VPP-933 VPP crashes when deleting an ARP entry - vpp

diff options

author	Matthew Smith <mgsmith@netgate.com>	2017-08-09 16:30:43 -0500
committer	Matthew Smith <mgsmith@netgate.com>	2017-08-09 19:31:30 -0500
commit	66c0adf1ea73f1347ab5e3b929fa378a597aeb15 (patch)
tree	6b09efbfba0f269e5072603050810ecf63001ec9 /src/vnet/ethernet
parent	909a6a1eb92ceacb983bcff088fb512352929c46 (diff)

VPP-933 VPP crashes when deleting an ARP entry

When attempting to delete an ARP entry on an interface that hasn't had any ARP entries added yet, VPP was retrieving an array element at an index that was out of bounds and trying to dereference it. Change-Id: Id141d3bfd8378dd8dd63f43b0b4b41461c285a4f Signed-off-by: Matthew Smith <mgsmith@netgate.com>

Diffstat (limited to 'src/vnet/ethernet')

-rw-r--r--

src/vnet/ethernet/arp.c

1 files changed, 7 insertions, 0 deletions

/* * Copyright (c) 2017 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include <vnet/session/application_namespace.h> #include <vnet/session/application_interface.h> #include <vnet/session/application.h> #include <vnet/session/session.h> #include <vnet/session/session_rules_table.h> #define SESSION_TEST_I(_cond, _comment, _args...) \ ({ \ int _evald = (_cond); \ if (!(_evald)) { \ fformat(stderr, "FAIL:%d: " _comment "\n", \ __LINE__, ##_args); \ } else { \ fformat(stderr, "PASS:%d: " _comment "\n", \ __LINE__, ##_args); \ } \ _evald; \ }) #define SESSION_TEST(_cond, _comment, _args...) \ { \ if (!SESSION_TEST_I(_cond, _comment, ##_args)) { \ return 1; \ } \ } void dummy_session_reset_callback (stream_session_t * s) { clib_warning ("called..."); } int dummy_session_connected_callback (u32 app_index, u32 api_context, stream_session_t * s, u8 is_fail) { clib_warning ("called..."); return -1; } static u32 dummy_segment_count; int dummy_add_segment_callback (u32 client_index, const ssvm_private_t * fs) { dummy_segment_count = 1; return 0; } int dummy_del_segment_callback (u32 client_index, const ssvm_private_t * fs) { dummy_segment_count = 0; return 0; } int dummy_redirect_connect_callback (u32 client_index, void *mp) { return VNET_API_ERROR_SESSION_REDIRECT; } void dummy_session_disconnect_callback (stream_session_t * s) { clib_warning ("called..."); } static u32 dummy_accept; int dummy_session_accept_callback (stream_session_t * s) { dummy_accept = 1; s->session_state = SESSION_STATE_READY; return 0; } int dummy_server_rx_callback (stream_session_t * s) { clib_warning ("called..."); return -1; } /* *INDENT-OFF* */ static session_cb_vft_t dummy_session_cbs = { .session_reset_callback = dummy_session_reset_callback, .session_connected_callback = dummy_session_connected_callback, .session_accept_callback = dummy_session_accept_callback, .session_disconnect_callback = dummy_session_disconnect_callback, .builtin_server_rx_callback = dummy_server_rx_callback, .add_segment_callback = dummy_add_segment_callback, .del_segment_callback = dummy_del_segment_callback, }; /* *INDENT-ON* */ static int session_create_lookpback (u32 table_id, u32 * sw_if_index, ip4_address_t * intf_addr) { u8 intf_mac[6]; memset (intf_mac, 0, sizeof (intf_mac)); if (vnet_create_loopback_interface (sw_if_index, intf_mac, 0, 0)) { clib_warning ("couldn't create loopback. stopping the test!"); return -1; } if (table_id != 0) ip_table_bind (FIB_PROTOCOL_IP4, *sw_if_index, table_id, 0); vnet_sw_interface_set_flags (vnet_get_main (), *sw_if_index, VNET_SW_INTERFACE_FLAG_ADMIN_UP); if (ip4_add_del_interface_address (vlib_get_main (), *sw_if_index, intf_addr, 24, 0)) { clib_warning ("couldn't assign loopback ip %U", format_ip4_address, intf_addr); return -1; } return 0; } static void session_delete_loopback (u32 sw_if_index) { /* fails spectacularly */ /* vnet_delete_loopback_interface (sw_if_index); */ } static int session_test_basic (vlib_main_t * vm, unformat_input_t * input) { session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; u64 options[APP_OPTIONS_N_OPTIONS], bind4_handle, bind6_handle; clib_error_t *error = 0; u32 server_index; memset (options, 0, sizeof (options)); options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; vnet_app_attach_args_t attach_args = { .api_client_index = ~0, .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, }; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "app attached"); server_index = attach_args.app_index; server_sep.is_ip4 = 1; vnet_bind_args_t bind_args = { .sep = server_sep, .app_index = 0, }; bind_args.app_index = server_index; error = vnet_bind (&bind_args); SESSION_TEST ((error == 0), "server bind4 should work"); bind4_handle = bind_args.handle; error = vnet_bind (&bind_args); SESSION_TEST ((error != 0), "double server bind4 should not work"); bind_args.sep.is_ip4 = 0; error = vnet_bind (&bind_args); SESSION_TEST ((error == 0), "server bind6 should work"); bind6_handle = bind_args.handle; error = vnet_bind (&bind_args); SESSION_TEST ((error != 0), "double server bind6 should not work"); vnet_unbind_args_t unbind_args = { .handle = bind4_handle, .app_index = server_index, }; error = vnet_unbind (&unbind_args); SESSION_TEST ((error == 0), "unbind4 should work"); unbind_args.handle = bind6_handle; error = vnet_unbind (&unbind_args); SESSION_TEST ((error == 0), "unbind6 should