tls: enforce certificate verification
[vpp.git] / src / vnet / session / session.c
index dcd141f..d4220d4 100644 (file)
 #include <vlibmemory/api.h>
 #include <vnet/dpo/load_balance.h>
 #include <vnet/fib/ip4_fib.h>
-#include <vnet/tcp/tcp.h>
 
 session_manager_main_t session_manager_main;
 extern transport_proto_vft_t *tp_vfts;
 
-int
-stream_session_create_i (segment_manager_t * sm, transport_connection_t * tc,
-                        u8 alloc_fifos, stream_session_t ** ret_s)
+static void
+session_send_evt_to_thread (u64 session_handle, fifo_event_type_t evt_type,
+                           u32 thread_index, void *fp, void *rpc_args)
+{
+  u32 tries = 0;
+  session_fifo_event_t evt = { {0}, };
+  svm_queue_t *q;
+
+  evt.event_type = evt_type;
+  if (evt_type == FIFO_EVENT_RPC)
+    {
+      evt.rpc_args.fp = fp;
+      evt.rpc_args.arg = rpc_args;
+    }
+  else
+    evt.session_handle = session_handle;
+
+  q = session_manager_get_vpp_event_queue (thread_index);
+  while (svm_queue_add (q, (u8 *) & evt, 1))
+    {
+      if (tries++ == 3)
+       {
+         SESSION_DBG ("failed to enqueue evt");
+         break;
+       }
+    }
+}
+
+void
+session_send_session_evt_to_thread (u64 session_handle,
+                                   fifo_event_type_t evt_type,
+                                   u32 thread_index)
+{
+  session_send_evt_to_thread (session_handle, evt_type, thread_index, 0, 0);
+}
+
+void
+session_send_rpc_evt_to_thread (u32 thread_index, void *fp, void *rpc_args)
+{
+  if (thread_index != vlib_get_thread_index ())
+    session_send_evt_to_thread (0, FIFO_EVENT_RPC, thread_index, fp,
+                               rpc_args);
+  else
+    {
+      void (*fnp) (void *) = fp;
+      fnp (rpc_args);
+    }
+}
+
+stream_session_t *
+session_alloc (u32 thread_index)
 {
   session_manager_main_t *smm = &session_manager_main;
+  stream_session_t *s;
+  u8 will_expand = 0;
+  pool_get_aligned_will_expand (smm->sessions[thread_index], will_expand,
+                               CLIB_CACHE_LINE_BYTES);
+  /* If we have peekers, let them finish */
+  if (PREDICT_FALSE (will_expand && vlib_num_workers ()))
+    {
+      clib_rwlock_writer_lock (&smm->peekers_rw_locks[thread_index]);
+      pool_get_aligned (session_manager_main.sessions[thread_index], s,
+                       CLIB_CACHE_LINE_BYTES);
+      clib_rwlock_writer_unlock (&smm->peekers_rw_locks[thread_index]);
+    }
+  else
+    {
+      pool_get_aligned (session_manager_main.sessions[thread_index], s,
+                       CLIB_CACHE_LINE_BYTES);
+    }
+  memset (s, 0, sizeof (*s));
+  s->session_index = s - session_manager_main.sessions[thread_index];
+  s->thread_index = thread_index;
+  return s;
+}
+
+void
+session_free (stream_session_t * s)
+{
+  pool_put (session_manager_main.sessions[s->thread_index], s);
+  if (CLIB_DEBUG)
+    memset (s, 0xFA, sizeof (*s));
+}
+
+int
+session_alloc_fifos (segment_manager_t * sm, stream_session_t * s)
+{
   svm_fifo_t *server_rx_fifo = 0, *server_tx_fifo = 0;
   u32 fifo_segment_index;
-  u32 pool_index;
-  stream_session_t *s;
-  u64 value;
-  u32 thread_index = tc->thread_index;
   int rv;
 
-  ASSERT (thread_index == vlib_get_thread_index ());
+  if ((rv = segment_manager_alloc_session_fifos (sm, &server_rx_fifo,
+                                                &server_tx_fifo,
+                                                &fifo_segment_index)))
+    return rv;
+  /* Initialize backpointers */
+  server_rx_fifo->master_session_index = s->session_index;
+  server_rx_fifo->master_thread_index = s->thread_index;
 
-  /* Create the session */
-  pool_get_aligned (smm->sessions[thread_index], s, CLIB_CACHE_LINE_BYTES);
-  memset (s, 0, sizeof (*s));
-  pool_index = s - smm->sessions[thread_index];
+  server_tx_fifo->master_session_index = s->session_index;
+  server_tx_fifo->master_thread_index = s->thread_index;
 
-  /* Allocate fifos */
-  if (alloc_fifos)
-    {
-      if ((rv = segment_manager_alloc_session_fifos (sm, &server_rx_fifo,
-                                                    &server_tx_fifo,
-                                                    &fifo_segment_index)))
-       {
-         pool_put (smm->sessions[thread_index], s);
-         return rv;
-       }
-      /* Initialize backpointers */
-      server_rx_fifo->master_session_index = pool_index;
-      server_rx_fifo->master_thread_index = thread_index;
+  s->server_rx_fifo = server_rx_fifo;
+  s->server_tx_fifo = server_tx_fifo;
+  s->svm_segment_index = fifo_segment_index;
+  return 0;
+}
 
-      server_tx_fifo->master_session_index = pool_index;
-      server_tx_fifo->master_thread_index = thread_index;
+static stream_session_t *
+session_alloc_for_connection (transport_connection_t * tc)
+{
+  stream_session_t *s;
+  u32 thread_index = tc->thread_index;
 
-      s->server_rx_fifo = server_rx_fifo;
-      s->server_tx_fifo = server_tx_fifo;
-      s->svm_segment_index = fifo_segment_index;
-    }
+  ASSERT (thread_index == vlib_get_thread_index ());
 
-  /* Initialize state machine, such as it is... */
-  s->session_type = session_type_from_proto_and_ip (tc->transport_proto,
-                                                   tc->is_ip4);
+  s = session_alloc (thread_index);
+  s->session_type = session_type_from_proto_and_ip (tc->proto, tc->is_ip4);
   s->session_state = SESSION_STATE_CONNECTING;
-  s->thread_index = thread_index;
-  s->session_index = pool_index;
+  s->enqueue_epoch = ~0;
 
