package net.floodlightcontroller.firewall; import static org.easymock.EasyMock.expect; import static org.easymock.EasyMock.replay; import static org.easymock.EasyMock.verify; import java.util.HashMap; import java.util.List; import java.util.Map; import net.floodlightcontroller.core.FloodlightContext; import net.floodlightcontroller.core.IFloodlightProviderService; import net.floodlightcontroller.core.IOFSwitch; import net.floodlightcontroller.core.module.FloodlightModuleContext; import net.floodlightcontroller.core.module.FloodlightModuleException; import net.floodlightcontroller.core.test.MockFloodlightProvider; import net.floodlightcontroller.packet.ARP; import net.floodlightcontroller.packet.Data; import net.floodlightcontroller.packet.Ethernet; import net.floodlightcontroller.packet.IPacket; import net.floodlightcontroller.packet.IPv4; import net.floodlightcontroller.packet.TCP; import net.floodlightcontroller.packet.UDP; import net.floodlightcontroller.restserver.IRestApiService; import net.floodlightcontroller.restserver.RestApiServer; import net.floodlightcontroller.routing.IRoutingDecision; import net.floodlightcontroller.storage.IStorageSourceService; import net.floodlightcontroller.storage.memory.MemoryStorageSource; import net.floodlightcontroller.test.FloodlightTestCase; import net.floodlightcontroller.util.MACAddress; import org.easymock.EasyMock; import org.junit.Before; import org.junit.Test; import org.openflow.protocol.OFPacketIn; import org.openflow.protocol.OFPacketIn.OFPacketInReason; import org.openflow.protocol.OFType; import org.openflow.util.HexString; /** * Unit test for stateless firewall implemented as a Google Summer of Code project. * * @author Amer Tahir */ public class FirewallTest extends FloodlightTestCase { protected MockFloodlightProvider mockFloodlightProvider; protected FloodlightContext cntx; protected OFPacketIn packetIn; protected IOFSwitch sw; protected IPacket tcpPacket; protected IPacket broadcastARPPacket; protected IPacket ARPReplyPacket; protected IPacket broadcastIPPacket; protected IPacket tcpPacketReply; protected IPacket broadcastMalformedPacket; private Firewall firewall; public static String TestSwitch1DPID = "00:00:00:00:00:00:00:01"; @Before public void setUp() throws Exception { super.setUp(); cntx = new FloodlightContext(); mockFloodlightProvider = getMockFloodlightProvider(); firewall = new Firewall(); IStorageSourceService storageService = new MemoryStorageSource(); RestApiServer restApi = new RestApiServer(); // Mock switches long dpid = HexString.toLong(TestSwitch1DPID); sw = EasyMock.createNiceMock(IOFSwitch.class); expect(sw.getId()).andReturn(dpid).anyTimes(); expect(sw.getStringId()).andReturn(TestSwitch1DPID).anyTimes(); replay(sw); // Load the switch map Map<Long, IOFSwitch> switches = new HashMap<Long, IOFSwitch>(); switches.put(dpid, sw); mockFloodlightProvider.setSwitches(switches); FloodlightModuleContext fmc = new FloodlightModuleContext(); fmc.addService(IFloodlightProviderService.class, mockFloodlightProvider); fmc.addService(IFirewallService.class, firewall); fmc.addService(IStorageSourceService.class, storageService); fmc.addService(IRestApiService.class, restApi); try { restApi.init(fmc); } catch (FloodlightModuleException e) { e.printStackTrace(); } firewall.init(fmc); firewall.startUp(fmc); // Build our test packet this.tcpPacket = new Ethernet() .setDestinationMACAddress("00:11:22:33:44:55") .setSourceMACAddress("00:44:33:22:11:00") .setVlanID((short) 42) .setEtherType(Ethernet.TYPE_IPv4) .setPayload( new IPv4() .setTtl((byte) 128) .setSourceAddress("192.168.1.1") .setDestinationAddress("192.168.1.2") .setPayload(new TCP() .setSourcePort((short) 81) .setDestinationPort((short) 80) .setPayload(new Data(new byte[] {0x01})))); // Build a broadcast ARP packet this.broadcastARPPacket = new Ethernet() .setDestinationMACAddress("FF:FF:FF:FF:FF:FF") .setSourceMACAddress("00:44:33:22:11:00") .setVlanID((short) 