blob: 927922e7e645f928ab87943bdc209622d64e0a9f [file] [log] [blame]
Florin Coras04e53442017-07-16 17:12:15 -07001/*
2 * Copyright (c) 2017 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16/** Generate typed init functions for multiple hash table styles... */
17#include <vppinfra/bihash_16_8.h>
18#include <vppinfra/bihash_template.h>
19
20#include <vppinfra/bihash_template.c>
21
22#undef __included_bihash_template_h__
23
24#include <vppinfra/bihash_48_8.h>
25#include <vppinfra/bihash_template.h>
26
27#include <vppinfra/bihash_template.c>
28#include <vnet/session/session_lookup.h>
29#include <vnet/session/session.h>
Florin Corascea194d2017-10-02 00:18:51 -070030#include <vnet/session/application.h>
Florin Coras04e53442017-07-16 17:12:15 -070031
Florin Corascea194d2017-10-02 00:18:51 -070032/**
33 * External vector of per transport virtual functions table
34 */
Florin Coras04e53442017-07-16 17:12:15 -070035extern transport_proto_vft_t *tp_vfts;
36
Florin Corascea194d2017-10-02 00:18:51 -070037/**
38 * Network namespace index (i.e., fib index) to session lookup table. We
39 * should have one per network protocol type but for now we only support IP4/6
40 */
41static u32 *fib_index_to_table_index[2];
42
Florin Coras04e53442017-07-16 17:12:15 -070043/* *INDENT-OFF* */
44/* 16 octets */
45typedef CLIB_PACKED (struct {
46 union
47 {
48 struct
49 {
50 ip4_address_t src;
51 ip4_address_t dst;
52 u16 src_port;
53 u16 dst_port;
54 /* align by making this 4 octets even though its a 1-bit field
55 * NOTE: avoid key overlap with other transports that use 5 tuples for
56 * session identification.
57 */
58 u32 proto;
59 };
60 u64 as_u64[2];
61 };
62}) v4_connection_key_t;
63
64typedef CLIB_PACKED (struct {
65 union
66 {
67 struct
68 {
69 /* 48 octets */
70 ip6_address_t src;
71 ip6_address_t dst;
72 u16 src_port;
73 u16 dst_port;
74 u32 proto;
75 u64 unused;
76 };
77 u64 as_u64[6];
78 };
79}) v6_connection_key_t;
80/* *INDENT-ON* */
81
82typedef clib_bihash_kv_16_8_t session_kv4_t;
83typedef clib_bihash_kv_48_8_t session_kv6_t;
84
85always_inline void
86make_v4_ss_kv (session_kv4_t * kv, ip4_address_t * lcl, ip4_address_t * rmt,
87 u16 lcl_port, u16 rmt_port, u8 proto)
88{
Florin Coras9679c812018-06-21 08:14:34 -070089 kv->key[0] = (u64) rmt->as_u32 << 32 | (u64) lcl->as_u32;
90 kv->key[1] = (u64) proto << 32 | (u64) rmt_port << 16 | (u64) lcl_port;
Florin Coras04e53442017-07-16 17:12:15 -070091 kv->value = ~0ULL;
92}
93
94always_inline void
95make_v4_listener_kv (session_kv4_t * kv, ip4_address_t * lcl, u16 lcl_port,
96 u8 proto)
97{
Florin Coras9679c812018-06-21 08:14:34 -070098 kv->key[0] = (u64) lcl->as_u32;
99 kv->key[1] = (u64) proto << 32 | (u64) lcl_port;
Florin Coras04e53442017-07-16 17:12:15 -0700100 kv->value = ~0ULL;
101}
102
103always_inline void
Florin Corasdbd44562017-11-09 19:30:17 -0800104make_v4_proxy_kv (session_kv4_t * kv, ip4_address_t * lcl, u8 proto)
105{
Florin Coras9679c812018-06-21 08:14:34 -0700106 kv->key[0] = (u64) lcl->as_u32;
107 kv->key[1] = (u64) proto << 32;
Florin Corasdbd44562017-11-09 19:30:17 -0800108 kv->value = ~0ULL;
109}
110
111always_inline void
Florin Coras561af9b2017-12-09 10:19:43 -0800112make_v4_ss_kv_from_tc (session_kv4_t * kv, transport_connection_t * tc)
Florin Coras04e53442017-07-16 17:12:15 -0700113{
Florin Coras561af9b2017-12-09 10:19:43 -0800114 make_v4_ss_kv (kv, &tc->lcl_ip.ip4, &tc->rmt_ip.ip4, tc->lcl_port,
115 tc->rmt_port, tc->proto);
Florin Coras04e53442017-07-16 17:12:15 -0700116}
117
118always_inline void
119make_v6_ss_kv (session_kv6_t * kv, ip6_address_t * lcl, ip6_address_t * rmt,
120 u16 lcl_port, u16 rmt_port, u8 proto)
121{
Florin Coras9679c812018-06-21 08:14:34 -0700122 kv->key[0] = lcl->as_u64[0];
123 kv->key[1] = lcl->as_u64[1];
124 kv->key[2] = rmt->as_u64[0];
125 kv->key[3] = rmt->as_u64[1];
126 kv->key[4] = (u64) proto << 32 | (u64) rmt_port << 16 | (u64) lcl_port;
127 kv->key[5] = 0;
Florin Coras04e53442017-07-16 17:12:15 -0700128 kv->value = ~0ULL;
129}
130
131always_inline void
132make_v6_listener_kv (session_kv6_t * kv, ip6_address_t * lcl, u16 lcl_port,
133 u8 proto)
134{
Florin Coras9679c812018-06-21 08:14:34 -0700135 kv->key[0] = lcl->as_u64[0];
136 kv->key[1] = lcl->as_u64[1];
137 kv->key[2] = 0;
138 kv->key[3] = 0;
139 kv->key[4] = (u64) proto << 32 | (u64) lcl_port;
140 kv->key[5] = 0;
Florin Coras04e53442017-07-16 17:12:15 -0700141 kv->value = ~0ULL;
142}
143
144always_inline void
Florin Corasdbd44562017-11-09 19:30:17 -0800145make_v6_proxy_kv (session_kv6_t * kv, ip6_address_t * lcl, u8 proto)
146{
Florin Coras9679c812018-06-21 08:14:34 -0700147 kv->key[0] = lcl->as_u64[0];
148 kv->key[1] = lcl->as_u64[1];
149 kv->key[2] = 0;
150 kv->key[3] = 0;
151 kv->key[4] = (u64) proto << 32;
152 kv->key[5] = 0;
Florin Corasdbd44562017-11-09 19:30:17 -0800153 kv->value = ~0ULL;
154}
155
156always_inline void
Florin Coras561af9b2017-12-09 10:19:43 -0800157make_v6_ss_kv_from_tc (session_kv6_t * kv, transport_connection_t * tc)
Florin Coras04e53442017-07-16 17:12:15 -0700158{
Florin Coras561af9b2017-12-09 10:19:43 -0800159 make_v6_ss_kv (kv, &tc->lcl_ip.ip6, &tc->rmt_ip.ip6, tc->lcl_port,
160 tc->rmt_port, tc->proto);
Florin Coras04e53442017-07-16 17:12:15 -0700161}
162
Florin Corascea194d2017-10-02 00:18:51 -0700163static session_table_t *
Florin Coras6c36f532017-11-03 18:32:34 -0700164session_table_get_or_alloc (u8 fib_proto, u8 fib_index)
Florin Coras04e53442017-07-16 17:12:15 -0700165{
Florin Corascea194d2017-10-02 00:18:51 -0700166 session_table_t *st;
Florin Coras6c36f532017-11-03 18:32:34 -0700167 u32 table_index;
168 if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
Florin Corascea194d2017-10-02 00:18:51 -0700169 {
170 st = session_table_alloc ();
171 table_index = session_table_index (st);
Florin Coras6c36f532017-11-03 18:32:34 -0700172 vec_validate (fib_index_to_table_index[fib_proto], fib_index);
173 fib_index_to_table_index[fib_proto][fib_index] = table_index;
174 st->active_fib_proto = fib_proto;
Florin Corasb795bd02017-12-14 11:30:48 -0800175 session_table_init (st, fib_proto);
Florin Corascea194d2017-10-02 00:18:51 -0700176 return st;
177 }
178 else
179 {
Florin Coras6c36f532017-11-03 18:32:34 -0700180 table_index = fib_index_to_table_index[fib_proto][fib_index];
Florin Corascea194d2017-10-02 00:18:51 -0700181 return session_table_get (table_index);
182 }
183}
184
185static session_table_t *
Florin Coras6c36f532017-11-03 18:32:34 -0700186session_table_get_or_alloc_for_connection (transport_connection_t * tc)
187{
188 u32 fib_proto;
189 fib_proto = transport_connection_fib_proto (tc);
190 return session_table_get_or_alloc (fib_proto, tc->fib_index);
191}
192
193static session_table_t *
Florin Corascea194d2017-10-02 00:18:51 -0700194session_table_get_for_connection (transport_connection_t * tc)
195{
196 u32 fib_proto = transport_connection_fib_proto (tc);
197 if (vec_len (fib_index_to_table_index[fib_proto]) <= tc->fib_index)
198 return 0;
199 return
200 session_table_get (fib_index_to_table_index[fib_proto][tc->fib_index]);
201}
202
203static session_table_t *
204session_table_get_for_fib_index (u32 fib_proto, u32 fib_index)
205{
206 if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
207 return 0;
208 return session_table_get (fib_index_to_table_index[fib_proto][fib_index]);
209}
210
211u32
212session_lookup_get_index_for_fib (u32 fib_proto, u32 fib_index)
213{
214 if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
215 return SESSION_TABLE_INVALID_INDEX;
216 return fib_index_to_table_index[fib_proto][fib_index];
217}
218
219/**
220 * Add transport connection to a session table
221 *
222 * Session lookup 5-tuple (src-ip, dst-ip, src-port, dst-port, session-type)
223 * is added to requested session table.
