Steven Luong [Mon, 23 Aug 2021 21:31:16 +0000 (14:31 -0700)]
vhost: migrate to new TX infra
Take advantage of the new TX infra and support manual thread placement
Type: improvement
Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: Id8023846a2eb59125fcf2f80f4f11eb681cf14dc
Benoît Ganne [Mon, 14 Dec 2020 18:31:16 +0000 (19:31 +0100)]
ikev2: check for valid cipher + integrity
Type: improvement
Change-Id: Ic09b2c777a7c82e8d7074164280f817f9141529b
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Wed, 25 Aug 2021 17:01:59 +0000 (19:01 +0200)]
ikev2: fix DNS resolution overflow
VPP DNS resolver expects NULL-terminated C string, whereas the ikev2
plugin only uses non-NULL terminated vectors.
Type: fix
Change-Id: I4a2afffb9e1b6b5dd11842621d5f13bc5a145862
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Wed, 25 Aug 2021 14:53:22 +0000 (16:53 +0200)]
af_xdp: fix stale rx/tx pointers in xsk objects
xsk objects keep pointers to the rx and tx objects. If we re-allocate
the rx and tx vectors after initializing the associated xsk object, the
pointers in the xsk object will be staled.
To avoid this, we allocate the vectors to the max expected size instead
of growing them.
Type: fix
Change-Id: If30433a28c186787d66c12dbab34bf210c95b519
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Ahmed Abdelsalam [Tue, 24 Aug 2021 15:59:39 +0000 (15:59 +0000)]
sr: extend the srv6 sid list structure
Extend the srv6 sid list structure with policy type to support
different SR policy types
Type: feature
Signed-off-by: Ahmed Abdelsalam <ahabdels@cisco.com>
Change-Id: I6a8cf82b1269e1c46f3757df0047b306f613112b
Tianyu Li [Thu, 26 Aug 2021 01:43:42 +0000 (09:43 +0800)]
acl: fix prefetch out of struct bound on Arm
fa_session_t *sess;
CLIB_PREFETCH (sess, 2 * CLIB_CACHE_LINE_BYTES, STORE);
sizeof(fa_session_t) is 128 bytes
i) on 64B cacheline size Arm machine,
above CLIB_PREFETCH () macro will be expand to
__builtin_prefetch(sess)
__builtin_prefetch(sess + 64)
__builtin_prefetch(sess + 128) << prefetch is out of range of *sess.
__builtin_prefetch(sess + 192) <<
ii) on 128B cacheline size Arm machine, CLIB_PREFETCH () expands to
__builtin_prefetch(sess)
__builtin_prefetch(sess + 128) << still out of bound
Solution:
Change to CLIB_PREFETCH (sess, sizeof(*sess), STORE);
Type: fix
Signed-off-by: Tianyu Li <tianyu.li@arm.com>
Reviewed-by: Lijian Zhang <lijian.zhang@arm.com>
Change-Id: I4b3d4fc55747f3d9ad1bcf24f8834601a03ef55e
jxm [Mon, 21 Jun 2021 04:53:59 +0000 (04:53 +0000)]
fib: fix source address get error for p2p if
Type: fix
Signed-off-by: jxm <jiangxiaoming@outlook.com>
Change-Id: I5a6a1ce9f232d4ed0fd4707cd5aa9b46cc8a2a5a
arikachen [Mon, 23 Aug 2021 05:45:21 +0000 (13:45 +0800)]
af_xdp: fix xsk_socket__delete left un-cleanup
Type: fix
while xsk fd closed by clib_file_del_by_index fisrt,
xsk_get_mmap_offsets will get wrong off in xsk_socket__delete,
so munmap wrong place.
Signed-off-by: arikachen <eaglesora@gmail.com>
Change-Id: I95464e9b4eec99814bd32d7402c0d60a0605cef5
Stanislav Zaikin [Fri, 20 Aug 2021 14:25:31 +0000 (16:25 +0200)]
ip: check if interface has link-local address
Type: fix
Change-Id: I9d3344374738f8cf883cffb4715c76b50bb4bfce
Signed-off-by: Stanislav Zaikin <zstaseg@gmail.com>
Matthew Smith [Thu, 19 Aug 2021 20:47:06 +0000 (15:47 -0500)]
build: include vat2 in RPM file list
Type: fix
Building an RPM with 'make pkg-rpm' fails because /usr/bin/vat2 is
installed but is not included in %files. Add it.
Change-Id: I686b291e4419d39141f0f87da963b413d11ab0f8
Signed-off-by: Matthew Smith <mgsmith@netgate.com>
Benoît Ganne [Tue, 22 Jun 2021 13:39:16 +0000 (15:39 +0200)]
ikev2: fix use-after-free
Type: fix
Change-Id: Ia3bacefdad674807de873b5c457b8470f66193f3
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Wed, 7 Jul 2021 12:58:06 +0000 (14:58 +0200)]
rdma: decrease inlining
Remove aggressive inlining outside of the main loop to improve build
time (from 146s to 22s).
Type: refactor
Change-Id: I3824516a85b5e8d02894e66f19d891569c1a68fb
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Tue, 20 Jul 2021 14:51:39 +0000 (16:51 +0200)]
vppinfra: fix clib_random_buffer_get_data caching
When using cached bytes:
- do not overflow
- do not return the same bytes twice
Type: fix
Change-Id: I2a87b47a79300e56a2201b8fc3cb6cb15b592e28
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Thu, 27 May 2021 15:43:34 +0000 (17:43 +0200)]
buffers: fix buffer linearization
vlib_buffer_chain_linearize() truncates partial data in chained buffers
in corner cases when current_data is negative.
