aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorRay Kinsella <mdr@ashroe.eu>2020-03-12 15:52:41 +0000
committerDamjan Marion <dmarion@me.com>2020-09-28 16:40:56 +0000
commit8899ce08bbe345b9c178ab1ffbfec2cd7d132e8f (patch)
tree4a09b25e8a2548dbe5e7079ce80b334ec2acbda3 /src
parentf68fccfe7e188fec2c9f91da38ca9acf6f67d811 (diff)
classify: preformance improvements in classifiers
Reworked the code to reduce line fill buffer pressure. Improved compiler loop unrolling, over the existing complex hand-unrolling. Updated the code to use vlib_get_buffers & vlib_buffer_enqueue_to_next. Type: improvement Signed-off-by: Ray Kinsella <mdr@ashroe.eu> Change-Id: I7dca7515ba91672eaf50a6eecd13811210cf0006
Diffstat (limited to 'src')
-rw-r--r--src/vnet/ip/ip_in_out_acl.c934
1 files changed, 649 insertions, 285 deletions
diff --git a/src/vnet/ip/ip_in_out_acl.c b/src/vnet/ip/ip_in_out_acl.c
index 8f550e29b9e..2f73e1307dc 100644
--- a/src/vnet/ip/ip_in_out_acl.c
+++ b/src/vnet/ip/ip_in_out_acl.c
@@ -22,7 +22,8 @@ typedef struct
u32 next_index;
u32 table_index;
u32 offset;
-} ip_in_out_acl_trace_t;
+}
+ip_in_out_acl_trace_t;
/* packet trace format function */
static u8 *
@@ -71,7 +72,8 @@ typedef enum
foreach_ip_inacl_error
#undef _
IP_INACL_N_ERROR,
-} ip_inacl_error_t;
+}
+ip_inacl_error_t;
static char *ip_inacl_error_strings[] = {
#define _(sym,string) string,
@@ -85,7 +87,8 @@ typedef enum
foreach_ip_outacl_error
#undef _
IP_OUTACL_N_ERROR,
-} ip_outacl_error_t;
+}
+ip_outacl_error_t;
static char *ip_outacl_error_strings[] = {
#define _(sym,string) string,
@@ -93,13 +96,12 @@ static char *ip_outacl_error_strings[] = {
#undef _
};
-static inline uword
+static_always_inline void
ip_in_out_acl_inline (vlib_main_t * vm,
- vlib_node_runtime_t * node, vlib_frame_t * frame,
- int is_ip4, int is_output)
+ vlib_node_runtime_t * node, vlib_buffer_t ** b,
+ u16 * next, u32 n_left, int is_ip4, int is_output,
+ int do_trace)
{
- u32 n_left_from, *from, *to_next;
- acl_next_index_t next_index;
in_out_acl_main_t *am = &in_out_acl_main;
vnet_classify_main_t *vcm = am->vnet_classify_main;
f64 now = vlib_time_now (vm);
@@ -110,6 +112,12 @@ ip_in_out_acl_inline (vlib_main_t * vm,
vlib_node_runtime_t *error_node;
u32 n_next_nodes;
+ u8 *h[4];
+ u32 sw_if_index[4];
+ u32 table_index[4];
+ vnet_classify_table_t *t[4] = { 0, 0 };
+ u64 hash[4];
+
n_next_nodes = node->n_next_nodes;
if (is_ip4)
@@ -123,355 +131,640 @@ ip_in_out_acl_inline (vlib_main_t * vm,
error_node = vlib_node_get_runtime (vm, ip6_input_node.index);
}
- from = vlib_frame_vector_args (frame);
- n_left_from = frame->n_vectors;
+ /* calculate hashes for b[0] & b[1] */
+ if (n_left >= 2)
+ {
+ sw_if_index[2] =
+ vnet_buffer (b[0])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
+ sw_if_index[3] =
+ vnet_buffer (b[1])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
+
+ table_index[2] =
+ am->classify_table_index_by_sw_if_index[is_output][tid]
+ [sw_if_index[2]];
+ table_index[3] =
+ am->classify_table_index_by_sw_if_index[is_output][tid]
+ [sw_if_index[3]];
+
+ t[2] = pool_elt_at_index (vcm->tables, table_index[2]);
+ t[3] = pool_elt_at_index (vcm->tables, table_index[3]);
+
+ if (t[2]->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
+ h[2] =
+ (void *) vlib_buffer_get_current (b[0]) + t[2]->current_data_offset;
+ else
+ h[2] = b[0]->data;
+
+ if (t[3]->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
+ h[3] =
+ (void *) vlib_buffer_get_current (b[1]) + t[3]->current_data_offset;
+ else
+ h[3] = b[1]->data;
+
+ if (is_output)
+ {
+ /* Save the rewrite length, since we are using the l2_classify struct */
+ vnet_buffer (b[0])->l2_classify.pad.l2_len =
+ vnet_buffer (b[0])->ip.save_rewrite_length;
+ /* advance the match pointer so the matching happens on IP header */
+ h[2] += vnet_buffer (b[0])->l2_classify.pad.l2_len;
+
+ /* Save the rewrite length, since we are using the l2_classify struct */
+ vnet_buffer (b[1])->l2_classify.pad.l2_len =
+ vnet_buffer (b[1])->ip.save_rewrite_length;
+ /* advance the match pointer so the matching happens on IP header */
+ h[3] += vnet_buffer (b[1])->l2_classify.pad.l2_len;
+ }
- /* First pass: compute hashes */
+ hash[2] = vnet_classify_hash_packet_inline (t[2], (u8 *) h[2]);
+ hash[3] = vnet_classify_hash_packet_inline (t[3], (u8 *) h[3]);
- while (n_left_from > 2)
+ vnet_buffer (b[0])->l2_classify.hash = hash[2];
+ vnet_buffer (b[1])->l2_classify.hash = hash[3];
+
+ vnet_buffer (b[0])->l2_classify.table_index = table_index[2];
+ vnet_buffer (b[1])->l2_classify.table_index = table_index[3];
+
+ vnet_buffer (b[0])->l2_classify.opaque_index = ~0;
+ vnet_buffer (b[1])->l2_classify.opaque_index = ~0;
+
+ vnet_classify_prefetch_bucket (t[2],
+ vnet_buffer (b[0])->l2_classify.hash);
+ vnet_classify_prefetch_bucket (t[3],
+ vnet_buffer (b[1])->l2_classify.hash);
+ }
+
+ while (n_left >= 2)
{
- vlib_buffer_t *b0, *b1;
- u32 bi0, bi1;
- u8 *h0, *h1;
- u32 sw_if_index0, sw_if_index1;
- u32 table_index0, table_index1;
- vnet_classify_table_t *t0, *t1;
+ vnet_classify_entry_t *e[2] = { 0, 0 };
+ u32 _next[2] = { ACL_NEXT_INDEX_DENY, ACL_NEXT_INDEX_DENY };
+ u8 error[2];
+
+ h[0] = h[2];
+ h[1] = h[3];
+ t[0] = t[2];
+ t[1] = t[3];
+
+ sw_if_index[0] = sw_if_index[2];
+ sw_if_index[1] = sw_if_index[3];
+
+ table_index[0] = table_index[2];
+ table_index[1] = table_index[3];
+
+ hash[0] = hash[2];
+ hash[1] = hash[3];
/* prefetch next iteration */
- {
- vlib_buffer_t *p1, *p2;
+ if (n_left >= 6)
+ {
+ vlib_prefetch_buffer_header (b[4], LOAD);
+ vlib_prefetch_buffer_header (b[5], LOAD);
- p1 = vlib_get_buffer (vm, from[1]);
- p2 = vlib_get_buffer (vm, from[2]);
+ CLIB_PREFETCH (b[4]->data, CLIB_CACHE_LINE_BYTES, LOAD);
+ CLIB_PREFETCH (b[5]->data, CLIB_CACHE_LINE_BYTES, LOAD);
+ }
- vlib_prefetch_buffer_header (p1, STORE);
- CLIB_PREFETCH (p1->data, CLIB_CACHE_LINE_BYTES, STORE);
- vlib_prefetch_buffer_header (p2, STORE);
- CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, STORE);
- }
+ /* calculate hashes for b[2] & b[3] */
+ if (n_left >= 4)
+ {
+ sw_if_index[2] =
+ vnet_buffer (b[2])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
+ sw_if_index[3] =
+ vnet_buffer (b[3])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
+
+ table_index[2] =
+ am->classify_table_index_by_sw_if_index[is_output][tid]
+ [sw_if_index[2]];
+ table_index[3] =
+ am->classify_table_index_by_sw_if_index[is_output][tid]
+ [sw_if_index[3]];
+
+ t[2] = pool_elt_at_index (vcm->tables, table_index[2]);
+ t[3] = pool_elt_at_index (vcm->tables, table_index[3]);
+
+ if (t[2]->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
+ h[2] =
+ (void *) vlib_buffer_get_current (b[2]) +
+ t[2]->current_data_offset;
+ else
+ h[2] = b[2]->data;
+
+ if (t[3]->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
+ h[3] =
+ (void *) vlib_buffer_get_current (b[3]) +
+ t[3]->current_data_offset;
+ else
+ h[3] = b[3]->data;
+
+ if (is_output)
+ {
+ /* Save the rewrite length, since we are using the l2_classify struct */
+ vnet_buffer (b[2])->l2_classify.pad.l2_len =
+ vnet_buffer (b[2])->ip.save_rewrite_length;
+ /* advance the match pointer so the matching happens on IP header */
+ h[2] += vnet_buffer (b[2])->l2_classify.pad.l2_len;
- bi0 = from[0];
- b0 = vlib_get_buffer (vm, bi0);
+ /* Save the rewrite length, since we are using the l2_classify struct */
+ vnet_buffer (b[3])->l2_classify.pad.l2_len =
+ vnet_buffer (b[3])->ip.save_rewrite_length;
+ /* advance the match pointer so the matching happens on IP header */
+ h[3] += vnet_buffer (b[3])->l2_classify.pad.l2_len;
+ }
- bi1 = from[1];
- b1 = vlib_get_buffer (vm, bi1);
+ hash[2] = vnet_classify_hash_packet_inline (t[2], (u8 *) h[2]);
+ hash[3] = vnet_classify_hash_packet_inline (t[3], (u8 *) h[3]);
- sw_if_index0 =
- vnet_buffer (b0)->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
- table_index0 =
- am->classify_table_index_by_sw_if_index[is_output][tid][sw_if_index0];
+ vnet_buffer (b[2])->l2_classify.hash = hash[2];
+ vnet_buffer (b[3])->l2_classify.hash = hash[3];
- sw_if_index1 =
- vnet_buffer (b1)->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
- table_index1 =
- am->classify_table_index_by_sw_if_index[is_output][tid][sw_if_index1];
+ vnet_buffer (b[2])->l2_classify.table_index = table_index[2];
+ vnet_buffer (b[3])->l2_classify.table_index = table_index[3];
- t0 = pool_elt_at_index (vcm->tables, table_index0);
+ vnet_buffer (b[2])->l2_classify.opaque_index = ~0;
+ vnet_buffer (b[3])->l2_classify.opaque_index = ~0;
- t1 = pool_elt_at_index (vcm->tables, table_index1);
+ vnet_classify_prefetch_bucket (t[2],
+ vnet_buffer (b[2])->
+ l2_classify.hash);
+ vnet_classify_prefetch_bucket (t[3],
+ vnet_buffer (b[3])->
+ l2_classify.hash);
+ }
- if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