-  /* Attach transport to session */
+  /* Attach transport to session and vice versa */
   s->connection_index = tc->c_index;
-
-  /* Attach session to transport */
   tc->s_index = s->session_index;
+  return s;
+}
+
+static int
+session_alloc_and_init (segment_manager_t * sm, transport_connection_t * tc,
+                       u8 alloc_fifos, stream_session_t ** ret_s)
+{
+  stream_session_t *s;
+  int rv;
+
+  s = session_alloc_for_connection (tc);
+  if (alloc_fifos && (rv = session_alloc_fifos (sm, s)))
+    {
+      session_free (s);
+      *ret_s = 0;
+      return rv;
+    }
 
   /* Add to the main lookup table */
-  value = stream_session_handle (s);
-  stream_session_table_add_for_tc (tc, value);
+  session_lookup_add_connection (tc, session_handle (s));
 
   *ret_s = s;
-
   return 0;
 }
 
@@ -217,13 +301,14 @@ session_enqueue_chain_tail (stream_session_t * s, vlib_buffer_t * b,
  * @return Number of bytes enqueued or a negative value if enqueueing failed.
  */
 int
-stream_session_enqueue_data (transport_connection_t * tc, vlib_buffer_t * b,
-                            u32 offset, u8 queue_event, u8 is_in_order)
+session_enqueue_stream_connection (transport_connection_t * tc,
+                                  vlib_buffer_t * b, u32 offset,
+                                  u8 queue_event, u8 is_in_order)
 {
   stream_session_t *s;
   int enqueued = 0, rv, in_order_off;
 
-  s = stream_session_get (tc->s_index, tc->thread_index);
+  s = session_get (tc->s_index, tc->thread_index);
 
   if (is_in_order)
     {
@@ -257,20 +342,52 @@ stream_session_enqueue_data (transport_connection_t * tc, vlib_buffer_t * b,
        * by calling stream_server_flush_enqueue_events () */
       session_manager_main_t *smm = vnet_get_session_manager_main ();
       u32 thread_index = s->thread_index;
-      u32 my_enqueue_epoch = smm->current_enqueue_epoch[thread_index];
+      u32 enqueue_epoch = smm->current_enqueue_epoch[tc->proto][thread_index];
 
-      if (s->enqueue_epoch != my_enqueue_epoch)
+      if (s->enqueue_epoch != enqueue_epoch)
        {
-         s->enqueue_epoch = my_enqueue_epoch;
-         vec_add1 (smm->session_indices_to_enqueue_by_thread[thread_index],
+         s->enqueue_epoch = enqueue_epoch;
+         vec_add1 (smm->session_to_enqueue[tc->proto][thread_index],
                    s - smm->sessions[thread_index]);
        }
     }
 
-  if (is_in_order)
-    return enqueued;
+  return enqueued;
+}
 
-  return 0;
+int
+session_enqueue_dgram_connection (stream_session_t * s, vlib_buffer_t * b,
+                                 u8 proto, u8 queue_event)
+{
+  int enqueued = 0, rv, in_order_off;
+
+  if (svm_fifo_max_enqueue (s->server_rx_fifo) < b->current_length)
+    return -1;
+  enqueued = svm_fifo_enqueue_nowait (s->server_rx_fifo, b->current_length,
+                                     vlib_buffer_get_current (b));
+  if (PREDICT_FALSE ((b->flags & VLIB_BUFFER_NEXT_PRESENT) && enqueued >= 0))
+    {
+      in_order_off = enqueued > b->current_length ? enqueued : 0;
+      rv = session_enqueue_chain_tail (s, b, in_order_off, 1);
+      if (rv > 0)
+       enqueued += rv;
+    }
+  if (queue_event)
+    {
+      /* Queue RX event on this fifo. Eventually these will need to be flushed
+       * by calling stream_server_flush_enqueue_events () */
+      session_manager_main_t *smm = vnet_get_session_manager_main ();
+      u32 thread_index = s->thread_index;
+      u32 enqueue_epoch = smm->current_enqueue_epoch[proto][thread_index];
+
+      if (s->enqueue_epoch != enqueue_epoch)
+       {
+         s->enqueue_epoch = enqueue_epoch;
+         vec_add1 (smm->session_to_enqueue[proto][thread_index],
+                   s - smm->sessions[thread_index]);
+       }
+    }
+  return enqueued;
 }
 
 /** Check if we have space in rx fifo to push more bytes */
@@ -278,7 +395,7 @@ u8
 stream_session_no_space (transport_connection_t * tc, u32 thread_index,
                         u16 data_len)
 {
-  stream_session_t *s = stream_session_get (tc->s_index, thread_index);
+  stream_session_t *s = session_get (tc->s_index, thread_index);
 
   if (PREDICT_FALSE (s->session_state != SESSION_STATE_READY))
     return 1;
@@ -292,7 +409,7 @@ stream_session_no_space (transport_connection_t * tc, u32 thread_index,
 u32
 stream_session_tx_fifo_max_dequeue (transport_connection_t * tc)
 {
-  stream_session_t *s = stream_session_get (tc->s_index, tc->thread_index);
+  stream_session_t *s = session_get (tc->s_index, tc->thread_index);
   if (!s->server_tx_fifo)
     return 0;
   return svm_fifo_max_dequeue (s->server_tx_fifo);
@@ -302,14 +419,14 @@ int
 stream_session_peek_bytes (transport_connection_t * tc, u8 * buffer,
                           u32 offset, u32 max_bytes)
 {
-  stream_session_t *s = stream_session_get (tc->s_index, tc->thread_index);
+  stream_session_t *s = session_get (tc->s_index, tc->thread_index);
   return svm_fifo_peek (s->server_tx_fifo, offset, max_bytes, buffer);
 }
 
 u32
 stream_session_dequeue_drop (transport_connection_t * tc, u32 max_bytes)
 {
-  stream_session_t *s = stream_session_get (tc->s_index, tc->thread_index);
+  stream_session_t *s = session_get (tc->s_index, tc->thread_index);
   return svm_fifo_dequeue_drop (s->server_tx_fifo, max_bytes);
 }
 
