nat: Final NAT44 EI/ED split patch

This patch achieves complete separation of
endpoint-dependent and endpoint-independent IPv4 NAT
features. Some common stuff is also moved to NAT
library.

Type: refactor

Change-Id: I52468b7e2b5ac28958a2baf8e2ea01787322e801
Signed-off-by: Filip Varga <fivarga@cisco.com>

virtio: enable the interrupt support for uio_pci_generic

Type: improvement

Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
Change-Id: Ic25ffe9c8e37826733cfb9e62cefb491bb3322bc

session: init ctrl msg without mq lock

Type: improvement

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I755e6da1fcf6f3bf3c72d6d36c4243b0919b7209

fib: fix sa selection for fib routed destinations

The move from ip4(6)_src_address_for_packet to fib_sas4(6)_get changed
the behavior, so that the new looked only to adjacent gleans. This
caused a problem for destinations routed according to FIB table.

To reproduce:
vpp# create tap
vpp# set interface state tap0 up
vpp# set interface ip address tap0 192.168.11.1/24
vpp# ip route add 192.168.20.0/24 via 192.168.11.2

linux$ sudo ip addr add 192.168.20.1/24 dev lo
linux$ sudo ip link set tap0 up
linux$ sudo ip addr add 192.168.11.2/24 dev tap0

vpp# ping 192.168.20.1
Failed: no source address for egress interface

Type: fix
Signed-off-by: Július Milan <julius.milan@pantheon.tech>
Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I22899f4dbbf8c1c85ccce72f801b92c183195b5d

wireguard: coverity fix

explicit null dereferenced

Type: fix

Signed-off-by: Artem Glazychev <artem.glazychev@xored.com>
Change-Id: Id1e4b0e048dbd0a68063c63374172ab6d3653aff

crypto: A more memory efficient layout of the frame element struct

Type: improvement

Also:
  - state as enum so my GDB life is easier
  - typo; s/indice/indices/;

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I3320f5ef1ccd7d042071ef336488a41adfad7463

docs: move pnat doc link into dev doc section

- "PNAT: 1:1 match and rewrite programmable NAT" link
   was hanging out on the top level of the doc tree.
   Move it to VPP->Developer Documentation.

Type: fix

Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
Change-Id: Iadb7d3463567a2414eece68db0a3743237ab26f9

l2: coverity woe in l2_api.c

Coverify complains deref_ptr before null check.

     deref_ptr: Directly dereferencing pointer reg.
1214              vl_reg = vl_api_client_index_to_registration (reg->client_index);
1215              ALWAYS_ASSERT (vl_reg != NULL);
1216

CID 216104 (#1 of 1): Dereference before null check (REVERSE_INULL)
check_after_deref: Null-checking reg suggests that it may be null, but it
 has already been dereferenced on all paths leading to the check.
1217              if (reg && vl_api_can_send_msg (vl_reg))

I believe the check is for vl_reg instead of reg because vl_reg may be NULL
after the call vl_api_client_index_to_registration.

Type: fix

Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: Ic4eb2284e65c48396f20d5024a4241c80c70c886

hsa: fifo detach cleanup

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I907b2e560d6ecd748aa7c6d775c4f7122a39b4cb

vcl: segment index leak on attach

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: If8840d455f8841264136adb19cc9a2046ba37b11

vcl: fix coverity warning

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Id9f922eafe4a68661d2858d72fc548a372e9596a

misc: run make test-refresh-deps to update the python dependencies

Also, remove the flake8 from requirements.txt as it looks
like upstream package is not installable...

Type: test
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Change-Id: I1a2132f30f7f9431d892e962a29c7d859e6a43db
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

tests: delete test/requirements-2.txt

Python2 has not been supported for a while now, time to spring clean...

Change-Id: Iafb18bd730c69b5aeefa6ccbfadbaaf30c92c2c8
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Type: improvement

vlib: fix offload flags value reset

When a buffer is freed and re-allocated for a new packet, opaque2 is
not reset, so the offload flags can be set to a stale value.
Make sure the offload flags are reset to the current value on 1st set.

