X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fsession%2Fsession_test.c;h=ceac703994061ae437616ca0ba8cd82100ae7181;hb=8f89dd0;hp=56d40b81ef8deb463e96fc199bf0fbba31132eaa;hpb=4e4531e4b10883be8c320ff3b9acd4950135f5f0;p=vpp.git diff --git a/src/vnet/session/session_test.c b/src/vnet/session/session_test.c index 56d40b81ef8..ceac7039940 100644 --- a/src/vnet/session/session_test.c +++ b/src/vnet/session/session_test.c @@ -53,18 +53,20 @@ dummy_session_connected_callback (u32 app_index, u32 api_context, return -1; } +static u32 dummy_segment_count; + int -dummy_add_segment_callback (u32 client_index, const u8 * seg_name, - u32 seg_size) +dummy_add_segment_callback (u32 client_index, const ssvm_private_t * fs) { - clib_warning ("called..."); - return -1; + dummy_segment_count = 1; + return 0; } int -dummy_redirect_connect_callback (u32 client_index, void *mp) +dummy_del_segment_callback (u32 client_index, const ssvm_private_t * fs) { - return VNET_API_ERROR_SESSION_REDIRECT; + dummy_segment_count = 0; + return 0; } void @@ -73,11 +75,14 @@ dummy_session_disconnect_callback (stream_session_t * s) clib_warning ("called..."); } +static u32 dummy_accept; + int dummy_session_accept_callback (stream_session_t * s) { - clib_warning ("called..."); - return -1; + dummy_accept = 1; + s->session_state = SESSION_STATE_READY; + return 0; } int @@ -93,23 +98,60 @@ static session_cb_vft_t dummy_session_cbs = { .session_connected_callback = dummy_session_connected_callback, .session_accept_callback = dummy_session_accept_callback, .session_disconnect_callback = dummy_session_disconnect_callback, - .builtin_server_rx_callback = dummy_server_rx_callback, - .redirect_connect_callback = dummy_redirect_connect_callback, + .builtin_app_rx_callback = dummy_server_rx_callback, + .add_segment_callback = dummy_add_segment_callback, + .del_segment_callback = dummy_del_segment_callback, }; /* *INDENT-ON* */ +static int +session_create_lookpback (u32 table_id, u32 * sw_if_index, + ip4_address_t * intf_addr) +{ + u8 intf_mac[6]; + + memset (intf_mac, 0, sizeof (intf_mac)); + + if (vnet_create_loopback_interface (sw_if_index, intf_mac, 0, 0)) + { + clib_warning ("couldn't create loopback. stopping the test!"); + return -1; + } + + if (table_id != 0) + ip_table_bind (FIB_PROTOCOL_IP4, *sw_if_index, table_id, 0); + + vnet_sw_interface_set_flags (vnet_get_main (), *sw_if_index, + VNET_SW_INTERFACE_FLAG_ADMIN_UP); + + if (ip4_add_del_interface_address (vlib_get_main (), *sw_if_index, + intf_addr, 24, 0)) + { + clib_warning ("couldn't assign loopback ip %U", format_ip4_address, + intf_addr); + return -1; + } + + return 0; +} + +static void +session_delete_loopback (u32 sw_if_index) +{ + /* fails spectacularly */ + /* vnet_delete_loopback_interface (sw_if_index); */ +} + static int session_test_basic (vlib_main_t * vm, unformat_input_t * input) { session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; - u64 options[SESSION_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle; - u8 segment_name[128]; + u64 options[APP_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle; clib_error_t *error = 0; u32 server_index; memset (options, 0, sizeof (options)); options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; vnet_app_attach_args_t attach_args = { @@ -117,7 +159,6 @@ session_test_basic (vlib_main_t * vm, unformat_input_t * input) .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, - .segment_name = segment_name, }; error = vnet_application_attach (&attach_args); @@ -167,20 +208,20 @@ session_test_basic (vlib_main_t * vm, unformat_input_t * input) static int session_test_namespace (vlib_main_t * vm, unformat_input_t * input) { - u64 options[SESSION_OPTIONS_N_OPTIONS], dummy_secret = 1234; + u64 options[APP_OPTIONS_N_OPTIONS], dummy_secret = 1234; u32 server_index, server_st_index, server_local_st_index; - u32 dummy_port = 1234, local_listener, client_index; + u32 dummy_port = 1234, client_index; u32 dummy_api_context = 4321, dummy_client_api_index = 1234; u32 dummy_server_api_index = ~0, sw_if_index = 0; session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; session_endpoint_t client_sep = SESSION_ENDPOINT_NULL; session_endpoint_t intf_sep = SESSION_ENDPOINT_NULL; clib_error_t *error = 0; - u8 *ns_id = format (0, "appns1"), intf_mac[6]; + u8 *ns_id = format (0, "appns1"); app_namespace_t *app_ns; - u8 segment_name[128]; application_t *server; stream_session_t *s; + u64 handle; int code; server_sep.is_ip4 = 1; @@ -188,16 +229,13 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) client_sep.is_ip4 = 1; client_sep.port = dummy_port; memset (options, 0, sizeof (options)); - memset (intf_mac, 0, sizeof (intf_mac)); options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT; vnet_app_attach_args_t attach_args = { .api_client_index = ~0, .