[svn-commits] mmichelson: branch mmichelson/acl-v6 r276265 - in /team/mmichelson/acl-v6: ma...
SVN commits to the Digium repositories
svn-commits at lists.digium.com
Tue Jul 13 19:19:31 CDT 2010
Author: mmichelson
Date: Tue Jul 13 19:19:20 2010
New Revision: 276265
URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=276265
Log:
Add new ACL tests to test_acl.
The tests aren't currently passing, and it appears to be due to a flaw
in the netmask parsing code. Valgrind indicates I'm making use of an
uninitialized value, but it's not clear what the value is. --track-origins
provided no help at all on the matter.
More debugging will have to wait until tomorrow.
Modified:
team/mmichelson/acl-v6/main/acl.c
team/mmichelson/acl-v6/tests/test_acl.c
Modified: team/mmichelson/acl-v6/main/acl.c
URL: http://svnview.digium.com/svn/asterisk/team/mmichelson/acl-v6/main/acl.c?view=diff&rev=276265&r1=276264&r2=276265
==============================================================================
--- team/mmichelson/acl-v6/main/acl.c (original)
+++ team/mmichelson/acl-v6/main/acl.c Tue Jul 13 19:19:20 2010
@@ -348,6 +348,10 @@
make_v4_mapped(addr, addr);
}
+ ast_log(LOG_NOTICE, "Going to apply mask %s to address %s\n",
+ ast_sockaddr_stringify_addr(netmask),
+ ast_sockaddr_stringify_addr(addr));
+
addr6 = (struct sockaddr_in6 *) &addr->ss;
result6.sin6_family = AF_INET6;
@@ -395,9 +399,13 @@
sin6.sin6_family = AF_INET6;
for (i = 0; i < 4; ++i) {
if (mask >= 32) {
+ ast_log(LOG_NOTICE, "mask is larger than 32, so I set word %d to %x (%x in network order)\n",
+ i, 0xFFFFFFFF, htonl(0xFFFFFFFF));
V6_WORD(&sin6, i) = htonl(0xFFFFFFFF);
mask -= 32;
} else if (mask > 0) {
+ ast_log(LOG_NOTICE, "mask is %d, so I set word %d to %x (%x in network order)\n",
+ mask, i, 0xFFFFFFFF << (32 - mask), htonl(0xFFFFFFFF << (32 - mask)));
V6_WORD(&sin6, i) = htonl(0xFFFFFFFF << (32 - mask));
/* Set mask to 0 so the remaining parts of the address
* Get filled in properly with zeros
@@ -407,11 +415,14 @@
/* Mask is 0. Special case to deal with unpredictable
* behavior when trying to shift more than 31 bits
*/
- V6_WORD(&sin6, i) = htonl(0);
+ ast_log(LOG_NOTICE, "mask is 0, so I set word %d to %x (%x in network order)\n",
+ i, 0, htonl(0));
+ V6_WORD(&sin6, i) = htonl(0x00000000);
}
}
memcpy(&addr->ss, &sin6, sizeof(sin6));
addr->len = sizeof(sin6);
+ ast_log(LOG_NOTICE, "Got mask %s for CIDR mask %s\n", ast_sockaddr_stringify_addr(addr), mask_str);
return 0;
}
Modified: team/mmichelson/acl-v6/tests/test_acl.c
URL: http://svnview.digium.com/svn/asterisk/team/mmichelson/acl-v6/tests/test_acl.c?view=diff&rev=276265&r1=276264&r2=276265
==============================================================================
--- team/mmichelson/acl-v6/tests/test_acl.c (original)
+++ team/mmichelson/acl-v6/tests/test_acl.c Tue Jul 13 19:19:20 2010
@@ -132,17 +132,35 @@
{ "10.0.0.0/24", "permit" },
};
+ struct acl acl3[] = {
+ { "::/0", "deny" },
+ { "fe80::/64", "permit" },
+ };
+
+ struct acl acl4[] = {
+ { "::/0", "deny" },
+ { "fe80::/64", "permit" },
+ { "fe80::ffff:0:0:0/80", "deny" },
+ { "fe80::ffff:0:ffff:0/112", "permit" },
+ };
+
struct {
const char *test_address;
int acl1_result;
int acl2_result;
+ int acl3_result;
+ int acl4_result;
} acl_tests[] = {
- { "10.1.1.5", AST_SENSE_ALLOW, AST_SENSE_ALLOW },
- { "192.168.0.5", AST_SENSE_ALLOW, AST_SENSE_ALLOW },
- { "192.168.1.5", AST_SENSE_DENY, AST_SENSE_ALLOW },
- { "10.0.0.1", AST_SENSE_ALLOW, AST_SENSE_ALLOW },
- { "10.0.10.10", AST_SENSE_ALLOW, AST_SENSE_DENY },
- { "172.16.0.1", AST_SENSE_DENY, AST_SENSE_ALLOW },
+ { "10.1.1.5", AST_SENSE_ALLOW, AST_SENSE_ALLOW, AST_SENSE_DENY, AST_SENSE_DENY },