@@ -322,12 +439,11 @@ stream_session_dequeue_drop (transport_connection_t * tc, u32 max_bytes)
  * @return 0 on succes or negative number if failed to send notification.
  */
 static int
-stream_session_enqueue_notify (stream_session_t * s, u8 block)
+session_enqueue_notify (stream_session_t * s, u8 block)
 {
   application_t *app;
   session_fifo_event_t evt;
-  unix_shared_memory_queue_t *q;
-  static u32 serial_number;
+  svm_queue_t *q;
 
   if (PREDICT_FALSE (s->session_state == SESSION_STATE_CLOSED))
     {
@@ -347,9 +463,9 @@ stream_session_enqueue_notify (stream_session_t * s, u8 block)
       return 0;
     }
 
-  /* Built-in server? Hand event to the callback... */
-  if (app->cb_fns.builtin_server_rx_callback)
-    return app->cb_fns.builtin_server_rx_callback (s);
+  /* Built-in app? Hand event to the callback... */
+  if (app->cb_fns.builtin_app_rx_callback)
+    return app->cb_fns.builtin_app_rx_callback (s);
 
   /* If no event, send one */
   if (svm_fifo_set_event (s->server_rx_fifo))
@@ -357,15 +473,14 @@ stream_session_enqueue_notify (stream_session_t * s, u8 block)
       /* Fabricate event */
       evt.fifo = s->server_rx_fifo;
       evt.event_type = FIFO_EVENT_APP_RX;
-      evt.event_id = serial_number++;
 
       /* Add event to server's event queue */
       q = app->event_queue;
 
       /* Based on request block (or not) for lack of space */
       if (block || PREDICT_TRUE (q->cursize < q->maxsize))
-       unix_shared_memory_queue_add (app->event_queue, (u8 *) & evt,
-                                     0 /* do wait for mutex */ );
+       svm_queue_add (app->event_queue, (u8 *) & evt,
+                      0 /* do wait for mutex */ );
       else
        {
          clib_warning ("fifo full");
@@ -375,7 +490,7 @@ stream_session_enqueue_notify (stream_session_t * s, u8 block)
 
   /* *INDENT-OFF* */
   SESSION_EVT_DBG(SESSION_EVT_ENQ, s, ({
-      ed->data[0] = evt.event_id;
+      ed->data[0] = evt.event_type;
       ed->data[1] = svm_fifo_max_dequeue (s->server_rx_fifo);
   }));
   /* *INDENT-ON* */
@@ -392,35 +507,25 @@ stream_session_enqueue_notify (stream_session_t * s, u8 block)
  *         failures due to API queue being full.
  */
 int
-session_manager_flush_enqueue_events (u32 thread_index)
+session_manager_flush_enqueue_events (u8 transport_proto, u32 thread_index)
 {
   session_manager_main_t *smm = &session_manager_main;
-  u32 *session_indices_to_enqueue;
+  u32 *indices;
+  stream_session_t *s;
   int i, errors = 0;
 
-  session_indices_to_enqueue =
-    smm->session_indices_to_enqueue_by_thread[thread_index];
+  indices = smm->session_to_enqueue[transport_proto][thread_index];
 
-  for (i = 0; i < vec_len (session_indices_to_enqueue); i++)
+  for (i = 0; i < vec_len (indices); i++)
     {
-      stream_session_t *s0;
-
-      /* Get session */
-      s0 = stream_session_get_if_valid (session_indices_to_enqueue[i],
-                                       thread_index);
-      if (s0 == 0 || stream_session_enqueue_notify (s0, 0 /* don't block */ ))
-       {
-         errors++;
-       }
+      s = session_get_if_valid (indices[i], thread_index);
+      if (s == 0 || session_enqueue_notify (s, 0 /* don't block */ ))
+       errors++;
     }
 
-  vec_reset_length (session_indices_to_enqueue);
-
-  smm->session_indices_to_enqueue_by_thread[thread_index] =
-    session_indices_to_enqueue;
-
-  /* Increment enqueue epoch for next round */
-  smm->current_enqueue_epoch[thread_index]++;
+  vec_reset_length (indices);
+  smm->session_to_enqueue[transport_proto][thread_index] = indices;
+  smm->current_enqueue_epoch[transport_proto][thread_index]++;
 
   return errors;
 }
@@ -435,83 +540,156 @@ stream_session_init_fifos_pointers (transport_connection_t * tc,
                                    u32 rx_pointer, u32 tx_pointer)
 {
   stream_session_t *s;
-  s = stream_session_get (tc->s_index, tc->thread_index);
+  s = session_get (tc->s_index, tc->thread_index);
   svm_fifo_init_pointers (s->server_rx_fifo, rx_pointer);
   svm_fifo_init_pointers (s->server_tx_fifo, tx_pointer);
 }
 
 int
-stream_session_connect_notify (transport_connection_t * tc, u8 is_fail)
+session_stream_connect_notify (transport_connection_t * tc, u8 is_fail)
 {
-  application_t *app;
+  u32 opaque = 0, new_ti, new_si;
   stream_session_t *new_s = 0;
-  u64 handle;
-  u32 opaque = 0;
+  segment_manager_t *sm;
+  application_t *app;
+  u8 alloc_fifos;
   int error = 0;
-  u8 st;
+  u64 handle;
 
-  st = session_type_from_proto_and_ip (tc->transport_proto, tc->is_ip4);
-  handle = stream_session_half_open_lookup_handle (&tc->lcl_ip, &tc->rmt_ip,
-                                                  tc->lcl_port, tc->rmt_port,
-                                                  st);
+  /*
+   * Find connection handle and cleanup half-open table
+   */
+  handle = session_lookup_half_open_handle (tc);
   if (handle == HALF_OPEN_LOOKUP_INVALID_VALUE)
     {
-      clib_warning ("This can't be good!");
+      SESSION_DBG ("half-open was removed!");
       return -1;
     }
+  session_lookup_del_half_open (tc);
 
   /* Get the app's index from the handle we stored when opening connection
    * and the opaque (api_context for external apps) from transport session
-   * index*/
+   * index */
   app = application_get_if_valid (handle >> 32);
   if (!app)
     return -1;
-
   opaque = tc->s_index;
 
+  /*
+   * Allocate new session with fifos (svm segments are allocated if needed)
+   */
   if (!is_fail)
     {
-      segment_manager_t *sm;
-      u8 alloc_fifos;
       sm = application_get_connect_segment_manager (app);
-      alloc_fifos = application_is_proxy (app);
-      /* Create new session (svm segments are allocated if needed) */
-      if (stream_session_create_i (sm, tc, alloc_fifos, &new_s))
+      alloc_fifos = !application_is_builtin_proxy (app);
+      if (session_alloc_and_init (sm, tc, alloc_fifos, &new_s))
        {
          is_fail = 1;
          error = -1;
        }
       else
-       new_s->app_index = app->index;
+       {
+         new_s->app_index = app->index;
+         new_si = new_s->session_index;
+         new_ti = new_s->thread_index;
+       }
     }
 
