- Added distance vector inverse path test case.

- Enhanced port forwarding configuration to restrict port forwarding to specific source IPs.
- Add configuration for counting additional connections per peer.
- Added caching for Core Messages, if confirmed virtual link is missing.
- Added caching for DV forwarding, if confirmed virtual link is missing.
- Fixed bug in fragmentation logic.
- Fixed bug in queueing logic.
- Fixed bug in flow control logic.
- Fixed Bug with lifetime of DV learn message. (Validation against replay attack still missing)
- removed make warnings
- fixed coverty findings

2 files changed, 97 insertions, 27 deletions

diff --git a/contrib/netjail/netjail_start.sh b/contrib/netjail/netjail_start.sh
index e2d5fd634..d03fa1c87 100755
--- a/contrib/netjail/netjail_start.sh
+++ b/contrib/netjail/netjail_start.sh
@@ -79,14 +79,46 @@ for N in $(seq $GLOBAL_N); do
     then
         #ip netns exec ${ROUTERS[$N]} nft add rule ip nat prerouting ip daddr $GLOBAL_GROUP.$N tcp dport 60002 counter dnat to $LOCAL_GROUP.1
         #ip netns exec ${ROUTERS[$N]} nft add rule ip filter FORWARD ip daddr $LOCAL_GROUP.1 ct state new,related,established  counter accept
-        ip netns exec ${ROUTERS[$N]} iptables -t nat -A PREROUTING -p tcp -d $GLOBAL_GROUP.$N --dport 60002 -j DNAT --to $LOCAL_GROUP.1
+        if [ "0" == "${R_TCP_ALLOWED_NUMBER[$N]}" ]; then
+            ip netns exec ${ROUTERS[$N]} iptables -t nat -A PREROUTING -p tcp -d $GLOBAL_GROUP.$N --dport 60002 -j DNAT --to $LOCAL_GROUP.1
+        else
+            delimiter=","
+            sources=$GLOBAL_GROUP."${R_TCP_ALLOWED[$N,1,1]}"
+            if [ "1" -lt "${R_TCP_ALLOWED_NUMBER[$N]}" ]
+            then
+               for ((i = 2; i <= ${R_TCP_ALLOWED_NUMBER[$N]}; i++))
+               do
+                   echo $i
+                   temp=$delimiter$GLOBAL_GROUP."${R_TCP_ALLOWED[$N,$i,1]}"
+                   sources=$sources$temp
+               done
+            fi
+            echo $sources
+            ip netns exec ${ROUTERS[$N]} iptables -t nat -A PREROUTING -p tcp -s $sources -d $GLOBAL_GROUP.$N --dport 60002 -j DNAT --to $LOCAL_GROUP.1
+        fi
         ip netns exec ${ROUTERS[$N]} iptables -A FORWARD -d $LOCAL_GROUP.1  -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
     fi
     if [ "1" == "${R_UDP[$N]}" ]
     then
         #ip netns exec ${ROUTERS[$N]} nft add rule ip nat prerouting ip daddr $GLOBAL_GROUP.$N udp dport $PORT counter dnat to $LOCAL_GROUP.1
         #ip netns exec ${ROUTERS[$N]} nft add rule ip filter FORWARD ip daddr $LOCAL_GROUP.1 ct state new,related,established  counter accept
-        ip netns exec ${ROUTERS[$N]} iptables -t nat -A PREROUTING -p udp -d $GLOBAL_GROUP.$N --dport $PORT -j DNAT --to $LOCAL_GROUP.1
+        if [ "0" == "${R_UDP_ALLOWED_NUMBER[$N]}" ]; then
+            ip netns exec ${ROUTERS[$N]} iptables -t nat -A PREROUTING -p udp -d $GLOBAL_GROUP.$N --dport $PORT -j DNAT --to $LOCAL_GROUP.1
+        else
+            delimiter=","
+            sources=$GLOBAL_GROUP."${R_UDP_ALLOWED[$N,1,1]}"
+            if [ "1" -lt "${R_UDP_ALLOWED_NUMBER[$N]}" ]
+            then
+               for ((i = 2; i <= ${R_UDP_ALLOWED_NUMBER[$N]}; i++))
+               do
+                   echo $i
+                   temp=$delimiter$GLOBAL_GROUP."${R_UDP_ALLOWED[$N,$i,1]}"
+                   sources=$sources$temp
+               done
+            fi
+            echo $sources
+            ip netns exec ${ROUTERS[$N]} iptables -t nat -A PREROUTING -p udp -s $GLOBAL_GROUP.$sources -d $GLOBAL_GROUP.$N --dport $PORT -j DNAT --to $LOCAL_GROUP.1
+        fi
         ip netns exec ${ROUTERS[$N]} iptables -A FORWARD -d $LOCAL_GROUP.1  -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
     fi
 done
diff --git a/contrib/netjail/topo.sh b/contrib/netjail/topo.sh
index d7586d425..d94fa0bac 100755
--- a/contrib/netjail/topo.sh
+++ b/contrib/netjail/topo.sh
@@ -2,14 +2,18 @@
 
 declare -A K_PLUGIN
 declare -A R_TCP
+declare -A R_TCP_ALLOWED
+declare -i -A R_TCP_ALLOWED_NUMBER
 declare -A R_UDP
+declare -A R_UDP_ALLOWED
+declare -i -A R_UDP_ALLOWED_NUMBER
 declare -A P_PLUGIN
 
 extract_attributes()
 {
     line_key=$1
     line=$2
-    
+
     if [ "$line_key" = "P" ]
     then
         n=$(echo $line|cut -d \| -f 1|awk -F: '{print $2}')
@@ -21,34 +25,68 @@ extract_attributes()
         echo $number
     fi
 
-    nf=$(echo $line|awk -F: '{print NF}')
+    #nf=$(echo $line|awk -F: '{print NF}')
+    nf=$(echo $line|awk -F\| '{print NF}')
     for ((i=2;i<=$nf;i++))
     do
-        entry=$(echo $line |awk -v i=$i -F\| '{print $i}')
+        entry=$(echo $line |awk -v i=$i -F\| '{print $i}')
+        echo $entry
+        if [ "$(echo $entry|grep P)" = "" ]; then
+                key=$(echo $entry|cut -d { -f 2|cut -d } -f 1|cut -d : -f 1)
+                echo $key
+                value=$(echo $entry|cut -d { -f 2|cut -d } -f 1|cut -d : -f 2)
+                echo $value
+            if [ "$key" = "tcp_port" ]
+                then
+                R_TCP_ALLOWED_NUMBER[$number]=0
+                    echo tcp port: $value
+                    R_TCP[$number]=$value
+                elif [ "$key" = "udp_port" ]
+                then
+                R_UDP_ALLOWED_NUMBER[$number]=0
+                    echo udp port: $value
+                    R_UDP[$number]=$value
+                elif [ "$key" = "plugin" ]
+                then
+                    echo plugin: $value
+                    echo $line_key
+                    if [ "$line_key" = "P" ]
+                    then
+                            P_PLUGIN[$n,$m]=$value
+                            echo $n $m ${P_PLUGIN[$n,$m]}
+                    elif [ "$line_key" = "K" ]
+                    then
+                            K_PLUGIN[$number]=$value
+                    fi
+                fi
+        else
+                p1=$(echo $entry|cut -d P -f 2|cut -d } -f 1|cut -d : -f 2)
+            echo $p1
+            p2=$(echo $entry|cut -d P -f 2|cut -d } -f 1|cut -d : -f 3)
+                echo $p2
+            if [ "$key" = "tcp_port" ]
+                then
+                R_TCP_ALLOWED_NUMBER[$number]+=1
+                    R_TCP_ALLOWED[$number,${R_TCP_ALLOWED_NUMBER[$number]},1]=$p1
+                R_TCP_ALLOWED[$number,${R_TCP_ALLOWED_NUMBER[$number]},2]=$p2
+                echo ${R_TCP_ALLOWED_NUMBER[$number]}
+                echo ${R_TCP_ALLOWED[$number,${R_TCP_ALLOWED_NUMBER[$number]},1]}
+                echo ${R_TCP_ALLOWED[$number,${R_TCP_ALLOWED_NUMBER[$number]},2]}
+                elif [ "$key" = "udp_port" ]
+                then
+                R_UDP_ALLOWED_NUMBER[$number]+=1
+                    R_UDP_ALLOWED[$number,${R_UDP_ALLOWED_NUMBER[$number]},1]=$p1
+                R_UDP_ALLOWED[$number,${R_UDP_ALLOWED_NUMBER[$number]},2]=$p2
+            fi
+        fi
+    done
+    #for ((i=2;i<=$nf;i++))
+    # do
+        #entry=$(echo $line |awk -v i=$i -F\| '{print $i}')
         key=$(echo $entry|cut -d { -f 2|cut -d } -f 1|cut -d : -f 1)
         value=$(echo $entry|cut -d { -f 2|cut -d } -f 1|cut -d : -f 2)
-        if [ "$key" = "tcp_port" ]
-        then
-            echo tcp port: $value
-            R_TCP[$number]=$value
-        elif [ "$key" = "udp_port" ]
-        then
-            echo udp port: $value
-            R_UDP[$number]=$value
-        elif [ "$key" = "plugin" ]
-        then
-            echo plugin: $value
-            echo $line_key
-            if [ "$line_key" = "P" ]
-            then
-                P_PLUGIN[$n,$m]=$value
-                echo $n $m ${P_PLUGIN[$n,$m]}
-            elif [ "$line_key" = "K" ]
-            then
-                K_PLUGIN[$number]=$value
-            fi
-        fi
-    done
+        
+    #done
 }
 
 parse_line(){