *)(nd_na + 1);
860 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
861 nd_opt->nd_opt_len = SET_ND_OPT_LEN(LINKADDR_OPT_LEN);
862 bcopy(target_hw, (nd_opt + 1), sizeof(*target_hw));
863 break;
864 }
865 case ND_ROUTER_SOLICIT: {
866 struct nd_router_solicit * nd_rs;
867
868 data_len = sizeof(*nd_rs) + LINKADDR_OPT_LEN;
869 frame_length += data_len;
870 T_QUIET;
871 T_ASSERT_GE(buf_len, frame_length, NULL);
872
873 nd_rs = (struct nd_router_solicit *)(void *)icmp6;
874
875 /* add the source lladdr option */
876 nd_opt = (struct nd_opt_hdr *)(nd_rs + 1);
877 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
878 nd_opt->nd_opt_len = SET_ND_OPT_LEN(LINKADDR_OPT_LEN);
879 bcopy(sender_hw, (nd_opt + 1), sizeof(*sender_hw));
880 break;
881 }
882 default:
883 T_FAIL("%s: unsupported type %u", __func__, type);
884 return 0;
885 }
886 /* icmp6 header */
887 icmp6->icmp6_type = type;
888 icmp6->icmp6_code = 0;
889 icmp6->icmp6_cksum = 0;
890 icmp6->icmp6_data32[0] = 0;
891
892 /* ethernet_header */
893 bcopy(sender_hw, eh_p->ether_shost, ETHER_ADDR_LEN);
894 if (dest_ether != NULL) {
895 bcopy(dest_ether, eh_p->ether_dhost,
896 sizeof(eh_p->ether_dhost));
897 } else {
898 /* XXX ether_dhost should be multicast */
899 bcopy(ðer_broadcast, eh_p->ether_dhost,
900 sizeof(eh_p->ether_dhost));
901 }
902 eh_p->ether_type = htons(ETHERTYPE_IPV6);
903
904 /* IPv6 header */
905 bzero(ip6, sizeof(*ip6));
906 ip6->ip6_nxt = IPPROTO_ICMPV6;
907 ip6->ip6_vfc = IPV6_VERSION;
908 bcopy(sender_ip, &ip6->ip6_src, sizeof(ip6->ip6_src));
909 /* XXX ip6_dst should be specific multicast */
910 bcopy(&in6addr_linklocal_allnodes, &ip6->ip6_dst, sizeof(ip6->ip6_dst));
911 ip6->ip6_plen = htons(data_len);
912
913 return frame_length;
914 }
915
916 /**
917 ** Switch port
918 **/
919 static void
switch_port_check_tx(switch_port_t port)920 switch_port_check_tx(switch_port_t port)
921 {
922 int error;
923 struct kevent kev;
924 int kq;
925 struct timespec ts = { .tv_sec = 0, .tv_nsec = 1000 * 1000};
926
927 kq = kqueue();
928 T_QUIET;
929 T_ASSERT_POSIX_SUCCESS(kq, "kqueue check_tx");
930 EV_SET(&kev, port->fd, EVFILT_WRITE, EV_ADD | EV_ENABLE, 0, 0, NULL);
931 error = kevent(kq, &kev, 1, &kev, 1, &ts);
932 T_QUIET;
933 T_ASSERT_EQ(error, 1, "kevent");
934 T_QUIET;
935 T_ASSERT_EQ((int)kev.filter, EVFILT_WRITE, NULL);
936 T_QUIET;
937 T_ASSERT_EQ((int)kev.ident, port->fd, NULL);
938 T_QUIET;
939 T_ASSERT_NULL(kev.udata, NULL);
940 close(kq);
941 return;
942 }
943
944 static void
switch_port_send_arp(switch_port_t port,uint16_t op,const ether_addr_t * sender_hw,struct in_addr sender_ip,const ether_addr_t * target_hw,struct in_addr target_ip)945 switch_port_send_arp(switch_port_t port,
946 uint16_t op,
947 const ether_addr_t * sender_hw,
948 struct in_addr sender_ip,
949 const ether_addr_t * target_hw,
950 struct in_addr target_ip)
951 {
952 u_int frame_length;
953 ether_packet pkt;
954 ssize_t n;
955
956 /* make sure we can send */
957 switch_port_check_tx(port);
958 frame_length = ethernet_arp_frame_populate(&pkt, sizeof(pkt),
959 op,
960 sender_hw,
961 sender_ip,
962 target_hw,
963 target_ip);
964 T_QUIET;
965 T_ASSERT_GT(frame_length, 0, "%s: frame_length %u",
966 __func__, frame_length);
967 if (G_debug) {
968 T_LOG("Port %s -> %s transmitting %u bytes",
969 port->ifname, port->member_ifname, frame_length);
970 }
971 ethernet_frame_validate(&pkt, frame_length, G_debug);
972 n = write(port->fd, &pkt, frame_length);
973 if (n < 0) {
974 T_ASSERT_POSIX_SUCCESS(n, "%s write fd %d failed %ld",
975 port->ifname, port->fd, n);
976 }
977 T_QUIET;
978 T_ASSERT_EQ((u_int)n, frame_length,
979 "%s fd %d wrote %ld",
980 port->ifname, port->fd, n);
981 }
982
983
984 static void
switch_port_send_nd6(switch_port_t port,uint8_t type,const ether_addr_t * sender_hw,struct in6_addr * sender_ip,const ether_addr_t * dest_ether,const ether_addr_t * target_hw,struct in6_addr * target_ip)985 switch_port_send_nd6(switch_port_t port,
986 uint8_t type,
987 const ether_addr_t * sender_hw,
988 struct in6_addr * sender_ip,
989 const ether_addr_t * dest_ether,
990 const ether_addr_t * target_hw,
991 struct in6_addr * target_ip)
992 {
993 u_int frame_length;
994 ether_packet pkt;
995 ssize_t n;
996
997 /* make sure we can send */
998 switch_port_check_tx(port);
999 frame_length = ethernet_nd6_frame_populate(&pkt, sizeof(pkt),
1000 type,
1001 sender_hw,
1002 sender_ip,
1003 dest_ether,
1004 target_hw,
1005 target_ip);
1006 T_QUIET;
1007 T_ASSERT_GT(frame_length, 0, "%s: frame_length %u",
1008 __func__, frame_length);
1009 if (G_debug) {
1010 T_LOG("Port %s -> %s transmitting %u bytes",
1011 port->ifname, port->member_ifname, frame_length);
1012 }
1013 ethernet_frame_validate(&pkt, frame_length, G_debug);
1014 n = write(port->fd, &pkt, frame_length);
1015 if (n < 0) {
1016 T_ASSERT_POSIX_SUCCESS(n, "%s write fd %d failed %ld",
1017 port->ifname, port->fd, n);
1018 }
1019 T_QUIET;
1020 T_ASSERT_EQ((u_int)n, frame_length,
1021 "%s fd %d wrote %ld",
1022 port->ifname, port->fd, n);
1023 }
1024
1025
1026 static void
switch_port_send_udp(switch_port_t port,uint8_t af,const ether_addr_t * src_eaddr,union ifbrip * src_ip,uint16_t src_port,const ether_addr_t * dst_eaddr,union ifbrip * dst_ip,uint16_t dst_port,const void * payload,u_int payload_length)1027 switch_port_send_udp(switch_port_t port,
1028 uint8_t af,
1029 const ether_addr_t * src_eaddr,
1030 union ifbrip * src_ip,
1031 uint16_t src_port,
1032 const ether_addr_t * dst_eaddr,
1033 union ifbrip * dst_ip,
1034 uint16_t dst_port,
1035 const void * payload, u_int payload_length)
1036 {
1037 u_int frame_length;
1038 ether_packet pkt;
1039 ssize_t n;
1040
1041 /* make sure we can send */
1042 switch_port_check_tx(port);
1043
1044 /* generate the packet */
1045 frame_length
1046 = ethernet_udp_frame_populate((void *)&pkt,
1047 (u_int)sizeof(pkt),
1048 af,
1049 src_eaddr,
1050 src_ip,
1051 src_port,
1052 dst_eaddr,
1053 dst_ip,
1054 dst_port,
1055 payload,
1056 payload_length);
1057 T_QUIET;
1058 T_ASSERT_GT(frame_length, 0, NULL);
1059 if (G_debug) {
1060 T_LOG("Port %s transmitting %u bytes",
1061 port->ifname, frame_length);
1062 }
1063 ethernet_frame_validate(&pkt, frame_length, G_debug);
1064 n = write(port->fd, &pkt, frame_length);
1065 if (n < 0) {
1066 T_ASSERT_POSIX_SUCCESS(n, "%s write fd %d failed %ld",
1067 port->ifname, port->fd, n);
1068 }
1069 T_QUIET;
1070 T_ASSERT_EQ((u_int)n, frame_length,
1071 "%s fd %d wrote %ld",
1072 port->ifname, port->fd, n);
1073 }
1074
1075
1076
1077 static void
switch_port_send_udp_addr_index(switch_port_t port,uint8_t af,u_int addr_index,const ether_addr_t * dst_eaddr,union ifbrip * dst_ip,const void * payload,u_int payload_length)1078 switch_port_send_udp_addr_index(switch_port_t port,
1079 uint8_t af,
1080 u_int addr_index,
1081 const ether_addr_t * dst_eaddr,
1082 union ifbrip * dst_ip,
1083 const void * payload, u_int payload_length)
1084 {
1085 ether_addr_t eaddr;
1086 union ifbrip ip;
1087
1088 /* generate traffic for the unit and address */
1089 set_ethernet_address(&eaddr, port->unit, addr_index);
1090 get_ip_address(af, port->unit, addr_index, &ip);
1091 switch_port_send_udp(port, af,
1092 &eaddr, &ip, TEST_SOURCE_PORT,
1093 dst_eaddr, dst_ip, TEST_DEST_PORT,
1094 payload, payload_length);
1095 }
1096
1097 typedef void
1098 (packet_validator)(switch_port_t port, const ether_header_t * eh_p,
1099 u_int pkt_len, void * context);
1100 typedef packet_validator * packet_validator_t;
1101
1102 static void
switch_port_receive(switch_port_t port,uint8_t af,const void * payload,u_int payload_length,packet_validator_t validator,void * context)1103 switch_port_receive(switch_port_t port,
1104 uint8_t af,
1105 const void * payload, u_int payload_length,
1106 packet_validator_t validator,
1107 void * context)
1108 {
1109 ether_header_t * eh_p;
1110 ssize_t n;
1111 char * offset;
1112
1113 n = read(port->fd, port->rx_buf, (unsigned)port->rx_buf_size);
1114 if (n < 0) {
1115 if (errno == EAGAIN) {
1116 return;
1117 }
1118 T_QUIET;
1119 T_ASSERT_POSIX_SUCCESS(n, "read %s port %d fd %d",
1120 port->ifname, port->unit, port->fd);
1121 return;
1122 }
1123 for (offset = port->rx_buf; n > 0;) {
1124 struct bpf_hdr * bpf = (struct bpf_hdr *)(void *)offset;
1125 u_int pkt_len;
1126 char * pkt;
1127 u_int skip;
1128
1129 pkt = offset + bpf->bh_hdrlen;
1130 pkt_len = bpf->bh_caplen;
1131
1132 eh_p = (ether_header_t *)(void *)pkt;
1133 T_QUIET;
1134 T_ASSERT_GE(pkt_len, (u_int)sizeof(*eh_p),
1135 "short packet %ld", n);
1136
1137 /* source shouldn't be broadcast/multicast */
1138 T_QUIET;
1139 T_ASSERT_EQ(eh_p->ether_shost[0] & 0x01, 0,
1140 "broadcast/multicast source");
1141
1142 if (G_debug) {
1143 T_LOG("Port %s [unit %d] [fd %d] Received %u bytes",
1144 port->ifname, port->unit, port->fd, pkt_len);
1145 }
1146 ethernet_frame_validate(pkt, pkt_len, G_debug);
1147
1148 /* call the validation function */
1149 (*validator)(port, eh_p, pkt_len, context);
1150
1151 if (payload != NULL) {
1152 const void * p;
1153 u_int p_len;
1154
1155 p = ethernet_frame_get_udp_payload(af, pkt, pkt_len,
1156 &p_len);
1157 T_QUIET;
1158 T_ASSERT_NOTNULL(p, "ethernet_frame_get_udp_payload");
1159 T_QUIET;
1160 T_ASSERT_EQ(p_len, payload_length,
1161 "payload length %u < expected %u",
1162 p_len, payload_length);
1163 T_QUIET;
1164 T_ASSERT_EQ(bcmp(payload, p, payload_length), 0,
1165 "unexpected payload");
1166 }
1167 skip = BPF_WORDALIGN(pkt_len + bpf->bh_hdrlen);
1168 if (skip == 0) {
1169 break;
1170 }
1171 offset += skip;
1172 n -= skip;
1173 }
1174 return;
1175 }
1176
1177 static void
switch_port_log(switch_port_t port)1178 switch_port_log(switch_port_t port)
1179 {
1180 T_LOG("%s [unit %d] [member %s]%s bpf fd %d bufsize %d\n",
1181 port->ifname, port->unit,
1182 port->member_ifname,
1183 port->mac_nat ? " [mac-nat]" : "",
1184 port->fd, port->rx_buf_size);
1185 }
1186
1187 #define switch_port_list_size(port_count) \
1188 offsetof(switch_port_list, list[port_count])
1189
1190 static switch_port_list_t
switch_port_list_alloc(u_int port_count,bool mac_nat)1191 switch_port_list_alloc(u_int port_count, bool mac_nat)
1192 {
1193 switch_port_list_t list;
1194
1195 list = (switch_port_list_t)
1196 calloc(1, switch_port_list_size(port_count));;
1197 list->size = port_count;
1198 list->mac_nat = mac_nat;
1199 return list;
1200 }
1201
1202 static void
switch_port_list_dealloc(switch_port_list_t list)1203 switch_port_list_dealloc(switch_port_list_t list)
1204 {
1205 u_int i;
1206 switch_port_t port;
1207
1208 for (i = 0, port = list->list; i < list->count; i++, port++) {
1209 close(port->fd);
1210 free(port->rx_buf);
1211 }
1212 free(list);
1213 return;
1214 }
1215
1216 static errno_t
