SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall-util: drop FirewallContext

Browse Source 
After iptables support is dropped, FirewallContext is a trivial
wrapper of sd_netlink. Let's drop it and directly use sd_netlink.
This commit is contained in:
Yu Watanabe
2025-09-19 15:33:17 +09:00
parent 9b75c41cb3
commit 7184f8366f
21 changed files with 189 additions and 396 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/test-firewall-util.c
+46 -59
View File
@@ -3,22 +3,24 @@
#include <stdlib.h>
#include <unistd.h>
#include "sd-netlink.h"
#include "firewall-util.h"
#include "firewall-util-private.h"
#include "in-addr-util.h"
#include "log.h"
#include "netlink-internal.h"
#include "random-util.h"
#include "socket-util.h"
#include "tests.h"
static void test_v6(FirewallContext *ctx) {
static sd_netlink *nfnl = NULL;
TEST(v6) {
union in_addr_union u1, u2, u3;
uint8_t prefixlen;
int r;
ASSERT_NOT_NULL(ctx);
log_info("/* %s(backend=%s) */", __func__, firewall_backend_to_string(ctx->backend));
ASSERT_NOT_NULL(nfnl);
if (!socket_ipv6_is_supported())
return log_info("IPv6 is not supported by kernel, skipping tests.");
@@ -29,22 +31,19 @@ static void test_v6(FirewallContext *ctx) {
prefixlen = random_u64_range(128 + 1 - 8) + 8;
random_bytes(&u3, sizeof(u3));
ASSERT_OK(fw_add_masquerade(&ctx, true, AF_INET6, &u1, 128));
ASSERT_OK(fw_add_masquerade(&ctx, false, AF_INET6, &u1, 128));
ASSERT_OK(fw_add_masquerade(&ctx, true, AF_INET6, &u1, 64));
ASSERT_OK(fw_add_masquerade(&ctx, false, AF_INET6, &u1, 64));
ASSERT_OK(fw_add_masquerade(&ctx, true, AF_INET6, &u3, prefixlen));
ASSERT_OK(fw_add_masquerade(&ctx, false, AF_INET6, &u3, prefixlen));
ASSERT_OK_OR(r = fw_nftables_add_masquerade(nfnl, true, AF_INET6, &u1, 128),
-EPERM, -EOPNOTSUPP, -ENOPROTOOPT);
if (r < 0)
return (void) log_tests_skipped_errno(r, "Failed to add IPv6 masquerade");
r = fw_add_local_dnat(&ctx, true, AF_INET6, IPPROTO_TCP, 4711, &u1, 815, NULL);
if (r == -EOPNOTSUPP) {
log_info("IPv6 DNAT seems not supported, skipping the following tests.");
return;
}
ASSERT_OK(r);
ASSERT_OK(fw_add_local_dnat(&ctx, true, AF_INET6, IPPROTO_TCP, 4711, &u2, 815, &u1));
ASSERT_OK(fw_add_local_dnat(&ctx, false, AF_INET6, IPPROTO_TCP, 4711, &u2, 815, NULL));
ASSERT_OK(fw_nftables_add_masquerade(nfnl, false, AF_INET6, &u1, 128));
ASSERT_OK(fw_nftables_add_masquerade(nfnl, true, AF_INET6, &u1, 64));
ASSERT_OK(fw_nftables_add_masquerade(nfnl, false, AF_INET6, &u1, 64));
ASSERT_OK(fw_nftables_add_masquerade(nfnl, true, AF_INET6, &u3, prefixlen));
ASSERT_OK(fw_nftables_add_masquerade(nfnl, false, AF_INET6, &u3, prefixlen));
ASSERT_OK(fw_nftables_add_local_dnat(nfnl, true, AF_INET6, IPPROTO_TCP, 4711, &u1, 815, NULL));
ASSERT_OK(fw_nftables_add_local_dnat(nfnl, true, AF_INET6, IPPROTO_TCP, 4711, &u2, 815, &u1));
ASSERT_OK(fw_nftables_add_local_dnat(nfnl, false, AF_INET6, IPPROTO_TCP, 4711, &u2, 815, NULL));