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, - .segment_name = segment_name, }; vnet_bind_args_t bind_args = { @@ -206,10 +244,10 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) }; vnet_connect_args_t connect_args = { - .sep = client_sep, .app_index = 0, .api_context = 0, }; + clib_memcpy (&connect_args.sep, &client_sep, sizeof (client_sep)); vnet_unbind_args_t unbind_args = { .handle = bind_args.handle, @@ -328,10 +366,8 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) SESSION_TEST ((s->app_index == server_index), "app_index should be that of " "the server"); server_local_st_index = application_local_session_table (server); - local_listener = - session_lookup_local_session_endpoint (server_local_st_index, - &server_sep); - SESSION_TEST ((local_listener != SESSION_INVALID_INDEX), + handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); + SESSION_TEST ((handle != SESSION_INVALID_HANDLE), "listener should exist in local table"); /* @@ -349,12 +385,15 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) code = clib_error_get_code (error); SESSION_TEST ((code == VNET_API_ERROR_INVALID_VALUE), "error code should be invalid value (zero ip)"); + SESSION_TEST ((dummy_segment_count == 0), + "shouldn't have received request to map new segment"); connect_args.sep.ip.ip4.as_u8[0] = 127; error = vnet_connect (&connect_args); - SESSION_TEST ((error != 0), "client connect should return error code"); + SESSION_TEST ((error == 0), "client connect should not return error code"); code = clib_error_get_code (error); - SESSION_TEST ((code == VNET_API_ERROR_SESSION_REDIRECT), - "error code should be redirect"); + SESSION_TEST ((dummy_segment_count == 1), + "should've received request to map new segment"); + SESSION_TEST ((dummy_accept == 1), "should've received accept request"); detach_args.app_index = client_index; vnet_application_detach (&detach_args); @@ -381,10 +420,9 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) s = session_lookup_listener (server_st_index, &server_sep); SESSION_TEST ((s == 0), "listener should not exist in global table"); - local_listener = - session_lookup_local_session_endpoint (server_local_st_index, - &server_sep); - SESSION_TEST ((s == 0), "listener should not exist in local table"); + handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); + SESSION_TEST ((handle == SESSION_INVALID_HANDLE), + "listener should not exist in local table"); detach_args.app_index = server_index; vnet_application_detach (&detach_args); @@ -407,20 +445,16 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) s = session_lookup_listener (server_st_index, &server_sep); SESSION_TEST ((s == 0), "listener should not exist in global table"); server_local_st_index = application_local_session_table (server); - local_listener = - session_lookup_local_session_endpoint (server_local_st_index, - &server_sep); - SESSION_TEST ((local_listener != SESSION_INVALID_INDEX), + handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); + SESSION_TEST ((handle != SESSION_INVALID_HANDLE), "listener should exist in local table"); unbind_args.handle = bind_args.handle; error = vnet_unbind (&unbind_args); SESSION_TEST ((error == 0), "unbind should work"); - local_listener = - session_lookup_local_session_endpoint (server_local_st_index, - &server_sep); - SESSION_TEST ((local_listener == SESSION_INVALID_INDEX), + handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); + SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "listener should not exist in local table"); /* @@ -448,15 +482,7 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) /* * Create loopback interface */ - if (vnet_create_loopback_interface (&sw_if_index, intf_mac, 0, 0)) - { - clib_warning ("couldn't create loopback. stopping the test!"); - return 0; - } - vnet_sw_interface_set_flags (vnet_get_main (), sw_if_index, - VNET_SW_INTERFACE_FLAG_ADMIN_UP); - ip4_add_del_interface_address (vlib_get_main (), sw_if_index, &intf_addr, - 24, 0); + session_create_lookpback (0, &sw_if_index, &intf_addr); /* * Update namespace @@ -489,10 +515,8 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) SESSION_TEST ((s->app_index == server_index), "app_index should be that of " "the server"); server_local_st_index = application_local_session_table (server); - local_listener = - session_lookup_local_session_endpoint (server_local_st_index, - &server_sep); - SESSION_TEST ((local_listener != SESSION_INVALID_INDEX), + handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); + SESSION_TEST ((handle != SESSION_INVALID_HANDLE), "zero listener should exist in local table"); detach_args.app_index = server_index; vnet_application_detach (&detach_args); @@ -501,7 +525,7 @@ session_test_namespace (vlib_main_t * vm, unformat_input_t * input) * Cleanup */ vec_free (ns_id); - vnet_delete_loopback_interface (sw_if_index); + session_delete_loopback (sw_if_index); return 0; } @@ -778,18 +802,20 @@ static int session_test_rules (vlib_main_t * vm, unformat_input_t * input) { session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; - u64 options[SESSION_OPTIONS_N_OPTIONS]; + u64 options[APP_OPTIONS_N_OPTIONS]; u16 lcl_port = 1234, rmt_port = 4321; - u32 server_index, app_index; + u32 server_index, server_index2; u32 dummy_server_api_index = ~0; transport_connection_t *tc; u32 dummy_port = 1111; clib_error_t *error = 0; - u8 segment_name[128]; + u8 is_filtered = 0, *ns_id = format (0, "appns1"); stream_session_t *listener, *s; app_namespace_t *default_ns = app_namespace_get_default (); u32 local_ns_index = default_ns->local_table_index; - int verbose = 0; + int verbose = 0, rv; + app_namespace_t *app_ns; + u64 handle; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { @@ -812,7 +838,6 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, - .segment_name = segment_name, }; vnet_bind_args_t bind_args = { @@ -824,7 +849,6 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) * Attach server with global and local default scope */ options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; - options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; attach_args.namespace_id = 0; @@ -857,7 +881,8 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0); + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); SESSION_TEST ((tc == 0), "optimized lookup should not work (port)"); /* @@ -883,7 +908,8 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) "optimized lookup should return the listener"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0); + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); SESSION_TEST ((tc->c_index == listener->connection_index), "lookup should return the listener"); s = session_lookup_safe4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, @@ -896,13 +922,14 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) .port = rmt_port, .transport_proto = TRANSPORT_PROTO_TCP, }; - app_index = session_lookup_local_session_endpoint (local_ns_index, &sep); - SESSION_TEST ((app_index != server_index), "local session endpoint lookup " + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle != server_index), "local session endpoint lookup " "should not work (global scope)"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port + 1, - rmt_port, TRANSPORT_PROTO_TCP, 0); + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); SESSION_TEST ((tc == 0), "optimized lookup for wrong lcl port + 1 should not work"); @@ -916,47 +943,130 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) args.table_args.action_index); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port + 1, - rmt_port, TRANSPORT_PROTO_TCP, 0); + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); SESSION_TEST ((tc->c_index == listener->connection_index), "optimized lookup for lcl port + 1 should work"); - app_index = session_lookup_local_session_endpoint (local_ns_index, &sep); - SESSION_TEST ((app_index != server_index), "local session endpoint lookup " - "should not work (constrained lcl ip)"); + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle == server_index), "local session endpoint lookup " + "should work (lcl ip was zeroed)"); /* - * Add drop rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) + * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) */ args.table_args.lcl_port = 1234; args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 32; + args.table_args.lcl.fp_len = 30; args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 32; + args.table_args.rmt.fp_len = 30; args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d", + SESSION_TEST ((error == 0), "Add 1.2.3.4/30 1234 5.6.7.8/30 4321 action %d", args.table_args.action_index); if (verbose) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); - session_lookup_dump_local_rules_table (0, FIB_PROTOCOL_IP4, + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0); + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); + SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 " + "should fail (deny rule)"); + SESSION_TEST ((is_filtered == 1), "lookup should be filtered (deny)"); + + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " + "5.6.7.8/16 4321 in local table should return deny"); + + tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, + &rmt_pref.fp_addr.ip4, lcl_port + 1, + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); + SESSION_TEST ((tc->c_index == listener->connection_index), + "lookup 1.2.3.4/32 123*5* 5.6.7.8/16 4321 should work"); + + /* + * "Mask" deny rule with more specific allow: + * Add allow rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -3 (allow) + */ + args.table_args.is_add = 1; + args.table_args.lcl_port = 1234; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW; + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Add masking rule 1.2.3.4/30 1234 5.6.7.8/32 " + "4321 action %d", args.table_args.action_index); + + is_filtered = 0; + tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, + &rmt_pref.fp_addr.ip4, lcl_port, + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 " - "should fail (drop rule)"); + "should fail (allow without app)"); + SESSION_TEST ((is_filtered == 0), "lookup should NOT be filtered"); + + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "lookup for 1.2.3.4/32 " + "1234 5.6.7.8/32 4321 in local table should return invalid"); + + if (verbose) + { + vlib_cli_output (vm, "Local rules"); + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + } + + sep.ip.ip4.as_u32 += 1 << 24; + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234" + " 5.6.7.9/32 4321 in local table should return deny"); + + vnet_connect_args_t connect_args = { + .app_index = attach_args.app_index, + .api_context = 0, + }; + clib_memcpy (&connect_args.sep, &sep, sizeof (sep)); + + /* Try connecting */ + error = vnet_connect (&connect_args); + SESSION_TEST ((error != 0), "connect should fail"); + rv = clib_error_get_code (error); + SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), + "connect should be filtered"); + + sep.ip.ip4.as_u32 -= 1 << 24; + + /* + * Delete masking rule: 1.2.3.4/32 1234 5.6.7.8/32 4321 allow + */ + args.table_args.is_add = 0; + args.table_args.lcl_port = 1234; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 allow"); + /* * Add local scope rule for 0/0 * 5.6.7.8/16 4321 action server_index */ + args.table_args.is_add = 1; args.table_args.lcl_port = 0; args.table_args.lcl.fp_len = 0; args.table_args.rmt.fp_len = 16; - args.table_args.action_index = server_index; + args.table_args.action_index = -1; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add * * 5.6.7.8/16 4321 action %d", args.table_args.action_index); @@ -965,60 +1075,93 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); - session_lookup_dump_local_rules_table (0, FIB_PROTOCOL_IP4, + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } - app_index = session_lookup_local_session_endpoint (local_ns_index, &sep); - SESSION_TEST ((app_index == server_index), "local session endpoint lookup " - "should work"); + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle == SESSION_DROP_HANDLE), + "local session endpoint lookup should return deny"); + + /* + * Delete 1.2.3.4/32 1234 5.6.7.8/32 4321 deny + */ + args.table_args.is_add = 0; + args.table_args.lcl_port = 1234; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 30; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 30; + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny"); + + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle == SESSION_INVALID_HANDLE), + "local session endpoint lookup should return invalid"); /* * Delete 0/0 * 5.6.7.8/16 4321, 1.2.3.4/16 * 5.6.7.8/16 4321 and * 1.2.3.4/16 1234 5.6.7.8/16 4321 */ args.table_args.is_add = 0; + args.table_args.lcl_port = 0; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 0; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 16; + args.table_args.rmt_port = 4321; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 0/0 * 5.6.7.8/16 4321"); - app_index = session_lookup_local_session_endpoint (local_ns_index, &sep); - SESSION_TEST ((app_index != server_index), "local session endpoint lookup " + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle != server_index), "local session endpoint lookup " "should not work (removed)"); args.table_args.is_add = 0; args.table_args.lcl = lcl_pref; + + args.table_args.is_add = 0; + args.table_args.lcl_port = 0; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 16; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 16; + args.table_args.rmt_port = 4321; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 1.2.3.4/16 * 5.6.7.8/16 4321"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port + 1, - rmt_port, TRANSPORT_PROTO_TCP, 0); - SESSION_TEST ((tc == 0), "optimized lookup for lcl port + 1 should not " + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); + SESSION_TEST ((tc == 0), + "lookup 1.2.3.4/32 123*5* 5.6.7.8/16 4321 should not " "work (del)"); args.table_args.is_add = 0; args.table_args.lcl_port = 1234; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 16; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 16; + args.table_args.rmt_port = 4321; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 1.2.3.4/16 1234 5.6.7.8/16 4321"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0); - SESSION_TEST ((tc == 0), - "optimized lookup should not work (del + negative)"); + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); + SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should " + "not work (del + deny)"); - args.table_args.is_add = 0; - args.table_args.lcl_port = 1234; - args.table_args.lcl.fp_addr.ip4 = lcl_ip; - args.table_args.lcl.fp_len = 32; - args.table_args.rmt.fp_addr.ip4 = rmt_ip; - args.table_args.rmt.fp_len = 