session: add support for application namespacing

Applications are now provided the option to select the namespace they
are to be attached to and the scope of their attachement. Application
namespaces are meant to:
1) constrain the scope of communication through the network by
association with source interfaces and/or fib tables that provide the
source ips to be used and limit the scope of routing
2) provide a namespace local scope to session layer communication, as
opposed to the global scope provided by 1). That is, sessions can be
established without assistance from transport and network layers.
Albeit, zero/local-host ip addresses must still be provided in session
establishment messages due to existing application idiosyncrasies. This
mode of communication uses shared-memory fifos (cut-through sessions)
exclusively.

If applications request no namespace, they are assigned to the default
one, which at its turn uses the default fib. Applications can request
access to both local and global scopes for a namespace. If no scope is
specified, session layer defaults to the global one.

When a sw_if_index is provided for a namespace, zero-ip (INADDR_ANY)
binds are converted to binds to the requested interface.

Change-Id: Ia0f660bbf7eec7f89673f75b4821fc7c3d58e3d1
Signed-off-by: Florin Coras <fcoras@cisco.com>

8 files changed, 199 insertions, 146 deletions

diff --git a/src/vnet/tcp/builtin_client.c b/src/vnet/tcp/builtin_client.c
index b48422c0b30..7a0d2ea1744 100644
--- a/src/vnet/tcp/builtin_client.c
+++ b/src/vnet/tcp/builtin_client.c
@@ -246,8 +246,8 @@ builtin_client_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  __sync_fetch_and_add (&tm->tx_total, sp->bytes_sent);
 	  __sync_fetch_and_add (&tm->rx_total, sp->bytes_received);
 
-	  stream_session_parse_handle (sp->vpp_session_handle,
-				       &index, &thread_index);
+	  session_parse_handle (sp->vpp_session_handle,
+				&index, &thread_index);
 	  s = stream_session_get_if_valid (index, thread_index);
 
 	  if (s)
@@ -425,14 +425,16 @@ static session_cb_vft_t builtin_clients = {
 };
 /* *INDENT-ON* */
 
-static int
-attach_builtin_test_clients_app (void)
+static clib_error_t *
+attach_builtin_test_clients_app (u8 * appns_id, u64 appns_flags,
+				 u64 appns_secret)
 {
   tclient_main_t *tm = &tclient_main;
   vnet_app_attach_args_t _a, *a = &_a;
   u8 segment_name[128];
   u32 segment_name_length, prealloc_fifos;
   u64 options[16];
+  clib_error_t *error = 0;
 
   segment_name_length = ARRAY_LEN (segment_name);
 
@@ -455,11 +457,16 @@ attach_builtin_test_clients_app (void)
   options[APP_OPTIONS_PREALLOC_FIFO_PAIRS] = prealloc_fifos;
 
   options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_BUILTIN_APP;
-
+  if (appns_id)
+    {
+      options[APP_OPTIONS_FLAGS] |= appns_flags;
+      options[APP_OPTIONS_NAMESPACE_SECRET] = appns_secret;
+    }
   a->options = options;
+  a->namespace_id = appns_id;
 
-  if (vnet_application_attach (a))
-    return -1;
+  if ((error = vnet_application_attach (a)))
+    return error;
 
   tm->app_index = a->app_index;
   return 0;
@@ -489,11 +496,12 @@ start_tx_pthread (tclient_main_t * tm)
   return 0;
 }
 
-void
+clib_error_t *
 clients_connect (vlib_main_t * vm, u8 * uri, u32 n_clients)
 {
   tclient_main_t *tm = &tclient_main;
   vnet_connect_args_t _a, *a = &_a;
+  clib_error_t *error = 0;
   int i;
   for (i = 0; i < n_clients; i++)
     {
@@ -503,7 +511,10 @@ clients_connect (vlib_main_t * vm, u8 * uri, u32 n_clients)
       a->api_context = i;
       a->app_index = tm->app_index;
       a->mp = 0;
-      vnet_connect_uri (a);
+
+      if ((error = vnet_connect_uri (a)))
+	return error;
+
 