work"); vnet_app_detach_args_t detach_args = { .app_index = server_index, }; vnet_application_detach (&detach_args); return 0; } static int session_test_namespace (vlib_main_t * vm, unformat_input_t * input) { u64 options[APP_OPTIONS_N_OPTIONS], dummy_secret = 1234; u32 server_index, server_st_index, server_local_st_index; u32 dummy_port = 1234, client_index; u32 dummy_api_context = 4321, dummy_client_api_index = 1234; u32 dummy_server_api_index = ~0, sw_if_index = 0; session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; session_endpoint_t client_sep = SESSION_ENDPOINT_NULL; session_endpoint_t intf_sep = SESSION_ENDPOINT_NULL; clib_error_t *error = 0; u8 *ns_id = format (0, "appns1"); app_namespace_t *app_ns; application_t *server; stream_session_t *s; u64 handle; int code; server_sep.is_ip4 = 1; server_sep.port = dummy_port; client_sep.is_ip4 = 1; client_sep.port = dummy_port; memset (options, 0, sizeof (options)); options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; vnet_app_attach_args_t attach_args = { .api_client_index = ~0, .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, }; vnet_bind_args_t bind_args = { .sep = server_sep, .app_index = 0, }; vnet_connect_args_t connect_args = { .sep = client_sep, .app_index = 0, .api_context = 0, }; vnet_unbind_args_t unbind_args = { .handle = bind_args.handle, .app_index = 0, }; vnet_app_detach_args_t detach_args = { .app_index = 0, }; ip4_address_t intf_addr = { .as_u32 = clib_host_to_net_u32 (0x06000105), }; intf_sep.ip.ip4 = intf_addr; intf_sep.is_ip4 = 1; intf_sep.port = dummy_port; /* * Insert namespace and lookup */ vnet_app_namespace_add_del_args_t ns_args = { .ns_id = ns_id, .secret = dummy_secret, .sw_if_index = APP_NAMESPACE_INVALID_INDEX, .is_add = 1 }; error = vnet_app_namespace_add_del (&ns_args); SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", clib_error_get_code (error)); app_ns = app_namespace_get_from_id (ns_id); SESSION_TEST ((app_ns != 0), "should find ns %v status", ns_id); SESSION_TEST ((app_ns->ns_secret == dummy_secret), "secret should be %d", dummy_secret); SESSION_TEST ((app_ns->sw_if_index == APP_NAMESPACE_INVALID_INDEX), "sw_if_index should be invalid"); /* * Try application attach with wrong secret */ options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; options[APP_OPTIONS_NAMESPACE_SECRET] = dummy_secret - 1; attach_args.namespace_id = ns_id; attach_args.api_client_index = dummy_server_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error != 0), "app attachment should fail"); code = clib_error_get_code (error); SESSION_TEST ((code == VNET_API_ERROR_APP_WRONG_NS_SECRET), "code should be wrong ns secret: %d", code); /* * Attach server with global default scope */ options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; options[APP_OPTIONS_NAMESPACE_SECRET] = 0; attach_args.namespace_id = 0; attach_args.api_client_index = dummy_server_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "server attachment should work"); server_index = attach_args.app_index; server = application_get (server_index); SESSION_TEST ((server->ns_index == 0), "server should be in the default ns"); bind_args.app_index = server_index; error = vnet_bind (&bind_args); SESSION_TEST ((error == 0), "server bind should work"); server_st_index = application_session_table (server, FIB_PROTOCOL_IP4); s = session_lookup_listener (server_st_index, &server_sep); SESSION_TEST ((s != 0), "listener should exist in global table"); SESSION_TEST ((s->app_index == server_index), "app_index should be that of " "the server"); server_local_st_index = application_local_session_table (server); SESSION_TEST ((server_local_st_index == APP_INVALID_INDEX), "server shouldn't have access to local table"); unbind_args.app_index = server_index; unbind_args.handle = bind_args.handle; error = vnet_unbind (&unbind_args); SESSION_TEST ((error == 0), "unbind should work"); s = session_lookup_listener (server_st_index, &server_sep); SESSION_TEST ((s == 0), "listener should not exist in global table"); detach_args.app_index = server_index; vnet_application_detach (&detach_args); /* * Attach server with local and global scope */ options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; options[APP_OPTIONS_NAMESPACE_SECRET] = dummy_secret; attach_args.namespace_id = ns_id; attach_args.api_client_index = dummy_server_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "server attachment should work"); server_index = attach_args.app_index; server = application_get (server_index); SESSION_TEST ((server->ns_index == app_namespace_index (app_ns)), "server should be in the right ns"); bind_args.app_index = server_index; error = vnet_bind (&bind_args); SESSION_TEST ((error == 0), "bind should work"); server_st_index = application_session_table (server, FIB_PROTOCOL_IP4); s = session_lookup_listener (server_st_index, &server_sep); SESSION_TEST ((s != 0), "listener should exist in global table"); SESSION_TEST ((s->app_index == server_index), "app_index should be that of " "the server"); server_local_st_index = application_local_session_table (server); handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); SESSION_TEST ((handle != SESSION_INVALID_HANDLE), "listener should exist in local table"); /* * Try client connect with 