test/fwtester.pl

   1 #!/usr/bin/perl
   2
   3 use lib '../src';
   4 use strict;
   5 use warnings;
   6 use Data::Dumper;
   7 use PVE::Firewall;
   8 use Getopt::Long;
   9 use File::Basename;
  10 use Net::IP;
  11
  12 my $mark;
  13 my $trace;
  14
  15 my $debug = 0;
  16
  17 sub print_usage_and_exit {
  18     die "usage: $0 [--debug] [testfile [testid]]\n";
  19 }
  20
  21 if (!GetOptions ('debug' => \$debug)) {
  22     print_usage_and_exit();
  23 }
  24
  25 my $testfilename = shift;
  26 my $testid = shift;
  27
  28 sub add_trace {
  29     my ($text) = @_;
  30
  31     if ($debug) {
  32         print $text;
  33     } else {
  34         $trace .= $text;
  35     }
  36 }
  37
  38 sub nf_dev_match {
  39     my ($devre, $dev) = @_;
  40
  41     $devre =~ s/\+$/\.\*/;
  42     return  ($dev =~ m/^${devre}$/) ? 1 : 0;
  43 }
  44
  45 sub ipset_match {
  46     my ($ipsetname, $ipset, $ipaddr) = @_;
  47
  48     my $ip = Net::IP->new($ipaddr);
  49
  50     foreach my $entry (@$ipset) {
  51         next if $entry =~ m/^create/; # simply ignore
  52         if ($entry =~ m/add \S+ (\S+)$/) {
  53             my $test = Net::IP->new($1);
  54             if ($test->overlaps($ip)) {
  55                 add_trace("IPSET $ipsetname match $ipaddr\n");
  56                 return 1;
  57             }
  58         } else {
  59             die "implement me";
  60         }
  61     }
  62
  63     return 0;
  64 }
  65
  66 sub rule_match {
  67     my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
  68
  69     $rule =~ s/^-A $chain // || die "got strange rule: $rule";
  70
  71     while (length($rule)) {
  72
  73         if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
  74             my $cstate = $1;
  75
  76             return undef if $cstate eq 'INVALID'; # no match
  77             return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
  78
  79             next if $cstate =~ m/NEW/;
  80
  81             die "please implement cstate test '$cstate'";
  82         }
  83
  84         if ($rule =~ s/^-m addrtype\s*//) {
  85             return undef; # simply ignore
  86         }
  87
  88         if ($rule =~ s/^-i (\S+)\s*//) {
  89             my $devre = $1;
  90             die "missing iface_in" if !$pkg->{iface_in};
  91             return undef if !nf_dev_match($devre, $pkg->{iface_in});
  92             next;
  93         }
  94
  95         if ($rule =~ s/^-o (\S+)\s*//) {
  96             my $devre = $1;
  97             die "missing iface_out" if !$pkg->{iface_out};
  98             return undef if !nf_dev_match($devre, $pkg->{iface_out});
  99             next;
 100         }
 101
 102         if ($rule =~ s/^-p (tcp|udp)\s*//) {
 103             die "missing proto" if !$pkg->{proto};
 104             return undef if $pkg->{proto} ne $1; # no match
 105             next;
 106         }
 107
 108         if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
 109             die "missing dport" if !$pkg->{dport};
 110             return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
 111             next;
 112         }
 113
 114         if ($rule =~ s/^--dport (\d+)\s*//) {
 115             die "missing dport" if !$pkg->{dport};
 116             return undef if $pkg->{dport} != $1; # no match
 117             next;
 118         }
 119
 120         if ($rule =~ s/^-s (\S+)\s*//) {
 121             die "missing source" if !$pkg->{source};
 122             my $ip = Net::IP->new($1);
 123             return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
 124             next;
 125         }
 126
 127         if ($rule =~ s/^-d (\S+)\s*//) {
 128             die "missing destination" if !$pkg->{dest};
 129             my $ip = Net::IP->new($1);
 130             return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
 131             next;
 132         }
 133
 134         if ($rule =~ s/^-m set --match-set (\S+) src\s*//) {
 135             die "missing source" if !$pkg->{source};
 136             my $ipset = $ipset_ruleset->{$1};
 137             die "no such ip set '$1'" if !$ipset;
 138             return undef if !ipset_match($1, $ipset, $pkg->{source});
 139             next;
 140         }
 141
 142         if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