- h0 = (void *) vlib_buffer_get_current (b0) + t0->current_data_offset;
- else
- h0 = b0->data;
+ /* find entry for b[0] & b[1] */
+ vnet_get_config_data (am->vnet_config_main[is_output][tid],
+ &b[0]->current_config_index, &_next[0],
+ /* # bytes of config data */ 0);
+ vnet_get_config_data (am->vnet_config_main[is_output][tid],
+ &b[1]->current_config_index, &_next[1],
+ /* # bytes of config data */ 0);
- if (is_output)
+ if (PREDICT_TRUE (table_index[0] != ~0))
{
- /* Save the rewrite length, since we are using the l2_classify struct */
- vnet_buffer (b0)->l2_classify.pad.l2_len =
- vnet_buffer (b0)->ip.save_rewrite_length;
- /* advance the match pointer so the matching happens on IP header */
- h0 += vnet_buffer (b0)->l2_classify.pad.l2_len;
+ e[0] =
+ vnet_classify_find_entry_inline (t[0], (u8 *) h[0], hash[0], now);
+ if (e[0])
+ {
+ vnet_buffer (b[0])->l2_classify.opaque_index
+ = e[0]->opaque_index;
+ vlib_buffer_advance (b[0], e[0]->advance);
+
+ _next[0] = (e[0]->next_index < n_next_nodes) ?
+ e[0]->next_index : _next[0];
+
+ hits++;
+
+ if (is_ip4)
+ error[0] = (_next[0] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_SESSION_DENY :
+ IP4_ERROR_INACL_SESSION_DENY) : IP4_ERROR_NONE;
+ else
+ error[0] = (_next[0] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_SESSION_DENY :
+ IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
+ b[0]->error = error_node->errors[error[0]];
+
+ if (!is_output)
+ {
+ if (e[0]->action == CLASSIFY_ACTION_SET_IP4_FIB_INDEX ||
+ e[0]->action == CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
+ vnet_buffer (b[0])->sw_if_index[VLIB_TX] = e[0]->metadata;
+ else if (e[0]->action == CLASSIFY_ACTION_SET_METADATA)
+ vnet_buffer (b[0])->ip.adj_index[VLIB_TX] =
+ e[0]->metadata;
+ }
+ }
+ else
+ {
+ while (1)
+ {
+ if (PREDICT_TRUE (t[0]->next_table_index != ~0))
+ t[0] = pool_elt_at_index (vcm->tables,
+ t[0]->next_table_index);
+ else
+ {
+ _next[0] = (t[0]->miss_next_index < n_next_nodes) ?
+ t[0]->miss_next_index : _next[0];
+
+ misses++;
+
+ if (is_ip4)
+ error[0] = (_next[0] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_TABLE_MISS :
+ IP4_ERROR_INACL_TABLE_MISS) : IP4_ERROR_NONE;
+ else
+ error[0] = (_next[0] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_TABLE_MISS :
+ IP6_ERROR_INACL_TABLE_MISS) : IP6_ERROR_NONE;
+ b[0]->error = error_node->errors[error[0]];
+ break;
+ }
+
+ if (t[0]->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
+ h[0] =
+ (void *) vlib_buffer_get_current (b[0]) +
+ t[0]->current_data_offset;
+ else
+ h[0] = b[0]->data;
+
+ /* advance the match pointer so the matching happens on IP header */
+ if (is_output)
+ h[0] += vnet_buffer (b[0])->l2_classify.pad.l2_len;
+
+ hash[0] =
+ vnet_classify_hash_packet_inline (t[0], (u8 *) h[0]);
+ e[0] =
+ vnet_classify_find_entry_inline (t[0], (u8 *) h[0],
+ hash[0], now);
+ if (e[0])
+ {
+ vnet_buffer (b[0])->l2_classify.opaque_index
+ = e[0]->opaque_index;
+ vlib_buffer_advance (b[0], e[0]->advance);
+ _next[0] = (e[0]->next_index < n_next_nodes) ?
+ e[0]->next_index : _next[0];
+ hits++;
+ chain_hits++;
+
+ if (is_ip4)
+ error[0] = (_next[0] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_SESSION_DENY :
+ IP4_ERROR_INACL_SESSION_DENY) : IP4_ERROR_NONE;
+ else
+ error[0] = (_next[0] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_SESSION_DENY :
+ IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
+ b[0]->error = error_node->errors[error[0]];
+
+ if (!is_output)
+ {
+ if (e[0]->action ==
+ CLASSIFY_ACTION_SET_IP4_FIB_INDEX
+ || e[0]->action ==
+ CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
+ vnet_buffer (b[0])->sw_if_index[VLIB_TX] =
+ e[0]->metadata;
+ else if (e[0]->action ==
+ CLASSIFY_ACTION_SET_METADATA)
+ vnet_buffer (b[0])->ip.adj_index[VLIB_TX] =
+ e[0]->metadata;
+ }
+ break;
+ }
+ }
+ }
}
- vnet_buffer (b0)->l2_classify.hash =
- vnet_classify_hash_packet (t0, (u8 *) h0);
+ if (PREDICT_TRUE (table_index[1] != ~0))
+ {
+ e[1] =
+ vnet_classify_find_entry_inline (t[1], (u8 *) h[1], hash[1], now);
+ if (e[1])
+ {
+ vnet_buffer (b[1])->l2_classify.opaque_index
+ = e[1]->opaque_index;
+ vlib_buffer_advance (b[1], e[1]->advance);
- vnet_classify_prefetch_bucket (t0, vnet_buffer (b0)->l2_classify.hash);
+ _next[1] = (e[1]->next_index < n_next_nodes) ?
+ e[1]->next_index : _next[1];
- if (t1->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
- h1 = (void *) vlib_buffer_get_current (b1) + t1->current_data_offset;
- else
- h1 = b1->data;
+ hits++;
- if (is_output)
+ if (is_ip4)
+ error[1] = (_next[1] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_SESSION_DENY :
+ IP4_ERROR_INACL_SESSION_DENY) : IP4_ERROR_NONE;
+ else
+ error[1] = (_next[1] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_SESSION_DENY :
+ IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
+ b[1]->error = error_node->errors[error[1]];
+
+ if (!is_output)
+ {
+ if (e[1]->action == CLASSIFY_ACTION_SET_IP4_FIB_INDEX ||
+ e[1]->action == CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
+ vnet_buffer (b[1])->sw_if_index[VLIB_TX] = e[1]->metadata;
+ else if (e[1]->action == CLASSIFY_ACTION_SET_METADATA)
+ vnet_buffer (b[1])->ip.adj_index[VLIB_TX] =
+ e[1]->metadata;
+ }
+ }
+ else
+ {
+ while (1)
+ {
+ if (PREDICT_TRUE (t[1]->next_table_index != ~0))
+ t[1] = pool_elt_at_index (vcm->tables,
+ t[1]->next_table_index);
+ else
+ {
+ _next[1] = (t[1]->miss_next_index < n_next_nodes) ?
+ t[1]->miss_next_index : _next[1];
+
+ misses++;
+
+ if (is_ip4)
+ error[1] = (_next[1] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_TABLE_MISS :
+ IP4_ERROR_INACL_TABLE_MISS) : IP4_ERROR_NONE;
+ else
+ error[1] = (_next[1] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_TABLE_MISS :
+ IP6_ERROR_INACL_TABLE_MISS) : IP6_ERROR_NONE;
+ b[1]->error = error_node->errors[error[1]];
+ break;
+ }
+
+ if (t[1]->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
+ h[1] =
+ (void *) vlib_buffer_get_current (b[1]) +
+ t[1]->current_data_offset;
+ else
+ h[1] = b[1]->data;
+
+ /* advance the match pointer so the matching happens on IP header */
+ if (is_output)
+ h[1] += vnet_buffer (b[1])->l2_classify.pad.l2_len;
+
+ hash[1] =
+ vnet_classify_hash_packet_inline (t[1], (u8 *) h[1]);
+ e[1] =
+ vnet_classify_find_entry_inline (t[1], (u8 *) h[1],
+ hash[1], now);
+ if (e[1])
+ {
+ vnet_buffer (b[1])->l2_classify.opaque_index
+ = e[1]->opaque_index;
+ vlib_buffer_advance (b[1], e[1]->advance);
+ _next[1] = (e[1]->next_index < n_next_nodes) ?
+ e[1]->next_index : _next[1];
+ hits++;
+ chain_hits++;
+
+ if (is_ip4)
+ error[1] = (_next[1] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_SESSION_DENY :
+ IP4_ERROR_INACL_SESSION_DENY) : IP4_ERROR_NONE;
+ else
+ error[1] = (_next[1] == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_SESSION_DENY :
+ IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
+ b[1]->error = error_node->errors[error[1]];
+
+ if (!is_output)
+ {
+ if (e[1]->action ==
+ CLASSIFY_ACTION_SET_IP4_FIB_INDEX
+ || e[1]->action ==
+ CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
+ vnet_buffer (b[1])->sw_if_index[VLIB_TX] =
+ e[1]->metadata;
+ else if (e[1]->action ==
+ CLASSIFY_ACTION_SET_METADATA)
+ vnet_buffer (b[1])->ip.adj_index[VLIB_TX] =
+ e[1]->metadata;
+ }
+ break;
+ }
+ }
+ }
+ }
+
+ if (do_trace && b[0]->flags & VLIB_BUFFER_IS_TRACED)
{
- /* Save the rewrite length, since we are using the l2_classify struct */
- vnet_buffer (b1)->l2_classify.pad.l2_len =
- vnet_buffer (b1)->ip.save_rewrite_length;
- /* advance the match pointer so the matching happens on IP header */
- h1 += vnet_buffer (b1)->l2_classify.pad.l2_len;
+ ip_in_out_acl_trace_t *_t =
+ vlib_add_trace (vm, node, b[0], sizeof (*_t));
+ _t->sw_if_index =
+ vnet_buffer (b[0])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
+ _t->next_index = _next[0];
+ _t->table_index = t[0] ? t[0] - vcm->tables : ~0;
+ _t->offset = (e[0]
+ && t[0]) ? vnet_classify_get_offset (t[0], e[0]) : ~0;
}
- vnet_buffer (b1)->l2_classify.hash =
- vnet_classify_hash_packet (t1, (u8 *) h1);
+ if (do_trace && b[1]->flags & VLIB_BUFFER_IS_TRACED)
+ {
+ ip_in_out_acl_trace_t *_t =
+ vlib_add_trace (vm, node, b[1], sizeof (*_t));
+ _t->sw_if_index =
+ vnet_buffer (b[1])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
+ _t->next_index = _next[1];
+ _t->table_index = t[1] ? t[1] - vcm->tables : ~0;
+ _t->offset = (e[1]
+ && t[1]) ? vnet_classify_get_offset (t[1], e[1]) : ~0;
+ }
- vnet_classify_prefetch_bucket (t1, vnet_buffer (b1)->l2_classify.hash);
+ if ((_next[0] == ACL_NEXT_INDEX_DENY) && is_output)
+ {
+ /* on output, for the drop node to work properly, go back to ip header */
+ vlib_buffer_advance (b[0], vnet_buffer (b[0])->l2.l2_len);
+ }
- vnet_buffer (b0)->l2_classify.table_index = table_index0;