42) .setEtherType(Ethernet.TYPE_ARP) .setPayload( new ARP() .setHardwareType(ARP.HW_TYPE_ETHERNET) .setProtocolType(ARP.PROTO_TYPE_IP) .setOpCode(ARP.OP_REQUEST) .setHardwareAddressLength((byte)6) .setProtocolAddressLength((byte)4) .setSenderHardwareAddress(Ethernet.toMACAddress("00:44:33:22:11:00")) .setSenderProtocolAddress(IPv4.toIPv4Address("192.168.1.1")) .setTargetHardwareAddress(Ethernet.toMACAddress("00:00:00:00:00:00")) .setTargetProtocolAddress(IPv4.toIPv4Address("192.168.1.2")) .setPayload(new Data(new byte[] {0x01}))); // Build a ARP packet this.ARPReplyPacket = new Ethernet() .setDestinationMACAddress("00:44:33:22:11:00") .setSourceMACAddress("00:11:22:33:44:55") .setVlanID((short) 42) .setEtherType(Ethernet.TYPE_ARP) .setPayload( new ARP() .setHardwareType(ARP.HW_TYPE_ETHERNET) .setProtocolType(ARP.PROTO_TYPE_IP) .setOpCode(ARP.OP_REQUEST) .setHardwareAddressLength((byte)6) .setProtocolAddressLength((byte)4) .setSenderHardwareAddress(Ethernet.toMACAddress("00:11:22:33:44:55")) .setSenderProtocolAddress(IPv4.toIPv4Address("192.168.1.2")) .setTargetHardwareAddress(Ethernet.toMACAddress("00:44:33:22:11:00")) .setTargetProtocolAddress(IPv4.toIPv4Address("192.168.1.1")) .setPayload(new Data(new byte[] {0x01}))); // Build a broadcast IP packet this.broadcastIPPacket = new Ethernet() .setDestinationMACAddress("FF:FF:FF:FF:FF:FF") .setSourceMACAddress("00:44:33:22:11:00") .setVlanID((short) 42) .setEtherType(Ethernet.TYPE_IPv4) .setPayload( new IPv4() .setTtl((byte) 128) .setSourceAddress("192.168.1.1") .setDestinationAddress("192.168.1.255") .setPayload(new UDP() .setSourcePort((short) 5000) .setDestinationPort((short) 5001) .setPayload(new Data(new byte[] {0x01})))); // Build a malformed broadcast packet this.broadcastMalformedPacket = new Ethernet() .setDestinationMACAddress("FF:FF:FF:FF:FF:FF") .setSourceMACAddress("00:44:33:22:11:00") .setVlanID((short) 42) .setEtherType(Ethernet.TYPE_IPv4) .setPayload( new IPv4() .setTtl((byte) 128) .setSourceAddress("192.168.1.1") .setDestinationAddress("192.168.1.2") .setPayload(new UDP() .setSourcePort((short) 5000) .setDestinationPort((short) 5001) .setPayload(new Data(new byte[] {0x01})))); this.tcpPacketReply = new Ethernet() .setDestinationMACAddress("00:44:33:22:11:00") .setSourceMACAddress("00:11:22:33:44:55") .setVlanID((short) 42) .setEtherType(Ethernet.TYPE_IPv4) .setPayload( new IPv4() .setTtl((byte) 128) .setSourceAddress("192.168.1.2") .setDestinationAddress("192.168.1.1") .setPayload(new TCP() .setSourcePort((short) 80) .setDestinationPort((short) 81) .setPayload(new Data(new byte[] {0x02})))); } protected void setPacketIn(IPacket packet) { byte[] serializedPacket = packet.serialize(); // Build the PacketIn this.packetIn = ((OFPacketIn) mockFloodlightProvider.getOFMessageFactory().getMessage(OFType.PACKET_IN)) .setBufferId(-1) .setInPort((short) 1) .setPacketData(serializedPacket) .setReason(OFPacketInReason.NO_MATCH) .setTotalLength((short) serializedPacket.length); // Add the packet to the context store IFloodlightProviderService.bcStore. put(cntx, IFloodlightProviderService.CONTEXT_PI_PAYLOAD, (Ethernet)packet); } @Test public void testNoRules() throws Exception { // enable firewall first firewall.enableFirewall(true); // simulate a packet-in event this.setPacketIn(tcpPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); assertEquals(0, firewall.rules.size()); IRoutingDecision decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); // no rules to match, so firewall should deny assertEquals(decision.getRoutingAction(), IRoutingDecision.RoutingAction.DROP); } @Test public void testReadRulesFromStorage() throws Exception { // add 2 rules first FirewallRule rule = new FirewallRule(); rule.in_port = 2; rule.dl_src = MACAddress.valueOf("00:00:00:00:00:01").toLong(); rule.dl_dst = MACAddress.valueOf("00:00:00:00:00:02").toLong(); rule.priority = 1; rule.action = FirewallRule.FirewallAction.DENY; firewall.addRule(rule); rule = new