       /* Crude pacing for call setups  */
       if ((i % 4) == 0)
@@ -514,6 +525,7 @@ clients_connect (vlib_main_t * vm, u8 * uri, u32 n_clients)
 	  vlib_process_suspend (vm, 100e-6);
 	}
     }
+  return 0;
 }
 
 static clib_error_t *
@@ -524,13 +536,14 @@ test_tcp_clients_command_fn (vlib_main_t * vm,
   tclient_main_t *tm = &tclient_main;
   vlib_thread_main_t *thread_main = vlib_get_thread_main ();
   uword *event_data = 0, event_type;
-  u8 *default_connect_uri = (u8 *) "tcp://6.0.1.1/1234", *uri;
-  u64 tmp, total_bytes;
+  u8 *default_connect_uri = (u8 *) "tcp://6.0.1.1/1234", *uri, *appns_id;
+  u64 tmp, total_bytes, appns_flags = 0, appns_secret = 0;
   f64 test_timeout = 20.0, syn_timeout = 20.0, delta;
   f64 time_before_connects;
   u32 n_clients = 1;
   int preallocate_sessions = 0;
   char *transfer_type;
+  clib_error_t *error = 0;
   int i;
 
   tm->bytes_to_send = 8192;
@@ -582,6 +595,17 @@ test_tcp_clients_command_fn (vlib_main_t * vm,
       else
 	if (unformat (input, "client-batch %d", &tm->connections_per_batch))
 	;
+      else if (unformat (input, "appns %_%v%_", &appns_id))
+	;
+      else if (unformat (input, "all-scope"))
+	appns_flags |= (APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE
+			| APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE);
+      else if (unformat (input, "local-scope"))
+	appns_flags = APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE;
+      else if (unformat (input, "global-scope"))
+	appns_flags = APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE;
+      else if (unformat (input, "secret %lu", &appns_secret))
+	;
       else
 	return clib_error_return (0, "unknown input `%U'",
 				  format_unformat_error, input);
@@ -616,10 +640,14 @@ test_tcp_clients_command_fn (vlib_main_t * vm,
 
   if (tm->test_client_attached == 0)
     {
-      if (attach_builtin_test_clients_app ())
+      if ((error = attach_builtin_test_clients_app (appns_id, appns_flags,
+						    appns_secret)))
 	{
-	  return clib_error_return (0, "app attach failed");
+	  vec_free (appns_id);
+	  clib_error_report (error);
+	  return error;
 	}
+      vec_free (appns_id);
     }
   tm->test_client_attached = 1;
 
@@ -639,7 +667,8 @@ test_tcp_clients_command_fn (vlib_main_t * vm,
 
   /* Fire off connect requests */
   time_before_connects = vlib_time_now (vm);
-  clients_connect (vm, uri, n_clients);
+  if ((error = clients_connect (vm, uri, n_clients)))
+    return error;
 
   /* Park until the sessions come up, or ten seconds elapse... */
   vlib_process_wait_for_event_or_clock (vm, syn_timeout);
diff --git a/src/vnet/tcp/builtin_http_server.c b/src/vnet/tcp/builtin_http_server.c
index 9ba19ce92f7..f808400d63d 100644
--- a/src/vnet/tcp/builtin_http_server.c
+++ b/src/vnet/tcp/builtin_http_server.c
@@ -129,7 +129,7 @@ send_data (builtin_http_server_args * args, u8 * data)
   f64 last_sent_timer = vlib_time_now (vm);
   stream_session_t *s;
 
-  s = stream_session_get_from_handle (args->session_handle);
+  s = session_get_from_handle (args->session_handle);
   ASSERT (s);
   bytes_to_send = vec_len (data);
   offset = 0;
diff --git a/src/vnet/tcp/builtin_proxy.c b/src/vnet/tcp/builtin_proxy.c
index 91377e76726..a51a812ca16 100644
--- a/src/vnet/tcp/builtin_proxy.c
+++ b/src/vnet/tcp/builtin_proxy.c
@@ -50,8 +50,7 @@ delete_proxy_session (stream_session_t * s, int is_active_open)
 	{
 	  ps = pool_elt_at_index (bpm->sessions, p[0]);
 	  if (ps->vpp_server_handle != ~0)
-	    server_session = stream_session_get_from_handle
-	      (ps->vpp_server_handle);
+	    server_session = session_get_from_handle (ps->vpp_server_handle);
 	  else
 	    server_session = 0;
 	}
@@ -71,7 +70,7 @@ delete_proxy_session (stream_session_t * s, int is_active_open)
 	{
 	  ps = pool_elt_at_index (bpm->sessions, p[0]);
 	  if (ps->vpp_server_handle != ~0)
-	    active_open_session = stream_session_get_from_handle
+	    active_open_session = session_get_from_handle
 	      (ps->vpp_server_handle);
 	  else
 	    active_open_session = 0;
diff --git a/src/vnet/tcp/builtin_server.c b/src/vnet/tcp/builtin_server.c
index 93314529973..b4a52c67fcd 100644
--- a/src/vnet/tcp/builtin_server.c
+++ b/src/vnet/tcp/builtin_server.c
@@ -272,7 +272,7 @@ create_api_loopback (vlib_main_t * vm)
 }
 
 static int
-server_attach ()
+server_attach (u8 * appns_id, u64 appns_flags, u64 appns_secret)
 {
   builtin_server_main_t *bsm = &builtin_server_main;
   u8 segment_name[128];
@@ -300,7 +300,12 @@ server_attach ()
     bsm->prealloc_fifos ? bsm->prealloc_fifos : 1;
 
   a->options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_BUILTIN_APP;
-
+  if (appns_id)
+    {
+      a->namespace_id = appns_id;
+      a->options[APP_OPTIONS_FLAGS] |= appns_flags;
+      a->options[APP_OPTIONS_NAMESPACE_SECRET] = appns_secret;
+    }
   a->segment_name = segment_name;
   a->segment_name_length = ARRAY_LEN (segment_name);
 
@@ -325,7 +330,8 @@ server_listen ()
 }
 
 static int
-server_create (vlib_main_t * vm)
+server_create (vlib_main_t * vm, u8 * appns_id, u64 appns_flags,
+	       u64 appns_secret)
 {
   builtin_server_main_t *bsm = &builtin_server_main;
   vlib_thread_main_t *vtm = vlib_get_thread_main ();
@@ -349,7 +355,7 @@ server_create (vlib_main_t * vm)
   for (i = 0; i < num_threads; i++)
     vec_validate (bsm->rx_buf[i], bsm->rcv_buffer_size);
 
-  if (server_attach ())
+  if (server_attach (appns_id, appns_flags, appns_secret))
     {
       clib_warning ("failed to attach server");
       return -1;
@@ -367,9 +373,9 @@ server_create_command_fn (vlib_main_t * vm, unformat_input_t * input,
 			  vlib_cli_command_t * cmd)
 {
   builtin_server_main_t *bsm = &builtin_server_main;
-  u8 server_uri_set = 0;
+  u8 server_uri_set = 0, *appns_id = 0;
+  u64 tmp, appns_flags = 0, appns_secret = 0;
   int rv;
-  u64 tmp;
 
   bsm->no_echo = 0;
   bsm->fifo_size = 64 << 10;
@@ -402,6 +408,17 @@ server_create_command_fn (vlib_main_t * vm, unformat_input_t * input,
 	}
       else if (unformat (input, "uri %s", &bsm->server_uri))
 	server_uri_set = 1;
+      else if (unformat (input, "appns %_%v%_", &appns_id))
+	;
+      else if (unformat (input, "all-scope"))
+	appns_flags |= (APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE
+			| APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE);
+      else if (unformat (input, "local-scope"))
+	appns_flags |= APP_OPTIONS_FLAGS_USE_LOCAL_SCOPE;
+      else if (unformat (input, "global-scope"))
+	appns_flags |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE;
+      else if (unformat (input, "secret %lu", &appns_secret))
+	;
       else
 	return clib_error_return (0, "unknown input `%U'",
 				  format_unformat_error, input);
@@ -412,7 +429,8 @@ server_create_command_fn (vlib_main_t * vm, unformat_input_t * input,
   if (!server_uri_set)
     bsm->server_uri = (char *) format (0, "tcp://0.0.0.0/1234%c", 0);
 
-  rv = server_create (vm);
+  rv = server_create (vm, appns_id, appns_flags, appns_secret);
+  vec_free (appns_id);
   switch (rv)
     {
     case 0:
diff --git a/src/vnet/tcp/tcp.c b/src/vnet/tcp/tcp.c
index 2a705d01b4c..52e945a262b 100644
--- a/src/vnet/tcp/tcp.c
+++ b/src/vnet/tcp/tcp.c
@@ -28,11 +28,45 @@
 
 tcp_main_t tcp_main;
 