switch_port_list_add_port(switch_port_list_t port_list,u_int unit,const char * ifname,u_short if_index,const char * member_ifname,u_int num_addrs,bool mac_nat,struct in_addr * ip)1217 switch_port_list_add_port(switch_port_list_t port_list, u_int unit,
1218 const char * ifname, u_short if_index, const char * member_ifname,
1219 u_int num_addrs, bool mac_nat, struct in_addr * ip)
1220 {
1221 int buf_size;
1222 errno_t err = EINVAL;
1223 int fd = -1;
1224 char ntopbuf_ip[INET6_ADDRSTRLEN];
1225 int opt;
1226 switch_port_t p;
1227
1228 if (port_list->count >= port_list->size) {
1229 T_LOG("Internal error: port_list count %u >= size %u\n",
1230 port_list->count, port_list->size);
1231 goto failed;
1232 }
1233 fd = bpf_new();
1234 if (fd < 0) {
1235 err = errno;
1236 T_LOG("bpf_new");
1237 goto failed;
1238 }
1239 bpf_set_traffic_class(fd, SO_TC_CTL);
1240 opt = 1;
1241 T_QUIET;
1242 T_ASSERT_POSIX_SUCCESS(ioctl(fd, FIONBIO, &opt), NULL);
1243 T_QUIET;
1244 T_ASSERT_POSIX_SUCCESS(bpf_set_immediate(fd, 1), NULL);
1245 T_QUIET;
1246 T_ASSERT_POSIX_SUCCESS(bpf_setif(fd, ifname), "bpf set if %s",
1247 ifname);
1248 T_QUIET;
1249 T_ASSERT_POSIX_SUCCESS(bpf_set_see_sent(fd, 0), NULL);
1250 T_QUIET;
1251 T_ASSERT_POSIX_SUCCESS(bpf_set_header_complete(fd, 1), NULL);
1252 T_QUIET;
1253 T_ASSERT_POSIX_SUCCESS(bpf_get_blen(fd, &buf_size), NULL);
1254 if (G_debug) {
1255 T_LOG("%s [unit %d] [member %s] bpf fd %d bufsize %d\n",
1256 ifname, unit,
1257 member_ifname, fd, buf_size);
1258 }
1259 p = port_list->list + port_list->count++;
1260 p->fd = fd;
1261 p->unit = unit;
1262 strlcpy(p->ifname, ifname, sizeof(p->ifname));
1263 strlcpy(p->member_ifname, member_ifname, sizeof(p->member_ifname));
1264 p->num_addrs = num_addrs;
1265 p->rx_buf_size = buf_size;
1266 p->rx_buf = malloc((unsigned)buf_size);
1267 p->mac_nat = mac_nat;
1268 ifnet_get_lladdr(ifname, &p->mac);
1269 ifnet_get_lladdr(member_ifname, &p->member_mac);
1270 p->ip = *ip;
1271 p->if_index = if_index;
1272 get_ipv6_ll_address(&p->mac, &p->ip6);
1273 inet_ntop(AF_INET6, &p->ip6, ntopbuf_ip, sizeof(ntopbuf_ip));
1274 T_LOG("%s %s", ifname, ntopbuf_ip);
1275 return 0;
1276
1277 failed:
1278 if (fd >= 0) {
1279 close(fd);
1280 }
1281 return err;
1282 }
1283
1284 static switch_port_t
switch_port_list_find_fd(switch_port_list_t ports,int fd)1285 switch_port_list_find_fd(switch_port_list_t ports, int fd)
1286 {
1287 u_int i;
1288 switch_port_t port;
1289
1290 for (i = 0, port = ports->list; i < ports->count; i++, port++) {
1291 if (port->fd == fd) {
1292 return port;
1293 }
1294 }
1295 return NULL;
1296 }
1297
1298 static void
switch_port_list_log(switch_port_list_t port_list)1299 switch_port_list_log(switch_port_list_t port_list)
1300 {
1301 u_int i;
1302 switch_port_t port;
1303
1304 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1305 switch_port_log(port);
1306 }
1307 return;
1308 }
1309
1310 static switch_port_t
switch_port_list_find_member(switch_port_list_t ports,const char * member_ifname)1311 switch_port_list_find_member(switch_port_list_t ports, const char * member_ifname)
1312 {
1313 u_int i;
1314 switch_port_t port;
1315
1316 for (i = 0, port = ports->list; i < ports->count; i++, port++) {
1317 if (strcmp(port->member_ifname, member_ifname) == 0) {
1318 return port;
1319 }
1320 }
1321 return NULL;
1322 }
1323
1324 static void
switch_port_list_check_receive(switch_port_list_t ports,uint8_t af,const void * payload,u_int payload_length,packet_validator_t validator,void * context)1325 switch_port_list_check_receive(switch_port_list_t ports, uint8_t af,
1326 const void * payload, u_int payload_length,
1327 packet_validator_t validator,
1328 void * context)
1329 {
1330 int i;
1331 int n_events;
1332 struct kevent kev[ports->count];
1333 int kq;
1334 switch_port_t port;
1335 struct timespec ts = { .tv_sec = 0, .tv_nsec = 10 * 1000 * 1000};
1336 u_int u;
1337
1338 kq = kqueue();
1339 T_QUIET;
1340 T_ASSERT_POSIX_SUCCESS(kq, "kqueue check_receive");
1341 for (u = 0, port = ports->list; u < ports->count; u++, port++) {
1342 port->test_count = 0;
1343 EV_SET(kev + u, port->fd,
1344 EVFILT_READ, EV_ADD | EV_ENABLE, 0, 0, NULL);
1345 }
1346
1347 do {
1348 n_events = kevent(kq, kev, (int)ports->count, kev,
1349 (int)ports->count, &ts);
1350 T_QUIET;
1351 T_ASSERT_POSIX_SUCCESS(n_events, "kevent receive %d", n_events);
1352 for (i = 0; i < n_events; i++) {
1353 T_QUIET;
1354 T_ASSERT_EQ((int)kev[i].filter, EVFILT_READ, NULL);
1355 T_QUIET;
1356 T_ASSERT_NULL(kev[i].udata, NULL);
1357 port = switch_port_list_find_fd(ports,
1358 (int)kev[i].ident);
1359 T_QUIET;
1360 T_ASSERT_NE(port, NULL,
1361 "port %p fd %d", (void *)port,
1362 (int)kev[i].ident);
1363 switch_port_receive(port, af, payload, payload_length,
1364 validator, context);
1365 }
1366 } while (n_events != 0);
1367 close(kq);
1368 }
1369
1370 static bool
switch_port_list_verify_rt_table(switch_port_list_t port_list,bool log)1371 switch_port_list_verify_rt_table(switch_port_list_t port_list, bool log)
1372 {
1373 bool all_present = true;
1374 u_int i;
1375 u_int count;
1376 struct ifbareq *ifba;
1377 struct ifbareq *rt_table;
1378 switch_port_t port;
1379
1380 /* clear out current notion of how many addresses are present */
1381 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1382 port->test_address_count = 0;
1383 port->test_address_present = 0;
1384 }
1385 rt_table = bridge_rt_table_copy(&count);
1386 if (rt_table == NULL) {
1387 return false;
1388 }
1389 if (log) {
1390 bridge_rt_table_log(rt_table, count);
1391 }
1392 for (i = 0, ifba = rt_table; i < count; i++, ifba++) {
1393 uint64_t addr_bit;
1394 u_int addr_index;
1395 u_int unit_index;
1396 u_char * ea;
1397 ether_addr_t * eaddr;
1398
1399 eaddr = (ether_addr_t *)&ifba->ifba_dst;
1400 ea = eaddr->octet;
1401 addr_index = ea[EA_ADDR_INDEX];
1402 unit_index = ea[EA_UNIT_INDEX];
1403 port = switch_port_list_find_member(port_list,
1404 ifba->ifba_ifsname);
1405 T_QUIET;
1406 T_ASSERT_NOTNULL(port, "switch_port_list_find_member %s",
1407 ifba->ifba_ifsname);
1408 if (!S_cleaning_up) {
1409 T_QUIET;
1410 T_ASSERT_EQ(unit_index, port->unit, NULL);
1411 addr_bit = 1 << addr_index;
1412 T_QUIET;
1413 T_ASSERT_BITS_NOTSET(port->test_address_present,
1414 addr_bit, "%s address %u",
1415 ifba->ifba_ifsname, addr_index);
1416 port->test_address_present |= addr_bit;
1417 port->test_address_count++;
1418 }
1419 }
1420 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1421 if (G_debug) {
1422 T_LOG("%s unit %d [member %s] %u expect %u",
1423 port->ifname, port->unit, port->member_ifname,
1424 port->test_address_count, port->num_addrs);
1425 }
1426 if (port->test_address_count != port->num_addrs) {
1427 all_present = false;
1428 }
1429 }
1430
1431 free(rt_table);
1432 return all_present;
1433 }
1434
1435 static bool
switch_port_list_verify_mac_nat(switch_port_list_t port_list,bool log)1436 switch_port_list_verify_mac_nat(switch_port_list_t port_list, bool log)
1437 {
1438 bool all_present = true;
1439 u_int i;
1440 u_int count;
1441 static struct ifbrmne * entries;
1442 switch_port_t port;
1443 struct ifbrmne * scan;
1444
1445
1446 /* clear out current notion of how many addresses are present */
1447 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1448 port->test_address_count = 0;
1449 port->test_address_present = 0;
1450 }
1451 entries = bridge_mac_nat_entries_copy(&count);
1452 if (entries == NULL) {
1453 return false;
1454 }
1455 if (log) {
1456 bridge_mac_nat_entries_log(entries, count);
1457 }
1458 for (i = 0, scan = entries; i < count; i++, scan++) {
1459 uint8_t af;
1460 uint64_t addr_bit;
1461 u_int addr_index;
1462 char buf_ip1[INET6_ADDRSTRLEN];
1463 char buf_ip2[INET6_ADDRSTRLEN];
1464 u_char * ea;
1465 ether_addr_t * eaddr;
1466 union ifbrip ip;
1467 u_int unit_index;
1468
1469 eaddr = (ether_addr_t *)&scan->ifbmne_mac;
1470 ea = eaddr->octet;
1471 addr_index = ea[EA_ADDR_INDEX];
1472 unit_index = ea[EA_UNIT_INDEX];
1473 port = switch_port_list_find_member(port_list,
1474 scan->ifbmne_ifname);
1475 T_QUIET;
1476 T_ASSERT_NOTNULL(port,
1477 "switch_port_list_find_member %s",
1478 scan->ifbmne_ifname);
1479 T_QUIET;
1480 T_ASSERT_EQ(unit_index, port->unit, NULL);
1481 af = scan->ifbmne_af;
1482 get_ip_address(af, port->unit, addr_index, &ip);
1483 addr_bit = 1 << addr_index;
1484 T_QUIET;
1485 T_ASSERT_TRUE(ip_addresses_are_equal(af, &ip, &scan->ifbmne_ip),
1486 "mac nat entry IP address %s expected %s",
1487 inet_ntop(af, &scan->ifbmne_ip_addr,
1488 buf_ip1, sizeof(buf_ip1)),
1489 inet_ntop(af, &ip,
1490 buf_ip2, sizeof(buf_ip2)));
1491 T_QUIET;
1492 T_ASSERT_BITS_NOTSET(port->test_address_present,
1493 addr_bit, "%s address %u",
1494 scan->ifbmne_ifname, addr_index);
1495 port->test_address_present |= addr_bit;
1496 port->test_address_count++;
1497 }
1498 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1499 if (port->mac_nat) {
1500 /* MAC-NAT interface should have no entries */
1501 T_QUIET;
1502 T_ASSERT_EQ(port->test_address_count, 0,
1503 "mac nat interface %s has %u entries",
1504 port->member_ifname,
1505 port->test_address_count);
1506 } else {
1507 if (G_debug) {
1508 T_LOG("%s unit %d [member %s] %u expect %u",
1509 port->ifname, port->unit,
1510 port->member_ifname,
1511 port->test_address_count, port->num_addrs);
1512 }
1513 if (port->test_address_count != port->num_addrs) {
1514 all_present = false;
1515 }
1516 }
1517 }
1518
1519 free(entries);
1520
1521 return all_present;
1522 }
1523
1524 /**
1525 ** Basic Bridge Tests
1526 **/
1527 static void
send_generation(switch_port_t port,uint8_t af,u_int addr_index,const ether_addr_t * dst_eaddr,union ifbrip * dst_ip,uint32_t generation)1528 send_generation(switch_port_t port, uint8_t af, u_int addr_index,
1529 const ether_addr_t * dst_eaddr, union ifbrip * dst_ip,
1530 uint32_t generation)
1531 {
1532 uint32_t payload;
1533
1534 payload = htonl(generation);
1535 switch_port_send_udp_addr_index(port, af, addr_index, dst_eaddr, dst_ip,
1536 &payload, sizeof(payload));
1537 }
1538
1539 static void
check_receive_generation(switch_port_list_t ports,uint8_t af,uint32_t generation,packet_validator_t validator,__unused void * context)1540 check_receive_generation(switch_port_list_t ports, uint8_t af,
1541 uint32_t generation, packet_validator_t validator,
1542 __unused void * context)
1543 {
1544 uint32_t payload;
1545
1546 payload = htonl(generation);
1547 switch_port_list_check_receive(ports, af, &payload, sizeof(payload),
1548 validator, context);
1549 }
1550
1551 static void
validate_source_ether_mismatch(switch_port_t port,const ether_header_t * eh_p)1552 validate_source_ether_mismatch(switch_port_t port, const ether_header_t * eh_p)
1553 {
1554 /* source shouldn't be our own MAC addresses */
1555 T_QUIET;
