| // Copyright 2019 The Fuchsia Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| use pest::{iterators::Pair, Parser}; |
| |
| use fidl_fuchsia_hardware_network as fhnet; |
| use fidl_fuchsia_net as net; |
| use fidl_fuchsia_net_filter_deprecated as filter; |
| |
| use crate::{ |
| grammar::{Error, FilterRuleParser, InvalidReason, Rule}, |
| util, |
| }; |
| |
| fn parse_action(pair: Pair<'_, Rule>) -> filter::Action { |
| assert_eq!(pair.as_rule(), Rule::action); |
| match pair.into_inner().next().unwrap().as_rule() { |
| Rule::pass => filter::Action::Pass, |
| Rule::drop => filter::Action::Drop, |
| Rule::dropreset => filter::Action::DropReset, |
| _ => unreachable!("action must be one of (pass|drop|dropreset)"), |
| } |
| } |
| |
| fn parse_direction(pair: Pair<'_, Rule>) -> filter::Direction { |
| assert_eq!(pair.as_rule(), Rule::direction); |
| match pair.into_inner().next().unwrap().as_rule() { |
| Rule::incoming => filter::Direction::Incoming, |
| Rule::outgoing => filter::Direction::Outgoing, |
| _ => unreachable!("direction must be one of (in|out)"), |
| } |
| } |
| |
| fn parse_proto(pair: Pair<'_, Rule>) -> filter::SocketProtocol { |
| assert_eq!(pair.as_rule(), Rule::proto); |
| match pair.into_inner().next() { |
| Some(pair) => match pair.as_rule() { |
| Rule::tcp => filter::SocketProtocol::Tcp, |
| Rule::udp => filter::SocketProtocol::Udp, |
| Rule::icmp => filter::SocketProtocol::Icmp, |
| _ => unreachable!("protocol must be one of (tcp|udp|icmp)"), |
| }, |
| None => filter::SocketProtocol::Any, |
| } |
| } |
| |
| fn parse_devclass(pair: Pair<'_, Rule>) -> filter::DeviceClass { |
| assert_eq!(pair.as_rule(), Rule::devclass); |
| match pair.into_inner().next() { |
| Some(pair) => match pair.as_rule() { |
| Rule::virt => filter::DeviceClass::Match_(fhnet::DeviceClass::Virtual), |
| Rule::ethernet => filter::DeviceClass::Match_(fhnet::DeviceClass::Ethernet), |
| Rule::wlan => filter::DeviceClass::Match_(fhnet::DeviceClass::Wlan), |
| Rule::ppp => filter::DeviceClass::Match_(fhnet::DeviceClass::Ppp), |
| Rule::bridge => filter::DeviceClass::Match_(fhnet::DeviceClass::Bridge), |
| Rule::ap => filter::DeviceClass::Match_(fhnet::DeviceClass::WlanAp), |
| _ => unreachable!("devclass must be one of (virt|ethernet|wlan|ppp|bridge|ap)"), |
| }, |
| None => filter::DeviceClass::Any(filter::Empty {}), |
| } |
| } |
| |
| fn parse_src( |
| pair: Pair<'_, Rule>, |
| ) -> Result<(Option<Box<net::Subnet>>, bool, filter::PortRange), Error> { |
| assert_eq!(pair.as_rule(), Rule::src); |
| parse_src_or_dst(pair) |
| } |
| |
| fn parse_dst( |
| pair: Pair<'_, Rule>, |
| ) -> Result<(Option<Box<net::Subnet>>, bool, filter::PortRange), Error> { |
| assert_eq!(pair.as_rule(), Rule::dst); |
| parse_src_or_dst(pair) |
| } |
| |
| fn parse_src_or_dst( |
| pair: Pair<'_, Rule>, |
| ) -> Result<(Option<Box<net::Subnet>>, bool, filter::PortRange), Error> { |
| let mut inner = pair.into_inner(); |
| match inner.next() { |
| Some(pair) => match pair.as_rule() { |
| Rule::invertible_subnet => { |
| let (subnet, invert_match) = util::parse_invertible_subnet(pair)?; |
| let port = match inner.next() { |
| Some(pair) => parse_port_range(pair)?, |
| None => filter::PortRange { start: 0, end: 0 }, |
| }; |
| Ok((Some(Box::new(subnet)), invert_match, port)) |
| } |
| Rule::port_range => Ok((None, false, parse_port_range(pair)?)), |
| _ => unreachable!("src or dst must be either an invertible subnet or port range"), |
| }, |
| None => Ok((None, false, filter::PortRange { start: 0, end: 0 })), |
| } |
| } |
| |
| fn parse_port_range(pair: Pair<'_, Rule>) -> Result<filter::PortRange, Error> { |
| assert_eq!(pair.as_rule(), Rule::port_range); |
| let mut inner = pair.into_inner(); |
| let pair = inner.next().unwrap(); |