Strengthen test cases to reproduce the errors and fix it.
Type: fix
Change-Id: Ida621923711c5755508224bdc3842b31003c6c0b
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Thu, 5 Aug 2021 09:47:52 +0000 (11:47 +0200)]
perfmon: fix perf event user page read
When mmap()-ing perf event in userspace, we must adhere to the kernel
update protocol to read consistent values.
Also, 'offset' is an offset to add to the counter value, not to apply
to the PMC index.
Type: fix
Change-Id: I59106bb3a48185ff3fcb0d2f09097269a67bb6d6
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Tue, 20 Jul 2021 14:49:13 +0000 (16:49 +0200)]
vlib: add format_vnet_buffer_no_chain
- add format_vnet_buffer and format_vnet_buffer_no_chain to mirror
format_vlib_buffer and format_vlib_buffer_no_chain
- format_vnet_buffer used to be the "no chain" version, replace all of
its current use with the corresponding format_vnet_buffer_no_chain
- add a function to dump vnet buffer details from gdb
Type: improvement
Change-Id: I143ce845f80e7ef937ea33a557b6e3b5988c5b8f
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Wed, 7 Jul 2021 12:45:10 +0000 (14:45 +0200)]
ikev2: decrease inlining
IKEv2 is not optimized for dataplane processing and do not really
benefit from aggressive inlining. Let the compiler decide to improve
build time (from 205s to 30s).
Type: refactor
Change-Id: I5286880b35d338d669ec9382bf049d4486c04947
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Thu, 19 Aug 2021 13:17:03 +0000 (15:17 +0200)]
build: fix external plugin build
Type: fix
Fixes:
88b2e3682be6303973fc59c3c62141d64a9e10d7
Change-Id: I4b29924246e2cdc307cf238c5cb8624f14317452
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Matthew Smith [Tue, 10 Aug 2021 17:22:14 +0000 (12:22 -0500)]
nat: handle ED in2out ICMP errors with workers
Type: fix
With endpoint dependent NAT44, When there are multiple workers we look
for a flow which matches the packet in order to figure out which worker
should handle the packet. If the packet is an ICMP error, it may be
associated with an existing flow by inspecting the L3/L4 headers that
are included in the message payload.
This was not being done for in2out packets in
nat44_ed_get_in2out_worker_index(), so some packets which were related
to an open session were not being associated with that session and were
being passed to a different thread than the one where the session was
created. Later on, when the packet was processed by the fast path in2out
node, the L3/L4 headers in the payload are inspected and the fast path
node finds the existing session. Since that session is owned by a
different thread than the one the packet is being processed by, the
in2out fast path node can potentially access the wrong session and/or
memory adjacent to the session pool. This can cause a SEGV.
Make nat44_ed_get_in2out_worker_index() look at the inner headers when
processing an ICMP error. THis is already done in
nat44_ed_get_out2in_worker_index() and in the fast path in2out node.
Change-Id: Icdc1abebcbce452ee7be7cb23fc563e09bf575f2
Signed-off-by: Matthew Smith <mgsmith@netgate.com>
Andrew Yourtchenko [Fri, 13 Aug 2021 13:59:50 +0000 (13:59 +0000)]
acl: add API call for setting the toggle to select between linear and bihash-based lookups
In some cases (ACL of a few lines long with a lot of different subnet masks), linear lookup
may be more efficient than the hash-based lookup. Expose the API to allow the control plane
to choose what lookup algorithm to use.
Type: improvement
Change-Id: I540dd1b4ce63c5106a556d550f911f3a578b33e0
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Steven Luong [Wed, 21 Apr 2021 16:54:34 +0000 (09:54 -0700)]
vhost: interrupt mode support with mq
vhost interrupt mode support with mq does not work when coalesce frame
is not configured to 0.
When packed-ring is configured, we were also setting the wrong flag
for want-interrupt.
No need to trigger an interrupt to RX infra if there is at least one
queue in the same thread that is doing polling.
Type: fix
Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I8e64250f2aa6bf611a777a53e4d2c1076d83305f
Ole Troan [Tue, 17 Aug 2021 10:57:00 +0000 (12:57 +0200)]
vat2: add shared memory argument
Add prefix argument to specifiy shared memory segment.
Add long arguments.
Add argument to dump apis.
Add help.
Add template argument
E.g:
vat2 --template sw_interface_add_del_address
{
"_msgname": "sw_interface_add_del_address",
"sw_if_index": 0,
"is_add": false,
"del_all": false,
"prefix": "0.0.0.0"
}
Usage: vat2 [OPTION] <message-name> <JSON object>
Send API message to VPP and print reply
-d, --debug Print additional information
-p, --prefix Specify shared memory prefix to connect to a given VPP instance
-f, --file File containing a JSON object with the arguments for the message to send
--dump-apis List all APIs available from connected VPP instance
Type: improvement
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I2d32483a727bc16990c9a30dfa9bc1fa7b1fa85a
Signed-off-by: Ole Troan <ot@cisco.com>
Alexander Chernavin [Tue, 6 Jul 2021 10:08:26 +0000 (06:08 -0400)]
nat: fix counters increment for output feature
Type: fix
The NAT plugin stores packet counters and a counter represents a vector
indexed by interface index. When an interface is assigned a NAT role,
the counters are validated to be long enough for the given interface
index.
When a packet traverses NAT in2out and output feature is disabled, the
appropriate counters are updated by the RX interface index. In this
case, translation happens on the inside interface and its index was
ensured to be valid in all of the counters during NAT role assignment.