+ { "192.168.0.5", AST_SENSE_ALLOW, AST_SENSE_ALLOW, AST_SENSE_DENY, AST_SENSE_DENY },
+ { "192.168.1.5", AST_SENSE_DENY, AST_SENSE_ALLOW, AST_SENSE_DENY, AST_SENSE_DENY },
+ { "10.0.0.1", AST_SENSE_ALLOW, AST_SENSE_ALLOW, AST_SENSE_DENY, AST_SENSE_DENY },
+ { "10.0.10.10", AST_SENSE_ALLOW, AST_SENSE_DENY, AST_SENSE_DENY, AST_SENSE_DENY },
+ { "172.16.0.1", AST_SENSE_DENY, AST_SENSE_ALLOW, AST_SENSE_DENY, AST_SENSE_DENY },
+ { "fe80::1234", AST_SENSE_DENY, AST_SENSE_DENY, AST_SENSE_ALLOW, AST_SENSE_DENY },
+ { "fe80:1234::1234", AST_SENSE_DENY, AST_SENSE_DENY, AST_SENSE_DENY, AST_SENSE_DENY, },
+ { "fe80::ffff:1213:dead:beef", AST_SENSE_DENY, AST_SENSE_DENY, AST_SENSE_ALLOW, AST_SENSE_DENY },
+ { "fe80::ffff:0:ffff:ABCD", AST_SENSE_DENY, AST_SENSE_DENY, AST_SENSE_ALLOW, AST_SENSE_ALLOW },
};
struct ast_ha *permit_hav4 = NULL;
@@ -151,6 +169,8 @@
struct ast_ha *deny_hav6 = NULL;
struct ast_ha *ha1 = NULL;
struct ast_ha *ha2 = NULL;
+ struct ast_ha *ha3 = NULL;
+ struct ast_ha *ha4 = NULL;
enum ast_test_result_state res = AST_TEST_PASS;
int err = 0;
int i;
@@ -209,6 +229,24 @@
}
}
+ for (i = 0; i < ARRAY_LEN(acl3); ++i) {
+ if (!(ha3 = ast_append_ha(acl3[i].access, acl3[i].host, ha3, &err))) {
+ ast_test_status_update(test, "Failed to add rule %s with access %s to ha3\n",
+ acl3[i].host, acl3[i].access);
+ res = AST_TEST_FAIL;
+ goto acl_cleanup;
+ }
+ }
+
+ for (i = 0; i < ARRAY_LEN(acl4); ++i) {
+ if (!(ha4 = ast_append_ha(acl4[i].access, acl4[i].host, ha4, &err))) {
+ ast_test_status_update(test, "Failed to add rule %s with access %s to ha4\n",
+ acl4[i].host, acl4[i].access);
+ res = AST_TEST_FAIL;
+ goto acl_cleanup;
+ }
+ }
+
for (i = 0; i < ARRAY_LEN(acl_tests); ++i) {
struct ast_sockaddr addr;
int permit_resv4;
@@ -217,6 +255,8 @@
int deny_resv6;
int acl1_res;
int acl2_res;
+ int acl3_res;
+ int acl4_res;
ast_sockaddr_parse(&addr, acl_tests[i].test_address, PARSE_PORT_FORBID);
@@ -226,6 +266,8 @@
deny_resv6 = ast_apply_ha(deny_hav6, &addr);
acl1_res = ast_apply_ha(ha1, &addr);
acl2_res = ast_apply_ha(ha2, &addr);
+ acl3_res = ast_apply_ha(ha3, &addr);
+ acl4_res = ast_apply_ha(ha4, &addr);
if (permit_resv4 != AST_SENSE_ALLOW) {
ast_test_status_update(test, "Access denied to %s on permit_all ACL\n",
@@ -256,15 +298,29 @@
}
if (acl1_res != acl_tests[i].acl1_result) {
- ast_test_status_update(test, "Access not as expected to %s on acl1. Expected %d but"
+ ast_test_status_update(test, "Access not as expected to %s on acl1. Expected %d but "
"got %d instead\n", acl_tests[i].test_address, acl_tests[i].acl1_result, acl1_res);
res = AST_TEST_FAIL;
goto acl_cleanup;
}
if (acl2_res != acl_tests[i].acl2_result) {
- ast_test_status_update(test, "Access not as expected to %s on acl2. Expected %d but"
+ ast_test_status_update(test, "Access not as expected to %s on acl2. Expected %d but "
"got %d instead\n", acl_tests[i].test_address, acl_tests[i].acl2_result, acl2_res);
+ res = AST_TEST_FAIL;
+ goto acl_cleanup;
+ }
+
+ if (acl3_res != acl_tests[i].acl3_result) {
+ ast_test_status_update(test, "Access not as expected to %s on acl3. Expected %d but "
+ "got %d instead\n", acl_tests[i].test_address, acl_tests[i].acl3_result, acl3_res);
+ res = AST_TEST_FAIL;
+ goto acl_cleanup;
+ }
+
+ if (acl4_res != acl_tests[i].acl4_result) {
+ ast_test_status_update(test, "Access not as expected to %s on acl4. Expected %d but "
+ "got %d instead\n", acl_tests[i].test_address, acl_tests[i].acl4_result, acl4_res);
res = AST_TEST_FAIL;
goto acl_cleanup;
}
@@ -286,8 +342,14 @@
if (ha1) {
ast_free_ha(ha1);
}
- if (ha1) {
+ if (ha2) {
ast_free_ha(ha2);
+ }
+ if (ha3) {
+ ast_free_ha(ha3);
+ }
+ if (ha4) {
+ ast_free_ha(ha4);
}
return res;
}
More information about the svn-commits
mailing list