1) local scope 2) global scope */ options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; attach_args.api_client_index = dummy_client_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "client attachment should work"); client_index = attach_args.app_index; connect_args.api_context = dummy_api_context; connect_args.app_index = client_index; error = vnet_connect (&connect_args); SESSION_TEST ((error != 0), "client connect should return error code"); code = clib_error_get_code (error); SESSION_TEST ((code == VNET_API_ERROR_INVALID_VALUE), "error code should be invalid value (zero ip)"); SESSION_TEST ((dummy_segment_count == 0), "shouldn't have received request to map new segment"); connect_args.sep.ip.ip4.as_u8[0] = 127; error = vnet_connect (&connect_args); SESSION_TEST ((error == 0), "client connect should not return error code"); code = clib_error_get_code (error); SESSION_TEST ((dummy_segment_count == 1), "should've received request to map new segment"); SESSION_TEST ((dummy_accept == 1), "should've received accept request"); detach_args.app_index = client_index; vnet_application_detach (&detach_args); options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; attach_args.api_client_index = dummy_client_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "client attachment should work"); error = vnet_connect (&connect_args); SESSION_TEST ((error != 0), "client connect should return error code"); code = clib_error_get_code (error); SESSION_TEST ((code == VNET_API_ERROR_SESSION_CONNECT), "error code should be connect (nothing in local scope)"); detach_args.app_index = client_index; vnet_application_detach (&detach_args); /* * Unbind and detach server and then re-attach with local scope only */ unbind_args.handle = bind_args.handle; unbind_args.app_index = server_index; error = vnet_unbind (&unbind_args); SESSION_TEST ((error == 0), "unbind should work"); s = session_lookup_listener (server_st_index, &server_sep); SESSION_TEST ((s == 0), "listener should not exist in global table"); handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "listener should not exist in local table"); detach_args.app_index = server_index; vnet_application_detach (&detach_args); options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; attach_args.api_client_index = dummy_server_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "app attachment should work"); server_index = attach_args.app_index; server = application_get (server_index); SESSION_TEST ((server->ns_index == app_namespace_index (app_ns)), "app should be in the right ns"); bind_args.app_index = server_index; error = vnet_bind (&bind_args); SESSION_TEST ((error == 0), "bind should work"); server_st_index = application_session_table (server, FIB_PROTOCOL_IP4); s = session_lookup_listener (server_st_index, &server_sep); SESSION_TEST ((s == 0), "listener should not exist in global table"); server_local_st_index = application_local_session_table (server); handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); SESSION_TEST ((handle != SESSION_INVALID_HANDLE), "listener should exist in local table"); unbind_args.handle = bind_args.handle; error = vnet_unbind (&unbind_args); SESSION_TEST ((error == 0), "unbind should work"); handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "listener should not exist in local table"); /* * Client attach + connect in default ns with local scope */ options[APP_OPTIONS_FLAGS] &= ~APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; attach_args.namespace_id = 0; attach_args.api_client_index = dummy_client_api_index; vnet_application_attach (&attach_args); error = vnet_connect (&connect_args); SESSION_TEST ((error != 0), "client connect should return error code"); code = clib_error_get_code (error); SESSION_TEST ((code == VNET_API_ERROR_SESSION_CONNECT), "error code should be connect (not in same ns)"); detach_args.app_index = client_index; vnet_application_detach (&detach_args); /* * Detach server */ detach_args.app_index = server_index; vnet_application_detach (&detach_args); /* * Create loopback interface */ session_create_lookpback (0, &sw_if_index, &intf_addr); /* * Update namespace */ ns_args.sw_if_index = sw_if_index; error = vnet_app_namespace_add_del (&ns_args); SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", clib_error_get_code (error)); /* * Attach server with local and global scope */ options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; options[APP_OPTIONS_NAMESPACE_SECRET] = dummy_secret; attach_args.namespace_id = ns_id; attach_args.api_client_index = dummy_server_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "server attachment should work"); server_index = attach_args.app_index; bind_args.app_index = server_index; error = vnet_bind (&bind_args); server_st_index = application_session_table (server, FIB_PROTOCOL_IP4); s = session_lookup_listener (server_st_index, &server_sep); SESSION_TEST ((s == 0), "zero listener should not exist in global table"); s = session_lookup_listener (server_st_index, &intf_sep); SESSION_TEST ((s != 0), "intf listener should exist in global table"); SESSION_TEST ((s->app_index == server_index), "app_index should be that of " "the server"); server_local_st_index = application_local_session_table (server); handle = session_lookup_local_endpoint (server_local_st_index, &server_sep); SESSION_TEST ((handle != SESSION_INVALID_HANDLE), "zero listener should exist in local table"); detach_args.app_index = server_index; vnet_application_detach (&detach_args); /* * Cleanup */ vec_free (ns_id); session_delete_loopback (sw_if_index); return 0; } static int session_test_rule_table (vlib_main_t * vm, unformat_input_t * input) { session_rules_table_t _srt, *srt = &_srt; u16 lcl_port = 1234, rmt_port = 4321; u32 action_index = 1, res; ip4_address_t lcl_lkup, rmt_lkup; clib_error_t *error; int verbose = 0; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { if (unformat (input, "verbose")) verbose = 1; else { vlib_cli_output (vm, "parse error: '%U'", format_unformat_error, input); return -1; } } memset (srt, 0, sizeof (*srt)); session_rules_table_init (srt); ip4_address_t lcl_ip = { .as_u32 = clib_host_to_net_u32 (0x01020304), }; ip4_address_t rmt_ip = { .as_u32 = clib_host_to_net_u32 (0x05060708), }; ip4_address_t lcl_ip2 = { .as_u32 = clib_host_to_net_u32 (0x02020202), }; ip4_address_t rmt_ip2 = { .as_u32 = clib_host_to_net_u32 (0x06060606), }; ip4_address_t lcl_ip3 = { .as_u32 = clib_host_to_net_u32 (0x03030303), }; ip4_address_t rmt_ip3 = { .as_u32 = clib_host_to_net_u32 (0x07070707), }; fib_prefix_t lcl_pref = { .fp_addr.ip4.as_u32 = lcl_ip.as_u32, .fp_len = 16, .fp_proto = FIB_PROTOCOL_IP4, }; fib_prefix_t rmt_pref = { .fp_addr.ip4.as_u32 = rmt_ip.as_u32, .fp_len = 16, .fp_proto = FIB_PROTOCOL_IP4, }; session_rule_table_add_del_args_t args = { .lcl = lcl_pref, .rmt = rmt_pref, .lcl_port = lcl_port, .rmt_port = rmt_port, .action_index = action_index++, .is_add = 1, }; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 action %d", action_index - 1); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); SESSION_TEST ((res == 1), "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 1: %d", res); /* * Add 1.2.3.4/24 1234 5.6.7.8/16 4321 and 1.2.3.4/24 1234 5.6.7.8/24 4321 */ args.lcl.fp_addr.ip4 = lcl_ip; args.lcl.fp_len = 24; args.action_index = action_index++; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Add 1.2.3.4/24 1234 5.6.7.8/16 4321 action %d", action_index - 1); args.rmt.fp_addr.ip4 = rmt_ip; args.rmt.fp_len = 24; args.action_index = action_index++; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Add 1.2.3.4/24 1234 5.6.7.8/24 4321 action %d", action_index - 1); /* * Add 2.2.2.2/24 1234 6.6.6.6/16 4321 and 3.3.3.3/24 1234 7.7.7.7/16 4321 */ args.lcl.fp_addr.ip4 = lcl_ip2; args.lcl.fp_len = 24; args.rmt.fp_addr.ip4 = rmt_ip2; args.rmt.fp_len = 16; args.action_index = action_index++; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Add 2.2.2.2/24 1234 6.6.6.6/16 4321 action %d", action_index - 1); args.lcl.fp_addr.ip4 = lcl_ip3; args.rmt.fp_addr.ip4 = rmt_ip3; args.action_index = action_index++; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Add 3.3.3.3/24 1234 7.7.7.7/16 4321 action %d", action_index - 1); /* * Add again 3.3.3.3/24 1234 7.7.7.7/16 4321 */ args.lcl.fp_addr.ip4 = lcl_ip3; args.rmt.fp_addr.ip4 = rmt_ip3; args.action_index = action_index++; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "overwrite 3.3.3.3/24 1234 7.7.7.7/16 4321 " "action %d", action_index - 1); /* * Lookup 1.2.3.4/32 1234 5.6.7.8/32 4321, 1.2.2.4/32 1234 5.6.7.9/32 4321 * and 3.3.3.3 1234 7.7.7.7 4321 */ res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); SESSION_TEST ((res == 3), "Lookup 1.2.3.4 1234 5.6.7.8 4321 action " "should be 3: %d", res); lcl_lkup.as_u32 = clib_host_to_net_u32 (0x01020204); rmt_lkup.as_u32 = clib_host_to_net_u32 (0x05060709); res = session_rules_table_lookup4 (srt, &lcl_lkup, &rmt_lkup, lcl_port, rmt_port); SESSION_TEST ((res == 1), "Lookup 1.2.2.4 1234 5.6.7.9 4321, action " "should be 1: %d", res); res = session_rules_table_lookup4 (srt, &lcl_ip3, &rmt_ip3, lcl_port, rmt_port); SESSION_TEST ((res == 6), "Lookup 3.3.3.3 1234 7.7.7.7 4321, action " "should be 6 (updated): %d", res); /* * Add 1.2.3.4/24 * 5.6.7.8/24 * * Lookup 1.2.3.4 1234 5.6.7.8 4321 and 1.2.3.4 1235 5.6.7.8 4321 */ args.lcl.fp_addr.ip4 = lcl_ip; args.rmt.fp_addr.ip4 = rmt_ip; args.lcl.fp_len = 24; args.rmt.fp_len = 24; args.lcl_port = 0; args.rmt_port = 0; args.action_index = action_index++; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Add 1.2.3.4/24 * 5.6.7.8/24 * action %d", action_index - 1); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); SESSION_TEST ((res == 7), "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should" " be 7 (lpm dst): %d", res); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port + 1, rmt_port); SESSION_TEST ((res == 7), "Lookup 1.2.3.4 1235 5.6.7.8 4321, action should " "be 7: %d", res); /* * Del 1.2.3.4/24 * 5.6.7.8/24 * * Add 1.2.3.4/16 * 5.6.7.8/16 * and 1.2.3.4/24 1235 5.6.7.8/24 4321 * Lookup 1.2.3.4 1234 5.6.7.8 4321, 1.2.3.4 1235 5.6.7.8 4321 and * 1.2.3.4 1235 5.6.7.8 4322 */ args.is_add = 0; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Del 1.2.3.4/24 * 5.6.7.8/24 *"); args.lcl.fp_addr.ip4 = lcl_ip; args.rmt.fp_addr.ip4 = rmt_ip; args.lcl.fp_len = 16; args.rmt.fp_len = 16; args.lcl_port = 0; args.rmt_port = 0; args.action_index = action_index++; args.is_add = 1; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Add 