+void *
+ip_interface_get_first_ip (u32 sw_if_index, u8 is_ip4)
+{
+  ip_lookup_main_t *lm4 = &ip4_main.lookup_main;
+  ip_lookup_main_t *lm6 = &ip6_main.lookup_main;
+  ip_interface_address_t *ia = 0;
+
+  if (is_ip4)
+    {
+      /* *INDENT-OFF* */
+      foreach_ip_interface_address (lm4, ia, sw_if_index, 1 /* unnumbered */ ,
+      ({
+        return ip_interface_address_get_address (lm4, ia);
+      }));
+      /* *INDENT-ON* */
+    }
+  else
+    {
+      /* *INDENT-OFF* */
+      foreach_ip_interface_address (lm6, ia, sw_if_index, 1 /* unnumbered */ ,
+      ({
+        ip6_address_t *rv;
+        rv = ip_interface_address_get_address (lm6, ia);
+        /* Trying to use a link-local ip6 src address is a fool's errand */
+        if (!ip6_address_is_link_local_unicast (rv))
+          return rv;
+      }));
+      /* *INDENT-ON* */
+    }
+
+  return 0;
+}
+
 static u32
 tcp_connection_bind (u32 session_index, transport_endpoint_t * lcl)
 {
   tcp_main_t *tm = &tcp_main;
   tcp_connection_t *listener;
+  void *iface_ip;
 
   pool_get (tm->listener_pool, listener);
   memset (listener, 0, sizeof (*listener));
@@ -40,19 +74,18 @@ tcp_connection_bind (u32 session_index, transport_endpoint_t * lcl)
   listener->c_c_index = listener - tm->listener_pool;
   listener->c_lcl_port = lcl->port;
 
-  if (lcl->is_ip4)
+  /* If we are provided a sw_if_index, bind using one of its ips */
+  if (ip_is_zero (&lcl->ip, 1) && lcl->sw_if_index != ENDPOINT_INVALID_INDEX)
     {
-      listener->c_lcl_ip4.as_u32 = lcl->ip.ip4.as_u32;
-      listener->c_is_ip4 = 1;
-    }
-  else
-    {
-      clib_memcpy (&listener->c_lcl_ip6, &lcl->ip.ip6,
-		   sizeof (ip6_address_t));
-
+      if ((iface_ip = ip_interface_get_first_ip (lcl->sw_if_index,
+						 lcl->is_ip4)))
+	ip_set (&lcl->ip, iface_ip, lcl->is_ip4);
     }
+  ip_copy (&listener->c_lcl_ip, &lcl->ip, lcl->is_ip4);
+  listener->c_is_ip4 = lcl->is_ip4;
   listener->c_transport_proto = TRANSPORT_PROTO_TCP;
   listener->c_s_index = session_index;
+  listener->c_fib_index = lcl->fib_index;
   listener->state = TCP_STATE_LISTEN;
 
   tcp_connection_timers_init (listener);
@@ -355,39 +388,6 @@ tcp_session_cleanup (u32 conn_index, u32 thread_index)
   tcp_timer_update (tc, TCP_TIMER_WAITCLOSE, TCP_CLEANUP_TIME);
 }
 
-void *
-ip_interface_get_first_ip (u32 sw_if_index, u8 is_ip4)
-{
-  ip_lookup_main_t *lm4 = &ip4_main.lookup_main;
-  ip_lookup_main_t *lm6 = &ip6_main.lookup_main;
-  ip_interface_address_t *ia = 0;
-
-  if (is_ip4)
-    {
-      /* *INDENT-OFF* */
-      foreach_ip_interface_address (lm4, ia, sw_if_index, 1 /* unnumbered */ ,
-      ({
-        return ip_interface_address_get_address (lm4, ia);
-      }));
-      /* *INDENT-ON* */
-    }
-  else
-    {
-      /* *INDENT-OFF* */
-      foreach_ip_interface_address (lm6, ia, sw_if_index, 1 /* unnumbered */ ,
-      ({
-        ip6_address_t *rv;
-        rv = ip_interface_address_get_address (lm6, ia);
-        /* Trying to use a link-local ip6 src address is a fool's errand */
-        if (!ip6_address_is_link_local_unicast (rv))
-          return rv;
-      }));
-      /* *INDENT-ON* */
-    }
-
-  return 0;
-}
-
 #define PORT_MASK ((1 << 16)- 1)
 /**
  * Allocate local port and add if successful add entry to local endpoint
@@ -528,7 +528,7 @@ tcp_lookup_rmt_in_fib (tcp_connection_t * tc)
   clib_memcpy (&prefix.fp_addr, &tc->c_rmt_ip, sizeof (prefix.fp_addr));
   prefix.fp_proto = tc->c_is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
   prefix.fp_len = tc->c_is_ip4 ? 32 : 128;
-  fib_index = fib_table_find (prefix.fp_proto, tc->c_vrf);
+  fib_index = fib_table_find (prefix.fp_proto, tc->c_fib_index);
   return fib_table_lookup (fib_index, &prefix);
 }
 