-  /* Notify client application */
+  /*
+   * Notify client application
+   */
   if (app->cb_fns.session_connected_callback (app->index, opaque, new_s,
                                              is_fail))
     {
-      clib_warning ("failed to notify app");
+      SESSION_DBG ("failed to notify app");
       if (!is_fail)
-       stream_session_disconnect (new_s);
+       {
+         new_s = session_get (new_si, new_ti);
+         stream_session_disconnect_transport (new_s);
+       }
     }
   else
     {
       if (!is_fail)
-       new_s->session_state = SESSION_STATE_READY;
+       {
+         new_s = session_get (new_si, new_ti);
+         new_s->session_state = SESSION_STATE_READY;
+       }
     }
 
-  /* Cleanup session lookup */
-  stream_session_half_open_table_del (tc);
-
   return error;
 }
 
+typedef struct _session_switch_pool_args
+{
+  u32 session_index;
+  u32 thread_index;
+  u32 new_thread_index;
+  u32 new_session_index;
+} session_switch_pool_args_t;
+
+static void
+session_switch_pool (void *cb_args)
+{
+  session_switch_pool_args_t *args = (session_switch_pool_args_t *) cb_args;
+  transport_proto_t tp;
+  stream_session_t *s;
+  ASSERT (args->thread_index == vlib_get_thread_index ());
+  s = session_get (args->session_index, args->thread_index);
+  s->server_tx_fifo->master_session_index = args->new_session_index;
+  s->server_tx_fifo->master_thread_index = args->new_thread_index;
+  tp = session_get_transport_proto (s);
+  tp_vfts[tp].cleanup (s->connection_index, s->thread_index);
+  session_free (s);
+  clib_mem_free (cb_args);
+}
+
+/**
+ * Move dgram session to the right thread
+ */
+int
+session_dgram_connect_notify (transport_connection_t * tc,
+                             u32 old_thread_index,
+                             stream_session_t ** new_session)
+{
+  stream_session_t *new_s;
+  session_switch_pool_args_t *rpc_args;
+
+  /*
+   * Clone half-open session to the right thread.
+   */
+  new_s = session_clone_safe (tc->s_index, old_thread_index);
+  new_s->connection_index = tc->c_index;
+  new_s->server_rx_fifo->master_session_index = new_s->session_index;
+  new_s->server_rx_fifo->master_thread_index = new_s->thread_index;
+  new_s->session_state = SESSION_STATE_READY;
+  session_lookup_add_connection (tc, session_handle (new_s));
+
+  /*
+   * Ask thread owning the old session to clean it up and make us the tx
+   * fifo owner
+   */
+  rpc_args = clib_mem_alloc (sizeof (*rpc_args));
+  rpc_args->new_session_index = new_s->session_index;
+  rpc_args->new_thread_index = new_s->thread_index;
+  rpc_args->session_index = tc->s_index;
+  rpc_args->thread_index = old_thread_index;
+  session_send_rpc_evt_to_thread (rpc_args->thread_index, session_switch_pool,
+                                 rpc_args);
+
+  tc->s_index = new_s->session_index;
+  new_s->connection_index = tc->c_index;
+  *new_session = new_s;
+  return 0;
+}
+
 void
 stream_session_accept_notify (transport_connection_t * tc)
 {
   application_t *server;
   stream_session_t *s;
 
-  s = stream_session_get (tc->s_index, tc->thread_index);
+  s = session_get (tc->s_index, tc->thread_index);
   server = application_get (s->app_index);
   server->cb_fns.session_accept_callback (s);
 }
@@ -529,39 +707,36 @@ stream_session_disconnect_notify (transport_connection_t * tc)
   application_t *server;
   stream_session_t *s;
 
-  s = stream_session_get (tc->s_index, tc->thread_index);
+  s = session_get (tc->s_index, tc->thread_index);
   server = application_get (s->app_index);
   server->cb_fns.session_disconnect_callback (s);
 }
 
 /**
- * Cleans up session and associated app if needed.
+ * Cleans up session and lookup table.
  */
 void
 stream_session_delete (stream_session_t * s)
 {
-  session_manager_main_t *smm = vnet_get_session_manager_main ();
   int rv;
 
   /* Delete from the main lookup table. */
-  if ((rv = stream_session_table_del (s)))
+  if ((rv = session_lookup_del_session (s)))
     clib_warning ("hash delete error, rv %d", rv);
 
   /* Cleanup fifo segments */
   segment_manager_dealloc_fifos (s->svm_segment_index, s->server_rx_fifo,
                                 s->server_tx_fifo);
-
-  pool_put (smm->sessions[s->thread_index], s);
-  if (CLIB_DEBUG)
-    memset (s, 0xFA, sizeof (*s));
+  session_free (s);
 }
 
 /**
  * Notification from transport that connection is being deleted
  *
- * This should be called only on previously fully established sessions. For
- * instance failed connects should call stream_session_connect_notify and
- * indicate that the connect has failed.
+ * This removes the session if it is still valid. It should be called only on
+ * previously fully established sessions. For instance failed connects should
+ * call stream_session_connect_notify and indicate that the connect has
+ * failed.
  */
 void
 stream_session_delete_notify (transport_connection_t * tc)
@@ -569,7 +744,7 @@ stream_session_delete_notify (transport_connection_t * tc)
   stream_session_t *s;
 
   /* App might've been removed already */
-  s = stream_session_get_if_valid (tc->s_index, tc->thread_index);
+  s = session_get_if_valid (tc->s_index, tc->thread_index);
   if (!s)
     return;
   stream_session_delete (s);
@@ -583,7 +758,7 @@ stream_session_reset_notify (transport_connection_t * tc)
 {
   stream_session_t *s;
   application_t *app;
-  s = stream_session_get (tc->s_index, tc->thread_index);
+  s = session_get (tc->s_index, tc->thread_index);
 
   app = application_get (s->app_index);
   app->cb_fns.session_reset_callback (s);
@@ -594,20 +769,22 @@ stream_session_reset_notify (transport_connection_t * tc)
  */
 int
 stream_session_accept (transport_connection_t * tc, u32 listener_index,
-                      u8 sst, u8 notify)
+                      u8 notify)
 {
   application_t *server;
   stream_session_t *s, *listener;
   segment_manager_t *sm;
-
+  session_type_t sst;
   int rv;
 