| match pair.as_rule() { |
| Rule::port => { |
| let port_num = util::parse_port_num(inner.next().unwrap())?; |
| Ok(filter::PortRange { start: port_num, end: port_num }) |
| } |
| Rule::range => { |
| let port_start = util::parse_port_num(inner.next().unwrap())?; |
| let port_end = util::parse_port_num(inner.next().unwrap())?; |
| Ok(filter::PortRange { start: port_start, end: port_end }) |
| } |
| _ => unreachable!("port range must be either a single port, or a port range"), |
| } |
| } |
| |
| fn parse_log(pair: Pair<'_, Rule>) -> bool { |
| assert_eq!(pair.as_rule(), Rule::log); |
| pair.as_str() == "log" |
| } |
| |
| fn parse_state(pair: Pair<'_, Rule>) -> bool { |
| assert_eq!(pair.as_rule(), Rule::state); |
| let mut inner = pair.into_inner(); |
| match inner.next() { |
| Some(pair) => { |
| assert_eq!(pair.as_rule(), Rule::state_adj); |
| match pair.as_str() { |
| "no" => false, |
| "keep" => true, |
| _ => unreachable!("state must be either (no|keep)"), |
| } |
| } |
| None => false, // no state by default |
| } |
| } |
| |
| fn parse_rule(pair: Pair<'_, Rule>) -> Result<filter::Rule, Error> { |
| assert_eq!(pair.as_rule(), Rule::rule); |
| let mut pairs = pair.into_inner(); |
| |
| let action = parse_action(pairs.next().unwrap()); |
| let direction = parse_direction(pairs.next().unwrap()); |
| let proto = parse_proto(pairs.next().unwrap()); |
| let device_class = parse_devclass(pairs.next().unwrap()); |
| let (src_subnet, src_subnet_invert_match, src_port_range) = parse_src(pairs.next().unwrap())?; |
| let (dst_subnet, dst_subnet_invert_match, dst_port_range) = parse_dst(pairs.next().unwrap())?; |
| let log = parse_log(pairs.next().unwrap()); |
| let keep_state = parse_state(pairs.next().unwrap()); |
| |
| Ok(filter::Rule { |
| action, |
| direction, |
| proto, |
| src_subnet, |
| src_subnet_invert_match, |
| src_port_range, |
| dst_subnet, |
| dst_subnet_invert_match, |
| dst_port_range, |
| nic: 0, // TODO: Support NICID (currently always 0 (= any)) |
| log, |
| keep_state, |
| device_class, |
| }) |
| } |
| |
| fn parse_nat(pair: Pair<'_, Rule>) -> Result<filter::Nat, Error> { |
| assert_eq!(pair.as_rule(), Rule::nat); |
| let mut pairs = pair.into_inner(); |
| |
| let proto = parse_proto(pairs.next().unwrap()); |
| let src_subnet = util::parse_subnet(pairs.next().unwrap())?; |
| |
| Ok(filter::Nat { |
| proto, |
| src_subnet, |
| outgoing_nic: 0, // TODO: Support NICID. |
| }) |
| } |
| |
| fn parse_rdr(pair: Pair<'_, Rule>) -> Result<filter::Rdr, Error> { |
| assert_eq!(pair.as_rule(), Rule::rdr); |
| let mut pairs = pair.into_inner(); |
| |
| let proto = parse_proto(pairs.next().unwrap()); |
| let dst_addr = util::parse_ipaddr(pairs.next().unwrap())?; |
| let dst_port_range = parse_port_range(pairs.next().unwrap())?; |
| let new_dst_addr = util::parse_ipaddr(pairs.next().unwrap())?; |
| let new_dst_port_range = parse_port_range(pairs.next().unwrap())?; |
| |
| Ok(filter::Rdr { |
| proto, |
| dst_addr, |
| dst_port_range, |
| new_dst_addr, |
| new_dst_port_range, |
| nic: 0, // TODO: Support NICID. |
| }) |
| } |
| |
| fn validate_port_range(range: &filter::PortRange) -> Result<(), Error> { |
| if (range.start == 0 && range.end != 0) || range.start > range.end { |
| return Err(Error::Invalid(InvalidReason::InvalidPortRange)); |
| } |
| Ok(()) |
| } |
| |
| fn port_range_length(range: &filter::PortRange) -> Result<u16, Error> { |
| let () = validate_port_range(&range)?; |
| Ok(range.end - range.start) |
| } |
| |
| fn validate_rule(rule: &filter::Rule) -> Result<(), Error> { |
| if let (Some(src_subnet), Some(dst_subnet)) = (&rule.src_subnet, &rule.dst_subnet) { |
| if !util::ip_version_eq(&src_subnet.addr, &dst_subnet.addr) { |
| return Err(Error::Invalid(InvalidReason::MixedIPVersions)); |