Type: fix
Fixes: 6809538e646bf86c000dc1faba60b0a4157ad898

Change-Id: I4048febedf25b9995dbd080a11495ee7dbe59153
Signed-off-by: Benoît Ganne <bganne@cisco.com>

vcl: fix vls_intercept_sigchld_handler be called recursively

The old_sa is rewrite with vls_intercept_sigchld_handler when parent
process fork child second time, parent process will call
vls_intercept_sigchld_handler recursively when received child signal.

Type: fix

Signed-off-by: nandfan <fanyufei521@outlook.com>
Change-Id: Ia58a254d58058489aa2d91b76a3b3cab1e38f802

api: fix memory leak in vl_api_cli_inband_t_handler

I noticed the memory leak while sending a lot of cli_inband APIs:

DBGvpp# memory-trace on main-heap

... send a lot of API cli_inband ...

DBGvpp# show memory main-heap
Thread 0 vpp_main
  base 0x7f85c8302000, size 1g, locked, unmap-on-destroy, name 'main heap'
    page stats: page-size 4K, total 262144, mapped 33129, not-mapped 229015
      numa 0: 33129 pages, 129.41m bytes
    total: 1023.99M, used: 125.78M, free: 898.22M, trimmable: 897.59M

  Bytes    Count     Sample   Traceback
  9751632   145034 0x7f85d01696e8 clib_mem_alloc_aligned_at_offset + 0x80
                                  vec_resize_allocate_memory + 0xa8
                                  _vec_resize_inline + 0x240
                                  va_unformat + 0xe4
                                  unformat + 0x159
                                  vlib_cli_dispatch_sub_commands + 0x11e
                                  vlib_cli_input + 0x8f
                                  vl_api_cli_inband_t_handler + 0xd9
                                  vl_msg_api_handler_with_vm_node + 0x488
                                  void_mem_api_handle_msg_i + 0x6f
                                  vl_mem_api_handle_msg_main + 0x38
                                  vl_api_clnt_process + 0x28d
  9723904   145034 0x7f85cd677238 clib_mem_alloc_aligned_at_offset + 0x80
                                  vec_resize_allocate_memory + 0xa8
                                  _vec_resize_inline + 0x240
                                  unformat_init_string + 0x10d
                                  vl_api_cli_inband_t_handler + 0xc1
                                  vl_msg_api_handler_with_vm_node + 0x488
                                  void_mem_api_handle_msg_i + 0x6f
                                  vl_mem_api_handle_msg_main + 0x38
                                  vl_api_clnt_process + 0x28d
                                  vlib_process_bootstrap + 0x5d
                                  0x7f8608b0e038
290077 total traced objects

Solution: free the input data structure.

Type: fix
Change-Id: I42de5572e8760237e793a53c1a94bce65a4ac5fa
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

vcl: cleanup fifos detached from segments

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I412024731c1f561680736ad7bfabb99b595e3dff

svm: free shared fifo on detach

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I639560ee3dd0a1d605ec2866dce5cdd13fda8201

vcl: support sockopt of SO_REUSEPORT and SO_DOMAIN

Type: fix

Signed-off-by: wanghanlin <wanghanlin@corp.netease.com>
Change-Id: I800cfffb07bf7d4c4d1454b73febdba03f7d6b75

ip-neighbor: add set ip neighbor-config CLI command

Type: improvement

Signed-off-by: Ivan Shvedunov <ivan4th@gmail.com>
Change-Id: I77ade50425e88d2da979f732d2248bed383f4ba4

svm: return chunks to slice on fifo detach

Ensure chunk alloc distribution is maintained on fifo detach.

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I5aa5524e06a703dc50e90da6d177663d2d997aa4

dpdk: fix cryptodev offset update

Type: fix

This patch fixes the missed crypto and integ offset update for
every packet. Previously the offset is updated only when the
key is changed. This is ok for encryption but not always true
for decryption.