+ if ((_next[1] == ACL_NEXT_INDEX_DENY) && is_output)
+ {
+ /* on output, for the drop node to work properly, go back to ip header */
+ vlib_buffer_advance (b[1], vnet_buffer (b[1])->l2.l2_len);
+ }
- vnet_buffer (b1)->l2_classify.table_index = table_index1;
+ next[0] = _next[0];
+ next[1] = _next[1];
- from += 2;
- n_left_from -= 2;
+ /* _next */
+ next += 2;
+ b += 2;
+ n_left -= 2;
}
- while (n_left_from > 0)
+ while (n_left > 0)
{
- vlib_buffer_t *b0;
- u32 bi0;
u8 *h0;
u32 sw_if_index0;
u32 table_index0;
- vnet_classify_table_t *t0;
-
- bi0 = from[0];
- b0 = vlib_get_buffer (vm, bi0);
+ vnet_classify_table_t *t0 = 0;
+ vnet_classify_entry_t *e0 = 0;
+ u32 next0 = ACL_NEXT_INDEX_DENY;
+ u64 hash0;
+ u8 error0;
sw_if_index0 =
- vnet_buffer (b0)->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
+ vnet_buffer (b[0])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
table_index0 =
am->classify_table_index_by_sw_if_index[is_output][tid][sw_if_index0];
t0 = pool_elt_at_index (vcm->tables, table_index0);
if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
- h0 = (void *) vlib_buffer_get_current (b0) + t0->current_data_offset;
+ h0 =
+ (void *) vlib_buffer_get_current (b[0]) + t0->current_data_offset;
else
- h0 = b0->data;
+ h0 = b[0]->data;
if (is_output)
{
/* Save the rewrite length, since we are using the l2_classify struct */
- vnet_buffer (b0)->l2_classify.pad.l2_len =
- vnet_buffer (b0)->ip.save_rewrite_length;
+ vnet_buffer (b[0])->l2_classify.pad.l2_len =
+ vnet_buffer (b[0])->ip.save_rewrite_length;
/* advance the match pointer so the matching happens on IP header */
- h0 += vnet_buffer (b0)->l2_classify.pad.l2_len;
+ h0 += vnet_buffer (b[0])->l2_classify.pad.l2_len;
}
- vnet_buffer (b0)->l2_classify.hash =
+ vnet_buffer (b[0])->l2_classify.hash =
vnet_classify_hash_packet (t0, (u8 *) h0);
- vnet_buffer (b0)->l2_classify.table_index = table_index0;
- vnet_classify_prefetch_bucket (t0, vnet_buffer (b0)->l2_classify.hash);
+ vnet_buffer (b[0])->l2_classify.table_index = table_index0;
+ vnet_buffer (b[0])->l2_classify.opaque_index = ~0;
- from++;
- n_left_from--;
- }
+ vnet_get_config_data (am->vnet_config_main[is_output][tid],
+ &b[0]->current_config_index, &next0,
+ /* # bytes of config data */ 0);
- next_index = node->cached_next_index;
- from = vlib_frame_vector_args (frame);
- n_left_from = frame->n_vectors;
+ if (PREDICT_TRUE (table_index0 != ~0))
+ {
+ hash0 = vnet_buffer (b[0])->l2_classify.hash;
+ t0 = pool_elt_at_index (vcm->tables, table_index0);
- while (n_left_from > 0)
- {
- u32 n_left_to_next;
+ if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
+ h0 =
+ (void *) vlib_buffer_get_current (b[0]) +
+ t0->current_data_offset;
+ else
+ h0 = b[0]->data;
- vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+ /* advance the match pointer so the matching happens on IP header */
+ if (is_output)
+ h0 += vnet_buffer (b[0])->l2_classify.pad.l2_len;
- /* Not enough load/store slots to dual loop... */
- while (n_left_from > 0 && n_left_to_next > 0)
- {
- u32 bi0;
- vlib_buffer_t *b0;
- u32 next0 = ACL_NEXT_INDEX_DENY;
- u32 table_index0;
- vnet_classify_table_t *t0;
- vnet_classify_entry_t *e0;
- u64 hash0;
- u8 *h0;
- u8 error0;
-
- /* Stride 3 seems to work best */
- if (PREDICT_TRUE (n_left_from > 3))
+ e0 = vnet_classify_find_entry_inline (t0, (u8 *) h0, hash0, now);
+ if (e0)
{
- vlib_buffer_t *p1 = vlib_get_buffer (vm, from[3]);
- vnet_classify_table_t *tp1;
- u32 table_index1;
- u64 phash1;
+ vnet_buffer (b[0])->l2_classify.opaque_index = e0->opaque_index;
+ vlib_buffer_advance (b[0], e0->advance);
- table_index1 = vnet_buffer (p1)->l2_classify.table_index;
+ next0 = (e0->next_index < n_next_nodes) ?
+ e0->next_index : next0;
+
+ hits++;
+
+ if (is_ip4)
+ error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_SESSION_DENY :
+ IP4_ERROR_INACL_SESSION_DENY) : IP4_ERROR_NONE;
+ else
+ error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_SESSION_DENY :
+ IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
+ b[0]->error = error_node->errors[error0];
- if (PREDICT_TRUE (table_index1 != ~0))
+ if (!is_output)
{
- tp1 = pool_elt_at_index (vcm->tables, table_index1);
- phash1 = vnet_buffer (p1)->l2_classify.hash;
- vnet_classify_prefetch_entry (tp1, phash1);
+ if (e0->action == CLASSIFY_ACTION_SET_IP4_FIB_INDEX ||
+ e0->action == CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
+ vnet_buffer (b[0])->sw_if_index[VLIB_TX] = e0->metadata;
+ else if (e0->action == CLASSIFY_ACTION_SET_METADATA)
+ vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = e0->metadata;
}
}
-
-
- /* speculatively enqueue b0 to the current next frame */
- bi0 = from[0];
- to_next[0] = bi0;
- from += 1;
- to_next += 1;
- n_left_from -= 1;
- n_left_to_next -= 1;
-
- b0 = vlib_get_buffer (vm, bi0);
- table_index0 = vnet_buffer (b0)->l2_classify.table_index;
- e0 = 0;
- t0 = 0;
- vnet_get_config_data (am->vnet_config_main[is_output][tid],
- &b0->current_config_index, &next0,
- /* # bytes of config data */ 0);
-
- vnet_buffer (b0)->l2_classify.opaque_index = ~0;
-
- if (PREDICT_TRUE (table_index0 != ~0))
+ else
{
- hash0 = vnet_buffer (b0)->l2_classify.hash;
- t0 = pool_elt_at_index (vcm->tables, table_index0);
-
- if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
- h0 =
- (void *) vlib_buffer_get_current (b0) +
- t0->current_data_offset;
- else
- h0 = b0->data;
-
- /* advance the match pointer so the matching happens on IP header */
- if (is_output)
- h0 += vnet_buffer (b0)->l2_classify.pad.l2_len;
-
- e0 = vnet_classify_find_entry (t0, (u8 *) h0, hash0, now);
- if (e0)
+ while (1)
{
- vnet_buffer (b0)->l2_classify.opaque_index
- = e0->opaque_index;
- vlib_buffer_advance (b0, e0->advance);
+ if (PREDICT_TRUE (t0->next_table_index != ~0))
+ t0 =
+ pool_elt_at_index (vcm->tables, t0->next_table_index);
+ else
+ {
+ next0 = (t0->miss_next_index < n_next_nodes) ?
+ t0->miss_next_index : next0;
- next0 = (e0->next_index < n_next_nodes) ?
- e0->next_index : next0;
+ misses++;
- hits++;
+ if (is_ip4)
+ error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_TABLE_MISS :
+ IP4_ERROR_INACL_TABLE_MISS) : IP4_ERROR_NONE;
+ else
+ error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_TABLE_MISS :
+ IP6_ERROR_INACL_TABLE_MISS) : IP6_ERROR_NONE;
+ b[0]->error = error_node->errors[error0];
+ break;
+ }
- if (is_ip4)
- error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
- (is_output ? IP4_ERROR_OUTACL_SESSION_DENY :
- IP4_ERROR_INACL_SESSION_DENY) : IP4_ERROR_NONE;
+ if (t0->current_data_flag == CLASSIFY_FLAG_USE_CURR_DATA)
+ h0 =
+ (void *) vlib_buffer_get_current (b[0]) +
+ t0->current_data_offset;
else
- error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
- (is_output ? IP6_ERROR_OUTACL_SESSION_DENY :
- IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
- b0->error = error_node->errors[error0];
+ h0 = b[0]->data;
- if (!is_output)
- {
- if (e0->action == CLASSIFY_ACTION_SET_IP4_FIB_INDEX ||
- e0->action == CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
- vnet_buffer (b0)->sw_if_index[VLIB_TX] = e0->metadata;
- else if (e0->action == CLASSIFY_ACTION_SET_METADATA)
- vnet_buffer (b0)->ip.adj_index[VLIB_TX] =
- e0->metadata;
- }
- }
- else
- {
- while (1)
- {
- if (PREDICT_TRUE (t0->next_table_index != ~0))
- t0 = pool_elt_at_index (vcm->tables,
- t0->next_table_index);
- else
- {
- next0 = (t0->miss_next_index < n_next_nodes) ?
- t0->miss_next_index : next0;
-
- misses++;
-
- if (is_ip4)
- error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
- (is_output ? IP4_ERROR_OUTACL_TABLE_MISS :
- IP4_ERROR_INACL_TABLE_MISS) : IP4_ERROR_NONE;
- else
- error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
- (is_output ? IP6_ERROR_OUTACL_TABLE_MISS :
- IP6_ERROR_INACL_TABLE_MISS) : IP6_ERROR_NONE;
- b0->error = error_node->errors[error0];
- break;
- }
+ /* advance the match pointer so the matching happens on IP header */
+ if (is_output)
+ h0 += vnet_buffer (b[0])->l2_classify.pad.l2_len;
- if (t0->current_data_flag ==
- CLASSIFY_FLAG_USE_CURR_DATA)
- h0 =
- (void *) vlib_buffer_get_current (b0) +
- t0->current_data_offset;
+ hash0 = vnet_classify_hash_packet_inline (t0, (u8 *) h0);
+ e0 = vnet_classify_find_entry_inline
+ (t0, (u8 *) h0, hash0, now);
+ if (e0)
+ {
+ vnet_buffer (b[0])->l2_classify.opaque_index
+ = e0->opaque_index;
+ vlib_buffer_advance (b[0], e0->advance);
+ next0 = (e0->next_index < n_next_nodes) ?
+ e0->next_index : next0;
+ hits++;
+
+ if (is_ip4)
+ error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP4_ERROR_OUTACL_SESSION_DENY :
+ IP4_ERROR_INACL_SESSION_DENY) : IP4_ERROR_NONE;
else
- h0 = b0->data;
-
- /* advance the match pointer so the matching happens on IP header */
- if (is_output)
- h0 += vnet_buffer (b0)->l2_classify.pad.l2_len;