224 *
225 * @param tc transport connection to be added
226 * @param value value to be stored
227 *
228 * @return non-zero if failure
229 */
230int
231session_lookup_add_connection (transport_connection_t * tc, u64 value)
232{
233 session_table_t *st;
Florin Coras04e53442017-07-16 17:12:15 -0700234 session_kv4_t kv4;
235 session_kv6_t kv6;
236
Florin Corascea194d2017-10-02 00:18:51 -0700237 st = session_table_get_or_alloc_for_connection (tc);
238 if (!st)
239 return -1;
Florin Coras68810622017-07-24 17:40:28 -0700240 if (tc->is_ip4)
Florin Coras04e53442017-07-16 17:12:15 -0700241 {
Florin Coras04e53442017-07-16 17:12:15 -0700242 make_v4_ss_kv_from_tc (&kv4, tc);
243 kv4.value = value;
Florin Corascea194d2017-10-02 00:18:51 -0700244 return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4,
245 1 /* is_add */ );
Florin Coras68810622017-07-24 17:40:28 -0700246 }
247 else
248 {
Florin Coras04e53442017-07-16 17:12:15 -0700249 make_v6_ss_kv_from_tc (&kv6, tc);
250 kv6.value = value;
Florin Corascea194d2017-10-02 00:18:51 -0700251 return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6,
252 1 /* is_add */ );
Florin Coras04e53442017-07-16 17:12:15 -0700253 }
254}
255
Florin Coras04e53442017-07-16 17:12:15 -0700256int
Florin Corascea194d2017-10-02 00:18:51 -0700257session_lookup_add_session_endpoint (u32 table_index,
258 session_endpoint_t * sep, u64 value)
Florin Coras04e53442017-07-16 17:12:15 -0700259{
Florin Corascea194d2017-10-02 00:18:51 -0700260 session_table_t *st;
Florin Coras04e53442017-07-16 17:12:15 -0700261 session_kv4_t kv4;
262 session_kv6_t kv6;
Florin Coras68810622017-07-24 17:40:28 -0700263
Florin Corascea194d2017-10-02 00:18:51 -0700264 st = session_table_get (table_index);
265 if (!st)
266 return -1;
267 if (sep->is_ip4)
268 {
269 make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
270 sep->transport_proto);
271 kv4.value = value;
272 return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4, 1);
273 }
274 else
275 {
276 make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
277 sep->transport_proto);
278 kv6.value = value;
279 return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6, 1);
280 }
281}
282
283int
284session_lookup_del_session_endpoint (u32 table_index,
285 session_endpoint_t * sep)
286{
287 session_table_t *st;
288 session_kv4_t kv4;
289 session_kv6_t kv6;
290
291 st = session_table_get (table_index);
292 if (!st)
293 return -1;
294 if (sep->is_ip4)
295 {
296 make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
297 sep->transport_proto);
298 return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4, 0);
299 }
300 else
301 {
302 make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
303 sep->transport_proto);
304 return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6, 0);
305 }
306}
307
308/**
309 * Delete transport connection from session table
310 *
311 * @param table_index session table index
312 * @param tc transport connection to be removed
313 *
314 * @return non-zero if failure
315 */
316int
317session_lookup_del_connection (transport_connection_t * tc)
318{
319 session_table_t *st;
320 session_kv4_t kv4;
321 session_kv6_t kv6;
322
323 st = session_table_get_for_connection (tc);
324 if (!st)
325 return -1;
Florin Coras68810622017-07-24 17:40:28 -0700326 if (tc->is_ip4)
Florin Coras04e53442017-07-16 17:12:15 -0700327 {
Florin Coras04e53442017-07-16 17:12:15 -0700328 make_v4_ss_kv_from_tc (&kv4, tc);
Florin Corascea194d2017-10-02 00:18:51 -0700329 return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4,
Florin Coras04e53442017-07-16 17:12:15 -0700330 0 /* is_add */ );
Florin Coras68810622017-07-24 17:40:28 -0700331 }
332 else
333 {
Florin Coras04e53442017-07-16 17:12:15 -0700334 make_v6_ss_kv_from_tc (&kv6, tc);
Florin Corascea194d2017-10-02 00:18:51 -0700335 return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6,
Florin Coras04e53442017-07-16 17:12:15 -0700336 0 /* is_add */ );
Florin Coras04e53442017-07-16 17:12:15 -0700337 }
Florin Coras04e53442017-07-16 17:12:15 -0700338}
339
340int
Florin Corascea194d2017-10-02 00:18:51 -0700341session_lookup_del_session (stream_session_t * s)
Florin Coras04e53442017-07-16 17:12:15 -0700342{
Florin Coras561af9b2017-12-09 10:19:43 -0800343 transport_proto_t tp = session_get_transport_proto (s);
Florin Coras04e53442017-07-16 17:12:15 -0700344 transport_connection_t *ts;
Florin Coras561af9b2017-12-09 10:19:43 -0800345 ts = tp_vfts[tp].get_connection (s->connection_index, s->thread_index);
Florin Corascea194d2017-10-02 00:18:51 -0700346 return session_lookup_del_connection (ts);
Florin Coras04e53442017-07-16 17:12:15 -0700347}
348
Florin Corasdff48db2017-11-19 18:06:58 -0800349static u8
350session_lookup_action_index_is_valid (u32 action_index)
Florin Corasf0c1c962017-11-02 21:31:46 -0700351{
Florin Corasdff48db2017-11-19 18:06:58 -0800352 if (action_index == SESSION_RULES_TABLE_ACTION_ALLOW
353 || action_index == SESSION_RULES_TABLE_INVALID_INDEX)
354 return 0;
355 return 1;
356}
357
Florin Corasf8f516a2018-02-08 15:10:09 -0800358static u64
359session_lookup_action_to_handle (u32 action_index)
Florin Corasdff48db2017-11-19 18:06:58 -0800360{
361 switch (action_index)
362 {
363 case SESSION_RULES_TABLE_ACTION_DROP:
Florin Corasf8f516a2018-02-08 15:10:09 -0800364 return SESSION_DROP_HANDLE;
Florin Corasdff48db2017-11-19 18:06:58 -0800365 case SESSION_RULES_TABLE_ACTION_ALLOW:
366 case SESSION_RULES_TABLE_INVALID_INDEX:
Florin Corasf8f516a2018-02-08 15:10:09 -0800367 return SESSION_INVALID_HANDLE;
Florin Corasdff48db2017-11-19 18:06:58 -0800368 default:
Florin Corasf8f516a2018-02-08 15:10:09 -0800369 /* application index */
Florin Corasdff48db2017-11-19 18:06:58 -0800370 return action_index;
371 }
Florin Corasf0c1c962017-11-02 21:31:46 -0700372}
373
Florin Coras1c710452017-10-17 00:03:13 -0700374static stream_session_t *
Florin Coras7999e832017-10-31 01:51:04 -0700375session_lookup_app_listen_session (u32 app_index, u8 fib_proto,
376 u8 transport_proto)
Florin Coras1c710452017-10-17 00:03:13 -0700377{
378 application_t *app;
Florin Corasdff48db2017-11-19 18:06:58 -0800379 app = application_get_if_valid (app_index);
Florin Coras1c710452017-10-17 00:03:13 -0700380 if (!app)
381 return 0;
382
Florin Coras15531972018-08-12 23:50:53 -0700383 return app_worker_first_listener (application_get_default_worker (app),
384 fib_proto, transport_proto);
Florin Coras1c710452017-10-17 00:03:13 -0700385}
386
Florin Corasa2ff7b82017-11-08 17:55:03 -0800387static stream_session_t *
388session_lookup_action_to_session (u32 action_index, u8 fib_proto,
389 u8 transport_proto)
390{
Florin Corasdff48db2017-11-19 18:06:58 -0800391 u32 app_index;
Florin Corasf8f516a2018-02-08 15:10:09 -0800392 app_index = session_lookup_action_to_handle (action_index);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800393 /* Nothing sophisticated for now, action index is app index */
Florin Corasdff48db2017-11-19 18:06:58 -0800394 return session_lookup_app_listen_session (app_index, fib_proto,
Florin Corasa2ff7b82017-11-08 17:55:03 -0800395 transport_proto);
396}
397
Florin Corasf8f516a2018-02-08 15:10:09 -0800398/** UNUSED */
Florin Coras1c710452017-10-17 00:03:13 -0700399stream_session_t *
Florin Corasa2ff7b82017-11-08 17:55:03 -0800400session_lookup_rules_table_session4 (session_table_t * st, u8 proto,
401 ip4_address_t * lcl, u16 lcl_port,
402 ip4_address_t * rmt, u16 rmt_port)
Florin Coras1c710452017-10-17 00:03:13 -0700403{
Florin Corasc97a7392017-11-05 23:07:07 -0800404 session_rules_table_t *srt = &st->session_rules[proto];
Florin Corasdff48db2017-11-19 18:06:58 -0800405 u32 action_index, app_index;
Florin Corasc97a7392017-11-05 23:07:07 -0800406 action_index = session_rules_table_lookup4 (srt, lcl, rmt, lcl_port,
Florin Coras1c710452017-10-17 00:03:13 -0700407 rmt_port);
Florin Corasf8f516a2018-02-08 15:10:09 -0800408 app_index = session_lookup_action_to_handle (action_index);
Florin Coras1c710452017-10-17 00:03:13 -0700409 /* Nothing sophisticated for now, action index is app index */
Florin Corasdff48db2017-11-19 18:06:58 -0800410 return session_lookup_app_listen_session (app_index, FIB_PROTOCOL_IP4,
Florin Coras7999e832017-10-31 01:51:04 -0700411 proto);
Florin Coras1c710452017-10-17 00:03:13 -0700412}
413
Florin Corasf8f516a2018-02-08 15:10:09 -0800414/** UNUSED */
Florin Coras1c710452017-10-17 00:03:13 -0700415stream_session_t *
Florin Corasdff48db2017-11-19 18:06:58 -0800416session_lookup_rules_table_session6 (session_table_t * st, u8 proto,
417 ip6_address_t * lcl, u16 lcl_port,
418 ip6_address_t * rmt, u16 rmt_port)
Florin Coras1c710452017-10-17 00:03:13 -0700419{
Florin Corasc97a7392017-11-05 23:07:07 -0800420 session_rules_table_t *srt = &st->session_rules[proto];
Florin Corasdff48db2017-11-19 18:06:58 -0800421 u32 action_index, app_index;