1556 T_ASSERT_NE(eh_p->ether_shost[EA_UNIT_INDEX], port->unit,
1557 "ether source matches unit %d", port->unit);
1558 }
1559
1560 static void
validate_not_present_dhost(switch_port_t port,const ether_header_t * eh_p,__unused u_int pkt_len,__unused void * context)1561 validate_not_present_dhost(switch_port_t port, const ether_header_t * eh_p,
1562 __unused u_int pkt_len,
1563 __unused void * context)
1564 {
1565 validate_source_ether_mismatch(port, eh_p);
1566 T_QUIET;
1567 T_ASSERT_EQ(bcmp(eh_p->ether_dhost, ðer_external,
1568 sizeof(eh_p->ether_dhost)), 0,
1569 "%s", __func__);
1570 port->test_count++;
1571 }
1572
1573 static void
validate_broadcast_dhost(switch_port_t port,const ether_header_t * eh_p,__unused u_int pkt_len,__unused void * context)1574 validate_broadcast_dhost(switch_port_t port, const ether_header_t * eh_p,
1575 __unused u_int pkt_len,
1576 __unused void * context)
1577 {
1578 validate_source_ether_mismatch(port, eh_p);
1579 T_QUIET;
1580 T_ASSERT_NE((eh_p->ether_dhost[0] & 0x01), 0,
1581 "%s", __func__);
1582 port->test_count++;
1583 }
1584
1585 static void
validate_port_dhost(switch_port_t port,const ether_header_t * eh_p,__unused u_int pkt_len,__unused void * context)1586 validate_port_dhost(switch_port_t port, const ether_header_t * eh_p,
1587 __unused u_int pkt_len,
1588 __unused void * context)
1589 {
1590 validate_source_ether_mismatch(port, eh_p);
1591 T_QUIET;
1592 T_ASSERT_EQ(eh_p->ether_dhost[EA_UNIT_INDEX], port->unit,
1593 "wrong dhost unit %d != %d",
1594 eh_p->ether_dhost[EA_UNIT_INDEX], port->unit);
1595 port->test_count++;
1596 }
1597
1598
1599 static void
check_received_count(switch_port_list_t port_list,switch_port_t port,uint32_t expected_packets)1600 check_received_count(switch_port_list_t port_list,
1601 switch_port_t port, uint32_t expected_packets)
1602 {
1603 u_int i;
1604 switch_port_t scan;
1605
1606 for (i = 0, scan = port_list->list; i < port_list->count; i++, scan++) {
1607 if (scan == port) {
1608 T_QUIET;
1609 T_ASSERT_EQ(port->test_count, 0,
1610 "unexpected receive on port %d",
1611 port->unit);
1612 } else if (expected_packets == ALL_ADDRS) {
1613 T_QUIET;
1614 T_ASSERT_EQ(scan->test_count, scan->num_addrs,
1615 "didn't receive on all addrs");
1616 } else {
1617 T_QUIET;
1618 T_ASSERT_EQ(scan->test_count, expected_packets,
1619 "wrong receive count on port %s", scan->member_ifname);
1620 }
1621 }
1622 }
1623
1624 static void
unicast_send_all(switch_port_list_t port_list,uint8_t af,switch_port_t port)1625 unicast_send_all(switch_port_list_t port_list, uint8_t af, switch_port_t port)
1626 {
1627 u_int i;
1628 switch_port_t scan;
1629
1630 for (i = 0, scan = port_list->list; i < port_list->count; i++, scan++) {
1631 if (G_debug) {
1632 T_LOG("Unicast send on %s", port->ifname);
1633 }
1634 for (u_int j = 0; j < scan->num_addrs; j++) {
1635 ether_addr_t eaddr;
1636 union ifbrip ip;
1637
1638 set_ethernet_address(&eaddr, scan->unit, j);
1639 get_ip_address(af, scan->unit, j, &ip);
1640 switch_port_send_udp_addr_index(port, af, 0, &eaddr, &ip,
1641 NULL, 0);
1642 }
1643 }
1644 }
1645
1646
1647 static void
bridge_learning_test_once(switch_port_list_t port_list,uint8_t af,packet_validator_t validator,void * context,const ether_addr_t * dst_eaddr,bool retry)1648 bridge_learning_test_once(switch_port_list_t port_list,
1649 uint8_t af,
1650 packet_validator_t validator,
1651 void * context,
1652 const ether_addr_t * dst_eaddr,
1653 bool retry)
1654 {
1655 u_int i;
1656 union ifbrip dst_ip;
1657 switch_port_t port;
1658
1659 get_broadcast_ip_address(af, &dst_ip);
1660 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1661 if (port->test_address_count == port->num_addrs) {
1662 /* already populated */
1663 continue;
1664 }
1665 if (G_debug) {
1666 T_LOG("Sending on %s", port->ifname);
1667 }
1668 for (u_int j = 0; j < port->num_addrs; j++) {
1669 uint32_t generation;
1670
1671 if (retry) {
1672 uint64_t addr_bit;
1673
1674 addr_bit = 1 << j;
1675 if ((port->test_address_present & addr_bit)
1676 != 0) {
1677 /* already present */
1678 continue;
1679 }
1680 T_LOG("Retry port %s unit %u address %u",
1681 port->ifname, port->unit, j);
1682 }
1683 generation = next_generation();
1684 send_generation(port,
1685 af,
1686 j,
1687 dst_eaddr,
1688 &dst_ip,
1689 generation);
1690
1691 /* receive across all ports */
1692 check_receive_generation(port_list,
1693 af,
1694 generation,
1695 validator,
1696 context);
1697
1698 /* ensure that every port saw the packet */
1699 check_received_count(port_list, port, 1);
1700 }
1701 }
1702 return;
1703 }
1704
1705 static void
bridge_learning_test(switch_port_list_t port_list,uint8_t af,packet_validator_t validator,void * context,const ether_addr_t * dst_eaddr)1706 bridge_learning_test(switch_port_list_t port_list,
1707 uint8_t af,
1708 packet_validator_t validator,
1709 void * context,
1710 const ether_addr_t * dst_eaddr)
1711 {
1712 char ntoabuf[ETHER_NTOA_BUFSIZE];
1713 u_int i;
1714 switch_port_t port;
1715 bool verified = false;
1716
1717 ether_ntoa_buf(dst_eaddr, ntoabuf, sizeof(ntoabuf));
1718
1719 /*
1720 * Send a broadcast frame from every port in the list so that the bridge
1721 * learns our MAC address.
1722 */
1723 #define BROADCAST_MAX_TRIES 20
1724 for (int try = 1; try < BROADCAST_MAX_TRIES; try++) {
1725 bool retry = (try > 1);
1726
1727 if (!retry) {
1728 T_LOG("%s: %s #ports %u #addrs %u dest %s",
1729 __func__,
1730 af_get_str(af),
1731 port_list->count, port_list->list->num_addrs,
1732 ntoabuf);
1733 } else {
1734 T_LOG("%s: %s #ports %u #addrs %u dest %s (TRY=%d)",
1735 __func__,
1736 af_get_str(af),
1737 port_list->count, port_list->list->num_addrs,
1738 ntoabuf, try);
1739 }
1740 bridge_learning_test_once(port_list, af, validator, context,
1741 dst_eaddr, retry);
1742 /*
1743 * In the event of a memory allocation failure, it's possible
1744 * that the address was not learned. Figure out whether
1745 * all addresses are present, and if not, we'll retry on
1746 * those that are not present.
1747 */
1748 verified = switch_port_list_verify_rt_table(port_list, false);
1749 if (verified) {
1750 break;
1751 }
1752 /* wait a short time to allow the system to recover */
1753 usleep(100 * 1000);
1754 }
1755 T_QUIET;
1756 T_ASSERT_TRUE(verified, "All addresses present");
1757
1758 /*
1759 * Since we just broadcast on every port in the switch, the bridge knows
1760 * the port's MAC addresses. The bridge should not need to broadcast the
1761 * packet to learn, which means the unicast traffic should only arrive
1762 * on the intended port.
1763 */
1764 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1765 /* send unicast packets to every other port's MAC addresses */
1766 unicast_send_all(port_list, af, port);
1767
1768 /* receive all of that generated traffic */
1769 switch_port_list_check_receive(port_list, af, NULL, 0,
1770 validate_port_dhost, NULL);
1771 /* check that we saw all of the unicast packets */
1772 check_received_count(port_list, port, ALL_ADDRS);
1773 }
1774 T_PASS("%s", __func__);
1775 }
1776
1777 /**
1778 ** MAC-NAT tests
1779 **/
1780 static void
mac_nat_check_received_count(switch_port_list_t port_list,switch_port_t port)1781 mac_nat_check_received_count(switch_port_list_t port_list, switch_port_t port)
1782 {
1783 u_int i;
1784 switch_port_t scan;
1785
1786 for (i = 0, scan = port_list->list; i < port_list->count; i++, scan++) {
1787 u_int expected = 0;
1788
1789 if (scan == port) {
1790 expected = scan->num_addrs;
1791 }
1792 T_QUIET;
1793 T_ASSERT_EQ(scan->test_count, expected,
1794 "%s [member %s]%s expected %u actual %u",
1795 scan->ifname, scan->member_ifname,
1796 scan->mac_nat ? " [mac-nat]" : "",
1797 expected, scan->test_count);
1798 }
1799 }
1800
1801 static void
validate_mac_nat(switch_port_t port,const ether_header_t * eh_p,__unused u_int pkt_len,__unused void * context)1802 validate_mac_nat(switch_port_t port, const ether_header_t * eh_p,
1803 __unused u_int pkt_len,
1804 __unused void * context)
1805 {
1806 if (port->mac_nat) {
1807 bool equal;
1808
1809 /* source must match MAC-NAT interface */
1810 equal = (bcmp(eh_p->ether_shost, &port->member_mac,
1811 sizeof(port->member_mac)) == 0);
1812 if (!equal) {
1813 ethernet_frame_validate(eh_p, pkt_len, true);
1814 }
1815 T_QUIET;
1816 T_ASSERT_TRUE(equal, "source address match");
1817 port->test_count++;
1818 } else {
1819 validate_not_present_dhost(port, eh_p, pkt_len, NULL);
1820 }
1821 }
1822
1823 static void
validate_mac_nat_in(switch_port_t port,const ether_header_t * eh_p,u_int pkt_len,__unused void * context)1824 validate_mac_nat_in(switch_port_t port, const ether_header_t * eh_p,
1825 u_int pkt_len, __unused void * context)
1826 {
1827 if (G_debug) {
1828 T_LOG("%s received %u bytes", port->member_ifname, pkt_len);
1829 ethernet_frame_validate(eh_p, pkt_len, true);
1830 }
1831 T_QUIET;
1832 T_ASSERT_EQ(eh_p->ether_dhost[EA_UNIT_INDEX], port->unit,
1833 "dhost unit %u expected %u",
1834 eh_p->ether_dhost[EA_UNIT_INDEX], port->unit);
1835 port->test_count++;
1836 }
1837
1838 static void
validate_mac_nat_arp_out(switch_port_t port,const ether_header_t * eh_p,u_int pkt_len,void * context)1839 validate_mac_nat_arp_out(switch_port_t port, const ether_header_t * eh_p,
1840 u_int pkt_len, void * context)
1841 {
1842 const struct ether_arp * earp;
1843 switch_port_t send_port = (switch_port_t)context;
1844
1845 if (G_debug) {
1846 T_LOG("%s received %u bytes", port->member_ifname, pkt_len);
1847 ethernet_frame_validate(eh_p, pkt_len, true);
1848 }
1849 T_QUIET;
1850 T_ASSERT_EQ((int)ntohs(eh_p->ether_type), (int)ETHERTYPE_ARP, NULL);
1851 earp = (const struct ether_arp *)(const void *)(eh_p + 1);
1852 T_QUIET;
1853 T_ASSERT_GE(pkt_len, (u_int)(sizeof(*eh_p) + sizeof(*earp)), NULL);
1854 if (port->mac_nat) {
1855 bool equal;
1856
1857 /* source ethernet must match MAC-NAT interface */
1858 equal = (bcmp(eh_p->ether_shost, &port->member_mac,
1859 sizeof(port->member_mac)) == 0);
1860 if (!equal) {
1861 ethernet_frame_validate(eh_p, pkt_len, true);
1862 }
1863 T_QUIET;
1864 T_ASSERT_TRUE(equal, "%s -> %s source address translated",
1865 send_port->member_ifname,
1866 port->member_ifname);
1867 /* sender hw must match MAC-NAT interface */
1868 equal = (bcmp(earp->arp_sha, &port->member_mac,
1869 sizeof(port->member_mac)) == 0);
1870 if (!equal) {
1871 ethernet_frame_validate(eh_p, pkt_len, true);
1872 }
1873 T_QUIET;
1874 T_ASSERT_TRUE(equal, "%s -> %s sender hardware translated",
1875 send_port->member_ifname,
1876 port->member_ifname);
1877 } else {
1878 /* source ethernet must match the sender */
1879 T_QUIET;
1880 T_ASSERT_EQ(eh_p->ether_shost[EA_UNIT_INDEX], send_port->unit,
1881 "%s -> %s unit %u expected %u",
1882 send_port->member_ifname,
1883 port->member_ifname,