| } |
| } |
| let () = validate_port_range(&rule.src_port_range)?; |
| let () = validate_port_range(&rule.dst_port_range)?; |
| |
| Ok(()) |
| } |
| |
| fn validate_rdr(rdr: &filter::Rdr) -> Result<(), Error> { |
| if !util::ip_version_eq(&rdr.dst_addr, &rdr.new_dst_addr) { |
| return Err(Error::Invalid(InvalidReason::MixedIPVersions)); |
| } |
| if port_range_length(&rdr.dst_port_range)? != port_range_length(&rdr.new_dst_port_range)? { |
| return Err(Error::Invalid(InvalidReason::PortRangeLengthMismatch)); |
| } |
| |
| Ok(()) |
| } |
| |
| pub fn parse_str_to_rules(line: &str) -> Result<Vec<filter::Rule>, Error> { |
| let mut pairs = FilterRuleParser::parse(Rule::rules, &line).map_err(Error::Pest)?; |
| let mut rules = Vec::new(); |
| for filter_rule in pairs.next().unwrap().into_inner() { |
| match filter_rule.as_rule() { |
| Rule::rule => { |
| let rule = parse_rule(filter_rule)?; |
| let () = validate_rule(&rule)?; |
| rules.push(rule); |
| } |
| Rule::EOI => (), |
| _ => unreachable!("rule must only have a rule case"), |
| } |
| } |
| Ok(rules) |
| } |
| |
| pub fn parse_str_to_nat_rules(line: &str) -> Result<Vec<filter::Nat>, Error> { |
| let mut pairs = FilterRuleParser::parse(Rule::nat_rules, &line).map_err(Error::Pest)?; |
| let mut nat_rules = Vec::new(); |
| for filter_rule in pairs.next().unwrap().into_inner() { |
| match filter_rule.as_rule() { |
| Rule::nat => { |
| let nat = parse_nat(filter_rule)?; |
| nat_rules.push(nat); |
| } |
| Rule::EOI => (), |
| _ => unreachable!("nat must only have a nat case"), |
| } |
| } |
| Ok(nat_rules) |
| } |
| |
| pub fn parse_str_to_rdr_rules(line: &str) -> Result<Vec<filter::Rdr>, Error> { |
| let mut pairs = FilterRuleParser::parse(Rule::rdr_rules, &line).map_err(Error::Pest)?; |
| let mut rdr_rules = Vec::new(); |
| for filter_rule in pairs.next().unwrap().into_inner() { |
| match filter_rule.as_rule() { |
| Rule::rdr => { |
| let rdr = parse_rdr(filter_rule)?; |
| let () = validate_rdr(&rdr)?; |
| rdr_rules.push(rdr); |
| } |
| Rule::EOI => (), |
| _ => unreachable!("rdr must only have a rdr case"), |
| } |
| } |
| Ok(rdr_rules) |
| } |
| |
| #[cfg(test)] |
| mod test { |
| use super::*; |
| |
| use net_declare::{fidl_ip, fidl_subnet}; |
| |
| #[test] |
| fn test_rule_with_proto_any() { |
| assert_eq!( |
| parse_str_to_rules("pass in;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Any, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_proto_tcp() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_multiple_rules() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp; drop out proto udp;"), |
| Ok(vec![ |
| filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }, |
| filter::Rule { |
| action: filter::Action::Drop, |
| direction: filter::Direction::Outgoing, |
| proto: filter::SocketProtocol::Udp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }, |
| ]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_v4_address() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp from 1.2.3.4/24;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: Some(Box::new(fidl_subnet!("1.2.3.4/24"))), |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_port() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp from port 10000;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 10000, end: 10000 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_range() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp from range 10000:10010;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 10000, end: 10010 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_invalid_range_1() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp from range 0:5;"), |
