2 * Copyright (c) 2017 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 /** Generate typed init functions for multiple hash table styles... */
17 #include <vppinfra/bihash_16_8.h>
18 #include <vppinfra/bihash_template.h>
20 #include <vppinfra/bihash_template.c>
22 #undef __included_bihash_template_h__
24 #include <vppinfra/bihash_48_8.h>
25 #include <vppinfra/bihash_template.h>
27 #include <vppinfra/bihash_template.c>
28 #include <vnet/session/session_lookup.h>
29 #include <vnet/session/session.h>
30 #include <vnet/session/application.h>
33 * External vector of per transport virtual functions table
35 extern transport_proto_vft_t *tp_vfts;
38 * Network namespace index (i.e., fib index) to session lookup table. We
39 * should have one per network protocol type but for now we only support IP4/6
41 static u32 *fib_index_to_table_index[2];
45 typedef CLIB_PACKED (struct {
54 /* align by making this 4 octets even though its a 1-bit field
55 * NOTE: avoid key overlap with other transports that use 5 tuples for
56 * session identification.
62 }) v4_connection_key_t;
64 typedef CLIB_PACKED (struct {
79 }) v6_connection_key_t;
82 typedef clib_bihash_kv_16_8_t session_kv4_t;
83 typedef clib_bihash_kv_48_8_t session_kv6_t;
86 make_v4_ss_kv (session_kv4_t * kv, ip4_address_t * lcl, ip4_address_t * rmt,
87 u16 lcl_port, u16 rmt_port, u8 proto)
89 v4_connection_key_t *key = (v4_connection_key_t *) kv->key;
91 key->src.as_u32 = lcl->as_u32;
92 key->dst.as_u32 = rmt->as_u32;
93 key->src_port = lcl_port;
94 key->dst_port = rmt_port;
101 make_v4_listener_kv (session_kv4_t * kv, ip4_address_t * lcl, u16 lcl_port,
104 v4_connection_key_t *key = (v4_connection_key_t *) kv->key;
106 key->src.as_u32 = lcl->as_u32;
108 key->src_port = lcl_port;
116 make_v4_proxy_kv (session_kv4_t * kv, ip4_address_t * lcl, u8 proto)
118 v4_connection_key_t *key = (v4_connection_key_t *) kv->key;
120 key->src.as_u32 = lcl->as_u32;
130 make_v4_ss_kv_from_tc (session_kv4_t * kv, transport_connection_t * t)
132 make_v4_ss_kv (kv, &t->lcl_ip.ip4, &t->rmt_ip.ip4, t->lcl_port, t->rmt_port,
133 session_type_from_proto_and_ip (t->proto, 1));
137 make_v6_ss_kv (session_kv6_t * kv, ip6_address_t * lcl, ip6_address_t * rmt,
138 u16 lcl_port, u16 rmt_port, u8 proto)
140 v6_connection_key_t *key = (v6_connection_key_t *) kv->key;
142 key->src.as_u64[0] = lcl->as_u64[0];
143 key->src.as_u64[1] = lcl->as_u64[1];
144 key->dst.as_u64[0] = rmt->as_u64[0];
145 key->dst.as_u64[1] = rmt->as_u64[1];
146 key->src_port = lcl_port;
147 key->dst_port = rmt_port;
155 make_v6_listener_kv (session_kv6_t * kv, ip6_address_t * lcl, u16 lcl_port,
158 v6_connection_key_t *key = (v6_connection_key_t *) kv->key;
160 key->src.as_u64[0] = lcl->as_u64[0];
161 key->src.as_u64[1] = lcl->as_u64[1];
162 key->dst.as_u64[0] = 0;
163 key->dst.as_u64[1] = 0;
164 key->src_port = lcl_port;
173 make_v6_proxy_kv (session_kv6_t * kv, ip6_address_t * lcl, u8 proto)
175 v6_connection_key_t *key = (v6_connection_key_t *) kv->key;
177 key->src.as_u64[0] = lcl->as_u64[0];
178 key->src.as_u64[1] = lcl->as_u64[1];
179 key->dst.as_u64[0] = 0;
180 key->dst.as_u64[1] = 0;
190 make_v6_ss_kv_from_tc (session_kv6_t * kv, transport_connection_t * t)
192 make_v6_ss_kv (kv, &t->lcl_ip.ip6, &t->rmt_ip.ip6, t->lcl_port, t->rmt_port,
193 session_type_from_proto_and_ip (t->proto, 0));
196 static session_table_t *
197 session_table_get_or_alloc (u8 fib_proto, u8 fib_index)
201 if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
203 st = session_table_alloc ();
204 table_index = session_table_index (st);
205 vec_validate (fib_index_to_table_index[fib_proto], fib_index);
206 fib_index_to_table_index[fib_proto][fib_index] = table_index;
207 st->active_fib_proto = fib_proto;
212 table_index = fib_index_to_table_index[fib_proto][fib_index];
213 return session_table_get (table_index);
217 static session_table_t *
218 session_table_get_or_alloc_for_connection (transport_connection_t * tc)
221 fib_proto = transport_connection_fib_proto (tc);
222 return session_table_get_or_alloc (fib_proto, tc->fib_index);
225 static session_table_t *
226 session_table_get_for_connection (transport_connection_t * tc)
228 u32 fib_proto = transport_connection_fib_proto (tc);
229 if (vec_len (fib_index_to_table_index[fib_proto]) <= tc->fib_index)
232 session_table_get (fib_index_to_table_index[fib_proto][tc->fib_index]);
235 static session_table_t *
236 session_table_get_for_fib_index (u32 fib_proto, u32 fib_index)
238 if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
240 return session_table_get (fib_index_to_table_index[fib_proto][fib_index]);
244 session_lookup_get_index_for_fib (u32 fib_proto, u32 fib_index)
246 if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
247 return SESSION_TABLE_INVALID_INDEX;
248 return fib_index_to_table_index[fib_proto][fib_index];
252 * Add transport connection to a session table
254 * Session lookup 5-tuple (src-ip, dst-ip, src-port, dst-port, session-type)
255 * is added to requested session table.
