Index: sys/net/route/nhop_ctl.c =================================================================== --- sys/net/route/nhop_ctl.c +++ sys/net/route/nhop_ctl.c @@ -105,6 +105,9 @@ 2 * CACHE_LINE_SIZE) #define NHOP_PRIV_ALIGNED_SIZE roundup2(sizeof(struct nhop_priv), \ 2 * CACHE_LINE_SIZE) + +#define MULTI_BIT_SET(x) (x && (x & (x - 1))) /* Inverse of IS_POW2() */ + void nhops_init(void) { @@ -288,6 +291,7 @@ struct nhop_object **nh_ret) { struct nhop_priv *nh_priv; + int flags; int error; NET_EPOCH_ASSERT(); @@ -301,8 +305,14 @@ } error = get_nhop(rnh, info, &nh_priv); - if (error == 0) + if (error == 0) { + /* allow only one of BLACKHOLE,REJECT,GATEWAY */ + flags = nh_priv->rt_flags & (RTF_BLACKHOLE | RTF_REJECT | RTF_GATEWAY); + if (MULTI_BIT_SET(flags)) + return (EINVAL); + *nh_ret = nh_priv->nh; + } return (error); } @@ -376,12 +386,16 @@ alter_nhop_from_info(struct nhop_object *nh, struct rt_addrinfo *info) { struct sockaddr *info_gw; + int flags; int error; /* Update MTU if set in the request*/ set_nhop_mtu_from_info(nh, info); - /* XXX: allow only one of BLACKHOLE,REJECT,GATEWAY */ + /* allow only one of BLACKHOLE,REJECT,GATEWAY */ + flags = nh->nh_priv->rt_flags & (RTF_BLACKHOLE | RTF_REJECT | RTF_GATEWAY); + if (MULTI_BIT_SET(flags)) + return (EINVAL); /* Allow some flags (FLAG1,STATIC,BLACKHOLE,REJECT) to be toggled on change. */ nh->nh_priv->rt_flags &= ~RTF_FMASK; Index: tests/sys/net/routing/Makefile =================================================================== --- tests/sys/net/routing/Makefile +++ tests/sys/net/routing/Makefile @@ -6,6 +6,7 @@ ATF_TESTS_C += test_rtsock_l3 ATF_TESTS_C += test_rtsock_lladdr +ATF_TESTS_SH+= test_route_modifier ${PACKAGE}FILES+= generic_cleanup.sh ${PACKAGE}FILESMODE_generic_cleanup.sh=0555 Index: tests/sys/net/routing/test_route_modifier.sh =================================================================== --- tests/sys/net/routing/test_route_modifier.sh +++ tests/sys/net/routing/test_route_modifier.sh @@ -0,0 +1,150 @@ +# $FreeBSD$ +# +# SPDX-License-Identifier: BSD-2-Clause-FreeBSD +# +# Copyright (c) 2020 Neel Chauhan +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +. $(atf_get_srcdir)/../../common/vnet.subr + +atf_test_case "add_route_modifier" "cleanup" +add_route_modifier_head() +{ + atf_set descr 'add route with modifier test' + atf_set require.user root +} + +add_route_modifier_body() +{ + vnet_init + + epair=$(vnet_mkepair) + + vnet_mkjail colleen ${epair}b + + ifconfig ${epair}a up + ifconfig ${epair}a inet 192.0.2.1/24 + + jexec colleen ifconfig ${epair}b inet 192.0.2.2/24 up + + atf_check -s exit:1 -o ignore -e ignore jexec colleen route add 198.51.100.0/24 192.0.2.1 -reject -blackhole +} + +add_route_modifier_cleanup() +{ + vnet_cleanup +} + +atf_test_case "change_route_modifier" "cleanup" +change_route_modifier_head() +{ + atf_set descr 'change route with modifier test' + atf_set require.user root +} + +change_route_modifier_body() +{ + vnet_init + + epair=$(vnet_mkepair) + + vnet_mkjail dana ${epair}b + + ifconfig ${epair}a up + ifconfig ${epair}a inet 192.0.2.1/24 + + jexec dana ifconfig ${epair}b inet 192.0.2.2/24 up + + jexec dana route add 198.51.100.0/24 192.0.2.1 -reject + atf_check -s exit:1 -o ignore -e ignore jexec dana route change 198.51.100.0/24 192.0.2.1 -blackhole +} + +change_route_modifier_cleanup() +{ + vnet_cleanup +} + +atf_test_case "add_route_modifier_v6" "cleanup" +add_route_modifier_v6_head() +{ + atf_set descr 'add IPv6 route with modifier test' + atf_set require.user root +} + +add_route_modifier_v6_body() +{ + vnet_init + + epair=$(vnet_mkepair) + + vnet_mkjail tove ${epair}b + + ifconfig ${epair}a up + ifconfig ${epair}a inet6 2001:db8:6666::1/64 + + jexec tove ifconfig ${epair}b inet6 2001:db8:6666::2/64 up + + atf_check -s exit:1 -o ignore -e ignore jexec tove route add -6 2001:db8:6667::/64 2001:db8:6666::1 -reject -blackhole +} + +add_route_modifier_v6_cleanup() +{ + vnet_cleanup +} + +atf_test_case "change_route_modifier_v6" "cleanup" +change_route_modifier_v6_head() +{ + atf_set descr 'change IPv6 route with modifier test' + atf_set require.user root +} + +change_route_modifier_v6_body() +{ + vnet_init + + epair=$(vnet_mkepair) + + vnet_mkjail astrid ${epair}b + + ifconfig ${epair}a up + ifconfig ${epair}a inet6 2001:db8:6666::1/64 + + jexec astrid ifconfig ${epair}b inet6 2001:db8:6666::2/64 up + + jexec astrid route add -6 2001:db8:6667::/64 2001:db8:6666::1 -reject + atf_check -s exit:1 -o ignore -e ignore jexec astrid route change -6 2001:db8:6667::/64 2001:db8:6666::1 -blackhole +} + +change_route_modifier_v6_cleanup() +{ + vnet_cleanup +} + +atf_init_test_cases() +{ + atf_add_test_case "add_route_modifier" + atf_add_test_case "change_route_modifier" + atf_add_test_case "add_route_modifier_v6" + atf_add_test_case "change_route_modifier_v6" +}