FirewallRule(); rule.in_port = 3; rule.dl_src = MACAddress.valueOf("00:00:00:00:00:02").toLong(); rule.dl_dst = MACAddress.valueOf("00:00:00:00:00:01").toLong(); rule.nw_proto = IPv4.PROTOCOL_TCP; rule.wildcard_nw_proto = false; rule.tp_dst = 80; rule.priority = 2; rule.action = FirewallRule.FirewallAction.ALLOW; firewall.addRule(rule); List<FirewallRule> rules = firewall.readRulesFromStorage(); // verify rule 1 FirewallRule r = rules.get(0); assertEquals(r.in_port, 2); assertEquals(r.priority, 1); assertEquals(r.dl_src, MACAddress.valueOf("00:00:00:00:00:01").toLong()); assertEquals(r.dl_dst, MACAddress.valueOf("00:00:00:00:00:02").toLong()); assertEquals(r.action, FirewallRule.FirewallAction.DENY); // verify rule 2 r = rules.get(1); assertEquals(r.in_port, 3); assertEquals(r.priority, 2); assertEquals(r.dl_src, MACAddress.valueOf("00:00:00:00:00:02").toLong()); assertEquals(r.dl_dst, MACAddress.valueOf("00:00:00:00:00:01").toLong()); assertEquals(r.nw_proto, IPv4.PROTOCOL_TCP); assertEquals(r.tp_dst, 80); assertEquals(r.wildcard_nw_proto, false); assertEquals(r.action, FirewallRule.FirewallAction.ALLOW); } @Test public void testRuleInsertionIntoStorage() throws Exception { // add TCP rule FirewallRule rule = new FirewallRule(); rule.nw_proto = IPv4.PROTOCOL_TCP; rule.wildcard_nw_proto = false; rule.priority = 1; firewall.addRule(rule); List<Map<String, Object>> rulesFromStorage = firewall.getStorageRules(); assertEquals(1, rulesFromStorage.size()); assertEquals(Integer.parseInt((String)rulesFromStorage.get(0).get("ruleid")), rule.ruleid); } @Test public void testRuleDeletion() throws Exception { // add TCP rule FirewallRule rule = new FirewallRule(); rule.nw_proto = IPv4.PROTOCOL_TCP; rule.wildcard_nw_proto = false; rule.priority = 1; firewall.addRule(rule); int rid = rule.ruleid; List<Map<String, Object>> rulesFromStorage = firewall.getStorageRules(); assertEquals(1, rulesFromStorage.size()); assertEquals(Integer.parseInt((String)rulesFromStorage.get(0).get("ruleid")), rid); // delete rule firewall.deleteRule(rid); rulesFromStorage = firewall.getStorageRules(); assertEquals(0, rulesFromStorage.size()); } @Test public void testFirewallDisabled() throws Exception { // firewall isn't enabled by default // so, it shouldn't make any decision // add TCP rule FirewallRule rule = new FirewallRule(); rule.nw_proto = IPv4.PROTOCOL_TCP; rule.wildcard_nw_proto = false; rule.priority = 1; firewall.addRule(rule); this.setPacketIn(tcpPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); assertEquals(1, firewall.rules.size()); IRoutingDecision decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertNull(decision); } @Test public void testSimpleAllowRule() throws Exception { // enable firewall first firewall.enableFirewall(true); // add TCP rule FirewallRule rule = new FirewallRule(); rule.dl_type = Ethernet.TYPE_IPv4; rule.wildcard_dl_type = false; rule.nw_proto = IPv4.PROTOCOL_TCP; rule.wildcard_nw_proto = false; // source is IP 192.168.1.2 rule.nw_src_prefix = IPv4.toIPv4Address("192.168.1.2"); rule.wildcard_nw_src = false; // dest is network 192.168.1.0/24 rule.nw_dst_prefix = IPv4.toIPv4Address("192.168.1.0"); rule.nw_dst_maskbits = 24; rule.wildcard_nw_dst = false; rule.priority = 1; firewall.addRule(rule); // simulate a packet-in events this.setPacketIn(tcpPacketReply); firewall.receive(sw, this.packetIn, cntx); verify(sw); IRoutingDecision decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(decision.getRoutingAction(), IRoutingDecision.RoutingAction.FORWARD_OR_FLOOD); // clear decision IRoutingDecision.rtStore.remove(cntx, IRoutingDecision.CONTEXT_DECISION); this.setPacketIn(tcpPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(decision.getRoutingAction(), IRoutingDecision.RoutingAction.DROP); } @Test public void testOverlappingRules() throws Exception { firewall.enableFirewall(true); // add TCP port 80 (destination only) allow rule FirewallRule rule = new FirewallRule(); rule.dl_type = Ethernet.TYPE_IPv4; rule.wildcard_dl_type = false; rule.nw_proto = IPv4.PROTOCOL_TCP; rule.wildcard_nw_proto = false; rule.tp_dst = 80; rule.priority = 1; firewall.addRule(rule); // add block all rule rule = new FirewallRule(); rule.action = FirewallRule.FirewallAction.DENY; rule.priority = 2; firewall.addRule(rule); assertEquals(2, firewall.rules.size()); // packet destined to TCP port 80 - should be allowed this.setPacketIn(tcpPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); IRoutingDecision decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(decision.getRoutingAction(), IRoutingDecision.RoutingAction.FORWARD_OR_FLOOD); // clear decision IRoutingDecision.rtStore.remove(cntx, IRoutingDecision.CONTEXT_DECISION); // packet destined for port 81 - should be denied this.setPacketIn(tcpPacketReply); firewall.receive(sw, this.packetIn, cntx); verify(sw); decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(decision.getRoutingAction(), IRoutingDecision.RoutingAction.DROP); } @Test public void testARP() throws Exception { // enable firewall first firewall.enableFirewall(true); // no rules inserted so all traffic other than broadcast and ARP-request-broadcast should be blocked // simulate an ARP broadcast packet-in event this.setPacketIn(broadcastARPPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); // broadcast-ARP traffic should be allowed IRoutingDecision decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(IRoutingDecision.RoutingAction.MULTICAST, decision.getRoutingAction()); // clear decision IRoutingDecision.rtStore.remove(cntx, IRoutingDecision.CONTEXT_DECISION); // simulate an ARP reply packet-in event this.setPacketIn(ARPReplyPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); // ARP reply traffic should be denied decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(decision.getRoutingAction(), IRoutingDecision.RoutingAction.DROP); } @Test public void testIPBroadcast() throws Exception { // enable firewall first firewall.enableFirewall(true); // set subnet mask for IP broadcast firewall.setSubnetMask("255.255.255.0"); // no rules inserted so all traffic other than broadcast and ARP-request-broadcast should be blocked // simulate a packet-in event this.setPacketIn(broadcastIPPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); // broadcast traffic should be allowed IRoutingDecision decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(IRoutingDecision.RoutingAction.MULTICAST, decision.getRoutingAction()); } @Test public void testMalformedIPBroadcast() throws Exception { // enable firewall first firewall.enableFirewall(true); // no rules inserted so all traffic other than broadcast and ARP-request-broadcast should be blocked // simulate a packet-in event this.setPacketIn(broadcastMalformedPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); // malformed broadcast traffic should NOT be allowed IRoutingDecision decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(decision.getRoutingAction(), IRoutingDecision.RoutingAction.DROP); } @Test public void testLayer2Rule() throws Exception { // enable firewall first firewall.enableFirewall(true); // add L2 rule FirewallRule rule = new FirewallRule(); rule.dl_src = MACAddress.valueOf("00:44:33:22:11:00").toLong(); rule.wildcard_dl_src = false; rule.dl_dst = MACAddress.valueOf("00:11:22:33:44:55").toLong(); rule.wildcard_dl_dst = false; rule.priority = 1; firewall.addRule(rule); // add TCP deny all rule rule = new FirewallRule(); rule.nw_proto = IPv4.PROTOCOL_TCP; rule.wildcard_nw_proto = false; rule.priority = 2; rule.action = FirewallRule.FirewallAction.DENY; firewall.addRule(rule); // simulate a packet-in event this.setPacketIn(tcpPacket); firewall.receive(sw, this.packetIn, cntx); verify(sw); IRoutingDecision decision = IRoutingDecision.rtStore.get(cntx, IRoutingDecision.CONTEXT_DECISION); assertEquals(decision.getRoutingAction(), IRoutingDecision.RoutingAction.FORWARD_OR_FLOOD); } }