32; - error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 drop"); + SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, - rmt_port, TRANSPORT_PROTO_TCP, 0); - SESSION_TEST ((tc == 0), "optimized lookup should not work (no-rule)"); + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); + SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should" + " not work (no-rule)"); /* - * Test tags. Add/del rule with tag + * Test tags. Add/overwrite/del rule with tag */ args.table_args.is_add = 1; args.table_args.lcl_port = 1234; @@ -1026,37 +1169,207 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) args.table_args.lcl.fp_len = 16; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 16; + args.table_args.rmt_port = 4321; args.table_args.tag = format (0, "test_rule"); + args.table_args.action_index = server_index; error = vnet_session_rule_add_del (&args); - SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 drop " + SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 deny " "tag test_rule"); if (verbose) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); - session_lookup_dump_local_rules_table (0, FIB_PROTOCOL_IP4, + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } + tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, + &rmt_pref.fp_addr.ip4, lcl_port, + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); + SESSION_TEST ((tc->c_index == listener->connection_index), + "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should work"); + + vec_free (args.table_args.tag); + args.table_args.lcl_port = 1234; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 16; + args.table_args.tag = format (0, "test_rule_overwrite"); + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), + "Overwrite 1.2.3.4/16 1234 5.6.7.8/16 4321 deny tag test_rule" + " should work"); + if (verbose) + { + session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + } + args.table_args.is_add = 0; args.table_args.lcl_port += 1; - SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 drop " - "tag test_rule"); + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny " + "tag %v", args.table_args.tag); + if (verbose) + { + session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + } + tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, + &rmt_pref.fp_addr.ip4, lcl_port, + rmt_port, TRANSPORT_PROTO_TCP, 0, + &is_filtered); + SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/32 4321 should not" + " work (del)"); + + /* + * Test local rules with multiple namespaces + */ + + /* + * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) + */ + args.table_args.is_add = 1; + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 0; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; + args.table_args.tag = 0; + args.scope = SESSION_RULE_SCOPE_LOCAL; + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d", + args.table_args.action_index); + /* + * Add 'white' rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) + */ + args.table_args.is_add = 1; + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 4321; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW; + error = vnet_session_rule_add_del (&args); + + if (verbose) + { + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + } + + vnet_app_namespace_add_del_args_t ns_args = { + .ns_id = ns_id, + .secret = 0, + .sw_if_index = APP_NAMESPACE_INVALID_INDEX, + .is_add = 1 + }; + error = vnet_app_namespace_add_del (&ns_args); + SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", + clib_error_get_code (error)); + app_ns = app_namespace_get_from_id (ns_id); + + attach_args.namespace_id = ns_id; + attach_args.api_client_index = dummy_server_api_index - 1; + error = vnet_application_attach (&attach_args); + SESSION_TEST ((error == 0), "server2 attached"); + server_index2 = attach_args.app_index; + + /* + * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) + */ + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 0; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; + args.appns_index = app_namespace_index (app_ns); + + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d " + "in test namespace", args.table_args.action_index); + /* + * Lookup default namespace + */ + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle == SESSION_INVALID_HANDLE), + "lookup for 1.2.3.4/32 1234 5.6.7.8/32 4321 in local table " + "should return allow (invalid)"); + + sep.port += 1; + handle = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " + "5.6.7.8/16 432*2* in local table should return deny"); + + + connect_args.app_index = server_index; + clib_memcpy (&connect_args.sep, &sep, sizeof (sep)); + + error = vnet_connect (&connect_args); + SESSION_TEST ((error != 0), "connect should fail"); + rv = clib_error_get_code (error); + SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), + "connect should be filtered"); + + /* + * Lookup test namespace + */ + handle = session_lookup_local_endpoint (app_ns->local_table_index, &sep); + SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " + "5.6.7.8/16 4321 in local table should return deny"); + + connect_args.app_index = server_index; + error = vnet_connect (&connect_args); + SESSION_TEST ((error != 0), "connect should fail"); + rv = clib_error_get_code (error); + SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), + "connect should be filtered"); + + args.table_args.is_add = 0; + vnet_session_rule_add_del (&args); + + args.appns_index = 0; + args.table_args.is_add = 0; + vnet_session_rule_add_del (&args); + + args.table_args.rmt_port = 4321; + vnet_session_rule_add_del (&args); + /* + * Final Cleanup + */ + vec_free (args.table_args.tag); vnet_app_detach_args_t detach_args = { .app_index = server_index, }; vnet_application_detach (&detach_args); + + detach_args.app_index = server_index2; + vnet_application_detach (&detach_args); + + vec_free (ns_id); return 0; } static int session_test_proxy (vlib_main_t * vm, unformat_input_t * input) { - u64 options[SESSION_OPTIONS_N_OPTIONS]; + u64 options[APP_OPTIONS_N_OPTIONS]; + char *show_listeners = "sh session listeners tcp verbose"; + char *show_local_listeners = "sh app ns table default"; + unformat_input_t tmp_input; u32 server_index, app_index; u32 dummy_server_api_index = ~0, sw_if_index = 0; clib_error_t *error = 0; - u8 segment_name[128], intf_mac[6], sst; + u8 sst, is_filtered = 0; stream_session_t *s; transport_connection_t *tc; u16 lcl_port = 1234, rmt_port = 4321; @@ -1096,21 +1409,13 @@ session_test_proxy (vlib_main_t * vm, unformat_input_t * input) /* * Create loopback interface */ - memset (intf_mac, 0, sizeof (intf_mac)); - if (vnet_create_loopback_interface (&sw_if_index, intf_mac, 0, 0)) - { - clib_warning ("couldn't create loopback. stopping the test!"); - return 0; - } - vnet_sw_interface_set_flags (vnet_get_main (), sw_if_index, - VNET_SW_INTERFACE_FLAG_ADMIN_UP); - ip4_add_del_interface_address (vlib_get_main (), sw_if_index, &lcl_ip, - 24, 0); + session_create_lookpback (0, &sw_if_index, &lcl_ip); app_ns = app_namespace_get_default (); app_ns->sw_if_index = sw_if_index; memset (options, 0, sizeof (options)); + options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_IS_PROXY; options[APP_OPTIONS_PROXY_TRANSPORT] = 1 << TRANSPORT_PROTO_TCP; @@ -1121,7 +1426,6 @@ session_test_proxy (vlib_main_t * vm, unformat_input_t * input) .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, - .segment_name = segment_name, }; attach_args.api_client_index = dummy_server_api_index; @@ -1130,11 +1434,17 @@ session_test_proxy (vlib_main_t * vm, unformat_input_t * input) server_index = attach_args.app_index; if (verbose) - session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); + { + unformat_init_string (&tmp_input, show_listeners, + strlen (show_listeners)); + vlib_cli_input (vm, &tmp_input, 0, 0); + unformat_init_string (&tmp_input, show_local_listeners, + strlen (show_local_listeners)); + vlib_cli_input (vm, &tmp_input, 0, 0); + } tc = session_lookup_connection_wt4 (0, &lcl_ip, &rmt_ip, lcl_port, rmt_port, - TRANSPORT_PROTO_TCP, 0); + TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc != 0), "lookup 1.2.3.4 1234 5.6.7.8 4321 should be " "successful"); sst = session_type_from_proto_and_ip (TRANSPORT_PROTO_TCP, 1); @@ -1143,16 +1453,11 @@ session_test_proxy (vlib_main_t * vm, unformat_input_t * input) " server"); tc = session_lookup_connection_wt4 (0, &rmt_ip, &rmt_ip, lcl_port, rmt_port, - TRANSPORT_PROTO_TCP, 0); + TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "lookup 5.6.7.8 1234 5.6.7.8 4321 should" " not work"); - if (verbose) - session_lookup_dump_local_rules_table (app_ns->local_table_index, - FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); - app_index = - session_lookup_local_session_endpoint (app_ns->local_table_index, &sep); + app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep); SESSION_TEST ((app_index == server_index), "local session endpoint lookup" " should work"); @@ -1162,15 +1467,20 @@ session_test_proxy (vlib_main_t * vm, unformat_input_t * input) vnet_application_detach (&detach_args); if (verbose) - session_lookup_dump_local_rules_table (app_ns->local_table_index, - FIB_PROTOCOL_IP4, - TRANSPORT_PROTO_TCP); + { + unformat_init_string (&tmp_input, show_listeners, + strlen (show_listeners)); + vlib_cli_input (vm, &tmp_input, 0, 0); + unformat_init_string (&tmp_input, show_local_listeners, + strlen (show_local_listeners)); + vlib_cli_input (vm, &tmp_input, 0, 0); + } - app_index = - session_lookup_local_session_endpoint (app_ns->local_table_index, &sep); + app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep); SESSION_TEST ((app_index == SESSION_RULES_TABLE_INVALID_INDEX), "local session endpoint lookup should not work after detach"); - + if (verbose) + unformat_free (&tmp_input); return 0; }