@@ -575,6 +575,7 @@ tcp_init_snd_vars (tcp_connection_t * tc)
   u32 time_now;
 
   /* Set random initial sequence */
+  tcp_set_time_now (0);
   time_now = tcp_time_now ();
   tc->iss = random_u32 (&time_now);
   tc->snd_una = tc->iss;
@@ -606,7 +607,7 @@ tcp_connection_open (transport_endpoint_t * rmt)
   tcp_connection_t *tc;
   fib_prefix_t prefix;
   fib_node_index_t fei;
-  u32 sw_if_index, fib_index;
+  u32 sw_if_index;
   ip46_address_t lcl_addr;
   int lcl_port;
 
@@ -620,14 +621,8 @@ tcp_connection_open (transport_endpoint_t * rmt)
   prefix.fp_proto = rmt->is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
   prefix.fp_len = rmt->is_ip4 ? 32 : 128;
 
-  fib_index = fib_table_find (prefix.fp_proto, rmt->vrf);
-  if (fib_index == (u32) ~ 0)
-    {
-      clib_warning ("no fib table");
-      return -1;
-    }
-
-  fei = fib_table_lookup (fib_index, &prefix);
+  ASSERT (rmt->fib_index != ENDPOINT_INVALID_INDEX);
+  fei = fib_table_lookup (rmt->fib_index, &prefix);
 
   /* Couldn't find route to destination. Bail out. */
   if (fei == FIB_NODE_INDEX_INVALID)
@@ -636,12 +631,14 @@ tcp_connection_open (transport_endpoint_t * rmt)
       return -1;
     }
 
-  sw_if_index = fib_entry_get_resolving_interface (fei);
+  sw_if_index = rmt->sw_if_index;
+  if (sw_if_index == ENDPOINT_INVALID_INDEX)
+    sw_if_index = fib_entry_get_resolving_interface (fei);
 
-  if (sw_if_index == (u32) ~ 0)
+  if (sw_if_index == ENDPOINT_INVALID_INDEX)
     {
       clib_warning ("no resolving interface for %U", format_ip46_address,
-		    &rmt->ip, IP46_TYPE_IP4);
+		    &rmt->ip, (rmt->is_ip4 == 0) + 1);
       return -1;
     }
 
@@ -709,7 +706,7 @@ tcp_connection_open (transport_endpoint_t * rmt)
   tc->c_lcl_port = clib_host_to_net_u16 (lcl_port);
   tc->c_is_ip4 = rmt->is_ip4;
   tc->c_transport_proto = TRANSPORT_PROTO_TCP;
-  tc->c_vrf = rmt->vrf;
+  tc->c_fib_index = rmt->fib_index;
   /* The other connection vars will be initialized after SYN ACK */
   tcp_connection_timers_init (tc);
 
diff --git a/src/vnet/tcp/tcp_input.c b/src/vnet/tcp/tcp_input.c
index 1679f818947..3a32e62d243 100644
--- a/src/vnet/tcp/tcp_input.c
+++ b/src/vnet/tcp/tcp_input.c
@@ -1469,7 +1469,7 @@ tcp_session_enqueue_ooo (tcp_connection_t * tc, vlib_buffer_t * b,
       ooo_segment_t *newest;
       u32 start, end;
 
-      s0 = stream_session_get (tc->c_s_index, tc->c_thread_index);
+      s0 = session_get (tc->c_s_index, tc->c_thread_index);
 
       /* Get the newest segment from the fifo */
       newest = svm_fifo_newest_ooo_segment (s0->server_rx_fifo);
@@ -1859,7 +1859,9 @@ vlib_node_registration_t tcp6_syn_sent_node;
 static u8
 tcp_lookup_is_valid (tcp_connection_t * tc, tcp_header_t * hdr)
 {
-  transport_connection_t *tmp;
+  transport_connection_t *tmp = 0;
+  u64 handle;
+
   if (!tc)
     return 1;
 