When a packet traverses NAT in2out and output feature is enabled, the
appropriate counters are updated by the RX interface index too. In this
case, translation happens on the outside interface and the packet could
be received on any interface, even with no NAT role assigned. If that's
the case and its index is greater than the greatest index validated in
the counters, a new counter value will be written to memory that does
not belong to the counter. As a result, a crash will occur at some
point.
With this change, use TX interface index to update the counters when
output feature is enabled. TX interface is an actual interface where
translation happens and its index is always valid in the counters.
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
Change-Id: I53a52af949fe96419e1b5fef4134ab4062198f51
Dave Wallace [Tue, 17 Aug 2021 19:11:43 +0000 (15:11 -0400)]
docs: fix missing dependency on pip-tools for docs-venv
Type: fix
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
Change-Id: Iadb72fd0cb434a7ca2f6cbda7d78209f0746f0c6
Klement Sekera [Mon, 2 Aug 2021 14:14:15 +0000 (16:14 +0200)]
ip: reassembly cleanup
Remove unused parameters and fix warnings.
Type: fix
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Change-Id: I2d0e7b84b56817999283ecb6be606159dcb26a28
Mohammed Hawari [Mon, 16 Aug 2021 12:37:21 +0000 (14:37 +0200)]
build: install ethernet/ethernet_types_api.h
ip/ip_types_api.h is already installed by the build system
Change-Id: Iec43e0ad50e32473d93ea8f7281b5a6477ddc87f
Signed-off-by: Mohammed Hawari <mohammed@hawari.fr>
Type: improvement
Andrew Yourtchenko [Mon, 16 Aug 2021 10:49:19 +0000 (12:49 +0200)]
build: remove dh-systemd from dependencies
b8e7a45d56be9f3e11b07b82fd899160e2af1bf1 has removed dh-systemd from the DEB_DEPENDS,
however this causes the make pkg-deb to fail on a clean lxd or docker install of debian10 as follows:
dpkg-buildpackage: info: source package vpp
dpkg-buildpackage: info: source version 21.10-rc0~
252-g76b19ceaf
dpkg-buildpackage: info: source distribution unstable
dpkg-buildpackage: info: source changed by fd.io VPP <vpp-dev@fd.io>
dpkg-buildpackage: info: host architecture amd64
dpkg-source --before-build .
dpkg-checkbuilddeps: error: Unmet build dependencies: dh-systemd
dpkg-buildpackage: warning: build dependencies/conflicts unsatisfied; aborting
dpkg-buildpackage: warning: (Use -d flag to override.)
FAILED: CMakeFiles/pkg/CMakeFiles/pkg-deb
cd /root/t/t/vpp/build-root/build-vpp-native/vpp/CMakeFiles && dpkg-buildpackage -us -uc -b
ninja: build stopped: subcommand failed.
make[1]: *** [/root/t/t/vpp/build-data/packages/vpp.mk:46: vpp-package-deb] Error 1
Thanks to Nick Brown for the help!
Type: fix
Fixes:
b8e7a45d56be9f3e11b07b82fd899160e2af1bf1
Change-Id: I08b3a1efcdf6e6096b4ab28263764c1d66be43ef
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Matthew Smith [Fri, 2 Jul 2021 20:30:37 +0000 (15:30 -0500)]
dpdk: patch i40e PMD to disable source pruning
Type: improvement
X710/XL710 devices have source pruning enabled by default and DPDK
provides no option to disable it. This prevents VRRP from working
properly.
Disable source pruning while setting up the main VSI.
Change-Id: Iaf89f7dae8992e3bd0b9fae83878daa27a5bb931
Signed-off-by: Matthew Smith <mgsmith@netgate.com>
Pim van Pelt [Tue, 10 Aug 2021 21:44:44 +0000 (23:44 +0200)]
ip: Fix crash in ip address add on sub-int without exact-match
Type: fix
Creating a sub-int without exact-match set, and subsequently adding an
IPv4 or IPv6 address will crash VPP. This fix catches this situation and
refuses to allow the caller to add an IPv4 or IPv6 address on an
ethernet sub-int that does not have exact-match set.
TESTED:
Before this change, the following crashes VPP:
```
DBGvpp# cre sub TenGigabitEthernet3/0/0 1 dot1q 10
TenGigabitEthernet3/0/0.1
DBGvpp# set interface ip address TenGigabitEthernet3/0/0.1 2001:db8::1/64
<crash>
```
After the change, VPP refuses to act:
```
DBGvpp# cre sub TenGigabitEthernet3/0/0 1 dot1q 10
TenGigabitEthernet3/0/0.1
DBGvpp# set interface ip address TenGigabitEthernet3/0/0.1 192.0.2.1/30
set interface ip address: sub-interface without exact-match doesn't support IP addressing
DBGvpp# set interface ip address TenGigabitEthernet3/0/0.1 2001:db8:1/64
set interface ip address: sub-interface without exact-match doesn't support IP addressing
```
Signed-off-by: Pim van Pelt <pim@ipng.nl>
Change-Id: I42997db314225cd186ebb54013b5717ace7f7bd6
Nathan Skrzypczak [Tue, 10 Aug 2021 13:05:29 +0000 (15:05 +0200)]
ip: punt redirect add nh in api
Type: feature
Change-Id: Ia970f444ba2f38b7a42ea94942c906f1b541511b
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
Ole Troan [Wed, 11 Aug 2021 11:54:14 +0000 (13:54 +0200)]
ip: source address selection
Implement a simple source address selection algorithm
for IPv4 and IPv6.
