diff options
Diffstat (limited to 'src')
103 files changed, 5695 insertions, 1541 deletions
diff --git a/src/plugins/abf/abf_itf_attach.c b/src/plugins/abf/abf_itf_attach.c index 04e5c4c40c2..3e55df52562 100644 --- a/src/plugins/abf/abf_itf_attach.c +++ b/src/plugins/abf/abf_itf_attach.c @@ -681,18 +681,20 @@ VLIB_REGISTER_NODE (abf_ip6_node) = } }; -VNET_FEATURE_INIT (abf_ip4_feat, static) = -{ +VNET_FEATURE_INIT (abf_ip4_feat, static) = { .arc_name = "ip4-unicast", .node_name = "abf-input-ip4", - .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"), + .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa", + "ip4-full-reassembly-feature", + "ip4-sv-reassembly-feature"), }; -VNET_FEATURE_INIT (abf_ip6_feat, static) = -{ +VNET_FEATURE_INIT (abf_ip6_feat, static) = { .arc_name = "ip6-unicast", .node_name = "abf-input-ip6", - .runs_after = VNET_FEATURES ("acl-plugin-in-ip6-fa"), + .runs_after = VNET_FEATURES ("acl-plugin-in-ip6-fa", + "ip6-full-reassembly-feature", + "ip6-sv-reassembly-feature"), }; static fib_node_t * diff --git a/src/plugins/dpdk/device/format.c b/src/plugins/dpdk/device/format.c index fd301da8ea5..f0199c929cc 100644 --- a/src/plugins/dpdk/device/format.c +++ b/src/plugins/dpdk/device/format.c @@ -117,8 +117,8 @@ _ (TX_MACSEC, "TX MACSEC") \ _ (TX_OUTER_IPV4, "TX outer IPV4") \ _ (TX_OUTER_IPV6, "TX outer IPV6") \ - _ (TX_OUTER_IP_CKSUM, "Outer IP cksum of Tx pkt. computed by NIC") \ - _ (TX_OUTER_UDP_CKSUM, "TX outer UDP cksum") \ + _ (TX_OUTER_IP_CKSUM, "Outer IP cksum of TX pkt. computed by NIC") \ + _ (TX_OUTER_UDP_CKSUM, "Outer UDP cksum of TX pkt. computed by NIC") \ _ (TX_QINQ, "TX QINQ") \ _ (TX_SCTP_CKSUM, "SCTP cksum of TX pkt. computed by NIC") \ _ (TX_SEC_OFFLOAD, "TX SEC OFFLOAD") \ @@ -133,7 +133,7 @@ _ (TX_TUNNEL_UDP, "TX tunnel UDP") \ _ (TX_TUNNEL_VXLAN, "TX packet is a VXLAN packet") \ _ (TX_TUNNEL_VXLAN_GPE, "TX tunnel VXLAN GPE") \ - _ (TX_UDP_CKSUM, "TX UDP cksum") \ + _ (TX_UDP_CKSUM, "UDP cksum of TX pkt. computed by NIC") \ _ (TX_UDP_SEG, "TX UDP SEG") \ _ (TX_VLAN, "TX packet is a 802.1q VLAN packet") diff --git a/src/plugins/hs_apps/http_client.c b/src/plugins/hs_apps/http_client.c index e4759317cbe..4701253bf59 100644 --- a/src/plugins/hs_apps/http_client.c +++ b/src/plugins/hs_apps/http_client.c @@ -693,9 +693,9 @@ hc_get_event (vlib_main_t *vm) { wrk = hc_worker_get (hcm->worker_index); hc_session = hc_session_get (wrk->session_index, wrk->thread_index); - vlib_cli_output (vm, "< %v< %v", hc_session->response_status, - hc_session->resp_headers); - vlib_cli_output (vm, "\n%v\n", hc_session->http_response); + vlib_cli_output (vm, "< %v\n< %v\n%v", hc_session->response_status, + hc_session->resp_headers, + hc_session->http_response); } break; case HC_REPEAT_DONE: @@ -851,8 +851,6 @@ hc_command_fn (vlib_main_t *vm, unformat_input_t *input, ; else if (unformat (line_input, "data %v", &hcm->data)) hcm->is_file = 0; - else if (unformat (line_input, "target %s", &hcm->target)) - ; else if (unformat (line_input, "file %s", &path)) hcm->is_file = 1; else if (unformat (line_input, "use-ptr")) @@ -919,11 +917,7 @@ hc_command_fn (vlib_main_t *vm, unformat_input_t *input, err = clib_error_return (0, "URI not defined"); goto done; } - if (!hcm->target) - { - err = clib_error_return (0, "target not defined"); - goto done; - } + if (!hcm->data && hcm->req_method == HTTP_REQ_POST) { if (path) @@ -939,6 +933,7 @@ hc_command_fn (vlib_main_t *vm, unformat_input_t *input, goto done; } } + if (hcm->duration && hcm->repeat_count) { err = clib_error_return ( @@ -953,6 +948,13 @@ hc_command_fn (vlib_main_t *vm, unformat_input_t *input, goto done; } + if ((rv = parse_target ((char **) &hcm->uri, (char **) &hcm->target))) + { + err = clib_error_return (0, "target parse error: %U", + format_session_error, rv); + goto done; + } + if ((rv = parse_uri ((char *) hcm->uri, &hcm->connect_sep))) { err = @@ -1000,7 +1002,7 @@ done: VLIB_CLI_COMMAND (hc_command, static) = { .path = "http client", .short_help = - "[post] uri http://<ip-addr> target <origin-form> " + "[post] uri http://<ip-addr>/<origin-form> " "[data <form-urlencoded> | file <file-path>] [use-ptr] " "[save-to <filename>] [header <Key:Value>] [verbose] " "[timeout <seconds> (default = 10)] [repeat <count> | duration <seconds>] " diff --git a/src/plugins/hs_apps/http_client_cli.c b/src/plugins/hs_apps/http_client_cli.c index 4ee3b49444c..8df5bfd10b8 100644 --- a/src/plugins/hs_apps/http_client_cli.c +++ b/src/plugins/hs_apps/http_client_cli.c @@ -62,6 +62,8 @@ typedef struct u8 *http_response; u8 *appns_id; u64 appns_secret; + u32 ckpair_index; + u8 need_crypto; } hcc_main_t; typedef enum @@ -333,6 +335,7 @@ hcc_attach () vnet_app_attach_args_t _a, *a = &_a; u64 options[18]; u32 segment_size = 128 << 20; + vnet_app_add_cert_key_pair_args_t _ck_pair, *ck_pair = &_ck_pair; int rv; if (hcm->private_segment_size) @@ -353,6 +356,7 @@ hcc_attach () hcm->fifo_size ? hcm->fifo_size : 32 << 10; a->options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; a->options[APP_OPTIONS_PREALLOC_FIFO_PAIRS] = hcm->prealloc_fifos; + a->options[APP_OPTIONS_TLS_ENGINE] = CRYPTO_ENGINE_OPENSSL; if (hcm->appns_id) { a->namespace_id = hcm->appns_id; @@ -365,6 +369,15 @@ hcc_attach () hcm->app_index = a->app_index; vec_free (a->name); hcm->test_client_attached = 1; + + clib_memset (ck_pair, 0, sizeof (*ck_pair)); + ck_pair->cert = (u8 *) test_srv_crt_rsa; + ck_pair->key = (u8 *) test_srv_key_rsa; + ck_pair->cert_len = test_srv_crt_rsa_len; + ck_pair->key_len = test_srv_key_rsa_len; + vnet_app_add_cert_key_pair (ck_pair); + hcm->ckpair_index = ck_pair->index; + return 0; } @@ -411,6 +424,14 @@ hcc_connect () &a->sep_ext, TRANSPORT_ENDPT_EXT_CFG_HTTP, sizeof (http_cfg)); clib_memcpy (ext_cfg->data, &http_cfg, sizeof (http_cfg)); + if (hcm->need_crypto) + { + ext_cfg = session_endpoint_add_ext_cfg ( + &a->sep_ext, TRANSPORT_ENDPT_EXT_CFG_CRYPTO, + sizeof (transport_endpt_crypto_cfg_t)); + ext_cfg->crypto.ckpair_index = hcm->ckpair_index; + } + /* allocate http session on main thread */ wrk = hcc_worker_get (0); hs = hcc_session_alloc (wrk); @@ -581,6 +602,8 @@ hcc_command_fn (vlib_main_t *vm, unformat_input_t *input, err = clib_error_return (0, "Uri parse error: %d", rv); goto done; } + hcm->need_crypto = hcm->connect_sep.transport_proto == TRANSPORT_PROTO_TLS; + hcm->connect_sep.transport_proto = TRANSPORT_PROTO_HTTP; session_enable_disable_args_t args = { .is_en = 1, .rt_engine_type = diff --git a/src/plugins/http/CMakeLists.txt b/src/plugins/http/CMakeLists.txt index ad584821c06..58cb4c000e3 100644 --- a/src/plugins/http/CMakeLists.txt +++ b/src/plugins/http/CMakeLists.txt @@ -13,6 +13,8 @@ add_vpp_plugin(http SOURCES + http2/hpack.c + http2/frame.c http.c http_buffer.c http_timer.c diff --git a/src/plugins/http/extras/mk_huffman_table.py b/src/plugins/http/extras/mk_huffman_table.py new file mode 100644 index 00000000000..378544b0dce --- /dev/null +++ b/src/plugins/http/extras/mk_huffman_table.py @@ -0,0 +1,416 @@ +#!/usr/bin/env python3 +from io import StringIO + + +# SPDX-License-Identifier: Apache-2.0 +# Copyright(c) 2025 Cisco Systems, Inc. + + +# e.g. 5 bit code symbol has 8 slots (2^8-5), last 3 bits are irrelevant +def generate_slots(fh, s, cl): + for i in range(1 << 8 - cl): + fh.write(" { 0x%02X, %d },\n" % (s, cl)) + + +# list of code and code length tuples +huff_code_table = [] + +# Huffman code from RFC7541 Appendix B, EOS removed +rfc7541_huffman_code = """\ + ( 0) |11111111|11000 1ff8 [13] + ( 1) |11111111|11111111|1011000 7fffd8 [23] + ( 2) |11111111|11111111|11111110|0010 fffffe2 [28] + ( 3) |11111111|11111111|11111110|0011 fffffe3 [28] + ( 4) |11111111|11111111|11111110|0100 fffffe4 [28] + ( 5) |11111111|11111111|11111110|0101 fffffe5 [28] + ( 6) |11111111|11111111|11111110|0110 fffffe6 [28] + ( 7) |11111111|11111111|11111110|0111 fffffe7 [28] + ( 8) |11111111|11111111|11111110|1000 fffffe8 [28] + ( 9) |11111111|11111111|11101010 ffffea [24] + ( 10) |11111111|11111111|11111111|111100 3ffffffc [30] + ( 11) |11111111|11111111|11111110|1001 fffffe9 [28] + ( 12) |11111111|11111111|11111110|1010 fffffea [28] + ( 13) |11111111|11111111|11111111|111101 3ffffffd [30] + ( 14) |11111111|11111111|11111110|1011 fffffeb [28] + ( 15) |11111111|11111111|11111110|1100 fffffec [28] + ( 16) |11111111|11111111|11111110|1101 fffffed [28] + ( 17) |11111111|11111111|11111110|1110 fffffee [28] + ( 18) |11111111|11111111|11111110|1111 fffffef [28] + ( 19) |11111111|11111111|11111111|0000 ffffff0 [28] + ( 20) |11111111|11111111|11111111|0001 ffffff1 [28] + ( 21) |11111111|11111111|11111111|0010 ffffff2 [28] + ( 22) |11111111|11111111|11111111|111110 3ffffffe [30] + ( 23) |11111111|11111111|11111111|0011 ffffff3 [28] + ( 24) |11111111|11111111|11111111|0100 ffffff4 [28] + ( 25) |11111111|11111111|11111111|0101 ffffff5 [28] + ( 26) |11111111|11111111|11111111|0110 ffffff6 [28] + ( 27) |11111111|11111111|11111111|0111 ffffff7 [28] + ( 28) |11111111|11111111|11111111|1000 ffffff8 [28] + ( 29) |11111111|11111111|11111111|1001 ffffff9 [28] + ( 30) |11111111|11111111|11111111|1010 ffffffa [28] + ( 31) |11111111|11111111|11111111|1011 ffffffb [28] +' ' ( 32) |010100 14 [ 6] +'!' ( 33) |11111110|00 3f8 [10] +'"' ( 34) |11111110|01 3f9 [10] +'#' ( 35) |11111111|1010 ffa [12] +'$' ( 36) |11111111|11001 1ff9 [13] +'%' ( 37) |010101 15 [ 6] +'&' ( 38) |11111000 f8 [ 8] +''' ( 39) |11111111|010 7fa [11] +'(' ( 40) |11111110|10 3fa [10] +')' ( 41) |11111110|11 3fb [10] +'*' ( 42) |11111001 f9 [ 8] +'+' ( 43) |11111111|011 7fb [11] +',' ( 44) |11111010 fa [ 8] +'-' ( 45) |010110 16 [ 6] +'.' ( 46) |010111 17 [ 6] +'/' ( 47) |011000 18 [ 6] +'0' ( 48) |00000 0 [ 5] +'1' ( 49) |00001 1 [ 5] +'2' ( 50) |00010 2 [ 5] +'3' ( 51) |011001 19 [ 6] +'4' ( 52) |011010 1a [ 6] +'5' ( 53) |011011 1b [ 6] +'6' ( 54) |011100 1c [ 6] +'7' ( 55) |011101 1d [ 6] +'8' ( 56) |011110 1e [ 6] +'9' ( 57) |011111 1f [ 6] +':' ( 58) |1011100 5c [ 7] +';' ( 59) |11111011 