return -1;
}
+static u32 dummy_segment_count;
+
int
-dummy_add_segment_callback (u32 client_index, const u8 * seg_name,
- u32 seg_size)
+dummy_add_segment_callback (u32 client_index, const ssvm_private_t * fs)
{
- clib_warning ("called...");
- return -1;
+ dummy_segment_count = 1;
+ return 0;
}
int
-dummy_redirect_connect_callback (u32 client_index, void *mp)
+dummy_del_segment_callback (u32 client_index, const ssvm_private_t * fs)
{
- return VNET_API_ERROR_SESSION_REDIRECT;
+ dummy_segment_count = 0;
+ return 0;
}
void
clib_warning ("called...");
}
+static u32 dummy_accept;
+
int
dummy_session_accept_callback (stream_session_t * s)
{
- clib_warning ("called...");
- return -1;
+ dummy_accept = 1;
+ s->session_state = SESSION_STATE_READY;
+ return 0;
}
int
.session_connected_callback = dummy_session_connected_callback,
.session_accept_callback = dummy_session_accept_callback,
.session_disconnect_callback = dummy_session_disconnect_callback,
- .builtin_server_rx_callback = dummy_server_rx_callback,
- .redirect_connect_callback = dummy_redirect_connect_callback,
+ .builtin_app_rx_callback = dummy_server_rx_callback,
+ .add_segment_callback = dummy_add_segment_callback,
+ .del_segment_callback = dummy_del_segment_callback,
};
/* *INDENT-ON* */
+static int
+session_create_lookpback (u32 table_id, u32 * sw_if_index,
+ ip4_address_t * intf_addr)
+{
+ u8 intf_mac[6];
+
+ memset (intf_mac, 0, sizeof (intf_mac));
+
+ if (vnet_create_loopback_interface (sw_if_index, intf_mac, 0, 0))
+ {
+ clib_warning ("couldn't create loopback. stopping the test!");
+ return -1;
+ }
+
+ if (table_id != 0)
+ ip_table_bind (FIB_PROTOCOL_IP4, *sw_if_index, table_id, 0);
+
+ vnet_sw_interface_set_flags (vnet_get_main (), *sw_if_index,
+ VNET_SW_INTERFACE_FLAG_ADMIN_UP);
+
+ if (ip4_add_del_interface_address (vlib_get_main (), *sw_if_index,
+ intf_addr, 24, 0))
+ {
+ clib_warning ("couldn't assign loopback ip %U", format_ip4_address,
+ intf_addr);
+ return -1;
+ }
+
+ return 0;
+}
+
+static void
+session_delete_loopback (u32 sw_if_index)
+{
+ /* fails spectacularly */
+ /* vnet_delete_loopback_interface (sw_if_index); */
+}
+
static int
session_test_basic (vlib_main_t * vm, unformat_input_t * input)
{
session_endpoint_t server_sep = SESSION_ENDPOINT_NULL;
- u64 options[SESSION_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle;
- u8 segment_name[128];
+ u64 options[APP_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle;
clib_error_t *error = 0;
u32 server_index;
memset (options, 0, sizeof (options));
options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN;
- options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT;
options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE;
options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE;
vnet_app_attach_args_t attach_args = {
.options = options,
.namespace_id = 0,
.session_cb_vft = &dummy_session_cbs,
- .segment_name = segment_name,
};
error = vnet_application_attach (&attach_args);
static int
session_test_namespace (vlib_main_t * vm, unformat_input_t * input)
{
- u64 options[SESSION_OPTIONS_N_OPTIONS], dummy_secret = 1234;
+ u64 options[APP_OPTIONS_N_OPTIONS], dummy_secret = 1234;
u32 server_index, server_st_index, server_local_st_index;
- u32 dummy_port = 1234, local_listener, client_index;
+ u32 dummy_port = 1234, client_index;
u32 dummy_api_context = 4321, dummy_client_api_index = 1234;
u32 dummy_server_api_index = ~0, sw_if_index = 0;
session_endpoint_t server_sep = SESSION_ENDPOINT_NULL;
session_endpoint_t client_sep = SESSION_ENDPOINT_NULL;
session_endpoint_t intf_sep = SESSION_ENDPOINT_NULL;
clib_error_t *error = 0;
- u8 *ns_id = format (0, "appns1"), intf_mac[6];
+ u8 *ns_id = format (0, "appns1");
app_namespace_t *app_ns;
- u8 segment_name[128];
application_t *server;
stream_session_t *s;
+ u64 handle;
int code;
server_sep.is_ip4 = 1;
client_sep.is_ip4 = 1;
client_sep.port = dummy_port;
memset (options, 0, sizeof (options));
- memset (intf_mac, 0, sizeof (intf_mac));
options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN;
- options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT;
