From 8f107b3686998f1e74353db0b7d0baa10ed4b754 Mon Sep 17 00:00:00 2001 From: Florin Coras Date: Tue, 21 Nov 2017 22:13:03 -0800 Subject: session: more rules unit tests and cli improvements Change-Id: I7e5545297ab9f2db8d7d07e44c744bdb0a0874a7 Signed-off-by: Florin Coras --- src/vnet/session/application.c | 14 ++-- src/vnet/session/application_namespace.c | 9 +- src/vnet/session/session_test.c | 136 +++++++++++++++++++++++++++++-- 3 files changed, 142 insertions(+), 17 deletions(-) (limited to 'src/vnet') diff --git a/src/vnet/session/application.c b/src/vnet/session/application.c index e7e580863ae..17770bec2e0 100644 --- a/src/vnet/session/application.c +++ b/src/vnet/session/application.c @@ -737,12 +737,12 @@ format_application (u8 * s, va_list * args) { if (verbose) s = format (s, "%-10s%-20s%-15s%-15s%-15s%-15s%-15s", "Index", "Name", - "Namespace", "API Client", "Add seg size", "Rx fifo size", + "API Client", "Namespace", "Add seg size", "Rx fifo size", "Tx fifo size"); else s = - format (s, "%-10s%-20s%-15s%-20s", "Index", "Name", "Namespace", - "API Client"); + format (s, "%-10s%-20s%-15s%-40s", "Index", "Name", "API Client", + "Namespace"); return s; } @@ -751,13 +751,13 @@ format_application (u8 * s, va_list * args) props = segment_manager_properties_get (app->sm_properties); if (verbose) s = - format (s, "%-10d%-20s%-15s%-15d%-15d%-15d%-15d", app->index, app_name, - app_ns_name, app->api_client_index, + format (s, "%-10d%-20s%-15d%-15d%-15d%-15d%-15d", app->index, app_name, + app->api_client_index, app->ns_index, props->add_segment_size, props->rx_fifo_size, props->tx_fifo_size); else - s = format (s, "%-10d%-20s%-15s%-20d", app->index, app_name, app_ns_name, - app->api_client_index); + s = format (s, "%-10d%-20s%-15d%-40s", app->index, app_name, + app->api_client_index, app_ns_name); return s; } diff --git a/src/vnet/session/application_namespace.c b/src/vnet/session/application_namespace.c index 21c1cbc92c6..8bd5b65f7fc 100644 --- a/src/vnet/session/application_namespace.c +++ b/src/vnet/session/application_namespace.c @@ -248,9 +248,8 @@ u8 * format_app_namespace (u8 * s, va_list * args) { app_namespace_t *app_ns = va_arg (*args, app_namespace_t *); - s = format (s, "%-20v%-10u%-20lu%-20u", app_ns->ns_id, - app_namespace_index (app_ns), app_ns->ns_secret, - app_ns->sw_if_index); + s = format (s, "%-10u%-20lu%-20u%-50v", app_namespace_index (app_ns), + app_ns->ns_secret, app_ns->sw_if_index, app_ns->ns_id); return s; } @@ -303,8 +302,8 @@ show_app_ns_fn (vlib_main_t * vm, unformat_input_t * main_input, } do_ns_list: - vlib_cli_output (vm, "%-20s%-10s%-20s%-20s", "Namespace", "Index", "Secret", - "sw_if_index"); + vlib_cli_output (vm, "%-10s%-20s%-20s%-50s", "Index", "Secret", + "sw_if_index", "Name"); /* *INDENT-OFF* */ pool_foreach (app_ns, app_namespace_pool, ({ diff --git a/src/vnet/session/session_test.c b/src/vnet/session/session_test.c index 58d0d28ff6c..bf3cea2a97c 100644 --- a/src/vnet/session/session_test.c +++ b/src/vnet/session/session_test.c @@ -776,16 +776,17 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) session_endpoint_t server_sep = SESSION_ENDPOINT_NULL; u64 options[SESSION_OPTIONS_N_OPTIONS]; u16 lcl_port = 1234, rmt_port = 4321; - u32 server_index, app_index; + u32 server_index, server_index2, app_index; u32 dummy_server_api_index = ~0; transport_connection_t *tc; u32 dummy_port = 1111; clib_error_t *error = 0; - u8 segment_name[128], is_filtered = 0; + u8 segment_name[128], is_filtered = 0, *ns_id = format (0, "appns1"); stream_session_t *listener, *s; app_namespace_t *default_ns = app_namespace_get_default (); u32 local_ns_index = default_ns->local_table_index; int verbose = 0, rv; + app_namespace_t *app_ns; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { @@ -989,7 +990,7 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) app_index = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((app_index == APP_INVALID_INDEX), "lookup for 1.2.3.4/32 1234" - " 5.6.7.8/16 4321 in local table should return invalid"); + " 5.6.7.8/32 4321 in local table should return invalid"); if (verbose) { @@ -1001,7 +1002,7 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) sep.ip.ip4.as_u32 += 1 << 24; app_index = session_lookup_local_endpoint (local_ns_index, &sep); SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234" - " 