| Err(Error::Invalid(InvalidReason::InvalidPortRange)) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_invalid_range_2() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp from range 10005:10000;"), |
| Err(Error::Invalid(InvalidReason::InvalidPortRange)) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_v4_address_port() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp from 1.2.3.4/24 port 10000;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: Some(Box::new(fidl_subnet!("1.2.3.4/24"))), |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 10000, end: 10000 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_not_v4_address_port() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp from !1.2.3.4/24 port 10000;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: Some(Box::new(fidl_subnet!("1.2.3.4/24"))), |
| src_subnet_invert_match: true, |
| src_port_range: filter::PortRange { start: 10000, end: 10000 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_v6_address_port() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp from 1234:5678::/32 port 10000;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: Some(Box::new(fidl_subnet!("1234:5678::/32"))), |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 10000, end: 10000 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_to_v6_address_port() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp to 1234:5678::/32 port 10000;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: Some(Box::new(fidl_subnet!("1234:5678::/32"))), |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 10000, end: 10000 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_v6_address_port_to_v4_address_port() { |
| assert_eq!( |
| parse_str_to_rules( |
| "pass in proto tcp from 1234:5678::/32 port 10000 to 1.2.3.4/8 port 1000;" |
| ), |
| Err(Error::Invalid(InvalidReason::MixedIPVersions)) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_from_v6_address_port_to_v6_address_port() { |
| assert_eq!( |
| parse_str_to_rules( |
| "pass in proto tcp from 1234:5678::/32 port 10000 to 2345:6789::/32 port 1000;" |
| ), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: Some(Box::new(fidl_subnet!("1234:5678::/32"))), |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 10000, end: 10000 }, |
| dst_subnet: Some(Box::new(fidl_subnet!("2345:6789::/32"))), |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 1000, end: 1000 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_log_no_state() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp log no state;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: true, |
| keep_state: false, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_keep_state() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp keep state;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: true, |
| device_class: filter::DeviceClass::Any(filter::Empty {}), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_device_class() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp devclass ap;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 0, end: 0 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Match_(fhnet::DeviceClass::WlanAp), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rule_with_device_class_and_dst_range() { |
| assert_eq!( |
| parse_str_to_rules("pass in proto tcp devclass ap to range 1:2;"), |
| Ok(vec![filter::Rule { |
| action: filter::Action::Pass, |
| direction: filter::Direction::Incoming, |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: None, |
| src_subnet_invert_match: false, |
| src_port_range: filter::PortRange { start: 0, end: 0 }, |
| dst_subnet: None, |
| dst_subnet_invert_match: false, |
| dst_port_range: filter::PortRange { start: 1, end: 2 }, |
| nic: 0, |
| log: false, |
| keep_state: false, |
