session_test_basic (vlib_main_t * vm, unformat_input_t * input)
{
session_endpoint_t server_sep = SESSION_ENDPOINT_NULL;
- u64 options[SESSION_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle;
- u8 segment_name[128];
+ u64 options[APP_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle;
clib_error_t *error = 0;
u32 server_index;
.options = options,
.namespace_id = 0,
.session_cb_vft = &dummy_session_cbs,
- .segment_name = segment_name,
};
error = vnet_application_attach (&attach_args);
static int
session_test_namespace (vlib_main_t * vm, unformat_input_t * input)
{
- u64 options[SESSION_OPTIONS_N_OPTIONS], dummy_secret = 1234;
+ u64 options[APP_OPTIONS_N_OPTIONS], dummy_secret = 1234;
u32 server_index, server_st_index, server_local_st_index;
u32 dummy_port = 1234, local_listener, client_index;
u32 dummy_api_context = 4321, dummy_client_api_index = 1234;
clib_error_t *error = 0;
u8 *ns_id = format (0, "appns1"), intf_mac[6];
app_namespace_t *app_ns;
- u8 segment_name[128];
application_t *server;
stream_session_t *s;
int code;
.options = options,
.namespace_id = 0,
.session_cb_vft = &dummy_session_cbs,
- .segment_name = segment_name,
};
vnet_bind_args_t bind_args = {
session_test_rules (vlib_main_t * vm, unformat_input_t * input)
{
session_endpoint_t server_sep = SESSION_ENDPOINT_NULL;
- u64 options[SESSION_OPTIONS_N_OPTIONS];
+ u64 options[APP_OPTIONS_N_OPTIONS];
u16 lcl_port = 1234, rmt_port = 4321;
- u32 server_index, app_index;
+ u32 server_index, server_index2, app_index;
u32 dummy_server_api_index = ~0;
transport_connection_t *tc;
u32 dummy_port = 1111;
clib_error_t *error = 0;
- u8 segment_name[128], is_filtered = 0;
+ u8 is_filtered = 0, *ns_id = format (0, "appns1");
stream_session_t *listener, *s;
app_namespace_t *default_ns = app_namespace_get_default ();
u32 local_ns_index = default_ns->local_table_index;
int verbose = 0, rv;
+ app_namespace_t *app_ns;
while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
{
.options = options,
.namespace_id = 0,
.session_cb_vft = &dummy_session_cbs,
- .segment_name = segment_name,
};
vnet_bind_args_t bind_args = {
app_index = session_lookup_local_endpoint (local_ns_index, &sep);
SESSION_TEST ((app_index == APP_INVALID_INDEX), "lookup for 1.2.3.4/32 1234"
- " 5.6.7.8/16 4321 in local table should return invalid");
+ " 5.6.7.8/32 4321 in local table should return invalid");
if (verbose)
{
sep.ip.ip4.as_u32 += 1 << 24;
app_index = session_lookup_local_endpoint (local_ns_index, &sep);
SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234"
- " 5.6.7.9/16 4321 in local table should return invalid");
+ " 5.6.7.9/32 4321 in local table should return deny");
vnet_connect_args_t connect_args = {
.sep = sep,
" not work (no-rule)");
/*
- * Test tags. Add/del rule with tag
+ * Test tags. Add/overwrite/del rule with tag
*/
args.table_args.is_add = 1;
args.table_args.lcl_port = 1234;
SESSION_TEST ((tc->c_index == listener->connection_index),
"lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should work");
+ vec_free (args.table_args.tag);
+ args.table_args.lcl_port = 1234;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 16;
+ args.table_args.tag = format (0, "test_rule_overwrite");
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0),
+ "Overwrite 1.2.3.4/16 1234 5.6.7.8/16 4321 deny tag test_rule"
+ " should work");
+ if (verbose)
+ {
+ session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ }
+
args.table_args.is_add = 0;
args.table_args.lcl_port += 1;
error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny "
+ "tag %v", args.table_args.tag);
if (verbose)
{
session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
TRANSPORT_PROTO_TCP);
}
- SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny "
- "tag test_rule");
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port,
rmt_port, TRANSPORT_PROTO_TCP, 0,
&is_filtered);
- SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should not"
+ SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/32 4321 should not"
" work (del)");
+
+
+ /*
+ * Test local rules with multiple namespaces
+ */
+
+ /*
+ * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop)
+ */
+ args.table_args.is_add = 1;
+ args.table_args.lcl_port = 1234;
+ args.table_args.rmt_port = 0;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP;
+ args.table_args.tag = 0;
+ args.scope = SESSION_RULE_SCOPE_LOCAL;
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d",
+ args.table_args.action_index);
+ /*
+ * Add 'white' rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop)
+ */
+ args.table_args.is_add = 1;
+ args.table_args.lcl_port = 1234;
+ args.table_args.rmt_port = 4321;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW;
+ error = vnet_session_rule_add_del (&args);
+
+ if (verbose)
+ {
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ }
+
+ vnet_app_namespace_add_del_args_t ns_args = {
+ .ns_id = ns_id,
+ .secret = 0,
+ .sw_if_index = APP_NAMESPACE_INVALID_INDEX,
+ .is_add = 1
+ };
+ error = vnet_app_namespace_add_del (&ns_args);
+ SESSION_TEST ((error == 0), "app ns insertion should succeed: %d",
+ clib_error_get_code (error));
+ app_ns = app_namespace_get_from_id (ns_id);
+
+ attach_args.namespace_id = ns_id;
+ attach_args.api_client_index = dummy_server_api_index - 1;
+ error = vnet_application_attach (&attach_args);
+ SESSION_TEST ((error == 0), "server2 attached");
+ server_index2 = attach_args.app_index;
+
+ /*
+ * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop)
+ */
+ args.table_args.lcl_port = 1234;
+ args.table_args.rmt_port = 0;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP;
+ args.appns_index = app_namespace_index (app_ns);
+
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d "
+ "in test namespace", args.table_args.action_index);
+ /*
+ * Lookup default namespace
+ */
+ app_index = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((app_index == APP_INVALID_INDEX),
+ "lookup for 1.2.3.4/32 1234 5.6.7.8/32 4321 in local table "
+ "should return allow (invalid)");
+
+ sep.port += 1;
+ app_index = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234 "
+ "5.6.7.8/16 432*2* in local table should return deny");
+
+ connect_args.app_index = server_index;
+ connect_args.sep = sep;
+ error = vnet_connect (&connect_args);
+ SESSION_TEST ((error != 0), "connect should fail");
+ rv = clib_error_get_code (error);
+ SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED),
+ "connect should be filtered");
+
+ /*
+ * Lookup test namespace
+ */
+ app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep);
+ SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234 "
+ "5.6.7.8/16 4321 in local table should return deny");
+
+ connect_args.app_index = server_index;
+ error = vnet_connect (&connect_args);
+ SESSION_TEST ((error != 0), "connect should fail");
+ rv = clib_error_get_code (error);
+ SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED),
+ "connect should be filtered");
+
+ args.table_args.is_add = 0;
+ vnet_session_rule_add_del (&args);
+
+ args.appns_index = 0;
+ args.table_args.is_add = 0;
+ vnet_session_rule_add_del (&args);
+
+ args.table_args.rmt_port = 4321;
+ vnet_session_rule_add_del (&args);
+ /*
+ * Final Cleanup
+ */
vec_free (args.table_args.tag);
vnet_app_detach_args_t detach_args = {
.app_index = server_index,
};
vnet_application_detach (&detach_args);
+
+ detach_args.app_index = server_index2;
+ vnet_application_detach (&detach_args);
+
+ vec_free (ns_id);
return 0;
}
static int
session_test_proxy (vlib_main_t * vm, unformat_input_t * input)
{
- u64 options[SESSION_OPTIONS_N_OPTIONS];
+ u64 options[APP_OPTIONS_N_OPTIONS];
char *show_listeners = "sh session listeners tcp verbose";
char *show_local_listeners = "sh app ns table default";
unformat_input_t tmp_input;
u32 server_index, app_index;
u32 dummy_server_api_index = ~0, sw_if_index = 0;
clib_error_t *error = 0;
- u8 segment_name[128], intf_mac[6], sst, is_filtered = 0;
+ u8 intf_mac[6], sst, is_filtered = 0;
stream_session_t *s;
transport_connection_t *tc;
u16 lcl_port = 1234, rmt_port = 4321;
.options = options,
.namespace_id = 0,
.session_cb_vft = &dummy_session_cbs,
- .segment_name = segment_name,
};
attach_args.api_client_index = dummy_server_api_index;
Code Review / vpp.git / blobdiff