Signed-off-by: Fan Zhang <roy.fan.zhang@intel.com>
Change-Id: Iccd0011f4ae488746ce487a14b94ddd24fb0c07c

tests: add input policer thread handoff tests

Test worker thread handoff on an interface input policer.

Type: test
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I1deddcc9711bccfde377290bc66a00f2cd4163e1

policer: add thread handoff for device input

Add worker thread handoff for policers on the device input feature arc
on an interface.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: Ib795457a09a5b3be3c4e6422c91e33100192b8e2

policer: move handoff checks into policer code

The IP punt policer currently checks if it needs to do worker thread
handoff based on the thread index stored in the policer. Move this
functionality into the policer code so it can be common for all users
of the policer.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: Ia8d11e62898a58b19d7b27b296f8369baa3e5aa1

tests: test input policer

Apply a policer to an interface, check it's policing packets.
Remove it and check it no longer polices packets.

Type: test
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I6f694c8a9804cadf010b5831770aaae81f42e027

policer: add api to configure input policing

Add a new API to apply a policer to an input interface.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: Ie8aff9120149b63d85363a9a5afdcaed60a93700

policer: add policing as device-input feature

Add input per-interface policing as an input feature, repurposing
vnet_policer_inline which formermly allowed input policing to be
configured via a CLI.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I2fd00e964ae358a05e507c844f5476372124fae1

ikev2: start counting msgid from 0

This fixes an issue when initiator is expecting request with intitial
msgid being 0 but 1 is received instead which results in retransmission
(instead of normally processing the new request).

Type: fix

Change-Id: I60062276bd93de78128847c5b15f5d6cecf1df65
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>

session vppinfra: asan fixes

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Ie709d76438542783cbc8c6174b5e712ef18a6276

svm: fix active fifo ll on attach

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Idf44f8d54c97fc43da5d5760e5ce477af07e5fbf

tests: remove unnecessary setup in policer test

The policer test class overrides setup and teardown methods from
VppTestCase but doesn't do anything other than call the parent's
method.

Type: test
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I76bac084c4cb5cb5195e34afe95b38affd585942

vlib: add a "vpplog" debug CLI

To add arbitrary text to the vlib log. Combines nicely with
comment/uncomment and the macro expander:

define MY_FEATURE uncomment   # or comment
...
$(MY_FEATURE) { vpplog { My feature was enabled } }

Type: improvement

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: Ia019f0a8fa670d8593ae01595f5ef410796e5b1c

vcl: epoll out deq notifications only if fifo exists

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Ia37d8474224f6074826c9ffb82feb919b2ef52f7

tests: re-enable NAT44ED tests for multiworker

Re-enable the test for 2-worker config test

Change-Id: Ie108c5d244c6704ffa152177ca77f6b6055fe38e
Type: test
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

tests: policer test check unformat return values

Keep coverity happy by checking the return value of unformat calls.

Type: test
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: Iccd0296da527d079f79cc7bd8b57af1b524299bd

vat2: jsonconvert return checking - coverity

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I8348645927519800d2390d27e01fae612602a6eb

misc: fix the linux-cp entry for Neale

Change-Id: I0f51ddfa10ed38d23617a715f8db5a970960d126
Type: improvement
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

vat2: add sanity checking - coverity errors

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I3cd56690fe52402d4cfa9ea67f1de53d8d919dee

vppapigen: resource leakage in fromjson array - coverity

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I43283c59fd121dcb2486b26151108c90b027748b

linux-cp: fix coverity defect

Type: fix

If no host interface name is passed to the CLI command which creates
an interface pair, NULL gets passed to lcp_itf_pair_create() and a
seg fault occurs. Check whether a host interface name was provided
and fail gracefully if none was given.