+ error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
+ (is_output ? IP6_ERROR_OUTACL_SESSION_DENY :
+ IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
+ b[0]->error = error_node->errors[error0];
- hash0 = vnet_classify_hash_packet (t0, (u8 *) h0);
- e0 = vnet_classify_find_entry
- (t0, (u8 *) h0, hash0, now);
- if (e0)
+ if (!is_output)
{
- vnet_buffer (b0)->l2_classify.opaque_index
- = e0->opaque_index;
- vlib_buffer_advance (b0, e0->advance);
- next0 = (e0->next_index < n_next_nodes) ?
- e0->next_index : next0;
- hits++;
- chain_hits++;
-
- if (is_ip4)
- error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
- (is_output ? IP4_ERROR_OUTACL_SESSION_DENY :
- IP4_ERROR_INACL_SESSION_DENY) : IP4_ERROR_NONE;
- else
- error0 = (next0 == ACL_NEXT_INDEX_DENY) ?
- (is_output ? IP6_ERROR_OUTACL_SESSION_DENY :
- IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
- b0->error = error_node->errors[error0];
-
- if (!is_output)
- {
- if (e0->action ==
- CLASSIFY_ACTION_SET_IP4_FIB_INDEX
- || e0->action ==
- CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
- vnet_buffer (b0)->sw_if_index[VLIB_TX] =
- e0->metadata;
- else if (e0->action ==
- CLASSIFY_ACTION_SET_METADATA)
- vnet_buffer (b0)->ip.adj_index[VLIB_TX] =
- e0->metadata;
- }
- break;
+ if (e0->action ==
+ CLASSIFY_ACTION_SET_IP4_FIB_INDEX
+ || e0->action ==
+ CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
+ vnet_buffer (b[0])->sw_if_index[VLIB_TX] =
+ e0->metadata;
+ else if (e0->action == CLASSIFY_ACTION_SET_METADATA)
+ vnet_buffer (b[0])->ip.adj_index[VLIB_TX] =
+ e0->metadata;
}
+ break;
}
}
}
+ }
- if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
- && (b0->flags & VLIB_BUFFER_IS_TRACED)))
- {
- ip_in_out_acl_trace_t *t =
- vlib_add_trace (vm, node, b0, sizeof (*t));
- t->sw_if_index =
- vnet_buffer (b0)->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
- t->next_index = next0;
- t->table_index = t0 ? t0 - vcm->tables : ~0;
- t->offset = (e0 && t0) ? vnet_classify_get_offset (t0, e0) : ~0;
- }
-
- if ((next0 == ACL_NEXT_INDEX_DENY) && is_output)
- {
- /* on output, for the drop node to work properly, go back to ip header */
- vlib_buffer_advance (b0, vnet_buffer (b0)->l2.l2_len);
- }
+ if (do_trace && b[0]->flags & VLIB_BUFFER_IS_TRACED)
+ {
+ ip_in_out_acl_trace_t *t =
+ vlib_add_trace (vm, node, b[0], sizeof (*t));
+ t->sw_if_index =
+ vnet_buffer (b[0])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
+ t->next_index = next0;
+ t->table_index = t0 ? t0 - vcm->tables : ~0;
+ t->offset = (e0 && t0) ? vnet_classify_get_offset (t0, e0) : ~0;
+ }
- /* verify speculative enqueue, maybe switch current next frame */
- vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
- to_next, n_left_to_next,
- bi0, next0);
+ if ((next0 == ACL_NEXT_INDEX_DENY) && is_output)
+ {
+ /* on output, for the drop node to work properly, go back to ip header */
+ vlib_buffer_advance (b[0], vnet_buffer (b[0])->l2.l2_len);
}
- vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+ next[0] = next0;
+
+ /* next */
+ next++;
+ b++;
+ n_left--;
}
vlib_node_increment_counter (vm, node->node_index,
@@ -483,23 +776,58 @@ ip_in_out_acl_inline (vlib_main_t * vm,
vlib_node_increment_counter (vm, node->node_index,
is_output ? IP_OUTACL_ERROR_CHAIN_HIT :
IP_INACL_ERROR_CHAIN_HIT, chain_hits);
- return frame->n_vectors;
}
VLIB_NODE_FN (ip4_inacl_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
vlib_frame_t * frame)
{
- return ip_in_out_acl_inline (vm, node, frame, 1 /* is_ip4 */ ,
- 0 /* is_output */ );
+
+ u32 *from;
+ vlib_buffer_t *bufs[VLIB_FRAME_SIZE];
+ u16 nexts[VLIB_FRAME_SIZE];
+
+ from = vlib_frame_vector_args (frame);
+
+ vlib_get_buffers (vm, from, bufs, frame->n_vectors);
+
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
+ ip_in_out_acl_inline (vm, node, bufs, nexts, frame->n_vectors,
+ 1 /* is_ip4 */ ,
+ 0 /* is_output */ , 1 /* is_trace */ );
+ else
+ ip_in_out_acl_inline (vm, node, bufs, nexts, frame->n_vectors,
+ 1 /* is_ip4 */ ,
+ 0 /* is_output */ , 0 /* is_trace */ );
+
+ vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
+
+ return frame->n_vectors;
}
VLIB_NODE_FN (ip4_outacl_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
vlib_frame_t * frame)
{
- return ip_in_out_acl_inline (vm, node, frame, 1 /* is_ip4 */ ,
- 1 /* is_output */ );
-}
+ u32 *from;
+ vlib_buffer_t *bufs[VLIB_FRAME_SIZE];
+ u16 nexts[VLIB_FRAME_SIZE];
+ from = vlib_frame_vector_args (frame);
+
+ vlib_get_buffers (vm, from, bufs, frame->n_vectors);
+
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
+ ip_in_out_acl_inline (vm, node, bufs, nexts, frame->n_vectors,
+ 1 /* is_ip4 */ ,
+ 1 /* is_output */ , 1 /* is_trace */ );
+ else
+ ip_in_out_acl_inline (vm, node, bufs, nexts, frame->n_vectors,
+ 1 /* is_ip4 */ ,
+ 1 /* is_output */ , 0 /* is_trace */ );
+
+ vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
+
+ return frame->n_vectors;
+}
/* *INDENT-OFF* */
VLIB_REGISTER_NODE (ip4_inacl_node) = {
@@ -532,15 +860,51 @@ VLIB_REGISTER_NODE (ip4_outacl_node) = {
VLIB_NODE_FN (ip6_inacl_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
vlib_frame_t * frame)
{
- return ip_in_out_acl_inline (vm, node, frame, 0 /* is_ip4 */ ,
- 0 /* is_output */ );
+ u32 *from;
+ vlib_buffer_t *bufs[VLIB_FRAME_SIZE];
+ u16 nexts[VLIB_FRAME_SIZE];
+
+ from = vlib_frame_vector_args (frame);
+
+ vlib_get_buffers (vm, from, bufs, frame->n_vectors);
+
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
+ ip_in_out_acl_inline (vm, node, bufs, nexts, frame->n_vectors,
+ 0 /* is_ip4 */ ,
+ 0 /* is_output */ , 1 /* is_trace */ );
+ else
+ ip_in_out_acl_inline (vm, node, bufs, nexts, frame->n_vectors,
+ 0 /* is_ip4 */ ,
+ 0 /* is_output */ , 0 /* is_trace */ );
+
+ vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
+
+ return frame->n_vectors;
}
VLIB_NODE_FN (ip6_outacl_node) (vlib_main_t * vm, vlib_node_runtime_t * node,
vlib_frame_t * frame)
{
- return ip_in_out_acl_inline (vm, node, frame, 0 /* is_ip4 */ ,
- 1 /* is_output */ );
+ u32 *from;
+ vlib_buffer_t *bufs[VLIB_FRAME_SIZE];
+ u16 nexts[VLIB_FRAME_SIZE];
+
+ from = vlib_frame_vector_args (frame);
+
+ vlib_get_buffers (vm, from, bufs, frame->n_vectors);
+
+ if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
+ ip_in_out_acl_inline (vm, node, bufs, nexts, frame->n_vectors,
+ 0 /* is_ip4 */ ,
+ 1 /* is_output */ , 1 /* is_trace */ );
+ else
+ ip_in_out_acl_inline (vm, node, bufs, nexts, frame->n_vectors,
+ 0 /* is_ip4 */ ,
+ 1 /* is_output */ , 0 /* is_trace */ );
+
+ vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
+
+ return frame->n_vectors;
}
/* *INDENT-OFF* */
0DD; font-weight: bold } /* Literal.Number.Bin */ .highlight .mf { color: #0000DD; font-weight: bold } /* Literal.Number.Float */ .highlight .mh { color: #0000DD; font-weight: bold } /* Literal.Number.Hex */ .highlight .mi { color: #0000DD; font-weight: bold } /* Literal.Number.Integer */ .highlight .mo { color: #0000DD; font-weight: bold } /* Literal.Number.Oct */ .highlight .sa { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Affix */ .highlight .sb { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Backtick */ .highlight .sc { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Char */ .highlight .dl { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Delimiter */ .highlight .sd { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Doc */ .highlight .s2 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Double */ .highlight .se { color: #0044dd; background-color: #fff0f0 } /* Literal.String.Escape */ .highlight .sh { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Heredoc */ .highlight .si { color: #3333bb; background-color: #fff0f0 } /* Literal.String.Interpol */ .highlight .sx { color: #22bb22; background-color: #f0fff0 } /* Literal.String.Other */ .highlight .sr { color: #008800; background-color: #fff0ff } /* Literal.String.Regex */ .highlight .s1 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Single */ .highlight .ss { color: #aa6600; background-color: #fff0f0 } /* Literal.String.Symbol */ .highlight .bp { color: #003388 } /* Name.Builtin.Pseudo */ .highlight .fm { color: #0066bb; font-weight: bold } /* Name.Function.Magic */ .highlight .vc { color: #336699 } /* Name.Variable.Class */ .highlight .vg { color: #dd7700 } /* Name.Variable.Global */ .highlight .vi { color: #3333bb } /* Name.Variable.Instance */ .highlight .vm { color: #336699 } /* Name.Variable.Magic */ .highlight .il { color: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */ } 
/*
 * Copyright (c) 2017-2019 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/** Generate typed init functions for multiple hash table styles... */
#include <vppinfra/bihash_16_8.h>
#include <vppinfra/bihash_template.h>