IPv6 does not yet implement RFC6724 but supports link-locals.
ping now chooses correct source address for link-local destination.
Added ping support for link-local multicast (e.g. allnodes).
Type: feature
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I1a3382c1f7d4ace0386c2c19e4e47b045b73a3ed
Signed-off-by: Ole Troan <ot@cisco.com>
Dave Wallace [Thu, 12 Aug 2021 22:36:02 +0000 (18:36 -0400)]
tests docs: upgrade python packages
- Upgrade python package requirements for test & docs
- Clean up docs generation warnings
- Consolidate python requirements for docs in test
requirements specs.
- Upgrade pip
Type: make
Change-Id: I74a3924b43ed93d15b32ec9f6fc41ed1ba95b69b
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
Gabriel Oginski [Thu, 12 Aug 2021 13:04:03 +0000 (14:04 +0100)]
wireguard: add flag to check hmac for decryption
Type: fix
Originally the decryption doesn't check the hmac for chacha20-poly1305.
This patch fixes the problem by adding flag to crypto op to check hmac.
Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com>
Change-Id: I63e06fc011b288b1c9dc1b96a92923f224ef656b
Andrew Yourtchenko [Wed, 26 May 2021 14:52:41 +0000 (14:52 +0000)]
misc: 21.06 Release Notes
Change-Id: Iedd1263a971e50aceb2d579982484dd8873814dc
Type: docs
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
(cherry picked from commit
fc83f8cc67e65c734df3c47518f724c1617e1a5c)
Filip Varga [Mon, 26 Jul 2021 18:59:21 +0000 (20:59 +0200)]
nat: NAT44ED configuration refactor
Refactoring and cleaning up address allocation functions &
ip table update callbacks.
Type: refactor
Change-Id: I9a11700a5f335b64d0d84e04d8e16d040624e01b
Signed-off-by: Filip Varga <fivarga@cisco.com>
Alexander Skorichenko [Fri, 2 Jul 2021 17:10:52 +0000 (13:10 -0400)]
nat: correct pool ops when disable nat44 plugin
Type: fix
Replace vec ops with pool ops when iterating over pool of
interfaces in plugin_disable() functions.
With this change plugin disabling function and interface role
disabling functions iterate over identical sets of registered
interfaces, preventing 'interface couldn't be found' errors.
Signed-off-by: Alexander Skorichenko <askorichenko@netgate.com>
Change-Id: I4e191bcc5322ff1f9f7730c6fda5e6af86a8eec9
Florin Coras [Wed, 11 Aug 2021 21:55:49 +0000 (14:55 -0700)]
session vcl: cert key add/del with socket api
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I70791285cbf427479d2dcbf70ffdce2253add2fb
Ofer Heifetz [Mon, 26 Jul 2021 11:17:33 +0000 (14:17 +0300)]
tls: add start_listen openssl API return value check
Type: improvement
Check SSL_CTX_use_* API return value and exit on error.
Check BIO_new return code.
Release allocated BIO on error cases.
Change-Id: I9c48e91727e0eeba5d7d74d06fc37634e3c20978
Signed-off-by: Ofer Heifetz <oferh@marvell.com>
Nick Brown [Tue, 10 Aug 2021 08:20:32 +0000 (09:20 +0100)]
build: consistent debhelper 10 support
Type: fix
debian/compat contents were set to 10, but debhelper build dependency,
which is the same thing, was set to only 9. Both are not needed,
debian/compat being deprecated, so use only the latter.
At compat level 10, dh-systemd is integrated directly into debhelper, so
build dependency not needed (And in Debian Bullseye dh-systemd
transitional package is completely removed).
See: https://manpages.debian.org/testing/debhelper/debhelper.7.en.html#COMPATIBILITY_LEVELS
Signed-off-by: Nick Brown <nickbroon@gmail.com>
Change-Id: I5809b739334076d7fa8389b076a97f1648726e6e
Florin Coras [Tue, 10 Aug 2021 23:56:34 +0000 (16:56 -0700)]
svm: make more fifo segment header fields private
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Idab0f455b52a38efd2cf3781497d8cc7f57bfa42
Neale Ranns [Tue, 10 Aug 2021 14:37:11 +0000 (14:37 +0000)]
fib: Compiile time option to use 8-8-8-8 stride tries for FIB rather
than 16-8-8-8
Type: feature
the memory trade-off is:
for 8-8-8-8 tries
DBGvpp# sh ip fib mtrie mem
ipv4-VRF:0 mtrie:8068 hash:3499
totals: mtrie:8068 hash:3499 all:11567
for 16-8-8
DBGvpp# sh ip fib mtrie mem
ipv4-VRF:0 mtrie:333056 hash:3499
totals: mtrie:333056 hash:3499 all:336555
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I5271a4322d786de6e47613cff9bd432762dbed2a
Neale Ranns [Tue, 10 Aug 2021 07:39:18 +0000 (07:39 +0000)]
fib: A 16-8-8 and a 8-8-8-8 versions of an ip4_fib_t
Type: feature
The difference being the MTRIE type they contain.
THE FIB continues to use the 16-8-8 version.
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I5a54d4e6e6cc639f18a3fb65ef2925507a7ef1de
Neale Ranns [Fri, 6 Aug 2021 13:12:00 +0000 (13:12 +0000)]
ip: [re]introduce the 8-8-8-8 stride MTRIE
Type: improvement
there's a time-space trade-off between the 16-8-8 and 8-8-8-8 stride.