Florin Corasc97a7392017-11-05 23:07:07 -0800422 action_index = session_rules_table_lookup6 (srt, lcl, rmt, lcl_port,
Florin Coras1c710452017-10-17 00:03:13 -0700423 rmt_port);
Florin Corasf8f516a2018-02-08 15:10:09 -0800424 app_index = session_lookup_action_to_handle (action_index);
Florin Corasdff48db2017-11-19 18:06:58 -0800425 return session_lookup_app_listen_session (app_index, FIB_PROTOCOL_IP6,
Florin Coras7999e832017-10-31 01:51:04 -0700426 proto);
Florin Coras1c710452017-10-17 00:03:13 -0700427}
428
Florin Corasa2ff7b82017-11-08 17:55:03 -0800429/**
430 * Lookup listener for session endpoint in table
431 *
432 * @param table_index table where the endpoint should be looked up
433 * @param sep session endpoint to be looked up
434 * @param use_rules flag that indicates if the session rules of the table
435 * should be used
436 * @return invalid handle if nothing is found, the handle of a valid listener
Florin Corasf8f516a2018-02-08 15:10:09 -0800437 * or an action derived handle if a rule is hit
Florin Corasa2ff7b82017-11-08 17:55:03 -0800438 */
Florin Coras3cbc04b2017-10-02 00:18:51 -0700439u64
Florin Corasa2ff7b82017-11-08 17:55:03 -0800440session_lookup_endpoint_listener (u32 table_index, session_endpoint_t * sep,
441 u8 use_rules)
Florin Coras04e53442017-07-16 17:12:15 -0700442{
Florin Corasc97a7392017-11-05 23:07:07 -0800443 session_rules_table_t *srt;
Florin Corascea194d2017-10-02 00:18:51 -0700444 session_table_t *st;
Florin Corasf0c1c962017-11-02 21:31:46 -0700445 u32 ai;
Florin Corascea194d2017-10-02 00:18:51 -0700446 int rv;
Florin Coras04e53442017-07-16 17:12:15 -0700447
Florin Corascea194d2017-10-02 00:18:51 -0700448 st = session_table_get (table_index);
449 if (!st)
Florin Coras3cbc04b2017-10-02 00:18:51 -0700450 return SESSION_INVALID_HANDLE;
Florin Corascea194d2017-10-02 00:18:51 -0700451 if (sep->is_ip4)
Florin Coras04e53442017-07-16 17:12:15 -0700452 {
Florin Corasa2ff7b82017-11-08 17:55:03 -0800453 session_kv4_t kv4;
454 ip4_address_t lcl4;
455
Florin Coras561af9b2017-12-09 10:19:43 -0800456 make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
457 sep->transport_proto);
Florin Corascea194d2017-10-02 00:18:51 -0700458 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
459 if (rv == 0)
Florin Coras3cbc04b2017-10-02 00:18:51 -0700460 return kv4.value;
Florin Corasa2ff7b82017-11-08 17:55:03 -0800461 if (use_rules)
462 {
Dave Barachb7b92992018-10-17 10:38:51 -0400463 clib_memset (&lcl4, 0, sizeof (lcl4));
Florin Corasa2ff7b82017-11-08 17:55:03 -0800464 srt = &st->session_rules[sep->transport_proto];
465 ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
466 sep->port);
Florin Corasdff48db2017-11-19 18:06:58 -0800467 if (session_lookup_action_index_is_valid (ai))
Florin Corasf8f516a2018-02-08 15:10:09 -0800468 return session_lookup_action_to_handle (ai);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800469 }
Florin Coras68810622017-07-24 17:40:28 -0700470 }
471 else
472 {
Florin Corasa2ff7b82017-11-08 17:55:03 -0800473 session_kv6_t kv6;
474 ip6_address_t lcl6;
475
Florin Coras561af9b2017-12-09 10:19:43 -0800476 make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
477 sep->transport_proto);
Florin Corascea194d2017-10-02 00:18:51 -0700478 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
479 if (rv == 0)
Florin Coras3cbc04b2017-10-02 00:18:51 -0700480 return kv6.value;
Florin Coras1c710452017-10-17 00:03:13 -0700481
Florin Corasa2ff7b82017-11-08 17:55:03 -0800482 if (use_rules)
483 {
Dave Barachb7b92992018-10-17 10:38:51 -0400484 clib_memset (&lcl6, 0, sizeof (lcl6));
Florin Corasa2ff7b82017-11-08 17:55:03 -0800485 srt = &st->session_rules[sep->transport_proto];
486 ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
487 sep->port);
Florin Corasdff48db2017-11-19 18:06:58 -0800488 if (session_lookup_action_index_is_valid (ai))
Florin Corasf8f516a2018-02-08 15:10:09 -0800489 return session_lookup_action_to_handle (ai);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800490 }
Florin Coras68810622017-07-24 17:40:28 -0700491 }
Florin Coras3cbc04b2017-10-02 00:18:51 -0700492 return SESSION_INVALID_HANDLE;
493}
494
Florin Corasa2ff7b82017-11-08 17:55:03 -0800495/**
496 * Look up endpoint in local session table
497 *
498 * The result, for now, is an application index and it may in the future
499 * be extended to a more complicated "action object". The only action we
500 * emulate now is "drop" and for that we return a special app index.
501 *
502 * Lookup logic is to check in order:
503 * - the rules in the table (connect acls)
504 * - session sub-table for a listener
505 * - session sub-table for a local listener (zeroed addr)
506 *
507 * @param table_index table where the lookup should be done
508 * @param sep session endpoint to be looked up
Florin Corasf8f516a2018-02-08 15:10:09 -0800509 * @return session handle that can be interpreted as an adjacency
Florin Corasa2ff7b82017-11-08 17:55:03 -0800510 */
Florin Corasf8f516a2018-02-08 15:10:09 -0800511u64
Florin Corasa2ff7b82017-11-08 17:55:03 -0800512session_lookup_local_endpoint (u32 table_index, session_endpoint_t * sep)
Florin Coras68810622017-07-24 17:40:28 -0700513{
Florin Corasc97a7392017-11-05 23:07:07 -0800514 session_rules_table_t *srt;
Florin Corascea194d2017-10-02 00:18:51 -0700515 session_table_t *st;
Florin Corasf0c1c962017-11-02 21:31:46 -0700516 u32 ai;
Florin Corascea194d2017-10-02 00:18:51 -0700517 int rv;
Florin Coras68810622017-07-24 17:40:28 -0700518
Florin Corascea194d2017-10-02 00:18:51 -0700519 st = session_table_get (table_index);
520 if (!st)
521 return SESSION_INVALID_INDEX;
Florin Corasa2ff7b82017-11-08 17:55:03 -0800522 ASSERT (st->is_local);
523
Florin Corascea194d2017-10-02 00:18:51 -0700524 if (sep->is_ip4)
Florin Coras68810622017-07-24 17:40:28 -0700525 {
Florin Corasa2ff7b82017-11-08 17:55:03 -0800526 session_kv4_t kv4;
527 ip4_address_t lcl4;
528
529 /*
530 * Check if endpoint has special rules associated
531 */
Dave Barachb7b92992018-10-17 10:38:51 -0400532 clib_memset (&lcl4, 0, sizeof (lcl4));
Florin Corasa2ff7b82017-11-08 17:55:03 -0800533 srt = &st->session_rules[sep->transport_proto];
534 ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
535 sep->port);
Florin Corasdff48db2017-11-19 18:06:58 -0800536 if (session_lookup_action_index_is_valid (ai))
Florin Corasf8f516a2018-02-08 15:10:09 -0800537 return session_lookup_action_to_handle (ai);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800538
539 /*
540 * Check if session endpoint is a listener
541 */
Florin Corascea194d2017-10-02 00:18:51 -0700542 make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
543 sep->transport_proto);
544 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
545 if (rv == 0)
Florin Corasf8f516a2018-02-08 15:10:09 -0800546 return kv4.value;
Florin Corascea194d2017-10-02 00:18:51 -0700547
548 /*
549 * Zero out the ip. Logic is that connect to local ips, say
550 * 127.0.0.1:port, can match 0.0.0.0:port
551 */
Florin Coras477e91a2018-02-27 10:05:57 -0800552 if (ip4_is_local_host (&sep->ip.ip4))
553 {
554 kv4.key[0] = 0;
555 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
556 if (rv == 0)
557 return kv4.value;
558 }
559 else
560 {
561 kv4.key[0] = 0;
562 }
Florin Corasdbd44562017-11-09 19:30:17 -0800563
564 /*
565 * Zero out the port and check if we have proxy
566 */
567 kv4.key[1] = 0;
568 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
569 if (rv == 0)
Florin Corasf8f516a2018-02-08 15:10:09 -0800570 return kv4.value;
Florin Coras68810622017-07-24 17:40:28 -0700571 }
572 else
573 {
Florin Corasa2ff7b82017-11-08 17:55:03 -0800574 session_kv6_t kv6;
575 ip6_address_t lcl6;
576
Dave Barachb7b92992018-10-17 10:38:51 -0400577 clib_memset (&lcl6, 0, sizeof (lcl6));
Florin Corasa2ff7b82017-11-08 17:55:03 -0800578 srt = &st->session_rules[sep->transport_proto];
579 ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
580 sep->port);
Florin Corasdff48db2017-11-19 18:06:58 -0800581 if (session_lookup_action_index_is_valid (ai))
Florin Corasf8f516a2018-02-08 15:10:09 -0800582 return session_lookup_action_to_handle (ai);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800583
Florin Corascea194d2017-10-02 00:18:51 -0700584 make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
585 sep->transport_proto);
586 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
587 if (rv == 0)
Florin Corasf8f516a2018-02-08 15:10:09 -0800588 return kv6.value;
Florin Corascea194d2017-10-02 00:18:51 -0700589
590 /*
591 * Zero out the ip. Same logic as above.
592 */
Florin Coras477e91a2018-02-27 10:05:57 -0800593
594 if (ip6_is_local_host (&sep->ip.ip6))
595 {
596 kv6.key[0] = kv6.key[1] = 0;
597 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
598 if (rv == 0)
599 return kv6.value;
600 }
601 else
602 {
603 kv6.key[0] = kv6.key[1] = 0;
604 }
Florin Corasdbd44562017-11-09 19:30:17 -0800605
606 /*
607 * Zero out the port. Same logic as above.