1.2.3.4/16 * 5.6.7.8/16 * action %d", action_index - 1); args.lcl.fp_addr.ip4 = lcl_ip; args.rmt.fp_addr.ip4 = rmt_ip; args.lcl.fp_len = 24; args.rmt.fp_len = 24; args.lcl_port = lcl_port + 1; args.rmt_port = rmt_port; args.action_index = action_index++; args.is_add = 1; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Add 1.2.3.4/24 1235 5.6.7.8/24 4321 action %d", action_index - 1); if (verbose) session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); SESSION_TEST ((res == 3), "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d", res); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port + 1, rmt_port); SESSION_TEST ((res == 9), "Lookup 1.2.3.4 1235 5.6.7.8 4321, action should " "be 9: %d", res); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port + 1, rmt_port + 1); SESSION_TEST ((res == 8), "Lookup 1.2.3.4 1235 5.6.7.8 4322, action should " "be 8: %d", res); /* * Delete 1.2.0.0/16 1234 5.6.0.0/16 4321 and 1.2.0.0/16 * 5.6.0.0/16 * * Lookup 1.2.3.4 1234 5.6.7.8 4321 */ args.lcl_port = 1234; args.rmt_port = 4321; args.lcl.fp_len = 16; args.rmt.fp_len = 16; args.is_add = 0; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Del 1.2.0.0/16 1234 5.6.0.0/16 4321"); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); SESSION_TEST ((res == 3), "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d", res); args.lcl_port = 0; args.rmt_port = 0; args.is_add = 0; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Del 1.2.0.0/16 * 5.6.0.0/16 *"); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); SESSION_TEST ((res == 3), "Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d", res); /* * Delete 1.2.3.4/24 1234 5.6.7.5/24 */ args.lcl.fp_addr.ip4 = lcl_ip; args.rmt.fp_addr.ip4 = rmt_ip; args.lcl.fp_len = 24; args.rmt.fp_len = 24; args.lcl_port = 1234; args.rmt_port = 4321; args.is_add = 0; error = session_rules_table_add_del (srt, &args); SESSION_TEST ((error == 0), "Del 1.2.3.4/24 1234 5.6.7.5/24"); res = session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port); SESSION_TEST ((res == 2), "Action should be 2: %d", res); return 0; } static int session_test_rules (vlib_main_t * vm, unformat_input_t * input) { session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; u64 options[APP_OPTIONS_N_OPTIONS]; u16 lcl_port = 1234, rmt_port = 4321; u32 server_index, server_index2; u32 dummy_server_api_index = ~0; transport_connection_t *tc; u32 dummy_port = 1111; clib_error_t *error = 0; u8 is_filtered = 0, *ns_id = format (0, "appns1"); stream_session_t *listener, *s; app_namespace_t *default_ns = app_namespace_get_default (); u32 local_ns_index = default_ns->local_table_index; int verbose = 0, rv; app_namespace_t *app_ns; u64 handle; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { if (unformat (input, "verbose")) verbose = 1; else { vlib_cli_output (vm, "parse error: '%U'", format_unformat_error, input); return -1; } } server_sep.is_ip4 = 1; server_sep.port = dummy_port; memset (options, 0, sizeof (options)); vnet_app_attach_args_t attach_args = { .api_client_index = ~0, .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, }; vnet_bind_args_t bind_args = { .sep = server_sep, .app_index = 0, }; /* * Attach server with global and local default scope */ options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; attach_args.namespace_id = 0; attach_args.api_client_index = dummy_server_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "server attached"); server_index = attach_args.app_index; bind_args.app_index = server_index; error = vnet_bind (&bind_args); SESSION_TEST ((error == 0), "server bound to %U/%d", format_ip46_address, &server_sep.ip, 1, server_sep.port); listener = listen_session_get_from_handle (bind_args.handle); ip4_address_t lcl_ip = { .as_u32 = clib_host_to_net_u32 (0x01020304), }; ip4_address_t rmt_ip = { .as_u32 = clib_host_to_net_u32 (0x05060708), }; fib_prefix_t lcl_pref = { .fp_addr.ip4.as_u32 = lcl_ip.as_u32, .fp_len = 16, .fp_proto = FIB_PROTOCOL_IP4, }; fib_prefix_t rmt_pref = { .fp_addr.ip4.as_u32 = rmt_ip.as_u32, .fp_len = 16, .fp_proto = FIB_PROTOCOL_IP4, }; tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "optimized lookup should not work (port)"); /* * Add 1.2.3.4/16 1234 5.6.7.8/16 4321 action server_index */ session_rule_add_del_args_t args = { .table_args.lcl = lcl_pref, .table_args.rmt = rmt_pref, .table_args.lcl_port = lcl_port, .table_args.rmt_port = rmt_port, .table_args.action_index = server_index, .table_args.is_add = 1, .appns_index = 0, }; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 action %d", args.table_args.action_index); tc = session_lookup_connection4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP); SESSION_TEST ((tc->c_index == listener->connection_index), "optimized lookup should return the listener"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc->c_index == listener->connection_index), "lookup should return the listener"); s = session_lookup_safe4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP); SESSION_TEST ((s->connection_index == listener->connection_index), "safe lookup should return the listener"); session_endpoint_t sep = { .ip = rmt_pref.fp_addr, .is_ip4 = 1, .port = rmt_port, .transport_proto = TRANSPORT_PROTO_TCP, }; handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle != server_index), "local session endpoint lookup " "should not work (global scope)"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port + 1, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "optimized lookup for wrong lcl port + 1 should not work"); /* * Add 1.2.3.4/16 * 5.6.7.8/16 4321 */ args.table_args.lcl_port = 0; args.scope = SESSION_RULE_SCOPE_LOCAL | SESSION_RULE_SCOPE_GLOBAL; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add 1.2.3.4/16 * 5.6.7.8/16 4321 action %d", args.table_args.action_index); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port + 1, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc->c_index == listener->connection_index), "optimized lookup for lcl port + 1 should work"); handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle == server_index), "local session endpoint lookup " "should work (lcl ip was zeroed)"); /* * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) */ args.table_args.lcl_port = 1234; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 30; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 30; args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add 1.2.3.4/30 1234 5.6.7.8/30 4321 action %d", args.table_args.action_index); if (verbose) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 " "should fail (deny rule)"); SESSION_TEST ((is_filtered == 1), "lookup should be filtered (deny)"); handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " "5.6.7.8/16 4321 in local table should return deny"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port + 1, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc->c_index == listener->connection_index), "lookup 1.2.3.4/32 123*5* 5.6.7.8/16 4321 should work"); /* * "Mask" deny rule with more specific allow: * Add allow rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -3 (allow) */ args.table_args.is_add = 1; args.table_args.lcl_port = 1234; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 32; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 32; args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add masking rule 1.2.3.4/30 1234 5.6.7.8/32 " "4321 action %d", args.table_args.action_index); is_filtered = 0; tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "lookup for 1.2.3.4/32 1234 5.6.7.8/16 4321 " "should fail (allow without app)"); SESSION_TEST ((is_filtered == 0), "lookup should NOT be filtered"); handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "lookup for 1.2.3.4/32 " "1234 5.6.7.8/32 4321 in local table should return invalid"); if (verbose) { vlib_cli_output (vm, "Local rules"); session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } sep.ip.ip4.as_u32 += 1 << 24; handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234" " 5.6.7.9/32 4321 in local table should return deny"); vnet_connect_args_t connect_args = { .sep = sep, .app_index = attach_args.app_index, .api_context = 0, }; /* Try connecting */ error = vnet_connect (&connect_args); SESSION_TEST ((error != 0), "connect should fail"); rv = clib_error_get_code (error); SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), "connect should be filtered"); sep.ip.ip4.as_u32 -= 1 << 24; /* * Delete masking rule: 1.2.3.4/32 1234 5.6.7.8/32 4321 allow */ args.table_args.is_add = 0; args.table_args.lcl_port = 1234; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 32; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 32; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 allow"); /* * Add local scope rule for 0/0 * 5.6.7.8/16 4321 action server_index */ args.table_args.is_add = 1; args.table_args.lcl_port = 0; args.table_args.lcl.fp_len = 0; args.table_args.rmt.fp_len = 16; args.table_args.action_index = -1; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add * * 5.6.7.8/16 4321 action %d", args.table_args.action_index); if (verbose) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle == SESSION_DROP_HANDLE), "local session endpoint lookup should return deny"); /* * Delete 1.2.3.4/32 1234 5.6.7.8/32 4321 deny */ args.table_args.is_add = 0; args.table_args.lcl_port = 1234; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 30; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 30; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny"); handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "local session endpoint lookup should return invalid"); /* * Delete 0/0 * 5.6.7.8/16 4321, 1.2.3.4/16 * 5.6.7.8/16 4321 and * 1.2.3.4/16 1234 5.6.7.8/16 4321 */ args.table_args.is_add = 0; args.table_args.lcl_port = 0; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 0; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 16; args.table_args.rmt_port = 4321; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 0/0 * 5.6.7.8/16 4321"); handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle != server_index), "local session endpoint lookup " "should not work (removed)"); args.table_args.is_add = 0; args.table_args.lcl = lcl_pref; args.table_args.is_add = 0; args.table_args.lcl_port = 0; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 16; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 16; args.table_args.rmt_port = 4321; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 