Change-Id: I82886f4c2ee710e206c751c34a74399112e9062c
Signed-off-by: Matthew Smith <mgsmith@netgate.com>

vppapigen: more _fromjson autogeneration coverity fixes

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I9a7bb617a3fa87d6ef49c75277e53425310cdcf9
Signed-off-by: Ole Troan <ot@cisco.com>

hsa: coverity fix

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I30fde452fdeeb9877f3e3fecb0dd723f10f61019

ikev2: fix coverity warnings

Type: fix

Change-Id: Ia22b1189b82e885eb380f638ea6d05923a858f01
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>

stats: coverity errors leaking fd

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I21368e37d70c5a64babd904bcf5f79339a5ab064
Signed-off-by: Ole Troan <ot@cisco.com>

vppapigen: coveriy missing check of return values

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I424c2f283dab99c1856eb8d9a1444486d09e8e29

vppapigen: fix coverity issues in jsonconvert

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I92e03a5a3fcbdab6ce4d178193dceb4450ac0f62

cjson: upgrade to new version

See if this fixes the coverity issues.
Now at 324a6ac9a9b285ff7a5a3e5b2071e3624b94f2db

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I2cd281ebaeda69e214e6dc93a84888298741d0ee
Signed-off-by: Ole Troan <ot@cisco.com>

vapi: add dedicated return code for client timeout

Type: refactor

Change-Id: I1fbabb743f20e21557c69bdaf97eda6f63584903
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

svm: fix mq coverity warning

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I1914366c17fa05305d57d842793fad372319256a

session: coverity fix

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Ic28ee0e7cd313686b820e7003a47d17b844b8a89

lisp: coverity fixes

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I2a55a2fe0c483359c3b42ebe93cd0e8e279131d1

vlib: refactor checksum offload support

Type: refactor

This patch refactors the offload flags in vlib_buffer_t.
There are two main reasons behind this refactoring.
First, offload flags are insufficient to represent outer
and inner headers offloads. Second, room for these flags
in first cacheline of vlib_buffer_t is also limited.

This patch introduces a generic offload flag in first
cacheline. And detailed offload flags in 2nd cacheline
of the structure for performance optimization.

Change-Id: Icc363a142fb9208ec7113ab5bbfc8230181f6004
Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>

misc: coverity fixes

Type: fix

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I6a3348c7edd1cce6b407d336443103f77392bc5d

papi: add method to retrieve field options

  Sample usage:
      cls.MEMIF_DEFAULT_BUFFER_SIZE = cls.vapi.vpp.get_field_options(
          'memif_create', 'buffer_size')['default']

Type: improvement

Change-Id: I298f4687623003a78c93a703d32f59a937e37bc2
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

tests: fix import in test/test_pcap.py

Type: test

Change-Id: Ib9192a12812b40090a0859cb73288aea27a3ca01
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

ip: Path MTU

Type: feature

Support setting the MTU for a peer on an interface. The minimum value of
the path and interface MTU is used at forwarding time.

the path MTU is specified for a given peer, by address and table-ID.
In the forwarding plane the MTU is enfored either:
 1 - if the peer is attached, then the MTU is set on the peer's
adjacency
 2 - if the peer is not attached, it is remote, then a DPO is added to
the peer's FIB entry to perform the necessary fragmentation.

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I8b9ea6a07868b50e97e2561f18d9335407dea7ae

policer: improve policer struct

Ensure policer struct is cache aligned and fits in one cache line.
Give it a simpler name to reflect its job as the representation of
a policer.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: If1ae4931c818b86eee20306e503f4e5d6b84bd0d

vppinfra: fix memcpy undefined behaviour

Calling mem{cpy,move} with NULL pointers results in undefined behaviour.
This in turns is exploited by GCC. For example, the sequence:
    memcpy (dst, src, n);
    if (!src)
      return;
    src[0] = 0xcafe;
will be optimized as
    memcpy (dst, src, n);
    src[0] = 0xcafe;
IOW the test for NULL is gone.

vec_*() functions sometime call memcpy with NULL pointers and 0 length,
triggering this optimization. For example, the sequence:
    vec_append(v1, v2);
    len = vec_len(v2);
will crash if v2 is NULL, because the test for NULL pointer in vec_len()
has been optimized out.