@@ -1869,15 +1871,17 @@ tcp_lookup_is_valid (tcp_connection_t * tc, tcp_header_t * hdr)
 
   if (!is_valid)
     {
-      if ((tmp =
-	   stream_session_half_open_lookup (&tc->c_lcl_ip, &tc->c_rmt_ip,
-					    tc->c_lcl_port, tc->c_rmt_port,
-					    tc->c_transport_proto)))
+      handle = session_lookup_half_open_handle (&tc->connection);
+      tmp = session_lookup_half_open_connection (handle & 0xFFFFFFFF,
+						 tc->c_transport_proto,
+						 tc->c_is_ip4);
+
+      if (tmp)
 	{
 	  if (tmp->lcl_port == hdr->dst_port
 	      && tmp->rmt_port == hdr->src_port)
 	    {
-	      clib_warning ("half-open is valid!");
+	      TCP_DBG ("half-open is valid!");
 	    }
 	}
     }
@@ -1888,7 +1892,8 @@ tcp_lookup_is_valid (tcp_connection_t * tc, tcp_header_t * hdr)
  * Lookup transport connection
  */
 static tcp_connection_t *
-tcp_lookup_connection (vlib_buffer_t * b, u8 thread_index, u8 is_ip4)
+tcp_lookup_connection (u32 fib_index, vlib_buffer_t * b, u8 thread_index,
+		       u8 is_ip4)
 {
   tcp_header_t *tcp;
   transport_connection_t *tconn;
@@ -1898,12 +1903,13 @@ tcp_lookup_connection (vlib_buffer_t * b, u8 thread_index, u8 is_ip4)
       ip4_header_t *ip4;
       ip4 = vlib_buffer_get_current (b);
       tcp = ip4_next_header (ip4);
-      tconn = stream_session_lookup_transport_wt4 (&ip4->dst_address,
-						   &ip4->src_address,
-						   tcp->dst_port,
-						   tcp->src_port,
-						   SESSION_TYPE_IP4_TCP,
-						   thread_index);
+      tconn = session_lookup_connection_wt4 (fib_index,
+					     &ip4->dst_address,
+					     &ip4->src_address,
+					     tcp->dst_port,
+					     tcp->src_port,
+					     TRANSPORT_PROTO_TCP,
+					     thread_index);
       tc = tcp_get_connection_from_transport (tconn);
       ASSERT (tcp_lookup_is_valid (tc, tcp));
     }
@@ -1912,12 +1918,13 @@ tcp_lookup_connection (vlib_buffer_t * b, u8 thread_index, u8 is_ip4)
       ip6_header_t *ip6;
       ip6 = vlib_buffer_get_current (b);
       tcp = ip6_next_header (ip6);
-      tconn = stream_session_lookup_transport_wt6 (&ip6->dst_address,
-						   &ip6->src_address,
-						   tcp->dst_port,
-						   tcp->src_port,
-						   SESSION_TYPE_IP6_TCP,
-						   thread_index);
+      tconn = session_lookup_connection_wt6 (fib_index,
+					     &ip6->dst_address,
+					     &ip6->src_address,
+					     tcp->dst_port,
+					     tcp->src_port,
+					     TRANSPORT_PROTO_TCP,
+					     thread_index);
       tc = tcp_get_connection_from_transport (tconn);
       ASSERT (tcp_lookup_is_valid (tc, tcp));
     }
@@ -1975,7 +1982,8 @@ tcp46_syn_sent_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  if (PREDICT_FALSE (tc0->flags & TCP_CONN_HALF_OPEN_DONE))
 	    {
 	      /* Make sure the connection actually exists */
-	      ASSERT (tcp_lookup_connection (b0, my_thread_index, is_ip4));
+	      ASSERT (tcp_lookup_connection (tc0->c_fib_index, b0,
+					     my_thread_index, is_ip4));
 	      goto drop;
 	    }
 
@@ -2309,7 +2317,9 @@ tcp46_rcv_process_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  if (CLIB_DEBUG)
 	    {
 	      tcp_connection_t *tmp;
-	      tmp = tcp_lookup_connection (b0, my_thread_index, is_ip4);
+	      tmp =
+		tcp_lookup_connection (tc0->c_fib_index, b0, my_thread_index,
+				       is_ip4);
 	      if (tmp->state != tc0->state)
 		{
 		  clib_warning ("state changed");
@@ -2657,7 +2667,6 @@ tcp46_listen_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 {
   u32 n_left_from, next_index, *from, *to_next;
   u32 my_thread_index = vm->thread_index;
-  u8 sst = is_ip4 ? SESSION_TYPE_IP4_TCP : SESSION_TYPE_IP6_TCP;
 
   from = vlib_frame_vector_args (from_frame);
   n_left_from = from_frame->n_vectors;
@@ -2719,7 +2728,9 @@ tcp46_listen_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  /* 3. check for a SYN (did that already) */
 