#include <vppinfra/bihash_template.c>

#undef __included_bihash_template_h__

#include <vppinfra/bihash_48_8.h>
#include <vppinfra/bihash_template.h>

#include <vppinfra/bihash_template.c>
#include <vnet/session/session_lookup.h>
#include <vnet/session/session.h>
#include <vnet/session/application.h>

/**
 * Network namespace index (i.e., fib index) to session lookup table. We
 * should have one per network protocol type but for now we only support IP4/6
 */
static u32 *fib_index_to_table_index[2];

/* *INDENT-OFF* */
/* 16 octets */
typedef CLIB_PACKED (struct {
  union
    {
      struct
	{
	  ip4_address_t src;
	  ip4_address_t dst;
	  u16 src_port;
	  u16 dst_port;
	  /* align by making this 4 octets even though its a 1-bit field
	   * NOTE: avoid key overlap with other transports that use 5 tuples for
	   * session identification.
	   */
	  u32 proto;
	};
      u64 as_u64[2];
    };
}) v4_connection_key_t;

typedef CLIB_PACKED (struct {
  union
    {
      struct
	{
	  /* 48 octets */
	  ip6_address_t src;
	  ip6_address_t dst;
	  u16 src_port;
	  u16 dst_port;
	  u32 proto;
	  u64 unused;
	};
      u64 as_u64[6];
    };
}) v6_connection_key_t;
/* *INDENT-ON* */

typedef clib_bihash_kv_16_8_t session_kv4_t;
typedef clib_bihash_kv_48_8_t session_kv6_t;

always_inline void
make_v4_ss_kv (session_kv4_t * kv, ip4_address_t * lcl, ip4_address_t * rmt,
	       u16 lcl_port, u16 rmt_port, u8 proto)
{
  kv->key[0] = (u64) rmt->as_u32 << 32 | (u64) lcl->as_u32;
  kv->key[1] = (u64) proto << 32 | (u64) rmt_port << 16 | (u64) lcl_port;
  kv->value = ~0ULL;
}

always_inline void
make_v4_listener_kv (session_kv4_t * kv, ip4_address_t * lcl, u16 lcl_port,
		     u8 proto)
{
  kv->key[0] = (u64) lcl->as_u32;
  kv->key[1] = (u64) proto << 32 | (u64) lcl_port;
  kv->value = ~0ULL;
}

always_inline void
make_v4_proxy_kv (session_kv4_t * kv, ip4_address_t * lcl, u8 proto)
{
  kv->key[0] = (u64) lcl->as_u32;
  kv->key[1] = (u64) proto << 32;
  kv->value = ~0ULL;
}

always_inline void
make_v4_ss_kv_from_tc (session_kv4_t * kv, transport_connection_t * tc)
{
  make_v4_ss_kv (kv, &tc->lcl_ip.ip4, &tc->rmt_ip.ip4, tc->lcl_port,
		 tc->rmt_port, tc->proto);
}

always_inline void
make_v6_ss_kv (session_kv6_t * kv, ip6_address_t * lcl, ip6_address_t * rmt,
	       u16 lcl_port, u16 rmt_port, u8 proto)
{
  kv->key[0] = lcl->as_u64[0];
  kv->key[1] = lcl->as_u64[1];
  kv->key[2] = rmt->as_u64[0];
  kv->key[3] = rmt->as_u64[1];
  kv->key[4] = (u64) proto << 32 | (u64) rmt_port << 16 | (u64) lcl_port;
  kv->key[5] = 0;
  kv->value = ~0ULL;
}

always_inline void
make_v6_listener_kv (session_kv6_t * kv, ip6_address_t * lcl, u16 lcl_port,
		     u8 proto)
{
  kv->key[0] = lcl->as_u64[0];
  kv->key[1] = lcl->as_u64[1];
  kv->key[2] = 0;
  kv->key[3] = 0;
  kv->key[4] = (u64) proto << 32 | (u64) lcl_port;
  kv->key[5] = 0;
  kv->value = ~0ULL;
}

always_inline void
make_v6_proxy_kv (session_kv6_t * kv, ip6_address_t * lcl, u8 proto)
{
  kv->key[0] = lcl->as_u64[0];
  kv->key[1] = lcl->as_u64[1];
  kv->key[2] = 0;
  kv->key[3] = 0;
  kv->key[4] = (u64) proto << 32;
  kv->key[5] = 0;
  kv->value = ~0ULL;
}

always_inline void
make_v6_ss_kv_from_tc (session_kv6_t * kv, transport_connection_t * tc)
{
  make_v6_ss_kv (kv, &tc->lcl_ip.ip6, &tc->rmt_ip.ip6, tc->lcl_port,
		 tc->rmt_port, tc->proto);
}

static session_table_t *
session_table_get_or_alloc (u8 fib_proto, u8 fib_index)
{
  session_table_t *st;
  u32 table_index;
  if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
    {
      st = session_table_alloc ();
      table_index = session_table_index (st);
      vec_validate (fib_index_to_table_index[fib_proto], fib_index);
      fib_index_to_table_index[fib_proto][fib_index] = table_index;
      st->active_fib_proto = fib_proto;
      session_table_init (st, fib_proto);
      return st;
    }
  else
    {
      table_index = fib_index_to_table_index[fib_proto][fib_index];
      return session_table_get (table_index);
    }
}

static session_table_t *
session_table_get_or_alloc_for_connection (transport_connection_t * tc)
{
  u32 fib_proto;
  fib_proto = transport_connection_fib_proto (tc);
  return session_table_get_or_alloc (fib_proto, tc->fib_index);
}

static session_table_t *
session_table_get_for_connection (transport_connection_t * tc)
{
  u32 fib_proto = transport_connection_fib_proto (tc);
  if (vec_len (fib_index_to_table_index[fib_proto]) <= tc->fib_index)
    return 0;
  return
    session_table_get (fib_index_to_table_index[fib_proto][tc->fib_index]);
}

static session_table_t *
session_table_get_for_fib_index (u32 fib_proto, u32 fib_index)
{
  if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
    return 0;
  return session_table_get (fib_index_to_table_index[fib_proto][fib_index]);
}

u32
session_lookup_get_index_for_fib (u32 fib_proto, u32 fib_index)
{
  if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
    return SESSION_TABLE_INVALID_INDEX;
  return fib_index_to_table_index[fib_proto][fib_index];
}

/**
 * Add transport connection to a session table
 *
 * Session lookup 5-tuple (src-ip, dst-ip, src-port, dst-port, session-type)
 * is added to requested session table.
 *
 * @param tc 		transport connection to be added
 * @param value	 	value to be stored
 *
 * @return non-zero if failure
 */
int
session_lookup_add_connection (transport_connection_t * tc, u64 value)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_kv6_t kv6;

  st = session_table_get_or_alloc_for_connection (tc);
  if (!st)
    return -1;
  if (tc->is_ip4)
    {
      make_v4_ss_kv_from_tc (&kv4, tc);
      kv4.value = value;
      return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4,
				       1 /* is_add */ );
    }
  else
    {
      make_v6_ss_kv_from_tc (&kv6, tc);
      kv6.value = value;
      return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6,
				       1 /* is_add */ );
    }
}

int
session_lookup_add_session_endpoint (u32 table_index,
				     session_endpoint_t * sep, u64 value)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_kv6_t kv6;

  st = session_table_get (table_index);
  if (!st)
    return -1;
  if (sep->is_ip4)
    {
      make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
			   sep->transport_proto);
      kv4.value = value;
      return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4, 1);
    }
  else
    {
      make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
			   sep->transport_proto);
      kv6.value = value;
      return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6, 1);
    }
}

int
session_lookup_del_session_endpoint (u32 table_index,
				     session_endpoint_t * sep)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_kv6_t kv6;

  st = session_table_get (table_index);
  if (!st)
    return -1;
  if (sep->is_ip4)
    {
      make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
			   sep->transport_proto);
      return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4, 0);
    }
  else
    {
      make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
			   sep->transport_proto);
      return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6, 0);
    }
}

/**
 * Delete transport connection from session table
 *
 * @param table_index	session table index
 * @param tc		transport connection to be removed
 *
 * @return non-zero if failure
 */
int
session_lookup_del_connection (transport_connection_t * tc)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_kv6_t kv6;

  st = session_table_get_for_connection (tc);
  if (!st)
    return -1;
  if (tc->is_ip4)
    {
      make_v4_ss_kv_from_tc (&kv4, tc);
      return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4,
				       0 /* is_add */ );
    }
  else
    {
      make_v6_ss_kv_from_tc (&kv6, tc);
      return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6,
				       0 /* is_add */ );
    }
}

int
session_lookup_del_session (session_t * s)
{
  transport_connection_t *ts;
  ts = transport_get_connection (session_get_transport_proto (s),
				 s->connection_index, s->thread_index);
  return session_lookup_del_connection (ts);
}

static u8
session_lookup_action_index_is_valid (u32 action_index)
{
  if (action_index == SESSION_RULES_TABLE_ACTION_ALLOW
      || action_index == SESSION_RULES_TABLE_INVALID_INDEX)
    return 0;
  return 1;
}

static u64
session_lookup_action_to_handle (u32 action_index)
{
  switch (action_index)
    {
    case SESSION_RULES_TABLE_ACTION_DROP:
      return SESSION_DROP_HANDLE;
    case SESSION_RULES_TABLE_ACTION_ALLOW:
    case SESSION_RULES_TABLE_INVALID_INDEX:
      return SESSION_INVALID_HANDLE;
    default:
      /* application index */
      return action_index;
    }
}

static session_t *
session_lookup_app_listen_session (u32 app_index, u8 fib_proto,
				   u8 transport_proto)
{
  application_t *app;
  app = application_get_if_valid (app_index);
  if (!app)
    return 0;

  return app_worker_first_listener (application_get_default_worker (app),
				    fib_proto, transport_proto);
}

static session_t *
session_lookup_action_to_session (u32 action_index, u8 fib_proto,
				  u8 transport_proto)
{
  u32 app_index;
  app_index = session_lookup_action_to_handle (action_index);
  /* Nothing sophisticated for now, action index is app index */
  return session_lookup_app_listen_session (app_index, fib_proto,
					    transport_proto);
}

/** UNUSED */
session_t *
session_lookup_rules_table_session4 (session_table_t * st, u8 proto,
				     ip4_address_t * lcl, u16 lcl_port,
				     ip4_address_t * rmt, u16 rmt_port)
{
  session_rules_table_t *srt = &st->session_rules[proto];
  u32 action_index, app_index;
  action_index = session_rules_table_lookup4 (srt, lcl, rmt, lcl_port,
					      rmt_port);
  app_index = session_lookup_action_to_handle (action_index);
  /* Nothing sophisticated for now, action index is app index */
  return session_lookup_app_listen_session (app_index, FIB_PROTOCOL_IP4,
					    proto);
}

/** UNUSED */
session_t *
session_lookup_rules_table_session6 (session_table_t * st, u8 proto,
				     ip6_address_t * lcl, u16 lcl_port,
				     ip6_address_t * rmt, u16 rmt_port)
{
  session_rules_table_t *srt = &st->session_rules[proto];
  u32 action_index, app_index;
  action_index = session_rules_table_lookup6 (srt, lcl, rmt, lcl_port,
					      rmt_port);
  app_index = session_lookup_action_to_handle (action_index);
  return session_lookup_app_listen_session (app_index, FIB_PROTOCOL_IP6,
					    proto);
}

/**
 * Lookup listener for session endpoint in table
 *
 * @param table_index table where the endpoint should be looked up
 * @param sep session endpoint to be looked up
 * @param use_rules flag that indicates if the session rules of the table
 * 		    should be used
 * @return invalid handle if nothing is found, the handle of a valid listener
 * 	   or an action derived handle if a rule is hit
 */
u64
session_lookup_endpoint_listener (u32 table_index, session_endpoint_t * sep,
				  u8 use_rules)
{
  session_rules_table_t *srt;
  session_table_t *st;
  u32 ai;
  int rv;

  st = session_table_get (table_index);
  if (!st)
    return SESSION_INVALID_HANDLE;
  if (sep->is_ip4)
    {
      session_kv4_t kv4;
      ip4_address_t lcl4;

      make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
			   sep->transport_proto);
      rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
      if (rv == 0)
	return kv4.value;
      if (use_rules)
	{
	  clib_memset (&lcl4, 0, sizeof (lcl4));
	  srt = &st->session_rules[sep->transport_proto];
	  ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
					    sep->port);
	  if (session_lookup_action_index_is_valid (ai))
	    return session_lookup_action_to_handle (ai);
	}
    }
  else
    {
      session_kv6_t kv6;
      ip6_address_t lcl6;

      make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
			   sep->transport_proto);
      rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
      if (rv == 0)
	return kv6.value;

      if (use_rules)
	{
	  clib_memset (&lcl6, 0, sizeof (lcl6));
	  srt = &st->session_rules[sep->transport_proto];
	  ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
					    sep->port);
	  if (session_lookup_action_index_is_valid (ai))
	    return session_lookup_action_to_handle (ai);
	}
    }
  return SESSION_INVALID_HANDLE;
}