608 */
609 kv6.key[4] = kv6.key[5] = 0;
610 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
611 if (rv == 0)
Florin Corasf8f516a2018-02-08 15:10:09 -0800612 return kv6.value;
Florin Coras04e53442017-07-16 17:12:15 -0700613 }
Florin Corasf8f516a2018-02-08 15:10:09 -0800614 return SESSION_INVALID_HANDLE;
Florin Coras04e53442017-07-16 17:12:15 -0700615}
616
Florin Coras477e91a2018-02-27 10:05:57 -0800617static inline stream_session_t *
Florin Corascea194d2017-10-02 00:18:51 -0700618session_lookup_listener4_i (session_table_t * st, ip4_address_t * lcl,
Florin Coras477e91a2018-02-27 10:05:57 -0800619 u16 lcl_port, u8 proto, u8 use_wildcard)
Florin Coras04e53442017-07-16 17:12:15 -0700620{
Florin Coras04e53442017-07-16 17:12:15 -0700621 session_kv4_t kv4;
622 int rv;
623
Florin Corasdbd44562017-11-09 19:30:17 -0800624 /*
625 * First, try a fully formed listener
626 */
Florin Coras04e53442017-07-16 17:12:15 -0700627 make_v4_listener_kv (&kv4, lcl, lcl_port, proto);
Florin Corascea194d2017-10-02 00:18:51 -0700628 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
Florin Coras04e53442017-07-16 17:12:15 -0700629 if (rv == 0)
Florin Coras5c9083d2018-04-13 06:39:07 -0700630 return listen_session_get ((u32) kv4.value);
Florin Coras04e53442017-07-16 17:12:15 -0700631
Florin Corasdbd44562017-11-09 19:30:17 -0800632 /*
633 * Zero out the lcl ip and check if any 0/0 port binds have been done
634 */
Florin Coras477e91a2018-02-27 10:05:57 -0800635 if (use_wildcard)
636 {
637 kv4.key[0] = 0;
638 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
639 if (rv == 0)
Florin Coras5c9083d2018-04-13 06:39:07 -0700640 return listen_session_get ((u32) kv4.value);
Florin Coras477e91a2018-02-27 10:05:57 -0800641 }
642 else
643 {
644 kv4.key[0] = 0;
645 }
Florin Coras04e53442017-07-16 17:12:15 -0700646
Florin Corasdbd44562017-11-09 19:30:17 -0800647 /*
648 * Zero out port and check if we have a proxy set up for our ip
649 */
650 make_v4_proxy_kv (&kv4, lcl, proto);
651 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
652 if (rv == 0)
Florin Coras5c9083d2018-04-13 06:39:07 -0700653 return listen_session_get ((u32) kv4.value);
Florin Corasdbd44562017-11-09 19:30:17 -0800654
Florin Coras04e53442017-07-16 17:12:15 -0700655 return 0;
656}
657
Florin Coras04e53442017-07-16 17:12:15 -0700658stream_session_t *
Florin Corascea194d2017-10-02 00:18:51 -0700659session_lookup_listener4 (u32 fib_index, ip4_address_t * lcl, u16 lcl_port,
660 u8 proto)
Florin Coras04e53442017-07-16 17:12:15 -0700661{
Florin Corascea194d2017-10-02 00:18:51 -0700662 session_table_t *st;
663 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
664 if (!st)
665 return 0;
Florin Coras477e91a2018-02-27 10:05:57 -0800666 return session_lookup_listener4_i (st, lcl, lcl_port, proto, 0);
Florin Coras04e53442017-07-16 17:12:15 -0700667}
668
Florin Corascea194d2017-10-02 00:18:51 -0700669static stream_session_t *
670session_lookup_listener6_i (session_table_t * st, ip6_address_t * lcl,
Florin Coras477e91a2018-02-27 10:05:57 -0800671 u16 lcl_port, u8 proto, u8 ip_wildcard)
Florin Coras04e53442017-07-16 17:12:15 -0700672{
Florin Coras04e53442017-07-16 17:12:15 -0700673 session_kv6_t kv6;
674 int rv;
675
676 make_v6_listener_kv (&kv6, lcl, lcl_port, proto);
Florin Corascea194d2017-10-02 00:18:51 -0700677 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
Florin Coras04e53442017-07-16 17:12:15 -0700678 if (rv == 0)
Florin Coras5c9083d2018-04-13 06:39:07 -0700679 return listen_session_get ((u32) kv6.value);
Florin Coras04e53442017-07-16 17:12:15 -0700680
681 /* Zero out the lcl ip */
Florin Coras477e91a2018-02-27 10:05:57 -0800682 if (ip_wildcard)
683 {
684 kv6.key[0] = kv6.key[1] = 0;
685 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
686 if (rv == 0)
Florin Coras5c9083d2018-04-13 06:39:07 -0700687 return listen_session_get ((u32) kv6.value);
Florin Coras477e91a2018-02-27 10:05:57 -0800688 }
689 else
690 {
691 kv6.key[0] = kv6.key[1] = 0;
692 }
Florin Coras04e53442017-07-16 17:12:15 -0700693
Florin Corasdbd44562017-11-09 19:30:17 -0800694 make_v6_proxy_kv (&kv6, lcl, proto);
695 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
696 if (rv == 0)
Florin Coras5c9083d2018-04-13 06:39:07 -0700697 return listen_session_get ((u32) kv6.value);
Florin Coras04e53442017-07-16 17:12:15 -0700698 return 0;
699}
700
Florin Coras04e53442017-07-16 17:12:15 -0700701stream_session_t *
Florin Corascea194d2017-10-02 00:18:51 -0700702session_lookup_listener6 (u32 fib_index, ip6_address_t * lcl, u16 lcl_port,
703 u8 proto)
Florin Coras04e53442017-07-16 17:12:15 -0700704{
Florin Corascea194d2017-10-02 00:18:51 -0700705 session_table_t *st;
706 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
707 if (!st)
708 return 0;
Florin Coras477e91a2018-02-27 10:05:57 -0800709 return session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
Florin Coras04e53442017-07-16 17:12:15 -0700710}
711
Florin Coras477e91a2018-02-27 10:05:57 -0800712/**
713 * Lookup listener, exact or proxy (inaddr_any:0) match
714 */
Florin Coras04e53442017-07-16 17:12:15 -0700715stream_session_t *
Florin Corascea194d2017-10-02 00:18:51 -0700716session_lookup_listener (u32 table_index, session_endpoint_t * sep)
Florin Coras04e53442017-07-16 17:12:15 -0700717{
Florin Corascea194d2017-10-02 00:18:51 -0700718 session_table_t *st;
719 st = session_table_get (table_index);
720 if (!st)
721 return 0;
722 if (sep->is_ip4)
723 return session_lookup_listener4_i (st, &sep->ip.ip4, sep->port,
Florin Coras477e91a2018-02-27 10:05:57 -0800724 sep->transport_proto, 0);
Florin Corascea194d2017-10-02 00:18:51 -0700725 else
726 return session_lookup_listener6_i (st, &sep->ip.ip6, sep->port,
Florin Coras477e91a2018-02-27 10:05:57 -0800727 sep->transport_proto, 0);
Florin Coras04e53442017-07-16 17:12:15 -0700728 return 0;
729}
730
Florin Corascea194d2017-10-02 00:18:51 -0700731int
732session_lookup_add_half_open (transport_connection_t * tc, u64 value)
733{
734 session_table_t *st;
735 session_kv4_t kv4;
736 session_kv6_t kv6;
737
738 st = session_table_get_or_alloc_for_connection (tc);
739 if (!st)
740 return 0;
741 if (tc->is_ip4)
742 {
743 make_v4_ss_kv_from_tc (&kv4, tc);
744 kv4.value = value;
745 return clib_bihash_add_del_16_8 (&st->v4_half_open_hash, &kv4,
746 1 /* is_add */ );
747 }
748 else
749 {
750 make_v6_ss_kv_from_tc (&kv6, tc);
751 kv6.value = value;
752 return clib_bihash_add_del_48_8 (&st->v6_half_open_hash, &kv6,
753 1 /* is_add */ );
754 }
755}
756
757int
758session_lookup_del_half_open (transport_connection_t * tc)
759{
760 session_table_t *st;
761 session_kv4_t kv4;
762 session_kv6_t kv6;
763
764 st = session_table_get_for_connection (tc);
765 if (!st)
766 return -1;
767 if (tc->is_ip4)
768 {
769 make_v4_ss_kv_from_tc (&kv4, tc);
770 return clib_bihash_add_del_16_8 (&st->v4_half_open_hash, &kv4,
771 0 /* is_add */ );
772 }
773 else
774 {
775 make_v6_ss_kv_from_tc (&kv6, tc);
776 return clib_bihash_add_del_48_8 (&st->v6_half_open_hash, &kv6,
777 0 /* is_add */ );
778 }
779}
780
Florin Coras04e53442017-07-16 17:12:15 -0700781u64
Florin Corascea194d2017-10-02 00:18:51 -0700782session_lookup_half_open_handle (transport_connection_t * tc)
Florin Coras04e53442017-07-16 17:12:15 -0700783{
Florin Corascea194d2017-10-02 00:18:51 -0700784 session_table_t *st;
Florin Coras04e53442017-07-16 17:12:15 -0700785 session_kv4_t kv4;
786 session_kv6_t kv6;
787 int rv;
788
Florin Corascea194d2017-10-02 00:18:51 -0700789 st = session_table_get_for_fib_index (transport_connection_fib_proto (tc),
790 tc->fib_index);
791 if (!st)
792 return HALF_OPEN_LOOKUP_INVALID_VALUE;
793 if (tc->is_ip4)
Florin Coras04e53442017-07-16 17:12:15 -0700794 {
Florin Corascea194d2017-10-02 00:18:51 -0700795 make_v4_ss_kv (&kv4, &tc->lcl_ip.ip4, &tc->rmt_ip.ip4, tc->lcl_port,
Florin Coras3cbc04b2017-10-02 00:18:51 -0700796 tc->rmt_port, tc->proto);
Florin Corascea194d2017-10-02 00:18:51 -0700797 rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
Florin Coras04e53442017-07-16 17:12:15 -0700798 if (rv == 0)
799 return kv4.value;
Florin Corascea194d2017-10-02 00:18:51 -0700800 }
801 else
802 {
803 make_v6_ss_kv (&kv6, &tc->lcl_ip.ip6, &tc->rmt_ip.ip6, tc->lcl_port,
Florin Coras3cbc04b2017-10-02 00:18:51 -0700804 tc->rmt_port, tc->proto);
Florin Corascea194d2017-10-02 00:18:51 -0700805 rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
Florin Coras04e53442017-07-16 17:12:15 -0700806 if (rv == 0)
807 return kv6.value;
Florin Coras04e53442017-07-16 17:12:15 -0700808 }
809 return HALF_OPEN_LOOKUP_INVALID_VALUE;
810}
811
812transport_connection_t *
Florin Corascea194d2017-10-02 00:18:51 -0700813session_lookup_half_open_connection (u64 handle, u8 proto, u8 is_ip4)
Florin Coras04e53442017-07-16 17:12:15 -0700814{
Florin Corascea194d2017-10-02 00:18:51 -0700815 u32 sst;
816
Florin Coras04e53442017-07-16 17:12:15 -0700817 if (handle != HALF_OPEN_LOOKUP_INVALID_VALUE)
Florin Corascea194d2017-10-02 00:18:51 -0700818 {
819 sst = session_type_from_proto_and_ip (proto, is_ip4);
820 return tp_vfts[sst].get_half_open (handle & 0xFFFFFFFF);
821 }
Florin Coras04e53442017-07-16 17:12:15 -0700822 return 0;
823}
824
Florin Corascea194d2017-10-02 00:18:51 -0700825/**
826 * Lookup connection with ip4 and transport layer information
827 *
828 * This is used on the fast path so it needs to be fast. Thereby,
829 * duplication of code and 'hacks' allowed.
830 *
831 * The lookup is incremental and returns whenever something is matched. The
832 * steps are:
833 * - Try to find an established session
Florin Corascea194d2017-10-02 00:18:51 -0700834 * - Try to find a half-open connection
Florin Coras1c710452017-10-17 00:03:13 -0700835 * - Try session rules table
Florin Corasa2ff7b82017-11-08 17:55:03 -0800836 * - Try to find a fully-formed or local source wildcarded (listener bound to
837 * all interfaces) listener session
Florin Corascea194d2017-10-02 00:18:51 -0700838 * - return 0
839 *
840 * @param fib_index index of fib wherein the connection was received
841 * @param lcl local ip4 address
842 * @param rmt remote ip4 address
843 * @param lcl_port local port
844 * @param rmt_port remote port
845 * @param proto transport protocol (e.g., tcp, udp)
846 * @param thread_index thread index for request
Florin Corasdff48db2017-11-19 18:06:58 -0800847 * @param is_filtered return flag that indicates if connection was filtered.