fb [ 8] +'<' ( 60) |11111111|1111100 7ffc [15] +'=' ( 61) |100000 20 [ 6] +'>' ( 62) |11111111|1011 ffb [12] +'?' ( 63) |11111111|00 3fc [10] +'@' ( 64) |11111111|11010 1ffa [13] +'A' ( 65) |100001 21 [ 6] +'B' ( 66) |1011101 5d [ 7] +'C' ( 67) |1011110 5e [ 7] +'D' ( 68) |1011111 5f [ 7] +'E' ( 69) |1100000 60 [ 7] +'F' ( 70) |1100001 61 [ 7] +'G' ( 71) |1100010 62 [ 7] +'H' ( 72) |1100011 63 [ 7] +'I' ( 73) |1100100 64 [ 7] +'J' ( 74) |1100101 65 [ 7] +'K' ( 75) |1100110 66 [ 7] +'L' ( 76) |1100111 67 [ 7] +'M' ( 77) |1101000 68 [ 7] +'N' ( 78) |1101001 69 [ 7] +'O' ( 79) |1101010 6a [ 7] +'P' ( 80) |1101011 6b [ 7] +'Q' ( 81) |1101100 6c [ 7] +'R' ( 82) |1101101 6d [ 7] +'S' ( 83) |1101110 6e [ 7] +'T' ( 84) |1101111 6f [ 7] +'U' ( 85) |1110000 70 [ 7] +'V' ( 86) |1110001 71 [ 7] +'W' ( 87) |1110010 72 [ 7] +'X' ( 88) |11111100 fc [ 8] +'Y' ( 89) |1110011 73 [ 7] +'Z' ( 90) |11111101 fd [ 8] +'[' ( 91) |11111111|11011 1ffb [13] +'\' ( 92) |11111111|11111110|000 7fff0 [19] +']' ( 93) |11111111|11100 1ffc [13] +'^' ( 94) |11111111|111100 3ffc [14] +'_' ( 95) |100010 22 [ 6] +'`' ( 96) |11111111|1111101 7ffd [15] +'a' ( 97) |00011 3 [ 5] +'b' ( 98) |100011 23 [ 6] +'c' ( 99) |00100 4 [ 5] +'d' (100) |100100 24 [ 6] +'e' (101) |00101 5 [ 5] +'f' (102) |100101 25 [ 6] +'g' (103) |100110 26 [ 6] +'h' (104) |100111 27 [ 6] +'i' (105) |00110 6 [ 5] +'j' (106) |1110100 74 [ 7] +'k' (107) |1110101 75 [ 7] +'l' (108) |101000 28 [ 6] +'m' (109) |101001 29 [ 6] +'n' (110) |101010 2a [ 6] +'o' (111) |00111 7 [ 5] +'p' (112) |101011 2b [ 6] +'q' (113) |1110110 76 [ 7] +'r' (114) |101100 2c [ 6] +'s' (115) |01000 8 [ 5] +'t' (116) |01001 9 [ 5] +'u' (117) |101101 2d [ 6] +'v' (118) |1110111 77 [ 7] +'w' (119) |1111000 78 [ 7] +'x' (120) |1111001 79 [ 7] +'y' (121) |1111010 7a [ 7] +'z' (122) |1111011 7b [ 7] +'{' (123) |11111111|1111110 7ffe [15] +'|' (124) |11111111|100 7fc [11] +'}' (125) |11111111|111101 3ffd [14] +'~' (126) |11111111|11101 1ffd [13] + (127) |11111111|11111111|11111111|1100 ffffffc [28] + (128) |11111111|11111110|0110 fffe6 [20] + (129) |11111111|11111111|010010 3fffd2 [22] + (130) |11111111|11111110|0111 fffe7 [20] + (131) |11111111|11111110|1000 fffe8 [20] + (132) |11111111|11111111|010011 3fffd3 [22] + (133) |11111111|11111111|010100 3fffd4 [22] + (134) |11111111|11111111|010101 3fffd5 [22] + (135) |11111111|11111111|1011001 7fffd9 [23] + (136) |11111111|11111111|010110 3fffd6 [22] + (137) |11111111|11111111|1011010 7fffda [23] + (138) |11111111|11111111|1011011 7fffdb [23] + (139) |11111111|11111111|1011100 7fffdc [23] + (140) |11111111|11111111|1011101 7fffdd [23] + (141) |11111111|11111111|1011110 7fffde [23] + (142) |11111111|11111111|11101011 ffffeb [24] + (143) |11111111|11111111|1011111 7fffdf [23] + (144) |11111111|11111111|11101100 ffffec [24] + (145) |11111111|11111111|11101101 ffffed [24] + (146) |11111111|11111111|010111 3fffd7 [22] + (147) |11111111|11111111|1100000 7fffe0 [23] + (148) |11111111|11111111|11101110 ffffee [24] + (149) |11111111|11111111|1100001 7fffe1 [23] + (150) |11111111|11111111|1100010 7fffe2 [23] + (151) |11111111|11111111|1100011 7fffe3 [23] + (152) |11111111|11111111|1100100 7fffe4 [23] + (153) |11111111|11111110|11100 1fffdc [21] + (154) |11111111|11111111|011000 3fffd8 [22] + (155) |11111111|11111111|1100101 7fffe5 [23] + (156) |11111111|11111111|011001 3fffd9 [22] + (157) |11111111|11111111|1100110 7fffe6 [23] + (158) |11111111|11111111|1100111 7fffe7 [23] + (159) |11111111|11111111|11101111 ffffef [24] + (160) |11111111|11111111|011010 3fffda [22] + (161) |11111111|11111110|11101 1fffdd [21] + (162) |11111111|11111110|1001 fffe9 [20] + (163) |11111111|11111111|011011 3fffdb [22] + (164) |11111111|11111111|011100 3fffdc [22] + (165) |11111111|11111111|1101000 7fffe8 [23] + (166) |11111111|11111111|1101001 7fffe9 [23] + (167) |11111111|11111110|11110 1fffde [21] + (168) |11111111|11111111|1101010 7fffea [23] + (169) |11111111|11111111|011101 3fffdd [22] + (170) |11111111|11111111|011110 3fffde [22] + (171) |11111111|11111111|11110000 fffff0 [24] + (172) |11111111|11111110|11111 1fffdf [21] + (173) |11111111|11111111|011111 3fffdf [22] + (174) |11111111|11111111|1101011 7fffeb [23] + (175) |11111111|11111111|1101100 7fffec [23] + (176) |11111111|11111111|00000 1fffe0 [21] + (177) |11111111|11111111|00001 1fffe1 [21] + (178) |11111111|11111111|100000 3fffe0 [22] + (179) |11111111|11111111|00010 1fffe2 [21] + (180) |11111111|11111111|1101101 7fffed [23] + (181) |11111111|11111111|100001 3fffe1 [22] + (182) |11111111|11111111|1101110 7fffee [23] + (183) |11111111|11111111|1101111 7fffef [23] + (184) |11111111|11111110|1010 fffea [20] + (185) |11111111|11111111|100010 3fffe2 [22] + (186) |11111111|11111111|100011 3fffe3 [22] + (187) |11111111|11111111|100100 3fffe4 [22] + (188) |11111111|11111111|1110000 7ffff0 [23] + (189) |11111111|11111111|100101 3fffe5 [22] + (190) |11111111|11111111|100110 3fffe6 [22] + (191) |11111111|11111111|1110001 7ffff1 [23] + (192) |11111111|11111111|11111000|00 3ffffe0 [26] + (193) |11111111|11111111|11111000|01 3ffffe1 [26] + (194) |11111111|11111110|1011 fffeb [20] + (195) |11111111|11111110|001 7fff1 [19] + (196) |11111111|11111111|100111 3fffe7 [22] + (197) |11111111|11111111|1110010 7ffff2 [23] + (198) |11111111|11111111|101000 3fffe8 [22] + (199) |11111111|11111111|11110110|0 1ffffec [25] + (200) |11111111|11111111|11111000|10 3ffffe2 [26] + (201) |11111111|11111111|11111000|11 3ffffe3 [26] + (202) |11111111|11111111|11111001|00 3ffffe4 [26] + (203) |11111111|11111111|11111011|110 7ffffde [27] + (204) |11111111|11111111|11111011|111 7ffffdf [27] + (205) |11111111|11111111|11111001|01 3ffffe5 [26] + (206) |11111111|11111111|11110001 fffff1 [24] + (207) |11111111|11111111|11110110|1 1ffffed [25] + (208) |11111111|11111110|010 7fff2 [19] + (209) |11111111|11111111|00011 1fffe3 [21] + (210) |11111111|11111111|11111001|10 3ffffe6 [26] + (211) |11111111|11111111|11111100|000 7ffffe0 [27] + (212) |11111111|11111111|11111100|001 7ffffe1 [27] + (213) |11111111|11111111|11111001|11 3ffffe7 [26] + (214) |11111111|11111111|11111100|010 7ffffe2 [27] + (215) |11111111|11111111|11110010 fffff2 [24] + (216) |11111111|11111111|00100 1fffe4 [21] + (217) |11111111|11111111|00101 1fffe5 [21] + (218) |11111111|11111111|11111010|00 3ffffe8 [26] + (219) |11111111|11111111|11111010|01 3ffffe9 [26] + (220) |11111111|11111111|11111111|1101 ffffffd [28] + (221) |11111111|11111111|11111100|011 7ffffe3 [27] + (222) |11111111|11111111|11111100|100 7ffffe4 [27] + (223) |11111111|11111111|11111100|101 7ffffe5 [27] + (224) |11111111|11111110|1100 fffec [20] + (225) |11111111|11111111|11110011 fffff3 [24] + (226) |11111111|11111110|1101 fffed [20] + (227) |11111111|11111111|00110 1fffe6 [21] + (228) |11111111|11111111|101001 3fffe9 [22] + (229) |11111111|11111111|00111 1fffe7 [21] + (230) |11111111|11111111|01000 1fffe8 [21] + (231) |11111111|11111111|1110011 7ffff3 [23] + (232) |11111111|11111111|101010 3fffea [22] + (233) |11111111|11111111|101011 3fffeb [22] + (234) |11111111|11111111|11110111|0 1ffffee [25] + (235) |11111111|11111111|11110111|1 1ffffef [25] + (236) |11111111|11111111|11110100 fffff4 [24] + (237) |11111111|11111111|11110101 fffff5 [24] + (238) |11111111|11111111|11111010|10 3ffffea [26] + (239) |11111111|11111111|1110100 7ffff4 [23] + (240) |11111111|11111111|11111010|11 3ffffeb [26] + (241) |11111111|11111111|11111100|110 7ffffe6 [27] + (242) |11111111|11111111|11111011|00 3ffffec [26] + (243) |11111111|11111111|11111011|01 3ffffed [26] + (244) |11111111|11111111|11111100|111 7ffffe7 [27] + (245) |11111111|11111111|11111101|000 7ffffe8 [27] + (246) |11111111|11111111|11111101|001 7ffffe9 [27] + (247) |11111111|11111111|11111101|010 7ffffea [27] + (248) |11111111|11111111|11111101|011 7ffffeb [27] + (249) |11111111|11111111|11111111|1110 ffffffe [28] + (250) |11111111|11111111|11111101|100 7ffffec [27] + (251) |11111111|11111111|11111101|101 7ffffed [27] + (252) |11111111|11111111|11111101|110 7ffffee [27] + (253) |11111111|11111111|11111101|111 7ffffef [27] + (254) |11111111|11111111|11111110|000 7fffff0 [27] + (255) |11111111|11111111|11111011|10 3ffffee [26]""" + +# parse Huffman code +for line in StringIO(rfc7541_huffman_code): + # we need just last two columns + l = line.rstrip().split(" ") + # len in bits + code_len = l[-1][1:-1].strip() + # code as hex aligned to LSB + code = l[-2].strip() + huff_code_table.append((code_len, code)) + +f = open("../http2/huffman_table.h", "w") +f.write( + """/* SPDX-License-Identifier: Apache-2.0 + * Copyright(c) 2025 Cisco Systems, Inc. + */ + +/* generated by mk_huffman_table.py */ + +#ifndef SRC_PLUGINS_HTTP_HUFFMAN_TABLE_H_ +#define SRC_PLUGINS_HTTP_HUFFMAN_TABLE_H_ + +#include <vppinfra/types.h> + +typedef struct +{ + u8 code_len; + u32 code; +} hpack_huffman_symbol_t; + +static hpack_huffman_symbol_t huff_sym_table[] = { +""" +) + +# encoding table +[f.write(" {" + code[0] + ", 0x" + code[1] + "},\n") for code in huff_code_table] + +f.write( + """}; + +typedef struct +{ + u8 symbol; + u8 code_len; +} hpack_huffman_code_t; + +static hpack_huffman_code_t huff_code_table_fast[] = { +""" +) + +# fast decoding table, symbols with code length from 5 to 8 bits (most of printable ASCII characters) +[generate_slots(f, i, 5) for i, code in enumerate(huff_code_table) if code[0] == "5"] +[generate_slots(f, i, 6) for i, code in enumerate(huff_code_table) if code[0] == "6"] +[generate_slots(f, i, 7) for i, code in enumerate(huff_code_table) if code[0] == "7"] +[generate_slots(f, i, 8) for i, code in enumerate(huff_code_table) if code[0] == "8"] + +# last 2 entries are longer codes prefixes, code_len set to 0 +f.write(" { 0x00, 0 },\n") +f.write(" { 0x00, 0 },\n") + +f.write( + """}; + +typedef struct +{ + u32 first_code; + u8 code_len; + u8 symbols[29]; +} hpack_huffman_group_t; + +/* clang-format off */ + +static hpack_huffman_group_t huff_code_table_slow[] = { +""" +) +for i in