| device_class: filter::DeviceClass::Match_(fhnet::DeviceClass::WlanAp), |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_nat_rule_from_v4_subnet() { |
| assert_eq!( |
| parse_str_to_nat_rules("nat from 1.2.3.0/24 -> from 192.168.1.1;"), |
| Ok(vec![filter::Nat { |
| proto: filter::SocketProtocol::Any, |
| src_subnet: fidl_subnet!("1.2.3.0/24"), |
| outgoing_nic: 0, |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_nat_rule_with_proto_tcp_from_v4_subnet() { |
| assert_eq!( |
| parse_str_to_nat_rules("nat proto tcp from 1.2.3.0/24 -> from 192.168.1.1;"), |
| Ok(vec![filter::Nat { |
| proto: filter::SocketProtocol::Tcp, |
| src_subnet: fidl_subnet!("1.2.3.0/24"), |
| outgoing_nic: 0, |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rdr_rule_with_to_v4_address_port_to_v4_address_port() { |
| assert_eq!( |
| parse_str_to_rdr_rules("rdr to 1.2.3.4 port 10000 -> to 192.168.1.1 port 20000;"), |
| Ok(vec![filter::Rdr { |
| proto: filter::SocketProtocol::Any, |
| dst_addr: fidl_ip!("1.2.3.4"), |
| dst_port_range: filter::PortRange { start: 10000, end: 10000 }, |
| new_dst_addr: fidl_ip!("192.168.1.1"), |
| new_dst_port_range: filter::PortRange { start: 20000, end: 20000 }, |
| nic: 0, |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rdr_rule_with_proto_tcp_to_v4_address_port_to_v4_address_port() { |
| assert_eq!( |
| parse_str_to_rdr_rules( |
| "rdr proto tcp to 1.2.3.4 port 10000 -> to 192.168.1.1 port 20000;" |
| ), |
| Ok(vec![filter::Rdr { |
| proto: filter::SocketProtocol::Tcp, |
| dst_addr: fidl_ip!("1.2.3.4"), |
| dst_port_range: filter::PortRange { start: 10000, end: 10000 }, |
| new_dst_addr: fidl_ip!("192.168.1.1"), |
| new_dst_port_range: filter::PortRange { start: 20000, end: 20000 }, |
| nic: 0, |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rdr_rule_with_to_v4_address_range_to_v4_address_range() { |
| assert_eq!( |
| parse_str_to_rdr_rules( |
| "rdr proto tcp to 1.2.3.4 range 10000:10005 -> to 192.168.1.1 range 20000:20005;" |
| ), |
| Ok(vec![filter::Rdr { |
| proto: filter::SocketProtocol::Tcp, |
| dst_addr: fidl_ip!("1.2.3.4"), |
| dst_port_range: filter::PortRange { start: 10000, end: 10005 }, |
| new_dst_addr: fidl_ip!("192.168.1.1"), |
| new_dst_port_range: filter::PortRange { start: 20000, end: 20005 }, |
| nic: 0, |
| }]) |
| ); |
| } |
| |
| #[test] |
| fn test_rdr_rule_with_to_v4_address_range_to_v4_address_invalid_range() { |
| assert_eq!( |
| parse_str_to_rdr_rules( |
| "rdr proto tcp to 1.2.3.4 range 10000:10005 -> to 192.168.1.1 range 0:5;" |
| ), |
| Err(Error::Invalid(InvalidReason::InvalidPortRange)) |
| ); |
| } |
| |
| #[test] |
| fn test_rdr_rule_with_to_v4_address_range_to_v4_address_port_range_length_mismatch() { |
| assert_eq!( |
| parse_str_to_rdr_rules( |
| "rdr proto tcp to 1.2.3.4 range 10000:10005 -> to 192.168.1.1 range 20000:20003;" |
| ), |
| Err(Error::Invalid(InvalidReason::PortRangeLengthMismatch)) |
| ); |
| } |
| |
| #[test] |
| fn test_rdr_rule_with_to_v4_address_range_to_v6_address_range() { |
| assert_eq!( |
| parse_str_to_rdr_rules( |
| "rdr proto tcp to 1.2.3.4 range 10000:10005 -> to 1234:5678:: range 20000:20005;" |
| ), |
| Err(Error::Invalid(InvalidReason::MixedIPVersions)) |
| ); |
| } |
| |
| #[test] |
| fn test_rdr_rule_with_to_v6_address_range_to_v6_address_range() { |
| assert_eq!( |
| parse_str_to_rdr_rules( |
| "rdr proto tcp to 1234:5678:: range 10000:10005 -> to 2345:6789:: range 20000:20005;" |
| ), |
| Ok(vec![filter::Rdr { |
| proto: filter::SocketProtocol::Tcp, |
| dst_addr: fidl_ip!("1234:5678::"), |
| dst_port_range: filter::PortRange { |
| start: 10000, |
| end: 10005, |
| }, |
| new_dst_addr: fidl_ip!("2345:6789::"), |
| new_dst_port_range: filter::PortRange { |
| start: 20000, |
| end: 20005, |
| }, |
| nic: 0, |
| }]) |
| ); |
| } |
| } |