257 * @param tc transport connection to be added
258 * @param value value to be stored
260 * @return non-zero if failure
263 session_lookup_add_connection (transport_connection_t * tc, u64 value)
269 st = session_table_get_or_alloc_for_connection (tc);
274 make_v4_ss_kv_from_tc (&kv4, tc);
276 return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4,
281 make_v6_ss_kv_from_tc (&kv6, tc);
283 return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6,
289 session_lookup_add_session_endpoint (u32 table_index,
290 session_endpoint_t * sep, u64 value)
296 st = session_table_get (table_index);
301 make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
302 sep->transport_proto);
304 return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4, 1);
308 make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
309 sep->transport_proto);
311 return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6, 1);
316 session_lookup_del_session_endpoint (u32 table_index,
317 session_endpoint_t * sep)
323 st = session_table_get (table_index);
328 make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
329 sep->transport_proto);
330 return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4, 0);
334 make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
335 sep->transport_proto);
336 return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6, 0);
341 * Delete transport connection from session table
343 * @param table_index session table index
344 * @param tc transport connection to be removed
346 * @return non-zero if failure
349 session_lookup_del_connection (transport_connection_t * tc)
355 st = session_table_get_for_connection (tc);
360 make_v4_ss_kv_from_tc (&kv4, tc);
361 return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4,
366 make_v6_ss_kv_from_tc (&kv6, tc);
367 return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6,
373 session_lookup_del_session (stream_session_t * s)
375 transport_connection_t *ts;
376 ts = tp_vfts[s->session_type].get_connection (s->connection_index,
378 return session_lookup_del_connection (ts);
382 session_lookup_action_to_session_index (u32 action_index)
384 if (action_index != SESSION_RULES_TABLE_ACTION_DROP)
386 return SESSION_INVALID_INDEX;
389 static stream_session_t *
390 session_lookup_app_listen_session (u32 app_index, u8 fib_proto,
394 app = application_get (app_index);
398 return application_first_listener (app, fib_proto, transport_proto);
401 static stream_session_t *
402 session_lookup_action_to_session (u32 action_index, u8 fib_proto,
406 session_index = session_lookup_action_to_session_index (action_index);
407 /* Nothing sophisticated for now, action index is app index */
408 return session_lookup_app_listen_session (session_index, fib_proto,
413 session_lookup_rules_table_session4 (session_table_t * st, u8 proto,
414 ip4_address_t * lcl, u16 lcl_port,
415 ip4_address_t * rmt, u16 rmt_port)
417 session_rules_table_t *srt = &st->session_rules[proto];
418 u32 action_index, session_index;
419 action_index = session_rules_table_lookup4 (srt, lcl, rmt, lcl_port,
421 session_index = session_lookup_action_to_session_index (action_index);
422 /* Nothing sophisticated for now, action index is app index */
423 return session_lookup_app_listen_session (session_index, FIB_PROTOCOL_IP4,
428 session_lookup_rules_table6 (session_table_t * st, u8 proto,
429 ip6_address_t * lcl, u16 lcl_port,
430 ip6_address_t * rmt, u16 rmt_port)
432 session_rules_table_t *srt = &st->session_rules[proto];
433 u32 action_index, session_index;
434 action_index = session_rules_table_lookup6 (srt, lcl, rmt, lcl_port,
436 session_index = session_lookup_action_to_session_index (action_index);
437 return session_lookup_app_listen_session (session_index, FIB_PROTOCOL_IP6,
442 * Lookup listener for session endpoint in table
444 * @param table_index table where the endpoint should be looked up
445 * @param sep session endpoint to be looked up
446 * @param use_rules flag that indicates if the session rules of the table
448 * @return invalid handle if nothing is found, the handle of a valid listener
449 * or an action_index if a rule is hit
452 session_lookup_endpoint_listener (u32 table_index, session_endpoint_t * sep,
455 session_rules_table_t *srt;
461 sst = session_type_from_proto_and_ip (sep->transport_proto, sep->is_ip4);
462 st = session_table_get (table_index);
464 return SESSION_INVALID_HANDLE;
470 make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port, sst);
471 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
476 memset (&lcl4, 0, sizeof (lcl4));
477 srt = &st->session_rules[sep->transport_proto];
478 ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
480 if (ai != SESSION_RULES_TABLE_INVALID_INDEX)
481 return session_lookup_action_to_session_index (ai);
489 make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port, sst);
490 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
496 memset (&lcl6, 0, sizeof (lcl6));
497 srt = &st->session_rules[sep->transport_proto];
498 ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
500 if (ai != SESSION_RULES_TABLE_INVALID_INDEX)
501 return session_lookup_action_to_session_index (ai);
504 return SESSION_INVALID_HANDLE;
508 * Look up endpoint in local session table
510 * The result, for now, is an application index and it may in the future
511 * be extended to a more complicated "action object". The only action we
512 * emulate now is "drop" and for that we return a special app index.
514 * Lookup logic is to check in order:
515 * - the rules in the table (connect acls)
516 * - session sub-table for a listener
517 * - session sub-table for a local listener (zeroed addr)
519 * @param table_index table where the lookup should be done
520 * @param sep session endpoint to be looked up
521 * @return index that can be interpreted as an app index or drop action.
524 session_lookup_local_endpoint (u32 table_index, session_endpoint_t * sep)
526 session_rules_table_t *srt;
531 st = session_table_get (table_index);
533 return SESSION_INVALID_INDEX;
534 ASSERT (st->is_local);
542 * Check if endpoint has special rules associated
544 memset (&lcl4, 0, sizeof (lcl4));
545 srt = &st->session_rules[sep->transport_proto];
546 ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
548 if (ai == SESSION_RULES_TABLE_ACTION_DROP)
549 return APP_DROP_INDEX;
550 if (ai != SESSION_RULES_TABLE_ACTION_NONE)
551 return session_lookup_action_to_session_index (ai);
554 * Check if session endpoint is a listener
556 make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
557 sep->transport_proto);
558 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
560 return (u32) kv4.value;
563 * Zero out the ip. Logic is that connect to local ips, say
564 * 127.0.0.1:port, can match 0.0.0.0:port
567 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
569 return (u32) kv4.value;
572 * Zero out the port and check if we have proxy
575 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
577 return (u32) kv4.value;
584 memset (&lcl6, 0, sizeof (lcl6));
585 srt = &st->session_rules[sep->transport_proto];
586 ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
588 if (ai == SESSION_RULES_TABLE_ACTION_DROP)
589 return APP_DROP_INDEX;
590 if (ai != SESSION_RULES_TABLE_INVALID_INDEX)
591 return session_lookup_action_to_session_index (ai);
593 make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
594 sep->transport_proto);
595 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
597 return (u32) kv6.value;
600 * Zero out the ip. Same logic as above.
602 kv6.key[0] = kv6.key[1] = 0;
603 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
605 return (u32) kv6.value;
608 * Zero out the port. Same logic as above.
610 kv6.key[4] = kv6.key[5] = 0;
611 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
613 return (u32) kv6.value;
615 return APP_INVALID_INDEX;
618 static stream_session_t *
619 session_lookup_listener4_i (session_table_t * st, ip4_address_t * lcl,
620 u16 lcl_port, u8 proto)
626 * First, try a fully formed listener
628 make_v4_listener_kv (&kv4, lcl, lcl_port, proto);
629 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
631 return session_manager_get_listener (proto, (u32) kv4.value);
634 * Zero out the lcl ip and check if any 0/0 port binds have been done
637 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
639 return session_manager_get_listener (proto, (u32) kv4.value);
642 * Zero out port and check if we have a proxy set up for our ip
644 make_v4_proxy_kv (&kv4, lcl, proto);
645 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
647 return session_manager_get_listener (proto, (u32) kv4.value);
653 session_lookup_listener4 (u32 fib_index, ip4_address_t * lcl, u16 lcl_port,
657 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
660 return session_lookup_listener4_i (st, lcl, lcl_port, proto);
663 static stream_session_t *
664 session_lookup_listener6_i (session_table_t * st, ip6_address_t * lcl,
665 u16 lcl_port, u8 proto)
670 make_v6_listener_kv (&kv6, lcl, lcl_port, proto);
671 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
673 return session_manager_get_listener (proto, (u32) kv6.value);
675 /* Zero out the lcl ip */
676 kv6.key[0] = kv6.key[1] = 0;
677 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
679 return session_manager_get_listener (proto, (u32) kv6.value);
681 make_v6_proxy_kv (&kv6, lcl, proto);
682 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
684 return session_manager_get_listener (proto, (u32) kv6.value);
689 session_lookup_listener6 (u32 fib_index, ip6_address_t * lcl, u16 lcl_port,
693 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
696 return session_lookup_listener6_i (st, lcl, lcl_port, proto);
700 session_lookup_listener (u32 table_index, session_endpoint_t * sep)
703 st = session_table_get (table_index);
707 return session_lookup_listener4_i (st, &sep->ip.ip4, sep->port,
708 sep->transport_proto);
710 return session_lookup_listener6_i (st, &sep->ip.ip6, sep->port,
711 sep->transport_proto);
716 session_lookup_add_half_open (transport_connection_t * tc, u64 value)
722 st = session_table_get_or_alloc_for_connection (tc);
727 make_v4_ss_kv_from_tc (&kv4, tc);
729 return clib_bihash_add_del_16_8 (&st->v4_half_open_hash, &kv4,
734 make_v6_ss_kv_from_tc (&kv6, tc);
736 return clib_bihash_add_del_48_8 (&st->v6_half_open_hash, &kv6,
742 session_lookup_del_half_open (transport_connection_t * tc)
748 st = session_table_get_for_connection (tc);
753 make_v4_ss_kv_from_tc (&kv4, tc);
754 return clib_bihash_add_del_16_8 (&st->v4_half_open_hash, &kv4,
759 make_v6_ss_kv_from_tc (&kv6, tc);
760 return clib_bihash_add_del_48_8 (&st->v6_half_open_hash, &kv6,
766 session_lookup_half_open_handle (transport_connection_t * tc)
773 st = session_table_get_for_fib_index (transport_connection_fib_proto (tc),
776 return HALF_OPEN_LOOKUP_INVALID_VALUE;
779 make_v4_ss_kv (&kv4, &tc->lcl_ip.ip4, &tc->rmt_ip.ip4, tc->lcl_port,
780 tc->rmt_port, tc->proto);
781 rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
787 make_v6_ss_kv (&kv6, &tc->lcl_ip.ip6, &tc->rmt_ip.ip6, tc->lcl_port,
788 tc->rmt_port, tc->proto);
789 rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
793 return HALF_OPEN_LOOKUP_INVALID_VALUE;
796 transport_connection_t *
797 session_lookup_half_open_connection (u64 handle, u8 proto, u8 is_ip4)
801 if (handle != HALF_OPEN_LOOKUP_INVALID_VALUE)
803 sst = session_type_from_proto_and_ip (proto, is_ip4);
804 return tp_vfts[sst].get_half_open (handle & 0xFFFFFFFF);
810 * Lookup connection with ip4 and transport layer information
812 * This is used on the fast path so it needs to be fast. Thereby,
813 * duplication of code and 'hacks' allowed.
815 * The lookup is incremental and returns whenever something is matched. The
817 * - Try to find an established session
818 * - Try to find a half-open connection
819 * - Try session rules table
820 * - Try to find a fully-formed or local source wildcarded (listener bound to
821 * all interfaces) listener session
824 * @param fib_index index of fib wherein the connection was received
825 * @param lcl local ip4 address
826 * @param rmt remote ip4 address
827 * @param lcl_port local port
828 * @param rmt_port remote port
829 * @param proto transport protocol (e.g., tcp, udp)
830 * @param thread_index thread index for request
832 * @return pointer to transport connection, if one is found, 0 otherwise
834 transport_connection_t *
835 session_lookup_connection_wt4 (u32 fib_index, ip4_address_t * lcl,
836 ip4_address_t * rmt, u16 lcl_port,
837 u16 rmt_port, u8 proto, u32 thread_index)
845 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
846 if (PREDICT_FALSE (!st))
850 * Lookup session amongst established ones
852 make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
853 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
856 ASSERT ((u32) (kv4.value >> 32) == thread_index);
857 s = session_get (kv4.value & 0xFFFFFFFFULL, thread_index);
858 return tp_vfts[s->session_type].get_connection (s->connection_index,
863 * Try half-open connections
865 rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
868 u32 sst = session_type_from_proto_and_ip (proto, 1);
869 return tp_vfts[sst].get_half_open (kv4.value & 0xFFFFFFFF);
873 * Check the session rules table
875 action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
876 rmt, lcl_port, rmt_port);
877 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
879 if (action_index != SESSION_RULES_TABLE_ACTION_NONE)
881 s = session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP4,
884 return tp_vfts[s->session_type].get_listener (s->connection_index);
888 * If nothing is found, check if any listener is available
890 s = session_lookup_listener4_i (st, lcl, lcl_port, proto);
892 return tp_vfts[s->session_type].get_listener (s->connection_index);
898 * Lookup connection with ip4 and transport layer information
900 * Not optimized. This is used on the fast path so it needs to be fast.
901 * Thereby, duplication of code and 'hacks' allowed. Lookup logic is identical
902 * to that of @ref session_lookup_connection_wt4
904 * @param fib_index index of the fib wherein the connection was received
905 * @param lcl local ip4 address
906 * @param rmt remote ip4 address
907 * @param lcl_port local port
908 * @param rmt_port remote port
909 * @param proto transport protocol (e.g., tcp, udp)
911 * @return pointer to transport connection, if one is found, 0 otherwise
913 transport_connection_t *
914 session_lookup_connection4 (u32 fib_index, ip4_address_t * lcl,
915 ip4_address_t * rmt, u16 lcl_port, u16 rmt_port,
924 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
925 if (PREDICT_FALSE (!st))
929 * Lookup session amongst established ones
931 make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
932 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
935 s = session_get_from_handle (kv4.value);
936 return tp_vfts[s->session_type].get_connection (s->connection_index,
941 * Try half-open connections
943 rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
946 u32 sst = session_type_from_proto_and_ip (proto, 1);
947 return tp_vfts[sst].get_half_open (kv4.value & 0xFFFFFFFF);
951 * Check the session rules table
953 action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
954 rmt, lcl_port, rmt_port);
955 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
957 if (action_index != SESSION_RULES_TABLE_ACTION_NONE)
959 s = session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP4,
962 return tp_vfts[s->session_type].get_listener (s->connection_index);
966 * If nothing is found, check if any listener is available
968 s = session_lookup_listener4_i (st, lcl, lcl_port, proto);
970 return tp_vfts[s->session_type].get_listener (s->connection_index);
976 * Lookup session with ip4 and transport layer information
978 * Important note: this may look into another thread's pool table and
979 * register as 'peeker'. Caller should call @ref session_pool_remove_peeker as
980 * if needed as soon as possible.
982 * Lookup logic is similar to that of @ref session_lookup_connection_wt4 but
983 * this returns a session as opposed to a transport connection and it does not
984 * try to lookup half-open sessions.
986 * Typically used by dgram connections
989 session_lookup_safe4 (u32 fib_index, ip4_address_t * lcl, ip4_address_t * rmt,
990 u16 lcl_port, u16 rmt_port, u8 proto)
998 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
999 if (PREDICT_FALSE (!st))
1003 * Lookup session amongst established ones
1005 make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
1006 rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
1008 return session_get_from_handle_safe (kv4.value);
1011 * Check the session rules table
1013 action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
1014 rmt, lcl_port, rmt_port);
1015 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
1017 if (action_index != SESSION_RULES_TABLE_ACTION_NONE)
1019 if ((s = session_lookup_action_to_session (action_index,
1020 FIB_PROTOCOL_IP4, proto)))
1025 * If nothing is found, check if any listener is available
1027 if ((s = session_lookup_listener4_i (st, lcl, lcl_port, proto)))
1034 * Lookup connection with ip6 and transport layer information
1036 * This is used on the fast path so it needs to be fast. Thereby,
1037 * duplication of code and 'hacks' allowed.
1039 * The lookup is incremental and returns whenever something is matched. The
1041 * - Try to find an established session
1042 * - Try to find a half-open connection
1043 * - Try session rules table
1044 * - Try to find a fully-formed or local source wildcarded (listener bound to
1045 * all interfaces) listener session
1048 * @param fib_index index of the fib wherein the connection was received
1049 * @param lcl local ip6 address
1050 * @param rmt remote ip6 address
1051 * @param lcl_port local port
1052 * @param rmt_port remote port
1053 * @param proto transport protocol (e.g., tcp, udp)
1054 * @param thread_index thread index for request
1056 * @return pointer to transport connection, if one is found, 0 otherwise
1058 transport_connection_t *
1059 session_lookup_connection_wt6 (u32 fib_index, ip6_address_t * lcl,
1060 ip6_address_t * rmt, u16 lcl_port,
1061 u16 rmt_port, u8 proto, u32 thread_index)
1063 session_table_t *st;
1064 stream_session_t *s;
1069 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
1070 if (PREDICT_FALSE (!st))
1073 make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
1074 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
1077 ASSERT ((u32) (kv6.value >> 32) == thread_index);
1078 s = session_get (kv6.value & 0xFFFFFFFFULL, thread_index);
1079 return tp_vfts[s->session_type].get_connection (s->connection_index,
1083 /* Try half-open connections */
1084 rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
1087 u32 sst = session_type_from_proto_and_ip (proto, 1);
1088 return tp_vfts[sst].get_half_open (kv6.value & 0xFFFFFFFF);
1091 /* Check the session rules table */
1092 action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
1093 rmt, lcl_port, rmt_port);
1094 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
1096 if (action_index != SESSION_RULES_TABLE_ACTION_NONE)
1098 s = session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP4,
1101 return tp_vfts[s->session_type].get_listener (s->connection_index);
1104 /* If nothing is found, check if any listener is available */
1105 s = session_lookup_listener6_i (st, lcl, lcl_port, proto);
1107 return tp_vfts[s->session_type].get_listener (s->connection_index);
1113 * Lookup connection with ip6 and transport layer information
1115 * Not optimized. This is used on the fast path so it needs to be fast.
1116 * Thereby, duplication of code and 'hacks' allowed. Lookup logic is identical
1117 * to that of @ref session_lookup_connection_wt4
1119 * @param fib_index index of the fib wherein the connection was received
1120 * @param lcl local ip6 address
1121 * @param rmt remote ip6 address
1122 * @param lcl_port local port
1123 * @param rmt_port remote port
1124 * @param proto transport protocol (e.g., tcp, udp)
1126 * @return pointer to transport connection, if one is found, 0 otherwise
1128 transport_connection_t *
1129 session_lookup_connection6 (u32 fib_index, ip6_address_t * lcl,
1130 ip6_address_t * rmt, u16 lcl_port, u16 rmt_port,
1133 session_table_t *st;
1134 stream_session_t *s;
1139 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
1140 if (PREDICT_FALSE (!st))
1143 make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
1144 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
1147 s = session_get_from_handle (kv6.value);
1148 return tp_vfts[s->session_type].get_connection (s->connection_index,
1152 /* Try half-open connections */
1153 rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
1156 u32 sst = session_type_from_proto_and_ip (proto, 1);
1157 return tp_vfts[sst].get_half_open (kv6.value & 0xFFFFFFFF);
1160 /* Check the session rules table */
1161 action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
1162 rmt, lcl_port, rmt_port);
1163 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
1165 if (action_index != SESSION_RULES_TABLE_ACTION_NONE)
1167 s = session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP4,
1170 return tp_vfts[s->session_type].get_listener (s->connection_index);
1173 /* If nothing is found, check if any listener is available */
1174 s = session_lookup_listener6 (fib_index, lcl, lcl_port, proto);
1176 return tp_vfts[s->session_type].get_listener (s->connection_index);
1182 * Lookup session with ip6 and transport layer information
1184 * Important note: this may look into another thread's pool table and
1185 * register as 'peeker'. Caller should call @ref session_pool_remove_peeker as
1186 * if needed as soon as possible.
1188 * Lookup logic is similar to that of @ref session_lookup_connection_wt6 but
1189 * this returns a session as opposed to a transport connection and it does not
1190 * try to lookup half-open sessions.
1192 * Typically used by dgram connections
1195 session_lookup_safe6 (u32 fib_index, ip6_address_t * lcl, ip6_address_t * rmt,
1196 u16 lcl_port, u16 rmt_port, u8 proto)
1198 session_table_t *st;
1200 stream_session_t *s;
1204 st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
1205 if (PREDICT_FALSE (!st))
1208 make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
1209 rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
1211 return session_get_from_handle_safe (kv6.value);
1213 /* Check the session rules table */
1214 action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
1215 rmt, lcl_port, rmt_port);
1216 if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
1218 if (action_index != SESSION_RULES_TABLE_ACTION_NONE)
1221 session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP4,
1226 /* If nothing is found, check if any listener is available */
1227 if ((s = session_lookup_listener6_i (st, lcl, lcl_port, proto)))
1233 session_lookup_local_listener_make_handle (session_endpoint_t * sep)
1235 return ((u64) SESSION_LOCAL_TABLE_PREFIX << 32
1236 | (u32) sep->port << 16 | (u32) sep->transport_proto << 8
1237 | (u32) sep->is_ip4);
1241 session_lookup_local_is_handle (u64 handle)
1243 if (handle >> 32 == SESSION_LOCAL_TABLE_PREFIX)
1249 session_lookup_local_listener_parse_handle (u64 handle,
1250 session_endpoint_t * sep)
1252 u32 local_table_handle;
1253 if (handle >> 32 != SESSION_LOCAL_TABLE_PREFIX)
1255 local_table_handle = handle & 0xFFFFFFFFULL;
1256 sep->is_ip4 = local_table_handle & 0xff;
1257 local_table_handle >>= 8;
1258 sep->transport_proto = local_table_handle & 0xff;
1259 sep->port = local_table_handle >> 8;
1264 vnet_session_rule_add_del (session_rule_add_del_args_t * args)
1266 app_namespace_t *app_ns = app_namespace_get (args->appns_index);
1267 session_rules_table_t *srt;
1268 session_table_t *st;
1271 clib_error_t *error;
1274 return clib_error_return_code (0, VNET_API_ERROR_APP_INVALID_NS, 0,
1276 if (args->scope > 3)
1277 return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
1279 if (args->transport_proto != TRANSPORT_PROTO_TCP
1280 && args->transport_proto != TRANSPORT_PROTO_UDP)
1281 return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
1282 "invalid transport proto");
1283 if ((args->scope & SESSION_RULE_SCOPE_GLOBAL) || args->scope == 0)
1285 fib_proto = args->table_args.rmt.fp_proto;
1286 fib_index = app_namespace_get_fib_index (app_ns, fib_proto);
1287 st = session_table_get_for_fib_index (fib_proto, fib_index);
1288 srt = &st->session_rules[args->transport_proto];
1289 if ((error = session_rules_table_add_del (srt, &args->table_args)))
1291 clib_error_report (error);
1295 if (args->scope & SESSION_RULE_SCOPE_LOCAL)
1297 memset (&args->table_args.lcl, 0, sizeof (args->table_args.lcl));
1298 args->table_args.lcl.fp_proto = args->table_args.rmt.fp_proto;
1299 args->table_args.lcl_port = 0;
1300 st = app_namespace_get_local_table (app_ns);
1301 srt = &st->session_rules[args->transport_proto];
1302 error = session_rules_table_add_del (srt, &args->table_args);
1308 * Mark (global) tables as pertaining to app ns
1311 session_lookup_set_tables_appns (app_namespace_t * app_ns)
1313 session_table_t *st;
1317 for (fp = 0; fp < ARRAY_LEN (fib_index_to_table_index); fp++)
1319 fib_index = app_namespace_get_fib_index (app_ns, fp);
1320 st = session_table_get_for_fib_index (fp, fib_index);
1322 st->appns_index = app_namespace_index (app_ns);
1327 format_ip4_session_lookup_kvp (u8 * s, va_list * args)
1329 clib_bihash_kv_16_8_t *kvp = va_arg (*args, clib_bihash_kv_16_8_t *);
1330 u32 is_local = va_arg (*args, u32);
1331 u8 *app_name, *str = 0;
1332 stream_session_t *session;
1333 v4_connection_key_t *key = (v4_connection_key_t *) kvp->key;
1335 char *proto = key->proto == TRANSPORT_PROTO_TCP ? "T" : "U";
1338 session = session_get_from_handle (kvp->value);
1339 app_name = application_name_from_index (session->app_index);
1340 str = format (0, "[%s] %U:%d->%U:%d", proto, format_ip4_address,
1341 &key->src, clib_net_to_host_u16 (key->src_port),
1342 format_ip4_address, &key->dst,
1343 clib_net_to_host_u16 (key->dst_port));
1344 s = format (s, "%-40v%-30v", str, app_name);
1348 app_name = application_name_from_index (kvp->value);
1349 str = format (0, "[%s] %U:%d", proto, format_ip4_address,
1350 &key->src, clib_net_to_host_u16 (key->src_port));
1351 s = format (s, "%-30v%-30v", str, app_name);
1353 vec_free (app_name);
1357 typedef struct _ip4_session_table_show_ctx_t
1361 } ip4_session_table_show_ctx_t;
1364 ip4_session_table_show (clib_bihash_kv_16_8_t * kvp, void *arg)
1366 ip4_session_table_show_ctx_t *ctx = arg;
1367 vlib_cli_output (ctx->vm, "%U", format_ip4_session_lookup_kvp, kvp,
1373 session_lookup_show_table_entries (vlib_main_t * vm, session_table_t * table,
1374 u8 type, u8 is_local)
1376 ip4_session_table_show_ctx_t ctx = {
1378 .is_local = is_local,
1381 vlib_cli_output (vm, "%-40s%-30s", "Session", "Application");
1383 vlib_cli_output (vm, "%-30s%-30s", "Listener", "Application");
1388 ip4_session_table_walk (&table->v4_session_hash, ip4_session_table_show,
1392 clib_warning ("not supported");
1396 static clib_error_t *
1397 session_rule_command_fn (vlib_main_t * vm, unformat_input_t * input,
1398 vlib_cli_command_t * cmd)
1400 u32 proto = ~0, lcl_port, rmt_port, action = 0, lcl_plen = 0, rmt_plen = 0;
1401 u32 appns_index, scope = 0;
1402 ip46_address_t lcl_ip, rmt_ip;
1403 u8 is_ip4 = 1, conn_set = 0;
1404 u8 fib_proto, is_add = 1, *ns_id = 0;
1406 app_namespace_t *app_ns;
1407 clib_error_t *error;
1409 memset (&lcl_ip, 0, sizeof (lcl_ip));
1410 memset (&rmt_ip, 0, sizeof (rmt_ip));
1411 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1413 if (unformat (input, "del"))
1415 else if (unformat (input, "add"))
1417 else if (unformat (input, "appns %_%v%_", &ns_id))
1419 else if (unformat (input, "scope global"))
1420 scope = SESSION_RULE_SCOPE_GLOBAL;
1421 else if (unformat (input, "scope local"))
1422 scope = SESSION_RULE_SCOPE_LOCAL;
1423 else if (unformat (input, "scope all"))
1424 scope = SESSION_RULE_SCOPE_LOCAL | SESSION_RULE_SCOPE_GLOBAL;
1425 else if (unformat (input, "proto %U", unformat_transport_proto, &proto))
1427 else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip4_address,
1428 &lcl_ip.ip4, &lcl_plen, &lcl_port,
1429 unformat_ip4_address, &rmt_ip.ip4, &rmt_plen,
1435 else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip6_address,
1436 &lcl_ip.ip6, &lcl_plen, &lcl_port,
1437 unformat_ip6_address, &rmt_ip.ip6, &rmt_plen,
1443 else if (unformat (input, "action %d", &action))
1445 else if (unformat (input, "tag %_%v%_", &tag))
1448 return clib_error_return (0, "unknown input `%U'",
1449 format_unformat_error, input);
1454 vlib_cli_output (vm, "proto must be set");
1457 if (is_add && !conn_set && action == ~0)
1459 vlib_cli_output (vm, "connection and action must be set for add");
1462 if (!is_add && !tag && !conn_set)
1464 vlib_cli_output (vm, "connection or tag must be set for delete");
1467 if (vec_len (tag) > SESSION_RULE_TAG_MAX_LEN)
1469 vlib_cli_output (vm, "tag too long (max u64)");
1475 app_ns = app_namespace_get_from_id (ns_id);
1478 vlib_cli_output (vm, "namespace %v does not exist", ns_id);
1484 app_ns = app_namespace_get_default ();
1486 appns_index = app_namespace_index (app_ns);
1488 fib_proto = is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
1489 session_rule_add_del_args_t args = {
1490 .table_args.lcl.fp_addr = lcl_ip,
1491 .table_args.lcl.fp_len = lcl_plen,
1492 .table_args.lcl.fp_proto = fib_proto,
1493 .table_args.rmt.fp_addr = rmt_ip,
1494 .table_args.rmt.fp_len = rmt_plen,
1495 .table_args.rmt.fp_proto = fib_proto,
1496 .table_args.lcl_port = lcl_port,
1497 .table_args.rmt_port = rmt_port,
1498 .table_args.action_index = action,
1499 .table_args.is_add = is_add,
1500 .table_args.tag = tag,
1501 .appns_index = appns_index,
1504 error = vnet_session_rule_add_del (&args);
1510 VLIB_CLI_COMMAND (session_rule_command, static) =
1512 .path = "session rule",
1513 .short_help = "session rule [add|del] appns <ns_id> proto <proto> "
1514 "<lcl-ip/plen> <lcl-port> <rmt-ip/plen> <rmt-port> action <action>",
1515 .function = session_rule_command_fn,
1520 session_lookup_dump_rules_table (u32 fib_index, u8 fib_proto,
1523 vlib_main_t *vm = vlib_get_main ();
1524 session_rules_table_t *srt;
1525 session_table_t *st;
1526 st = session_table_get_for_fib_index (fib_index, fib_proto);
1527 srt = &st->session_rules[transport_proto];
1528 session_rules_table_cli_dump (vm, srt, fib_proto);
1532 session_lookup_dump_local_rules_table (u32 table_index, u8 fib_proto,
1535 vlib_main_t *vm = vlib_get_main ();
1536 session_rules_table_t *srt;
1537 session_table_t *st;
1538 st = session_table_get (table_index);
1539 srt = &st->session_rules[transport_proto];
1540 session_rules_table_cli_dump (vm, srt, fib_proto);
1543 static clib_error_t *
1544 show_session_rules_command_fn (vlib_main_t * vm, unformat_input_t * input,
1545 vlib_cli_command_t * cmd)
1547 u32 transport_proto = ~0, lcl_port, rmt_port, lcl_plen, rmt_plen;
1548 u32 fib_index, scope = 0;
1549 ip46_address_t lcl_ip, rmt_ip;
1550 u8 is_ip4 = 1, show_one = 0;
1551 app_namespace_t *app_ns;
1552 session_rules_table_t *srt;
1553 session_table_t *st;
1554 u8 *ns_id = 0, fib_proto;
1556 memset (&lcl_ip, 0, sizeof (lcl_ip));
1557 memset (&rmt_ip, 0, sizeof (rmt_ip));
1558 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1560 if (unformat (input, "%U", unformat_transport_proto, &transport_proto))
1562 else if (unformat (input, "appns %_%v%_", &ns_id))
1564 else if (unformat (input, "scope global"))
1566 else if (unformat (input, "scope local"))
1568 else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip4_address,
1569 &lcl_ip.ip4, &lcl_plen, &lcl_port,
1570 unformat_ip4_address, &rmt_ip.ip4, &rmt_plen,
1576 else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip6_address,
1577 &lcl_ip.ip6, &lcl_plen, &lcl_port,
1578 unformat_ip6_address, &rmt_ip.ip6, &rmt_plen,
1585 return clib_error_return (0, "unknown input `%U'",
1586 format_unformat_error, input);
1589 if (transport_proto == ~0)
1591 vlib_cli_output (vm, "transport proto must be set");
1597 app_ns = app_namespace_get_from_id (ns_id);
1600 vlib_cli_output (vm, "appns %v doesn't exist", ns_id);
1606 app_ns = app_namespace_get_default ();
1609 if (scope == 1 || scope == 0)
1611 fib_proto = is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
1612 fib_index = is_ip4 ? app_ns->ip4_fib_index : app_ns->ip6_fib_index;
1613 st = session_table_get_for_fib_index (fib_proto, fib_index);
1617 st = app_namespace_get_local_table (app_ns);
1622 srt = &st->session_rules[transport_proto];
1623 session_rules_table_show_rule (vm, srt, &lcl_ip, lcl_port, &rmt_ip,
1628 vlib_cli_output (vm, "%U rules table", format_transport_proto,
1630 srt = &st->session_rules[transport_proto];
1631 session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4);
1632 session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP6);
1639 VLIB_CLI_COMMAND (show_session_rules_command, static) =
1641 .path = "show session rules",
1642 .short_help = "show session rules [appns <id> proto <proto> <lcl-ip/plen>"
1643 " <lcl-port> <rmt-ip/plen> <rmt-port>]",
1644 .function = show_session_rules_command_fn,
1649 session_lookup_init (void)
1652 * Allocate default table and map it to fib_index 0
1654 session_table_t *st = session_table_alloc ();
1655 vec_validate (fib_index_to_table_index[FIB_PROTOCOL_IP4], 0);
1656 fib_index_to_table_index[FIB_PROTOCOL_IP4][0] = session_table_index (st);
1657 st->active_fib_proto = FIB_PROTOCOL_IP4;
1658 session_table_init (st, FIB_PROTOCOL_IP4);
1659 st = session_table_alloc ();
1660 vec_validate (fib_index_to_table_index[FIB_PROTOCOL_IP6], 0);
1661 fib_index_to_table_index[FIB_PROTOCOL_IP6][0] = session_table_index (st);
1662 st->active_fib_proto = FIB_PROTOCOL_IP6;
1663 session_table_init (st, FIB_PROTOCOL_IP6);
1667 * fd.io coding-style-patch-verification: ON
1670 * eval: (c-set-style "gnu")