1.2.3.4/16 * 5.6.7.8/16 4321"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port + 1, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 123*5* 5.6.7.8/16 4321 should not " "work (del)"); args.table_args.is_add = 0; args.table_args.lcl_port = 1234; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 16; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 16; args.table_args.rmt_port = 4321; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 1.2.3.4/16 1234 5.6.7.8/16 4321"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should " "not work (del + deny)"); SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny"); tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should" " not work (no-rule)"); /* * Test tags. Add/overwrite/del rule with tag */ args.table_args.is_add = 1; args.table_args.lcl_port = 1234; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 16; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 16; args.table_args.rmt_port = 4321; args.table_args.tag = format (0, "test_rule"); args.table_args.action_index = server_index; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 deny " "tag test_rule"); if (verbose) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc->c_index == listener->connection_index), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should work"); vec_free (args.table_args.tag); args.table_args.lcl_port = 1234; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 16; args.table_args.tag = format (0, "test_rule_overwrite"); error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Overwrite 1.2.3.4/16 1234 5.6.7.8/16 4321 deny tag test_rule" " should work"); if (verbose) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } args.table_args.is_add = 0; args.table_args.lcl_port += 1; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 deny " "tag %v", args.table_args.tag); if (verbose) { session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } tc = session_lookup_connection_wt4 (0, &lcl_pref.fp_addr.ip4, &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/32 4321 should not" " work (del)"); /* * Test local rules with multiple namespaces */ /* * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) */ args.table_args.is_add = 1; args.table_args.lcl_port = 1234; args.table_args.rmt_port = 0; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 32; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 32; args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; args.table_args.tag = 0; args.scope = SESSION_RULE_SCOPE_LOCAL; error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d", args.table_args.action_index); /* * Add 'white' rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) */ args.table_args.is_add = 1; args.table_args.lcl_port = 1234; args.table_args.rmt_port = 4321; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 32; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 32; args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW; error = vnet_session_rule_add_del (&args); if (verbose) { session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, TRANSPORT_PROTO_TCP); } vnet_app_namespace_add_del_args_t ns_args = { .ns_id = ns_id, .secret = 0, .sw_if_index = APP_NAMESPACE_INVALID_INDEX, .is_add = 1 }; error = vnet_app_namespace_add_del (&ns_args); SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", clib_error_get_code (error)); app_ns = app_namespace_get_from_id (ns_id); attach_args.namespace_id = ns_id; attach_args.api_client_index = dummy_server_api_index - 1; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "server2 attached"); server_index2 = attach_args.app_index; /* * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) */ args.table_args.lcl_port = 1234; args.table_args.rmt_port = 0; args.table_args.lcl.fp_addr.ip4 = lcl_ip; args.table_args.lcl.fp_len = 32; args.table_args.rmt.fp_addr.ip4 = rmt_ip; args.table_args.rmt.fp_len = 32; args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; args.appns_index = app_namespace_index (app_ns); error = vnet_session_rule_add_del (&args); SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d " "in test namespace", args.table_args.action_index); /* * Lookup default namespace */ handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle == SESSION_INVALID_HANDLE), "lookup for 1.2.3.4/32 1234 5.6.7.8/32 4321 in local table " "should return allow (invalid)"); sep.port += 1; handle = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " "5.6.7.8/16 432*2* in local table should return deny"); connect_args.app_index = server_index; connect_args.sep = sep; error = vnet_connect (&connect_args); SESSION_TEST ((error != 0), "connect should fail"); rv = clib_error_get_code (error); SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), "connect should be filtered"); /* * Lookup test namespace */ handle = session_lookup_local_endpoint (app_ns->local_table_index, &sep); SESSION_TEST ((handle == SESSION_DROP_HANDLE), "lookup for 1.2.3.4/32 1234 " "5.6.7.8/16 4321 in local table should return deny"); connect_args.app_index = server_index; error = vnet_connect (&connect_args); SESSION_TEST ((error != 0), "connect should fail"); rv = clib_error_get_code (error); SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), "connect should