vnet_app_attach_args_t attach_args = {
.api_client_index = ~0,
.options = options,
.namespace_id = 0,
.session_cb_vft = &dummy_session_cbs,
- .segment_name = segment_name,
};
vnet_bind_args_t bind_args = {
};
vnet_connect_args_t connect_args = {
- .sep = client_sep,
.app_index = 0,
.api_context = 0,
};
+ clib_memcpy (&connect_args.sep, &client_sep, sizeof (client_sep));
vnet_unbind_args_t unbind_args = {
.handle = bind_args.handle,
SESSION_TEST ((s->app_index == server_index), "app_index should be that of "
"the server");
server_local_st_index = application_local_session_table (server);
- local_listener =
- session_lookup_local_session_endpoint (server_local_st_index,
- &server_sep);
- SESSION_TEST ((local_listener != SESSION_INVALID_INDEX),
+ handle = session_lookup_local_endpoint (server_local_st_index, &server_sep);
+ SESSION_TEST ((handle != SESSION_INVALID_HANDLE),
"listener should exist in local table");
/*
code = clib_error_get_code (error);
SESSION_TEST ((code == VNET_API_ERROR_INVALID_VALUE),
"error code should be invalid value (zero ip)");
+ SESSION_TEST ((dummy_segment_count == 0),
+ "shouldn't have received request to map new segment");
connect_args.sep.ip.ip4.as_u8[0] = 127;
error = vnet_connect (&connect_args);
- SESSION_TEST ((error != 0), "client connect should return error code");
+ SESSION_TEST ((error == 0), "client connect should not return error code");
code = clib_error_get_code (error);
- SESSION_TEST ((code == VNET_API_ERROR_SESSION_REDIRECT),
- "error code should be redirect");
+ SESSION_TEST ((dummy_segment_count == 1),
+ "should've received request to map new segment");
+ SESSION_TEST ((dummy_accept == 1), "should've received accept request");
detach_args.app_index = client_index;
vnet_application_detach (&detach_args);
s = session_lookup_listener (server_st_index, &server_sep);
SESSION_TEST ((s == 0), "listener should not exist in global table");
- local_listener =
- session_lookup_local_session_endpoint (server_local_st_index,
- &server_sep);
- SESSION_TEST ((s == 0), "listener should not exist in local table");
+ handle = session_lookup_local_endpoint (server_local_st_index, &server_sep);
+ SESSION_TEST ((handle == SESSION_INVALID_HANDLE),
+ "listener should not exist in local table");
detach_args.app_index = server_index;
vnet_application_detach (&detach_args);
s = session_lookup_listener (server_st_index, &server_sep);
SESSION_TEST ((s == 0), "listener should not exist in global table");
server_local_st_index = application_local_session_table (server);
- local_listener =
- session_lookup_local_session_endpoint (server_local_st_index,
- &server_sep);
- SESSION_TEST ((local_listener != SESSION_INVALID_INDEX),
+ handle = session_lookup_local_endpoint (server_local_st_index, &server_sep);
+ SESSION_TEST ((handle != SESSION_INVALID_HANDLE),
"listener should exist in local table");
unbind_args.handle = bind_args.handle;
error = vnet_unbind (&unbind_args);
SESSION_TEST ((error == 0), "unbind should work");
- local_listener =
- session_lookup_local_session_endpoint (server_local_st_index,
- &server_sep);
- SESSION_TEST ((local_listener == SESSION_INVALID_INDEX),
+ handle = session_lookup_local_endpoint (server_local_st_index, &server_sep);
+ SESSION_TEST ((handle == SESSION_INVALID_HANDLE),
"listener should not exist in local table");
/*
/*
* Create loopback interface
*/
- if (vnet_create_loopback_interface (&sw_if_index, intf_mac, 0, 0))
- {
- clib_warning ("couldn't create loopback. stopping the test!");
- return 0;
- }
- vnet_sw_interface_set_flags (vnet_get_main (), sw_if_index,
- VNET_SW_INTERFACE_FLAG_ADMIN_UP);
- ip4_add_del_interface_address (vlib_get_main (), sw_if_index, &intf_addr,
- 24, 0);
+ session_create_lookpback (0, &sw_if_index, &intf_addr);
/*
* Update namespace
SESSION_TEST ((s->app_index == server_index), "app_index should be that of "
"the server");
server_local_st_index = application_local_session_table (server);
- local_listener =
- session_lookup_local_session_endpoint (server_local_st_index,
- &server_sep);
- SESSION_TEST ((local_listener != SESSION_INVALID_INDEX),