This commit fixes occurrences of such undefined behaviour, and also
introduces a memcpy wrapper to catch those in debug mode.

Type: fix

Change-Id: I175e2dd726a883f97cf7de3b15f66d4b237ddefd
Signed-off-by: Benoît Ganne <bganne@cisco.com>

quic: Coverity fix

Type: fix

Change-Id: I744cedb9c1b57945af5e83057e4759964fd2e104
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>

ikev2: fix rekey against strongSwan

When strongSwan rekeys it sends create child sa request first and then
delete request for the old child sa (or vice versa depending on
configuration) as opposed to sending just a single create child sa with
rekey notify message.

Type: fix

Change-Id: I1fa55a607ca623cd3a6d887436207153c6f6bbf6
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>

tests: test punt policer bound to worker thread

Add to the IP[46] punt policer handoff tests by binding the policer to
a particular worker and checking all packets are policed on that thread.

Type: test
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I7fab28659ccb65f13f841cec65a3f808281b3f90

policer: add api to bind policer to worker

Add a new api to allow a policer to be bound to
a specific worker thread for thread handoff.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I2623a6827843c3d93c0d7b4ad7c2e13611ec1696

interface: Add promisc on/off in api

Type: feature

Change-Id: Ib777a5201f1c728438c7a5f2b1aa2246f1344b9b
Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>

fib: Always honour flow hash flag

Type: fix

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: Id7b27edf3712aaa3c277e752b9ca78bb91d184a1

vppapigen: py2 cleanup - remove subclassing of object

Type: refactor

Change-Id: I7136cb8ba101ea3917dacc31ceb3a76a31328301
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

tests: explicitly close subprocess files

Resolve the following error:
/vpp/test/framework.py:657: ResourceWarning: unclosed file <_io.BufferedReader name=6>
  del cls.vpp
Object allocated at (most recent call last):
  File "/usr/lib/python3.8/subprocess.py", lineno 844
    self.stdout = io.open(c2pread, 'rb', bufsize)

Type: test

Change-Id: Ia2974da594f0582dcff1f4bdf40d25475769c46c
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

rdma: rdma_log__ argument dev is a pointer

Also apply style edits as proprosed by checkstyle.

Ticket: VPP-1971
Type: fix

Change-Id: I4332a4e32220f3076b4a373da01cc0022cde32f5
Signed-off-by: Vratko Polak <vrpolak@cisco.com>

nat: pnat only use save_rewrite_length on output path

Don't expect save_rewrite_length to be set correctly on RX path.

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: Ieee40d119213f617c3d836181e5879f084b74548
Signed-off-by: Ole Troan <ot@cisco.com>

ipsec: Store thread-index in buffer meta-data during SA handoff

Type: improvement

negates the need to load the SA in the handoff node.
don't prefetch the packet data, it's not needed.

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: I340472dc437f050cc1c3c11dfeb47ab09c609624

dpdk: use whole vmbus address as hash key for devconf

u32[0] is not enough unique for some platforms like azure
where several devices(not only network) can have almost
the same addresses and this can cause collisions.

Change hash to mhash type for vmbus devices with key
of whole 16 bytes of vmbus address.

Type: improvement

Signed-off-by: Vladimir Ratnikov <vratnikov@netgate.com>
Change-Id: Ic6c6a657ae29f45beddd0c69d8e785e702349460

policer: tidy up

Convert old logging style to new and remove unused tracepoints.
Remove code always conditionally not compiled.
Make comment style consistent.

Type: improvement
Change-Id: I13339f28539cf190fb92be2d5c8020b6249319c8
Signed-off-by: Brian Russell <brian@graphiant.com>

policer: use enum types

Make the policer action enum packed and use it in the policer code.
Use other policer enums where applicable.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I32f9735942af8bca3160b9ef8a75f605d9aba5fa

docs: fixing VPP tutorial

Updating ARP table command.