FIB continues to use the 16-8-8. Other features are now free to make the
choice.
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I6691a163486ce62e75e629f6ef0c990f253df8e5
Neale Ranns [Fri, 6 Aug 2021 12:24:14 +0000 (12:24 +0000)]
ip: Rename the ip4 mtrie function to be 16_8_8 specific
Type: improvement
the existing mtrie functions use the existing 16_8_8 mtrie. Rename them
to make that explicit. Then we can add the 8_8_8_8 types and functions
alongside.
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: If5ce7a282d5d3742dc65bcd0523220235d9c510d
Nathan Skrzypczak [Fri, 6 Aug 2021 10:03:11 +0000 (12:03 +0200)]
vppinfra: Fix bihash del warning
Type: fix
When freeing an uninstantiated bihash
created with dont_add_to_all_bihash_list = 1
we get a warning. This removes the
warning & the search for the bihash on
cleanup.
Change-Id: Iac50ce7e30b97925768f7ad3cb1d30af14686e21
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
Florin Coras [Fri, 6 Aug 2021 00:34:40 +0000 (17:34 -0700)]
tls: picotls optimize rx path
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I0dfa8d60739bc781c37e0d8fced8280b9af93367
Florin Coras [Thu, 5 Aug 2021 01:20:24 +0000 (18:20 -0700)]
tls: picotls optimize writes
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I76a1cd516849cfe5bc87ed2b3707c6f2257126d2
Benoît Ganne [Thu, 15 Jul 2021 17:21:31 +0000 (19:21 +0200)]
misc: do not capture tx packets twice
When a packet goes through interface-output, whether it should be
captured or not will be evaluated twice: in interface-output and in
interface-output-template (<interface_name>-out) node.
interface-output should only capture packets if there is an interface
filter, otherwise it should defer evaluation to
interface-output-template.
Type: fix
Change-Id: Ia720c5d184a236335e1d7d44d8c04caf87af5630
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Neale Ranns [Tue, 10 Aug 2021 12:35:57 +0000 (12:35 +0000)]
ip: Use the IP4 lookup functions
Type: refactor
as opposed to wrtiing out the mtrie steps one by one each time.
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I1248861350f9189f9a67ac6e68940813af279e03
Neale Ranns [Tue, 10 Aug 2021 12:21:07 +0000 (12:21 +0000)]
ip: Remove the 'test lookup' CLI command
Type: fix
There's no such thing as a conflict between the FIB and adj tables. This
is code that should have been removed way back in 16.04.
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I4524e7921b03b89106dd1f35aa1171d0945367cf
Ole Troan [Fri, 6 Aug 2021 07:58:09 +0000 (09:58 +0200)]
ip6-nd: only respond to RS if sending RA is enabled
Even when periodic RAs are disabled VPP would respond to
router solicitations. Making it impossible to have an IPv6
enabled interface with hosts connected to it without VPP
acting as a default router.
This change drops RS messages if the radv_info->send_radv is
off.
Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I9a68f8e12c93c1c00125b54f8fd454f48fa22caa
Signed-off-by: Ole Troan <ot@cisco.com>
Florin Coras [Fri, 6 Aug 2021 19:54:20 +0000 (12:54 -0700)]
tls: avoid picotls buffer allocs on rx
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I6cf0c141ab4a4f5a46feb6119fa142148366f0a6
Florin Coras [Fri, 6 Aug 2021 20:07:34 +0000 (13:07 -0700)]
tls: avoid ptls ctx free on transport close
Type: fix
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I0537fa590b11abddf05550e42c7258549729f8a7
Benoît Ganne [Wed, 4 Aug 2021 16:48:41 +0000 (18:48 +0200)]
classify: fix parsing for l4 match
l4 match parsing should not try to consume the whole input, otherwise
it breaks cli such as:
'classify session ... match l4 dst_port 22 action set-ip4-fib-id 2'
Type: fix
Change-Id: I81a1b5779811f7df8286a371f85fafe09c947b87
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Benoît Ganne [Thu, 5 Aug 2021 13:06:36 +0000 (15:06 +0200)]
ip: fix ip punt redirect cli
- restore fib paths support for ip4
- initialize payload_proto to the relevant default protocol so that
'via <dev>' paths are supported
- fix 'rx all'
- fix temp path vector mem leak
Type: fix
Change-Id: I564d88dc4dce86884ff6791af69974e6d70ff7ca
Signed-off-by: Benoît Ganne <bganne@cisco.com>
Filip Varga [Mon, 26 Jul 2021 10:48:26 +0000 (12:48 +0200)]
nat: nat44-ed disable protection for api/cli
Return unsupported error if user calls one
of the configuration functions that can
run only after nat44-ed plugin is
enabled via appropriate api/cli
call.
Type: fix
Change-Id: I0d4ab0684ba5ae23fc2ecc668554a34537c2904a
Signed-off-by: Filip Varga <fivarga@cisco.com>
Mohsin Kazmi [Tue, 3 Aug 2021 17:56:05 +0000 (17:56 +0000)]
vppinfra: fix the array mask function
Type: fix
Fixes:
0ec7dad7a00852663eb88554561347987f87bb53
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Change-Id: I7fab80b3c7e86ac712a34c24ea3e526b0b5bb7ad
Artem Glazychev [Thu, 29 Jul 2021 07:54:59 +0000 (14:54 +0700)]
memif: fix offset
signs were changed here when calculating the offset:
d78ba5aa01ff1415bff0b06069ce21e0a78df89c
Type: fix
Signed-off-by: Artem Glazychev <artem.glazychev@xored.com>
Change-Id: I62b7a409caaf478e40efbdd6000922dcc7e92860
Aloys Augustin [Mon, 2 Aug 2021 15:42:23 +0000 (17:42 +0200)]
quic: do not update crypto keys from workers
The vnet_crypto_key_add should only be called from the main thread.