+ handle = session_lookup_local_endpoint (server_local_st_index, &server_sep);
+ SESSION_TEST ((handle != SESSION_INVALID_HANDLE),
"zero listener should exist in local table");
detach_args.app_index = server_index;
vnet_application_detach (&detach_args);
* Cleanup
*/
vec_free (ns_id);
- vnet_delete_loopback_interface (sw_if_index);
+ session_delete_loopback (sw_if_index);
return 0;
}
session_test_rules (vlib_main_t * vm, unformat_input_t * input)
{
session_endpoint_t server_sep = SESSION_ENDPOINT_NULL;
- u64 options[SESSION_OPTIONS_N_OPTIONS];
+ u64 options[APP_OPTIONS_N_OPTIONS];
u16 lcl_port = 1234, rmt_port = 4321;
- u32 server_index, app_index;
+ u32 server_index, server_index2;
u32 dummy_server_api_index = ~0;
transport_connection_t *tc;
u32 dummy_port = 1111;
clib_error_t *error = 0;
- u8 segment_name[128];
+ u8 is_filtered = 0, *ns_id = format (0, "appns1");
stream_session_t *listener, *s;
app_namespace_t *default_ns = app_namespace_get_default ();
u32 local_ns_index = default_ns->local_table_index;
- int verbose = 0;
+ int verbose = 0, rv;
+ app_namespace_t *app_ns;
+ u64 handle;
while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
{
.options = options,
.namespace_id = 0,
.session_cb_vft = &dummy_session_cbs,
- .segment_name = segment_name,
};
vnet_bind_args_t bind_args = {
* Attach server with global and local default scope
*/
options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN;
- options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT;
options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE;
options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE;
attach_args.namespace_id = 0;
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port,
- rmt_port, TRANSPORT_PROTO_TCP, 0);
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
SESSION_TEST ((tc == 0), "optimized lookup should not work (port)");
/*
"optimized lookup should return the listener");
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port,
- rmt_port, TRANSPORT_PROTO_TCP, 0);
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
SESSION_TEST ((tc->c_index == listener->connection_index),
"lookup should return the listener");
s = session_lookup_safe4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4,
.port = rmt_port,
.transport_proto = TRANSPORT_PROTO_TCP,
};
- app_index = session_lookup_local_session_endpoint (local_ns_index, &sep);
- SESSION_TEST ((app_index != server_index), "local session endpoint lookup "
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle != server_index), "local session endpoint lookup "
"should not work (global scope)");
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port + 1,
- rmt_port, TRANSPORT_PROTO_TCP, 0);
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
SESSION_TEST ((tc == 0),
"optimized lookup for wrong lcl port + 1 should not work");
args.table_args.action_index);
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port + 1,
- rmt_port, TRANSPORT_PROTO_TCP, 0);
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
SESSION_TEST ((tc->c_index == listener->connection_index),
"optimized lookup for lcl port + 1 should work");
- app_index = session_lookup_local_session_endpoint (local_ns_index, &sep);
- SESSION_TEST ((app_index != server_index), "local session endpoint lookup "
- "should not work (constrained lcl ip)");
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle == server_index), "local session endpoint lookup "
+ "should work (lcl ip was zeroed)");
/*
- * Add drop rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop)
+ * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop)
*/
args.table_args.lcl_port = 1234;
args.table_args.lcl.fp_addr.ip4 = lcl_ip;
- args.table_args.lcl.fp_len = 32;
+ args.table_args.lcl.fp_len = 30;
args.table_args.rmt.fp_addr.ip4 = rmt_ip;
- args.table_args.rmt.fp_len = 32;
+ args.table_args.rmt.fp_len = 30;
args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP;
error = vnet_session_rule_add_del (&args);
- SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d",
+ SESSION_TEST ((error == 0), "Add 1.2.3.4/30 1234 5.6.7.8/30 4321 action %d",
args.table_args.action_index);