range(10, 31): + symbols = [ + (symbol, code[1]) + for symbol, code in enumerate(huff_code_table) + if code[0] == str(i) + ] + if symbols: + _, first_code = symbols[0] + f.write(" {\n 0x" + first_code + ", /* first_code */\n") + f.write(" " + str(i) + ", /* code_len */\n") + f.write(" {\n ") + [f.write(" 0x%02X," % s) for s, c in symbols[:10]] + if len(symbols) > 10: + f.write("\n ") + [f.write(" 0x%02X," % s) for s, c in symbols[10:20]] + if len(symbols) > 20: + f.write("\n ") + [f.write(" 0x%02X," % s) for s, c in symbols[20:30]] + f.write("\n } /* symbols */\n },\n") + +f.write( + """}; + +/* clang format-on */ + +always_inline hpack_huffman_group_t * +hpack_huffman_get_group (u32 value) +{ +""" +) + +index = 0 + +symbols = [ + (symbol, code[1]) for symbol, code in enumerate(huff_code_table) if code[0] == "10" +] +_, last_code = symbols[-1] +boundary = (int(last_code, 16) + 1) << 22 +f.write(" if (value < 0x%X)\n" % boundary) +f.write(" return &huff_code_table_slow[%d];\n" % index) +index += 1 + +for i in range(11, 30): + symbols = [ + (symbol, code[1]) + for symbol, code in enumerate(huff_code_table) + if code[0] == str(i) + ] + if symbols: + _, last_code = symbols[-1] + boundary = (int(last_code, 16) + 1) << (32 - i) + f.write(" else if (value < 0x%X)\n" % boundary) + f.write(" return &huff_code_table_slow[%d];\n" % index) + index += 1 + +f.write(" else\n") +f.write(" return &huff_code_table_slow[%d];\n" % index) + +f.write( + """} + +#endif /* SRC_PLUGINS_HTTP_HUFFMAN_TABLE_H_ */ +""" +) + +f.close() diff --git a/src/plugins/http/http.c b/src/plugins/http/http.c index c995c996433..fc5b7d5d72d 100644 --- a/src/plugins/http/http.c +++ b/src/plugins/http/http.c @@ -179,6 +179,13 @@ http_conn_free (http_conn_t *hc) pool_put (wrk->conn_pool, hc); } +static void +http_add_postponed_ho_cleanups (u32 ho_hc_index) +{ + http_main_t *hm = &http_main; + vec_add1 (hm->postponed_ho_free, ho_hc_index); +} + static inline http_conn_t * http_ho_conn_get (u32 ho_hc_index) { @@ -195,12 +202,49 @@ http_ho_conn_free (http_conn_t *ho_hc) pool_put (hm->ho_conn_pool, ho_hc); } +static void +http_ho_try_free (u32 ho_hc_index) +{ + http_conn_t *ho_hc; + HTTP_DBG (1, "half open: %x", ho_hc_index); + ho_hc = http_ho_conn_get (ho_hc_index); + if (!(ho_hc->flags & HTTP_CONN_F_HO_DONE)) + { + HTTP_DBG (1, "postponed cleanup"); + ho_hc->h_tc_session_handle = SESSION_INVALID_HANDLE; + http_add_postponed_ho_cleanups (ho_hc_index); + return; + } + if (!(ho_hc->flags & HTTP_CONN_F_NO_APP_SESSION)) + session_half_open_delete_notify (&ho_hc->connection); + http_ho_conn_free (ho_hc); +} + +static void +http_flush_postponed_ho_cleanups () +{ + http_main_t *hm = &http_main; + u32 *ho_indexp, *tmp; + + tmp = hm->postponed_ho_free; + hm->postponed_ho_free = hm->ho_free_list; + hm->ho_free_list = tmp; + + vec_foreach (ho_indexp, hm->ho_free_list) + http_ho_try_free (*ho_indexp); + + vec_reset_length (hm->ho_free_list); +} + static inline u32 http_ho_conn_alloc (void) { http_main_t *hm = &http_main; http_conn_t *hc; + if (vec_len (hm->postponed_ho_free)) + http_flush_postponed_ho_cleanups (); + pool_get_aligned_safe (hm->ho_conn_pool, hc, CLIB_CACHE_LINE_BYTES); clib_memset (hc, 0, sizeof (*hc)); hc->h_hc_index = hc - hm->ho_conn_pool; @@ -361,7 +405,7 @@ http_conn_invalidate_timer_cb (u32 hs_handle) } hc->timer_handle = HTTP_TIMER_HANDLE_INVALID; - hc->pending_timer = 1; + hc->flags |= HTTP_CONN_F_PENDING_TIMER; } static void @@ -381,7 +425,7 @@ http_conn_timeout_cb (void *hc_handlep) return; } - if (!hc->pending_timer) + if (!(hc->flags & HTTP_CONN_F_PENDING_TIMER)) { HTTP_DBG (1, "timer not pending"); return; @@ -492,6 +536,7 @@ http_ts_connected_callback (u32 http_app_index, u32 ho_hc_index, session_t *ts, { clib_warning ("half-open hc index %d, error: %U", ho_hc_index, format_session_error, err); + ho_hc->flags |= HTTP_CONN_F_HO_DONE; app_wrk = app_worker_get_if_valid (ho_hc->h_pa_wrk_index); if (app_wrk) app_worker_connect_notify (app_wrk, 0, err, ho_hc->h_pa_app_api_ctx); @@ -503,6 +548,9 @@ http_ts_connected_callback (u32 http_app_index, u32 ho_hc_index, session_t *ts, clib_memcpy_fast (hc, ho_hc, sizeof (*hc)); + /* in chain with TLS there is race on half-open cleanup */ + __atomic_fetch_or (&ho_hc->flags, HTTP_CONN_F_HO_DONE, __ATOMIC_RELEASE); + hc->timer_handle = HTTP_TIMER_HANDLE_INVALID; hc->c_thread_index = ts->thread_index; hc->h_tc_session_handle = session_handle (ts); @@ -642,12 +690,12 @@ http_ts_cleanup_callback (session_t *ts, session_cleanup_ntf_t ntf) } pool_free (hc->req_pool); - if (hc->pending_timer == 0) + if (!(hc->flags & HTTP_CONN_F_PENDING_TIMER)) http_conn_timer_stop (hc); session_transport_delete_notify (&hc->connection); - if (!hc->is_server) + if (!(hc->flags & HTTP_CONN_F_IS_SERVER)) { vec_free (hc->app_name); vec_free (hc->host); @@ -658,12 +706,9 @@ http_ts_cleanup_callback (session_t *ts, session_cleanup_ntf_t ntf) static void http_ts_ho_cleanup_callback (session_t *ts) { - http_conn_t *ho_hc; u32 ho_hc_index = http_conn_index_from_handle (ts->opaque); HTTP_DBG (1, "half open: %x", ho_hc_index); - ho_hc = http_ho_conn_get (ho_hc_index); - session_half_open_delete_notify (&ho_hc->connection); - http_ho_conn_free (ho_hc); + http_ho_try_free (ho_hc_index); } int @@ -803,7 +848,12 @@ http_transport_connect (transport_endpoint_cfg_t *tep) hc->timeout = http_cfg->timeout; } - hc->is_server = 0; + ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_CRYPTO); + if (ext_cfg) + { + HTTP_DBG (1, "app set tls"); + cargs->sep.transport_proto = TRANSPORT_PROTO_TLS; + } if (vec_len (app->name)) hc->app_name = vec_dup (app->name); @@ -895,7 +945,7 @@ http_start_listen (u32 app_listener_index, transport_endpoint_cfg_t *tep) lhc->c_s_index = app_listener_index; lhc->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP; - lhc->is_server = 1; + lhc->flags |= HTTP_CONN_F_IS_SERVER; if (vec_len (app->name)) lhc->app_name = vec_dup (app->name); @@ -1142,6 +1192,12 @@ http_transport_cleanup_ho (u32 ho_hc_index) HTTP_DBG (1, "half open: %x", ho_hc_index); ho_hc = http_ho_conn_get (ho_hc_index); + if (ho_hc->h_tc_session_handle == SESSION_INVALID_HANDLE) + { + HTTP_DBG (1, "already pending cleanup"); + ho_hc->flags |= HTTP_CONN_F_NO_APP_SESSION; + return; + } session_cleanup_half_open (ho_hc->h_tc_session_handle); http_ho_conn_free (ho_hc); } diff --git a/src/plugins/http/http.h b/src/plugins/http/http.h index 178bdd14881..434ff965b6a 100644 --- a/src/plugins/http/http.h +++ b/src/plugins/http/http.h @@ -56,6 +56,7 @@ typedef enum http_req_method_ HTTP_REQ_GET = 0, HTTP_REQ_POST, HTTP_REQ_CONNECT, + HTTP_REQ_UNKNOWN, /* for internal use */ } http_req_method_t; typedef enum http_msg_type_ @@ -209,96 +210,108 @@ typedef enum http_status_code_ } http_status_code_t; #define foreach_http_header_name \ - _ (ACCEPT, "Accept") \ - _ (ACCEPT_CHARSET, "Accept-Charset") \ - _ (ACCEPT_ENCODING, "Accept-Encoding") \ - _ (ACCEPT_LANGUAGE, "Accept-Language") \ - _ (ACCEPT_RANGES, "Accept-Ranges") \ - _ (ACCESS_CONTROL_ALLOW_CREDENTIALS, "Access-Control-Allow-Credentials") \ - _ (ACCESS_CONTROL_ALLOW_HEADERS, "Access-Control-Allow-Headers") \ - _ (ACCESS_CONTROL_ALLOW_METHODS, "Access-Control-Allow-Methods") \ - _ (ACCESS_CONTROL_ALLOW_ORIGIN, "Access-Control-Allow-Origin") \ - _ (ACCESS_CONTROL_EXPOSE_HEADERS, "Access-Control-Expose-Headers") \ - _ (ACCESS_CONTROL_MAX_AGE, "Access-Control-Max-Age") \ - _ (ACCESS_CONTROL_REQUEST_HEADERS, "Access-Control-Request-Headers") \ - _ (ACCESS_CONTROL_REQUEST_METHOD, "Access-Control-Request-Method") \ - _ (AGE, "Age") \ - _ (ALLOW, "Allow") \ - _ (ALPN, "ALPN") \ - _ (ALT_SVC, "Alt-Svc") \ - _ (ALT_USED, "Alt-Used") \ - _ (ALTERNATES, "Alternates") \ - _ (AUTHENTICATION_CONTROL, "Authentication-Control") \ - _ (AUTHENTICATION_INFO, "Authentication-Info") \ - _ (AUTHORIZATION, "Authorization") \ - _ (CACHE_CONTROL, "Cache-Control") \ - _ (CACHE_STATUS, "Cache-Status") \ - _ (CAPSULE_PROTOCOL, "Capsule-Protocol") \ - _ (CDN_CACHE_CONTROL, "CDN-Cache-Control") \ - _ (CDN_LOOP, "CDN-Loop") \ - _ (CLIENT_CERT, "Client-Cert") \ - _ (CLIENT_CERT_CHAIN, "Client-Cert-Chain") \ - _ (CLOSE, "Close") \ - _ (CONNECTION, "Connection") \ - _ (CONTENT_DIGEST, "Content-Digest") \ - _ (CONTENT_DISPOSITION, "Content-Disposition") \ - _ (CONTENT_ENCODING, "Content-Encoding") \ - _ (CONTENT_LANGUAGE, "Content-Language") \ - _ (CONTENT_LENGTH, "Content-Length") \ - _ (CONTENT_LOCATION, "Content-Location") \ - _ (CONTENT_RANGE, "Content-Range") \ - _ (CONTENT_TYPE, "Content-Type") \ - _ (COOKIE, "Cookie") \ - _ (DATE, "Date") \ - _ (DIGEST, "Digest") \ - _ (DPOP, "DPoP") \ - _ (DPOP_NONCE, "DPoP-Nonce") \ - _ (EARLY_DATA, "Early-Data") \ - _ (ETAG, "ETag") \ - _ (EXPECT, "Expect") \ - _ (EXPIRES, "Expires") \ - _ (FORWARDED, "Forwarded") \ - _ (FROM, "From") \ - _ (HOST, "Host") \ - _ (IF_MATCH, "If-Match") \ - _ (IF_MODIFIED_SINCE, "If-Modified-Since") \ - _ (IF_NONE_MATCH, "If-None-Match") \ - _ (IF_RANGE, "If-Range") \ - _ (IF_UNMODIFIED_SINCE, "If-Unmodified-Since") \ - _ (KEEP_ALIVE, "Keep-Alive") \ - _ (LAST_MODIFIED, "Last-Modified") \ - _ (LINK, "Link") \ - _ (LOCATION, "Location") \ - _ (MAX_FORWARDS, "Max-Forwards") \ - _ (ORIGIN, "Origin") \ - _ (PRIORITY, "Priority") \ - _ (PROXY_AUTHENTICATE, "Proxy-Authenticate") \ - _ (PROXY_AUTHENTICATION_INFO, "Proxy-Authentication-Info") \ - _ (PROXY_AUTHORIZATION, "Proxy-Authorization") \ - _ (PROXY_STATUS, "Proxy-Status") \ - _ (RANGE, "Range") \ - _ (REFERER, "Referer") \ - _ (REPR_DIGEST, "Repr-Digest") \ - _ (SET_COOKIE, "Set-Cookie") \ - _ (SIGNATURE, "Signature") \ - _ (SIGNATURE_INPUT, "Signature-Input") \ - _ (STRICT_TRANSPORT_SECURITY, "Strict-Transport-Security") \ - _ (RETRY_AFTER, "Retry-After") \ - _ (SERVER, "Server") \ - _ (TE, "TE") \ - _ (TRAILER, "Trailer") \ - _ (TRANSFER_ENCODING, "Transfer-Encoding") \ - _ (UPGRADE, "Upgrade") \ - _ (USER_AGENT, "User-Agent") \ - _ (VARY, "Vary") \ - _ (VIA, "Via") \ - _ (WANT_CONTENT_DIGEST, "Want-Content-Digest") \ - _ (WANT_REPR_DIGEST, "Want-Repr-Digest") \ - _ (WWW_AUTHENTICATE, "WWW-Authenticate") + _ (ACCEPT_CHARSET, "Accept-Charset", "accept-charset", 15) \ + _ (ACCEPT_ENCODING, "Accept-Encoding", "accept-encoding", 16) \ + _ (ACCEPT_LANGUAGE, "Accept-Language", "accept-language", 17) \ + _ (ACCEPT_RANGES, "Accept-Ranges", "accept-ranges", 18) \ + _ (ACCEPT, "Accept", "accept", 19) \ + _ (ACCESS_CONTROL_ALLOW_CREDENTIALS, "Access-Control-Allow-Credentials", \ + "access-control-allow-credentials", 0) \ + _ (ACCESS_CONTROL_ALLOW_HEADERS, "Access-Control-Allow-Headers", \ + "access-control-allow-headers", 0) \ + _ (ACCESS_CONTROL_ALLOW_METHODS, "Access-Control-Allow-Methods", \ + "access-control-allow-methods", 0) \ + _ (ACCESS_CONTROL_ALLOW_ORIGIN, "Access-Control-Allow-Origin", \ + "access-control-allow-origin", 20) \ + _ (ACCESS_CONTROL_EXPOSE_HEADERS, "Access-Control-Expose-Headers", \ + "access-control-expose-headers", 0) \ + _ (ACCESS_CONTROL_MAX_AGE, "Access-Control-Max-Age", \ + "access-control-max-age", 0) \ + _ (ACCESS_CONTROL_REQUEST_HEADERS, "Access-Control-Request-Headers", \ + "access-control-request-headers", 0) \ + _ (ACCESS_CONTROL_REQUEST_METHOD, "Access-Control-Request-Method", \ + "access-control-request-method", 0) \ + _ (AGE, "Age", "age", 21) \ + _ (ALLOW, "Allow", "allow", 22) \ + _ (ALPN, "ALPN", "alpn", 0) \ + _ (ALT_SVC, "Alt-Svc", "alt-svc", 0) \ + _ (ALT_USED, "Alt-Used", "alt-used", 0) \ + _ (ALTERNATES, "Alternates", "alternates", 0) \ + _ (AUTHENTICATION_CONTROL, "Authentication-Control", \ + "authentication-control", 0) \ + _ (AUTHENTICATION_INFO, "Authentication-Info", "authentication-info", 0) \ + _ (AUTHORIZATION, "Authorization", "authorization", 23) \ + _ (CACHE_CONTROL, "Cache-Control", "cache-control", 24) \ + _ (CACHE_STATUS, "Cache-Status", "cache-status", 0) \ + _ (CAPSULE_PROTOCOL, "Capsule-Protocol", "capsule-protocol", 0) \ + _ (CDN_CACHE_CONTROL, "CDN-Cache-Control", "cdn-cache-control", 0) \ + _ (CDN_LOOP, "CDN-Loop", "cdn-loop", 0) \ + _ (CLIENT_CERT, "Client-Cert", "client-cert", 0) \ + _ (CLIENT_CERT_CHAIN, "Client-Cert-Chain", "client-cert-chain", 0) \ + _ (CLOSE, "Close", "close", 0) \ + _ (CONNECTION, "Connection", "connection", 0) \ + _ (CONTENT_DIGEST, "Content-Digest", "content-digest", 0) \ + _ (CONTENT_DISPOSITION, "Content-Disposition", "content-disposition", 25) \ + _ (CONTENT_ENCODING, "Content-Encoding", "content-encoding", 26) \ + _ (CONTENT_LANGUAGE, "Content-Language", "content-language", 27) \ + _ (CONTENT_LENGTH, "Content-Length", "content-length", 28) \ + _ (CONTENT_LOCATION, "Content-Location", "content-location", 29) \ + _ (CONTENT_RANGE, "Content-Range", "content-range", 30) \ + _ (CONTENT_TYPE, "Content-Type", "content-type", 31) \ + _ (COOKIE, "Cookie", "cookie", 32) \ + _ (DATE, "Date", "date", 33) \ + _ (DIGEST, "Digest", "digest", 0) \ + _ (DPOP, "DPoP", "dpop", 0) \ + _ (DPOP_NONCE, "DPoP-Nonce", "dpop-nonce", 0) \ + _ (EARLY_DATA, "Early-Data", "early-data", 0) \ + _ (ETAG, "ETag", "etag", 34) \ + _ (EXPECT, "Expect", "expect", 35) \ + _ (EXPIRES, "Expires", "expires", 36) \ + _ (FORWARDED, "Forwarded", "forwarded", 0) \ + _ (FROM, "From", "from", 37) \ + _ (HOST, "Host", "host", 38) \ + _ (IF_MATCH, "If-Match", "if-match", 39) \ + _ (IF_MODIFIED_SINCE, "If-Modified-Since", "if-modified-since", 40) \ + _ (IF_NONE_MATCH, "If-None-Match", "if-none-match", 41) \ + _ (IF_RANGE, "If-Range", "if-range", 42) \ + _ (IF_UNMODIFIED_SINCE, "If-Unmodified-Since", "if-unmodified-since", 43) \ + _ (KEEP_ALIVE, "Keep-Alive", "keep-alive", 0) \ + _ (LAST_MODIFIED, "Last-Modified", "last-modified", 44) \ + _ (LINK, "Link", "link", 45) \ + _ (LOCATION, "Location", "location", 46) \ + _ (MAX_FORWARDS, "Max-Forwards", "max-forwards", 47) \ + _ (ORIGIN, "Origin", "origin", 0) \ + _ (PRIORITY, "Priority", "priority", 0) \ + _ (PROXY_AUTHENTICATE, "Proxy-Authenticate", "proxy-authenticate", 48) \ + _ (PROXY_AUTHENTICATION_INFO, "Proxy-Authentication-Info", \ + "proxy-authentication-info", 0) \ + _ (PROXY_AUTHORIZATION, "Proxy-Authorization", "proxy-authorization", 49) \ + _ (PROXY_STATUS, "Proxy-Status", "proxy-status", 0) \ + _ (RANGE, "Range", "range", 50) \ + _ (REFERER, "Referer", "referer", 51) \ + _ (REFRESH, "Refresh", "refresh", 52) \ + _ (REPR_DIGEST, "Repr-Digest", "repr-digest", 0) \ + _ (RETRY_AFTER, "Retry-After", "retry-after", 53) \ + _ (SERVER, "Server", "server", 54) \ + _ (SET_COOKIE, "Set-Cookie", "set-cookie", 55) \ + _ (SIGNATURE, "Signature", "signature", 0) \ + _ (SIGNATURE_INPUT, "Signature-Input", "signature-input", 0) \ + _ (STRICT_TRANSPORT_SECURITY, "Strict-Transport-Security", \ + "strict-transport-security", 56) \ + _ (TE, "TE", "te", 0) \ + _ (TRAILER, "Trailer", "trailer", 0) \ + _ (TRANSFER_ENCODING, "Transfer-Encoding", "transfer-encoding", 57) \ + _ (UPGRADE, "Upgrade", "upgrade", 0) \ + _ (USER_AGENT, "User-Agent", "user-agent", 58) \ + _ (VARY, "Vary", "vary", 59) \ + _ (VIA, "Via", "via", 60) \ + _ (WANT_CONTENT_DIGEST, "Want-Content-Digest", "want-content-digest", 0) \ + _ (WANT_REPR_DIGEST, "Want-Repr-Digest", "want-repr-digest", 0) \ + _ (WWW_AUTHENTICATE, "WWW-Authenticate", "www-authenticate", 61) typedef enum http_header_name_ { -#define _(sym, str) HTTP_HEADER_##sym, +#define _(sym, str_canonical, str_lower, hpack_index) HTTP_HEADER_##sym, foreach_http_header_name #undef _ } http_header_name_t; @@ -337,6 +350,7 @@ typedef enum http_url_scheme_ { HTTP_URL_SCHEME_HTTP, HTTP_URL_SCHEME_HTTPS, + HTTP_URL_SCHEME_UNKNOWN, /* for internal use */ } http_url_scheme_t; typedef struct http_msg_data_ @@ -495,7 +509,8 @@ http_percent_decode (u8 *src, u32 len) } /** - * Remove dot segments from path (RFC3986 section 5.2.4) + * Sanitize HTTP path by squashing repeating slashes and removing + * dot segments from path (RFC3986 section 5.2.4) * * @param path Path to sanitize. * @@ -504,18 +519,18 @@ http_percent_decode (u8 *src, u32 len) * The caller is always responsible to free the returned vector. */ always_inline u8 * -http_path_remove_dot_segments (u8 *path) +http_path_sanitize (u8 *path) { u32 *segments = 0, *segments_len = 0, segment_len; u8 *new_path = 0; int i, ii; - if (!path) + if (!path || vec_len (path) == 0) return vec_new (u8, 0); segments = vec_new (u32, 1); /* first segment */ - segments[0] = 0; + segments[0] = (path[0] == '/' ? 1 : 0); /* find all segments */ for (i = 1; i < (vec_len (path) - 1); i++) { @@ -530,7 +545,8 @@ http_path_remove_dot_segments (u8 *path) for (i = 0; i < vec_len (segments_len); i++) { segment_len = segments[i + 1] - segments[i]; - if (segment_len == 2 && path[segments[i]] == '.') + /* aside from dots, skip empty segments (double slashes) */ + if ((segment_len == 2 && path[segments[i]] == '.') || segment_len == 1) segment_len = 0; else if (segment_len == 3 && path[segments[i]] == '.' && path[segments[i] + 1] == '.') @@ -918,21 +934,24 @@ http_init_headers_ctx (http_headers_ctx_t *ctx, u8 *buf, u32 len) * @param name Header name ID (see @ref http_header_name_t). * @param value Header value pointer. * @param value_len Header value length. + * + * @return @c 0 if in case of success, @c -1 otherwise. */ -always_inline void +always_inline int http_add_header (http_headers_ctx_t *ctx, http_header_name_t name, const char *value, uword value_len) { http_app_header_t *header; - ASSERT ((ctx->tail_offset + sizeof (http_app_header_t) + value_len) < - ctx->len); + if ((ctx->tail_offset + sizeof (http_app_header_t) + value_len) > ctx->len) + return -1; header = (http_app_header_t *) (ctx->buf + ctx->tail_offset); header->name = (u32) name; header->value.len = (u32) value_len; clib_memcpy (header->value.token, (u8 *) value, value_len); ctx->tail_offset += sizeof (http_app_header_t) + value_len; + return 0; } /** @@ -943,15 +962,18 @@ http_add_header (http_headers_ctx_t *ctx, http_header_name_t name, * @param name_len Header name length. * @param value Header value pointer. * @param value_len Header value length. + * + * @return @c 0 if in case of success, @c -1 otherwise. */ -always_inline void +always_inline int http_add_custom_header (http_headers_ctx_t *ctx, const char *name, uword name_len, const char *value, uword value_len) { http_custom_token_t *token; - ASSERT ((ctx->tail_offset + 2 * sizeof (http_custom_token_t) + name_len + - value_len) < ctx->len); + if ((ctx->tail_offset + 2 * sizeof (http_custom_token_t) + name_len + + value_len) > ctx->len) + return -1; /* name */ token = (http_custom_token_t *) (ctx->buf + ctx->tail_offset); @@ -964,6 +986,18 @@ http_add_custom_header (http_headers_ctx_t *ctx, const char *name, token->len = (u32) value_len; clib_memcpy (token->token, (u8 *) value, token->len); ctx->tail_offset += sizeof (http_custom_token_t) + value_len; + return 0; +} + +/** + * Truncate the header list + * + * @param ctx Headers list context. + */ +always_inline void +http_truncate_headers_list (http_headers_ctx_t *ctx) +{ + ctx->tail_offset = 0; } typedef enum http_uri_host_type_ diff --git a/src/plugins/http/http1.c b/src/plugins/http/http1.c index 44dd099ccee..c152956e43c 100644 --- a/src/plugins/http/http1.c +++ b/src/plugins/http/http1.c @@ -1028,7 +1028,7 @@ http1_req_state_transport_io_more_data (http_conn_t *hc, http_req_t *req, * server back to HTTP_REQ_STATE_WAIT_APP_REPLY * client to HTTP_REQ_STATE_WAIT_APP_METHOD */ if (req->to_recv == 0) - http_req_state_change (req, hc->is_server ? + http_req_state_change (req, (hc->flags & HTTP_CONN_F_IS_SERVER) ? HTTP_REQ_STATE_WAIT_APP_REPLY : HTTP_REQ_STATE_WAIT_APP_METHOD); @@ -1456,7 +1456,7 @@ http1_req_state_app_io_more_data (http_conn_t *hc, http_req_t *req, /* Finished transaction: * server back to HTTP_REQ_STATE_WAIT_TRANSPORT_METHOD * client to HTTP_REQ_STATE_WAIT_TRANSPORT_REPLY */ - http_req_state_change (req, hc->is_server ? + http_req_state_change (req, (hc->flags & HTTP_CONN_F_IS_SERVER) ? HTTP_REQ_STATE_WAIT_TRANSPORT_METHOD : HTTP_REQ_STATE_WAIT_TRANSPORT_REPLY); http_buffer_free (hb); @@ -1635,7 +1635,8 @@ http1_app_tx_callback (http_conn_t *hc, transport_send_params_t *sp) { /* Sometimes the server apps can send the response earlier * than expected (e.g when rejecting a bad request)*/ - if (req->state == HTTP_REQ_STATE_TRANSPORT_IO_MORE_DATA && hc->is_server) + if (req->state == HTTP_REQ_STATE_TRANSPORT_IO_MORE_DATA && + (hc->flags & HTTP_CONN_F_IS_SERVER)) { http_io_ts_drain_all (hc); http_req_state_change (req, HTTP_REQ_STATE_WAIT_APP_REPLY); diff --git a/src/plugins/http/http2/frame.c b/src/plugins/http/http2/frame.c new file mode 100644 index 00000000000..577bb6c1e3b --- /dev/null +++ b/src/plugins/http/http2/frame.c @@ -0,0 +1,323 @@ +/* SPDX-License-Identifier: Apache-2.0 + * Copyright(c) 2025 Cisco Systems, Inc. + */ + +#include <vppinfra/string.h> +#include <http/http2/frame.h> + +#define MAX_U24 0xFFFFFF + +static_always_inline u8 * +http2_decode_u24 (u8 *src, u32 *value) +{ + *value = 0; + *value = (u32) (src[0] << 16) | (u32) (src[1] << 8) | (u32) src[2]; + return src + 3; +} + +static_always_inline u8 * +http2_encode_u24 (u8 *dst, u32 value) +{ + ASSERT (value <= MAX_U24); + *dst++ = (value >> 16) & 0xFF; + *dst++ = (value >> 8) & 0xFF; + *dst++ = value & 0xFF; + return dst; +} + +/* + * RFC9113 section 4.1 + * + * HTTP Frame { + * Length (24), + * Type (8), + * Flags (8), + * Reserved (1), + * Stream Identifier (31), + * Frame Payload (..), + * } + */ + +__clib_export void +http2_frame_header_read (u8 *src, http2_frame_header_t *fh) +{ + u32 *stream_id; + src = http2_decode_u24 (src, &fh->length); + fh->type = *src++; + fh->flags = *src++; + stream_id = (u32 *) src; + fh->stream_id = clib_net_to_host_u32 (*stream_id) & 0x7FFFFFFF; +} + +static void +http2_frame_header_write (http2_frame_header_t *fh, u8 *dst) +{ + u32 stream_id; + + dst = http2_encode_u24 (dst, fh->length); + *dst++ = fh->type; + *dst++ = fh->flags; + stream_id = clib_host_to_net_u32 (fh->stream_id); + clib_memcpy_fast (dst, &stream_id, sizeof (stream_id)); +} + +__clib_export http2_error_t +http2_frame_read_settings (http2_conn_settings_t *settings, u8 *payload, + u32 payload_len) +{ + http2_settings_entry_t *entry; + u32 value; + + while (payload_len >= sizeof (*entry)) + { + entry = (http2_settings_entry_t *) payload; + switch (clib_net_to_host_u16 (entry->identifier)) + { +#define _(v, label, member, min, max, default_value, err_code) \ + case HTTP2_SETTINGS_##label: \ + value = clib_net_to_host_u32 (entry->value); \ + if (!(value >= min && value <= max)) \ + return err_code; \ + settings->member = value; \ + break; + foreach_http2_settings +#undef _ + /* ignore unknown or unsupported identifier */ + default : break; + } + payload_len -= sizeof (*entry); + payload += sizeof (*entry); + } + + if (payload_len != 0) + return HTTP2_ERROR_FRAME_SIZE_ERROR; + + return HTTP2_ERROR_NO_ERROR; +} + +__clib_export void +http2_frame_write_settings_ack (u8 **dst) +{ + http2_frame_header_t fh = { .flags = HTTP2_FRAME_FLAG_ACK, + .type = HTTP2_FRAME_TYPE_SETTINGS }; + u8 *p = http2_frame_header_alloc (dst); + http2_frame_header_write (&fh, p); +} + +__clib_export void +http2_frame_write_settings (http2_settings_entry_t *settings, u8 **dst) +{ + u8 *p; + u32 length; + http2_settings_entry_t *entry, e; + + ASSERT (settings); + ASSERT (vec_len (settings) > 0); + + length = vec_len (settings) * sizeof (*entry); + http2_frame_header_t fh = { .type = HTTP2_FRAME_TYPE_SETTINGS, + .length = length }; + p = http2_frame_header_alloc (dst); + http2_frame_header_write (&fh, p); + + vec_add2 (*dst, p, length); + vec_foreach (entry, settings) + { + e.identifier = clib_host_to_net_u16 (entry->identifier); + e.value = clib_host_to_net_u32 (entry->value); + clib_memcpy_fast (p, &e, sizeof (e)); + p += sizeof (e); + } +} + +#define WINDOW_UPDATE_LENGTH 4 + +__clib_export http2_error_t +http2_frame_read_window_update (u32 *increment, u8 *payload, u32 payload_len) +{ + u32 *value; + + if (payload_len != WINDOW_UPDATE_LENGTH) + return HTTP2_ERROR_FRAME_SIZE_ERROR; + + value = (u32 *) payload; + + if (value == 0) + return HTTP2_ERROR_PROTOCOL_ERROR; + + *increment = clib_net_to_host_u32 (*value) & 0x7FFFFFFF; + return HTTP2_ERROR_NO_ERROR; +} + +__clib_export void +http2_frame_write_window_update (u32 increment, u32 stream_id, u8 **dst) +{ + u8 *p; + u32 value; + + ASSERT (increment > 0 && increment <= 0x7FFFFFFF); + + http2_frame_header_t fh = { .type = HTTP2_FRAME_TYPE_WINDOW_UPDATE, + .length = WINDOW_UPDATE_LENGTH, + .stream_id = stream_id }; + p = http2_frame_header_alloc (dst); + http2_frame_header_write (&fh, p); + + vec_add2 (*dst, p, WINDOW_UPDATE_LENGTH); + value = clib_host_to_net_u32 (increment); + clib_memcpy_fast (p, &value, WINDOW_UPDATE_LENGTH); +} + +#define RST_STREAM_LENGTH 4 + +__clib_export http2_error_t +http2_frame_read_rst_stream (u32 *error_code, u8 *payload, u32 payload_len) +{ + u32 *value; + + if (payload_len != RST_STREAM_LENGTH) + return HTTP2_ERROR_FRAME_SIZE_ERROR; + + value = (u32 *) payload; + + *error_code = clib_net_to_host_u32 (*value); + return HTTP2_ERROR_NO_ERROR; +} + +__clib_export void +http2_frame_write_rst_stream (http2_error_t error_code, u32 stream_id, + u8 **dst) +{ + u8 *p; + u32 value; + + ASSERT (stream_id > 0 && stream_id <= 0x7FFFFFFF); + + http2_frame_header_t fh = { .type = HTTP2_FRAME_TYPE_RST_STREAM, + .length = RST_STREAM_LENGTH, + .stream_id = stream_id }; + p = http2_frame_header_alloc (dst); + http2_frame_header_write (&fh, p); + + vec_add2 (*dst, p, RST_STREAM_LENGTH); + value = clib_host_to_net_u32 ((u32) error_code); + clib_memcpy_fast (p, &value, RST_STREAM_LENGTH); +} + +#define GOAWAY_MIN_SIZE 8 + +__clib_export http2_error_t +http2_frame_read_goaway (u32 *error_code, u32 *last_stream_id, u8 *payload, + u32 payload_len) +{ + u32 *value; + + if (payload_len < GOAWAY_MIN_SIZE) + return HTTP2_ERROR_FRAME_SIZE_ERROR; + + value = (u32 *) payload; + *last_stream_id = clib_net_to_host_u32 (*value) & 0x7FFFFFFF; + payload += 4; + + value = (u32 *) payload; + *error_code = clib_net_to_host_u32 (*value); + + /* TODO: Additional Debug Data */ + return HTTP2_ERROR_NO_ERROR; +} + +__clib_export void +http2_frame_write_goaway (http2_error_t error_code, u32 last_stream_id, + u8 **dst) +{ + u8 *p; + u32 value; + + ASSERT (last_stream_id > 0 && last_stream_id <= 0x7FFFFFFF); + + http2_frame_header_t fh = { .type = HTTP2_FRAME_TYPE_GOAWAY, + .length = GOAWAY_MIN_SIZE }; + p = http2_frame_header_alloc (dst); + http2_frame_header_write (&fh, p); + + vec_add2 (*dst, p, GOAWAY_MIN_SIZE); + value = clib_host_to_net_u32 (last_stream_id); + clib_memcpy_fast (p, &value, 4); + p += 4; + value = clib_host_to_net_u32 ((u32) error_code); + clib_memcpy_fast (p, &value, 4); + /* TODO: Additional Debug Data */ +} + +#define PRIORITY_DATA_LEN 5 + +__clib_export http2_error_t +http2_frame_read_headers (u8 **headers, u32 *headers_len, u8 *payload, + u32 payload_len, u8 flags) +{ + *headers_len = payload_len; + + if (flags & HTTP2_FRAME_FLAG_PADED) + { + u8 pad_len = *payload++; + if ((u32) pad_len >= payload_len) + return HTTP2_ERROR_PROTOCOL_ERROR; + *headers_len -= pad_len; + } + + if (flags & HTTP2_FRAME_FLAG_PRIORITY) + { + if (*headers_len <= PRIORITY_DATA_LEN) + return HTTP2_ERROR_FRAME_SIZE_ERROR; + /* just skip, priority scheme defined in RFC7540 is deprecated */ + *headers_len -= PRIORITY_DATA_LEN; + payload += PRIORITY_DATA_LEN; + } + + *headers = payload; + + return HTTP2_ERROR_NO_ERROR; +} + +__clib_export void +http2_frame_write_headers_header (u32 headers_len, u32 stream_id, u8 flags, + u8 *dst) +{ + ASSERT (stream_id > 0 && stream_id <= 0x7FFFFFFF); + + http2_frame_header_t fh = { .type = HTTP2_FRAME_TYPE_HEADERS, + .length = headers_len, + .flags = flags, + .stream_id = stream_id }; + http2_frame_header_write (&fh, dst); +} + +__clib_export http2_error_t +http2_frame_read_data (u8 **data, u32 *data_len, u8 *payload, u32 payload_len, + u8 flags) +{ + *data_len = payload_len; + + if (flags & HTTP2_FRAME_FLAG_PADED) + { + u8 pad_len = *payload++; + if ((u32) pad_len >= payload_len) + return HTTP2_ERROR_PROTOCOL_ERROR; + *data_len -= pad_len; + } + + *data = payload; + return HTTP2_ERROR_NO_ERROR; +} + +__clib_export void +http2_frame_write_data_header (u32 data_len, u32 stream_id, u8 flags, u8 *dst) +{ + ASSERT (stream_id > 0 && stream_id <= 0x7FFFFFFF); + + http2_frame_header_t fh = { .type = HTTP2_FRAME_TYPE_DATA, + .length = data_len, + .flags = flags, + .stream_id = stream_id }; + http2_frame_header_write (&fh, dst); +} diff --git a/src/plugins/http/http2/frame.h b/src/plugins/http/http2/frame.h new file mode 100644 index 00000000000..bfe4e122f0d --- /dev/null +++ b/src/plugins/http/http2/frame.h @@ -0,0 +1,235 @@ +/* SPDX-License-Identifier: Apache-2.0 + * Copyright(c) 2025 Cisco Systems, Inc. + */ + +#ifndef SRC_PLUGINS_HTTP_HTTP2_FRAME_H_ +#define SRC_PLUGINS_HTTP_HTTP2_FRAME_H_ + +#include <vppinfra/error.h> +#include <vppinfra/types.h> +#include <http/http2/http2.h> + +#define HTTP2_FRAME_HEADER_SIZE 9 + +#define foreach_http2_frame_type \ + _ (0x00, DATA, "DATA") \ + _ (0x01, HEADERS, "HEADERS") \ + _ (0x02, PRIORITY, "PRIORITY") \ + _ (0x03, RST_STREAM, "RST_STREAM") \ + _ (0x04, SETTINGS, "SETTINGS") \ + _ (0x05, PUSH_PROMISE, "PUSH_PROMISE") \ + _ (0x06, PING, "PING") \ + _ (0x07, GOAWAY, "GOAWAY") \ + _ (0x08, WINDOW_UPDATE, "WINDOW_UPDATE") \ + _ (0x09, CONTINUATION, "CONTINUATION") + +typedef enum +{ +#define _(v, n, s) HTTP2_FRAME_TYPE_##n = v, + foreach_http2_frame_type +#undef _ +} __clib_packed http2_frame_type_t; + +STATIC_ASSERT_SIZEOF (http2_frame_type_t, 1); + +#define foreach_http2_frame_flag \ + _ (0, NONE) \ + _ (1, END_STREAM) \ + _ (1, ACK) \ + _ (1 << 2, END_HEADERS) \ + _ (1 << 3, PADED) \ + _ (1 << 5, PRIORITY) + +typedef enum +{ +#define _(v, n) HTTP2_FRAME_FLAG_##n = v, + foreach_http2_frame_flag +#undef _ +} __clib_packed http2_frame_flag_t; + +STATIC_ASSERT_SIZEOF (http2_frame_flag_t, 1); + +typedef struct +{ + u32 