Florin Corascea194d2017-10-02 00:18:51 -0700848 *
849 * @return pointer to transport connection, if one is found, 0 otherwise
850 */
Florin Coras04e53442017-07-16 17:12:15 -0700851transport_connection_t *
Florin Corascea194d2017-10-02 00:18:51 -0700852session_lookup_connection_wt4 (u32 fib_index, ip4_address_t * lcl,
853 ip4_address_t * rmt, u16 lcl_port,
Florin Corasdff48db2017-11-19 18:06:58 -0800854 u16 rmt_port, u8 proto, u32 thread_index,
855 u8 * is_filtered)
Florin Coras04e53442017-07-16 17:12:15 -0700856{
Florin Corascea194d2017-10-02 00:18:51 -0700857 session_table_t *st;
Florin Coras04e53442017-07-16 17:12:15 -0700858 session_kv4_t kv4;
859 stream_session_t *s;
Florin Corasa2ff7b82017-11-08 17:55:03 -0800860 u32 action_index;
Florin Coras04e53442017-07-16 17:12:15 -0700861 int rv;
862
Florin Corascea194d2017-10-02 00:18:51 -0700863 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
864 if (PREDICT_FALSE (!st))
865 return 0;
866
Florin Corasa2ff7b82017-11-08 17:55:03 -0800867 /*
868 * Lookup session amongst established ones
869 */
Florin Coras04e53442017-07-16 17:12:15 -0700870 make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
Florin Corascea194d2017-10-02 00:18:51 -0700871 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
Florin Coras04e53442017-07-16 17:12:15 -0700872 if (rv == 0)
873 {
Florin Corascea194d2017-10-02 00:18:51 -0700874 ASSERT ((u32) (kv4.value >> 32) == thread_index);
875 s = session_get (kv4.value & 0xFFFFFFFFULL, thread_index);
Florin Coras561af9b2017-12-09 10:19:43 -0800876 return tp_vfts[proto].get_connection (s->connection_index,
877 thread_index);
Florin Coras04e53442017-07-16 17:12:15 -0700878 }
879
Florin Corasa2ff7b82017-11-08 17:55:03 -0800880 /*
881 * Try half-open connections
882 */
Florin Corascea194d2017-10-02 00:18:51 -0700883 rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
Florin Coras04e53442017-07-16 17:12:15 -0700884 if (rv == 0)
Florin Coras561af9b2017-12-09 10:19:43 -0800885 return tp_vfts[proto].get_half_open (kv4.value & 0xFFFFFFFF);
Florin Coras1c710452017-10-17 00:03:13 -0700886
Florin Corasa2ff7b82017-11-08 17:55:03 -0800887 /*
888 * Check the session rules table
889 */
890 action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
891 rmt, lcl_port, rmt_port);
Florin Corasdff48db2017-11-19 18:06:58 -0800892 if (session_lookup_action_index_is_valid (action_index))
Florin Corasa2ff7b82017-11-08 17:55:03 -0800893 {
Florin Corasdff48db2017-11-19 18:06:58 -0800894 if ((*is_filtered = (action_index == SESSION_RULES_TABLE_ACTION_DROP)))
895 return 0;
896 if ((s = session_lookup_action_to_session (action_index,
897 FIB_PROTOCOL_IP4, proto)))
Florin Coras561af9b2017-12-09 10:19:43 -0800898 return tp_vfts[proto].get_listener (s->connection_index);
Florin Corasdff48db2017-11-19 18:06:58 -0800899 return 0;
Florin Corasa2ff7b82017-11-08 17:55:03 -0800900 }
901
902 /*
903 * If nothing is found, check if any listener is available
904 */
Florin Coras477e91a2018-02-27 10:05:57 -0800905 s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800906 if (s)
Florin Coras561af9b2017-12-09 10:19:43 -0800907 return tp_vfts[proto].get_listener (s->connection_index);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800908
909 return 0;
Florin Coras04e53442017-07-16 17:12:15 -0700910}
911
Florin Corascea194d2017-10-02 00:18:51 -0700912/**
913 * Lookup connection with ip4 and transport layer information
914 *
915 * Not optimized. This is used on the fast path so it needs to be fast.
916 * Thereby, duplication of code and 'hacks' allowed. Lookup logic is identical
917 * to that of @ref session_lookup_connection_wt4
918 *
919 * @param fib_index index of the fib wherein the connection was received
920 * @param lcl local ip4 address
921 * @param rmt remote ip4 address
922 * @param lcl_port local port
923 * @param rmt_port remote port
924 * @param proto transport protocol (e.g., tcp, udp)
925 *
926 * @return pointer to transport connection, if one is found, 0 otherwise
927 */
Florin Coras04e53442017-07-16 17:12:15 -0700928transport_connection_t *
Florin Corascea194d2017-10-02 00:18:51 -0700929session_lookup_connection4 (u32 fib_index, ip4_address_t * lcl,
930 ip4_address_t * rmt, u16 lcl_port, u16 rmt_port,
931 u8 proto)
Florin Coras04e53442017-07-16 17:12:15 -0700932{
Florin Corascea194d2017-10-02 00:18:51 -0700933 session_table_t *st;
Florin Coras04e53442017-07-16 17:12:15 -0700934 session_kv4_t kv4;
935 stream_session_t *s;
Florin Corasa2ff7b82017-11-08 17:55:03 -0800936 u32 action_index;
Florin Coras04e53442017-07-16 17:12:15 -0700937 int rv;
938
Florin Corascea194d2017-10-02 00:18:51 -0700939 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
940 if (PREDICT_FALSE (!st))
941 return 0;
942
Florin Corasa2ff7b82017-11-08 17:55:03 -0800943 /*
944 * Lookup session amongst established ones
945 */
Florin Coras04e53442017-07-16 17:12:15 -0700946 make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
Florin Corascea194d2017-10-02 00:18:51 -0700947 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
Florin Coras04e53442017-07-16 17:12:15 -0700948 if (rv == 0)
949 {
Florin Corascea194d2017-10-02 00:18:51 -0700950 s = session_get_from_handle (kv4.value);
Florin Coras561af9b2017-12-09 10:19:43 -0800951 return tp_vfts[proto].get_connection (s->connection_index,
952 s->thread_index);
Florin Coras04e53442017-07-16 17:12:15 -0700953 }
954
Florin Corasa2ff7b82017-11-08 17:55:03 -0800955 /*
956 * Try half-open connections
957 */
Florin Corascea194d2017-10-02 00:18:51 -0700958 rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
Florin Coras04e53442017-07-16 17:12:15 -0700959 if (rv == 0)
Florin Coras561af9b2017-12-09 10:19:43 -0800960 return tp_vfts[proto].get_half_open (kv4.value & 0xFFFFFFFF);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800961
962 /*
963 * Check the session rules table
964 */
965 action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
966 rmt, lcl_port, rmt_port);
Florin Corasdff48db2017-11-19 18:06:58 -0800967 if (session_lookup_action_index_is_valid (action_index))
Florin Corasa2ff7b82017-11-08 17:55:03 -0800968 {
Florin Corasdff48db2017-11-19 18:06:58 -0800969 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
970 return 0;
971 if ((s = session_lookup_action_to_session (action_index,
972 FIB_PROTOCOL_IP4, proto)))
Florin Coras561af9b2017-12-09 10:19:43 -0800973 return tp_vfts[proto].get_listener (s->connection_index);
Florin Corasdff48db2017-11-19 18:06:58 -0800974 return 0;
Florin Corasa2ff7b82017-11-08 17:55:03 -0800975 }
976
977 /*
978 * If nothing is found, check if any listener is available
979 */
Florin Coras477e91a2018-02-27 10:05:57 -0800980 s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800981 if (s)
Florin Coras561af9b2017-12-09 10:19:43 -0800982 return tp_vfts[proto].get_listener (s->connection_index);
Florin Corasa2ff7b82017-11-08 17:55:03 -0800983
984 return 0;
Florin Coras04e53442017-07-16 17:12:15 -0700985}
986
Florin Corascea194d2017-10-02 00:18:51 -0700987/**
988 * Lookup session with ip4 and transport layer information
989 *
Florin Coras3cbc04b2017-10-02 00:18:51 -0700990 * Important note: this may look into another thread's pool table and
991 * register as 'peeker'. Caller should call @ref session_pool_remove_peeker as
992 * if needed as soon as possible.
993 *
994 * Lookup logic is similar to that of @ref session_lookup_connection_wt4 but
995 * this returns a session as opposed to a transport connection and it does not
996 * try to lookup half-open sessions.
997 *
998 * Typically used by dgram connections
Florin Corascea194d2017-10-02 00:18:51 -0700999 */
1000stream_session_t *
Florin Coras3cbc04b2017-10-02 00:18:51 -07001001session_lookup_safe4 (u32 fib_index, ip4_address_t * lcl, ip4_address_t * rmt,
1002 u16 lcl_port, u16 rmt_port, u8 proto)
Florin Coras04e53442017-07-16 17:12:15 -07001003{
Florin Corascea194d2017-10-02 00:18:51 -07001004 session_table_t *st;
1005 session_kv4_t kv4;
1006 stream_session_t *s;
Florin Corasa2ff7b82017-11-08 17:55:03 -08001007 u32 action_index;
Florin Corascea194d2017-10-02 00:18:51 -07001008 int rv;
1009
1010 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
1011 if (PREDICT_FALSE (!st))
1012 return 0;
1013
Florin Corasa2ff7b82017-11-08 17:55:03 -08001014 /*
1015 * Lookup session amongst established ones
1016 */
Florin Corascea194d2017-10-02 00:18:51 -07001017 make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
1018 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
1019 if (rv == 0)
Florin Coras3cbc04b2017-10-02 00:18:51 -07001020 return session_get_from_handle_safe (kv4.value);
Florin Corascea194d2017-10-02 00:18:51 -07001021
Florin Corasa2ff7b82017-11-08 17:55:03 -08001022 /*
1023 * Check the session rules table
1024 */
1025 action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
1026 rmt, lcl_port, rmt_port);
Florin Corasdff48db2017-11-19 18:06:58 -08001027 if (session_lookup_action_index_is_valid (action_index))
Florin Corasa2ff7b82017-11-08 17:55:03 -08001028 {
Florin Corasdff48db2017-11-19 18:06:58 -08001029 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
1030 return 0;
1031 return session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP4,
1032 proto);
Florin Corasa2ff7b82017-11-08 17:55:03 -08001033 }
1034
1035 /*
1036 * If nothing is found, check if any listener is available
1037 */
Florin Coras477e91a2018-02-27 10:05:57 -08001038 if ((s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1)))
Florin Corascea194d2017-10-02 00:18:51 -07001039 return s;
Florin Corasa2ff7b82017-11-08 17:55:03 -08001040
1041 return 0;
Florin Corascea194d2017-10-02 00:18:51 -07001042}
1043
1044/**
1045 * Lookup connection with ip6 and transport layer information
1046 *
1047 * This is used on the fast path so it needs to be fast. Thereby,
1048 * duplication of code and 'hacks' allowed.
1049 *
1050 * The lookup is incremental and returns whenever something is matched. The
1051 * steps are:
1052 * - Try to find an established session
Florin Corascea194d2017-10-02 00:18:51 -07001053 * - Try to find a half-open connection
Florin Coras1c710452017-10-17 00:03:13 -07001054 * - Try session rules table
Florin Corasa2ff7b82017-11-08 17:55:03 -08001055 * - Try to find a fully-formed or local source wildcarded (listener bound to
1056 * all interfaces) listener session
Florin Corascea194d2017-10-02 00:18:51 -07001057 * - return 0
1058 *
1059 * @param fib_index index of the fib wherein the connection was received
1060 * @param lcl local ip6 address
1061 * @param rmt remote ip6 address
1062 * @param lcl_port local port
1063 * @param rmt_port remote port
1064 * @param proto transport protocol (e.g., tcp, udp)
1065 * @param thread_index thread index for request
1066 *
1067 * @return pointer to transport connection, if one is found, 0 otherwise
1068 */
1069transport_connection_t *
1070session_lookup_connection_wt6 (u32 fib_index, ip6_address_t * lcl,
1071 ip6_address_t * rmt, u16 lcl_port,
Florin Corasdff48db2017-11-19 18:06:58 -08001072 u16 rmt_port, u8 proto, u32 thread_index,
1073 u8 * is_filtered)
Florin Corascea194d2017-10-02 00:18:51 -07001074{
1075 session_table_t *st;
Florin Coras04e53442017-07-16 17:12:15 -07001076 stream_session_t *s;
1077 session_kv6_t kv6;
Florin Corasa2ff7b82017-11-08 17:55:03 -08001078 u32 action_index;
Florin Coras04e53442017-07-16 17:12:15 -07001079 int rv;
1080
Florin Corascea194d2017-10-02 00:18:51 -07001081 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
1082 if (PREDICT_FALSE (!st))
1083 return 0;
1084
Florin Coras04e53442017-07-16 17:12:15 -07001085 make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
Florin Corascea194d2017-10-02 00:18:51 -07001086 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
Florin Coras04e53442017-07-16 17:12:15 -07001087 if (rv == 0)
1088 {
Florin Corascea194d2017-10-02 00:18:51 -07001089 ASSERT ((u32) (kv6.value >> 32) == thread_index);
1090 s = session_get (kv6.value & 0xFFFFFFFFULL, thread_index);
Florin Coras561af9b2017-12-09 10:19:43 -08001091 return tp_vfts[proto].get_connection (s->connection_index,
1092 thread_index);
Florin Coras04e53442017-07-16 17:12:15 -07001093 }
1094
Florin Corasa2ff7b82017-11-08 17:55:03 -08001095 /* Try half-open connections */
Florin Corascea194d2017-10-02 00:18:51 -07001096 rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
Florin Coras04e53442017-07-16 17:12:15 -07001097 if (rv == 0)
Florin Coras561af9b2017-12-09 10:19:43 -08001098 return tp_vfts[proto].get_half_open (kv6.value & 0xFFFFFFFF);
Florin Coras04e53442017-07-16 17:12:15 -07001099
Florin Corasa2ff7b82017-11-08 17:55:03 -08001100 /* Check the session rules table */
1101 action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
1102 rmt, lcl_port, rmt_port);
Florin Corasdff48db2017-11-19 18:06:58 -08001103 if (session_lookup_action_index_is_valid (action_index))
Florin Corasa2ff7b82017-11-08 17:55:03 -08001104 {
Florin Corasdff48db2017-11-19 18:06:58 -08001105 if ((*is_filtered = (action_index == SESSION_RULES_TABLE_ACTION_DROP)))
1106 return 0;
1107 if ((s = session_lookup_action_to_session (action_index,
1108 FIB_PROTOCOL_IP6, proto)))
Florin Coras561af9b2017-12-09 10:19:43 -08001109 return tp_vfts[proto].get_listener (s->connection_index);
Florin Corasdff48db2017-11-19 18:06:58 -08001110 return 0;
Florin Corasa2ff7b82017-11-08 17:55:03 -08001111 }
1112
1113 /* If nothing is found, check if any listener is available */
Florin Coras477e91a2018-02-27 10:05:57 -08001114 s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
Florin Corasa2ff7b82017-11-08 17:55:03 -08001115 if (s)
Florin Coras561af9b2017-12-09 10:19:43 -08001116 return tp_vfts[proto].get_listener (s->connection_index);
Florin Corasa2ff7b82017-11-08 17:55:03 -08001117
1118 return 0;
Florin Coras04e53442017-07-16 17:12:15 -07001119}
1120
Florin Corascea194d2017-10-02 00:18:51 -07001121/**
1122 * Lookup connection with ip6 and transport layer information
1123 *
1124 * Not optimized. This is used on the fast path so it needs to be fast.
1125 * Thereby, duplication of code and 'hacks' allowed. Lookup logic is identical
1126 * to that of @ref session_lookup_connection_wt4
1127 *
1128 * @param fib_index index of the fib wherein the connection was received
1129 * @param lcl local ip6 address
1130 * @param rmt remote ip6 address
1131 * @param lcl_port local port
1132 * @param rmt_port remote port
1133 * @param proto transport protocol (e.g., tcp, udp)
1134 *
1135 * @return pointer to transport connection, if one is found, 0 otherwise
1136 */
Florin Coras04e53442017-07-16 17:12:15 -07001137transport_connection_t *
Florin Corascea194d2017-10-02 00:18:51 -07001138session_lookup_connection6 (u32 fib_index, ip6_address_t * lcl,
1139 ip6_address_t * rmt, u16 lcl_port, u16 rmt_port,
1140 u8 proto)
Florin Coras04e53442017-07-16 17:12:15 -07001141{
Florin Corascea194d2017-10-02 00:18:51 -07001142 session_table_t *st;
Florin Coras04e53442017-07-16 17:12:15 -07001143 stream_session_t *s;
1144 session_kv6_t kv6;
Florin Corasa2ff7b82017-11-08 17:55:03 -08001145 u32 action_index;
Florin Coras04e53442017-07-16 17:12:15 -07001146 int rv;
1147
Florin Corascea194d2017-10-02 00:18:51 -07001148 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
1149 if (PREDICT_FALSE (!st))
1150 return 0;
1151
Florin Coras04e53442017-07-16 17:12:15 -07001152 make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
Florin Corascea194d2017-10-02 00:18:51 -07001153 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
Florin Coras04e53442017-07-16 17:12:15 -07001154 if (rv == 0)
1155 {
Florin Corascea194d2017-10-02 00:18:51 -07001156 s = session_get_from_handle (kv6.value);
Florin Coras561af9b2017-12-09 10:19:43 -08001157 return tp_vfts[proto].get_connection (s->connection_index,
1158 s->thread_index);
Florin Coras04e53442017-07-16 17:12:15 -07001159 }
1160
Florin Corasa2ff7b82017-11-08 17:55:03 -08001161 /* Try half-open connections */
Florin Corascea194d2017-10-02 00:18:51 -07001162 rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
Florin Coras04e53442017-07-16 17:12:15 -07001163 if (rv == 0)
Florin Coras561af9b2017-12-09 10:19:43 -08001164 return tp_vfts[proto].get_half_open (kv6.value & 0xFFFFFFFF);
Florin Coras04e53442017-07-16 17:12:15 -07001165
Florin Corasa2ff7b82017-11-08 17:55:03 -08001166 /* Check the session rules table */
1167 action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
1168 rmt, lcl_port, rmt_port);
Florin Corasdff48db2017-11-19 18:06:58 -08001169 if (session_lookup_action_index_is_valid (action_index))
Florin Corasa2ff7b82017-11-08 17:55:03 -08001170 {
Florin Corasdff48db2017-11-19 18:06:58 -08001171 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
1172 return 0;
1173 if ((s = session_lookup_action_to_session (action_index,
1174 FIB_PROTOCOL_IP6, proto)))
Florin Coras561af9b2017-12-09 10:19:43 -08001175 return tp_vfts[proto].get_listener (s->connection_index);
Florin Corasdff48db2017-11-19 18:06:58 -08001176 return 0;
Florin Corasa2ff7b82017-11-08 17:55:03 -08001177 }
1178
1179 /* If nothing is found, check if any listener is available */
Florin Coras477e91a2018-02-27 10:05:57 -08001180 s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
Florin Corasa2ff7b82017-11-08 17:55:03 -08001181 if (s)
Florin Coras561af9b2017-12-09 10:19:43 -08001182 return tp_vfts[proto].get_listener (s->connection_index);
Florin Corasa2ff7b82017-11-08 17:55:03 -08001183
1184 return 0;
Florin Coras04e53442017-07-16 17:12:15 -07001185}
1186
Florin Corascea194d2017-10-02 00:18:51 -07001187/**
1188 * Lookup session with ip6 and transport layer information
1189 *
Florin Coras3cbc04b2017-10-02 00:18:51 -07001190 * Important note: this may look into another thread's pool table and
1191 * register as 'peeker'. Caller should call @ref session_pool_remove_peeker as
1192 * if needed as soon as possible.
1193 *
1194 * Lookup logic is similar to that of @ref session_lookup_connection_wt6 but
1195 * this returns a session as opposed to a transport connection and it does not
1196 * try to lookup half-open sessions.