if (verbose)
{
session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
TRANSPORT_PROTO_TCP);
- session_lookup_dump_local_rules_table (0, FIB_PROTOCOL_IP4,
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
TRANSPORT_PROTO_TCP);
}
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port,
- rmt_port, TRANSPORT_PROTO_TCP, 0);
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
+ SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 "
+ "should fail (deny rule)");
+ SESSION_TEST ((is_filtered == 1), "lookup should be filtered (deny)");
+
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 "
+ "5.6.7.8/16 4321 in local table should return deny");
+
+ tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
+ &rmt_pref.fp_addr.ip4, lcl_port + 1,
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
+ SESSION_TEST ((tc->c_index == listener->connection_index),
+ "lookup 1.2.3.4/32 123*5* 5.6.7.8/16 4321 should work");
+
+ /*
+ * "Mask" deny rule with more specific allow:
+ * Add allow rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -3 (allow)
+ */
+ args.table_args.is_add = 1;
+ args.table_args.lcl_port = 1234;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW;
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Add masking rule 1.2.3.4/30 1234 5.6.7.8/32 "
+ "4321 action %d", args.table_args.action_index);
+
+ is_filtered = 0;
+ tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
+ &rmt_pref.fp_addr.ip4, lcl_port,
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 "
- "should fail (drop rule)");
+ "should fail (allow without app)");
+ SESSION_TEST ((is_filtered == 0), "lookup should NOT be filtered");
+
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "lookup for 1.2.3.4/32 "
+ "1234 5.6.7.8/32 4321 in local table should return invalid");
+
+ if (verbose)
+ {
+ vlib_cli_output (vm, "Local rules");
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ }
+
+ sep.ip.ip4.as_u32 += 1 << 24;
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234"
+ " 5.6.7.9/32 4321 in local table should return deny");
+
+ vnet_connect_args_t connect_args = {
+ .app_index = attach_args.app_index,
+ .api_context = 0,
+ };
+ clib_memcpy (&connect_args.sep, &sep, sizeof (sep));
+
+ /* Try connecting */
+ error = vnet_connect (&connect_args);
+ SESSION_TEST ((error != 0), "connect should fail");
+ rv = clib_error_get_code (error);
+ SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED),
+ "connect should be filtered");
+
+ sep.ip.ip4.as_u32 -= 1 << 24;
+
+ /*
+ * Delete masking rule: 1.2.3.4/32 1234 5.6.7.8/32 4321 allow
+ */
+ args.table_args.is_add = 0;
+ args.table_args.lcl_port = 1234;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 allow");
+
/*
* Add local scope rule for 0/0 * 5.6.7.8/16 4321 action server_index
*/
+ args.table_args.is_add = 1;
args.table_args.lcl_port = 0;
args.table_args.lcl.fp_len = 0;
args.table_args.rmt.fp_len = 16;
- args.table_args.action_index = server_index;
+ args.table_args.action_index = -1;
error = vnet_session_rule_add_del (&args);
SESSION_TEST ((error == 0), "Add * * 5.6.7.8/16 4321 action %d",
args.table_args.action_index);
{
session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
TRANSPORT_PROTO_TCP);
- session_lookup_dump_local_rules_table (0, FIB_PROTOCOL_IP4,
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
TRANSPORT_PROTO_TCP);
}
- app_index = session_lookup_local_session_endpoint (local_ns_index, &sep);
- SESSION_TEST ((app_index == server_index), "local session endpoint lookup "
- "should work");
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle == SESSION_DROP_HANDLE),
+ "local session endpoint lookup should return deny");
+
+ /*
+ * Delete 1.2.3.4/32 1234 5.6.7.8/32 4321 deny
+ */
+ args.table_args.is_add = 0;
+ args.table_args.lcl_port = 1234;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 30;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 30;
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny");
+
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle == SESSION_INVALID_HANDLE),
+ "local session endpoint lookup should return invalid");