/**
 * Look up endpoint in local session table
 *
 * The result, for now, is an application index and it may in the future
 * be extended to a more complicated "action object". The only action we
 * emulate now is "drop" and for that we return a special app index.
 *
 * Lookup logic is to check in order:
 * - the rules in the table (connect acls)
 * - session sub-table for a listener
 * - session sub-table for a local listener (zeroed addr)
 *
 * @param table_index table where the lookup should be done
 * @param sep session endpoint to be looked up
 * @return session handle that can be interpreted as an adjacency
 */
u64
session_lookup_local_endpoint (u32 table_index, session_endpoint_t * sep)
{
  session_rules_table_t *srt;
  session_table_t *st;
  u32 ai;
  int rv;

  st = session_table_get (table_index);
  if (!st)
    return SESSION_INVALID_INDEX;
  ASSERT (st->is_local);

  if (sep->is_ip4)
    {
      session_kv4_t kv4;
      ip4_address_t lcl4;

      /*
       * Check if endpoint has special rules associated
       */
      clib_memset (&lcl4, 0, sizeof (lcl4));
      srt = &st->session_rules[sep->transport_proto];
      ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
					sep->port);
      if (session_lookup_action_index_is_valid (ai))
	return session_lookup_action_to_handle (ai);

      /*
       * Check if session endpoint is a listener
       */
      make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
			   sep->transport_proto);
      rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
      if (rv == 0)
	return kv4.value;

      /*
       * Zero out the ip. Logic is that connect to local ips, say
       * 127.0.0.1:port, can match 0.0.0.0:port
       */
      if (ip4_is_local_host (&sep->ip.ip4))
	{
	  kv4.key[0] = 0;
	  rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
	  if (rv == 0)
	    return kv4.value;
	}
      else
	{
	  kv4.key[0] = 0;
	}

      /*
       * Zero out the port and check if we have proxy
       */
      kv4.key[1] = 0;
      rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
      if (rv == 0)
	return kv4.value;
    }
  else
    {
      session_kv6_t kv6;
      ip6_address_t lcl6;

      clib_memset (&lcl6, 0, sizeof (lcl6));
      srt = &st->session_rules[sep->transport_proto];
      ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
					sep->port);
      if (session_lookup_action_index_is_valid (ai))
	return session_lookup_action_to_handle (ai);

      make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
			   sep->transport_proto);
      rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
      if (rv == 0)
	return kv6.value;

      /*
       * Zero out the ip. Same logic as above.
       */

      if (ip6_is_local_host (&sep->ip.ip6))
	{
	  kv6.key[0] = kv6.key[1] = 0;
	  rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
	  if (rv == 0)
	    return kv6.value;
	}
      else
	{
	  kv6.key[0] = kv6.key[1] = 0;
	}

      /*
       * Zero out the port. Same logic as above.
       */
      kv6.key[4] = kv6.key[5] = 0;
      rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
      if (rv == 0)
	return kv6.value;
    }
  return SESSION_INVALID_HANDLE;
}

static inline session_t *
session_lookup_listener4_i (session_table_t * st, ip4_address_t * lcl,
			    u16 lcl_port, u8 proto, u8 use_wildcard)
{
  session_kv4_t kv4;
  int rv;

  /*
   * First, try a fully formed listener
   */
  make_v4_listener_kv (&kv4, lcl, lcl_port, proto);
  rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
  if (rv == 0)
    return listen_session_get ((u32) kv4.value);

  /*
   * Zero out the lcl ip and check if any 0/0 port binds have been done
   */
  if (use_wildcard)
    {
      kv4.key[0] = 0;
      rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
      if (rv == 0)
	return listen_session_get ((u32) kv4.value);
    }
  else
    {
      kv4.key[0] = 0;
    }

  /*
   * Zero out port and check if we have a proxy set up for our ip
   */
  make_v4_proxy_kv (&kv4, lcl, proto);
  rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
  if (rv == 0)
    return listen_session_get ((u32) kv4.value);

  return 0;
}

session_t *
session_lookup_listener4 (u32 fib_index, ip4_address_t * lcl, u16 lcl_port,
			  u8 proto)
{
  session_table_t *st;
  st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
  if (!st)
    return 0;
  return session_lookup_listener4_i (st, lcl, lcl_port, proto, 0);
}

static session_t *
session_lookup_listener6_i (session_table_t * st, ip6_address_t * lcl,
			    u16 lcl_port, u8 proto, u8 ip_wildcard)
{
  session_kv6_t kv6;
  int rv;

  make_v6_listener_kv (&kv6, lcl, lcl_port, proto);
  rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
  if (rv == 0)
    return listen_session_get ((u32) kv6.value);

  /* Zero out the lcl ip */
  if (ip_wildcard)
    {
      kv6.key[0] = kv6.key[1] = 0;
      rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
      if (rv == 0)
	return listen_session_get ((u32) kv6.value);
    }
  else
    {
      kv6.key[0] = kv6.key[1] = 0;
    }

  make_v6_proxy_kv (&kv6, lcl, proto);
  rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
  if (rv == 0)
    return listen_session_get ((u32) kv6.value);
  return 0;
}

session_t *
session_lookup_listener6 (u32 fib_index, ip6_address_t * lcl, u16 lcl_port,
			  u8 proto)
{
  session_table_t *st;
  st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
  if (!st)
    return 0;
  return session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
}

/**
 * Lookup listener, exact or proxy (inaddr_any:0) match
 */
session_t *
session_lookup_listener (u32 table_index, session_endpoint_t * sep)
{
  session_table_t *st;
  st = session_table_get (table_index);
  if (!st)
    return 0;
  if (sep->is_ip4)
    return session_lookup_listener4_i (st, &sep->ip.ip4, sep->port,
				       sep->transport_proto, 0);
  else
    return session_lookup_listener6_i (st, &sep->ip.ip6, sep->port,
				       sep->transport_proto, 0);
  return 0;
}

/**
 * Lookup listener wildcard match
 */
session_t *
session_lookup_listener_wildcard (u32 table_index, session_endpoint_t * sep)
{
  session_table_t *st;
  st = session_table_get (table_index);
  if (!st)
    return 0;
  if (sep->is_ip4)
    return session_lookup_listener4_i (st, &sep->ip.ip4, sep->port,
				       sep->transport_proto,
				       1 /* use_wildcard */ );
  else
    return session_lookup_listener6_i (st, &sep->ip.ip6, sep->port,
				       sep->transport_proto,
				       1 /* use_wildcard */ );
  return 0;
}

int
session_lookup_add_half_open (transport_connection_t * tc, u64 value)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_kv6_t kv6;

  st = session_table_get_or_alloc_for_connection (tc);
  if (!st)
    return 0;
  if (tc->is_ip4)
    {
      make_v4_ss_kv_from_tc (&kv4, tc);
      kv4.value = value;
      return clib_bihash_add_del_16_8 (&st->v4_half_open_hash, &kv4,
				       1 /* is_add */ );
    }
  else
    {
      make_v6_ss_kv_from_tc (&kv6, tc);
      kv6.value = value;
      return clib_bihash_add_del_48_8 (&st->v6_half_open_hash, &kv6,
				       1 /* is_add */ );
    }
}

int
session_lookup_del_half_open (transport_connection_t * tc)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_kv6_t kv6;

  st = session_table_get_for_connection (tc);
  if (!st)
    return -1;
  if (tc->is_ip4)
    {
      make_v4_ss_kv_from_tc (&kv4, tc);
      return clib_bihash_add_del_16_8 (&st->v4_half_open_hash, &kv4,
				       0 /* is_add */ );
    }
  else
    {
      make_v6_ss_kv_from_tc (&kv6, tc);
      return clib_bihash_add_del_48_8 (&st->v6_half_open_hash, &kv6,
				       0 /* is_add */ );
    }
}

u64
session_lookup_half_open_handle (transport_connection_t * tc)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_kv6_t kv6;
  int rv;

  st = session_table_get_for_fib_index (transport_connection_fib_proto (tc),
					tc->fib_index);
  if (!st)
    return HALF_OPEN_LOOKUP_INVALID_VALUE;
  if (tc->is_ip4)
    {
      make_v4_ss_kv (&kv4, &tc->lcl_ip.ip4, &tc->rmt_ip.ip4, tc->lcl_port,
		     tc->rmt_port, tc->proto);
      rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
      if (rv == 0)
	return kv4.value;
    }
  else
    {
      make_v6_ss_kv (&kv6, &tc->lcl_ip.ip6, &tc->rmt_ip.ip6, tc->lcl_port,
		     tc->rmt_port, tc->proto);
      rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
      if (rv == 0)
	return kv6.value;
    }
  return HALF_OPEN_LOOKUP_INVALID_VALUE;
}

transport_connection_t *
session_lookup_half_open_connection (u64 handle, u8 proto, u8 is_ip4)
{
  if (handle != HALF_OPEN_LOOKUP_INVALID_VALUE)
    {
      u32 sst = session_type_from_proto_and_ip (proto, is_ip4);
      return transport_get_half_open (sst, handle & 0xFFFFFFFF);
    }
  return 0;
}

/**
 * Lookup connection with ip4 and transport layer information
 *
 * This is used on the fast path so it needs to be fast. Thereby,
 * duplication of code and 'hacks' allowed.
 *
 * The lookup is incremental and returns whenever something is matched. The
 * steps are:
 * - Try to find an established session
 * - Try to find a half-open connection
 * - Try session rules table
 * - Try to find a fully-formed or local source wildcarded (listener bound to
 *   all interfaces) listener session
 * - return 0
 *
 * @param fib_index	index of fib wherein the connection was received
 * @param lcl		local ip4 address
 * @param rmt		remote ip4 address
 * @param lcl_port	local port
 * @param rmt_port	remote port
 * @param proto		transport protocol (e.g., tcp, udp)
 * @param thread_index	thread index for request
 * @param is_filtered	return flag that indicates if connection was filtered.
 *
 * @return pointer to transport connection, if one is found, 0 otherwise
 */
transport_connection_t *
session_lookup_connection_wt4 (u32 fib_index, ip4_address_t * lcl,
			       ip4_address_t * rmt, u16 lcl_port,
			       u16 rmt_port, u8 proto, u32 thread_index,
			       u8 * result)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_t *s;
  u32 action_index;
  int rv;

  st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
  if (PREDICT_FALSE (!st))
    return 0;

  /*
   * Lookup session amongst established ones
   */
  make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
  rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
  if (rv == 0)
    {
      if (PREDICT_FALSE ((u32) (kv4.value >> 32) != thread_index))
	{
	  *result = SESSION_LOOKUP_RESULT_WRONG_THREAD;
	  return 0;
	}
      s = session_get (kv4.value & 0xFFFFFFFFULL, thread_index);
      return transport_get_connection (proto, s->connection_index,
				       thread_index);
    }

  /*
   * Try half-open connections
   */
  rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
  if (rv == 0)
    return transport_get_half_open (proto, kv4.value & 0xFFFFFFFF);

  /*
   * Check the session rules table
   */
  action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
					      rmt, lcl_port, rmt_port);
  if (session_lookup_action_index_is_valid (action_index))
    {
      if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
	{
	  *result = SESSION_LOOKUP_RESULT_FILTERED;
	  return 0;
	}
      if ((s = session_lookup_action_to_session (action_index,
						 FIB_PROTOCOL_IP4, proto)))
	return transport_get_listener (proto, s->connection_index);
      return 0;
    }