1197 *
1198 * Typically used by dgram connections
Florin Corascea194d2017-10-02 00:18:51 -07001199 */
1200stream_session_t *
Florin Coras3cbc04b2017-10-02 00:18:51 -07001201session_lookup_safe6 (u32 fib_index, ip6_address_t * lcl, ip6_address_t * rmt,
1202 u16 lcl_port, u16 rmt_port, u8 proto)
Florin Corascea194d2017-10-02 00:18:51 -07001203{
1204 session_table_t *st;
1205 session_kv6_t kv6;
1206 stream_session_t *s;
Florin Corasa2ff7b82017-11-08 17:55:03 -08001207 u32 action_index;
Florin Corascea194d2017-10-02 00:18:51 -07001208 int rv;
1209
1210 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
1211 if (PREDICT_FALSE (!st))
1212 return 0;
1213
1214 make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
1215 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
1216 if (rv == 0)
Florin Coras3cbc04b2017-10-02 00:18:51 -07001217 return session_get_from_handle_safe (kv6.value);
Florin Corascea194d2017-10-02 00:18:51 -07001218
Florin Corasa2ff7b82017-11-08 17:55:03 -08001219 /* Check the session rules table */
1220 action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
1221 rmt, lcl_port, rmt_port);
Florin Corasdff48db2017-11-19 18:06:58 -08001222 if (session_lookup_action_index_is_valid (action_index))
Florin Corasa2ff7b82017-11-08 17:55:03 -08001223 {
Florin Corasdff48db2017-11-19 18:06:58 -08001224 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
1225 return 0;
1226 return session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP6,
1227 proto);
Florin Corasa2ff7b82017-11-08 17:55:03 -08001228 }
1229
Florin Corascea194d2017-10-02 00:18:51 -07001230 /* If nothing is found, check if any listener is available */
Florin Coras477e91a2018-02-27 10:05:57 -08001231 if ((s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1)))
Florin Corascea194d2017-10-02 00:18:51 -07001232 return s;
Florin Corasa2ff7b82017-11-08 17:55:03 -08001233 return 0;
Florin Corascea194d2017-10-02 00:18:51 -07001234}
1235
Florin Coras1c710452017-10-17 00:03:13 -07001236clib_error_t *
1237vnet_session_rule_add_del (session_rule_add_del_args_t * args)
1238{
1239 app_namespace_t *app_ns = app_namespace_get (args->appns_index);
Florin Corasc97a7392017-11-05 23:07:07 -08001240 session_rules_table_t *srt;
Florin Coras1c710452017-10-17 00:03:13 -07001241 session_table_t *st;
1242 u32 fib_index;
1243 u8 fib_proto;
1244 clib_error_t *error;
1245
1246 if (!app_ns)
1247 return clib_error_return_code (0, VNET_API_ERROR_APP_INVALID_NS, 0,
1248 "invalid app ns");
1249 if (args->scope > 3)
1250 return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
1251 "invalid scope");
Florin Corasc97a7392017-11-05 23:07:07 -08001252 if (args->transport_proto != TRANSPORT_PROTO_TCP
1253 && args->transport_proto != TRANSPORT_PROTO_UDP)
1254 return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
1255 "invalid transport proto");
Florin Coras1c710452017-10-17 00:03:13 -07001256 if ((args->scope & SESSION_RULE_SCOPE_GLOBAL) || args->scope == 0)
1257 {
1258 fib_proto = args->table_args.rmt.fp_proto;
1259 fib_index = app_namespace_get_fib_index (app_ns, fib_proto);
1260 st = session_table_get_for_fib_index (fib_proto, fib_index);
Florin Corasc97a7392017-11-05 23:07:07 -08001261 srt = &st->session_rules[args->transport_proto];
1262 if ((error = session_rules_table_add_del (srt, &args->table_args)))
1263 {
1264 clib_error_report (error);
1265 return error;
1266 }
Florin Coras1c710452017-10-17 00:03:13 -07001267 }
1268 if (args->scope & SESSION_RULE_SCOPE_LOCAL)
1269 {
Dave Barachb7b92992018-10-17 10:38:51 -04001270 clib_memset (&args->table_args.lcl, 0, sizeof (args->table_args.lcl));
Florin Corasa2ff7b82017-11-08 17:55:03 -08001271 args->table_args.lcl.fp_proto = args->table_args.rmt.fp_proto;
1272 args->table_args.lcl_port = 0;
Florin Coras1c710452017-10-17 00:03:13 -07001273 st = app_namespace_get_local_table (app_ns);
Florin Corasc97a7392017-11-05 23:07:07 -08001274 srt = &st->session_rules[args->transport_proto];
1275 error = session_rules_table_add_del (srt, &args->table_args);
Florin Coras1c710452017-10-17 00:03:13 -07001276 }
1277 return error;
1278}
1279
Florin Coras6c36f532017-11-03 18:32:34 -07001280/**
1281 * Mark (global) tables as pertaining to app ns
1282 */
1283void
1284session_lookup_set_tables_appns (app_namespace_t * app_ns)
1285{
1286 session_table_t *st;
1287 u32 fib_index;
1288 u8 fp;
1289
1290 for (fp = 0; fp < ARRAY_LEN (fib_index_to_table_index); fp++)
1291 {
1292 fib_index = app_namespace_get_fib_index (app_ns, fp);
1293 st = session_table_get_for_fib_index (fp, fib_index);
1294 if (st)
1295 st->appns_index = app_namespace_index (app_ns);
1296 }
1297}
1298
Florin Corascea194d2017-10-02 00:18:51 -07001299u8 *
1300format_ip4_session_lookup_kvp (u8 * s, va_list * args)
1301{
1302 clib_bihash_kv_16_8_t *kvp = va_arg (*args, clib_bihash_kv_16_8_t *);
Florin Coras15531972018-08-12 23:50:53 -07001303 u32 is_local = va_arg (*args, u32), app_wrk_index, session_index;
1304 v4_connection_key_t *key = (v4_connection_key_t *) kvp->key;
Florin Corascea194d2017-10-02 00:18:51 -07001305 u8 *app_name, *str = 0;
1306 stream_session_t *session;
Florin Coras15531972018-08-12 23:50:53 -07001307 app_worker_t *app_wrk;
Florin Corascea194d2017-10-02 00:18:51 -07001308
Florin Corascea194d2017-10-02 00:18:51 -07001309 if (!is_local)
1310 {
1311 session = session_get_from_handle (kvp->value);
Florin Coras15531972018-08-12 23:50:53 -07001312 app_wrk = app_worker_get (session->app_wrk_index);
1313 app_name = application_name_from_index (app_wrk->app_index);
Florin Coras561af9b2017-12-09 10:19:43 -08001314 str = format (0, "[%U] %U:%d->%U:%d", format_transport_proto_short,
1315 key->proto, format_ip4_address, &key->src,
1316 clib_net_to_host_u16 (key->src_port), format_ip4_address,
1317 &key->dst, clib_net_to_host_u16 (key->dst_port));
Florin Corascea194d2017-10-02 00:18:51 -07001318 s = format (s, "%-40v%-30v", str, app_name);
1319 }
1320 else
1321 {
Florin Coras15531972018-08-12 23:50:53 -07001322 local_session_parse_handle (kvp->value, &app_wrk_index, &session_index);
1323 app_wrk = app_worker_get (app_wrk_index);
1324 app_name = application_name_from_index (app_wrk->app_index);
Florin Coras561af9b2017-12-09 10:19:43 -08001325 str = format (0, "[%U] %U:%d", format_transport_proto_short, key->proto,
1326 format_ip4_address, &key->src,
1327 clib_net_to_host_u16 (key->src_port));
Florin Corascea194d2017-10-02 00:18:51 -07001328 s = format (s, "%-30v%-30v", str, app_name);
1329 }
1330 vec_free (app_name);
1331 return s;
1332}
1333
1334typedef struct _ip4_session_table_show_ctx_t
1335{
1336 vlib_main_t *vm;
1337 u8 is_local;
1338} ip4_session_table_show_ctx_t;
1339
1340static int
1341ip4_session_table_show (clib_bihash_kv_16_8_t * kvp, void *arg)
1342{
1343 ip4_session_table_show_ctx_t *ctx = arg;
1344 vlib_cli_output (ctx->vm, "%U", format_ip4_session_lookup_kvp, kvp,
1345 ctx->is_local);
1346 return 1;
1347}
1348
1349void
1350session_lookup_show_table_entries (vlib_main_t * vm, session_table_t * table,
1351 u8 type, u8 is_local)
1352{
1353 ip4_session_table_show_ctx_t ctx = {
1354 .vm = vm,
1355 .is_local = is_local,
1356 };
1357 if (!is_local)
1358 vlib_cli_output (vm, "%-40s%-30s", "Session", "Application");
1359 else
1360 vlib_cli_output (vm, "%-30s%-30s", "Listener", "Application");
1361 switch (type)
1362 {
1363 /* main table v4 */
1364 case 0:
1365 ip4_session_table_walk (&table->v4_session_hash, ip4_session_table_show,
1366 &ctx);
1367 break;
1368 default:
1369 clib_warning ("not supported");
1370 }
1371}
Florin Coras66b11312017-07-31 17:18:03 -07001372
Florin Coras1c710452017-10-17 00:03:13 -07001373static clib_error_t *
1374session_rule_command_fn (vlib_main_t * vm, unformat_input_t * input,
1375 vlib_cli_command_t * cmd)
1376{
Florin Corasc97a7392017-11-05 23:07:07 -08001377 u32 proto = ~0, lcl_port, rmt_port, action = 0, lcl_plen = 0, rmt_plen = 0;
Florin Coras1c710452017-10-17 00:03:13 -07001378 u32 appns_index, scope = 0;
1379 ip46_address_t lcl_ip, rmt_ip;
1380 u8 is_ip4 = 1, conn_set = 0;
1381 u8 fib_proto, is_add = 1, *ns_id = 0;
Florin Corasc97a7392017-11-05 23:07:07 -08001382 u8 *tag = 0;
Florin Coras1c710452017-10-17 00:03:13 -07001383 app_namespace_t *app_ns;
Florin Corasc97a7392017-11-05 23:07:07 -08001384 clib_error_t *error;
Florin Coras1c710452017-10-17 00:03:13 -07001385
Dave Barachb7b92992018-10-17 10:38:51 -04001386 clib_memset (&lcl_ip, 0, sizeof (lcl_ip));
1387 clib_memset (&rmt_ip, 0, sizeof (rmt_ip));
Florin Coras1c710452017-10-17 00:03:13 -07001388 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1389 {
1390 if (unformat (input, "del"))
1391 is_add = 0;
1392 else if (unformat (input, "add"))
1393 ;
1394 else if (unformat (input, "appns %_%v%_", &ns_id))
1395 ;
1396 else if (unformat (input, "scope global"))
1397 scope = SESSION_RULE_SCOPE_GLOBAL;
1398 else if (unformat (input, "scope local"))
1399 scope = SESSION_RULE_SCOPE_LOCAL;
1400 else if (unformat (input, "scope all"))
