X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fsession%2Fsession_test.c;h=a9a902d27bcc286f937e19e9aed2b5cd06f07017;hb=b384b543313b6b47a277c903e9d4fcd4343054fa;hp=58d0d28ff6c346181cb9a89f5d41135f76ad019d;hpb=dff48db0782444125f68cab14d91e7bb4109286a;p=vpp.git diff --git a/src/vnet/session/session_test.c b/src/vnet/session/session_test.c index 58d0d28ff6c..a9a902d27bc 100644 --- a/src/vnet/session/session_test.c +++ b/src/vnet/session/session_test.c @@ -102,8 +102,7 @@ static int session_test_basic (vlib_main_t * vm, unformat_input_t * input) { session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; - u64 options[SESSION_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle; - u8 segment_name[128]; + u64 options[APP_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle; clib_error_t *error = 0; u32 server_index; @@ -117,7 +116,6 @@ session_test_basic (vlib_main_t * vm, unformat_input_t * input) .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, - .segment_name = segment_name, }; error = vnet_application_attach (&attach_args); @@ -167,7 +165,7 @@ session_test_basic (vlib_main_t * vm, unformat_input_t * input) static int session_test_namespace (vlib_main_t * vm, unformat_input_t * input) { - u64 options[SESSION_OPTIONS_N_OPTIONS], dummy_secret = 1234; + u64 options[APP_OPTIONS_N_OPTIONS], dummy_secret = 1234; u32 server_index, server_st_index, server_local_st_index; u32 dummy_port = 1234, local_listener, client_index; u32 dummy_api_context = 4321, dummy_client_api_index = 1234; @@ -178,7 +176,6 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) clib_error_t *error = 0; u8 *ns_id = format (0, "appns1"), intf_mac[6]; app_namespace_t *app_ns; - u8 segment_name[128]; application_t *server; stream_session_t *s; int code; @@ -197,7 +194,6 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, - .segment_name = segment_name, }; vnet_bind_args_t bind_args = { @@ -774,18 +770,19 @@ static int session_test_rules (vlib_main_t * vm, unformat_input_t * input) { session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; - u64 options[SESSION_OPTIONS_N_OPTIONS]; + u64 options[APP_OPTIONS_N_OPTIONS]; u16 lcl_port = 1234, rmt_port = 4321; - u32 server_index, app_index; + u32 server_index, server_index2, app_index; u32 dummy_server_api_index = ~0; transport_connection_t *tc; u32 dummy_port = 1111; clib_error_t *error = 0; - u8 segment_name[128], is_filtered = 0; + u8 is_filtered = 0, *ns_id = format (0, "appns1"); stream_session_t *listener, *s; app_namespace_t *default_ns = app_namespace_get_default (); u32 local_ns_index = default_ns->local_table_index; int verbose = 0, rv; + app_namespace_t *app_ns; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { @@ -808,7 +805,6 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, - .segment_name = segment_name, }; vnet_bind_args_t bind_args = { @@ -989,7 +985,7 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) app_index = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((app_index == APP_INVALID_INDEX), "lookup for 1.2.3.4/32 1234" - " 5.6.7.8/16 4321 in local table should return invalid"); + " 5.6.7.8/32 4321 in local table should return invalid"); if (verbose) { @@ -1001,7 +997,7 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) sep.ip.ip4.as_u32 += 1 << 24; app_index = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234" - " 5.6.7.9/16 4321 in local table should return invalid"); + " 5.6.7.9/32 4321 in local table should return deny"); vnet_connect_args_t connect_args = { .sep = sep, @@ -1135,7 +1131,7 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) " not work (no-rule)"); /* - * Test tags. Add/del rule with tag + * Test tags. Add/overwrite/del rule with tag */ args.table_args.is_add = 1; args.table_args.lcl_port = 1234; @@ -1163,9 +1159,28 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) SESSION_TEST ((tc->c_index == listener->connection_index), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should work"); + vec_free (args.table_args.tag); + args.table_args.lcl_port = 1234; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 16; + args.table_args.tag = format (0, "test_rule_overwrite"); + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), + "Overwrite 1.2.3.4/16 1234 5.6.7.8/16 4321 deny tag test_rule" + " should work"); + if (verbose) + { + session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + } + args.table_args.is_add = 0; args.table_args.lcl_port += 1; error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny " + "tag %v", args.table_args.tag); if (verbose) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, @@ -1173,33 +1188,156 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } - SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny " - "tag test_rule"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); - SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should not" + SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/32 4321 should not" " work (del)"); + + + /* + * Test local rules with multiple namespaces + */ + + /* + * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) + */ + args.table_args.is_add = 1; + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 0; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; + args.table_args.tag = 0; + args.scope = SESSION_RULE_SCOPE_LOCAL; + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d", + args.table_args.action_index); + /* + * Add 'white' rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) + */ + args.table_args.is_add = 1; + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 4321; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW; + error = vnet_session_rule_add_del (&args); + + if (verbose) + { + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + } + + vnet_app_namespace_add_del_args_t ns_args = { + .ns_id = ns_id, + .secret = 0, + .sw_if_index = APP_NAMESPACE_INVALID_INDEX, + .is_add = 1 + }; + error = vnet_app_namespace_add_del (&ns_args); + SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", + clib_error_get_code (error)); + app_ns = app_namespace_get_from_id (ns_id); + + attach_args.namespace_id = ns_id; + attach_args.api_client_index = dummy_server_api_index - 1; + error = vnet_application_attach (&attach_args); + SESSION_TEST ((error == 0), "server2 attached"); + server_index2 = attach_args.app_index; + + /* + * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) + */ + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 0; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; + args.appns_index = app_namespace_index (app_ns); + + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d " + "in test namespace", args.table_args.action_index); + /* + * Lookup default namespace + */ + app_index = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((app_index == APP_INVALID_INDEX), + "lookup for 1.2.3.4/32 1234 5.6.7.8/32 4321 in local table " + "should return allow (invalid)"); + + sep.port += 1; + app_index = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234 " + "5.6.7.8/16 432*2* in local table should return deny"); + + connect_args.app_index = server_index; + connect_args.sep = sep; + error = vnet_connect (&connect_args); + SESSION_TEST ((error != 0), "connect should fail"); + rv = clib_error_get_code (error); + SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), + "connect should be filtered"); + + /* + * Lookup test namespace + */ + app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep); + SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234 " + "5.6.7.8/16 4321 in local table should return deny"); + + connect_args.app_index = server_index; + error = vnet_connect (&connect_args); + SESSION_TEST ((error != 0), "connect should fail"); + rv = clib_error_get_code (error); + SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), + "connect should be filtered"); + + args.table_args.is_add = 0; + vnet_session_rule_add_del (&args); + + args.appns_index = 0; + args.table_args.is_add = 0; + vnet_session_rule_add_del (&args); + + args.table_args.rmt_port = 4321; + vnet_session_rule_add_del (&args); + /* + * Final Cleanup + */ vec_free (args.table_args.tag); vnet_app_detach_args_t detach_args = { .app_index = server_index, }; vnet_application_detach (&detach_args); + + detach_args.app_index = server_index2; + vnet_application_detach (&detach_args); + + vec_free (ns_id); return 0; } static int session_test_proxy (vlib_main_t * vm, unformat_input_t * input) { - u64 options[SESSION_OPTIONS_N_OPTIONS]; + u64 options[APP_OPTIONS_N_OPTIONS]; char *show_listeners = "sh session listeners tcp verbose"; char *show_local_listeners = "sh app ns table default"; unformat_input_t tmp_input; u32 server_index, app_index; u32 dummy_server_api_index = ~0, sw_if_index = 0; clib_error_t *error = 0; - u8 segment_name[128], intf_mac[6], sst, is_filtered = 0; + u8 intf_mac[6], sst, is_filtered = 0; stream_session_t *s; transport_connection_t *tc; u16 lcl_port = 1234, rmt_port = 4321; @@ -1264,7 +1402,6 @@ session_test_proxy (vlib_main_t * vm, unformat_input_t * input) .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, - .segment_name = segment_name, }; attach_args.api_client_index = dummy_server_api_index;