  /*
   * If nothing is found, check if any listener is available
   */
  s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1);
  if (s)
    return transport_get_listener (proto, s->connection_index);

  return 0;
}

/**
 * Lookup connection with ip4 and transport layer information
 *
 * Not optimized. Lookup logic is identical to that of
 * @ref session_lookup_connection_wt4
 *
 * @param fib_index	index of the fib wherein the connection was received
 * @param lcl		local ip4 address
 * @param rmt		remote ip4 address
 * @param lcl_port	local port
 * @param rmt_port	remote port
 * @param proto		transport protocol (e.g., tcp, udp)
 *
 * @return pointer to transport connection, if one is found, 0 otherwise
 */
transport_connection_t *
session_lookup_connection4 (u32 fib_index, ip4_address_t * lcl,
			    ip4_address_t * rmt, u16 lcl_port, u16 rmt_port,
			    u8 proto)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_t *s;
  u32 action_index;
  int rv;

  st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
  if (PREDICT_FALSE (!st))
    return 0;

  /*
   * Lookup session amongst established ones
   */
  make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
  rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
  if (rv == 0)
    {
      s = session_get_from_handle (kv4.value);
      return transport_get_connection (proto, s->connection_index,
				       s->thread_index);
    }

  /*
   * Try half-open connections
   */
  rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
  if (rv == 0)
    return transport_get_half_open (proto, kv4.value & 0xFFFFFFFF);

  /*
   * Check the session rules table
   */
  action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
					      rmt, lcl_port, rmt_port);
  if (session_lookup_action_index_is_valid (action_index))
    {
      if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
	return 0;
      if ((s = session_lookup_action_to_session (action_index,
						 FIB_PROTOCOL_IP4, proto)))
	return transport_get_listener (proto, s->connection_index);
      return 0;
    }

  /*
   * If nothing is found, check if any listener is available
   */
  s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1);
  if (s)
    return transport_get_listener (proto, s->connection_index);

  return 0;
}

/**
 * Lookup session with ip4 and transport layer information
 *
 * Important note: this may look into another thread's pool table and
 * register as 'peeker'. Caller should call @ref session_pool_remove_peeker as
 * if needed as soon as possible.
 *
 * Lookup logic is similar to that of @ref session_lookup_connection_wt4 but
 * this returns a session as opposed to a transport connection and it does not
 * try to lookup half-open sessions.
 *
 * Typically used by dgram connections
 */
session_t *
session_lookup_safe4 (u32 fib_index, ip4_address_t * lcl, ip4_address_t * rmt,
		      u16 lcl_port, u16 rmt_port, u8 proto)
{
  session_table_t *st;
  session_kv4_t kv4;
  session_t *s;
  u32 action_index;
  int rv;

  st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
  if (PREDICT_FALSE (!st))
    return 0;

  /*
   * Lookup session amongst established ones
   */
  make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
  rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
  if (rv == 0)
    return session_get_from_handle_safe (kv4.value);

  /*
   * Check the session rules table
   */
  action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
					      rmt, lcl_port, rmt_port);
  if (session_lookup_action_index_is_valid (action_index))
    {
      if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
	return 0;
      return session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP4,
					       proto);
    }

  /*
   *  If nothing is found, check if any listener is available
   */
  if ((s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1)))
    return s;

  return 0;
}

/**
 * Lookup connection with ip6 and transport layer information
 *
 * This is used on the fast path so it needs to be fast. Thereby,
 * duplication of code and 'hacks' allowed.
 *
 * The lookup is incremental and returns whenever something is matched. The
 * steps are:
 * - Try to find an established session
 * - Try to find a half-open connection
 * - Try session rules table
 * - Try to find a fully-formed or local source wildcarded (listener bound to
 *   all interfaces) listener session
 * - return 0
 *
 * @param fib_index	index of the fib wherein the connection was received
 * @param lcl		local ip6 address
 * @param rmt		remote ip6 address
 * @param lcl_port	local port
 * @param rmt_port	remote port
 * @param proto		transport protocol (e.g., tcp, udp)
 * @param thread_index	thread index for request
 *
 * @return pointer to transport connection, if one is found, 0 otherwise
 */
transport_connection_t *
session_lookup_connection_wt6 (u32 fib_index, ip6_address_t * lcl,
			       ip6_address_t * rmt, u16 lcl_port,
			       u16 rmt_port, u8 proto, u32 thread_index,
			       u8 * result)
{
  session_table_t *st;
  session_t *s;
  session_kv6_t kv6;
  u32 action_index;
  int rv;

  st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
  if (PREDICT_FALSE (!st))
    return 0;

  make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
  rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
  if (rv == 0)
    {
      ASSERT ((u32) (kv6.value >> 32) == thread_index);
      if (PREDICT_FALSE ((u32) (kv6.value >> 32) != thread_index))
	{
	  *result = SESSION_LOOKUP_RESULT_WRONG_THREAD;
	  return 0;
	}
      s = session_get (kv6.value & 0xFFFFFFFFULL, thread_index);
      return transport_get_connection (proto, s->connection_index,
				       thread_index);
    }

  /* Try half-open connections */
  rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
  if (rv == 0)
    return transport_get_half_open (proto, kv6.value & 0xFFFFFFFF);

  /* Check the session rules table */
  action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
					      rmt, lcl_port, rmt_port);
  if (session_lookup_action_index_is_valid (action_index))
    {
      if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
	{
	  *result = SESSION_LOOKUP_RESULT_FILTERED;
	  return 0;
	}
      if ((s = session_lookup_action_to_session (action_index,
						 FIB_PROTOCOL_IP6, proto)))
	return transport_get_listener (proto, s->connection_index);
      return 0;
    }

  /* If nothing is found, check if any listener is available */
  s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
  if (s)
    return transport_get_listener (proto, s->connection_index);

  return 0;
}

/**
 * Lookup connection with ip6 and transport layer information
 *
 * Not optimized. This is used on the fast path so it needs to be fast.
 * Thereby, duplication of code and 'hacks' allowed. Lookup logic is identical
 * to that of @ref session_lookup_connection_wt4
 *
 * @param fib_index	index of the fib wherein the connection was received
 * @param lcl		local ip6 address
 * @param rmt		remote ip6 address
 * @param lcl_port	local port
 * @param rmt_port	remote port
 * @param proto		transport protocol (e.g., tcp, udp)
 *
 * @return pointer to transport connection, if one is found, 0 otherwise
 */
transport_connection_t *
session_lookup_connection6 (u32 fib_index, ip6_address_t * lcl,
			    ip6_address_t * rmt, u16 lcl_port, u16 rmt_port,
			    u8 proto)
{
  session_table_t *st;
  session_t *s;
  session_kv6_t kv6;
  u32 action_index;
  int rv;

  st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
  if (PREDICT_FALSE (!st))
    return 0;

  make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
  rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
  if (rv == 0)
    {
      s = session_get_from_handle (kv6.value);
      return transport_get_connection (proto, s->connection_index,
				       s->thread_index);
    }

  /* Try half-open connections */
  rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
  if (rv == 0)
    return transport_get_half_open (proto, kv6.value & 0xFFFFFFFF);

  /* Check the session rules table */
  action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
					      rmt, lcl_port, rmt_port);
  if (session_lookup_action_index_is_valid (action_index))
    {
      if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
	return 0;
      if ((s = session_lookup_action_to_session (action_index,
						 FIB_PROTOCOL_IP6, proto)))
	return transport_get_listener (proto, s->connection_index);
      return 0;
    }

  /* If nothing is found, check if any listener is available */
  s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
  if (s)
    return transport_get_listener (proto, s->connection_index);

  return 0;
}

/**
 * Lookup session with ip6 and transport layer information
 *
 * Important note: this may look into another thread's pool table and
 * register as 'peeker'. Caller should call @ref session_pool_remove_peeker as
 * if needed as soon as possible.
 *
 * Lookup logic is similar to that of @ref session_lookup_connection_wt6 but
 * this returns a session as opposed to a transport connection and it does not
 * try to lookup half-open sessions.
 *
 * Typically used by dgram connections
 */
session_t *
session_lookup_safe6 (u32 fib_index, ip6_address_t * lcl, ip6_address_t * rmt,
		      u16 lcl_port, u16 rmt_port, u8 proto)
{
  session_table_t *st;
  session_kv6_t kv6;
  session_t *s;
  u32 action_index;
  int rv;

  st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
  if (PREDICT_FALSE (!st))
    return 0;

  make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
  rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
  if (rv == 0)
    return session_get_from_handle_safe (kv6.value);

  /* Check the session rules table */
  action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
					      rmt, lcl_port, rmt_port);
  if (session_lookup_action_index_is_valid (action_index))
    {
      if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
	return 0;
      return session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP6,
					       proto);
    }

  /* If nothing is found, check if any listener is available */
  if ((s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1)))
    return s;
  return 0;
}

int
vnet_session_rule_add_del (session_rule_add_del_args_t * args)
{
  app_namespace_t *app_ns = app_namespace_get (args->appns_index);
  session_rules_table_t *srt;
  session_table_t *st;
  u32 fib_index;
  u8 fib_proto;
  int rv = 0;

  if (!app_ns)
    return VNET_API_ERROR_APP_INVALID_NS;

  if (args->scope > 3)
    return VNET_API_ERROR_INVALID_VALUE;

  if (args->transport_proto != TRANSPORT_PROTO_TCP
      && args->transport_proto != TRANSPORT_PROTO_UDP)
    return VNET_API_ERROR_INVALID_VALUE;

  if ((args->scope & SESSION_RULE_SCOPE_GLOBAL) || args->scope == 0)
    {
      fib_proto = args->table_args.rmt.fp_proto;
      fib_index = app_namespace_get_fib_index (app_ns, fib_proto);
      st = session_table_get_for_fib_index (fib_proto, fib_index);
      srt = &st->session_rules[args->transport_proto];
      if ((rv = session_rules_table_add_del (srt, &args->table_args)))
	return rv;
    }
  if (args->scope & SESSION_RULE_SCOPE_LOCAL)
    {
      clib_memset (&args->table_args.lcl, 0, sizeof (args->table_args.lcl));
      args->table_args.lcl.fp_proto = args->table_args.rmt.fp_proto;
      args->table_args.lcl_port = 0;
      st = app_namespace_get_local_table (app_ns);
      srt = &st->session_rules[args->transport_proto];
      rv = session_rules_table_add_del (srt, &args->table_args);
    }
  return rv;
}