 143             die "missing destination" if !$pkg->{dest};
 144             my $ipset = $ipset_ruleset->{$1};
 145             die "no such ip set '$1'" if !$ipset;
 146             return undef if !ipset_match($1, $ipset, $pkg->{dest});
 147             next;
 148         }
 149
 150         if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
 151             die "missing source mac" if !$pkg->{mac_source};
 152             return undef if $pkg->{mac_source} eq $1; # no match
 153             next;
 154         }
 155
 156         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
 157             my $devre = $1;
 158             return undef if !$pkg->{physdev_in};
 159             return undef if !nf_dev_match($devre, $pkg->{physdev_in});
 160             next;
 161         }
 162
 163         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
 164             my $devre = $1;
 165             return undef if !$pkg->{physdev_out};
 166             return undef if !nf_dev_match($devre, $pkg->{physdev_out});
 167             next;
 168         }
 169
 170         if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
 171             return undef if !defined($mark) || $mark != $1;
 172             next;
 173         }
 174
 175         # final actions
 176
 177         if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
 178             $mark = $1;
 179             return undef;
 180         }
 181
 182         if ($rule =~ s/^-j (\S+)\s*$//) {
 183             return (0, $1);
 184         }
 185
 186         if ($rule =~ s/^-g (\S+)\s*$//) {
 187             return (1, $1);
 188         }
 189
 190         if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
 191             return undef;
 192         }
 193
 194         last;
 195     }
 196
 197     die "unable to parse rule: $rule";
 198 }
 199
 200 sub ruleset_simulate_chain {
 201     my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
 202
 203     add_trace("ENTER chain $chain\n");
 204
 205     my $counter = 0;
 206
 207     if ($chain eq 'PVEFW-Drop') {
 208         add_trace("LEAVE chain $chain\n");
 209         return ('DROP', $counter);
 210     }
 211     if ($chain eq 'PVEFW-reject') {
 212         add_trace("LEAVE chain $chain\n");
 213         return ('REJECT', $counter);
 214     }
 215
 216     if ($chain eq 'PVEFW-tcpflags') {
 217         add_trace("LEAVE chain $chain\n");
 218         return (undef, $counter);
 219     }
 220
 221     my $rules = $ruleset->{$chain} ||
 222         die "no such chain '$chain'";
 223
 224     foreach my $rule (@$rules) {
 225         $counter++;
 226         my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
 227         if (!defined($action)) {
 228             add_trace("SKIP: $rule\n");
 229             next;
 230         }
 231         add_trace("MATCH: $rule\n");
 232
 233         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 234             add_trace("TERMINATE chain $chain: $action\n");
 235             return ($action, $counter);
 236         } elsif ($action eq 'RETURN') {
 237             add_trace("RETURN FROM chain $chain\n");
 238             last;
 239         } else {
 240             if ($goto) {
 241                 add_trace("LEAVE chain $chain - goto $action\n");
 242                 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
 243                 #$chain = $action;
 244                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 245             } else {
 246                 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
 247                 $counter += $ctr;
 248                 return ($act, $counter) if $act;
 249                 add_trace("CONTINUE chain $chain\n");
 250             }
 251         }
 252     }
 253
 254     add_trace("LEAVE chain $chain\n");
 255     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 256         return ('ACCEPT', $counter); # default policy
 257     }
 258
 259     return (undef, $counter);
 260 }
 261
 262 sub copy_packet {
 263     my ($pkg) = @_;
 264
 265     my $res = {};
 266
 267     while (my ($k,$v) = each %$pkg) {
 268         $res->{$k} = $v;
 269     }
 270
 271     return $res;
 272 }
 273
 274 # Try to simulate packet traversal inside kernel. This invokes iptable
 275 # checks several times.
 276 sub route_packet {
 277     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 278
 279     my $route_state = $start_state;
 280
 281     my $physdev_in;
 282
 283     my $ipt_invocation_counter = 0;
 284     my $rule_check_counter = 0;
 285
 286     while ($route_state ne $target->{iface}) {
 287
 288         my $chain;
 289         my $next_route_state;
 290         my $next_physdev_in;
 291
 292         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 293         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 294
 295         if ($route_state eq 'from-bport') {
 296             $next_route_state = $from_info->{bridge} || die 'internal error';
 297             $next_physdev_in = $from_info->{iface} || die 'internal error';
 298         } elsif ($route_state eq 'host') {
 299
 300             if ($target->{type} eq 'bport') {
 301                 $pkg->{iface_in} = 'lo';
 302                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 303                 $chain = 'PVEFW-OUTPUT';
 304                 $next_route_state = $target->{iface} || die 'internal error';
 305             } elsif ($target->{type} eq 'ct') {
 306                 $pkg->{iface_in} = 'lo';
 307                 $pkg->{iface_out} = 'venet0';
 308                 $chain = 'PVEFW-OUTPUT';
 309                 $next_route_state = 'venet-in';
 310             } elsif ($target->{type} eq 'vm') {
 311                 $pkg->{iface_in} = 'lo';
 312                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 313                 $chain = 'PVEFW-OUTPUT';
 314                 $next_route_state = 'fwbr-in';
 315             } else {
 316                 die "implement me";
 317             }
 318
 319         } elsif ($route_state eq 'venet-out') {
 320
 321             if ($target->{type} eq 'host') {
 322
 323                 $chain = 'PVEFW-INPUT';
 324                 $pkg->{iface_in} = 'venet0';
 325                 $pkg->{iface_out} = 'lo';
 326                 $next_route_state = 'host';
 327
 328             } elsif ($target->{type} eq 'bport') {
 329
 330                 $chain = 'PVEFW-FORWARD';
 331                 $pkg->{iface_in} = 'venet0';
 332                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 333                 $next_route_state = $target->{iface} || die 'internal error';
 334
 335             } elsif ($target->{type} eq 'vm') {
 336
 337                 $chain = 'PVEFW-FORWARD';
 338                 $pkg->{iface_in} = 'venet0';
 339                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 340                 $next_route_state = 'fwbr-in';
 341
 342             } elsif ($target->{type} eq 'ct') {
 343
 344                 $chain = 'PVEFW-FORWARD';
 345                 $pkg->{iface_in} = 'venet0';
 346                 $pkg->{iface_out} = 'venet0';
 347                 $next_route_state = 'venet-in';
 348
 349             } else {
 350                 die "implement me";
 351             }
 352
 353         } elsif ($route_state eq 'fwbr-out') {
 354
 355             $chain = 'PVEFW-FORWARD';
 356             $next_route_state = $from_info->{bridge} || die 'internal error';
 357             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 358             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 359             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 360             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 361             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 362
 363         } elsif ($route_state eq 'fwbr-in') {
 364
 365             $chain = 'PVEFW-FORWARD';
 366             $next_route_state = $target->{tapdev};
 367             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 368             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 369             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 370             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 371
 372         } elsif ($route_state =~ m/^vmbr\d+$/) {
 373
 374             die "missing physdev_in - internal error?" if !$physdev_in;
 375             $pkg->{physdev_in} = $physdev_in;
 376
 377             if ($target->{type} eq 'host') {
 378
 379                 $chain = 'PVEFW-INPUT';
 380                 $pkg->{iface_in} = $route_state;
 381                 $pkg->{iface_out} = 'lo';
 382                 $next_route_state = 'host';
 383
 384             } elsif ($target->{type} eq 'bport') {
 385
 386                 $chain = 'PVEFW-FORWARD';
 387                 $pkg->{iface_in} = $route_state;
 388                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 389                 # conditionally set physdev_out (same behavior as kernel)
 390                 if ($route_state eq $target->{bridge}) {
 391                     $pkg->{physdev_out} = $target->{iface} || die 'internal error';
 392                 }
 393                 $next_route_state = $target->{iface};
 394
 395             } elsif ($target->{type} eq 'ct') {
 396
 397                 $chain = 'PVEFW-FORWARD';
 398                 $pkg->{iface_in} = $route_state;
 399                 $pkg->{iface_out} = 'venet0';
 400                 $next_route_state = 'venet-in';
 401
 402             } elsif ($target->{type} eq 'vm') {
 403