+  sst = session_type_from_proto_and_ip (tc->proto, tc->is_ip4);
+
   /* Find the server */
   listener = listen_session_get (sst, listener_index);
   server = application_get (listener->app_index);
 
   sm = application_get_listen_segment_manager (server, listener);
-  if ((rv = stream_session_create_i (sm, tc, 1, &s)))
+  if ((rv = session_alloc_and_init (sm, tc, 1, &s)))
     return rv;
 
   s->app_index = server->index;
@@ -623,47 +800,119 @@ stream_session_accept (transport_connection_t * tc, u32 listener_index,
   return 0;
 }
 
-/**
- * Ask transport to open connection to remote transport endpoint.
- *
- * Stores handle for matching request with reply since the call can be
- * asynchronous. For instance, for TCP the 3-way handshake must complete
- * before reply comes. Session is only created once connection is established.
- *
- * @param app_index Index of the application requesting the connect
- * @param st Session type requested.
- * @param tep Remote transport endpoint
- * @param res Resulting transport connection .
- */
 int
-stream_session_open (u32 app_index, session_type_t st,
-                    transport_endpoint_t * rmt,
-                    transport_connection_t ** res)
+session_open_cl (u32 app_index, session_endpoint_t * rmt, u32 opaque)
 {
   transport_connection_t *tc;
+  transport_endpoint_t *tep;
+  segment_manager_t *sm;
+  stream_session_t *s;
+  application_t *app;
   int rv;
+
+  tep = session_endpoint_to_transport (rmt);
+  rv = tp_vfts[rmt->transport_proto].open (tep);
+  if (rv < 0)
+    {
+      SESSION_DBG ("Transport failed to open connection.");
+      return VNET_API_ERROR_SESSION_CONNECT;
+    }
+
+  tc = tp_vfts[rmt->transport_proto].get_half_open ((u32) rv);
+
+  /* For dgram type of service, allocate session and fifos now.
+   */
+  app = application_get (app_index);
+  sm = application_get_connect_segment_manager (app);
+
+  if (session_alloc_and_init (sm, tc, 1, &s))
+    return -1;
+  s->app_index = app->index;
+  s->session_state = SESSION_STATE_CONNECTING_READY;
+
+  /* Tell the app about the new event fifo for this session */
+  app->cb_fns.session_connected_callback (app->index, opaque, s, 0);
+
+  return 0;
+}
+
+int
+session_open_vc (u32 app_index, session_endpoint_t * rmt, u32 opaque)
+{
+  transport_connection_t *tc;
+  transport_endpoint_t *tep;
   u64 handle;
+  int rv;
 
-  rv = tp_vfts[st].open (rmt);
+  /* TODO until udp is fixed */
+  if (rmt->transport_proto == TRANSPORT_PROTO_UDP)
+    return session_open_cl (app_index, rmt, opaque);
+
+  tep = session_endpoint_to_transport (rmt);
+  rv = tp_vfts[rmt->transport_proto].open (tep);
   if (rv < 0)
     {
-      clib_warning ("Transport failed to open connection.");
-      return VNET_API_ERROR_SESSION_CONNECT_FAIL;
+      SESSION_DBG ("Transport failed to open connection.");
+      return VNET_API_ERROR_SESSION_CONNECT;
     }
 
-  tc = tp_vfts[st].get_half_open ((u32) rv);
+  tc = tp_vfts[rmt->transport_proto].get_half_open ((u32) rv);
 
-  /* Save app and tc index. The latter is needed to help establish the
-   * connection while the former is needed when the connect notify comes
-   * and we have to notify the external app */
+  /* If transport offers a stream service, only allocate session once the
+   * connection has been established.
+   * Add connection to half-open table and save app and tc index. The
+   * latter is needed to help establish the connection while the former
+   * is needed when the connect notify comes and we have to notify the
+   * external app
+   */
   handle = (((u64) app_index) << 32) | (u64) tc->c_index;
+  session_lookup_add_half_open (tc, handle);
 
-  /* Add to the half-open lookup table */
-  stream_session_half_open_table_add (tc, handle);
+  /* Store api_context (opaque) for when the reply comes. Not the nicest
+   * thing but better than allocating a separate half-open pool.
+   */
+  tc->s_index = opaque;
+  return 0;
+}
 
-  *res = tc;
+int
+session_open_app (u32 app_index, session_endpoint_t * rmt, u32 opaque)
+{
+  session_endpoint_extended_t *sep = (session_endpoint_extended_t *) rmt;
+  sep->app_index = app_index;
+  sep->opaque = opaque;
 
-  return 0;
+  return tp_vfts[rmt->transport_proto].open ((transport_endpoint_t *) sep);
+}
+
+typedef int (*session_open_service_fn) (u32, session_endpoint_t *, u32);
+
+/* *INDENT-OFF* */
+static session_open_service_fn session_open_srv_fns[TRANSPORT_N_SERVICES] = {
+  session_open_vc,
+  session_open_cl,
+  session_open_app,
+};
+/* *INDENT-ON* */
+
+/**
+ * Ask transport to open connection to remote transport endpoint.
+ *
+ * Stores handle for matching request with reply since the call can be
+ * asynchronous. For instance, for TCP the 3-way handshake must complete
+ * before reply comes. Session is only created once connection is established.
+ *
+ * @param app_index Index of the application requesting the connect
+ * @param st Session type requested.
+ * @param tep Remote transport endpoint
+ * @param opaque Opaque data (typically, api_context) the application expects
+ *              on open completion.
+ */
+int
+session_open (u32 app_index, session_endpoint_t * rmt, u32 opaque)
+{
+  transport_service_type_t tst = tp_vfts[rmt->transport_proto].service_type;
+  return session_open_srv_fns[tst] (app_index, rmt, opaque);
 }
 
 /**
@@ -675,31 +924,62 @@ stream_session_open (u32 app_index, session_type_t st,
  * @param tep Local endpoint to be listened on.
  */
 int
-stream_session_listen (stream_session_t * s, transport_endpoint_t * tep)
+session_listen_vc (stream_session_t * s, session_endpoint_t * sep)
 {
   transport_connection_t *tc;
   u32 tci;
 