length; + http2_frame_type_t type; + u8 flags; + u32 stream_id; +} http2_frame_header_t; + +typedef struct +{ + u16 identifier; + u32 value; +} __clib_packed http2_settings_entry_t; + +/** + * Parse frame header + * + * @param src Pointer to the beginning of the frame + * @param fh Parsed frame header + */ +void http2_frame_header_read (u8 *src, http2_frame_header_t *fh); + +/** + * Add 9 bytes (frame header size) to the end of given vector + * + * @param dst Pointer to vector + * + * @return Pointer to the frame header beginning + */ +static_always_inline u8 * +http2_frame_header_alloc (u8 **dst) +{ + u8 *p; + + vec_add2 (*dst, p, HTTP2_FRAME_HEADER_SIZE); + return p; +} + +/** + * Parse SETTINGS frame payload + * + * @param settings Vector of HTTP/2 settings + * @param payload Payload to parse + * @param payload_len Payload length + * + * @return @c HTTP2_ERROR_NO_ERROR on success, error otherwise + */ +http2_error_t http2_frame_read_settings (http2_conn_settings_t *settings, + u8 *payload, u32 payload_len); + +/** + * Write SETTINGS ACK frame to the end of given vector + * + * @param dst Vector where SETTINGS ACK frame will be written + */ +void http2_frame_write_settings_ack (u8 **dst); + +/** + * Write SETTINGS frame to the end of given vector + * + * @param settings Vector of HTTP/2 settings + * @param dst Vector where SETTINGS frame will be written + */ +void http2_frame_write_settings (http2_settings_entry_t *settings, u8 **dst); + +/** + * Parse WINDOW_UPDATE frame payload + * + * @param increment Parsed window increment value + * @param payload Payload to parse + * @param payload_len Payload length + * + * @return @c HTTP2_ERROR_NO_ERROR on success, error otherwise + */ +http2_error_t http2_frame_read_window_update (u32 *increment, u8 *payload, + u32 payload_len); + +/** + * Write WINDOW_UPDATE frame to the end of given vector + * + * @param increment Window increment value + * @param stream_id Stream ID + * @param dst Vector where WINDOW_UPDATE frame will be written + */ +void http2_frame_write_window_update (u32 increment, u32 stream_id, u8 **dst); + +/** + * Parse RST_STREAM frame payload + * + * @param error_code Parsed error code + * @param payload Payload to parse + * @param payload_len Payload length + * + * @return @c HTTP2_ERROR_NO_ERROR on success, error otherwise + */ +http2_error_t http2_frame_read_rst_stream (u32 *error_code, u8 *payload, + u32 payload_len); + +/** + * Write RST_STREAM frame to the end of given vector + * + * @param error_code Error code + * @param stream_id Stream ID, except 0 + * @param dst Vector where RST_STREAM frame will be written + */ +void http2_frame_write_rst_stream (http2_error_t error_code, u32 stream_id, + u8 **dst); + +/** + * Parse GOAWAY frame payload + * + * @param last_stream_id Parsed last stream ID + * @param error_code Parsed error code + * @param payload Payload to parse + * @param payload_len Payload length + * + * @return @c HTTP2_ERROR_NO_ERROR on success, error otherwise + */ +http2_error_t http2_frame_read_goaway (u32 *last_stream_id, u32 *error_code, + u8 *payload, u32 payload_len); + +/** + * Write GOAWAY frame to the end of given vector + * @param error_code Error code + * @param last_stream_id Last stream ID + * @param dst Vector where GOAWAY frame will be written + */ +void http2_frame_write_goaway (http2_error_t error_code, u32 last_stream_id, + u8 **dst); + +/** + * Parse HEADERS frame payload + * + * @param headers Pointer to header block fragment + * @param headers_len Header block fragment length + * @param payload Payload to parse + * @param payload_len Payload length + * @param flags Flag field of frame header + * + * @return @c HTTP2_ERROR_NO_ERROR on success, error otherwise + */ +http2_error_t http2_frame_read_headers (u8 **headers, u32 *headers_len, + u8 *payload, u32 payload_len, + u8 flags); + +/** + * Write HEADERS frame header + * + * @param headers_len Header block fragment length + * @param stream_id Stream ID, except 0 + * @param flags Frame header flags + * @param dst Pointer where frame header will be written + * + * @note Use @c http2_frame_header_alloc before + */ +void http2_frame_write_headers_header (u32 headers_len, u32 stream_id, + u8 flags, u8 *dst); + +/** + * Parse DATA frame payload + * + * @param headers Pointer to data + * @param headers_len Data length + * @param payload Payload to parse + * @param payload_len Payload length + * @param flags Flag field of frame header + * + * @return @c HTTP2_ERROR_NO_ERROR on success, error otherwise + */ +http2_error_t http2_frame_read_data (u8 **data, u32 *data_len, u8 *payload, + u32 payload_len, u8 flags); + +/** + * Write DATA frame header + * + * @param data_len Data length + * @param stream_id Stream ID, except 0 + * @param flags Frame header flags + * @param dst Pointer where frame header will be written + */ +void http2_frame_write_data_header (u32 data_len, u32 stream_id, u8 flags, + u8 *dst); + +#endif /* SRC_PLUGINS_HTTP_HTTP2_FRAME_H_ */ diff --git a/src/plugins/http/http2/hpack.c b/src/plugins/http/http2/hpack.c new file mode 100644 index 00000000000..6dcf5f6c19b --- /dev/null +++ b/src/plugins/http/http2/hpack.c @@ -0,0 +1,1101 @@ +/* SPDX-License-Identifier: Apache-2.0 + * Copyright(c) 2025 Cisco Systems, Inc. + */ + +#include <vppinfra/error.h> +#include <vppinfra/ring.h> +#include <http/http.h> +#include <http/http2/hpack.h> +#include <http/http2/huffman_table.h> +#include <http/http_status_codes.h> + +#define HPACK_STATIC_TABLE_SIZE 61 + +typedef struct +{ + char *name; + uword name_len; + char *value; + uword value_len; +} hpack_static_table_entry_t; + +#define name_val_token_lit(name, value) \ + (name), sizeof (name) - 1, (value), sizeof (value) - 1 + +static hpack_static_table_entry_t + hpack_static_table[HPACK_STATIC_TABLE_SIZE] = { + { name_val_token_lit (":authority", "") }, + { name_val_token_lit (":method", "GET") }, + { name_val_token_lit (":method", "POST") }, + { name_val_token_lit (":path", "/") }, + { name_val_token_lit (":path", "/index.html") }, + { name_val_token_lit (":scheme", "http") }, + { name_val_token_lit (":scheme", "https") }, + { name_val_token_lit (":status", "200") }, + { name_val_token_lit (":status", "204") }, + { name_val_token_lit (":status", "206") }, + { name_val_token_lit (":status", "304") }, + { name_val_token_lit (":status", "400") }, + { name_val_token_lit (":status", "404") }, + { name_val_token_lit (":status", "500") }, + { name_val_token_lit ("accept-charset", "") }, + { name_val_token_lit ("accept-encoding", "gzip, deflate") }, + { name_val_token_lit ("accept-language", "") }, + { name_val_token_lit ("accept-ranges", "") }, + { name_val_token_lit ("accept", "") }, + { name_val_token_lit ("access-control-allow-origin", "") }, + { name_val_token_lit ("age", "") }, + { name_val_token_lit ("allow", "") }, + { name_val_token_lit ("authorization", "") }, + { name_val_token_lit ("cache-control", "") }, + { name_val_token_lit ("content-disposition", "") }, + { name_val_token_lit ("content-encoding", "") }, + { name_val_token_lit ("content-language", "") }, + { name_val_token_lit ("content-length", "") }, + { name_val_token_lit ("content-location", "") }, + { name_val_token_lit ("content-range", "") }, + { name_val_token_lit ("content-type", "") }, + { name_val_token_lit ("cookie", "") }, + { name_val_token_lit ("date", "") }, + { name_val_token_lit ("etag", "") }, + { name_val_token_lit ("etag", "") }, + { name_val_token_lit ("expires", "") }, + { name_val_token_lit ("from", "") }, + { name_val_token_lit ("host", "") }, + { name_val_token_lit ("if-match", "") }, + { name_val_token_lit ("if-modified-since", "") }, + { name_val_token_lit ("if-none-match", "") }, + { name_val_token_lit ("if-range", "") }, + { name_val_token_lit ("if-unmodified-since", "") }, + { name_val_token_lit ("last-modified", "") }, + { name_val_token_lit ("link", "") }, + { name_val_token_lit ("location", "") }, + { name_val_token_lit ("max-forwards", "") }, + { name_val_token_lit ("proxy-authenticate", "") }, + { name_val_token_lit ("proxy-authorization", "") }, + { name_val_token_lit ("range", "") }, + { name_val_token_lit ("referer", "") }, + { name_val_token_lit ("refresh", "") }, + { name_val_token_lit ("retry-after", "") }, + { name_val_token_lit ("server", "") }, + { name_val_token_lit ("set-cookie", "") }, + { name_val_token_lit ("strict-transport-security", "") }, + { name_val_token_lit ("transfer-encoding", "") }, + { name_val_token_lit ("user-agent", "") }, + { name_val_token_lit ("vary", "") }, + { name_val_token_lit ("via", "") }, + { name_val_token_lit ("www-authenticate", "") }, + }; + +typedef struct +{ + char *base; + uword len; + u8 static_table_index; +} hpack_token_t; + +static hpack_token_t hpack_headers[] = { +#define _(sym, str_canonical, str_lower, hpack_index) \ + { http_token_lit (str_lower), hpack_index }, + foreach_http_header_name +#undef _ +}; + +__clib_export uword +hpack_decode_int (u8 **src, u8 *end, u8 prefix_len) +{ + uword value, new_value; + u8 *p, shift = 0, byte; + u16 prefix_max; + + ASSERT (*src < end); + ASSERT (prefix_len >= 1 && prefix_len <= 8); + + p = *src; + prefix_max = (1 << prefix_len) - 1; + value = *p & (u8) prefix_max; + p++; + /* if integer value is less than 2^prefix_len-1 it's encoded within prefix */ + if (value != prefix_max) + { + *src = p; + return value; + } + + while (p != end) + { + byte = *p; + p++; + new_value = value + ((uword) (byte & 0x7F) << shift); + shift += 7; + /* check for overflow */ + if (new_value < value) + return HPACK_INVALID_INT; + value = new_value; + /* MSB of the last byte is zero */ + if ((byte & 0x80) == 0) + { + *src = p; + return value; + } + } + + return HPACK_INVALID_INT; +} + +http2_error_t +hpack_decode_huffman (u8 **src, u8 *end, u8 **buf, uword *buf_len) +{ + u64 accumulator = 0; + u8 accumulator_len = 0; + u8 *p; + hpack_huffman_code_t *code; + + p = *src; + while (1) + { + /* out of space? */ + if (*buf_len == 0) + return