 	  /* Make sure connection wasn't just created */
-	  child0 = tcp_lookup_connection (b0, my_thread_index, is_ip4);
+	  child0 =
+	    tcp_lookup_connection (lc0->c_fib_index, b0, my_thread_index,
+				   is_ip4);
 	  if (PREDICT_FALSE (child0->state != TCP_STATE_LISTEN))
 	    {
 	      error0 = TCP_ERROR_CREATE_EXISTS;
@@ -2746,7 +2757,7 @@ tcp46_listen_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 			   sizeof (ip6_address_t));
 	    }
 
-	  if (stream_session_accept (&child0->connection, lc0->c_s_index, sst,
+	  if (stream_session_accept (&child0->connection, lc0->c_s_index,
 				     0 /* notify */ ))
 	    {
 	      clib_warning ("session accept fail");
@@ -2924,7 +2935,7 @@ tcp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
       while (n_left_from > 0 && n_left_to_next > 0)
 	{
 	  int n_advance_bytes0, n_data_bytes0;
-	  u32 bi0;
+	  u32 bi0, fib_index0;
 	  vlib_buffer_t *b0;
 	  tcp_header_t *tcp0 = 0;
 	  tcp_connection_t *tc0;
@@ -2943,6 +2954,7 @@ tcp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 
 	  b0 = vlib_get_buffer (vm, bi0);
 	  vnet_buffer (b0)->tcp.flags = 0;
+	  fib_index0 = vnet_buffer (b0)->ip.fib_index;
 
 	  /* Checksum computed by ipx_local no need to compute again */
 
@@ -2954,12 +2966,12 @@ tcp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 				  + tcp_header_bytes (tcp0));
 	      n_data_bytes0 = clib_net_to_host_u16 (ip40->length)
 		- n_advance_bytes0;
-	      tconn = stream_session_lookup_transport_wt4 (&ip40->dst_address,
-							   &ip40->src_address,
-							   tcp0->dst_port,
-							   tcp0->src_port,
-							   SESSION_TYPE_IP4_TCP,
-							   my_thread_index);
+	      tconn =
+		session_lookup_connection_wt4 (fib_index0, &ip40->dst_address,
+					       &ip40->src_address,
+					       tcp0->dst_port, tcp0->src_port,
+					       TRANSPORT_PROTO_TCP,
+					       my_thread_index);
 	      tc0 = tcp_get_connection_from_transport (tconn);
 	      ASSERT (tcp_lookup_is_valid (tc0, tcp0));
 	    }
@@ -2971,12 +2983,12 @@ tcp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      n_data_bytes0 = clib_net_to_host_u16 (ip60->payload_length)
 		- n_advance_bytes0;
 	      n_advance_bytes0 += sizeof (ip60[0]);
-	      tconn = stream_session_lookup_transport_wt6 (&ip60->dst_address,
-							   &ip60->src_address,
-							   tcp0->dst_port,
-							   tcp0->src_port,
-							   SESSION_TYPE_IP6_TCP,
-							   my_thread_index);
+	      tconn =
+		session_lookup_connection_wt6 (fib_index0, &ip60->dst_address,
+					       &ip60->src_address,
+					       tcp0->dst_port, tcp0->src_port,
+					       TRANSPORT_PROTO_TCP,
+					       my_thread_index);
 	      tc0 = tcp_get_connection_from_transport (tconn);
 	      ASSERT (tcp_lookup_is_valid (tc0, tcp0));
 	    }
diff --git a/src/vnet/tcp/tcp_output.c b/src/vnet/tcp/tcp_output.c
index e921a4a13ea..3509ad4701d 100644
--- a/src/vnet/tcp/tcp_output.c
+++ b/src/vnet/tcp/tcp_output.c
@@ -1741,8 +1741,7 @@ tcp_fast_retransmit (tcp_connection_t * tc)
 always_inline u32
 tcp_session_has_ooo_data (tcp_connection_t * tc)
 {
-  stream_session_t *s =
-    stream_session_get (tc->c_s_index, tc->c_thread_index);
+  stream_session_t *s = session_get (tc->c_s_index, tc->c_thread_index);
   return svm_fifo_has_ooo_data (s->server_rx_fifo);
 }
 
diff --git a/src/vnet/tcp/tcp_test.c b/src/vnet/tcp/tcp_test.c
index 37640cc61b9..2018855840f 100644
--- a/src/vnet/tcp/tcp_test.c
+++ b/src/vnet/tcp/tcp_test.c
@@ -1597,11 +1597,11 @@ tcp_test_lookup (vlib_main_t * vm, unformat_input_t * input)
    * Confirm that connection lookup works
    */
 