   /* Transport bind/listen  */
-  tci = tp_vfts[s->session_type].bind (s->session_index, tep);
+  tci = tp_vfts[sep->transport_proto].bind (s->session_index,
+                                           session_endpoint_to_transport
+                                           (sep));
 
   if (tci == (u32) ~ 0)
     return -1;
 
   /* Attach transport to session */
   s->connection_index = tci;
-  tc = tp_vfts[s->session_type].get_listener (tci);
+  tc = tp_vfts[sep->transport_proto].get_listener (tci);
 
   /* Weird but handle it ... */
   if (tc == 0)
     return -1;
 
   /* Add to the main lookup table */
-  stream_session_table_add_for_tc (tc, s->session_index);
-
+  session_lookup_add_connection (tc, s->session_index);
   return 0;
 }
 
+int
+session_listen_app (stream_session_t * s, session_endpoint_t * sep)
+{
+  session_endpoint_extended_t esep;
+  clib_memcpy (&esep, sep, sizeof (*sep));
+  esep.app_index = s->app_index;
+
+  return tp_vfts[sep->transport_proto].bind (s->session_index,
+                                            (transport_endpoint_t *) & esep);
+}
+
+typedef int (*session_listen_service_fn) (stream_session_t *,
+                                         session_endpoint_t *);
+
+/* *INDENT-OFF* */
+static session_listen_service_fn
+session_listen_srv_fns[TRANSPORT_N_SERVICES] = {
+  session_listen_vc,
+  session_listen_vc,
+  session_listen_app,
+};
+/* *INDENT-ON* */
+
+int
+stream_session_listen (stream_session_t * s, session_endpoint_t * sep)
+{
+  transport_service_type_t tst = tp_vfts[sep->transport_proto].service_type;
+  return session_listen_srv_fns[tst] (s, sep);
+}
+
 /**
  * Ask transport to stop listening on local transport endpoint.
  *
@@ -708,70 +988,55 @@ stream_session_listen (stream_session_t * s, transport_endpoint_t * tep)
 int
 stream_session_stop_listen (stream_session_t * s)
 {
+  transport_proto_t tp = session_get_transport_proto (s);
   transport_connection_t *tc;
-
   if (s->session_state != SESSION_STATE_LISTENING)
     {
       clib_warning ("not a listening session");
       return -1;
     }
 
-  tc = tp_vfts[s->session_type].get_listener (s->connection_index);
+  tc = tp_vfts[tp].get_listener (s->connection_index);
   if (!tc)
     {
       clib_warning ("no transport");
       return VNET_API_ERROR_ADDRESS_NOT_IN_USE;
     }
 
-  stream_session_table_del_for_tc (tc);
-  tp_vfts[s->session_type].unbind (s->connection_index);
+  session_lookup_del_connection (tc);
+  tp_vfts[tp].unbind (s->connection_index);
   return 0;
 }
 
+/**
+ * Initialize session disconnect.
+ *
+ * Request is always sent to session node to ensure that all outstanding
+ * requests are served before transport is notified.
+ */
 void
-session_send_session_evt_to_thread (u64 session_handle,
-                                   fifo_event_type_t evt_type,
-                                   u32 thread_index)
+stream_session_disconnect (stream_session_t * s)
 {
-  static u16 serial_number = 0;
-  session_fifo_event_t evt;
-  unix_shared_memory_queue_t *q;
-
-  /* Fabricate event */
-  evt.session_handle = session_handle;
-  evt.event_type = evt_type;
-  evt.event_id = serial_number++;
-
-  q = session_manager_get_vpp_event_queue (thread_index);
-
-  /* Based on request block (or not) for lack of space */
-  if (PREDICT_TRUE (q->cursize < q->maxsize))
-    {
-      if (unix_shared_memory_queue_add (q, (u8 *) & evt,
-                                       1 /* do wait for mutex */ ))
-       {
-         clib_warning ("failed to enqueue evt");
-       }
-    }
-  else
-    {
-      clib_warning ("queue full");
-      return;
-    }
+  if (!s || s->session_state == SESSION_STATE_CLOSED)
+    return;
+  s->session_state = SESSION_STATE_CLOSED;
+  session_send_session_evt_to_thread (session_handle (s),
+                                     FIFO_EVENT_DISCONNECT, s->thread_index);
 }
 
 /**
- * Disconnect session and propagate to transport. This should eventually
+ * Notify transport the session can be disconnected. This should eventually
  * result in a delete notification that allows us to cleanup session state.
  * Called for both active/passive disconnects.
  *
- * Should be called from the session's thread.
+ * Must be called from the session's thread.
  */
 void
-stream_session_disconnect (stream_session_t * s)
+stream_session_disconnect_transport (stream_session_t * s)
 {
   s->session_state = SESSION_STATE_CLOSED;
-  tp_vfts[s->session_type].close (s->connection_index, s->thread_index);
+  tp_vfts[session_get_transport_proto (s)].close (s->connection_index,
+                                                 s->thread_index);
 }
 
 /**
@@ -788,89 +1053,190 @@ stream_session_cleanup (stream_session_t * s)
   s->session_state = SESSION_STATE_CLOSED;
 
   /* Delete from the main lookup table to avoid more enqueues */
-  rv = stream_session_table_del (s);
+  rv = session_lookup_del_session (s);
   if (rv)
     clib_warning ("hash delete error, rv %d", rv);
 
-  tp_vfts[s->session_type].cleanup (s->connection_index, s->thread_index);
+  tp_vfts[session_get_transport_proto (s)].cleanup (s->connection_index,
+                                                   s->thread_index);
 }
 
 /**
- * Allocate vpp event queue (once) per worker thread
+ * Allocate event queues in the shared-memory segment
+ *
+ * That can either be a newly created memfd segment, that will need to be
+ * mapped by all stack users, or the binary api's svm region. The latter is
+ * assumed to be already mapped. NOTE that this assumption DOES NOT hold if
+ * api clients bootstrap shm api over sockets (i.e. use memfd segments) and
+ * vpp uses api svm region for event queues.
  */
 void
-session_vpp_event_queue_allocate (session_manager_main_t * smm,
-                                 u32 thread_index)
+session_vpp_event_queues_allocate (session_manager_main_t * smm)
 {
+  u32 evt_q_length = 2048, evt_size = sizeof (session_fifo_event_t);
+  ssvm_private_t *eqs = &smm->evt_qs_segment;
   api_main_t *am = &api_main;
+  u64 eqs_size = 64 << 20;
+  pid_t vpp_pid = getpid ();
   void *oldheap;
-  u32 event_queue_length = 2048;
+  int i;
+
+  if (smm->configured_event_queue_length)
+    evt_q_length = smm->configured_event_queue_length;
 