5.6.7.9/16 4321 in local table should return invalid"); + " 5.6.7.9/32 4321 in local table should return deny"); vnet_connect_args_t connect_args = { .sep = sep, @@ -1179,13 +1180,138 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input) &rmt_pref.fp_addr.ip4, lcl_port, rmt_port, TRANSPORT_PROTO_TCP, 0, &is_filtered); - SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/16 4321 should not" + SESSION_TEST ((tc == 0), "lookup 1.2.3.4/32 1234 5.6.7.8/32 4321 should not" " work (del)"); + + + /* + * Test local rules with multiple namespaces + */ + + /* + * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) + */ + args.table_args.is_add = 1; + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 0; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; + args.table_args.tag = 0; + args.scope = SESSION_RULE_SCOPE_LOCAL; + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d", + args.table_args.action_index); + /* + * Add 'white' rule 1.2.3.4/32 1234 5.6.7.8/32 4321 action -2 (drop) + */ + args.table_args.is_add = 1; + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 4321; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_ALLOW; + error = vnet_session_rule_add_del (&args); + + if (verbose) + { + session_lookup_dump_local_rules_table (local_ns_index, FIB_PROTOCOL_IP4, + TRANSPORT_PROTO_TCP); + } + + vnet_app_namespace_add_del_args_t ns_args = { + .ns_id = ns_id, + .secret = 0, + .sw_if_index = APP_NAMESPACE_INVALID_INDEX, + .is_add = 1 + }; + error = vnet_app_namespace_add_del (&ns_args); + SESSION_TEST ((error == 0), "app ns insertion should succeed: %d", + clib_error_get_code (error)); + app_ns = app_namespace_get_from_id (ns_id); + + attach_args.namespace_id = ns_id; + attach_args.api_client_index = dummy_server_api_index - 1; + error = vnet_application_attach (&attach_args); + SESSION_TEST ((error == 0), "server2 attached"); + server_index2 = attach_args.app_index; + + /* + * Add deny rule 1.2.3.4/32 1234 5.6.7.8/32 0 action -2 (drop) + */ + args.table_args.lcl_port = 1234; + args.table_args.rmt_port = 0; + args.table_args.lcl.fp_addr.ip4 = lcl_ip; + args.table_args.lcl.fp_len = 32; + args.table_args.rmt.fp_addr.ip4 = rmt_ip; + args.table_args.rmt.fp_len = 32; + args.table_args.action_index = SESSION_RULES_TABLE_ACTION_DROP; + args.appns_index = app_namespace_index (app_ns); + + error = vnet_session_rule_add_del (&args); + SESSION_TEST ((error == 0), "Add 1.2.3.4/32 1234 5.6.7.8/32 4321 action %d " + "in test namespace", args.table_args.action_index); + /* + * Lookup default namespace + */ + app_index = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((app_index == APP_INVALID_INDEX), + "lookup for 1.2.3.4/32 1234 5.6.7.8/32 4321 in local table " + "should return allow (invalid)"); + + sep.port += 1; + app_index = session_lookup_local_endpoint (local_ns_index, &sep); + SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234 " + "5.6.7.8/16 432*2* in local table should return deny"); + + connect_args.app_index = server_index; + connect_args.sep = sep; + error = vnet_connect (&connect_args); + SESSION_TEST ((error != 0), "connect should fail"); + rv = clib_error_get_code (error); + SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), + "connect should be filtered"); + + /* + * Lookup test namespace + */ + app_index = session_lookup_local_endpoint (app_ns->local_table_index, &sep); + SESSION_TEST ((app_index == APP_DROP_INDEX), "lookup for 1.2.3.4/32 1234 " + "5.6.7.8/16 4321 in local table should return deny"); + + connect_args.app_index = server_index; + error = vnet_connect (&connect_args); + SESSION_TEST ((error != 0), "connect should fail"); + rv = clib_error_get_code (error); + SESSION_TEST ((rv == VNET_API_ERROR_APP_CONNECT_FILTERED), + "connect should be filtered"); + + args.table_args.is_add = 0; + vnet_session_rule_add_del (&args); + + args.appns_index = 0; + args.table_args.is_add = 0; + vnet_session_rule_add_del (&args); + + args.table_args.rmt_port = 4321; + vnet_session_rule_add_del (&args); + /* + * Final Cleanup + */ vec_free (args.table_args.tag); vnet_app_detach_args_t detach_args = { .app_index = server_index, }; vnet_application_detach (&detach_args); + + detach_args.app_index = server_index2; + vnet_application_detach (&detach_args); + + vec_free (ns_id); return 0; } -- cgit 1.2.3-korg