-  stream_session_table_add_for_tc (tc1, tc1->s_index);
-  tconn = stream_session_lookup_transport_wt4 (&tc1->lcl_ip.ip4,
-					       &tc1->rmt_ip.ip4,
-					       tc1->lcl_port, tc1->rmt_port,
-					       tc1->transport_proto, 0);
+  session_lookup_add_connection (tc1, tc1->s_index);
+  tconn = session_lookup_connection_wt4 (0, &tc1->lcl_ip.ip4,
+					 &tc1->rmt_ip.ip4,
+					 tc1->lcl_port, tc1->rmt_port,
+					 tc1->transport_proto, 0);
   cmp = (memcmp (&tconn->rmt_ip, &tc1->rmt_ip, sizeof (tc1->rmt_ip)) == 0);
   TCP_TEST ((cmp), "rmt ip is identical %d", cmp);
   TCP_TEST ((tconn->lcl_port == tc1->lcl_port),
@@ -1611,35 +1611,35 @@ tcp_test_lookup (vlib_main_t * vm, unformat_input_t * input)
    * Non-existing connection lookup should not work
    */
 
-  tconn = stream_session_lookup_transport_wt4 (&tc2->lcl_ip.ip4,
-					       &tc2->rmt_ip.ip4,
-					       tc2->lcl_port, tc2->rmt_port,
-					       tc2->transport_proto, 0);
+  tconn = session_lookup_connection_wt4 (0, &tc2->lcl_ip.ip4,
+					 &tc2->rmt_ip.ip4,
+					 tc2->lcl_port, tc2->rmt_port,
+					 tc2->transport_proto, 0);
   TCP_TEST ((tconn == 0), "lookup result should be null");
 
   /*
    * Delete and lookup again
    */
-  stream_session_table_del_for_tc (tc1);
-  tconn = stream_session_lookup_transport_wt4 (&tc1->lcl_ip.ip4,
-					       &tc1->rmt_ip.ip4,
-					       tc1->lcl_port, tc1->rmt_port,
-					       tc1->transport_proto, 0);
+  session_lookup_del_connection (tc1);
+  tconn = session_lookup_connection_wt4 (0, &tc1->lcl_ip.ip4,
+					 &tc1->rmt_ip.ip4,
+					 tc1->lcl_port, tc1->rmt_port,
+					 tc1->transport_proto, 0);
   TCP_TEST ((tconn == 0), "lookup result should be null");
-  tconn = stream_session_lookup_transport_wt4 (&tc2->lcl_ip.ip4,
-					       &tc2->rmt_ip.ip4,
-					       tc2->lcl_port, tc2->rmt_port,
-					       tc2->transport_proto, 0);
+  tconn = session_lookup_connection_wt4 (0, &tc2->lcl_ip.ip4,
+					 &tc2->rmt_ip.ip4,
+					 tc2->lcl_port, tc2->rmt_port,
+					 tc2->transport_proto, 0);
   TCP_TEST ((tconn == 0), "lookup result should be null");
 
   /*
    * Re-add and lookup tc2
    */
-  stream_session_table_add_for_tc (tc1, tc1->s_index);
-  tconn = stream_session_lookup_transport_wt4 (&tc2->lcl_ip.ip4,
-					       &tc2->rmt_ip.ip4,
-					       tc2->lcl_port, tc2->rmt_port,
-					       tc2->transport_proto, 0);
+  session_lookup_add_connection (tc1, tc1->s_index);
+  tconn = session_lookup_connection_wt4 (0, &tc2->lcl_ip.ip4,
+					 &tc2->rmt_ip.ip4,
+					 tc2->lcl_port, tc2->rmt_port,
+					 tc2->transport_proto, 0);
   TCP_TEST ((tconn == 0), "lookup result should be null");
 
   return 0;
@@ -1650,7 +1650,6 @@ tcp_test_session (vlib_main_t * vm, unformat_input_t * input)
 {
   int rv = 0;
   tcp_connection_t *tc0;
-  u8 sst = SESSION_TYPE_IP4_TCP;
   ip4_address_t local, remote;
   u16 local_port, remote_port;
   tcp_main_t *tm = vnet_get_tcp_main ();
@@ -1692,7 +1691,7 @@ tcp_test_session (vlib_main_t * vm, unformat_input_t * input)
       TCP_EVT_DBG (TCP_EVT_OPEN, tc0);
 
       if (stream_session_accept (&tc0->connection, 0 /* listener index */ ,
-				 sst, 0 /* notify */ ))
+				 0 /* notify */ ))
 	clib_warning ("stream_session_accept failed");
 
       stream_session_accept_notify (&tc0->connection);