-  if (smm->vpp_event_queues[thread_index] == 0)
+  if (smm->evt_qs_use_memfd_seg)
     {
-      /* Allocate event fifo in the /vpe-api shared-memory segment */
-      oldheap = svm_push_data_heap (am->vlib_rp);
+      if (smm->evt_qs_segment_size)
+       eqs_size = smm->evt_qs_segment_size;
 
-      if (smm->configured_event_queue_length)
-       event_queue_length = smm->configured_event_queue_length;
+      eqs->ssvm_size = eqs_size;
+      eqs->i_am_master = 1;
+      eqs->my_pid = vpp_pid;
+      eqs->name = format (0, "%s%c", "evt-qs-segment", 0);
+      eqs->requested_va = smm->session_baseva;
 
-      smm->vpp_event_queues[thread_index] =
-       unix_shared_memory_queue_init
-       (event_queue_length,
-        sizeof (session_fifo_event_t), 0 /* consumer pid */ ,
-        0 /* (do not) send signal when queue non-empty */ );
+      ssvm_master_init (eqs, SSVM_SEGMENT_MEMFD);
+    }
+
+  if (smm->evt_qs_use_memfd_seg)
+    oldheap = ssvm_push_heap (eqs->sh);
+  else
+    oldheap = svm_push_data_heap (am->vlib_rp);
 
-      svm_pop_heap (oldheap);
+  for (i = 0; i < vec_len (smm->vpp_event_queues); i++)
+    {
+      smm->vpp_event_queues[i] = svm_queue_init (evt_q_length, evt_size,
+                                                vpp_pid, 0);
     }
+
+  if (smm->evt_qs_use_memfd_seg)
+    ssvm_pop_heap (oldheap);
+  else
+    svm_pop_heap (oldheap);
 }
 
-session_type_t
-session_type_from_proto_and_ip (transport_proto_t proto, u8 is_ip4)
+ssvm_private_t *
+session_manager_get_evt_q_segment (void)
 {
-  if (proto == TRANSPORT_PROTO_TCP)
+  session_manager_main_t *smm = &session_manager_main;
+  if (smm->evt_qs_use_memfd_seg)
+    return &smm->evt_qs_segment;
+  return 0;
+}
+
+/* *INDENT-OFF* */
+static session_fifo_rx_fn *session_tx_fns[TRANSPORT_TX_N_FNS] = {
+    session_tx_fifo_peek_and_snd,
+    session_tx_fifo_dequeue_and_snd,
+    session_tx_fifo_dequeue_internal
+};
+/* *INDENT-ON* */
+
+/**
+ * Initialize session layer for given transport proto and ip version
+ *
+ * Allocates per session type (transport proto + ip version) data structures
+ * and adds arc from session queue node to session type output node.
+ */
+void
+session_register_transport (transport_proto_t transport_proto,
+                           const transport_proto_vft_t * vft, u8 is_ip4,
+                           u32 output_node)
+{
+  session_manager_main_t *smm = &session_manager_main;
+  session_type_t session_type;
+  u32 next_index = ~0;
+
+  session_type = session_type_from_proto_and_ip (transport_proto, is_ip4);
+
+  vec_validate (smm->session_type_to_next, session_type);
+  vec_validate (smm->listen_sessions, session_type);
+  vec_validate (smm->session_tx_fns, session_type);
+
+  /* *INDENT-OFF* */
+  if (output_node != ~0)
     {
-      if (is_ip4)
-       return SESSION_TYPE_IP4_TCP;
-      else
-       return SESSION_TYPE_IP6_TCP;
+      foreach_vlib_main (({
+          next_index = vlib_node_add_next (this_vlib_main,
+                                           session_queue_node.index,
+                                           output_node);
+      }));
     }
-  else
+  /* *INDENT-ON* */
+
+  smm->session_type_to_next[session_type] = next_index;
+  smm->session_tx_fns[session_type] = session_tx_fns[vft->tx_type];
+}
+
+transport_connection_t *
+session_get_transport (stream_session_t * s)
+{
+  transport_proto_t tp;
+  if (s->session_state != SESSION_STATE_LISTENING)
     {
-      if (is_ip4)
-       return SESSION_TYPE_IP4_UDP;
-      else
-       return SESSION_TYPE_IP6_UDP;
+      tp = session_get_transport_proto (s);
+      return tp_vfts[tp].get_connection (s->connection_index,
+                                        s->thread_index);
+    }
+  return 0;
+}
+
+transport_connection_t *
+listen_session_get_transport (stream_session_t * s)
+{
+  transport_proto_t tp = session_get_transport_proto (s);
+  return tp_vfts[tp].get_listener (s->connection_index);
+}
+
+int
+listen_session_get_local_session_endpoint (stream_session_t * listener,
+                                          session_endpoint_t * sep)
+{
+  transport_proto_t tp = session_get_transport_proto (listener);
+  transport_connection_t *tc;
+  tc = tp_vfts[tp].get_listener (listener->connection_index);
+  if (!tc)
+    {
+      clib_warning ("no transport");
+      return -1;
     }
 
-  return SESSION_N_TYPES;
+  /* N.B. The ip should not be copied because this is the local endpoint */
+  sep->port = tc->lcl_port;
+  sep->transport_proto = tc->proto;
+  sep->is_ip4 = tc->is_ip4;
+  return 0;
 }
 
 static clib_error_t *
 session_manager_main_enable (vlib_main_t * vm)
 {
+  segment_manager_main_init_args_t _sm_args = { 0 }, *sm_args = &_sm_args;
   session_manager_main_t *smm = &session_manager_main;
   vlib_thread_main_t *vtm = vlib_get_thread_main ();
-  u32 num_threads;
-  u32 preallocated_sessions_per_worker;
-  int i;
+  u32 num_threads, preallocated_sessions_per_worker;
+  int i, j;
 
   num_threads = 1 /* main thread */  + vtm->n_threads;
 
   if (num_threads < 1)
     return clib_error_return (0, "n_thread_stacks not set");
 