}
static union in_addr_union *parse_addr(const char *str, union in_addr_union *u) {
@@ -54,45 +53,31 @@ static union in_addr_union *parse_addr(const char *str, union in_addr_union *u)
return u;
}
static bool test_v4(FirewallContext *ctx) {
TEST(v4) {
union in_addr_union u, v;
int r;
ASSERT_NOT_NULL(ctx);
ASSERT_NOT_NULL(nfnl);
log_info("/* %s(backend=%s) */", __func__, firewall_backend_to_string(ctx->backend));
ASSERT_ERROR(fw_nftables_add_masquerade(nfnl, true, AF_INET, NULL, 0), EINVAL);
ASSERT_ERROR(fw_nftables_add_masquerade(nfnl, true, AF_INET, parse_addr("10.1.2.0", &u), 0), EINVAL);
ASSERT_ERROR(fw_add_masquerade(&ctx, true, AF_INET, NULL, 0), EINVAL);
ASSERT_ERROR(fw_add_masquerade(&ctx, true, AF_INET, parse_addr("10.1.2.0", &u), 0), EINVAL);
ASSERT_OK_OR(r = fw_nftables_add_masquerade(nfnl, true, AF_INET, parse_addr("10.1.2.3", &u), 32),
-EPERM, -EOPNOTSUPP, -ENOPROTOOPT);
if (r < 0)
return (void) log_tests_skipped_errno(r, "Failed to add IPv4 masquerade");
r = fw_add_masquerade(&ctx, true, AF_INET, parse_addr("10.1.2.3", &u), 32);
if (r < 0) {
bool ignore = IN_SET(r, -EPERM, -EOPNOTSUPP, -ENOPROTOOPT);
log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
"Failed to add IPv4 masquerade%s: %m",
ignore ? ", skipping following tests" : "");
if (ignore)
return false;
}
ASSERT_OK(r);
ASSERT_OK(fw_add_masquerade(&ctx, true, AF_INET, parse_addr("10.0.2.0", &u), 28));
ASSERT_OK(fw_add_masquerade(&ctx, false, AF_INET, parse_addr("10.0.2.0", &u), 28));
ASSERT_OK(fw_add_masquerade(&ctx, false, AF_INET, parse_addr("10.1.2.3", &u), 32));
ASSERT_OK(fw_add_local_dnat(&ctx, true, AF_INET, IPPROTO_TCP, 4711, parse_addr("1.2.3.4", &u), 815, NULL));
ASSERT_OK(fw_add_local_dnat(&ctx, true, AF_INET, IPPROTO_TCP, 4711, parse_addr("1.2.3.4", &u), 815, NULL));
ASSERT_OK(fw_add_local_dnat(&ctx, true, AF_INET, IPPROTO_TCP, 4711, parse_addr("1.2.3.5", &u), 815, parse_addr("1.2.3.4", &v)));
ASSERT_OK(fw_add_local_dnat(&ctx, false, AF_INET, IPPROTO_TCP, 4711, parse_addr("1.2.3.5", &u), 815, NULL));
return true;
ASSERT_OK(fw_nftables_add_masquerade(nfnl, true, AF_INET, parse_addr("10.0.2.0", &u), 28));
ASSERT_OK(fw_nftables_add_masquerade(nfnl, false, AF_INET, parse_addr("10.0.2.0", &u), 28));
ASSERT_OK(fw_nftables_add_masquerade(nfnl, false, AF_INET, parse_addr("10.1.2.3", &u), 32));
ASSERT_OK(fw_nftables_add_local_dnat(nfnl, true, AF_INET, IPPROTO_TCP, 4711, parse_addr("1.2.3.4", &u), 815, NULL));
ASSERT_OK(fw_nftables_add_local_dnat(nfnl, true, AF_INET, IPPROTO_TCP, 4711, parse_addr("1.2.3.4", &u), 815, NULL));
ASSERT_OK(fw_nftables_add_local_dnat(nfnl, true, AF_INET, IPPROTO_TCP, 4711, parse_addr("1.2.3.5", &u), 815, parse_addr("1.2.3.4", &v)));
ASSERT_OK(fw_nftables_add_local_dnat(nfnl, false, AF_INET, IPPROTO_TCP, 4711, parse_addr("1.2.3.5", &u), 815, NULL));