1884 eh_p->ether_shost[EA_UNIT_INDEX], send_port->unit);
1885 /* source hw must match the sender */
1886 T_QUIET;
1887 T_ASSERT_EQ(earp->arp_sha[EA_UNIT_INDEX], send_port->unit,
1888 "%s -> %s unit %u expected %u",
1889 send_port->member_ifname,
1890 port->member_ifname,
1891 earp->arp_sha[EA_UNIT_INDEX], send_port->unit);
1892 }
1893 port->test_count++;
1894 }
1895
1896 static void
validate_mac_nat_arp_in(switch_port_t port,const ether_header_t * eh_p,u_int pkt_len,void * context)1897 validate_mac_nat_arp_in(switch_port_t port, const ether_header_t * eh_p,
1898 u_int pkt_len, void * context)
1899 {
1900 const struct ether_arp * earp;
1901 switch_port_t send_port = (switch_port_t)context;
1902
1903 if (G_debug) {
1904 T_LOG("%s received %u bytes", port->member_ifname, pkt_len);
1905 ethernet_frame_validate(eh_p, pkt_len, true);
1906 }
1907 earp = (const struct ether_arp *)(const void *)(eh_p + 1);
1908 T_QUIET;
1909 T_ASSERT_EQ((int)ntohs(eh_p->ether_type), (int)ETHERTYPE_ARP, NULL);
1910 T_QUIET;
1911 T_ASSERT_GE(pkt_len, (u_int)(sizeof(*eh_p) + sizeof(*earp)), NULL);
1912 T_QUIET;
1913 T_ASSERT_FALSE(port->mac_nat, NULL);
1914
1915 /* destination ethernet must match the unit */
1916 T_QUIET;
1917 T_ASSERT_EQ(eh_p->ether_dhost[EA_UNIT_INDEX], port->unit,
1918 "%s -> %s unit %u expected %u",
1919 send_port->member_ifname,
1920 port->member_ifname,
1921 eh_p->ether_dhost[EA_UNIT_INDEX], port->unit);
1922 /* source hw must match the sender */
1923 T_QUIET;
1924 T_ASSERT_EQ(earp->arp_tha[EA_UNIT_INDEX], port->unit,
1925 "%s -> %s unit %u expected %u",
1926 send_port->member_ifname,
1927 port->member_ifname,
1928 earp->arp_tha[EA_UNIT_INDEX], port->unit);
1929 port->test_count++;
1930 }
1931
1932 static void
mac_nat_test_arp_out(switch_port_list_t port_list)1933 mac_nat_test_arp_out(switch_port_list_t port_list)
1934 {
1935 u_int i;
1936 struct in_addr ip_dst;
1937 switch_port_t port;
1938
1939 ip_dst = get_external_ipv4_address();
1940 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1941 if (port->mac_nat) {
1942 continue;
1943 }
1944 for (u_int j = 0; j < port->num_addrs; j++) {
1945 ether_addr_t eaddr;
1946 struct in_addr ip_src;
1947
1948 set_ethernet_address(&eaddr, port->unit, j);
1949 get_ipv4_address(port->unit, j, &ip_src);
1950 switch_port_send_arp(port,
1951 ARPOP_REQUEST,
1952 &eaddr,
1953 ip_src,
1954 NULL,
1955 ip_dst);
1956 switch_port_list_check_receive(port_list, AF_INET,
1957 NULL, 0,
1958 validate_mac_nat_arp_out,
1959 port);
1960 check_received_count(port_list, port, 1);
1961 }
1962 }
1963 T_PASS("%s", __func__);
1964 }
1965
1966 static void
mac_nat_send_arp_response(switch_port_t ext_port,switch_port_t port)1967 mac_nat_send_arp_response(switch_port_t ext_port, switch_port_t port)
1968 {
1969 struct in_addr ip_src;
1970
1971 T_QUIET;
1972 T_ASSERT_TRUE(ext_port->mac_nat, "%s is MAC-NAT interface",
1973 ext_port->member_ifname);
1974 ip_src = get_external_ipv4_address();
1975 for (u_int j = 0; j < port->num_addrs; j++) {
1976 struct in_addr ip_dst;
1977
1978 get_ipv4_address(port->unit, j, &ip_dst);
1979 if (G_debug) {
1980 T_LOG("Generating ARP destined to %s %s",
1981 port->ifname, inet_ntoa(ip_dst));
1982 }
1983 switch_port_send_arp(ext_port,
1984 ARPOP_REPLY,
1985 ðer_external,
1986 ip_src,
1987 &ext_port->member_mac,
1988 ip_dst);
1989 }
1990 }
1991
1992 static void
mac_nat_test_arp_in(switch_port_list_t port_list)1993 mac_nat_test_arp_in(switch_port_list_t port_list)
1994 {
1995 u_int i;
1996 switch_port_t port;
1997
1998 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
1999 if (port->mac_nat) {
2000 continue;
2001 }
2002 mac_nat_send_arp_response(port_list->list, port);
2003
2004 /* receive the generated traffic */
2005 switch_port_list_check_receive(port_list, AF_INET, NULL, 0,
2006 validate_mac_nat_arp_in,
2007 port_list->list);
2008
2009 /* verify that only the single port got the packet */
2010 mac_nat_check_received_count(port_list, port);
2011 }
2012 T_PASS("%s", __func__);
2013 }
2014
2015 static void
validate_mac_nat_dhcp(switch_port_t port,const ether_header_t * eh_p,u_int pkt_len,void * context)2016 validate_mac_nat_dhcp(switch_port_t port, const ether_header_t * eh_p,
2017 u_int pkt_len, void * context)
2018 {
2019 u_int dp_flags;
2020 const struct bootp_packet * pkt;
2021 switch_port_t send_port = (switch_port_t)context;
2022
2023
2024 T_QUIET;
2025 T_ASSERT_GE(pkt_len, (u_int)sizeof(*pkt), NULL);
2026 T_QUIET;
2027 T_ASSERT_EQ((int)ntohs(eh_p->ether_type), (int)ETHERTYPE_IP, NULL);
2028 pkt = (const struct bootp_packet *)(const void *)(eh_p + 1);
2029
2030 dp_flags = ntohs(pkt->bp_bootp.bp_unused);
2031 if (port->mac_nat) {
2032 bool equal;
2033
2034 /* Broadcast bit must be set */
2035 T_QUIET;
2036 T_ASSERT_BITS_SET(dp_flags, (u_int)DHCP_FLAGS_BROADCAST,
2037 "%s -> %s: flags 0x%x must have 0x%x",
2038 send_port->member_ifname,
2039 port->member_ifname,
2040 dp_flags, DHCP_FLAGS_BROADCAST);
2041
2042 /* source must match MAC-NAT interface */
2043 equal = (bcmp(eh_p->ether_shost, &port->member_mac,
2044 sizeof(port->member_mac)) == 0);
2045 if (!equal) {
2046 ethernet_frame_validate(eh_p, pkt_len, true);
2047 }
2048 T_QUIET;
2049 T_ASSERT_TRUE(equal, "%s -> %s source address translated",
2050 send_port->member_ifname,
2051 port->member_ifname);
2052 } else {
2053 /* Broadcast bit must not be set */
2054 T_QUIET;
2055 T_ASSERT_BITS_NOTSET(dp_flags, DHCP_FLAGS_BROADCAST,
2056 "%s -> %s flags 0x%x must not have 0x%x",
2057 send_port->member_ifname,
2058 port->member_ifname,
2059 dp_flags, DHCP_FLAGS_BROADCAST);
2060 T_QUIET;
2061 T_ASSERT_EQ(eh_p->ether_shost[EA_UNIT_INDEX], send_port->unit,
2062 "%s -> %s unit %u expected %u",
2063 send_port->member_ifname,
2064 port->member_ifname,
2065 eh_p->ether_shost[EA_UNIT_INDEX], send_port->unit);
2066 }
2067 port->test_count++;
2068 }
2069
2070 static void
mac_nat_test_dhcp(switch_port_list_t port_list,bool link_layer_unicast)2071 mac_nat_test_dhcp(switch_port_list_t port_list, bool link_layer_unicast)
2072 {
2073 u_int i;
2074 struct in_addr ip_dst = { INADDR_BROADCAST };
2075 struct in_addr ip_src = { INADDR_ANY };
2076 switch_port_t port;
2077 ether_addr_t * ether_dst;
2078
2079 if (link_layer_unicast) {
2080 /* use link-layer address of MAC-NAT interface */
2081 ether_dst = &port_list->list[0].member_mac;
2082 } else {
2083 /* use link-layer broadcast address */
2084 ether_dst = ðer_broadcast;
2085 }
2086 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
2087 ether_addr_t eaddr;
2088 dhcp_min_payload payload;
2089 u_int payload_len;
2090
2091 if (!link_layer_unicast && port->mac_nat) {
2092 /* only send through non-MAC-NAT ports */
2093 continue;
2094 }
2095 set_ethernet_address(&eaddr, port->unit, 0);
2096 payload_len = make_dhcp_payload(&payload, &eaddr);
2097 if (G_debug) {
2098 T_LOG("%s: transmit DHCP packet (member %s)",
2099 port->ifname, port->member_ifname);
2100 }
2101 switch_port_send_udp(port,
2102 AF_INET,
2103 &eaddr,
2104 (union ifbrip *)&ip_src,
2105 BOOTP_CLIENT_PORT,
2106 ether_dst,
2107 (union ifbrip *)&ip_dst,
2108 BOOTP_SERVER_PORT,
2109 &payload,
2110 payload_len);
2111
2112 switch_port_list_check_receive(port_list, AF_INET, NULL, 0,
2113 validate_mac_nat_dhcp,
2114 port);
2115
2116 check_received_count(port_list, port, 1);
2117 if (link_layer_unicast) {
2118 /* send a single unicast to MAC-NAT interface */
2119 break;
2120 }
2121 }
2122 T_PASS("%s %s", __func__,
2123 link_layer_unicast ? "unicast" : "broadcast");
2124 }
2125
2126
2127 static void
validate_mac_nat_nd6(switch_port_t port,const struct icmp6_hdr * icmp6,u_int icmp6_len,uint8_t opt_type,u_int nd_hdr_size,switch_port_t send_port)2128 validate_mac_nat_nd6(switch_port_t port,
2129 const struct icmp6_hdr * icmp6,
2130 u_int icmp6_len,
2131 uint8_t opt_type,
2132 u_int nd_hdr_size,
2133 switch_port_t send_port)
2134 {
2135 const uint8_t * linkaddr;
2136 const uint8_t * ptr;
2137 const struct nd_opt_hdr * nd_opt;
2138 u_int nd_size;
2139
2140 ptr = (const uint8_t *)icmp6;
2141 nd_size = nd_hdr_size + LINKADDR_OPT_LEN;
2142 if (icmp6_len < nd_size) {
2143 /* no LINKADDR option */
2144 return;
2145 }
2146 nd_opt = (const struct nd_opt_hdr *)(const void *)(ptr + nd_hdr_size);
2147 T_QUIET;
2148 T_ASSERT_EQ(nd_opt->nd_opt_type, opt_type,
2149 "nd_opt->nd_opt_type 0x%x, opt_type 0x%x",
2150 nd_opt->nd_opt_type, opt_type);
2151 T_QUIET;
2152 T_ASSERT_EQ(GET_ND_OPT_LEN(nd_opt->nd_opt_len), LINKADDR_OPT_LEN, NULL);
2153 linkaddr = (const uint8_t *)(nd_opt + 1);
2154 if (port->mac_nat) {
2155 bool equal;
2156
2157 equal = (bcmp(linkaddr, &port->member_mac,
2158 sizeof(port->member_mac)) == 0);
2159 T_QUIET;
2160 T_ASSERT_TRUE(equal, "%s -> %s sender hardware translated",
2161 send_port->member_ifname,
2162 port->member_ifname);
2163 } else {
2164 /* source hw must match the sender */
2165 T_QUIET;
2166 T_ASSERT_EQ(linkaddr[EA_UNIT_INDEX], send_port->unit,
2167 "%s -> %s unit %u expected %u",
2168 send_port->member_ifname,
2169 port->member_ifname,
2170 linkaddr[EA_UNIT_INDEX], send_port->unit);
2171 }
2172 }
2173
2174 static void
validate_mac_nat_icmp6_out(switch_port_t port,const struct icmp6_hdr * icmp6,u_int icmp6_len,switch_port_t send_port)2175 validate_mac_nat_icmp6_out(switch_port_t port, const struct icmp6_hdr * icmp6,
2176 u_int icmp6_len, switch_port_t send_port)
2177 {
2178 switch (icmp6->icmp6_type) {
2179 case ND_NEIGHBOR_ADVERT:
2180 validate_mac_nat_nd6(port, icmp6, icmp6_len,
2181 ND_OPT_TARGET_LINKADDR,
2182 sizeof(struct nd_neighbor_advert),
2183 send_port);
2184 break;
2185 case ND_NEIGHBOR_SOLICIT:
2186 validate_mac_nat_nd6(port, icmp6, icmp6_len,
2187 ND_OPT_SOURCE_LINKADDR,
2188 sizeof(struct nd_neighbor_solicit),
2189 send_port);
2190 break;
2191 case ND_ROUTER_SOLICIT:
2192 validate_mac_nat_nd6(port, icmp6, icmp6_len,
2193 ND_OPT_SOURCE_LINKADDR,
2194 sizeof(struct nd_router_solicit),
2195 send_port);
2196 break;
2197 default:
2198 T_FAIL("Unsupported icmp6 type %d", icmp6->icmp6_type);
2199 break;
2200 }
2201 }
2202
2203 static void
validate_mac_nat_nd6_out(switch_port_t port,const ether_header_t * eh_p,u_int pkt_len,void * context)2204 validate_mac_nat_nd6_out(switch_port_t port, const ether_header_t * eh_p,
2205 u_int pkt_len, void * context)
2206 {
2207 const struct icmp6_hdr * icmp6;
2208 const struct ip6_hdr * ip6;
2209 unsigned int payload_length;
2210 switch_port_t send_port = (switch_port_t)context;
2211
2212 if (G_debug) {
2213 T_LOG("%s received %u bytes", port->member_ifname, pkt_len);
2214 ethernet_frame_validate(eh_p, pkt_len, true);
2215 }
2216 T_QUIET;
2217 T_ASSERT_EQ(ntohs(eh_p->ether_type), (u_short)ETHERTYPE_IPV6, NULL);
2218 ip6 = (const struct ip6_hdr *)(const void *)(eh_p + 1);
2219 icmp6 = (const struct icmp6_hdr *)(const void *)(ip6 + 1);
2220 T_QUIET;
2221 T_ASSERT_GE(pkt_len, (u_int)MIN_ICMP6_LEN, NULL);
2222 T_QUIET;
2223 T_ASSERT_EQ(ip6->ip6_nxt, IPPROTO_ICMPV6, NULL);
2224
2225 /* validate the ethernet header */
2226 if (port->mac_nat) {
2227 bool equal;
2228
2229 /* source ethernet must match MAC-NAT interface */
2230 equal = (bcmp(eh_p->ether_shost, &port->member_mac,
2231 sizeof(port->member_mac)) == 0);
2232 if (!equal) {
2233 ethernet_frame_validate(eh_p, pkt_len, true);
2234 }
2235 T_QUIET;
2236 T_ASSERT_TRUE(equal, "%s -> %s source address translated",
2237 send_port->member_ifname,
2238 port->member_ifname);
2239 } else {
2240 /* source ethernet must match the sender */
2241 T_QUIET;
2242 T_ASSERT_EQ(eh_p->ether_shost[EA_UNIT_INDEX], send_port->unit,
2243 "%s -> %s unit %u expected %u",
2244 send_port->member_ifname,
2245 port->member_ifname,
2246 eh_p->ether_shost[EA_UNIT_INDEX], send_port->unit);
2247 }
2248 /* validate the icmp6 payload */
2249 payload_length = ntohs(ip6->ip6_plen);
2250 validate_mac_nat_icmp6_out(port, icmp6, payload_length, send_port);
2251 port->test_count++;
2252 }
2253
2254 static void
mac_nat_test_nd6_out(switch_port_list_t port_list)2255 mac_nat_test_nd6_out(switch_port_list_t port_list)
2256 {
2257 switch_port_t ext_port;
2258 u_int i;
2259 union ifbrip ip_dst;
2260 switch_port_t port;
2261
2262 get_external_ip_address(AF_INET6, &ip_dst);
2263 ext_port = port_list->list;
2264 T_QUIET;
2265 T_ASSERT_TRUE(ext_port->mac_nat, NULL);
2266 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
2267 if (port->mac_nat) {
2268 continue;
2269 }
2270 /* neighbor solicit */
2271 for (u_int j = 0; j < port->num_addrs; j++) {
2272 ether_addr_t eaddr;
2273 union ifbrip ip_src;
2274
2275 set_ethernet_address(&eaddr, port->unit, j);
2276 get_ip_address(AF_INET6, port->unit, j, &ip_src);
2277 switch_port_send_nd6(port,
2278 ND_NEIGHBOR_SOLICIT,
2279 &eaddr,
2280 &ip_src.ifbrip_addr6,
2281 NULL,
2282 NULL,
2283 &ip_dst.ifbrip_addr6);
2284 switch_port_list_check_receive(port_list, AF_INET,
2285 NULL, 0,
2286 validate_mac_nat_nd6_out,
2287 port);
2288 check_received_count(port_list, port, 1);
2289 }
2290 /* neighbor advert */
2291 for (u_int j = 0; j < port->num_addrs; j++) {
2292 ether_addr_t eaddr;
2293 union ifbrip ip_src;
2294
2295 set_ethernet_address(&eaddr, port->unit, j);
2296 get_ip_address(AF_INET6, port->unit, j, &ip_src);
2297 switch_port_send_nd6(port,
2298 ND_NEIGHBOR_ADVERT,
2299 &eaddr,
2300 &ip_src.ifbrip_addr6,
2301 NULL,
2302 &eaddr,
2303 &ip_src.ifbrip_addr6);
2304 switch_port_list_check_receive(port_list, AF_INET,
2305 NULL, 0,
2306 validate_mac_nat_nd6_out,
2307 port);
2308 check_received_count(port_list, port, 1);
2309 }
2310 /* router solicit */
2311 for (u_int j = 0; j < port->num_addrs; j++) {
2312 ether_addr_t eaddr;
2313 union ifbrip ip_src;
2314
2315 set_ethernet_address(&eaddr, port->unit, j);
2316 get_ip_address(AF_INET6, port->unit, j, &ip_src);
2317 //get_ipv6ll_address(port->unit, j, &ip_src.ifbrip_addr6);
2318 switch_port_send_nd6(port,
2319 ND_ROUTER_SOLICIT,
2320 &eaddr,
2321 &ip_src.ifbrip_addr6,
2322 NULL,
2323 NULL,
2324 NULL);
2325 switch_port_list_check_receive(port_list, AF_INET,
2326 NULL, 0,
2327 validate_mac_nat_nd6_out,
2328 port);
2329 check_received_count(port_list, port, 1);
2330 }
2331 }
2332 T_PASS("%s", __func__);
2333 }
2334
2335 static void
mac_nat_send_response(switch_port_t ext_port,uint8_t af,switch_port_t port)2336 mac_nat_send_response(switch_port_t ext_port, uint8_t af, switch_port_t port)
2337 {
2338 union ifbrip src_ip;
2339
2340 T_QUIET;
2341 T_ASSERT_TRUE(ext_port->mac_nat, "%s is MAC-NAT interface",
2342 ext_port->member_ifname);
2343 if (G_debug) {
2344 T_LOG("Generating UDP traffic destined to %s", port->ifname);
2345 }
2346 get_external_ip_address(af, &src_ip);
2347 for (u_int j = 0; j < port->num_addrs; j++) {
2348 union ifbrip ip;
2349
2350 get_ip_address(af, port->unit, j, &ip);
2351 switch_port_send_udp(ext_port,
2352 af,
2353 ðer_external,
2354 &src_ip,
2355 TEST_DEST_PORT,
2356 &ext_port->member_mac,
2357 &ip,
2358 TEST_SOURCE_PORT,
2359 NULL, 0);
2360 }
2361 }
2362
2363
2364 static void
mac_nat_test_ip_once(switch_port_list_t port_list,uint8_t af,bool retry)2365 mac_nat_test_ip_once(switch_port_list_t port_list, uint8_t af, bool retry)
2366 {
2367 union ifbrip dst_ip;
2368 u_int i;
2369 switch_port_t port;
2370
2371 get_external_ip_address(af, &dst_ip);
2372 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
2373 if (port->test_address_count == port->num_addrs) {
2374 /* already populated */
2375 continue;
2376 }
2377 if (G_debug) {
2378 T_LOG("Sending on %s", port->ifname);
2379 }
2380 for (u_int j = 0; j < port->num_addrs; j++) {
2381 uint32_t generation;
2382
2383 if (retry) {
2384 uint64_t addr_bit;
2385
2386 addr_bit = 1 << j;
2387 if ((port->test_address_present & addr_bit)
2388 != 0) {
2389 /* already present */
2390 continue;
2391 }
2392 T_LOG("Retry port %s unit %u address %u",
2393 port->ifname, port->unit, j);
2394 }
2395
2396 generation = next_generation();
2397 send_generation(port,
2398 af,
2399 j,
2400 ðer_external,
2401 &dst_ip,
2402 generation);
2403
2404 /* receive across all ports */
2405 check_receive_generation(port_list,
2406 af,
2407 generation,
2408 validate_mac_nat,
2409 NULL);
2410
2411 /* ensure that every port saw the packet */
2412 check_received_count(port_list, port, 1);
2413 }
2414 }
2415 return;
2416 }
2417
2418 static void
mac_nat_test_ip(switch_port_list_t port_list,uint8_t af)2419 mac_nat_test_ip(switch_port_list_t port_list, uint8_t af)
2420 {
2421 u_int i;
2422 switch_port_t port;
2423 bool verified = false;
2424
2425 /*
2426 * Send a packet from every port in the list so that the bridge
2427 * learns the MAC addresses and IP addresses.
2428 */
2429 #define MAC_NAT_MAX_TRIES 20
2430 for (int try = 1; try < BROADCAST_MAX_TRIES; try++) {
2431 bool retry = (try > 1);
2432
2433 if (!retry) {
2434 T_LOG("%s: #ports %u #addrs %u",
2435 __func__,
2436 port_list->count, port_list->list->num_addrs);
2437 } else {
2438 T_LOG("%s: #ports %u #addrs %u destination (TRY=%d)",
2439 __func__,
2440 port_list->count, port_list->list->num_addrs,
2441 try);
2442 }
2443 mac_nat_test_ip_once(port_list, af, retry);
2444 /*
2445 * In the event of a memory allocation failure, it's possible
2446 * that the address was not learned. Figure out whether
2447 * all addresses are present, and if not, we'll retry on
2448 * those that are not present.
2449 */
2450 verified = switch_port_list_verify_mac_nat(port_list, false);
2451 if (verified) {
2452 break;
2453 }
2454 /* wait a short time to allow the system to recover */
2455 usleep(100 * 1000);
2456 }
2457 T_QUIET;
2458 T_ASSERT_TRUE(verified, "All addresses present");
2459
2460 /*
2461 * The bridge now has an IP address <-> MAC address binding for every
2462 * address on each internal interface.
2463 *
2464 * Generate an inbound packet on the MAC-NAT interface targeting
2465 * each interface address. Verify that the packet appears on
2466 * the appropriate internal address with appropriate translation.
2467 */
2468 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
2469 if (port->mac_nat) {
2470 continue;
2471 }
2472 mac_nat_send_response(port_list->list, af, port);
2473
2474 /* receive the generated traffic */
2475 switch_port_list_check_receive(port_list, AF_INET, NULL, 0,
2476 validate_mac_nat_in,
2477 NULL);
2478
2479 /* verify that only the single port got the packet */
2480 mac_nat_check_received_count(port_list, port);
2481 }
2482 T_PASS("%s", __func__);
2483 }
2484
2485 /**
2486 ** interface management
2487 **/
2488
2489 static int
bridge_delete_member(const char * bridge,const char * member)2490 bridge_delete_member(const char * bridge, const char * member)
2491 {
2492 struct ifbreq req;
2493 int ret;
2494
2495 memset(&req, 0, sizeof(req));
2496 strlcpy(req.ifbr_ifsname, member, sizeof(req.ifbr_ifsname));
2497 ret = siocdrvspec(bridge, BRDGDEL, &req, sizeof(req), true);
2498 T_QUIET;
2499 T_ASSERT_POSIX_SUCCESS(ret, "%s %s %s", __func__, bridge, member);
2500 return ret;
2501 }
2502
2503
2504 static int
bridge_member_modify_ifflags(const char * bridge,const char * member,uint32_t flags_to_modify,bool set)2505 bridge_member_modify_ifflags(const char * bridge, const char * member,
2506 uint32_t flags_to_modify, bool set)
2507 {
2508 uint32_t flags;
2509 bool need_set = false;
2510 struct ifbreq req;
2511 int ret;
2512
2513 memset(&req, 0, sizeof(req));
2514 strlcpy(req.ifbr_ifsname, member, sizeof(req.ifbr_ifsname));
2515 ret = siocdrvspec(bridge, BRDGGIFFLGS, &req, sizeof(req), false);
2516 T_QUIET;
2517 T_ASSERT_POSIX_SUCCESS(ret, "BRDGGIFFLGS %s %s", bridge, member);
2518 flags = req.ifbr_ifsflags;
2519 if (set) {
2520 if ((flags & flags_to_modify) != flags_to_modify) {
2521 need_set = true;
2522 req.ifbr_ifsflags |= flags_to_modify;
2523 }
2524 /* need to set it */
2525 } else if ((flags & flags_to_modify) != 0) {
2526 /* need to clear it */
2527 need_set = true;
2528 req.ifbr_ifsflags &= ~flags_to_modify;
2529 }
2530 if (need_set) {
2531 ret = siocdrvspec(bridge, BRDGSIFFLGS,
2532 &req, sizeof(req), true);
2533 T_QUIET;
2534 T_ASSERT_POSIX_SUCCESS(ret, "BRDGSIFFLGS %s %s 0x%x => 0x%x",
2535 bridge, member,
2536 flags, req.ifbr_ifsflags);
2537 }
2538 return ret;
2539 }
2540
2541 static int
bridge_member_modify_mac_nat(const char * bridge,const char * member,bool enable)2542 bridge_member_modify_mac_nat(const char * bridge,
2543 const char * member, bool enable)
2544 {
2545 return bridge_member_modify_ifflags(bridge, member,
2546 IFBIF_MAC_NAT,
2547 enable);
2548 }
2549
2550 static int
bridge_member_modify_checksum_offload(const char * bridge,const char * member,bool enable)2551 bridge_member_modify_checksum_offload(const char * bridge,
2552 const char * member, bool enable)
2553 {
2554 #ifndef IFBIF_CHECKSUM_OFFLOAD
2555 #define IFBIF_CHECKSUM_OFFLOAD 0x10000 /* checksum inbound packets,
2556 * drop outbound packets with
2557 * bad checksum
2558 */
2559 #endif
2560 return bridge_member_modify_ifflags(bridge, member,
2561 IFBIF_CHECKSUM_OFFLOAD,
2562 enable);
2563 }
2564
2565 static struct ifbareq *
bridge_rt_table_copy_common(const char * bridge,u_int * ret_count)2566 bridge_rt_table_copy_common(const char * bridge, u_int * ret_count)
2567 {
2568 struct ifbaconf ifbac;
2569 u_int len = 8 * 1024;
2570 char * inbuf = NULL;
2571 char * ninbuf;
2572 int ret;
2573 struct ifbareq * rt_table = NULL;
2574
2575 /*
2576 * BRDGRTS should work like other ioctl's where passing in NULL
2577 * for the buffer says "tell me how many there are". Unfortunately,
2578 * it doesn't so we have to pass in a buffer, then check that it
2579 * was too big.
2580 */
2581 for (;;) {
2582 ninbuf = realloc(inbuf, len);
2583 T_QUIET;
2584 T_ASSERT_NOTNULL((void *)ninbuf, "realloc %u", len);
2585 ifbac.ifbac_len = len;
2586 ifbac.ifbac_buf = inbuf = ninbuf;
2587 ret = siocdrvspec(bridge, BRDGRTS,
2588 &ifbac, sizeof(ifbac), false);
2589 T_QUIET;
2590 T_ASSERT_POSIX_SUCCESS(ret, "%s %s", __func__, bridge);
2591 if ((ifbac.ifbac_len + sizeof(*rt_table)) < len) {
2592 /* we passed a buffer larger than what was required */
2593 break;
2594 }
2595 len *= 2;
2596 }
2597 if (ifbac.ifbac_len == 0) {
2598 free(ninbuf);
2599 T_LOG("No bridge routing entries");
2600 goto done;
2601 }
2602 *ret_count = ifbac.ifbac_len / sizeof(*rt_table);
2603 rt_table = (struct ifbareq *)(void *)ninbuf;
2604 done:
2605 if (rt_table == NULL) {
2606 *ret_count = 0;
2607 }
2608 return rt_table;
2609 }
2610
2611 static struct ifbareq *
bridge_rt_table_copy(u_int * ret_count)2612 bridge_rt_table_copy(u_int * ret_count)
2613 {
2614 return bridge_rt_table_copy_common(BRIDGE200, ret_count);
2615 }
2616
2617 static void
bridge_rt_table_log(struct ifbareq * rt_table,u_int count)2618 bridge_rt_table_log(struct ifbareq *rt_table, u_int count)
2619 {
2620 u_int i;
2621 char ntoabuf[ETHER_NTOA_BUFSIZE];
2622 struct ifbareq * ifba;
2623
2624 for (i = 0, ifba = rt_table; i < count; i++, ifba++) {
2625 ether_ntoa_buf((const ether_addr_t *)&ifba->ifba_dst,
2626 ntoabuf, sizeof(ntoabuf));
2627 T_LOG("%s %s %lu", ifba->ifba_ifsname, ntoabuf,
2628 ifba->ifba_expire);
2629 }
2630 return;
2631 }
2632
2633 static struct ifbrmne *
bridge_mac_nat_entries_copy_common(const char * bridge,u_int * ret_count)2634 bridge_mac_nat_entries_copy_common(const char * bridge, u_int * ret_count)
2635 {
2636 char * buf = NULL;
2637 u_int count = 0;
2638 int err;
2639 u_int i;
2640 struct ifbrmnelist mnl;
2641 struct ifbrmne * ret_list = NULL;
2642 char * scan;
2643
2644 /* find out how many there are */
2645 bzero(&mnl, sizeof(mnl));
2646 err = siocdrvspec(bridge, BRDGGMACNATLIST, &mnl, sizeof(mnl), false);
2647 if (err != 0 && S_cleaning_up) {
2648 T_LOG("BRDGGMACNATLIST %s failed %d", bridge, errno);
2649 goto done;
2650 }
2651 T_QUIET;
2652 T_ASSERT_POSIX_SUCCESS(err, "BRDGGMACNATLIST %s", bridge);
2653 T_QUIET;
2654 T_ASSERT_GE(mnl.ifbml_elsize, (uint16_t)sizeof(struct ifbrmne),
2655 "mac nat entry size %u minsize %u",
2656 mnl.ifbml_elsize, (u_int)sizeof(struct ifbrmne));
2657 if (mnl.ifbml_len == 0) {
2658 goto done;
2659 }
2660
2661 /* call again with a buffer large enough to hold them */
2662 buf = malloc(mnl.ifbml_len);
2663 T_QUIET;
2664 T_ASSERT_NOTNULL(buf, "mac nat entries buffer");
2665 mnl.ifbml_buf = buf;
2666 err = siocdrvspec(bridge, BRDGGMACNATLIST, &mnl, sizeof(mnl), false);
2667 T_QUIET;
2668 T_ASSERT_POSIX_SUCCESS(err, "BRDGGMACNATLIST %s", bridge);
2669 count = mnl.ifbml_len / mnl.ifbml_elsize;
2670 if (count == 0) {
2671 goto done;
2672 }
2673 if (mnl.ifbml_elsize == sizeof(struct ifbrmne)) {
2674 /* element size is expected size, no need to "right-size" it */
2675 ret_list = (struct ifbrmne *)(void *)buf;
2676 buf = NULL;
2677 goto done;
2678 }
2679 /* element size is larger than we expect, create a "right-sized" array */
2680 ret_list = malloc(count * sizeof(*ret_list));
2681 T_QUIET;
2682 T_ASSERT_NOTNULL(ret_list, "mac nat entries list");
2683 for (i = 0, scan = buf; i < count; i++, scan += mnl.ifbml_elsize) {
2684 struct ifbrmne * ifbmne;
2685
2686 ifbmne = (struct ifbrmne *)(void *)scan;
2687 ret_list[i] = *ifbmne;
2688 }
2689 done:
2690 if (buf != NULL) {
2691 free(buf);
2692 }
2693 *ret_count = count;
2694 return ret_list;
2695 }
2696
2697 static struct ifbrmne *
bridge_mac_nat_entries_copy(u_int * ret_count)2698 bridge_mac_nat_entries_copy(u_int * ret_count)
2699 {
2700 return bridge_mac_nat_entries_copy_common(BRIDGE200, ret_count);
2701 }
2702
2703 static void
bridge_mac_nat_entries_log(struct ifbrmne * entries,u_int count)2704 bridge_mac_nat_entries_log(struct ifbrmne * entries, u_int count)
2705 {
2706 u_int i;
2707 char ntoabuf[ETHER_NTOA_BUFSIZE];
2708 char ntopbuf[INET6_ADDRSTRLEN];
2709 struct ifbrmne * scan;
2710
2711 for (i = 0, scan = entries; i < count; i++, scan++) {
2712 ether_ntoa_buf((const ether_addr_t *)&scan->ifbmne_mac,
2713 ntoabuf, sizeof(ntoabuf));
2714 inet_ntop(scan->ifbmne_af, &scan->ifbmne_ip,
2715 ntopbuf, sizeof(ntopbuf));
2716 printf("%s %s %s %lu\n",
2717 scan->ifbmne_ifname, ntopbuf, ntoabuf,
2718 (unsigned long)scan->ifbmne_expire);
2719 }
2720 return;
2721 }
2722
2723 /**
2724 ** Test Main
2725 **/
2726 static u_int S_n_ports;
2727 static switch_port_list_t S_port_list;
2728
2729 static void
2730 bridge_cleanup(const char * bridge, u_int n_ports, bool fail_on_error);
2731
2732 static int fake_bsd_mode;
2733 static int fake_fcs;
2734 static int fake_trailer_length;
2735
2736 static void
fake_set_trailers_fcs(bool enable)2737 fake_set_trailers_fcs(bool enable)
2738 {
2739 int error;
2740 int fcs;
2741 size_t len;
2742 int trailer_length;
2743
2744 if (enable) {
2745 fcs = 1;
2746 trailer_length = 28;
2747 } else {
2748 fcs = 0;
2749 trailer_length = 0;
2750 }
2751
2752 /* set fcs */
2753 len = sizeof(fake_fcs);
2754 error = sysctlbyname("net.link.fake.fcs",
2755 &fake_fcs, &len,
2756 &fcs, sizeof(fcs));
2757 T_ASSERT_EQ(error, 0, "sysctl net.link.fake.fcs %d", fcs);
2758
2759 /* set trailer_length */
2760 len = sizeof(fake_trailer_length);
2761 error = sysctlbyname("net.link.fake.trailer_length",
2762 &fake_trailer_length, &len,
2763 &trailer_length, sizeof(trailer_length));
2764 T_ASSERT_EQ(error, 0, "sysctl net.link.fake.trailer_length %d",
2765 trailer_length);
2766 }
2767
2768 static void
fake_restore_trailers_fcs(void)2769 fake_restore_trailers_fcs(void)
2770 {
2771 int error;
2772
2773 error = sysctlbyname("net.link.fake.fcs",
2774 NULL, 0, &fake_fcs, sizeof(fake_fcs));
2775 T_LOG("sysctl net.link.fake.fcs=%d returned %d", fake_fcs, error);
2776 error = sysctlbyname("net.link.fake.trailer_length",
2777 NULL, 0, &fake_trailer_length, sizeof(fake_trailer_length));
2778 T_LOG("sysctl net.link.fake.trailer_length=%d returned %d",
2779 fake_trailer_length, error);
2780 }
2781
2782 static void
fake_set_bsd_mode(bool enable)2783 fake_set_bsd_mode(bool enable)
2784 {
2785 int error;
2786 int bsd_mode;
2787 size_t len;
2788
2789 bsd_mode = (enable) ? 1 : 0;
2790 len = sizeof(fake_bsd_mode);
2791 error = sysctlbyname("net.link.fake.bsd_mode",
2792 &fake_bsd_mode, &len,
2793 &bsd_mode, sizeof(bsd_mode));
2794 T_ASSERT_EQ(error, 0, "sysctl net.link.fake.bsd_mode %d", bsd_mode);
2795 }
2796
2797 static void
fake_restore_bsd_mode(void)2798 fake_restore_bsd_mode(void)
2799 {
2800 int error;
2801
2802 error = sysctlbyname("net.link.fake.bsd_mode",
2803 NULL, 0, &fake_bsd_mode, sizeof(fake_bsd_mode));
2804 T_LOG("sysctl net.link.fake.bsd_mode=%d returned %d",
2805 fake_bsd_mode, error);
2806 }
2807
2808 static void
fake_set_lro(bool enable)2809 fake_set_lro(bool enable)
2810 {
2811 int error;
2812 int lro;
2813
2814 lro = (enable) ? 1 : 0;
2815 error = sysctlbyname("net.link.fake.lro", NULL, 0,
2816 &lro, sizeof(lro));
2817 T_ASSERT_EQ(error, 0, "sysctl net.link.fake.lro %d", lro);
2818 }
2819
2820 static void
cleanup_common(bool dump_table)2821 cleanup_common(bool dump_table)
2822 {
2823 if (S_n_ports == 0) {
2824 return;
2825 }
2826 S_cleaning_up = true;
2827 if (S_port_list != NULL &&
2828 (S_port_list->mac_nat || dump_table)) {
2829 switch_port_list_log(S_port_list);
2830 if (S_port_list->mac_nat) {
2831 switch_port_list_verify_mac_nat(S_port_list, true);
2832 }
2833 (void)switch_port_list_verify_rt_table(S_port_list, true);
2834 }
2835 if (G_debug) {
2836 T_LOG("sleeping for 5 seconds\n");
2837 sleep(5);
2838 }
2839 bridge_cleanup(BRIDGE200, S_n_ports, false);
2840 return;
2841 }
2842
2843 static void
cleanup(void)2844 cleanup(void)
2845 {
2846 cleanup_common(true);
2847 return;
2848 }
2849
2850 static void
sigint_handler(__unused int sig)2851 sigint_handler(__unused int sig)
2852 {
2853 cleanup_common(false);
2854 signal(SIGINT, SIG_DFL);
2855 }
2856
2857 static switch_port_list_t
bridge_setup(char * bridge,u_int n_ports,u_int num_addrs,uint8_t setup_flags)2858 bridge_setup(char * bridge, u_int n_ports, u_int num_addrs,
2859 uint8_t setup_flags)
2860 {
2861 u_int addr_index = 1;
2862 bool attach_stack;
2863 ether_addr_t bridge_mac;
2864 bool checksum_offload;
2865 errno_t err;
2866 struct in_addr ip;
2867 switch_port_list_t list = NULL;
2868 bool mac_nat;
2869 bool share_member_mac = false;
2870 uint8_t trailers;
2871
2872 attach_stack = (setup_flags & SETUP_FLAGS_ATTACH_STACK) != 0;
2873 checksum_offload = (setup_flags & SETUP_FLAGS_CHECKSUM_OFFLOAD) != 0;
2874 mac_nat = (setup_flags & SETUP_FLAGS_MAC_NAT) != 0;
2875 trailers = (setup_flags & SETUP_FLAGS_TRAILERS) != 0;
2876 share_member_mac = (setup_flags & SETUP_FLAGS_SHARE_MEMBER_MAC) != 0;
2877
2878 S_n_ports = n_ports;
2879 T_ATEND(cleanup);
2880 T_SETUPBEGIN;
2881 err = ifnet_create(bridge);
2882 if (err != 0) {
2883 goto done;
2884 }
2885 ifnet_get_lladdr(bridge, &bridge_mac);
2886 bridge_if_index = (u_short)if_nametoindex(bridge);
2887 if (attach_stack) {
2888 char ntopbuf_ip[INET6_ADDRSTRLEN];
2889
2890 /* bridge gets .1 */
2891 get_ipv4_address(0, addr_index, &bridge_ip_addr);
2892 addr_index++;
2893 ifnet_add_ip_address(bridge, bridge_ip_addr,
2894 inet_class_c_subnet_mask);
2895 ifnet_start_ipv6(bridge);
2896 get_ipv6_ll_address(&bridge_mac, &bridge_ipv6_addr);
2897 inet_ntop(AF_INET6, &bridge_ipv6_addr, ntopbuf_ip,
2898 sizeof(ntopbuf_ip));
2899 T_LOG("%s %s", bridge, ntopbuf_ip);
2900 }
2901 list = switch_port_list_alloc(n_ports, mac_nat);
2902 fake_set_bsd_mode(true);
2903 fake_set_trailers_fcs(trailers);
2904 for (u_int i = 0; i < n_ports; i++) {
2905 bool do_mac_nat;
2906 char ifname[IFNAMSIZ];
2907 u_short if_index = 0;
2908 char member_ifname[IFNAMSIZ];
2909
2910 snprintf(ifname, sizeof(ifname), "%s%d",
2911 FETH_NAME, i);
2912 snprintf(member_ifname, sizeof(member_ifname), "%s%d",
2913 FETH_NAME, i + n_ports);
2914 err = ifnet_create(ifname);
2915 if (err != 0) {
2916 goto done;
2917 }
2918 ifnet_attach_ip(ifname);
2919 err = ifnet_create(member_ifname);
2920 if (err != 0) {
2921 goto done;
2922 }
2923 if (i == 0 && share_member_mac) {
2924 err = ifnet_set_lladdr(member_ifname, &bridge_mac);
2925 if (err != 0) {
2926 goto done;
2927 }
2928 }
2929 fake_set_peer(ifname, member_ifname);
2930 if (attach_stack) {
2931 /* members get .2, .3, etc. */
2932 if_index = (u_short)if_nametoindex(ifname);
2933 get_ipv4_address(0, addr_index, &ip);
2934 ifnet_add_ip_address(ifname, ip,
2935 inet_class_c_subnet_mask);
2936 route_add_inet_scoped_subnet(ifname, if_index,
2937 ip, inet_class_c_subnet_mask);
2938 addr_index++;
2939 ifnet_start_ipv6(ifname);
2940 }
2941 /* add the interface's peer to the bridge */
2942 err = bridge_add_member(bridge, member_ifname);
2943 if (err != 0) {
2944 goto done;
2945 }
2946
2947 do_mac_nat = (i == 0 && mac_nat);
2948 if (do_mac_nat) {
2949 /* enable MAC NAT on unit 0 */
2950 err = bridge_member_modify_mac_nat(bridge,
2951 member_ifname,
2952 true);
2953 if (err != 0) {
2954 goto done;
2955 }
2956 } else if (checksum_offload) {
2957 err = bridge_member_modify_checksum_offload(bridge,
2958 member_ifname,
2959 true);
2960 if (err != 0) {
2961 goto done;
2962 }
2963 }
2964 /* we'll send/receive on the interface */
2965 err = switch_port_list_add_port(list, i, ifname, if_index,
2966 member_ifname, num_addrs, do_mac_nat, &ip);
2967 if (err != 0) {
2968 goto done;
2969 }
2970 }
2971 done:
2972 if (err != 0 && list != NULL) {
2973 switch_port_list_dealloc(list);
2974 list = NULL;
2975 }
2976 T_SETUPEND;
2977 return list;
2978 }
2979
2980 static void
bridge_cleanup(const char * bridge,u_int n_ports,bool fail_on_error)2981 bridge_cleanup(const char * bridge, u_int n_ports, bool fail_on_error)
2982 {
2983 ifnet_destroy(bridge, fail_on_error);
2984 for (u_int i = 0; i < n_ports; i++) {
2985 char ifname[IFNAMSIZ];
2986 char member_ifname[IFNAMSIZ];
2987
2988 snprintf(ifname, sizeof(ifname), "%s%d",
2989 FETH_NAME, i);
2990 snprintf(member_ifname, sizeof(member_ifname), "%s%d",
2991 FETH_NAME, i + n_ports);
2992 ifnet_destroy(ifname, fail_on_error);
2993 ifnet_destroy(member_ifname, fail_on_error);
2994 }
2995 S_n_ports = 0;
2996 fake_restore_trailers_fcs();
2997 fake_restore_bsd_mode();
2998 return;
2999 }
3000
3001 /*
3002 * Basic Bridge Tests
3003 *
3004 * Broadcast
3005 * - two cases: actual broadcast, unknown ethernet
3006 * - send broadcast packets
3007 * - verify all received
3008 * - check bridge rt list contains all expected MAC addresses
3009 * - send unicast ARP packets
3010 * - verify packets received only on expected port
3011 *
3012 * MAC-NAT
3013 * - verify ARP translation
3014 * - verify IPv4 translation
3015 * - verify DHCP broadcast bit conversion
3016 * - verify IPv6 translation
3017 * - verify ND6 translation (Neighbor, Router)
3018 * - verify IPv4 subnet-local broadcast to MAC-NAT interface link-layer
3019 * address arrives on all member links
3020 */
3021
3022 static void
bridge_test(packet_validator_t validator,void * context,const ether_addr_t * dst_eaddr,uint8_t af,u_int n_ports,u_int num_addrs)3023 bridge_test(packet_validator_t validator,
3024 void * context,
3025 const ether_addr_t * dst_eaddr,
3026 uint8_t af, u_int n_ports, u_int num_addrs)
3027 {
3028 #if TARGET_OS_BRIDGE
3029 T_SKIP("Test uses too much memory");
3030 #else /* TARGET_OS_BRIDGE */
3031 switch_port_list_t port_list;
3032
3033 signal(SIGINT, sigint_handler);
3034 port_list = bridge_setup(BRIDGE200, n_ports, num_addrs, 0);
3035 if (port_list == NULL) {
3036 T_FAIL("bridge_setup");
3037 return;
3038 }
3039 S_port_list = port_list;
3040 bridge_learning_test(port_list, af, validator, context, dst_eaddr);
3041
3042 //T_LOG("Sleeping for 5 seconds");
3043 //sleep(5);
3044 bridge_cleanup(BRIDGE200, n_ports, true);
3045 switch_port_list_dealloc(port_list);
3046 return;
3047 #endif /* TARGET_OS_BRIDGE */
3048 }
3049
3050 static void
bridge_test_mac_nat_ipv4(u_int n_ports,u_int num_addrs)3051 bridge_test_mac_nat_ipv4(u_int n_ports, u_int num_addrs)
3052 {
3053 #if TARGET_OS_BRIDGE
3054 T_SKIP("Test uses too much memory");
3055 #else /* TARGET_OS_BRIDGE */
3056 switch_port_list_t port_list;
3057
3058 signal(SIGINT, sigint_handler);
3059 port_list = bridge_setup(BRIDGE200, n_ports, num_addrs,
3060 SETUP_FLAGS_MAC_NAT);
3061 if (port_list == NULL) {
3062 T_FAIL("bridge_setup");
3063 return;
3064 }
3065 S_port_list = port_list;
3066
3067 /* verify that IPv4 packets get translated when necessary */
3068 mac_nat_test_ip(port_list, AF_INET);
3069
3070 /* verify the DHCP broadcast bit gets set appropriately */
3071 mac_nat_test_dhcp(port_list, false);
3072
3073 /* verify that ARP packet gets translated when necessary */
3074 mac_nat_test_arp_out(port_list);
3075 mac_nat_test_arp_in(port_list);
3076
3077 /* verify IP broadcast to MAC-NAT interface link layer address */
3078 mac_nat_test_dhcp(port_list, true);
3079
3080 if (G_debug) {
3081 T_LOG("Sleeping for 5 seconds");
3082 sleep(5);
3083 }
3084 bridge_cleanup(BRIDGE200, n_ports, true);
3085 switch_port_list_dealloc(port_list);
3086 return;
3087 #endif /* TARGET_OS_BRIDGE */
3088 }
3089
3090 static void
bridge_test_mac_nat_ipv6(u_int n_ports,u_int num_addrs,uint8_t flags)3091 bridge_test_mac_nat_ipv6(u_int n_ports, u_int num_addrs, uint8_t flags)
3092 {
3093 #if TARGET_OS_BRIDGE
3094 T_SKIP("Test uses too much memory");
3095 #else /* TARGET_OS_BRIDGE */
3096 switch_port_list_t port_list;
3097
3098 signal(SIGINT, sigint_handler);
3099 flags |= SETUP_FLAGS_MAC_NAT;
3100 port_list = bridge_setup(BRIDGE200, n_ports, num_addrs, flags);
3101 if (port_list == NULL) {
3102 T_FAIL("bridge_setup");
3103 return;
3104 }
3105 S_port_list = port_list;
3106
3107 /* verify that IPv6 packets get translated when necessary */
3108 mac_nat_test_ip(port_list, AF_INET6);
3109
3110 /* verify that ND6 packet gets translated when necessary */
3111 mac_nat_test_nd6_out(port_list);
3112 if (G_debug) {
3113 T_LOG("Sleeping for 5 seconds");
3114 sleep(5);
3115 }
3116 bridge_cleanup(BRIDGE200, n_ports, true);
3117 switch_port_list_dealloc(port_list);
3118 return;
3119 #endif /* TARGET_OS_BRIDGE */
3120 }
3121
3122 /*
3123 * Filter test utilities
3124 */
3125 static void
system_cmd(const char * cmd,bool fail_on_error)3126 system_cmd(const char *cmd, bool fail_on_error)
3127 {
3128 pid_t pid = -1;
3129 int exit_status = 0;
3130 const char *argv[] = {
3131 "/usr/local/bin/bash",
3132 "-c",
3133 cmd,
3134 NULL
3135 };
3136
3137 int rc = dt_launch_tool(&pid, (char **)(void *)argv, false, NULL, NULL);
3138 T_QUIET;
3139 T_ASSERT_EQ(rc, 0, "dt_launch_tool(%s) failed", cmd);
3140
3141 if (dt_waitpid(pid, &exit_status, NULL, 30)) {
3142 T_QUIET;
3143 T_ASSERT_MACH_SUCCESS(exit_status, "command(%s)", cmd);
3144 } else {
3145 if (fail_on_error) {
3146 T_FAIL("dt_waitpid(%s) failed", cmd);
3147 }
3148 }
3149 }
3150
3151 static bool
executable_is_present(const char * path)3152 executable_is_present(const char * path)
3153 {
3154 struct stat statb = { 0 };
3155
3156 return stat(path, &statb) == 0 && (statb.st_mode & S_IXUSR) != 0;
3157 }
3158
3159 static void
cleanup_pf(void)3160 cleanup_pf(void)
3161 {
3162 struct ifbrparam param;
3163
3164 system_cmd("pfctl -d", false);
3165 system_cmd("pfctl -F all", false);
3166
3167 param.ifbrp_filter = 0;
3168 siocdrvspec(BRIDGE200, BRDGSFILT,
3169 ¶m, sizeof(param), true);
3170 return;
3171 }
3172
3173 static void
block_all_traffic(bool input,const char * infname1,const char * infname2)3174 block_all_traffic(bool input, const char* infname1, const char* infname2)
3175 {
3176 int ret;
3177 struct ifbrparam param;
3178 char command[512];
3179 char *dir = input ? "in" : "out";
3180
3181 snprintf(command, sizeof(command), "echo \"block %s on %s all\nblock %s on %s all\n\" | pfctl -vvv -f -",
3182 dir, infname1, dir, infname2);
3183 /* enable block all filter */
3184 param.ifbrp_filter = IFBF_FILT_MEMBER | IFBF_FILT_ONLYIP;
3185 ret = siocdrvspec(BRIDGE200, BRDGSFILT,
3186 ¶m, sizeof(param), true);
3187 T_ASSERT_POSIX_SUCCESS(ret,
3188 "SIOCDRVSPEC(BRDGSFILT %s, 0x%x)",
3189 BRIDGE200, param.ifbrp_filter);
3190 // ignore errors such that not having pf.os doesn't raise any issues
3191 system_cmd(command, false);
3192 system_cmd("pfctl -e", true);
3193 system_cmd("pfctl -s all", true);
3194 }
3195
3196 /*
3197 * Basic bridge filter test
3198 *
3199 * For both broadcast and unicast transfers ensure that data can
3200 * be blocked using pf on the bridge
3201 */
3202
3203 static void
filter_test(uint8_t af)3204 filter_test(uint8_t af)
3205 {
3206 #if TARGET_OS_BRIDGE
3207 T_SKIP("pfctl isn't valid on this platform");
3208 #else /* TARGET_OS_BRIDGE */
3209 switch_port_list_t port_list;
3210 switch_port_t port;
3211 const u_int n_ports = 2;
3212 u_int num_addrs = 1;
3213 u_int i;
3214 char ntoabuf[ETHER_NTOA_BUFSIZE];
3215 union ifbrip dst_ip;
3216 bool blocked = true;
3217 bool input = true;
3218 const char* ifnames[2];
3219
3220 #define PFCTL_PATH "/sbin/pfctl"
3221 if (!executable_is_present(PFCTL_PATH)) {
3222 T_SKIP("%s not present", PFCTL_PATH);
3223 return;
3224 }
3225 signal(SIGINT, sigint_handler);
3226
3227 T_ATEND(cleanup);
3228 T_ATEND(cleanup_pf);
3229
3230 port_list = bridge_setup(BRIDGE200, n_ports, num_addrs, 0);
3231 if (port_list == NULL) {
3232 T_FAIL("bridge_setup");
3233 return;
3234 }
3235
3236 ether_ntoa_buf(ðer_broadcast, ntoabuf, sizeof(ntoabuf));
3237
3238 S_port_list = port_list;
3239 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
3240 ifnames[i] = port->member_ifname;
3241 }
3242
3243 get_broadcast_ip_address(af, &dst_ip);
3244 do {
3245 do {
3246 if (blocked) {
3247 block_all_traffic(input, ifnames[0], ifnames[1]);
3248 }
3249 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
3250 if (G_debug) {
3251 T_LOG("Sending on %s", port->ifname);
3252 }
3253 for (u_int j = 0; j < port->num_addrs; j++) {
3254 uint32_t generation;
3255
3256 generation = next_generation();
3257 send_generation(port,
3258 af,
3259 j,
3260 ðer_broadcast,
3261 &dst_ip,
3262 generation);
3263
3264 /* receive across all ports */
3265 check_receive_generation(port_list,
3266 af,
3267 generation,
3268 validate_broadcast_dhost,
3269 NULL);
3270
3271 /* ensure that every port saw the right amount of packets*/
3272 if (blocked) {
3273 check_received_count(port_list, port, 0);
3274 } else {
3275 check_received_count(port_list, port, 1);
3276 }
3277 }
3278 }
3279 T_PASS("%s broadcast %s %s", __func__, blocked ? "blocked" : "not blocked", input ? "input" : "output");
3280 input = !input;
3281 cleanup_pf();
3282 } while (input == false && blocked);
3283 blocked = !blocked;
3284 } while (blocked == false);
3285
3286 do {
3287 do {
3288 if (blocked) {
3289 block_all_traffic(input, ifnames[0], ifnames[1]);
3290 }
3291 for (i = 0, port = port_list->list; i < port_list->count; i++, port++) {
3292 /* send unicast packets to every other port's MAC addresses */
3293 unicast_send_all(port_list, af, port);
3294
3295 /* receive all of that generated traffic */
3296 switch_port_list_check_receive(port_list, af, NULL, 0,
3297 validate_port_dhost, NULL);
3298
3299 /* ensure that every port saw the right amount of packets*/
3300 if (blocked) {
3301 check_received_count(port_list, port, 0);
3302 } else {
3303 check_received_count(port_list, port, 1);
3304 }
3305 }
3306 T_PASS("%s unicast %s %s", __func__, blocked ? "blocked" : "not blocked", input ? "input" : "output");
3307 input = !input;
3308 cleanup_pf();
3309 } while (input == false && blocked);
3310 blocked = !blocked;
3311 } while (blocked == false);
3312
3313 bridge_cleanup(BRIDGE200, n_ports, true);
3314 switch_port_list_dealloc(port_list);
3315 return;
3316 #endif /* TARGET_OS_BRIDGE */
3317 }
3318
3319 /*
3320 * Bridge checksum offload tests
3321 */
3322
3323 static void
test_traffic_for_af(switch_port_list_t ports,uint8_t af)3324 test_traffic_for_af(switch_port_list_t ports, uint8_t af)
3325 {
3326 u_int i;
3327 inet_address server;
3328 int server_if_index;
3329 const char * server_name;
3330 switch_port_t server_port;
3331 switch_port_t port;
3332
3333 /* bridge as server, each peer as client */
3334 server_if_index = bridge_if_index;
3335 server_name = BRIDGE200;
3336 if (af == AF_INET) {
3337 server.v4 = bridge_ip_addr;
3338 } else {
3339 server.v6 = bridge_ipv6_addr;
3340 }
3341 for (i = 0, port = ports->list; i < ports->count; i++, port++) {
3342 inet_test_traffic(af, &server, server_name,
3343 server_if_index, port->ifname, port->if_index);
3344 }
3345
3346 /* peer 0 as server, other peers as client */
3347 assert(ports->count > 0);
3348 server_port = ports->list;
3349 server_name = server_port->ifname;
3350 server_if_index = server_port->if_index;
3351 if (af == AF_INET) {
3352 server.v4 = server_port->ip;
3353 } else {
3354 server.v6 = server_port->ip6;
3355 }
3356 for (i = 1, port = ports->list + 1; i < ports->count; i++, port++) {
3357 inet_test_traffic(af, &server, server_name,
3358 server_if_index, port->ifname, port->if_index);
3359 }
3360 }
3361
3362 static void
bridge_test_transfer(u_int n_ports,uint8_t setup_flags)3363 bridge_test_transfer(u_int n_ports, uint8_t setup_flags)
3364 {
3365 #if TARGET_OS_BRIDGE
3366 T_SKIP("Test uses too much memory");
3367 #else /* TARGET_OS_BRIDGE */
3368 switch_port_list_t port_list;
3369
3370 signal(SIGINT, sigint_handler);
3371 port_list = bridge_setup(BRIDGE200, n_ports, 0,
3372 SETUP_FLAGS_ATTACH_STACK | setup_flags);
3373 if (port_list == NULL) {
3374 T_FAIL("bridge_setup");
3375 return;
3376 }
3377 test_traffic_for_af(port_list, AF_INET);
3378 test_traffic_for_af(port_list, AF_INET6);
3379 if (G_debug) {
3380 T_LOG("Sleeping for 5 seconds");
3381 sleep(5);
3382 }
3383 bridge_cleanup(BRIDGE200, n_ports, true);
3384 switch_port_list_dealloc(port_list);
3385 return;
3386 #endif /* TARGET_OS_BRIDGE */
3387 }
3388
3389 static void
lro_test_cleanup(void)3390 lro_test_cleanup(void)
3391 {
3392 ifnet_destroy(BRIDGE200, false);
3393 ifnet_destroy(FETH0, false);
3394 fake_set_lro(false);
3395 }
3396
3397 static void
sigint_lro_cleanup(__unused int sig)3398 sigint_lro_cleanup(__unused int sig)
3399 {
3400 signal(SIGINT, SIG_DFL);
3401 lro_test_cleanup();
3402 }
3403
3404 static void
verify_lro_capability(const char * if_name,bool expected)3405 verify_lro_capability(const char * if_name, bool expected)
3406 {
3407 struct ifreq ifr;
3408 int result;
3409 bool lro_enabled;
3410 int s = inet_dgram_socket_get();
3411
3412 memset(&ifr, 0, sizeof(ifr));
3413 strlcpy(ifr.ifr_name, if_name, sizeof(ifr.ifr_name));
3414 result = ioctl(s, SIOCGIFCAP, &ifr);
3415 T_ASSERT_POSIX_SUCCESS(result, "SIOCGIFCAP(%s)", if_name);
3416 lro_enabled = (ifr.ifr_curcap & IFCAP_LRO) != 0;
3417 T_ASSERT_EQ(expected, lro_enabled, "%s %s expected %s",
3418 __func__, if_name, expected ? "enabled" : "disabled");
3419 }
3420
3421 static void
bridge_test_lro_disable(void)3422 bridge_test_lro_disable(void)
3423 {
3424 int err;
3425
3426 signal(SIGINT, sigint_lro_cleanup);
3427
3428 T_ATEND(lro_test_cleanup);
3429
3430 err = ifnet_create(BRIDGE200);
3431 T_ASSERT_EQ(err, 0, "ifnet_create(%s)", BRIDGE200);
3432 fake_set_lro(true);
3433 err = ifnet_create(FETH0);
3434 T_ASSERT_EQ(err, 0, "ifnet_create(%s)", FETH0);
3435 fake_set_lro(false);
3436 verify_lro_capability(FETH0, true);
3437 bridge_add_member(BRIDGE200, FETH0);
3438 verify_lro_capability(FETH0, false);
3439 bridge_delete_member(BRIDGE200, FETH0);
3440 verify_lro_capability(FETH0, true);
3441 }
3442
3443 T_DECL(net_if_bridge_bcast,
3444 "bridge broadcast IPv4",
3445 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3446 {
3447 bridge_test(validate_broadcast_dhost, NULL, ðer_broadcast,
3448 AF_INET, 5, 1);
3449 }
3450
3451 T_DECL(net_if_bridge_bcast_many,
3452 "bridge broadcast many IPv4",
3453 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3454 {
3455 bridge_test(validate_broadcast_dhost, NULL, ðer_broadcast,
3456 AF_INET, 5, 20);
3457 }
3458
3459 T_DECL(net_if_bridge_unknown,
3460 "bridge unknown host IPv4",
3461 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3462 {
3463 bridge_test(validate_not_present_dhost, NULL, ðer_external,
3464 AF_INET, 5, 1);
3465 }
3466
3467 T_DECL(net_if_bridge_bcast_v6,
3468 "bridge broadcast IPv6",
3469 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3470 {
3471 bridge_test(validate_broadcast_dhost, NULL, ðer_broadcast,
3472 AF_INET6, 5, 1);
3473 }
3474
3475 T_DECL(net_if_bridge_bcast_many_v6,
3476 "bridge broadcast many IPv6",
3477 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3478 {
3479 bridge_test(validate_broadcast_dhost, NULL, ðer_broadcast,
3480 AF_INET6, 5, 20);
3481 }
3482
3483 T_DECL(net_if_bridge_unknown_v6,
3484 "bridge unknown host IPv6",
3485 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3486 {
3487 bridge_test(validate_not_present_dhost, NULL, ðer_external,
3488 AF_INET6, 5, 1);
3489 }
3490
3491 T_DECL(net_if_bridge_mac_nat_ipv4,
3492 "bridge mac nat ipv4",
3493 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3494 {
3495 bridge_test_mac_nat_ipv4(5, 10);
3496 }
3497
3498 T_DECL(net_if_bridge_mac_nat_ipv6,
3499 "bridge mac nat ipv6",
3500 T_META_ASROOT(true),
3501 T_META_TAG_VM_PREFERRED,
3502 T_META_ENABLED(false /* rdar://133955717 */))
3503 {
3504 bridge_test_mac_nat_ipv6(5, 10, 0);
3505 }
3506
3507 T_DECL(net_if_bridge_mac_nat_ipv6_trailers,
3508 "bridge mac nat ipv6 trailers",
3509 T_META_ASROOT(true),
3510 T_META_TAG_VM_PREFERRED,
3511 T_META_ENABLED(false /* rdar://133955717 */))
3512 {
3513 bridge_test_mac_nat_ipv6(5, 10, SETUP_FLAGS_TRAILERS);
3514 }
3515
3516 T_DECL(net_if_bridge_filter_ipv4,
3517 "bridge filter ipv4",
3518 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3519 {
3520 filter_test(AF_INET);
3521 }
3522
3523 T_DECL(net_if_bridge_filter_ipv6,
3524 "bridge filter ipv6",
3525 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3526 {
3527 filter_test(AF_INET6);
3528 }
3529
3530 T_DECL(net_if_bridge_checksum_offload,
3531 "bridge checksum offload",
3532 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3533 {
3534 bridge_test_transfer(2, SETUP_FLAGS_CHECKSUM_OFFLOAD);
3535 }
3536
3537 T_DECL(net_if_bridge_checksum_offload_trailers,
3538 "bridge checksum offload with trailers+fcs",
3539 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3540 {
3541 bridge_test_transfer(2, SETUP_FLAGS_CHECKSUM_OFFLOAD |
3542 SETUP_FLAGS_TRAILERS);
3543 }
3544
3545 T_DECL(net_if_bridge_transfer,
3546 "bridge transfer",
3547 T_META_ASROOT(true))
3548 {
3549 bridge_test_transfer(2, 0);
3550 }
3551
3552 T_DECL(net_if_bridge_transfer_share_mac,
3553 "bridge transfer share member's MAC",
3554 T_META_ASROOT(true))
3555 {
3556 bridge_test_transfer(2, SETUP_FLAGS_SHARE_MEMBER_MAC);
3557 }
3558
3559 T_DECL(net_if_bridge_lro_disable,
3560 "bridge LRO disable",
3561 T_META_ASROOT(true), T_META_TAG_VM_PREFERRED)
3562 {
3563 bridge_test_lro_disable();
3564 }
3565