Type: fix

Signed-off-by: Arthur de Kerhor <arthurdekerhor@gmail.com>
Change-Id: I02d6ac86aed4c83430f9d07bdeaa3e0f5c3ae73f

policer: remove SSE2 prefix

The policer code uses a naming convention of prefixing a lot of
its definitions with "SSE2" when in fact there is nothing SSE2
specific about them. This is confusing so remove the prefix.

Unfortunately it has to stay in the API definitions for backward
compatibility.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I59a7df9fd5ded2575f2e587b2768a025a213b07c

vppapigen: coverity issues in autogenerated code pass 3.

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I5ee2e8aba3ee7281bbca11825dece79983e52f06

build: add missing virtualenv dependencies for debian-10

Type: make
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Change-Id: I57a1f90d7fe9e1262f210d0c091bafda5d496c69

vppapigen: fix fromjson coverity errors in generation

Fix memory leak coverity errors where free was not called
on error conditions. Or called twice.

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I21cffa8b01e4f72f10501f202f6a762ae300a941
Signed-off-by: Ole Troan <ot@cisco.com>

vppinfra: fix membulk coverity warnings

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I4830656ad852de62211e31574a0e0afb62d00f37

tests: tag the tests that do not work with multi-worker configuration

If the multi-worker default VPP configuration is triggered by
setting VPP_WORKER_CONFIG="workers 2", some of the tests fail
for various reasons.

It's a substantial number, so this change marks all of the
testsets that have this issue, such that they can be addressed
later independently.

Type: test
Change-Id: I4f77196499edef3300afe7eabef9cbff91f794d3
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

wireguard: testing alternative timer dispatch

Change-Id: I645bb0a31b333a6160c74987dddb3fb50ff154d8
Type: improvement
Signed-off-by: Mohammed Hawari <mohammed@hawari.fr>

policer: use ip dscp

Use the common IP definitions of DSCP rather than duplicating in the
policer code.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: Iff4bc789356edc290b9c31eca33e93cf5b6211bf

vcl: validate seg handle on migrate only if needed

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I3c15a465f84f2ceb6bd5f1c459899824d4bc1c90

tests: add policer tests

Add some tests which configure policer params, use the policer
test helper CLI to police pretend packets and then check the
policer stats.

Type: test
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: Ib2688b6f77d84a4bfd3c8185e44c59fa2300716a

tests: add policer test helper

Add a helper CLI to exercise a policer pre-configured by the test
harness. The test harness will check the stats afterwards.

Type: test
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I913dda4a9f8179c1c6b3061a68164bf1e698a392

vppinfra: fix bihash test-debug aarch64 sporadic failure

Turns out that both the multi-core and single-core add / del tests run
for just under 5 seconds (aarch64, debug image). Increase the vapi =>
debug CLI timeout to avoid spurious failures.

Type: test

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: Ia64bffa82a908172a21c34f3ae4402ad774af28a

ipsec: Use the new tunnel API types to add flow label and TTL copy
support

Type: feature

attmpet 2. this includes changes in ah_encrypt that don't use
uninitialised memory when doing tunnel mode fixups.

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: Ie3cb776f5c415c93b8a5ee22f22586fd0181110d

nat: fix EI hairpinning thread safety

Avoid doing inter-thread reads without locks by doing a handoff before
destination address rewrite. Destination address is read from a session
which is possibly owned by a different thread. By splitting the work in
two parts with a handoff in the middle, we can do both in a thread safe
way.

Type: improvement
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Change-Id: I1c50d188393a610f5564fa230c75771a8065f273

misc: updating maintainers file

Adding maintainers for stn, ioam, cdp.

