+ /*
+ * "Mask" deny rule with more specific allow:
+ * Add allow rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -3 (allow)
+ */
+ args.table_args.is_add = 1;
+ args.table_args.lcl_port = 1234;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW;
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Add masking rule 1.2.3.4/30 1234 5.6.7.8/32 "
+ "4321 action %d", args.table_args.action_index);
+
+ is_filtered = 0;
+ tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
+ &rmt_pref.fp_addr.ip4, lcl_port,
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
+ SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 "
+ "should fail (allow without app)");
+ SESSION_TEST ((is_filtered == 0), "lookup should NOT be filtered");
+
+ app_index = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((app_index == APP_INVALID_INDEX), "lookup for 1.2.3.4/32 1234"
+ " 5.6.7.8/16 4321 in local table should return invalid");
+
+ if (verbose)
+ {
+ vlib_cli_output (vm, "Local rules");
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ }
+
+ sep.ip.ip4.as_u32 += 1 << 24;
+ app_index = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234"
+ " 5.6.7.9/16 4321 in local table should return invalid");
+
+ vnet_connect_args_t connect_args = {
+ .sep = sep,
+ .app_index = attach_args.app_index,
+ .api_context = 0,
+ };
+
+ /* Try connecting */
+ error = vnet_connect (&connect_args);
+ SESSION_TEST ((error != 0), "connect should fail");
+ rv = clib_error_get_code (error);
+ SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED),
+ "connect should be filtered");
+
+ sep.ip.ip4.as_u32 -= 1 << 24;
+
+
+
+ /*
+ * Delete masking rule: 1.2.3.4/32 1234 5.6.7.8/32 4321 allow
+ */
+ args.table_args.is_add = 0;
+ args.table_args.lcl_port = 1234;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 allow");
+
+