/*
* Delete 0/0 * 5.6.7.8/16 4321, 1.2.3.4/16 * 5.6.7.8/16 4321 and
* 1.2.3.4/16 1234 5.6.7.8/16 4321
*/
args.table_args.is_add = 0;
+ args.table_args.lcl_port = 0;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 0;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 16;
+ args.table_args.rmt_port = 4321;
error = vnet_session_rule_add_del (&args);
SESSION_TEST ((error == 0), "Del 0/0 * 5.6.7.8/16 4321");
- app_index = session_lookup_local_session_endpoint (local_ns_index, &sep);
- SESSION_TEST ((app_index != server_index), "local session endpoint lookup "
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle != server_index), "local session endpoint lookup "
"should not work (removed)");
args.table_args.is_add = 0;
args.table_args.lcl = lcl_pref;
+
+ args.table_args.is_add = 0;
+ args.table_args.lcl_port = 0;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 16;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 16;
+ args.table_args.rmt_port = 4321;
error = vnet_session_rule_add_del (&args);
SESSION_TEST ((error == 0), "Del 1.2.3.4/16 * 5.6.7.8/16 4321");
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port + 1,
- rmt_port, TRANSPORT_PROTO_TCP, 0);
- SESSION_TEST ((tc == 0), "optimized lookup for lcl port + 1 should not "
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
+ SESSION_TEST ((tc == 0),
+ "lookup 1.2.3.4/32 123*5* 5.6.7.8/16 4321 should not "
"work (del)");
args.table_args.is_add = 0;
args.table_args.lcl_port = 1234;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 16;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 16;
+ args.table_args.rmt_port = 4321;
error = vnet_session_rule_add_del (&args);
SESSION_TEST ((error == 0), "Del 1.2.3.4/16 1234 5.6.7.8/16 4321");
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port,
- rmt_port, TRANSPORT_PROTO_TCP, 0);
- SESSION_TEST ((tc == 0),
- "optimized lookup should not work (del + negative)");
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
+ SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should "
+ "not work (del + deny)");
- args.table_args.is_add = 0;
- args.table_args.lcl_port = 1234;
- args.table_args.lcl.fp_addr.ip4 = lcl_ip;
- args.table_args.lcl.fp_len = 32;
- args.table_args.rmt.fp_addr.ip4 = rmt_ip;
- args.table_args.rmt.fp_len = 32;
- error = vnet_session_rule_add_del (&args);
- SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 drop");
+ SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny");
tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
&rmt_pref.fp_addr.ip4, lcl_port,
- rmt_port, TRANSPORT_PROTO_TCP, 0);
- SESSION_TEST ((tc == 0), "optimized lookup should not work (no-rule)");
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
+ SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should"
+ " not work (no-rule)");
/*
- * Test tags. Add/del rule with tag
+ * Test tags. Add/overwrite/del rule with tag
*/
args.table_args.is_add = 1;
args.table_args.lcl_port = 1234;
args.table_args.lcl.fp_len = 16;
args.table_args.rmt.fp_addr.ip4 = rmt_ip;
args.table_args.rmt.fp_len = 16;
+ args.table_args.rmt_port = 4321;
args.table_args.tag = format (0, "test_rule");
+ args.table_args.action_index = server_index;
error = vnet_session_rule_add_del (&args);
- SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 drop "
+ SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 deny "
"tag test_rule");
if (verbose)
{
session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
TRANSPORT_PROTO_TCP);
- session_lookup_dump_local_rules_table (0, FIB_PROTOCOL_IP4,
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
TRANSPORT_PROTO_TCP);
}
+ tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
+ &rmt_pref.fp_addr.ip4, lcl_port,
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
+ SESSION_TEST ((tc->c_index == listener->connection_index),
+ "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should work");
+
+ vec_free (args.table_args.tag);
+ args.table_args.lcl_port = 1234;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 16;
+ args.table_args.tag = format (0, "test_rule_overwrite");
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0),