 404                 $chain = 'PVEFW-FORWARD';
 405                 $pkg->{iface_in} = $route_state;
 406                 $pkg->{iface_out} = $target->{bridge};
 407                 # conditionally set physdev_out (same behavior as kernel)
 408                 if ($route_state eq $target->{bridge}) {
 409                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 410                 }
 411                 $next_route_state = 'fwbr-in';
 412
 413             } else {
 414                 die "implement me";
 415             }
 416
 417         } else {
 418             die "implement me $route_state";
 419         }
 420
 421         die "internal error" if !defined($next_route_state);
 422
 423         if ($chain) {
 424             add_trace("IPT check at $route_state (chain $chain)\n");
 425             add_trace(Dumper($pkg));
 426             $ipt_invocation_counter++;
 427             my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
 428             $rule_check_counter += $ctr;
 429             return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
 430         }
 431
 432         $route_state = $next_route_state;
 433
 434         $physdev_in = $next_physdev_in;
 435     }
 436
 437     return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
 438 }
 439
 440 sub extract_ct_info {
 441     my ($vmdata, $vmid) = @_;
 442
 443     my $info = { type => 'ct', vmid => $vmid };
 444
 445     my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
 446     if ($conf->{ip_address}) {
 447         $info->{ip_address} = $conf->{ip_address}->{value};
 448     } else {
 449         die "implement me";
 450     }
 451     return $info;
 452 }
 453
 454 sub extract_vm_info {
 455     my ($vmdata, $vmid) = @_;
 456
 457     my $info = { type => 'vm', vmid => $vmid };
 458
 459     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 460     my $net = PVE::QemuServer::parse_net($conf->{net0});
 461     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 462     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 463     $info->{fwbr} = "fwbr${vmid}i0";
 464     $info->{tapdev} = "tap${vmid}i0";
 465     $info->{fwln} = "fwln${vmid}i0";
 466     $info->{fwpr} = "fwpr${vmid}p0";
 467
 468     return $info;
 469 }
 470
 471 sub simulate_firewall {
 472     my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
 473
 474     my $from = $test->{from} || die "missing 'from' field";
 475     my $to = $test->{to} || die "missing 'to' field";
 476     my $action = $test->{action} || die "missing 'action'";
 477
 478     my $testid = $test->{id};
 479
 480     die "from/to needs to be different" if $from eq $to;
 481
 482     my $pkg = {
 483         proto => 'tcp',
 484         sport => undef,
 485         dport => undef,
 486         source => undef,
 487         dest => undef,
 488     };
 489
 490     while (my ($k,$v) = each %$test) {
 491         next if $k eq 'from';
 492         next if $k eq 'to';
 493         next if $k eq 'action';
 494         next if $k eq 'id';
 495         die "unknown attribute '$k'\n" if !exists($pkg->{$k});
 496         $pkg->{$k} = $v;
 497     }
 498
 499     my $from_info = {};
 500
 501     my $start_state;
 502
 503     my $host_ip = '172.16.1.2';
 504
 505     if ($from eq 'host') {
 506         $from_info->{type} = 'host';
 507         $start_state = 'host';
 508         $pkg->{source} = $host_ip if !defined($pkg->{source});
 509     } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
 510         $from_info->{type} = 'bport';
 511         $from_info->{bridge} = $1;
 512         $from_info->{iface} = $2;
 513         $start_state = 'from-bport';
 514     } elsif ($from eq 'outside') {
 515         $from_info->{type} = 'bport';
 516         $from_info->{bridge} = 'vmbr0';
 517         $from_info->{iface} = 'eth0';
 518         $start_state = 'from-bport';
 519     } elsif ($from eq 'nfvm') {
 520         $from_info->{type} = 'bport';
 521         $from_info->{bridge} = 'vmbr0';
 522         $from_info->{iface} = 'tapXYZ';
 523         $start_state = 'from-bport';
 524     } elsif ($from =~ m/^ct(\d+)$/) {
 525         my $vmid = $1;
 526         $from_info = extract_ct_info($vmdata, $vmid);
 527         if ($from_info->{ip_address}) {
 528             $pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
 529             $start_state = 'venet-out';
 530         } else {
 531             die "implement me";
 532         }
 533     } elsif ($from =~ m/^vm(\d+)$/) {
 534         my $vmid = $1;
 535         $from_info = extract_vm_info($vmdata, $vmid);
 536         $start_state = 'fwbr-out';
 537         $pkg->{mac_source} = $from_info->{macaddr};
 538     } else {
 539         die "unable to parse \"from => '$from'\"\n";
 540     }
 541
 542     my $target;
 543
 544     if ($to eq 'host') {
 545         $target->{type} = 'host';
 546         $target->{iface} = 'host';
 547         $pkg->{dest} = $host_ip if !defined($pkg->{dest});
 548     } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
 549         $target->{type} = 'bport';
 550         $target->{bridge} = $1;
 551         $target->{iface} = $2;
 552     } elsif ($to eq 'outside') {
 553         $target->{type} = 'bport';
 554         $target->{bridge} = 'vmbr0';
 555         $target->{iface} = 'eth0';
 556      } elsif ($to eq 'nfvm') {
 557         $target->{type} = 'bport';
 558         $target->{bridge} = 'vmbr0';
 559         $target->{iface} = 'tapXYZ';
 560     } elsif ($to =~ m/^ct(\d+)$/) {
 561         my $vmid = $1;
 562         $target = extract_ct_info($vmdata, $vmid);
 563         $target->{iface} = 'venet-in';
 564
 565         if ($target->{ip_address}) {
 566             $pkg->{dest} = $target->{ip_address};
 567         } else {
 568             die "implement me";
 569         }
 570    } elsif ($to =~ m/^vm(\d+)$/) {
 571         my $vmid = $1;
 572         $target = extract_vm_info($vmdata, $vmid);
 573         $target->{iface} = $target->{tapdev};
 574     } else {
 575         die "unable to parse \"to => '$to'\"\n";
 576     }
 577
 578     $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
 579     $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
 580
 581     my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
 582                                        $from_info, $target, $start_state);
 583
 584     add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 585
 586     die "test failed ($res != $action)\n" if $action ne $res;
 587
 588     return undef;
 589 }
 590
 591 sub run_tests {
 592     my ($vmdata, $testdir, $testfile, $testid) = @_;
 593
 594     $testfile = 'tests' if !$testfile;
 595
 596     $vmdata->{testdir} = $testdir;
 597
 598     PVE::Firewall::cluster_network('172.16.1.0/24');
 599
 600     my ($ruleset, $ipset_ruleset) =
 601         PVE::Firewall::compile(undef, undef, $vmdata);
 602
 603     my $filename = "$testdir/$testfile";
 604     my $fh = IO::File->new($filename) ||
 605         die "unable to open '$filename' - $!\n";
 606
 607     my $testcount = 0;
 608     while (defined(my $line = <$fh>)) {
 609         next if $line =~ m/^\s*$/;
 610         next if $line =~ m/^#.*$/;
 611         if ($line =~ m/^\{.*\}\s*$/) {
 612             my $test = eval $line;
 613             die $@ if $@;
 614             next if defined($testid) && (!defined($test->{id}) || ($testid ne $test->{id}));
 615             $trace = '';
 616             print Dumper($ruleset) if $debug;
 617             $testcount++;
 618             eval {
 619                 my @test_zones = qw(host outside nfvm vm100 ct200);
 620                 if (!defined($test->{from}) && !defined($test->{to})) {
 621                     die "missing zone speification (from, to)\n";
 622                 } elsif (!defined($test->{to})) {
 623                     foreach my $zone (@test_zones) {
 624                         next if $zone eq $test->{from};
 625                         $test->{to} = $zone;
 626                         add_trace("Set Zone: to => '$zone'\n");
 627                         simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
 628                     }
 629                 } elsif (!defined($test->{from})) {
 630                     foreach my $zone (@test_zones) {
 631                         next if $zone eq $test->{to};
 632                         $test->{from} = $zone;
 633                         add_trace("Set Zone: from => '$zone'\n");
 634                         simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
 635                     }
 636                 } else {
 637                     simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
 638                 }
 639             };
 640             if (my $err = $@) {
 641
 642                 print Dumper($ruleset) if !$debug;
 643
 644                 print "$trace\n" if !$debug;
 645
 646                 print "$filename line $.: $line";
 647
 648                 print "test failed: $err\n";
 649
 650                 exit(-1);
 651             }
 652         } else {
 653             die "parse error";
 654         }
 655     }
 656
 657     die "no tests found\n" if $testcount <= 0;
 658
 659     print "PASS: $filename\n";
 660
 661     return undef;
 662 }
 663
 664 my $vmdata = {
 665     qemu => {
 666         100 => {
 667             net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=1",
 668         },
 669         101 => {
 670             net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0,firewall=1",
 671         },
 672         # on bridge vmbr1
 673         110 => {
 674             net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1,firewall=1",
 675         },
 676     },
 677     openvz => {
 678         200 => {
 679             ip_address => { value => '10.0.200.1' },
 680         },
 681         201 => {
 682             ip_address => { value => '10.0.200.2' },
 683         },
 684     },
 685 };
 686
 687 if ($testfilename) {
 688     my $testfile;
 689     my $dir;
 690
 691     if (-d $testfilename) {
 692         $dir = $testfilename;
 693     } elsif (-f $testfilename) {
 694         $dir = dirname($testfilename);
 695         $testfile = basename($testfilename);
 696     } else {
 697         die "no such file/dir '$testfilename'\n";
 698     }
 699
 700     run_tests($vmdata, $dir, $testfile, $testid);
 701
 702 } else {
 703     foreach my $dir (<test-*>) {
 704         next if ! -d $dir;
 705         run_tests($vmdata, $dir);
 706     }
 707 }
 708
 709 print "OK - all tests passed\n";
 710
 711 exit(0);