1401 scope = SESSION_RULE_SCOPE_LOCAL | SESSION_RULE_SCOPE_GLOBAL;
1402 else if (unformat (input, "proto %U", unformat_transport_proto, &proto))
1403 ;
1404 else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip4_address,
1405 &lcl_ip.ip4, &lcl_plen, &lcl_port,
1406 unformat_ip4_address, &rmt_ip.ip4, &rmt_plen,
1407 &rmt_port))
1408 {
1409 is_ip4 = 1;
1410 conn_set = 1;
1411 }
1412 else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip6_address,
1413 &lcl_ip.ip6, &lcl_plen, &lcl_port,
1414 unformat_ip6_address, &rmt_ip.ip6, &rmt_plen,
1415 &rmt_port))
1416 {
1417 is_ip4 = 0;
1418 conn_set = 1;
1419 }
1420 else if (unformat (input, "action %d", &action))
1421 ;
Florin Corasc97a7392017-11-05 23:07:07 -08001422 else if (unformat (input, "tag %_%v%_", &tag))
1423 ;
Florin Coras1c710452017-10-17 00:03:13 -07001424 else
1425 return clib_error_return (0, "unknown input `%U'",
1426 format_unformat_error, input);
1427 }
1428
Florin Corasc97a7392017-11-05 23:07:07 -08001429 if (proto == ~0)
1430 {
1431 vlib_cli_output (vm, "proto must be set");
1432 return 0;
1433 }
1434 if (is_add && !conn_set && action == ~0)
1435 {
1436 vlib_cli_output (vm, "connection and action must be set for add");
1437 return 0;
1438 }
1439 if (!is_add && !tag && !conn_set)
1440 {
1441 vlib_cli_output (vm, "connection or tag must be set for delete");
1442 return 0;
1443 }
1444 if (vec_len (tag) > SESSION_RULE_TAG_MAX_LEN)
1445 {
1446 vlib_cli_output (vm, "tag too long (max u64)");
1447 return 0;
1448 }
Florin Coras1c710452017-10-17 00:03:13 -07001449
1450 if (ns_id)
1451 {
1452 app_ns = app_namespace_get_from_id (ns_id);
1453 if (!app_ns)
Florin Corasc97a7392017-11-05 23:07:07 -08001454 {
1455 vlib_cli_output (vm, "namespace %v does not exist", ns_id);
1456 return 0;
1457 }
Florin Coras1c710452017-10-17 00:03:13 -07001458 }
1459 else
1460 {
1461 app_ns = app_namespace_get_default ();
1462 }
1463 appns_index = app_namespace_index (app_ns);
1464
1465 fib_proto = is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
1466 session_rule_add_del_args_t args = {
1467 .table_args.lcl.fp_addr = lcl_ip,
1468 .table_args.lcl.fp_len = lcl_plen,
1469 .table_args.lcl.fp_proto = fib_proto,
1470 .table_args.rmt.fp_addr = rmt_ip,
1471 .table_args.rmt.fp_len = rmt_plen,
1472 .table_args.rmt.fp_proto = fib_proto,
1473 .table_args.lcl_port = lcl_port,
1474 .table_args.rmt_port = rmt_port,
1475 .table_args.action_index = action,
1476 .table_args.is_add = is_add,
Florin Corasc97a7392017-11-05 23:07:07 -08001477 .table_args.tag = tag,
Florin Coras1c710452017-10-17 00:03:13 -07001478 .appns_index = appns_index,
1479 .scope = scope,
1480 };
Florin Corasc97a7392017-11-05 23:07:07 -08001481 error = vnet_session_rule_add_del (&args);
1482 vec_free (tag);
1483 return error;
Florin Coras1c710452017-10-17 00:03:13 -07001484}
1485
1486/* *INDENT-OFF* */
1487VLIB_CLI_COMMAND (session_rule_command, static) =
1488{
1489 .path = "session rule",
1490 .short_help = "session rule [add|del] appns <ns_id> proto <proto> "
1491 "<lcl-ip/plen> <lcl-port> <rmt-ip/plen> <rmt-port> action <action>",
1492 .function = session_rule_command_fn,
1493};
1494/* *INDENT-ON* */
1495
Florin Coras7999e832017-10-31 01:51:04 -07001496void
1497session_lookup_dump_rules_table (u32 fib_index, u8 fib_proto,
1498 u8 transport_proto)
1499{
1500 vlib_main_t *vm = vlib_get_main ();
Florin Corasc97a7392017-11-05 23:07:07 -08001501 session_rules_table_t *srt;
Florin Coras7999e832017-10-31 01:51:04 -07001502 session_table_t *st;
1503 st = session_table_get_for_fib_index (fib_index, fib_proto);
Florin Corasc97a7392017-11-05 23:07:07 -08001504 srt = &st->session_rules[transport_proto];
1505 session_rules_table_cli_dump (vm, srt, fib_proto);
Florin Coras7999e832017-10-31 01:51:04 -07001506}
1507
1508void
1509session_lookup_dump_local_rules_table (u32 table_index, u8 fib_proto,
1510 u8 transport_proto)
1511{
1512 vlib_main_t *vm = vlib_get_main ();
Florin Corasc97a7392017-11-05 23:07:07 -08001513 session_rules_table_t *srt;
Florin Coras7999e832017-10-31 01:51:04 -07001514 session_table_t *st;
1515 st = session_table_get (table_index);
Florin Corasc97a7392017-11-05 23:07:07 -08001516 srt = &st->session_rules[transport_proto];
1517 session_rules_table_cli_dump (vm, srt, fib_proto);
Florin Coras7999e832017-10-31 01:51:04 -07001518}
1519
Florin Coras1c710452017-10-17 00:03:13 -07001520static clib_error_t *
1521show_session_rules_command_fn (vlib_main_t * vm, unformat_input_t * input,
1522 vlib_cli_command_t * cmd)
1523{
1524 u32 transport_proto = ~0, lcl_port, rmt_port, lcl_plen, rmt_plen;
1525 u32 fib_index, scope = 0;
1526 ip46_address_t lcl_ip, rmt_ip;
1527 u8 is_ip4 = 1, show_one = 0;
1528 app_namespace_t *app_ns;
Florin Corasc97a7392017-11-05 23:07:07 -08001529 session_rules_table_t *srt;
Florin Coras1c710452017-10-17 00:03:13 -07001530 session_table_t *st;
1531 u8 *ns_id = 0, fib_proto;
1532
Dave Barachb7b92992018-10-17 10:38:51 -04001533 clib_memset (&lcl_ip, 0, sizeof (lcl_ip));
1534 clib_memset (&rmt_ip, 0, sizeof (rmt_ip));
Florin Coras1c710452017-10-17 00:03:13 -07001535 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1536 {
1537 if (unformat (input, "%U", unformat_transport_proto, &transport_proto))
1538 ;
1539 else if (unformat (input, "appns %_%v%_", &ns_id))
1540 ;
1541 else if (unformat (input, "scope global"))
1542 scope = 1;
1543 else if (unformat (input, "scope local"))
1544 scope = 2;
1545 else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip4_address,
1546 &lcl_ip.ip4, &lcl_plen, &lcl_port,
1547 unformat_ip4_address, &rmt_ip.ip4, &rmt_plen,
1548 &rmt_port))
1549 {
1550 is_ip4 = 1;
1551 show_one = 1;
1552 }
1553 else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip6_address,
1554 &lcl_ip.ip6, &lcl_plen, &lcl_port,
1555 unformat_ip6_address, &rmt_ip.ip6, &rmt_plen,
1556 &rmt_port))
1557 {
1558 is_ip4 = 0;
1559 show_one = 1;
1560 }
1561 else
1562 return clib_error_return (0, "unknown input `%U'",
1563 format_unformat_error, input);
1564 }
1565
1566 if (transport_proto == ~0)
1567 {
1568 vlib_cli_output (vm, "transport proto must be set");
1569 return 0;
1570 }
1571
1572 if (ns_id)
1573 {
1574 app_ns = app_namespace_get_from_id (ns_id);
1575 if (!app_ns)
1576 {
1577 vlib_cli_output (vm, "appns %v doesn't exist", ns_id);
1578 return 0;
1579 }
1580 }
1581 else
1582 {
1583 app_ns = app_namespace_get_default ();
1584 }
1585
1586 if (scope == 1 || scope == 0)
1587 {
1588 fib_proto = is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
1589 fib_index = is_ip4 ? app_ns->ip4_fib_index : app_ns->ip6_fib_index;
1590 st = session_table_get_for_fib_index (fib_proto, fib_index);
1591 }
1592 else
1593 {
1594 st = app_namespace_get_local_table (app_ns);
1595 }
1596
1597 if (show_one)
1598 {
Florin Corasc97a7392017-11-05 23:07:07 -08001599 srt = &st->session_rules[transport_proto];
1600 session_rules_table_show_rule (vm, srt, &lcl_ip, lcl_port, &rmt_ip,
1601 rmt_port, is_ip4);
Florin Coras1c710452017-10-17 00:03:13 -07001602 return 0;
1603 }
1604
Florin Corasc97a7392017-11-05 23:07:07 -08001605 vlib_cli_output (vm, "%U rules table", format_transport_proto,
1606 transport_proto);
1607 srt = &st->session_rules[transport_proto];
1608 session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4);
1609 session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP6);
Florin Coras1c710452017-10-17 00:03:13 -07001610
1611 vec_free (ns_id);
1612 return 0;
1613}
1614
1615/* *INDENT-OFF* */
1616VLIB_CLI_COMMAND (show_session_rules_command, static) =
1617{
1618 .path = "show session rules",
Florin Corasdff48db2017-11-19 18:06:58 -08001619 .short_help = "show session rules [<proto> appns <id> <lcl-ip/plen> "
1620 "<lcl-port> <rmt-ip/plen> <rmt-port> scope <scope>]",
Florin Coras1c710452017-10-17 00:03:13 -07001621 .function = show_session_rules_command_fn,
1622};
1623/* *INDENT-ON* */
1624
Florin Coras04e53442017-07-16 17:12:15 -07001625void
1626session_lookup_init (void)
1627{
Florin Corascea194d2017-10-02 00:18:51 -07001628 /*
1629 * Allocate default table and map it to fib_index 0
1630 */
1631 session_table_t *st = session_table_alloc ();
1632 vec_validate (fib_index_to_table_index[FIB_PROTOCOL_IP4], 0);
1633 fib_index_to_table_index[FIB_PROTOCOL_IP4][0] = session_table_index (st);
Florin Coras6c36f532017-11-03 18:32:34 -07001634 st->active_fib_proto = FIB_PROTOCOL_IP4;
1635 session_table_init (st, FIB_PROTOCOL_IP4);
Florin Corascea194d2017-10-02 00:18:51 -07001636 st = session_table_alloc ();
1637 vec_validate (fib_index_to_table_index[FIB_PROTOCOL_IP6], 0);
1638 fib_index_to_table_index[FIB_PROTOCOL_IP6][0] = session_table_index (st);
Florin Coras6c36f532017-11-03 18:32:34 -07001639 st->active_fib_proto = FIB_PROTOCOL_IP6;
1640 session_table_init (st, FIB_PROTOCOL_IP6);
Florin Coras04e53442017-07-16 17:12:15 -07001641}
1642
1643/*
1644 * fd.io coding-style-patch-verification: ON
1645 *
1646 * Local Variables:
1647 * eval: (c-set-style "gnu")
1648 * End:
1649 */