+ "Overwrite 1.2.3.4/16 1234 5.6.7.8/16 4321 deny tag test_rule"
+ " should work");
+ if (verbose)
+ {
+ session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ }
+
args.table_args.is_add = 0;
args.table_args.lcl_port += 1;
- SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 drop "
- "tag test_rule");
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny "
+ "tag %v", args.table_args.tag);
+ if (verbose)
+ {
+ session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ }
+ tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4,
+ &rmt_pref.fp_addr.ip4, lcl_port,
+ rmt_port, TRANSPORT_PROTO_TCP, 0,
+ &is_filtered);
+ SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/32 4321 should not"
+ " work (del)");
+
+ /*
+ * Test local rules with multiple namespaces
+ */
+
+ /*
+ * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop)
+ */
+ args.table_args.is_add = 1;
+ args.table_args.lcl_port = 1234;
+ args.table_args.rmt_port = 0;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP;
+ args.table_args.tag = 0;
+ args.scope = SESSION_RULE_SCOPE_LOCAL;
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d",
+ args.table_args.action_index);
+ /*
+ * Add 'white' rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop)
+ */
+ args.table_args.is_add = 1;
+ args.table_args.lcl_port = 1234;
+ args.table_args.rmt_port = 4321;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW;
+ error = vnet_session_rule_add_del (&args);
+
+ if (verbose)
+ {
+ session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4,
+ TRANSPORT_PROTO_TCP);
+ }
+
+ vnet_app_namespace_add_del_args_t ns_args = {
+ .ns_id = ns_id,
+ .secret = 0,
+ .sw_if_index = APP_NAMESPACE_INVALID_INDEX,
+ .is_add = 1
+ };
+ error = vnet_app_namespace_add_del (&ns_args);
+ SESSION_TEST ((error == 0), "app ns insertion should succeed: %d",
+ clib_error_get_code (error));
+ app_ns = app_namespace_get_from_id (ns_id);
+
+ attach_args.namespace_id = ns_id;
+ attach_args.api_client_index = dummy_server_api_index - 1;
+ error = vnet_application_attach (&attach_args);
+ SESSION_TEST ((error == 0), "server2 attached");
+ server_index2 = attach_args.app_index;
+
+ /*
+ * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop)
+ */
+ args.table_args.lcl_port = 1234;
+ args.table_args.rmt_port = 0;
+ args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+ args.table_args.lcl.fp_len = 32;
+ args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+ args.table_args.rmt.fp_len = 32;
+ args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP;
+ args.appns_index = app_namespace_index (app_ns);
+
+ error = vnet_session_rule_add_del (&args);
+ SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d "
+ "in test namespace", args.table_args.action_index);
+ /*
+ * Lookup default namespace
+ */
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle == SESSION_INVALID_HANDLE),
+ "lookup for 1.2.3.4/32 1234 5.6.7.8/32 4321 in local table "
+ "should return allow (invalid)");
+
+ sep.port += 1;
+ handle = session_lookup_local_endpoint (local_ns_index, &sep);
+ SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 "
+ "5.6.7.8/16 432*2* in local table should return deny");
+
+
+ connect_args.app_index = server_index;
+ clib_memcpy (&connect_args.sep, &sep, sizeof (sep));
+
+ error = vnet_connect (&connect_args);
+ SESSION_TEST ((error != 0), "connect should fail");
+ rv = clib_error_get_code (error);
+ SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED),
+ "connect should be filtered");
+
+ /*
+ * Lookup test namespace
+ */
+ handle = session_lookup_local_endpoint (app_ns->local_table_index, &sep);
+ SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 "
+ "5.6.7.8/16 4321 in local table should return deny");
+
+ connect_args.app_index = server_index;
+ error = vnet_connect (&connect_args);
+ SESSION_TEST ((error != 0), "connect should fail");
+ rv = clib_error_get_code (error);
+ SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED),
+ "connect should be filtered");
+
+ args.table_args.is_add = 0;
+ vnet_session_rule_add_del (&args);
+
+ args.appns_index = 0;