HTTP2_ERROR_INTERNAL_ERROR; + /* refill */ + while (p < end && accumulator_len <= 56) + { + accumulator <<= 8; + accumulator_len += 8; + accumulator |= (u64) *p++; + } + /* first try short codes (5 - 8 bits) */ + code = + &huff_code_table_fast[(u8) (accumulator >> (accumulator_len - 8))]; + /* zero code length mean no luck */ + if (PREDICT_TRUE (code->code_len)) + { + **buf = code->symbol; + (*buf)++; + (*buf_len)--; + accumulator_len -= code->code_len; + } + else + { + /* slow path / long codes (10 - 30 bits) */ + u32 tmp; + /* group boundaries are aligned to 32 bits */ + if (accumulator_len < 32) + tmp = accumulator << (32 - accumulator_len); + else + tmp = accumulator >> (accumulator_len - 32); + /* figure out which interval code falls into, this is possible + * because HPACK use canonical Huffman codes + * see Schwartz, E. and B. Kallick, “Generating a canonical prefix + * encoding” + */ + hpack_huffman_group_t *hg = hpack_huffman_get_group (tmp); + /* trim code to correct length */ + u32 code = (accumulator >> (accumulator_len - hg->code_len)) & + ((1 << hg->code_len) - 1); + /* find symbol in the list */ + **buf = hg->symbols[code - hg->first_code]; + (*buf)++; + (*buf_len)--; + accumulator_len -= hg->code_len; + } + /* all done */ + if (p == end && accumulator_len < 8) + { + /* there might be one more symbol encoded with short code */ + if (accumulator_len >= 5) + { + /* first check EOF case */ + if (((1 << accumulator_len) - 1) == + (accumulator & ((1 << accumulator_len) - 1))) + break; + + /* out of space? */ + if (*buf_len == 0) + return HTTP2_ERROR_INTERNAL_ERROR; + + /* if bogus EOF check bellow will fail */ + code = &huff_code_table_fast[(u8) (accumulator + << (8 - accumulator_len))]; + **buf = code->symbol; + (*buf)++; + (*buf_len)--; + accumulator_len -= code->code_len; + /* end at byte boundary? */ + if (accumulator_len == 0) + break; + } + /* we must end with EOF here */ + if (((1 << accumulator_len) - 1) != + (accumulator & ((1 << accumulator_len) - 1))) + return HTTP2_ERROR_COMPRESSION_ERROR; + break; + } + } + return HTTP2_ERROR_NO_ERROR; +} + +__clib_export http2_error_t +hpack_decode_string (u8 **src, u8 *end, u8 **buf, uword *buf_len) +{ + u8 *p, is_huffman; + uword len; + + ASSERT (*src < end); + + p = *src; + /* H flag in first bit */ + is_huffman = *p & 0x80; + + /* length is integer with 7 bit prefix */ + len = hpack_decode_int (&p, end, 7); + if (PREDICT_FALSE (len == HPACK_INVALID_INT)) + return HTTP2_ERROR_COMPRESSION_ERROR; + + /* do we have everything? */ + if (len > (end - p)) + return HTTP2_ERROR_COMPRESSION_ERROR; + + if (is_huffman) + { + *src = (p + len); + return hpack_decode_huffman (&p, p + len, buf, buf_len); + } + else + { + /* enough space? */ + if (len > *buf_len) + return HTTP2_ERROR_INTERNAL_ERROR; + + clib_memcpy (*buf, p, len); + *buf_len -= len; + *buf += len; + *src = (p + len); + return HTTP2_ERROR_NO_ERROR; + } +} + +__clib_export u8 * +hpack_encode_int (u8 *dst, uword value, u8 prefix_len) +{ + u16 prefix_max; + + ASSERT (prefix_len >= 1 && prefix_len <= 8); + + prefix_max = (1 << prefix_len) - 1; + + /* if integer value is less than 2^prefix_len-1 it's encoded within prefix */ + if (value < prefix_max) + { + *dst++ |= (u8) value; + return dst; + } + + /* otherwise all bits of the prefix are set to 1 */ + *dst++ |= (u8) prefix_max; + /* and the value is decreased by 2^prefix_len-1 */ + value -= prefix_max; + /* MSB of each byte is used as continuation flag */ + for (; value >= 0x80; value >>= 7) + *dst++ = 0x80 | (value & 0x7F); + /* except for the last byte */ + *dst++ = (u8) value; + + return dst; +} + +uword +hpack_huffman_encoded_len (const u8 *value, uword value_len) +{ + uword len = 0; + u8 *end; + hpack_huffman_symbol_t *sym; + + end = (u8 *) value + value_len; + while (value != end) + { + sym = &huff_sym_table[*value++]; + len += sym->code_len; + } + /* round up to byte boundary */ + return (len + 7) / 8; +} + +u8 * +hpack_encode_huffman (u8 *dst, const u8 *value, uword value_len) +{ + u8 *end; + hpack_huffman_symbol_t *sym; + u8 accumulator_len = 40; /* leftover (1 byte) + max code_len (4 bytes) */ + u64 accumulator = 0; /* to fit leftover and current code */ + + end = (u8 *) value + value_len; + + while (value != end) + { + sym = &huff_sym_table[*value++]; + /* add current code to leftover of previous one */ + accumulator |= (u64) sym->code << (accumulator_len - sym->code_len); + accumulator_len -= sym->code_len; + /* write only fully occupied bytes (max 4) */ + switch (accumulator_len) + { + case 1 ... 8: +#define WRITE_BYTE() \ + *dst = (u8) (accumulator >> 32); \ + accumulator_len += 8; \ + accumulator <<= 8; \ + dst++; + WRITE_BYTE (); + case 9 ... 16: + WRITE_BYTE (); + case 17 ... 24: + WRITE_BYTE (); + case 25 ... 32: + WRITE_BYTE (); + default: + break; + } + } + + /* padding (0-7 bits)*/ + ASSERT (accumulator_len > 32 && accumulator_len <= 40); + if (accumulator_len != 40) + { + accumulator |= (u64) 0x7F << (accumulator_len - 7); + *dst = (u8) (accumulator >> 32); + dst++; + } + return dst; +} + +__clib_export u8 * +hpack_encode_string (u8 *dst, const u8 *value, uword value_len) +{ + uword huff_len; + + huff_len = hpack_huffman_encoded_len (value, value_len); + /* raw bytes might take fewer bytes */ + if (huff_len >= value_len) + { + *dst = 0; /* clear H flag */ + dst = hpack_encode_int (dst, value_len, 7); + clib_memcpy (dst, value, value_len); + return dst + value_len; + } + + *dst = 0x80; /* set H flag */ + dst = hpack_encode_int (dst, huff_len, 7); + dst = hpack_encode_huffman (dst, value, value_len); + + return dst; +} + +__clib_export void +hpack_dynamic_table_init (hpack_dynamic_table_t *table, u32 max_size) +{ + table->max_size = max_size; + table->size = max_size; + table->used = 0; + clib_ring_new (table->entries, + max_size / HPACK_DYNAMIC_TABLE_ENTRY_OVERHEAD); +} + +__clib_export void +hpack_dynamic_table_free (hpack_dynamic_table_t *table) +{ + hpack_dynamic_table_entry_t *e; + + while ((e = clib_ring_deq (table->entries)) != 0) + vec_free (e->buf); + + clib_ring_free (table->entries); +} + +#define hpack_dynamic_table_entry_value_base(e) \ + ((char *) ((e)->buf + (e)->name_len)) +#define hpack_dynamic_table_entry_value_len(e) \ + (vec_len ((e)->buf) - (e)->name_len) + +always_inline hpack_dynamic_table_entry_t * +hpack_dynamic_table_get (hpack_dynamic_table_t *table, uword index) +{ + if (index > clib_ring_n_enq (table->entries)) + return 0; + + hpack_dynamic_table_entry_t *first = clib_ring_get_first (table->entries); + u32 first_index = first - table->entries; + u32 entry_index = + (first_index + (clib_ring_n_enq (table->entries) - 1 - (u32) index)) % + vec_len (table->entries); + return table->entries + entry_index; +} + +__clib_export u8 * +format_hpack_dynamic_table (u8 *s, va_list *args) +{ + hpack_dynamic_table_t *table = va_arg (*args, hpack_dynamic_table_t *); + u32 i; + hpack_dynamic_table_entry_t *e; + + s = format (s, "HPACK dynamic table:\n"); + for (i = 0; i < clib_ring_n_enq (table->entries); i++) + { + e = hpack_dynamic_table_get (table, i); + s = format (s, "\t[%u] %U: %U\n", i, format_http_bytes, e->buf, + e->name_len, format_http_bytes, + hpack_dynamic_table_entry_value_base (e), + hpack_dynamic_table_entry_value_len (e)); + } + return s; +} + +static inline void +hpack_dynamic_table_evict_one (hpack_dynamic_table_t *table) +{ + u32 entry_size; + hpack_dynamic_table_entry_t *e; + + e = clib_ring_deq (table->entries); + ASSERT (e); + HTTP_DBG (2, "%U: %U", format_http_bytes, e->buf, e->name_len, + format_http_bytes, hpack_dynamic_table_entry_value_base (e), + hpack_dynamic_table_entry_value_len (e)); + entry_size = vec_len (e->buf) + HPACK_DYNAMIC_TABLE_ENTRY_OVERHEAD; + table->used -= entry_size; + vec_reset_length (e->buf); +} + +static void +hpack_dynamic_table_add (hpack_dynamic_table_t *table, http_token_t *name, + http_token_t *value) +{ + u32 entry_size; + hpack_dynamic_table_entry_t *e; + + entry_size = name->len + value->len + HPACK_DYNAMIC_TABLE_ENTRY_OVERHEAD; + + /* make space or evict all */ + while (clib_ring_n_enq (table->entries) && + (table->used + entry_size > table->size)) + hpack_dynamic_table_evict_one (table); + + /* attempt to add entry larger than the maximum size is not error */ + if (entry_size > table->size) + return; + + e = clib_ring_enq (table->entries); + ASSERT (e); + vec_validate (e->buf, name->len + value->len - 1); + clib_memcpy (e->buf, name->base, name->len); + clib_memcpy (e->buf + name->len, value->base, value->len); + e->name_len = name->len; + table->used += entry_size; + + HTTP_DBG (2, "%U: %U", format_http_bytes, e->buf, e->name_len, + format_http_bytes, hpack_dynamic_table_entry_value_base (e), + hpack_dynamic_table_entry_value_len (e)); +} + +static http2_error_t +hpack_get_table_entry (uword index, http_token_t *name, http_token_t *value, + u8 value_is_indexed, hpack_dynamic_table_t *dt) +{ + if (index <= HPACK_STATIC_TABLE_SIZE) + { + hpack_static_table_entry_t *e = &hpack_static_table[index - 1]; + name->base = e->name; + name->len = e->name_len; + if (value_is_indexed) + { + if (PREDICT_FALSE (e->value_len == 0)) + { + HTTP_DBG (1, "static table entry [%llu] without value", index); + return HTTP2_ERROR_COMPRESSION_ERROR; + } + value->base = e->value; + value->len = e->value_len; + } + HTTP_DBG (2, "[%llu] %U: %U", index, format_http_bytes, e->name, + e->name_len, format_http_bytes, e->value, e->value_len); + return HTTP2_ERROR_NO_ERROR; + } + else + { + hpack_dynamic_table_entry_t *e = + hpack_dynamic_table_get (dt, index - HPACK_STATIC_TABLE_SIZE - 1); + if (PREDICT_FALSE (!e)) + { + HTTP_DBG (1, "index %llu not in dynamic table", index); + return HTTP2_ERROR_COMPRESSION_ERROR; + } + name->base = (char *) e->buf; + name->len = e->name_len; + value->base = hpack_dynamic_table_entry_value_base (e); + value->len = hpack_dynamic_table_entry_value_len (e); + HTTP_DBG (2, "[%llu] %U: %U", index, format_http_bytes, name->base, + name->len, format_http_bytes, value->base, value->len); + return