This patch works around this limitation by allocating one key per worker
and updating it on the fly everytime we need to do a crypto operation.
This solution is far from ideal, but quicly has a strong assumption that
it can use a key immediately after determining it, so making the key
creation asynchronous is not a possibility.
Signed-off-by: Aloys Augustin <aloaugus@cisco.com>
Change-Id: I19fc5814195156003c36a73bb616738ba9d828f7
Type: fix
Florin Coras [Sat, 31 Jul 2021 22:56:45 +0000 (15:56 -0700)]
tls: picotls handle accept failures
Should also fix coverity warning.
Type: fix
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I068b837377b329a22ace5b2235c6dd9f067ead77
liuyacan [Mon, 2 Aug 2021 12:15:05 +0000 (20:15 +0800)]
vcl: fix sendto for dgrams
We need to set rmt address before sending connect, otherwise VPP
would connect to 0.0.0.0:0 and return invalid remote ip.
Type: fix
Signed-off-by: liuyacan <liuyacan@corp.netease.com>
Change-Id: I85ae6931c2ba9f2f77c9ab19a2f801f50745449c
liuyacan [Mon, 2 Aug 2021 02:01:39 +0000 (10:01 +0800)]
vcl: fix sleep time in ldp_pselect()
Type: fix
Signed-off-by: liuyacan <liuyacan@corp.netease.com>
Change-Id: Ic9c5b23be4bde88880972be35525f12fa2c6dc10
Sivaprasad Tummala [Sat, 31 Jul 2021 16:08:19 +0000 (21:38 +0530)]
vcl: fix ldp for __recv_chk socket calls
add ldp support for handling __recv_chk socket calls.
Type: fix
Signed-off-by: Sivaprasad Tummala <Sivaprasad.Tummala@intel.com>
Change-Id: I33221c465ac607bc665fcba500dd399a56b32df6
Florin Coras [Thu, 29 Jul 2021 16:06:00 +0000 (09:06 -0700)]
tls: picotls rx fixes and improvements
Type: fix
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I9ea41b8b271e9123e676acdc581ef429072fe843
Florin Coras [Wed, 28 Jul 2021 05:48:05 +0000 (22:48 -0700)]
vcl: move vls pool lock to process local state
We only support one vls worker per process and therefore should not
share lock between processes.
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I57bb536cf3bf04e8de031b07cb885f80b4fa03c9
Florin Coras [Tue, 27 Jul 2021 01:19:25 +0000 (18:19 -0700)]
vcl: vls cleanup and more docs
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: If32dd21842b99e176db1d4eb9f6c6a51fbff1bfe
Filip Tehlar [Fri, 23 Jul 2021 18:24:19 +0000 (18:24 +0000)]
ip: add api test file
Type: improvement
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
Change-Id: I49c4183a443b7b39924328900e6a6ac2e09be426
Klement Sekera [Tue, 27 Jul 2021 11:33:51 +0000 (13:33 +0200)]
nat: fix ICMP checksum validation
Handle case where extra data is present in buffer which is not part of
IP/ICMP headers.
Type: fix
Fixes:
05b5a5b3b4b04823776feed6403b5a99b2e06d76
Change-Id: Icfef811470056d38c60fc45cc302139ed7594385
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Zachary Leaf [Tue, 27 Jul 2021 10:18:47 +0000 (05:18 -0500)]
ipsec: move startup config to common file
The ipsec startup.conf config currently exists in ipsec_tun.c. This is
because currently the only ipsec{...} options are tunnel related.
This patch moves the ipsec config to a common file (ipsec.c) for future
extensibility/addition of non-tunnel related config options.
Type: refactor
Signed-off-by: Zachary Leaf <zachary.leaf@arm.com>
Change-Id: I1569dd7948334fd2cc28523ccc6791a22dea8d32
Stanislav Zaikin [Thu, 15 Jul 2021 14:27:29 +0000 (16:27 +0200)]
gre: set proper fib index for unnumbered interfaces, unset fib index before forwarding gre payload
This commit introduces 2 fixes:
1) After GRE decapsulation sw_if_index[VLIB_TX] is set as fib index of GRE tunnel.
But since GRE tunnel can work on v4 endpoints and have v6 payload, we need to reset it.
In case we get IPv6 packet inside IPv4 GRE tunnel (or vice-versa) fib index can be (and usually is) invalid.
2) Check that ip-table and ip6-table are the same when setting interface as an unnumbered one.
Also, fix for the pipe test include setting the right unnumbered interface for the pipes
Type: fix
Signed-off-by: Stanislav Zaikin <zstaseg@gmail.com>
Change-Id: Id13d239cfdd21e0db6b1c9725f01c40d4af4d800
Fan Zhang [Tue, 27 Jul 2021 15:49:55 +0000 (16:49 +0100)]
dpdk: fix cryptodev raw data path dequeue
This patch fixes the dpdk cryptodev raw data path dequeue problem.
The fix involves DPDK QAT PMD changes and is to be upstreamed
as a patch. The patch is also sent to DPDK mailing list.