be filtered"); args.table_args.is_add = 0; vnet_session_rule_add_del (&args); args.appns_index = 0; args.table_args.is_add = 0; vnet_session_rule_add_del (&args); args.table_args.rmt_port = 4321; vnet_session_rule_add_del (&args); /* * Final Cleanup */ vec_free (args.table_args.tag); vnet_app_detach_args_t detach_args = { .app_index = server_index, }; vnet_application_detach (&detach_args); detach_args.app_index = server_index2; vnet_application_detach (&detach_args); vec_free (ns_id); return 0; } static int session_test_proxy (vlib_main_t * vm, unformat_input_t * input) { u64 options[APP_OPTIONS_N_OPTIONS]; char *show_listeners = "sh session listeners tcp verbose"; char *show_local_listeners = "sh app ns table default"; unformat_input_t tmp_input; u32 server_index, app_index; u32 dummy_server_api_index = ~0, sw_if_index = 0; clib_error_t *error = 0; u8 sst, is_filtered = 0; stream_session_t *s; transport_connection_t *tc; u16 lcl_port = 1234, rmt_port = 4321; app_namespace_t *app_ns; int verbose = 0; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { if (unformat (input, "verbose")) verbose = 1; else { vlib_cli_output (vm, "parse error: '%U'", format_unformat_error, input); return -1; } } ip4_address_t lcl_ip = { .as_u32 = clib_host_to_net_u32 (0x01020304), }; ip4_address_t rmt_ip = { .as_u32 = clib_host_to_net_u32 (0x05060708), }; fib_prefix_t rmt_pref = { .fp_addr.ip4.as_u32 = rmt_ip.as_u32, .fp_len = 16, .fp_proto = FIB_PROTOCOL_IP4, }; session_endpoint_t sep = { .ip = rmt_pref.fp_addr, .is_ip4 = 1, .port = rmt_port, .transport_proto = TRANSPORT_PROTO_TCP, }; /* * Create loopback interface */ session_create_lookpback (0, &sw_if_index, &lcl_ip); app_ns = app_namespace_get_default (); app_ns->sw_if_index = sw_if_index; memset (options, 0, sizeof (options)); options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_ACCEPT_REDIRECT; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_IS_PROXY; options[APP_OPTIONS_PROXY_TRANSPORT] = 1 << TRANSPORT_PROTO_TCP; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE; vnet_app_attach_args_t attach_args = { .api_client_index = ~0, .options = options, .namespace_id = 0, .session_cb_vft = &dummy_session_cbs, }; attach_args.api_client_index = dummy_server_api_index; error = vnet_application_attach (&attach_args); SESSION_TEST ((error == 0), "server attachment should work"); server_index = attach_args.app_index; if (verbose) { unformat_init_string (&tmp_input, show_listeners, strlen (show_listeners)); vlib_cli_input (vm, &tmp_input, 0, 0); unformat_init_string (&tmp_input, show_local_listeners, strlen (show_local_listeners)); vlib_cli_input (vm, &tmp_input, 0, 0); } tc = session_lookup_connection_wt4 (0, &lcl_ip, &rmt_ip, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc != 0), "lookup 1.2.3.4 1234 5.6.7.8 4321 should be " "successful"); sst = session_type_from_proto_and_ip (TRANSPORT_PROTO_TCP, 1); s = listen_session_get (sst, tc->s_index); SESSION_TEST ((s->app_index == server_index), "lookup should return the" " server"); tc = session_lookup_connection_wt4 (0, &rmt_ip, &rmt_ip, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); SESSION_TEST ((tc == 0), "lookup 5.6.7.8 1234 5.6.7.8 4321 should" " not work"); app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep); SESSION_TEST ((app_index == server_index), "local session endpoint lookup" " should work"); vnet_app_detach_args_t detach_args = { .app_index = server_index, }; vnet_application_detach (&detach_args); if (verbose) { unformat_init_string (&tmp_input, show_listeners, strlen (show_listeners)); vlib_cli_input (vm, &tmp_input, 0, 0); unformat_init_string (&tmp_input, show_local_listeners, strlen (show_local_listeners)); vlib_cli_input (vm, &tmp_input, 0, 0); } app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep); SESSION_TEST ((app_index == SESSION_RULES_TABLE_INVALID_INDEX), "local session endpoint lookup should not work after detach"); if (verbose) unformat_free (&tmp_input); return 0; } static clib_error_t * session_test (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd_arg) { int res = 0; vnet_session_enable_disable (vm, 1); while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { if (unformat (input, "basic")) res = session_test_basic (vm, input); else if (unformat (input, "namespace")) res = session_test_namespace (vm, input); else if (unformat (input, "rules-table")) res = session_test_rule_table (vm, input); else if (unformat (input, "rules")) res = session_test_rules (vm, input); else if (unformat (input, "proxy")) res = session_test_proxy (vm, input); else if (unformat (input, "all")) { if ((res = session_test_basic (vm, input))) goto done; if ((res = session_test_namespace (vm, input))) goto done; if ((res = session_test_rule_table (vm, input))) goto done; if ((res = session_test_rules (vm, input))) goto done; if ((res = session_test_proxy (vm, input))) goto done; } else break; } done: if (res) return clib_error_return (0, "Session unit test failed"); return 0; } /* *INDENT-OFF* */ VLIB_CLI_COMMAND (tcp_test_command, static) = { .path = "test session", .short_help = "internal session unit tests", .function = session_test, }; /* *INDENT-ON* */ /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */


context:
space:
mode: