X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fsession%2Fsession_test.c;h=770e726302435aec08fb5579752d64514c2b9cef;hb=b10561bbecb2870360a731b4696bff920150720d;hp=c12041a2ee6f91a626fa74ab74c4adb7abef4654;hpb=5c9083d52646153bdc917a7ae37da696d864ad1c;p=vpp.git diff --git a/src/vnet/session/session_test.c b/src/vnet/session/session_test.c index c12041a2ee6..770e7263024 100644 --- a/src/vnet/session/session_test.c +++ b/src/vnet/session/session_test.c @@ -1,1551 +1,362 @@ -/* - * Copyright (c) 2017 Cisco and/or its affiliates. - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at: - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. +/* SPDX-License-Identifier: Apache-2.0 + * Copyright(c) 2021 Cisco Systems, Inc. */ -#include -#include -#include -#include -#include - -#define SESSION_TEST_I(_cond, _comment, _args...) \ -({ \ - int _evald = (_cond); \ - if (!(_evald)) { \ - fformat(stderr, "FAIL:%d: " _comment "\n", \ - __LINE__, ##_args); \ - } else { \ - fformat(stderr, "PASS:%d: " _comment "\n", \ - __LINE__, ##_args); \ - } \ - _evald; \ -}) - -#define SESSION_TEST(_cond, _comment, _args...) \ -{ \ - if (!SESSION_TEST_I(_cond, _comment, ##_args)) { \ - return 1; \ - } \ -} +#include +#include +#include +#include +#include -void -dummy_session_reset_callback (stream_session_t * s) -{ - clib_warning ("called..."); -} +#include -int -dummy_session_connected_callback (u32 app_index, u32 api_context, - stream_session_t * s, u8 is_fail) -{ - clib_warning ("called..."); - return -1; -} +#define __plugin_msg_base session_test_main.msg_id_base +#include -static u32 dummy_segment_count; +#include +#include -int -dummy_add_segment_callback (u32 client_index, const ssvm_private_t * fs) -{ - dummy_segment_count = 1; - return 0; -} +/* Declare message IDs */ +#include +#include +#include -int -dummy_del_segment_callback (u32 client_index, const ssvm_private_t * fs) -{ - dummy_segment_count = 0; - return 0; -} +#define vl_endianfun /* define message structures */ +#include +#undef vl_endianfun -void -dummy_session_disconnect_callback (stream_session_t * s) +typedef struct { - clib_warning ("called..."); -} + /* API message ID base */ + u16 msg_id_base; + u32 ping_id; + vat_main_t *vat_main; +} session_test_main_t; -static u32 dummy_accept; - -int -dummy_session_accept_callback (stream_session_t * s) -{ - dummy_accept = 1; - s->session_state = SESSION_STATE_READY; - return 0; -} - -int -dummy_server_rx_callback (stream_session_t * s) -{ - clib_warning ("called..."); - return -1; -} - -/* *INDENT-OFF* */ -static session_cb_vft_t dummy_session_cbs = { - .session_reset_callback = dummy_session_reset_callback, - .session_connected_callback = dummy_session_connected_callback, - .session_accept_callback = dummy_session_accept_callback, - .session_disconnect_callback = dummy_session_disconnect_callback, - .builtin_app_rx_callback = dummy_server_rx_callback, - .add_segment_callback = dummy_add_segment_callback, - .del_segment_callback = dummy_del_segment_callback, -}; -/* *INDENT-ON* */ +static session_test_main_t session_test_main; static int -session_create_lookpback (u32 table_id, u32 * sw_if_index, - ip4_address_t * intf_addr) +api_session_rule_add_del (vat_main_t *vam) { - u8 intf_mac[6]; - - memset (intf_mac, 0, sizeof (intf_mac)); + vl_api_session_rule_add_del_t *mp; + unformat_input_t *i = vam->input; + u32 proto = ~0, lcl_port, rmt_port, action = 0, lcl_plen, rmt_plen; + u32 appns_index = 0, scope = 0; + ip4_address_t lcl_ip4, rmt_ip4; + ip6_address_t lcl_ip6, rmt_ip6; + u8 is_ip4 = 1, conn_set = 0; + u8 is_add = 1, *tag = 0; + int ret; + fib_prefix_t lcl, rmt; + + while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT) + { + if (unformat (i, "del")) + is_add = 0; + else if (unformat (i, "add")) + ; + else if (unformat (i, "proto tcp")) + proto = 0; + else if (unformat (i, "proto udp")) + proto = 1; + else if (unformat (i, "appns %d", &appns_index)) + ; + else if (unformat (i, "scope %d", &scope)) + ; + else if (unformat (i, "tag %_%v%_", &tag)) + ; + else if (unformat (i, "%U/%d %d %U/%d %d", unformat_ip4_address, + &lcl_ip4, &lcl_plen, &lcl_port, unformat_ip4_address, + &rmt_ip4, &rmt_plen, &rmt_port)) + { + is_ip4 = 1; + conn_set = 1; + } + else if (unformat (i, "%U/%d %d %U/%d %d", unformat_ip6_address, + &lcl_ip6, &lcl_plen, &lcl_port, unformat_ip6_address, + &rmt_ip6, &rmt_plen, &rmt_port)) + { + is_ip4 = 0; + conn_set = 1; + } + else if (unformat (i, "action %d", &action)) + ; + else + break; + } + if (proto == ~0 || !conn_set || action == ~0) + { + errmsg ("transport proto, connection and action must be set"); + return -99; + } - if (vnet_create_loopback_interface (sw_if_index, intf_mac, 0, 0)) + if (scope > 3) { - clib_warning ("couldn't create loopback. stopping the test!"); - return -1; + errmsg ("scope should be 0-3"); + return -99; } - if (table_id != 0) - ip_table_bind (FIB_PROTOCOL_IP4, *sw_if_index, table_id, 0); + M (SESSION_RULE_ADD_DEL, mp); - vnet_sw_interface_set_flags (vnet_get_main (), *sw_if_index, - VNET_SW_INTERFACE_FLAG_ADMIN_UP); + clib_memset (&lcl, 0, sizeof (lcl)); + clib_memset (&rmt, 0, sizeof (rmt)); + if (is_ip4) + { + ip_set (&lcl.fp_addr, &lcl_ip4, 1); + ip_set (&rmt.fp_addr, &rmt_ip4, 1); + lcl.fp_len = lcl_plen; + rmt.fp_len = rmt_plen; + } + else + { + ip_set (&lcl.fp_addr, &lcl_ip6, 0); + ip_set (&rmt.fp_addr, &rmt_ip6, 0); + lcl.fp_len = lcl_plen; + rmt.fp_len = rmt_plen; + } - if (ip4_add_del_interface_address (vlib_get_main (), *sw_if_index, - intf_addr, 24, 0)) + ip_prefix_encode (&lcl, &mp->lcl); + ip_prefix_encode (&rmt, &mp->rmt); + mp->lcl_port = clib_host_to_net_u16 ((u16) lcl_port); + mp->rmt_port = clib_host_to_net_u16 ((u16) rmt_port); + mp->transport_proto = + proto ? TRANSPORT_PROTO_API_UDP : TRANSPORT_PROTO_API_TCP; + mp->action_index = clib_host_to_net_u32 (action); + mp->appns_index = clib_host_to_net_u32 (appns_index); + mp->scope = scope; + mp->is_add = is_add; + if (tag) { - clib_warning ("couldn't assign loopback ip %U", format_ip4_address, - intf_addr); - return -1; + clib_memcpy (mp->tag, tag, vec_len (tag)); + vec_free (tag); } - return 0; + S (mp); + W (ret); + return ret; } static void -session_delete_loopback (u32 sw_if_index) +vl_api_app_attach_reply_t_handler (vl_api_app_attach_reply_t *mp) { - /* fails spectacularly */ - /* vnet_delete_loopback_interface (sw_if_index); */ } -static int -session_test_basic (vlib_main_t * vm, unformat_input_t * input) +static void +vl_api_app_add_cert_key_pair_reply_t_handler ( + vl_api_app_add_cert_key_pair_reply_t *mp) { - session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; - u64 options[APP_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle; - clib_error_t *error = 0; - u32 server_index; - - memset (options, 0, sizeof (options)); - options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - vnet_app_attach_args_t attach_args = { - .api_client_index = ~0, - .options = options, - .namespace_id = 0, - .session_cb_vft = &dummy_session_cbs, - .name = format (0, "session_test"), - }; - - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "app attached"); - server_index = attach_args.app_index; - vec_free (attach_args.name); - - server_sep.is_ip4 = 1; - vnet_bind_args_t bind_args = { - .sep = server_sep, - .app_index = 0, - }; - - bind_args.app_index = server_index; - error = vnet_bind (&bind_args); - SESSION_TEST ((error == 0), "server bind4 should work"); - bind4_handle = bind_args.handle; - - error = vnet_bind (&bind_args); - SESSION_TEST ((error != 0), "double server bind4 should not work"); - - bind_args.sep.is_ip4 = 0; - error = vnet_bind (&bind_args); - SESSION_TEST ((error == 0), "server bind6 should work"); - bind6_handle = bind_args.handle; - - error = vnet_bind (&bind_args); - SESSION_TEST ((error != 0), "double server bind6 should not work"); - - vnet_unbind_args_t unbind_args = { - .handle = bind4_handle, - .app_index = server_index, - }; - error = vnet_unbind (&unbind_args); - SESSION_TEST ((error == 0), "unbind4 should work"); - - unbind_args.handle = bind6_handle; - error = vnet_unbind (&unbind_args); - SESSION_TEST ((error == 0), "unbind6 should work"); - - vnet_app_detach_args_t detach_args = { - .app_index = server_index, - }; - vnet_application_detach (&detach_args); - return 0; } static int -session_test_namespace (vlib_main_t * vm, unformat_input_t * input) +api_app_attach (vat_main_t *vat) { - u64 options[APP_OPTIONS_N_OPTIONS], dummy_secret = 1234; - u32 server_index, server_st_index, server_local_st_index; - u32 dummy_port = 1234, client_index; - u32 dummy_api_context = 4321, dummy_client_api_index = 1234; - u32 dummy_server_api_index = ~0, sw_if_index = 0; - session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; - session_endpoint_t client_sep = SESSION_ENDPOINT_NULL; - session_endpoint_t intf_sep = SESSION_ENDPOINT_NULL; - clib_error_t *error = 0; - u8 *ns_id = format (0, "appns1"); - app_namespace_t *app_ns; - application_t *server; - stream_session_t *s; - u64 handle; - int code; - - server_sep.is_ip4 = 1; - server_sep.port = dummy_port; - client_sep.is_ip4 = 1; - client_sep.port = dummy_port; - memset (options, 0, sizeof (options)); - - options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; - vnet_app_attach_args_t attach_args = { - .api_client_index = ~0, - .options = options, - .namespace_id = 0, - .session_cb_vft = &dummy_session_cbs, - .name = format (0, "session_test"), - }; - - vnet_bind_args_t bind_args = { - .sep = server_sep, - .app_index = 0, - }; - - vnet_connect_args_t connect_args = { - .app_index = 0, - .api_context = 0, - }; - clib_memcpy (&connect_args.sep, &client_sep, sizeof (client_sep)); - - vnet_unbind_args_t unbind_args = { - .handle = bind_args.handle, - .app_index = 0, - }; - - vnet_app_detach_args_t detach_args = { - .app_index = 0, - }; - - ip4_address_t intf_addr = { - .as_u32 = clib_host_to_net_u32 (0x06000105), - }; - - intf_sep.ip.ip4 = intf_addr; - intf_sep.is_ip4 = 1; - intf_sep.port = dummy_port; - - /* - * Insert namespace and lookup - */ - - vnet_app_namespace_add_del_args_t ns_args = { - .ns_id = ns_id, - .secret = dummy_secret, - .sw_if_index = APP_NAMESPACE_INVALID_INDEX, - .is_add = 1 - }; - error = vnet_app_namespace_add_del (&ns_args); - SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", - clib_error_get_code (error)); - - app_ns = app_namespace_get_from_id (ns_id); - SESSION_TEST ((app_ns != 0), "should find ns %v status", ns_id); - SESSION_TEST ((app_ns->ns_secret == dummy_secret), "secret should be %d", - dummy_secret); - SESSION_TEST ((app_ns->sw_if_index == APP_NAMESPACE_INVALID_INDEX), - "sw_if_index should be invalid"); - - /* - * Try application attach with wrong secret - */ - - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - options[APP_OPTIONS_NAMESPACE_SECRET] = dummy_secret - 1; - attach_args.namespace_id = ns_id; - attach_args.api_client_index = dummy_server_api_index; - - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error != 0), "app attachment should fail"); - code = clib_error_get_code (error); - SESSION_TEST ((code == VNET_API_ERROR_APP_WRONG_NS_SECRET), - "code should be wrong ns secret: %d", code); - - /* - * Attach server with global default scope - */ - options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - options[APP_OPTIONS_NAMESPACE_SECRET] = 0; - attach_args.namespace_id = 0; - attach_args.api_client_index = dummy_server_api_index; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "server attachment should work"); - server_index = attach_args.app_index; - server = application_get (server_index); - SESSION_TEST ((server->ns_index == 0), - "server should be in the default ns"); - - bind_args.app_index = server_index; - error = vnet_bind (&bind_args); - SESSION_TEST ((error == 0), "server bind should work"); - - server_st_index = application_session_table (server, FIB_PROTOCOL_IP4); - s = session_lookup_listener (server_st_index, &server_sep); - SESSION_TEST ((s != 0), "listener should exist in global table"); - SESSION_TEST ((s->app_index == server_index), "app_index should be that of " - "the server"); - server_local_st_index = application_local_session_table (server); - SESSION_TEST ((server_local_st_index == APP_INVALID_INDEX), - "server shouldn't have access to local table"); - - unbind_args.app_index = server_index; - unbind_args.handle = bind_args.handle; - error = vnet_unbind (&unbind_args); - SESSION_TEST ((error == 0), "unbind should work"); - - s = session_lookup_listener (server_st_index, &server_sep); - SESSION_TEST ((s == 0), "listener should not exist in global table"); - - detach_args.app_index = server_index; - vnet_application_detach (&detach_args); - - /* - * Attach server with local and global scope - */ - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - options[APP_OPTIONS_NAMESPACE_SECRET] = dummy_secret; - attach_args.namespace_id = ns_id; - attach_args.api_client_index = dummy_server_api_index; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "server attachment should work"); - server_index = attach_args.app_index; - server = application_get (server_index); - SESSION_TEST ((server->ns_index == app_namespace_index (app_ns)), - "server should be in the right ns"); - - bind_args.app_index = server_index; - error = vnet_bind (&bind_args); - SESSION_TEST ((error == 0), "bind should work"); - server_st_index = application_session_table (server, FIB_PROTOCOL_IP4); - s = session_lookup_listener (server_st_index, &server_sep); - SESSION_TEST ((s != 0), "listener should exist in global table"); - SESSION_TEST ((s->app_index == server_index), "app_index should be that of " - "the server"); - server_local_st_index = application_local_session_table (server); - handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); - SESSION_TEST ((handle != SESSION_INVALID_HANDLE), - "listener should exist in local table"); - - /* - * Try client connect with 1) local scope 2) global scope - */ - options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - attach_args.api_client_index = dummy_client_api_index; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "client attachment should work"); - client_index = attach_args.app_index; - connect_args.api_context = dummy_api_context; - connect_args.app_index = client_index; - error = vnet_connect (&connect_args); - SESSION_TEST ((error != 0), "client connect should return error code"); - code = clib_error_get_code (error); - SESSION_TEST ((code == VNET_API_ERROR_INVALID_VALUE), - "error code should be invalid value (zero ip)"); - SESSION_TEST ((dummy_segment_count == 0), - "shouldn't have received request to map new segment"); - connect_args.sep.ip.ip4.as_u8[0] = 127; - error = vnet_connect (&connect_args); - SESSION_TEST ((error == 0), "client connect should not return error code"); - code = clib_error_get_code (error); - SESSION_TEST ((dummy_segment_count == 1), - "should've received request to map new segment"); - SESSION_TEST ((dummy_accept == 1), "should've received accept request"); - detach_args.app_index = client_index; - vnet_application_detach (&detach_args); - - options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - attach_args.api_client_index = dummy_client_api_index; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "client attachment should work"); - error = vnet_connect (&connect_args); - SESSION_TEST ((error != 0), "client connect should return error code"); - code = clib_error_get_code (error); - SESSION_TEST ((code == VNET_API_ERROR_SESSION_CONNECT), - "error code should be connect (nothing in local scope)"); - detach_args.app_index = client_index; - vnet_application_detach (&detach_args); - - /* - * Unbind and detach server and then re-attach with local scope only - */ - unbind_args.handle = bind_args.handle; - unbind_args.app_index = server_index; - error = vnet_unbind (&unbind_args); - SESSION_TEST ((error == 0), "unbind should work"); - - s = session_lookup_listener (server_st_index, &server_sep); - SESSION_TEST ((s == 0), "listener should not exist in global table"); - handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); - SESSION_TEST ((handle == SESSION_INVALID_HANDLE), - "listener should not exist in local table"); - - detach_args.app_index = server_index; - vnet_application_detach (&detach_args); - - options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - attach_args.api_client_index = dummy_server_api_index; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "app attachment should work"); - server_index = attach_args.app_index; - server = application_get (server_index); - SESSION_TEST ((server->ns_index == app_namespace_index (app_ns)), - "app should be in the right ns"); - - bind_args.app_index = server_index; - error = vnet_bind (&bind_args); - SESSION_TEST ((error == 0), "bind should work"); - - server_st_index = application_session_table (server, FIB_PROTOCOL_IP4); - s = session_lookup_listener (server_st_index, &server_sep); - SESSION_TEST ((s == 0), "listener should not exist in global table"); - server_local_st_index = application_local_session_table (server); - handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); - SESSION_TEST ((handle != SESSION_INVALID_HANDLE), - "listener should exist in local table"); - - unbind_args.handle = bind_args.handle; - error = vnet_unbind (&unbind_args); - SESSION_TEST ((error == 0), "unbind should work"); - - handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); - SESSION_TEST ((handle == SESSION_INVALID_HANDLE), - "listener should not exist in local table"); - - /* - * Client attach + connect in default ns with local scope - */ - options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - attach_args.namespace_id = 0; - attach_args.api_client_index = dummy_client_api_index; - vnet_application_attach (&attach_args); - error = vnet_connect (&connect_args); - SESSION_TEST ((error != 0), "client connect should return error code"); - code = clib_error_get_code (error); - SESSION_TEST ((code == VNET_API_ERROR_SESSION_CONNECT), - "error code should be connect (not in same ns)"); - detach_args.app_index = client_index; - vnet_application_detach (&detach_args); - - /* - * Detach server - */ - detach_args.app_index = server_index; - vnet_application_detach (&detach_args); - - /* - * Create loopback interface - */ - session_create_lookpback (0, &sw_if_index, &intf_addr); - - /* - * Update namespace - */ - ns_args.sw_if_index = sw_if_index; - error = vnet_app_namespace_add_del (&ns_args); - SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", - clib_error_get_code (error)); - - /* - * Attach server with local and global scope - */ - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - options[APP_OPTIONS_NAMESPACE_SECRET] = dummy_secret; - attach_args.namespace_id = ns_id; - attach_args.api_client_index = dummy_server_api_index; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "server attachment should work"); - server_index = attach_args.app_index; - - bind_args.app_index = server_index; - error = vnet_bind (&bind_args); - server_st_index = application_session_table (server, FIB_PROTOCOL_IP4); - s = session_lookup_listener (server_st_index, &server_sep); - SESSION_TEST ((s == 0), "zero listener should not exist in global table"); - - s = session_lookup_listener (server_st_index, &intf_sep); - SESSION_TEST ((s != 0), "intf listener should exist in global table"); - SESSION_TEST ((s->app_index == server_index), "app_index should be that of " - "the server"); - server_local_st_index = application_local_session_table (server); - handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); - SESSION_TEST ((handle != SESSION_INVALID_HANDLE), - "zero listener should exist in local table"); - detach_args.app_index = server_index; - vnet_application_detach (&detach_args); - - /* - * Cleanup - */ - vec_free (attach_args.name); - vec_free (ns_id); - session_delete_loopback (sw_if_index); - return 0; + return -1; } static int -session_test_rule_table (vlib_main_t * vm, unformat_input_t * input) +api_application_detach (vat_main_t *vat) { - session_rules_table_t _srt, *srt = &_srt; - u16 lcl_port = 1234, rmt_port = 4321; - u32 action_index = 1, res; - ip4_address_t lcl_lkup, rmt_lkup; - clib_error_t *error; - int verbose = 0; - - while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (input, "verbose")) - verbose = 1; - else - { - vlib_cli_output (vm, "parse error: '%U'", format_unformat_error, - input); - return -1; - } - } - - memset (srt, 0, sizeof (*srt)); - session_rules_table_init (srt); - - ip4_address_t lcl_ip = { - .as_u32 = clib_host_to_net_u32 (0x01020304), - }; - ip4_address_t rmt_ip = { - .as_u32 = clib_host_to_net_u32 (0x05060708), - }; - ip4_address_t lcl_ip2 = { - .as_u32 = clib_host_to_net_u32 (0x02020202), - }; - ip4_address_t rmt_ip2 = { - .as_u32 = clib_host_to_net_u32 (0x06060606), - }; - ip4_address_t lcl_ip3 = { - .as_u32 = clib_host_to_net_u32 (0x03030303), - }; - ip4_address_t rmt_ip3 = { - .as_u32 = clib_host_to_net_u32 (0x07070707), - }; - fib_prefix_t lcl_pref = { - .fp_addr.ip4.as_u32 = lcl_ip.as_u32, - .fp_len = 16, - .fp_proto = FIB_PROTOCOL_IP4, - }; - fib_prefix_t rmt_pref = { - .fp_addr.ip4.as_u32 = rmt_ip.as_u32, - .fp_len = 16, - .fp_proto = FIB_PROTOCOL_IP4, - }; - - session_rule_table_add_del_args_t args = { - .lcl = lcl_pref, - .rmt = rmt_pref, - .lcl_port = lcl_port, - .rmt_port = rmt_port, - .action_index = action_index++, - .is_add = 1, - }; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 action %d", - action_index - 1); - - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); - SESSION_TEST ((res == 1), - "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 1: %d", - res); - - /* - * Add 1.2.3.4/24 1234 5.6.7.8/16 4321 and 1.2.3.4/24 1234 5.6.7.8/24 4321 - */ - args.lcl.fp_addr.ip4 = lcl_ip; - args.lcl.fp_len = 24; - args.action_index = action_index++; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/24 1234 5.6.7.8/16 4321 action %d", - action_index - 1); - args.rmt.fp_addr.ip4 = rmt_ip; - args.rmt.fp_len = 24; - args.action_index = action_index++; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/24 1234 5.6.7.8/24 4321 action %d", - action_index - 1); - - /* - * Add 2.2.2.2/24 1234 6.6.6.6/16 4321 and 3.3.3.3/24 1234 7.7.7.7/16 4321 - */ - args.lcl.fp_addr.ip4 = lcl_ip2; - args.lcl.fp_len = 24; - args.rmt.fp_addr.ip4 = rmt_ip2; - args.rmt.fp_len = 16; - args.action_index = action_index++; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Add 2.2.2.2/24 1234 6.6.6.6/16 4321 action %d", - action_index - 1); - args.lcl.fp_addr.ip4 = lcl_ip3; - args.rmt.fp_addr.ip4 = rmt_ip3; - args.action_index = action_index++; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Add 3.3.3.3/24 1234 7.7.7.7/16 4321 action %d", - action_index - 1); - - /* - * Add again 3.3.3.3/24 1234 7.7.7.7/16 4321 - */ - args.lcl.fp_addr.ip4 = lcl_ip3; - args.rmt.fp_addr.ip4 = rmt_ip3; - args.action_index = action_index++; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "overwrite 3.3.3.3/24 1234 7.7.7.7/16 4321 " - "action %d", action_index - 1); - - /* - * Lookup 1.2.3.4/32 1234 5.6.7.8/32 4321, 1.2.2.4/32 1234 5.6.7.9/32 4321 - * and 3.3.3.3 1234 7.7.7.7 4321 - */ - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); - SESSION_TEST ((res == 3), - "Lookup 1.2.3.4 1234 5.6.7.8 4321 action " "should be 3: %d", - res); - - lcl_lkup.as_u32 = clib_host_to_net_u32 (0x01020204); - rmt_lkup.as_u32 = clib_host_to_net_u32 (0x05060709); - res = - session_rules_table_lookup4 (srt, &lcl_lkup, - &rmt_lkup, lcl_port, rmt_port); - SESSION_TEST ((res == 1), - "Lookup 1.2.2.4 1234 5.6.7.9 4321, action " "should be 1: %d", - res); - - res = - session_rules_table_lookup4 (srt, &lcl_ip3, &rmt_ip3, lcl_port, rmt_port); - SESSION_TEST ((res == 6), - "Lookup 3.3.3.3 1234 7.7.7.7 4321, action " - "should be 6 (updated): %d", res); - - /* - * Add 1.2.3.4/24 * 5.6.7.8/24 * - * Lookup 1.2.3.4 1234 5.6.7.8 4321 and 1.2.3.4 1235 5.6.7.8 4321 - */ - args.lcl.fp_addr.ip4 = lcl_ip; - args.rmt.fp_addr.ip4 = rmt_ip; - args.lcl.fp_len = 24; - args.rmt.fp_len = 24; - args.lcl_port = 0; - args.rmt_port = 0; - args.action_index = action_index++; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/24 * 5.6.7.8/24 * action %d", - action_index - 1); - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); - SESSION_TEST ((res == 7), - "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should" - " be 7 (lpm dst): %d", res); - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, - lcl_port + 1, rmt_port); - SESSION_TEST ((res == 7), - "Lookup 1.2.3.4 1235 5.6.7.8 4321, action should " "be 7: %d", - res); - - /* - * Del 1.2.3.4/24 * 5.6.7.8/24 * - * Add 1.2.3.4/16 * 5.6.7.8/16 * and 1.2.3.4/24 1235 5.6.7.8/24 4321 - * Lookup 1.2.3.4 1234 5.6.7.8 4321, 1.2.3.4 1235 5.6.7.8 4321 and - * 1.2.3.4 1235 5.6.7.8 4322 - */ - args.is_add = 0; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Del 1.2.3.4/24 * 5.6.7.8/24 *"); - - args.lcl.fp_addr.ip4 = lcl_ip; - args.rmt.fp_addr.ip4 = rmt_ip; - args.lcl.fp_len = 16; - args.rmt.fp_len = 16; - args.lcl_port = 0; - args.rmt_port = 0; - args.action_index = action_index++; - args.is_add = 1; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/16 * 5.6.7.8/16 * action %d", - action_index - 1); - - args.lcl.fp_addr.ip4 = lcl_ip; - args.rmt.fp_addr.ip4 = rmt_ip; - args.lcl.fp_len = 24; - args.rmt.fp_len = 24; - args.lcl_port = lcl_port + 1; - args.rmt_port = rmt_port; - args.action_index = action_index++; - args.is_add = 1; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/24 1235 5.6.7.8/24 4321 action %d", - action_index - 1); - - if (verbose) - session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4); - - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); - SESSION_TEST ((res == 3), - "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d", - res); - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, - lcl_port + 1, rmt_port); - SESSION_TEST ((res == 9), - "Lookup 1.2.3.4 1235 5.6.7.8 4321, action should " "be 9: %d", - res); - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, - lcl_port + 1, rmt_port + 1); - SESSION_TEST ((res == 8), - "Lookup 1.2.3.4 1235 5.6.7.8 4322, action should " "be 8: %d", - res); - - /* - * Delete 1.2.0.0/16 1234 5.6.0.0/16 4321 and 1.2.0.0/16 * 5.6.0.0/16 * - * Lookup 1.2.3.4 1234 5.6.7.8 4321 - */ - args.lcl_port = 1234; - args.rmt_port = 4321; - args.lcl.fp_len = 16; - args.rmt.fp_len = 16; - args.is_add = 0; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Del 1.2.0.0/16 1234 5.6.0.0/16 4321"); - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); - SESSION_TEST ((res == 3), - "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d", - res); - - args.lcl_port = 0; - args.rmt_port = 0; - args.is_add = 0; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Del 1.2.0.0/16 * 5.6.0.0/16 *"); - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); - SESSION_TEST ((res == 3), - "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d", - res); - - /* - * Delete 1.2.3.4/24 1234 5.6.7.5/24 - */ - args.lcl.fp_addr.ip4 = lcl_ip; - args.rmt.fp_addr.ip4 = rmt_ip; - args.lcl.fp_len = 24; - args.rmt.fp_len = 24; - args.lcl_port = 1234; - args.rmt_port = 4321; - args.is_add = 0; - error = session_rules_table_add_del (srt, &args); - SESSION_TEST ((error == 0), "Del 1.2.3.4/24 1234 5.6.7.5/24"); - res = - session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); - SESSION_TEST ((res == 2), "Action should be 2: %d", res); - - return 0; + return -1; } static int -session_test_rules (vlib_main_t * vm, unformat_input_t * input) +api_app_del_cert_key_pair (vat_main_t *vat) { - session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; - u64 options[APP_OPTIONS_N_OPTIONS]; - u16 lcl_port = 1234, rmt_port = 4321; - u32 server_index, server_index2; - u32 dummy_server_api_index = ~0; - transport_connection_t *tc; - u32 dummy_port = 1111; - clib_error_t *error = 0; - u8 is_filtered = 0, *ns_id = format (0, "appns1"); - stream_session_t *listener, *s; - app_namespace_t *default_ns = app_namespace_get_default (); - u32 local_ns_index = default_ns->local_table_index; - int verbose = 0, rv; - app_namespace_t *app_ns; - u64 handle; - - while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (input, "verbose")) - verbose = 1; - else - { - vlib_cli_output (vm, "parse error: '%U'", format_unformat_error, - input); - return -1; - } - } - - server_sep.is_ip4 = 1; - server_sep.port = dummy_port; - memset (options, 0, sizeof (options)); - - vnet_app_attach_args_t attach_args = { - .api_client_index = ~0, - .options = options, - .namespace_id = 0, - .session_cb_vft = &dummy_session_cbs, - .name = format (0, "session_test"), - }; - - vnet_bind_args_t bind_args = { - .sep = server_sep, - .app_index = 0, - }; - - /* - * Attach server with global and local default scope - */ - options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - attach_args.namespace_id = 0; - attach_args.api_client_index = dummy_server_api_index; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "server attached"); - server_index = attach_args.app_index; - - bind_args.app_index = server_index; - error = vnet_bind (&bind_args); - SESSION_TEST ((error == 0), "server bound to %U/%d", format_ip46_address, - &server_sep.ip, 1, server_sep.port); - listener = listen_session_get_from_handle (bind_args.handle); - ip4_address_t lcl_ip = { - .as_u32 = clib_host_to_net_u32 (0x01020304), - }; - ip4_address_t rmt_ip = { - .as_u32 = clib_host_to_net_u32 (0x05060708), - }; - fib_prefix_t lcl_pref = { - .fp_addr.ip4.as_u32 = lcl_ip.as_u32, - .fp_len = 16, - .fp_proto = FIB_PROTOCOL_IP4, - }; - fib_prefix_t rmt_pref = { - .fp_addr.ip4.as_u32 = rmt_ip.as_u32, - .fp_len = 16, - .fp_proto = FIB_PROTOCOL_IP4, - }; - - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc == 0), "optimized lookup should not work (port)"); - - /* - * Add 1.2.3.4/16 1234 5.6.7.8/16 4321 action server_index - */ - session_rule_add_del_args_t args = { - .table_args.lcl = lcl_pref, - .table_args.rmt = rmt_pref, - .table_args.lcl_port = lcl_port, - .table_args.rmt_port = rmt_port, - .table_args.action_index = server_index, - .table_args.is_add = 1, - .appns_index = 0, - }; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 action %d", - args.table_args.action_index); - - tc = session_lookup_connection4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, - TRANSPORT_PROTO_TCP); - SESSION_TEST ((tc->c_index == listener->connection_index), - "optimized lookup should return the listener"); - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc->c_index == listener->connection_index), - "lookup should return the listener"); - s = session_lookup_safe4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, - lcl_port, rmt_port, TRANSPORT_PROTO_TCP); - SESSION_TEST ((s->connection_index == listener->connection_index), - "safe lookup should return the listener"); - session_endpoint_t sep = { - .ip = rmt_pref.fp_addr, - .is_ip4 = 1, - .port = rmt_port, - .transport_proto = TRANSPORT_PROTO_TCP, - }; - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle != server_index), "local session endpoint lookup " - "should not work (global scope)"); - - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port + 1, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc == 0), - "optimized lookup for wrong lcl port + 1 should not work"); - - /* - * Add 1.2.3.4/16 * 5.6.7.8/16 4321 - */ - args.table_args.lcl_port = 0; - args.scope = SESSION_RULE_SCOPE_LOCAL | SESSION_RULE_SCOPE_GLOBAL; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/16 * 5.6.7.8/16 4321 action %d", - args.table_args.action_index); - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port + 1, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc->c_index == listener->connection_index), - "optimized lookup for lcl port + 1 should work"); - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle == server_index), "local session endpoint lookup " - "should work (lcl ip was zeroed)"); - - /* - * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) - */ - args.table_args.lcl_port = 1234; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 30; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 30; - args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/30 1234 5.6.7.8/30 4321 action %d", - args.table_args.action_index); - - if (verbose) - { - session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); - session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); - } - - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 " - "should fail (deny rule)"); - SESSION_TEST ((is_filtered == 1), "lookup should be filtered (deny)"); - - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " - "5.6.7.8/16 4321 in local table should return deny"); - - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port + 1, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc->c_index == listener->connection_index), - "lookup 1.2.3.4/32 123*5* 5.6.7.8/16 4321 should work"); - - /* - * "Mask" deny rule with more specific allow: - * Add allow rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -3 (allow) - */ - args.table_args.is_add = 1; - args.table_args.lcl_port = 1234; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 32; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 32; - args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add masking rule 1.2.3.4/30 1234 5.6.7.8/32 " - "4321 action %d", args.table_args.action_index); - - is_filtered = 0; - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 " - "should fail (allow without app)"); - SESSION_TEST ((is_filtered == 0), "lookup should NOT be filtered"); - - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "lookup for 1.2.3.4/32 " - "1234 5.6.7.8/32 4321 in local table should return invalid"); - - if (verbose) - { - vlib_cli_output (vm, "Local rules"); - session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); - } - - sep.ip.ip4.as_u32 += 1 << 24; - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234" - " 5.6.7.9/32 4321 in local table should return deny"); - - vnet_connect_args_t connect_args = { - .app_index = attach_args.app_index, - .api_context = 0, - }; - clib_memcpy (&connect_args.sep, &sep, sizeof (sep)); - - /* Try connecting */ - error = vnet_connect (&connect_args); - SESSION_TEST ((error != 0), "connect should fail"); - rv = clib_error_get_code (error); - SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), - "connect should be filtered"); - - sep.ip.ip4.as_u32 -= 1 << 24; - - /* - * Delete masking rule: 1.2.3.4/32 1234 5.6.7.8/32 4321 allow - */ - args.table_args.is_add = 0; - args.table_args.lcl_port = 1234; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 32; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 32; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 allow"); + return -1; +} +static int +api_app_add_cert_key_pair (vat_main_t *vat) +{ + return -1; +} - /* - * Add local scope rule for 0/0 * 5.6.7.8/16 4321 action server_index - */ - args.table_args.is_add = 1; - args.table_args.lcl_port = 0; - args.table_args.lcl.fp_len = 0; - args.table_args.rmt.fp_len = 16; - args.table_args.action_index = -1; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add * * 5.6.7.8/16 4321 action %d", - args.table_args.action_index); +static int +api_session_rules_dump (vat_main_t *vam) +{ + vl_api_session_rules_dump_t *mp; + vl_api_control_ping_t *mp_ping; + int ret; - if (verbose) + if (!vam->json_output) { - session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); - session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); + print (vam->ofp, "%=20s", "Session Rules"); } - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle == SESSION_DROP_HANDLE), - "local session endpoint lookup should return deny"); - - /* - * Delete 1.2.3.4/32 1234 5.6.7.8/32 4321 deny - */ - args.table_args.is_add = 0; - args.table_args.lcl_port = 1234; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 30; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 30; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny"); - - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle == SESSION_INVALID_HANDLE), - "local session endpoint lookup should return invalid"); - - /* - * Delete 0/0 * 5.6.7.8/16 4321, 1.2.3.4/16 * 5.6.7.8/16 4321 and - * 1.2.3.4/16 1234 5.6.7.8/16 4321 - */ - args.table_args.is_add = 0; - args.table_args.lcl_port = 0; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 0; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 16; - args.table_args.rmt_port = 4321; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Del 0/0 * 5.6.7.8/16 4321"); - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle != server_index), "local session endpoint lookup " - "should not work (removed)"); + M (SESSION_RULES_DUMP, mp); + /* send it... */ + S (mp); - args.table_args.is_add = 0; - args.table_args.lcl = lcl_pref; + /* Use a control ping for synchronization */ + PING (&session_test_main, mp_ping); + S (mp_ping); - args.table_args.is_add = 0; - args.table_args.lcl_port = 0; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 16; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 16; - args.table_args.rmt_port = 4321; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Del 1.2.3.4/16 * 5.6.7.8/16 4321"); - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port + 1, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc == 0), - "lookup 1.2.3.4/32 123*5* 5.6.7.8/16 4321 should not " - "work (del)"); + /* Wait for a reply... */ + W (ret); + return ret; +} - args.table_args.is_add = 0; - args.table_args.lcl_port = 1234; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 16; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 16; - args.table_args.rmt_port = 4321; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Del 1.2.3.4/16 1234 5.6.7.8/16 4321"); - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should " - "not work (del + deny)"); +static void +vl_api_session_rules_details_t_handler (vl_api_session_rules_details_t *mp) +{ + vat_main_t *vam = &vat_main; + fib_prefix_t lcl, rmt; - SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny"); - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should" - " not work (no-rule)"); + ip_prefix_decode (&mp->lcl, &lcl); + ip_prefix_decode (&mp->rmt, &rmt); - /* - * Test tags. Add/overwrite/del rule with tag - */ - args.table_args.is_add = 1; - args.table_args.lcl_port = 1234; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 16; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 16; - args.table_args.rmt_port = 4321; - args.table_args.tag = format (0, "test_rule"); - args.table_args.action_index = server_index; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 deny " - "tag test_rule"); - if (verbose) + if (lcl.fp_proto == FIB_PROTOCOL_IP4) { - session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); - session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); + print (vam->ofp, + "appns %u tp %u scope %d %U/%d %d %U/%d %d action: %d tag: %s", + clib_net_to_host_u32 (mp->appns_index), mp->transport_proto, + mp->scope, format_ip4_address, &lcl.fp_addr.ip4, lcl.fp_len, + clib_net_to_host_u16 (mp->lcl_port), format_ip4_address, + &rmt.fp_addr.ip4, rmt.fp_len, clib_net_to_host_u16 (mp->rmt_port), + clib_net_to_host_u32 (mp->action_index), mp->tag); } - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc->c_index == listener->connection_index), - "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should work"); - - vec_free (args.table_args.tag); - args.table_args.lcl_port = 1234; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 16; - args.table_args.tag = format (0, "test_rule_overwrite"); - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), - "Overwrite 1.2.3.4/16 1234 5.6.7.8/16 4321 deny tag test_rule" - " should work"); - if (verbose) + else { - session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); - session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); + print (vam->ofp, + "appns %u tp %u scope %d %U/%d %d %U/%d %d action: %d tag: %s", + clib_net_to_host_u32 (mp->appns_index), mp->transport_proto, + mp->scope, format_ip6_address, &lcl.fp_addr.ip6, lcl.fp_len, + clib_net_to_host_u16 (mp->lcl_port), format_ip6_address, + &rmt.fp_addr.ip6, rmt.fp_len, clib_net_to_host_u16 (mp->rmt_port), + clib_net_to_host_u32 (mp->action_index), mp->tag); } +} - args.table_args.is_add = 0; - args.table_args.lcl_port += 1; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny " - "tag %v", args.table_args.tag); - if (verbose) +static void +vl_api_app_namespace_add_del_reply_t_handler ( + vl_api_app_namespace_add_del_reply_t *mp) +{ + vat_main_t *vam = &vat_main; + i32 retval = ntohl (mp->retval); + if (vam->async_mode) { - session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); - session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); + vam->async_errors += (retval < 0); } - tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, - &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0, - &is_filtered); - SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/32 4321 should not" - " work (del)"); - - - /* - * Test local rules with multiple namespaces - */ - - /* - * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) - */ - args.table_args.is_add = 1; - args.table_args.lcl_port = 1234; - args.table_args.rmt_port = 0; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 32; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 32; - args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; - args.table_args.tag = 0; - args.scope = SESSION_RULE_SCOPE_LOCAL; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d", - args.table_args.action_index); - /* - * Add 'white' rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) - */ - args.table_args.is_add = 1; - args.table_args.lcl_port = 1234; - args.table_args.rmt_port = 4321; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 32; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 32; - args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW; - error = vnet_session_rule_add_del (&args); - - if (verbose) + else { - session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); + vam->retval = retval; + if (retval == 0) + errmsg ("app ns index %d\n", ntohl (mp->appns_index)); + vam->result_ready = 1; } +} - vnet_app_namespace_add_del_args_t ns_args = { - .ns_id = ns_id, - .secret = 0, - .sw_if_index = APP_NAMESPACE_INVALID_INDEX, - .is_add = 1 - }; - error = vnet_app_namespace_add_del (&ns_args); - SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", - clib_error_get_code (error)); - app_ns = app_namespace_get_from_id (ns_id); - - attach_args.namespace_id = ns_id; - attach_args.api_client_index = dummy_server_api_index - 1; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "server2 attached"); - server_index2 = attach_args.app_index; - - /* - * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) - */ - args.table_args.lcl_port = 1234; - args.table_args.rmt_port = 0; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 32; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 32; - args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; - args.appns_index = app_namespace_index (app_ns); - - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d " - "in test namespace", args.table_args.action_index); - /* - * Lookup default namespace - */ - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle == SESSION_INVALID_HANDLE), - "lookup for 1.2.3.4/32 1234 5.6.7.8/32 4321 in local table " - "should return allow (invalid)"); - - sep.port += 1; - handle = session_lookup_local_endpoint (local_ns_index, &sep); - SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " - "5.6.7.8/16 432*2* in local table should return deny"); - - - connect_args.app_index = server_index; - clib_memcpy (&connect_args.sep, &sep, sizeof (sep)); - - error = vnet_connect (&connect_args); - SESSION_TEST ((error != 0), "connect should fail"); - rv = clib_error_get_code (error); - SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), - "connect should be filtered"); - - /* - * Lookup test namespace - */ - handle = session_lookup_local_endpoint (app_ns->local_table_index, &sep); - SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " - "5.6.7.8/16 4321 in local table should return deny"); - - connect_args.app_index = server_index; - error = vnet_connect (&connect_args); - SESSION_TEST ((error != 0), "connect should fail"); - rv = clib_error_get_code (error); - SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), - "connect should be filtered"); - - args.table_args.is_add = 0; - vnet_session_rule_add_del (&args); - - args.appns_index = 0; - args.table_args.is_add = 0; - vnet_session_rule_add_del (&args); +static void +vl_api_app_namespace_add_del_v2_reply_t_handler ( + vl_api_app_namespace_add_del_v2_reply_t *vat) +{ +} - args.table_args.rmt_port = 4321; - vnet_session_rule_add_del (&args); - /* - * Final Cleanup - */ - vec_free (args.table_args.tag); - vnet_app_detach_args_t detach_args = { - .app_index = server_index, - }; - vnet_application_detach (&detach_args); +static void +vl_api_app_worker_add_del_reply_t_handler ( + vl_api_app_worker_add_del_reply_t *vat) +{ +} - detach_args.app_index = server_index2; - vnet_application_detach (&detach_args); +static int +api_app_namespace_add_del_v2 (vat_main_t *vat) +{ + return -1; +} - vec_free (ns_id); - vec_free (attach_args.name); - return 0; +static int +api_session_enable_disable (vat_main_t *vat) +{ + return -1; } static int -session_test_proxy (vlib_main_t * vm, unformat_input_t * input) +api_app_worker_add_del (vat_main_t *vat) { - u64 options[APP_OPTIONS_N_OPTIONS]; - char *show_listeners = "sh session listeners tcp verbose"; - char *show_local_listeners = "sh app ns table default"; - unformat_input_t tmp_input; - u32 server_index, app_index; - u32 dummy_server_api_index = ~0, sw_if_index = 0; - clib_error_t *error = 0; - u8 is_filtered = 0; - stream_session_t *s; - transport_connection_t *tc; - u16 lcl_port = 1234, rmt_port = 4321; - app_namespace_t *app_ns; - int verbose = 0; + return -1; +} - while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) +static int +api_app_namespace_add_del (vat_main_t *vam) +{ + vl_api_app_namespace_add_del_t *mp; + unformat_input_t *i = vam->input; + u8 *ns_id = 0, secret_set = 0, sw_if_index_set = 0; + u32 sw_if_index, ip4_fib_id, ip6_fib_id; + u64 secret; + int ret; + + while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT) { - if (unformat (input, "verbose")) - verbose = 1; + if (unformat (i, "id %_%v%_", &ns_id)) + ; + else if (unformat (i, "secret %lu", &secret)) + secret_set = 1; + else if (unformat (i, "sw_if_index %d", &sw_if_index)) + sw_if_index_set = 1; + else if (unformat (i, "ip4_fib_id %d", &ip4_fib_id)) + ; + else if (unformat (i, "ip6_fib_id %d", &ip6_fib_id)) + ; else - { - vlib_cli_output (vm, "parse error: '%U'", format_unformat_error, - input); - return -1; - } + break; } - - ip4_address_t lcl_ip = { - .as_u32 = clib_host_to_net_u32 (0x01020304), - }; - ip4_address_t rmt_ip = { - .as_u32 = clib_host_to_net_u32 (0x05060708), - }; - fib_prefix_t rmt_pref = { - .fp_addr.ip4.as_u32 = rmt_ip.as_u32, - .fp_len = 16, - .fp_proto = FIB_PROTOCOL_IP4, - }; - session_endpoint_t sep = { - .ip = rmt_pref.fp_addr, - .is_ip4 = 1, - .port = rmt_port, - .transport_proto = TRANSPORT_PROTO_TCP, - }; - - /* - * Create loopback interface - */ - session_create_lookpback (0, &sw_if_index, &lcl_ip); - - app_ns = app_namespace_get_default (); - app_ns->sw_if_index = sw_if_index; - - memset (options, 0, sizeof (options)); - options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_IS_PROXY; - options[APP_OPTIONS_PROXY_TRANSPORT] = 1 << TRANSPORT_PROTO_TCP; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; - vnet_app_attach_args_t attach_args = { - .api_client_index = ~0, - .options = options, - .namespace_id = 0, - .session_cb_vft = &dummy_session_cbs, - .name = format (0, "session_test"), - }; - - attach_args.api_client_index = dummy_server_api_index; - error = vnet_application_attach (&attach_args); - SESSION_TEST ((error == 0), "server attachment should work"); - server_index = attach_args.app_index; - - if (verbose) + if (!ns_id || !secret_set || !sw_if_index_set) { - unformat_init_string (&tmp_input, show_listeners, - strlen (show_listeners)); - vlib_cli_input (vm, &tmp_input, 0, 0); - unformat_init_string (&tmp_input, show_local_listeners, - strlen (show_local_listeners)); - vlib_cli_input (vm, &tmp_input, 0, 0); + errmsg ("namespace id, secret and sw_if_index must be set"); + return -99; } - - tc = session_lookup_connection_wt4 (0, &lcl_ip, &rmt_ip, lcl_port, rmt_port, - TRANSPORT_PROTO_TCP, 0, &is_filtered); - SESSION_TEST ((tc != 0), "lookup 1.2.3.4 1234 5.6.7.8 4321 should be " - "successful"); - s = listen_session_get (tc->s_index); - SESSION_TEST ((s->app_index == server_index), "lookup should return the" - " server"); - - tc = session_lookup_connection_wt4 (0, &rmt_ip, &rmt_ip, lcl_port, rmt_port, - TRANSPORT_PROTO_TCP, 0, &is_filtered); - SESSION_TEST ((tc == 0), "lookup 5.6.7.8 1234 5.6.7.8 4321 should" - " not work"); - - app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep); - SESSION_TEST ((app_index == server_index), "local session endpoint lookup" - " should work"); - - vnet_app_detach_args_t detach_args = { - .app_index = server_index, - }; - vnet_application_detach (&detach_args); - - if (verbose) + if (vec_len (ns_id) > 64) { - unformat_init_string (&tmp_input, show_listeners, - strlen (show_listeners)); - vlib_cli_input (vm, &tmp_input, 0, 0); - unformat_init_string (&tmp_input, show_local_listeners, - strlen (show_local_listeners)); - vlib_cli_input (vm, &tmp_input, 0, 0); + errmsg ("namespace id too long"); + return -99; } + M (APP_NAMESPACE_ADD_DEL, mp); - app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep); - SESSION_TEST ((app_index == SESSION_RULES_TABLE_INVALID_INDEX), - "local session endpoint lookup should not work after detach"); - if (verbose) - unformat_free (&tmp_input); - vec_free (attach_args.name); - return 0; + vl_api_vec_to_api_string (ns_id, &mp->namespace_id); + mp->secret = clib_host_to_net_u64 (secret); + mp->sw_if_index = clib_host_to_net_u32 (sw_if_index); + mp->ip4_fib_id = clib_host_to_net_u32 (ip4_fib_id); + mp->ip6_fib_id = clib_host_to_net_u32 (ip6_fib_id); + vec_free (ns_id); + S (mp); + W (ret); + return ret; } -static clib_error_t * -session_test (vlib_main_t * vm, - unformat_input_t * input, vlib_cli_command_t * cmd_arg) +static void +vl_api_app_namespace_add_del_v4_reply_t_handler ( + vl_api_app_namespace_add_del_v4_reply_t *mp) { - int res = 0; +} - vnet_session_enable_disable (vm, 1); +static int +api_app_namespace_add_del_v4 (vat_main_t *vat) +{ + return -1; +} - while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (input, "basic")) - res = session_test_basic (vm, input); - else if (unformat (input, "namespace")) - res = session_test_namespace (vm, input); - else if (unformat (input, "rules-table")) - res = session_test_rule_table (vm, input); - else if (unformat (input, "rules")) - res = session_test_rules (vm, input); - else if (unformat (input, "proxy")) - res = session_test_proxy (vm, input); - else if (unformat (input, "all")) - { - if ((res = session_test_basic (vm, input))) - goto done; - if ((res = session_test_namespace (vm, input))) - goto done; - if ((res = session_test_rule_table (vm, input))) - goto done; - if ((res = session_test_rules (vm, input))) - goto done; - if ((res = session_test_proxy (vm, input))) - goto done; - } - else - break; - } +static void +vl_api_app_namespace_add_del_v3_reply_t_handler ( + vl_api_app_namespace_add_del_v3_reply_t *mp) +{ +} -done: - if (res) - return clib_error_return (0, "Session unit test failed"); - return 0; +static int +api_app_namespace_add_del_v3 (vat_main_t *vat) +{ + return -1; } -/* *INDENT-OFF* */ -VLIB_CLI_COMMAND (tcp_test_command, static) = +static int +api_session_sapi_enable_disable (vat_main_t *vat) { - .path = "test session", - .short_help = "internal session unit tests", - .function = session_test, -}; -/* *INDENT-ON* */ + return -1; +} + +#include /* - * fd.io coding-style-patch-verification: ON - * * Local Variables: * eval: (c-set-style "gnu") * End: