#include "fa_node.h"
#define ACL_PLUGIN_VERSION_MAJOR 1
-#define ACL_PLUGIN_VERSION_MINOR 2
+#define ACL_PLUGIN_VERSION_MINOR 3
+
+#define UDP_SESSION_IDLE_TIMEOUT_SEC 600
+#define TCP_SESSION_IDLE_TIMEOUT_SEC (3600*24)
+#define TCP_SESSION_TRANSIENT_TIMEOUT_SEC 120
extern vlib_node_registration_t acl_in_node;
extern vlib_node_registration_t acl_out_node;
/* MACIP (input) ACLs associated with the interfaces */
u32 *macip_acl_by_sw_if_index;
- /* next indices for our nodes in the l2-classify tables */
- u32 l2_input_classify_next_acl_old;
- u32 l2_output_classify_next_acl_old;
-
- /* next node indices for feature bitmap */
- u32 acl_in_node_feat_next_node_index[32];
- u32 acl_out_node_feat_next_node_index[32];
-
- /* ACL match actions (must be coherent across in/out ACLs to next indices (can differ) */
-
- u32 acl_in_ip4_match_next[256];
- u32 acl_in_ip6_match_next[256];
- u32 acl_out_ip4_match_next[256];
- u32 acl_out_ip6_match_next[256];
- u32 n_match_actions;
-
/* bitmaps when set the processing is enabled on the interface */
uword *fa_in_acl_on_sw_if_index;
uword *fa_out_acl_on_sw_if_index;
/* bitmap, when set the hash is initialized */
uword *fa_sessions_on_sw_if_index;
clib_bihash_40_8_t *fa_sessions_by_sw_if_index;
- /* pool for FA session data. See fa_node.h */
- fa_session_t *fa_sessions_pool;
- /* The process node which is responsible to deleting the sessions */
+ /* The process node which orcherstrates the cleanup */
u32 fa_cleaner_node_index;
/* FA session timeouts, in seconds */
u32 session_timeout_sec[ACL_N_TIMEOUTS];
/* L2 datapath glue */
- /* active next indices within L2 classifiers - switch old/new path */
+ /* next indices within L2 classifiers for ip4/ip6 fa L2 nodes */
u32 l2_input_classify_next_acl_ip4;
u32 l2_input_classify_next_acl_ip6;
u32 l2_output_classify_next_acl_ip4;
u32 l2_output_classify_next_acl_ip6;
- /* saved next indices within L2 classifiers for ip4/ip6 fa L2 nodes */
- u32 fa_l2_input_classify_next_acl_ip4;
- u32 fa_l2_input_classify_next_acl_ip6;
- u32 fa_l2_output_classify_next_acl_ip4;
- u32 fa_l2_output_classify_next_acl_ip6;
/* next node indices for L2 dispatch */
u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32];
u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32];
/* EH values that we can skip over */
uword *fa_ipv6_known_eh_bitmap;
+ /* whether to match L4 ACEs with ports on the non-initial fragment */
+ int l4_match_nonfirst_fragment;
+
/* conn table per-interface conn table parameters */
u32 fa_conn_table_hash_num_buckets;
uword fa_conn_table_hash_memory_size;
f64 fa_cleaner_wait_time_increment;
u64 fa_current_cleaner_timer_wait_interval;
- u32 fa_conn_list_head[ACL_N_TIMEOUTS];
- u32 fa_conn_list_tail[ACL_N_TIMEOUTS];
+ /* per-worker data related t conn management */
+ acl_fa_per_worker_data_t *per_worker_data;
+
+ /* Configured session timeout */
+ u64 session_timeout[ACL_N_TIMEOUTS];
+
+
+ /* Counters for the cleaner thread */
+
+#define foreach_fa_cleaner_counter \
+ _(fa_cleaner_cnt_delete_by_sw_index, "delete_by_sw_index events") \
+ _(fa_cleaner_cnt_delete_by_sw_index_ok, "delete_by_sw_index handled ok") \
+ _(fa_cleaner_cnt_unknown_event, "unknown events received") \
+ _(fa_cleaner_cnt_timer_restarted, "session idle timers restarted") \
+ _(fa_cleaner_cnt_wait_with_timeout, "event wait with timeout called") \
+ _(fa_cleaner_cnt_wait_without_timeout, "event wait w/o timeout called") \
+ _(fa_cleaner_cnt_event_cycles, "total event cycles") \
+/* end of counters */
+#define _(id, desc) u32 id;
+ foreach_fa_cleaner_counter
+#undef _
/* convenience */
vlib_main_t * vlib_main;
_(HOPBYHOP , 0 , "IPv6ExtHdrHopByHop") \
_(ROUTING , 43 , "IPv6ExtHdrRouting") \
_(DESTOPT , 60 , "IPv6ExtHdrDestOpt") \
+ _(FRAGMENT , 44 , "IPv6ExtHdrFragment") \
_(MOBILITY , 135, "Mobility Header") \
_(HIP , 139, "Experimental use Host Identity Protocol") \
_(SHIM6 , 140, "Shim6 Protocol") \
Also, Fragment header needs special processing.
_(NONEXT , 59 , "NoNextHdr") \
- _(FRAGMENT , 44 , "IPv6ExtHdrFragment") \
ESP is hiding its internal format, so no point in trying to go past it.