+ args.table_args.is_add = 0;
+ vnet_session_rule_add_del (&args);
+
+ args.table_args.rmt_port = 4321;
+ vnet_session_rule_add_del (&args);
+ /*
+ * Final Cleanup
+ */
+ vec_free (args.table_args.tag);
vnet_app_detach_args_t detach_args = {
.app_index = server_index,
};
vnet_application_detach (&detach_args);
+
+ detach_args.app_index = server_index2;
+ vnet_application_detach (&detach_args);
+
+ vec_free (ns_id);
return 0;
}
static int
session_test_proxy (vlib_main_t * vm, unformat_input_t * input)
{
- u64 options[SESSION_OPTIONS_N_OPTIONS];
+ u64 options[APP_OPTIONS_N_OPTIONS];
+ char *show_listeners = "sh session listeners tcp verbose";
+ char *show_local_listeners = "sh app ns table default";
+ unformat_input_t tmp_input;
u32 server_index, app_index;
u32 dummy_server_api_index = ~0, sw_if_index = 0;
clib_error_t *error = 0;
- u8 segment_name[128], intf_mac[6], sst;
+ u8 sst, is_filtered = 0;
stream_session_t *s;
transport_connection_t *tc;
u16 lcl_port = 1234, rmt_port = 4321;
/*
* Create loopback interface
*/
- memset (intf_mac, 0, sizeof (intf_mac));
- if (vnet_create_loopback_interface (&sw_if_index, intf_mac, 0, 0))
- {
- clib_warning ("couldn't create loopback. stopping the test!");
- return 0;
- }
- vnet_sw_interface_set_flags (vnet_get_main (), sw_if_index,
- VNET_SW_INTERFACE_FLAG_ADMIN_UP);
- ip4_add_del_interface_address (vlib_get_main (), sw_if_index, &lcl_ip,
- 24, 0);
+ session_create_lookpback (0, &sw_if_index, &lcl_ip);
app_ns = app_namespace_get_default ();
app_ns->sw_if_index = sw_if_index;
memset (options, 0, sizeof (options));
+ options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN;
options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT;
options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_IS_PROXY;
options[APP_OPTIONS_PROXY_TRANSPORT] = 1 << TRANSPORT_PROTO_TCP;
.options = options,
.namespace_id = 0,
.session_cb_vft = &dummy_session_cbs,
- .segment_name = segment_name,
};
attach_args.api_client_index = dummy_server_api_index;
server_index = attach_args.app_index;
if (verbose)
- session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
- TRANSPORT_PROTO_TCP);
+ {
+ unformat_init_string (&tmp_input, show_listeners,
+ strlen (show_listeners));
+ vlib_cli_input (vm, &tmp_input, 0, 0);
+ unformat_init_string (&tmp_input, show_local_listeners,
+ strlen (show_local_listeners));
+ vlib_cli_input (vm, &tmp_input, 0, 0);
+ }
tc = session_lookup_connection_wt4 (0, &lcl_ip, &rmt_ip, lcl_port, rmt_port,
- TRANSPORT_PROTO_TCP, 0);
+ TRANSPORT_PROTO_TCP, 0, &is_filtered);
SESSION_TEST ((tc != 0), "lookup 1.2.3.4 1234 5.6.7.8 4321 should be "
"successful");
sst = session_type_from_proto_and_ip (TRANSPORT_PROTO_TCP, 1);
" server");
tc = session_lookup_connection_wt4 (0, &rmt_ip, &rmt_ip, lcl_port, rmt_port,
- TRANSPORT_PROTO_TCP, 0);
+ TRANSPORT_PROTO_TCP, 0, &is_filtered);
SESSION_TEST ((tc == 0), "lookup 5.6.7.8 1234 5.6.7.8 4321 should"
" not work");
- if (verbose)
- session_lookup_dump_local_rules_table (app_ns->local_table_index,
- FIB_PROTOCOL_IP4,
- TRANSPORT_PROTO_TCP);
- app_index =
- session_lookup_local_session_endpoint (app_ns->local_table_index, &sep);
+ app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep);
SESSION_TEST ((app_index == server_index), "local session endpoint lookup"
" should work");
vnet_application_detach (&detach_args);
if (verbose)
- session_lookup_dump_local_rules_table (app_ns->local_table_index,
- FIB_PROTOCOL_IP4,
- TRANSPORT_PROTO_TCP);
+ {
+ unformat_init_string (&tmp_input, show_listeners,
+ strlen (show_listeners));
+ vlib_cli_input (vm, &tmp_input, 0, 0);
+ unformat_init_string (&tmp_input, show_local_listeners,
+ strlen (show_local_listeners));
+ vlib_cli_input (vm, &tmp_input, 0, 0);
+ }
- app_index =
- session_lookup_local_session_endpoint (app_ns->local_table_index, &sep);
+ app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep);
SESSION_TEST ((app_index == SESSION_RULES_TABLE_INVALID_INDEX),
"local session endpoint lookup should not work after detach");
-
+ if (verbose)
+ unformat_free (&tmp_input);
return 0;
}
Code Review / vpp.git / blobdiff