}
int main(int argc, char *argv[]) {
_cleanup_(fw_ctx_freep) FirewallContext *ctx = NULL;
test_setup_logging(LOG_DEBUG);
static int intro(void) {
int r;
if (getuid() != 0)
return log_tests_skipped("not root");
@@ -100,14 +85,16 @@ int main(int argc, char *argv[]) {
ASSERT_OK_ERRNO(setenv("SYSTEMD_FIREWALL_UTIL_NFT_TABLE_NAME", "io.systemd-test.nat", /* overwrite = */ true));
ASSERT_OK_ERRNO(setenv("SYSTEMD_FIREWALL_UTIL_DNAT_MAP_NAME", "test_map_port_ipport", /* overwrite = */ true));
ASSERT_OK(fw_ctx_new(&ctx));
ASSERT_NOT_NULL(ctx);
if (ctx->backend == FW_BACKEND_NONE)
return log_tests_skipped("no firewall backend supported");
if (test_v4(ctx) && ctx->backend == FW_BACKEND_NFTABLES)
test_v6(ctx);
r = sd_nfnl_socket_open(&nfnl);
if (r < 0)
return log_tests_skipped_errno(r, "Failed to initialize nftables");
return 0;
}
static int outro(void) {
sd_netlink_unref(nfnl);
return 0;
}
DEFINE_TEST_MAIN_FULL(LOG_DEBUG, intro, outro);
src/test/test-nft-set.c
+8 -7
View File
@@ -2,6 +2,8 @@
#include <unistd.h>
#include "sd-netlink.h"
#include "firewall-util.h"
#include "in-addr-util.h"
#include "netlink-internal.h"
@@ -25,9 +27,8 @@ int main(int argc, char **argv) {
const char *table = argv[3], *set = argv[4];
FirewallContext *ctx;
r = fw_ctx_new(&ctx);
assert_se(r == 0);
_cleanup_(sd_netlink_unrefp) sd_netlink *nfnl = NULL;
ASSERT_OK(sd_nfnl_socket_open(&nfnl));
bool add;
if (streq(argv[1], "add"))
@@ -41,7 +42,7 @@ int main(int argc, char **argv) {
r = safe_atou32(argv[6], &element);
assert_se(r == 0);
r = nft_set_element_modify_any(ctx, add, nfproto, table, set, &element, sizeof(element));
r = nft_set_element_modify_any(nfnl, add, nfproto, table, set, &element, sizeof(element));
assert_se(r == 0);
} else if (streq(argv[5], "uint64")) {
uint64_t element;
@@ -49,7 +50,7 @@ int main(int argc, char **argv) {
r = safe_atou64(argv[6], &element);
assert_se(r == 0);
r = nft_set_element_modify_any(ctx, add, nfproto, table, set, &element, sizeof(element));
r = nft_set_element_modify_any(nfnl, add, nfproto, table, set, &element, sizeof(element));
assert_se(r == 0);
} else if (streq(argv[5], "in_addr")) {
union in_addr_union addr;
@@ -58,7 +59,7 @@ int main(int argc, char **argv) {
r = in_addr_from_string_auto(argv[6], &af, &addr);
assert_se(r == 0);
r = nft_set_element_modify_ip(ctx, add, nfproto, af, table, set, &addr);
r = nft_set_element_modify_ip(nfnl, add, nfproto, af, table, set, &addr);
assert_se(r == 0);
} else if (streq(argv[5], "network")) {
union in_addr_union addr;
@@ -68,7 +69,7 @@ int main(int argc, char **argv) {
r = in_addr_prefix_from_string_auto(argv[6], &af, &addr, &prefixlen);
assert_se(r == 0);
r = nft_set_element_modify_iprange(ctx, add, nfproto, af, table, set, &addr, prefixlen);
r = nft_set_element_modify_iprange(nfnl, add, nfproto, af, table, set, &addr, prefixlen);
assert_se(r == 0);
}