Type: fix
Signed-off-by: Fan Zhang <roy.fan.zhang@intel.com>
Change-Id: I1a9253c8a7fbc2aa43f19f90da45e64e2840356a
Damjan Marion [Wed, 14 Jul 2021 16:18:08 +0000 (18:18 +0200)]
vppinfra: introduce CLIB_CACHE_PREFETCH_BYTES
Type: improvement
Change-Id: Ic07010f11ef303f5213a33b0faf24aaedb62f110
Signed-off-by: Damjan Marion <damarion@cisco.com>
Dave Barach [Tue, 27 Jul 2021 13:27:07 +0000 (09:27 -0400)]
vlib: don't ASSERT(vm) in worker thread bootstrap
Otherwise, threads declared with .no_data_structure_clone=1 crash on
startup.
Type: fix
Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I5dcb25d1b61330fc9eee5427b815fcfcb9bf2153
Sivaprasad Tummala [Tue, 27 Jul 2021 12:08:00 +0000 (17:38 +0530)]
vcl: configure the cert-key pair from app
add the cert/key pair as selected by app.
Type: fix
Signed-off-by: Sivaprasad Tummala <Sivaprasad.Tummala@intel.com>
Change-Id: I3cef5bebadd8b192a65857d5f4aa6883c2a8d372
Nathan Skrzypczak [Tue, 27 Jul 2021 17:51:27 +0000 (19:51 +0200)]
vppinfra: fix sock init netns
Type: fix
Change-Id: I0ce8183ded601bdab031c9689ca361414fed165f
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
Florin Coras [Thu, 22 Jul 2021 21:03:11 +0000 (14:03 -0700)]
udp: add option to disable icmp unreachables
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I90c2a191ab34a2a7df3fb0a951e5fc78f40ccfe2
liuyacan [Thu, 22 Jul 2021 07:52:01 +0000 (15:52 +0800)]
vcl: fix some risk after fork()
1.Not only the session in state VCL_STATE_LISTEN_NO_MQ
has no queue. Session in CLOSED also didn't.
2.Refresh vls->wrk_index in child process, or this value will
become invalid if parent exit.
3.Set vlsh->vls_wrk_index once vls_worker_alloc() is called, then
vls_get_worker_index() can be simplified.
Type: fix
Signed-off-by: liuyacan <liuyacan@corp.netease.com>
Change-Id: If4f5e134915eafd74ce38f585d65ce8836b2e553
liuyacan [Sat, 24 Jul 2021 14:48:36 +0000 (22:48 +0800)]
vcl: fix shutdown deadlock issue
Type: fix
Signed-off-by: liuyacan <liuyacan@corp.netease.com>
Change-Id: I4974815ecb0e3bff01af983f086ca15d77fd6fb4
liuyacan [Sat, 24 Jul 2021 06:30:51 +0000 (14:30 +0800)]
session: avoid vpp deadlock due to app crash
In high traffic scenarios, if app crashed or hang on somewhere, app_mq
will quickly accumulate to full, after which vpp worker will try 100
times before giving up allocating slot for every msg. This will cause
vpp main thread barrier sync to fail.
Type: fix
Signed-off-by: liuyacan <liuyacan@corp.netease.com>
Change-Id: I2b2bf2b272c5b3ca7e4a56af179af12bbcde149d
Florin Coras [Fri, 23 Jul 2021 15:39:26 +0000 (08:39 -0700)]
session vcl: support abstract sockets for app ns
App namespaces can now be associated to a linux ip netns, e.g.:
app ns add id <ns_id> secret <n> sw_if_index <n> netns <netns>
If session layer's app sock api is enabled, this triggers the creation
of an abstract listening socket in the netns that has been configured.
For the example above that would be @vpp/session/<ns_id>.
Consequently, vcl, or other apps attaching to vpp, can connect to said
abstract socket from an ip netns without the need to share unix domain
socket files. In particular, for vcl it's enough to set app-socket-api
to @vpp/session/<ns_id> in the conf file.
Type: feature
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I26fdc626a760a3f423c5b8be4251623f6e9cd73a
Florin Coras [Thu, 22 Jul 2021 01:17:20 +0000 (18:17 -0700)]
session vcl: explit mq indices in ctrl messages
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I8e80252b85dda9a8f5699109264dc1b913581442
Nathan Skrzypczak [Mon, 19 Jul 2021 16:21:43 +0000 (18:21 +0200)]
vppinfra: add abstract socket & netns fns
* Add clib_socket_init support for abstract sockets
if name starts with an '@'
* Add clib_socket_init_netns to open socket in netns
* Add clib_netns_open
Type: feature
Change-Id: I89637ad657c702ec38ddecb5c03a1673d0dfb104
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
Filip Varga [Wed, 26 May 2021 16:45:59 +0000 (18:45 +0200)]
nat: nat44-ed configuration refactor & cleanup
Refactoring static mapping configuration
functions based on feature type.
Type: refactor
Signed-off-by: Filip Varga <fivarga@cisco.com>
Change-Id: I007d9b0e9717ced613fbcef2b11b6853f479be1e
Ole Troan [Tue, 18 May 2021 09:52:47 +0000 (11:52 +0200)]
api: enable trace / replay flag on messages
For an unknown reason the trace/replay flags where missed
when moving API message registration code from manually
cut and pasted to aut-generated.
Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: Ib7625a57d3a263aac154682007459648953b1803
Neale Ranns [Wed, 21 Jul 2021 13:29:58 +0000 (13:29 +0000)]
interface: Byte swap the duplex value in interface details
Type: fix
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I6d9473a7b5ab0fbd460e80df36368dd43c5e4fee
Florin Coras [Wed, 21 Jul 2021 02:08:12 +0000 (19:08 -0700)]
session: fix unlisten rpc barrier release
Type: fix
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I9301fbbcd611033b4b6ad5313edbc66840f5bb3a
Florin Coras [Wed, 21 Jul 2021 04:12:23 +0000 (21:12 -0700)]
hsa: separate ctrl and test session accept vcl server
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Id6bcf6511c904c8625c0845cd9758539f35e6b50
Florin Coras [Mon, 19 Jul 2021 22:23:51 +0000 (15:23 -0700)]
session: option to use memfd segs for builtin apps
Type: improvement
Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Iecb171c9451c0fa9a7c6ae4b3e9ab7774a4fe585
Klement Sekera [Mon, 28 Jun 2021 11:40:40 +0000 (13:40 +0200)]
nat: harden ICMP handling
Verify that headers are not truncated and that checksums are valid.
Correct checksum computation in translation code.
Type: fix
Change-Id: I6acfcec4661411f83c86b15aafac90cd4538c0b5
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Damjan Marion [Fri, 16 Jul 2021 11:44:33 +0000 (13:44 +0200)]
vppinfra: remove pool_foreach_old, pool_foreach_index_old, clib_bitmap_foreach_old
Type: refactor
Change-Id: Ifacdd001bdeb5d609d495406f53546090b86476d
Signed-off-by: Damjan Marion <damarion@cisco.com>
Damjan Marion [Fri, 16 Jul 2021 10:44:22 +0000 (12:44 +0200)]
build: fix formatting of CMake config output
Type: make
Change-Id: I6e40817609d022cb70887f70aa3608dc759fcd76
Signed-off-by: Damjan Marion <damarion@cisco.com>
Mohsin Kazmi [Thu, 17 Jun 2021 12:33:03 +0000 (14:33 +0200)]
vlib: add tunnel offload flags for vlib_buffer_t
Type: improvement
Change-Id: Iaad50b2044702c46eff287708dfcb24e61022104
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Mohsin Kazmi [Thu, 17 Jun 2021 15:48:22 +0000 (17:48 +0200)]
dpdk: improve tx offload formatting
Type: improvement
Change-Id: I06eaf39b1e441045c3402cbf40339054ad26ade9
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Damjan Marion [Wed, 27 Jan 2021 20:17:48 +0000 (21:17 +0100)]
snort: snort3 plugin and DAQ
Zero copy interface which exposes VPP buffers to snort instance(s).
Includes VPP DAQ which is compiled only if libdaq 3 API headers are
available.
Type: feature
Change-Id: I96611b43f94fbae091e7391589e0454ae66de88b
Signed-off-by: Damjan Marion <damarion@cisco.com>
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
Mohsin Kazmi [Thu, 15 Jul 2021 10:34:36 +0000 (10:34 +0000)]
vppinfra: add array mask func
Type: feature
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Change-Id: I6869221917f30f7e59709e20571b4615bc68dc8c
Mohsin Kazmi [Tue, 6 Apr 2021 17:24:00 +0000 (19:24 +0200)]
ip6-nd: refactor neighbour advertisement code
Type: refactor
Refactor neighbour advertisement code into inline function
to be used solely in feature nodes.
Change-Id: I1e84c54f9807b4e3d90c37526c78a7afcb0ba087
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Robert Shearman [Tue, 6 Jul 2021 09:34:52 +0000 (10:34 +0100)]
dpdk: enable RX interrupts for the virtio driver
Type: improvement
Request use of RX interrupts for virtio if the system will support it,
which is done by applying the same check as in the virtio driver,
namely whether multiple interrupts are supported. This allows the use
of RX adaptive/interrupt mode instead of just polling, which is useful
in virtualised environments where functionality may be more important
than performance and so using polling mode is wasteful.
Signed-off-by: Robert Shearman <robertshearman@gmail.com>
Change-Id: I29527b6f04b0b1d0c9f9424751b2bd252ed10505
Steven Luong [Thu, 15 Jul 2021 15:57:02 +0000 (08:57 -0700)]
ip-neighbor: GARP sent to bogus ip address
The function ip4_neighbor_advertise may be called with NULL addr. In
that case, it looks up addr from fib by calling fib_sas4_get which
returns true or false to indicate whether there is an ip address
associated with the interface or not. But the caller to fib_sas4_get
does not check the return code and blindly assumes there is always an
ip address associated with the interface. As a result, it ends up
sending GARP to the bogus ip address if there is no ip address
associated with the interface.
Type: fix
Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I7aa0270766c3943ed8ca8f8a092cae34567fd30e
Mohsin Kazmi [Thu, 15 Jul 2021 14:20:57 +0000 (14:20 +0000)]
vppinfra: fix the vector funcs test for march variants
Type: fix
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Change-Id: I4208c2622817eb51a4b192cf420f9f1b5f193eef
Neale Ranns [Thu, 15 Jul 2021 08:11:38 +0000 (08:11 +0000)]
acl: Fix the CLI to accept IPv6 prefixes
Type: fix
DBGvpp# set acl-plugin acl src 1::1/128 dst 2::/64
DBGvpp# sh acl-plugin acl
acl-index 0 count 1 tag {cli}
0: ipv4 permit src 1.1.1.1/32 dst 1.1.1.2/32 proto 0 sport 0-65535 dport 0-65535
acl-index 1 count 1 tag {cli}
0: ipv6 permit src 1::1/128 dst 2::/64 proto 0 sport 0-65535 dport 0-65535
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: Ibb8e20dd4ec2792f423a61eefe7398175e45a577