-  /* $$$ config parameters */
-  svm_fifo_segment_init (0x200000000ULL /* first segment base VA */ ,
-                        20 /* timeout in seconds */ );
-
   /* configure per-thread ** vectors */
   vec_validate (smm->sessions, num_threads - 1);
-  vec_validate (smm->session_indices_to_enqueue_by_thread, num_threads - 1);
   vec_validate (smm->tx_buffers, num_threads - 1);
   vec_validate (smm->pending_event_vector, num_threads - 1);
+  vec_validate (smm->pending_disconnects, num_threads - 1);
   vec_validate (smm->free_event_vector, num_threads - 1);
-  vec_validate (smm->current_enqueue_epoch, num_threads - 1);
   vec_validate (smm->vpp_event_queues, num_threads - 1);
+  vec_validate (smm->peekers_rw_locks, num_threads - 1);
+
+  for (i = 0; i < TRANSPORT_N_PROTO; i++)
+    for (j = 0; j < num_threads; j++)
+      {
+       vec_validate (smm->session_to_enqueue[i], num_threads - 1);
+       vec_validate (smm->current_enqueue_epoch[i], num_threads - 1);
+      }
 
   for (i = 0; i < num_threads; i++)
     {
@@ -878,52 +1244,54 @@ session_manager_main_enable (vlib_main_t * vm)
       _vec_len (smm->free_event_vector[i]) = 0;
       vec_validate (smm->pending_event_vector[i], 0);
       _vec_len (smm->pending_event_vector[i]) = 0;
+      vec_validate (smm->pending_disconnects[i], 0);
+      _vec_len (smm->pending_disconnects[i]) = 0;
+      if (num_threads > 1)
+       clib_rwlock_init (&smm->peekers_rw_locks[i]);
     }
 
 #if SESSION_DBG
   vec_validate (smm->last_event_poll_by_thread, num_threads - 1);
 #endif
 
-  /* Allocate vpp event queues */
-  for (i = 0; i < vec_len (smm->vpp_event_queues); i++)
-    session_vpp_event_queue_allocate (smm, i);
+  /* Allocate vpp event queues segment and queue */
+  session_vpp_event_queues_allocate (smm);
+
+  /* Initialize fifo segment main baseva and timeout */
+  sm_args->baseva = smm->session_baseva + smm->evt_qs_segment_size;
+  sm_args->size = smm->session_va_space_size;
+  segment_manager_main_init (sm_args);
 
   /* Preallocate sessions */
-  if (num_threads == 1)
+  if (smm->preallocated_sessions)
     {
-      for (i = 0; i < smm->preallocated_sessions; i++)
+      if (num_threads == 1)
        {
-         stream_session_t *ss __attribute__ ((unused));
-         pool_get_aligned (smm->sessions[0], ss, CLIB_CACHE_LINE_BYTES);
+         pool_init_fixed (smm->sessions[0], smm->preallocated_sessions);
        }
-
-      for (i = 0; i < smm->preallocated_sessions; i++)
-       pool_put_index (smm->sessions[0], i);
-    }
-  else
-    {
-      int j;
-      preallocated_sessions_per_worker = smm->preallocated_sessions /
-       (num_threads - 1);
-
-      for (j = 1; j < num_threads; j++)
+      else
        {
-         for (i = 0; i < preallocated_sessions_per_worker; i++)
+         int j;
+         preallocated_sessions_per_worker =
+           (1.1 * (f64) smm->preallocated_sessions /
+            (f64) (num_threads - 1));
+
+         for (j = 1; j < num_threads; j++)
            {
-             stream_session_t *ss __attribute__ ((unused));
-             pool_get_aligned (smm->sessions[j], ss, CLIB_CACHE_LINE_BYTES);
+             pool_init_fixed (smm->sessions[j],
+                              preallocated_sessions_per_worker);
            }
-         for (i = 0; i < preallocated_sessions_per_worker; i++)
-           pool_put_index (smm->sessions[j], i);
        }
     }
 
   session_lookup_init ();
+  app_namespaces_init ();
+  transport_init ();
 
   smm->is_enabled = 1;
 
-  /* Enable TCP transport */
-  vnet_tcp_enable_disable (vm, 1);
+  /* Enable transports */
+  transport_enable_disable (vm, 1);
 
   return 0;
 }
@@ -943,14 +1311,14 @@ session_node_enable_disable (u8 is_en)
 clib_error_t *
 vnet_session_enable_disable (vlib_main_t * vm, u8 is_en)
 {
+  clib_error_t *error = 0;
   if (is_en)
     {
       if (session_manager_main.is_enabled)
        return 0;
 
       session_node_enable_disable (is_en);
-
-      return session_manager_main_enable (vm);
+      error = session_manager_main_enable (vm);
     }
   else
     {
@@ -958,13 +1326,16 @@ vnet_session_enable_disable (vlib_main_t * vm, u8 is_en)
       session_node_enable_disable (is_en);
     }
 
-  return 0;
+  return error;
 }
 
 clib_error_t *
 session_manager_main_init (vlib_main_t * vm)
 {
   session_manager_main_t *smm = &session_manager_main;
+  smm->session_baseva = 0x200000000ULL;
+  smm->session_va_space_size = (u64) 128 << 30;
+  smm->evt_qs_segment_size = 64 << 20;
   smm->is_enabled = 0;
   return 0;
 }
@@ -1034,6 +1405,19 @@ session_config_fn (vlib_main_t * vm, unformat_input_t * input)
                                      tmp, tmp);
          smm->configured_v6_halfopen_table_memory = tmp;
        }
+      else if (unformat (input, "local-endpoints-table-memory %U",
+                        unformat_memory_size, &tmp))
+       {
+         if (tmp >= 0x100000000)
+           return clib_error_return (0, "memory size %llx (%lld) too large",
+                                     tmp, tmp);
+         smm->local_endpoints_table_memory = tmp;
+       }
+      else if (unformat (input, "local-endpoints-table-buckets %d",
+                        &smm->local_endpoints_table_buckets))
+       ;
+      else if (unformat (input, "evt_qs_memfd_seg"))
+       smm->evt_qs_use_memfd_seg = 1;
       else
        return clib_error_return (0, "unknown input `%U'",
                                  format_unformat_error, input);