Type: improvement
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I0f75bb0044b340ee17a1720a7eea1c840625276b

l2: crash on l2_input_is_xconnect

Running vpp without any interface configured and then invoking the
binary-api l2_xconnect_dump causes vpp to crash in l2_input_is_xconnect due
to l2input_main.configs has no memory allocated to it, not even for the local
interface which exists all the times.

The reason that l2input_main.configs has no memory allocated to it was due to
gerrit patch 29232 which took out a line in l2input_init

  /* Create the config vector */
  vec_validate (mp->configs, 100);

The fix is to iterate through l2input_main.configs for each interface in
l2 to call l2_input_is_xconnect when dumping l2_xconnect interfaces.

Type: fix
Fixes: gerrit 29232

Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I8d9cba4b7eba4c2e0c60887c4fd57d5ec3b06d3b

tls: dtls initial implementation

Type: feature

Basic dtls transport protocol implementation that relies on openssl
wire protocol implementation. Retries/timeouts not yet supported.

To test using vcl test apps, first ensure all arp entries are properly
resolved and subsequently:

server: vcl_server -p dtls 1234
client: vcl_client -p dtls <server-ip> 1234 -U -N 2000000 -T 1460 -X

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I04b4516a8fe9ce85ba230bcdd891f33a900046ed

session: coverity fixes

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I2828287c58115aa08c0a4297c01cea60f41f4749

crypto: fix bad-hmac in sw scheduler if async mode

When IPsec async mode is enabled, packets don't pass through the tunnel
if ciphers other than AES GCM are used for child SAs. An error that
arises is "bad-hmac" in the "crypto-dispatch" node.

On the encryption stage, the VNET_CRYPTO_OP_FLAG_HMAC_CHECK flag is set
for the integrity crypto operation when it's not supposed to. It seems
that the flag remains from the previous operation.

With this change, zero flags of crypto operations in the SW scheduler
during operation filling.

Type: fix
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
Change-Id: Iabac253474e95cb01f9ec0933f3c4860f8a5289c

gbp: fix typo in macro

Type: fix

Change-Id: I1f8245e8cccacb5bbb511aef39e31d0a76bba95f
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

papi: expose vpp_papi version to client

root@ae2a2e85c5d4:/vpp/src/vpp-api/python# python3
Python 3.6.9 (default, Oct  8 2020, 12:12:24)
[GCC 8.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import vpp_papi
>>> vpp_papi.__version__
'1.6.2'

Type: feature

Change-Id: I73025427a58214a842245fceaa77daa7acd3e6f8
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

papi: remove python2 vpp-api-python.deb

Type: fix

Change-Id: I4901f7eb9d739afd4d45a25306434e9d122a4068
Signed-off-by: Paul Vinciguerra <pvinci@vinciconsulting.com>

misc: Now that VOM is deprecated remove the build dependency on boost

Type: make

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: Icbbae3ab222e7d97e6c496c13ec9229e94cf5ede

nat: bump default max translations to 63K

Type: improvement

Signed-off-by: Klement Sekera <ksekera@cisco.com>
Change-Id: Ibea7ec844d1d910e8a3235e11154b1ecea8302ac

nat: deny adding intf addr if static-mapping-only

If static-mapping-only is enabled, NAT pool cannot be configured, only
static mappings. There're two ways to add addresses to the NAT pool:
by address range, or by first found address from an interface.
NAT44_ADD_DEL_ADDRESS_RANGE already tests if dynamic mappings are
available but NAT44_ADD_DEL_INTERFACE_ADDR doesn't. If
static-mapping-only is enabled, adding addresses by range is rejected
but by interface not.

With this change, if static-mapping-only is enabled, do not allow to
add addresses to the NAT pool both ways.

Type: fix
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
Change-Id: Ifc055ea9a71a5e579388833a2990aef21bf7ed29

nat: fix coverity errors

Including a general missing free in fromjson autogenerated code.

Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I9ab2b0193135e2fb3d62d51b3c114df56969e341
Signed-off-by: Ole Troan <ot@cisco.com>