/**
 * Mark (global) tables as pertaining to app ns
 */
void
session_lookup_set_tables_appns (app_namespace_t * app_ns)
{
  session_table_t *st;
  u32 fib_index;
  u8 fp;

  for (fp = 0; fp < ARRAY_LEN (fib_index_to_table_index); fp++)
    {
      fib_index = app_namespace_get_fib_index (app_ns, fp);
      st = session_table_get_for_fib_index (fp, fib_index);
      if (st)
	st->appns_index = app_namespace_index (app_ns);
    }
}

u8 *
format_ip4_session_lookup_kvp (u8 * s, va_list * args)
{
  clib_bihash_kv_16_8_t *kvp = va_arg (*args, clib_bihash_kv_16_8_t *);
  u32 is_local = va_arg (*args, u32);
  v4_connection_key_t *key = (v4_connection_key_t *) kvp->key;
  session_t *session;
  app_worker_t *app_wrk;
  const u8 *app_name;
  u8 *str = 0;

  if (!is_local)
    {
      session = session_get_from_handle (kvp->value);
      app_wrk = app_worker_get (session->app_wrk_index);
      app_name = application_name_from_index (app_wrk->app_index);
      str = format (0, "[%U] %U:%d->%U:%d", format_transport_proto_short,
		    key->proto, format_ip4_address, &key->src,
		    clib_net_to_host_u16 (key->src_port), format_ip4_address,
		    &key->dst, clib_net_to_host_u16 (key->dst_port));
      s = format (s, "%-40v%-30v", str, app_name);
    }
  else
    {
      session = session_get_from_handle (kvp->value);
      app_wrk = app_worker_get (session->app_wrk_index);
      app_name = application_name_from_index (app_wrk->app_index);
      str = format (0, "[%U] %U:%d", format_transport_proto_short, key->proto,
		    format_ip4_address, &key->src,
		    clib_net_to_host_u16 (key->src_port));
      s = format (s, "%-30v%-30v", str, app_name);
    }
  return s;
}

typedef struct _ip4_session_table_show_ctx_t
{
  vlib_main_t *vm;
  u8 is_local;
} ip4_session_table_show_ctx_t;

static int
ip4_session_table_show (clib_bihash_kv_16_8_t * kvp, void *arg)
{
  ip4_session_table_show_ctx_t *ctx = arg;
  vlib_cli_output (ctx->vm, "%U", format_ip4_session_lookup_kvp, kvp,
		   ctx->is_local);
  return 1;
}

void
session_lookup_show_table_entries (vlib_main_t * vm, session_table_t * table,
				   u8 type, u8 is_local)
{
  ip4_session_table_show_ctx_t ctx = {
    .vm = vm,
    .is_local = is_local,
  };
  if (!is_local)
    vlib_cli_output (vm, "%-40s%-30s", "Session", "Application");
  else
    vlib_cli_output (vm, "%-30s%-30s", "Listener", "Application");
  switch (type)
    {
      /* main table v4 */
    case 0:
      ip4_session_table_walk (&table->v4_session_hash, ip4_session_table_show,
			      &ctx);
      break;
    default:
      clib_warning ("not supported");
    }
}

static clib_error_t *
session_rule_command_fn (vlib_main_t * vm, unformat_input_t * input,
			 vlib_cli_command_t * cmd)
{
  u32 proto = ~0, lcl_port, rmt_port, action = 0, lcl_plen = 0, rmt_plen = 0;
  u32 appns_index, scope = 0;
  ip46_address_t lcl_ip, rmt_ip;
  u8 is_ip4 = 1, conn_set = 0;
  u8 fib_proto, is_add = 1, *ns_id = 0;
  u8 *tag = 0;
  app_namespace_t *app_ns;
  int rv;

  clib_memset (&lcl_ip, 0, sizeof (lcl_ip));
  clib_memset (&rmt_ip, 0, sizeof (rmt_ip));
  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
    {
      if (unformat (input, "del"))
	is_add = 0;
      else if (unformat (input, "add"))
	;
      else if (unformat (input, "appns %_%v%_", &ns_id))
	;
      else if (unformat (input, "scope global"))
	scope = SESSION_RULE_SCOPE_GLOBAL;
      else if (unformat (input, "scope local"))
	scope = SESSION_RULE_SCOPE_LOCAL;
      else if (unformat (input, "scope all"))
	scope = SESSION_RULE_SCOPE_LOCAL | SESSION_RULE_SCOPE_GLOBAL;
      else if (unformat (input, "proto %U", unformat_transport_proto, &proto))
	;
      else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip4_address,
			 &lcl_ip.ip4, &lcl_plen, &lcl_port,
			 unformat_ip4_address, &rmt_ip.ip4, &rmt_plen,
			 &rmt_port))
	{
	  is_ip4 = 1;
	  conn_set = 1;
	}
      else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip6_address,
			 &lcl_ip.ip6, &lcl_plen, &lcl_port,
			 unformat_ip6_address, &rmt_ip.ip6, &rmt_plen,
			 &rmt_port))
	{
	  is_ip4 = 0;
	  conn_set = 1;
	}
      else if (unformat (input, "action %d", &action))
	;
      else if (unformat (input, "tag %_%v%_", &tag))
	;
      else
	return clib_error_return (0, "unknown input `%U'",
				  format_unformat_error, input);
    }

  if (proto == ~0)
    {
      vlib_cli_output (vm, "proto must be set");
      return 0;
    }
  if (is_add && !conn_set && action == ~0)
    {
      vlib_cli_output (vm, "connection and action must be set for add");
      return 0;
    }
  if (!is_add && !tag && !conn_set)
    {
      vlib_cli_output (vm, "connection or tag must be set for delete");
      return 0;
    }
  if (vec_len (tag) > SESSION_RULE_TAG_MAX_LEN)
    {
      vlib_cli_output (vm, "tag too long (max u64)");
      return 0;
    }

  if (ns_id)
    {
      app_ns = app_namespace_get_from_id (ns_id);
      if (!app_ns)
	{
	  vlib_cli_output (vm, "namespace %v does not exist", ns_id);
	  return 0;
	}
    }
  else
    {
      app_ns = app_namespace_get_default ();
    }
  appns_index = app_namespace_index (app_ns);

  fib_proto = is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
  session_rule_add_del_args_t args = {
    .transport_proto = proto,
    .table_args.lcl.fp_addr = lcl_ip,
    .table_args.lcl.fp_len = lcl_plen,
    .table_args.lcl.fp_proto = fib_proto,
    .table_args.rmt.fp_addr = rmt_ip,
    .table_args.rmt.fp_len = rmt_plen,
    .table_args.rmt.fp_proto = fib_proto,
    .table_args.lcl_port = lcl_port,
    .table_args.rmt_port = rmt_port,
    .table_args.action_index = action,
    .table_args.is_add = is_add,
    .table_args.tag = tag,
    .appns_index = appns_index,
    .scope = scope,
  };
  if ((rv = vnet_session_rule_add_del (&args)))
    return clib_error_return (0, "rule add del returned %u", rv);

  vec_free (tag);
  return 0;
}

/* *INDENT-OFF* */
VLIB_CLI_COMMAND (session_rule_command, static) =
{
  .path = "session rule",
  .short_help = "session rule [add|del] appns <ns_id> proto <proto> "
      "<lcl-ip/plen> <lcl-port> <rmt-ip/plen> <rmt-port> action <action>",
  .function = session_rule_command_fn,
};
/* *INDENT-ON* */

void
session_lookup_dump_rules_table (u32 fib_index, u8 fib_proto,
				 u8 transport_proto)
{
  vlib_main_t *vm = vlib_get_main ();
  session_rules_table_t *srt;
  session_table_t *st;
  st = session_table_get_for_fib_index (fib_index, fib_proto);
  srt = &st->session_rules[transport_proto];
  session_rules_table_cli_dump (vm, srt, fib_proto);
}

void
session_lookup_dump_local_rules_table (u32 table_index, u8 fib_proto,
				       u8 transport_proto)
{
  vlib_main_t *vm = vlib_get_main ();
  session_rules_table_t *srt;
  session_table_t *st;
  st = session_table_get (table_index);
  srt = &st->session_rules[transport_proto];
  session_rules_table_cli_dump (vm, srt, fib_proto);
}

static clib_error_t *
show_session_rules_command_fn (vlib_main_t * vm, unformat_input_t * input,
			       vlib_cli_command_t * cmd)
{
  u32 transport_proto = ~0, lcl_port, rmt_port, lcl_plen, rmt_plen;
  u32 fib_index, scope = 0;
  ip46_address_t lcl_ip, rmt_ip;
  u8 is_ip4 = 1, show_one = 0;
  app_namespace_t *app_ns;
  session_rules_table_t *srt;
  session_table_t *st;
  u8 *ns_id = 0, fib_proto;

  clib_memset (&lcl_ip, 0, sizeof (lcl_ip));
  clib_memset (&rmt_ip, 0, sizeof (rmt_ip));
  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
    {
      if (unformat (input, "%U", unformat_transport_proto, &transport_proto))
	;
      else if (unformat (input, "appns %_%v%_", &ns_id))
	;
      else if (unformat (input, "scope global"))
	scope = 1;
      else if (unformat (input, "scope local"))
	scope = 2;
      else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip4_address,
			 &lcl_ip.ip4, &lcl_plen, &lcl_port,
			 unformat_ip4_address, &rmt_ip.ip4, &rmt_plen,
			 &rmt_port))
	{
	  is_ip4 = 1;
	  show_one = 1;
	}
      else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip6_address,
			 &lcl_ip.ip6, &lcl_plen, &lcl_port,
			 unformat_ip6_address, &rmt_ip.ip6, &rmt_plen,
			 &rmt_port))
	{
	  is_ip4 = 0;
	  show_one = 1;
	}
      else
	return clib_error_return (0, "unknown input `%U'",
				  format_unformat_error, input);
    }

  if (transport_proto == ~0)
    {
      vlib_cli_output (vm, "transport proto must be set");
      return 0;
    }

  if (ns_id)
    {
      app_ns = app_namespace_get_from_id (ns_id);
      if (!app_ns)
	{
	  vlib_cli_output (vm, "appns %v doesn't exist", ns_id);
	  return 0;
	}
    }
  else
    {
      app_ns = app_namespace_get_default ();
    }

  if (scope == 1 || scope == 0)
    {
      fib_proto = is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
      fib_index = is_ip4 ? app_ns->ip4_fib_index : app_ns->ip6_fib_index;
      st = session_table_get_for_fib_index (fib_proto, fib_index);
    }
  else
    {
      st = app_namespace_get_local_table (app_ns);
    }

  if (show_one)
    {
      srt = &st->session_rules[transport_proto];
      session_rules_table_show_rule (vm, srt, &lcl_ip, lcl_port, &rmt_ip,
				     rmt_port, is_ip4);
      return 0;
    }

  vlib_cli_output (vm, "%U rules table", format_transport_proto,
		   transport_proto);
  srt = &st->session_rules[transport_proto];
  session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4);
  session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP6);

  vec_free (ns_id);
  return 0;
}

/* *INDENT-OFF* */
VLIB_CLI_COMMAND (show_session_rules_command, static) =
{
  .path = "show session rules",
  .short_help = "show session rules [<proto> appns <id> <lcl-ip/plen> "
      "<lcl-port> <rmt-ip/plen> <rmt-port> scope <scope>]",
  .function = show_session_rules_command_fn,
};
/* *INDENT-ON* */

void
session_lookup_init (void)
{
  /*
   * Allocate default table and map it to fib_index 0
   */
  session_table_t *st = session_table_alloc ();
  vec_validate (fib_index_to_table_index[FIB_PROTOCOL_IP4], 0);
  fib_index_to_table_index[FIB_PROTOCOL_IP4][0] = session_table_index (st);
  st->active_fib_proto = FIB_PROTOCOL_IP4;
  session_table_init (st, FIB_PROTOCOL_IP4);
  st = session_table_alloc ();
  vec_validate (fib_index_to_table_index[FIB_PROTOCOL_IP6], 0);
  fib_index_to_table_index[FIB_PROTOCOL_IP6][0] = session_table_index (st);
  st->active_fib_proto = FIB_PROTOCOL_IP6;
  session_table_init (st, FIB_PROTOCOL_IP6);
}

/*
 * fd.io coding-style-patch-verification: ON
 *
 * Local Variables:
 * eval: (c-set-style "gnu")
 * End:
 */