HTTP2_ERROR_NO_ERROR; + } +} + +__clib_export http2_error_t +hpack_decode_header (u8 **src, u8 *end, u8 **buf, uword *buf_len, + u32 *name_len, u32 *value_len, hpack_dynamic_table_t *dt) +{ + u8 *p; + u8 value_is_indexed = 0, add_new_entry = 0; + uword old_len, new_max, index = 0; + http_token_t name, value; + http2_error_t rv; + + ASSERT (*src < end); + p = *src; + + /* dynamic table size update */ + while ((*p & 0xE0) == 0x20) + { + new_max = hpack_decode_int (&p, end, 5); + if (p == end || new_max > (uword) dt->max_size) + { + HTTP_DBG (1, "invalid dynamic table size update"); + return HTTP2_ERROR_COMPRESSION_ERROR; + } + while (clib_ring_n_enq (dt->entries) && new_max > dt->used) + hpack_dynamic_table_evict_one (dt); + dt->size = (u32) new_max; + } + + if (*p & 0x80) /* indexed header field */ + { + index = hpack_decode_int (&p, end, 7); + /* index value of 0 is not used */ + if (index == 0 || index == HPACK_INVALID_INT) + { + HTTP_DBG (1, "invalid index"); + return HTTP2_ERROR_COMPRESSION_ERROR; + } + value_is_indexed = 1; + } + else if (*p > 0x40) /* incremental indexing - indexed name */ + { + index = hpack_decode_int (&p, end, 6); + /* index value of 0 is not used */ + if (index == 0 || index == HPACK_INVALID_INT) + { + HTTP_DBG (1, "invalid index"); + return HTTP2_ERROR_COMPRESSION_ERROR; + } + add_new_entry = 1; + } + else if (*p == 0x40) /* incremental indexing - new name */ + { + add_new_entry = 1; + p++; + } + else /* without indexing / never indexed */ + { + if ((*p & 0x0F) == 0) /* new name */ + p++; + else /* indexed name */ + { + index = hpack_decode_int (&p, end, 4); + /* index value of 0 is not used */ + if (index == 0 || index == HPACK_INVALID_INT) + { + HTTP_DBG (1, "invalid index"); + return HTTP2_ERROR_COMPRESSION_ERROR; + } + } + } + + if (index) + { + rv = hpack_get_table_entry (index, &name, &value, value_is_indexed, dt); + if (rv != HTTP2_ERROR_NO_ERROR) + { + HTTP_DBG (1, "entry index %llu error", index); + return rv; + } + if (name.len > *buf_len) + { + HTTP_DBG (1, "not enough space"); + return HTTP2_ERROR_INTERNAL_ERROR; + } + clib_memcpy (*buf, name.base, name.len); + *buf_len -= name.len; + *buf += name.len; + *name_len = name.len; + if (value_is_indexed) + { + if (value.len > *buf_len) + { + HTTP_DBG (1, "not enough space"); + return HTTP2_ERROR_INTERNAL_ERROR; + } + clib_memcpy (*buf, value.base, value.len); + *buf_len -= value.len; + *buf += value.len; + *value_len = value.len; + } + } + else + { + old_len = *buf_len; + name.base = (char *) *buf; + rv = hpack_decode_string (&p, end, buf, buf_len); + if (rv != HTTP2_ERROR_NO_ERROR) + { + HTTP_DBG (1, "invalid header name"); + return rv; + } + *name_len = old_len - *buf_len; + name.len = *name_len; + } + + if (!value_is_indexed) + { + old_len = *buf_len; + value.base = (char *) *buf; + rv = hpack_decode_string (&p, end, buf, buf_len); + if (rv != HTTP2_ERROR_NO_ERROR) + { + HTTP_DBG (1, "invalid header value"); + return rv; + } + *value_len = old_len - *buf_len; + value.len = *value_len; + } + + if (add_new_entry) + hpack_dynamic_table_add (dt, &name, &value); + + *src = p; + return HTTP2_ERROR_NO_ERROR; +} + +static inline u8 +hpack_header_name_is_valid (u8 *name, u32 name_len) +{ + u32 i; + static uword tchar[4] = { + /* !#$%'*+-.0123456789 */ + 0x03ff6cba00000000, + /* ^_`abcdefghijklmnopqrstuvwxyz|~ */ + 0x57ffffffc0000000, + 0x0000000000000000, + 0x0000000000000000, + }; + for (i = 0; i < name_len; i++) + { + if (!clib_bitmap_get_no_check (tchar, name[i])) + return 0; + } + return 1; +} + +static inline u8 +hpack_header_value_is_valid (u8 *value, u32 value_len) +{ + u32 i; + /* VCHAR / SP / HTAB / %x80-FF */ + static uword tchar[4] = { + 0xffffffff00000200, + 0x7fffffffffffffff, + 0xffffffffffffffff, + 0xffffffffffffffff, + }; + + /* must not start or end with SP or HTAB */ + if ((value[0] == 0x20 || value[0] == 0x09 || value[value_len - 1] == 0x20 || + value[value_len - 1] == 0x09)) + return 0; + + for (i = 0; i < value_len; i++) + { + if (!clib_bitmap_get_no_check (tchar, value[i])) + return 0; + } + return 1; +} + +static inline http_req_method_t +hpack_parse_method (u8 *value, u32 value_len) +{ + switch (value_len) + { + case 3: + if (!memcmp (value, "GET", 3)) + return HTTP_REQ_GET; + break; + case 4: + if (!memcmp (value, "POST", 4)) + return HTTP_REQ_POST; + break; + case 7: + if (!memcmp (value, "CONNECT", 7)) + return HTTP_REQ_CONNECT; + break; + default: + break; + } + /* HPACK should return only connection errors, this one is stream error */ + return HTTP_REQ_UNKNOWN; +} + +static inline http_url_scheme_t +hpack_parse_scheme (u8 *value, u32 value_len) +{ + switch (value_len) + { + case 4: + if (!memcmp (value, "http", 4)) + return HTTP_URL_SCHEME_HTTP; + break; + case 5: + if (!memcmp (value, "https", 5)) + return HTTP_URL_SCHEME_HTTPS; + break; + default: + break; + } + /* HPACK should return only connection errors, this one is stream error */ + return HTTP_URL_SCHEME_UNKNOWN; +} + +static http2_error_t +hpack_parse_req_pseudo_header (u8 *name, u32 name_len, u8 *value, + u32 value_len, + hpack_request_control_data_t *control_data) +{ + HTTP_DBG (2, "%U: %U", format_http_bytes, name, name_len, format_http_bytes, + value, value_len); + switch (name_len) + { + case 5: + if (!memcmp (name + 1, "path", 4)) + { + if (control_data->parsed_bitmap & HPACK_PSEUDO_HEADER_PATH_PARSED) + return HTTP2_ERROR_PROTOCOL_ERROR; + control_data->parsed_bitmap |= HPACK_PSEUDO_HEADER_PATH_PARSED; + control_data->path = value; + control_data->path_len = value_len; + break; + } + return HTTP2_ERROR_PROTOCOL_ERROR; + case 7: + switch (name[1]) + { + case 'm': + if (!memcmp (name + 2, "ethod", 5)) + { + if (control_data->parsed_bitmap & + HPACK_PSEUDO_HEADER_METHOD_PARSED) + return HTTP2_ERROR_PROTOCOL_ERROR; + control_data->parsed_bitmap |= HPACK_PSEUDO_HEADER_METHOD_PARSED; + control_data->method = hpack_parse_method (value, value_len); + break; + } + return HTTP2_ERROR_PROTOCOL_ERROR; + case 's': + if (!memcmp (name + 2, "cheme", 5)) + { + if (control_data->parsed_bitmap & + HPACK_PSEUDO_HEADER_SCHEME_PARSED) + return HTTP2_ERROR_PROTOCOL_ERROR; + control_data->parsed_bitmap |= HPACK_PSEUDO_HEADER_SCHEME_PARSED; + control_data->scheme = hpack_parse_scheme (value, value_len); + break; + } + return HTTP2_ERROR_PROTOCOL_ERROR; + default: + return HTTP2_ERROR_PROTOCOL_ERROR; + } + break; + case 10: + if (!memcmp (name + 1, "authority", 9)) + { + if (control_data->parsed_bitmap & + HPACK_PSEUDO_HEADER_AUTHORITY_PARSED) + return HTTP2_ERROR_PROTOCOL_ERROR; + control_data->parsed_bitmap |= HPACK_PSEUDO_HEADER_AUTHORITY_PARSED; + control_data->authority = value; + control_data->authority_len = value_len; + break; + } + return HTTP2_ERROR_PROTOCOL_ERROR; + default: + return HTTP2_ERROR_PROTOCOL_ERROR; + } + + return HTTP2_ERROR_NO_ERROR; +} + +__clib_export http2_error_t +hpack_parse_request (u8 *src, u32 src_len, u8 *dst, u32 dst_len, + hpack_request_control_data_t *control_data, + http_field_line_t **headers, + hpack_dynamic_table_t *dynamic_table) +{ + u8 *p, *end, *b, *name, *value; + u8 regular_header_parsed = 0; + u32 name_len, value_len; + uword b_left; + http_field_line_t *header; + http2_error_t rv; + + p = src; + end = src + src_len; + b = dst; + b_left = dst_len; + control_data->parsed_bitmap = 0; + control_data->headers_len = 0; + + while (p != end) + { + name = b; + rv = hpack_decode_header (&p, end, &b, &b_left, &name_len, &value_len, + dynamic_table); + if (rv != HTTP2_ERROR_NO_ERROR) + { + HTTP_DBG (1, "hpack_decode_header: %U", format_http2_error, rv); + return rv; + } + value = name + name_len; + + /* pseudo header */ + if (name[0] == ':') + { + /* all pseudo-headers must be before regular headers */ + if (regular_header_parsed) + { + HTTP_DBG (1, "pseudo-headers after regular header"); + return HTTP2_ERROR_PROTOCOL_ERROR; + } + rv = hpack_parse_req_pseudo_header (name, name_len, value, value_len, + control_data); + if (rv != HTTP2_ERROR_NO_ERROR) + { + HTTP_DBG (1, "hpack_parse_req_pseudo_header: %U", + format_http2_error, rv); + return rv; + } + continue; + } + else + { + if (!hpack_header_name_is_valid (name, name_len)) + return HTTP2_ERROR_PROTOCOL_ERROR; + if (!regular_header_parsed) + { + regular_header_parsed = 1; + control_data->headers = name; + } + } + if (!hpack_header_value_is_valid (value, value_len)) + return HTTP2_ERROR_PROTOCOL_ERROR; + vec_add2 (*headers, header, 1); + HTTP_DBG (2, "%U: %U", format_http_bytes, name, name_len, + format_http_bytes, value, value_len); + header->name_offset = name - control_data->headers; + header->name_len = name_len; + header->value_offset = value - control_data->headers; + header->value_len = value_len; + control_data->headers_len += name_len; + control_data->headers_len += value_len; + } + + HTTP_DBG (2, "%U", format_hpack_dynamic_table, dynamic_table); + return HTTP2_ERROR_NO_ERROR; +} + +static inline u8 * +hpack_encode_header (u8 *dst, http_header_name_t name, const u8 *value, + u32 value_len) +{ + hpack_token_t *name_token; + u8 *a, *b; + u32 orig_len, actual_size; + + orig_len = vec_len (dst); + name_token = &hpack_headers[name]; + if (name_token->static_table_index) + { + /* static table index with 4 bit prefix is max 2 bytes */ + vec_add2 (dst, a, 2 + value_len + HPACK_ENCODED_INT_MAX_LEN); + /* Literal Header Field without Indexing — Indexed Name */ + *a = 0x00; /* zero first 4 bits */ + b = hpack_encode_int (a, name_token->static_table_index, 4); + } + else + { + /* one extra byte for 4 bit prefix */ + vec_add2 (dst, a, + name_token->len + value_len + HPACK_ENCODED_INT_MAX_LEN * 2 + + 1); + b = a; + /* Literal Header Field without Indexing — New Name */ + *b++ = 0x00; + b = hpack_encode_string (b, (const u8 *) name_token->base, + name_token->len); + } + b = hpack_encode_string (b, value, value_len); + + actual_size = b - a; + vec_set_len (dst, orig_len + actual_size); + return dst; +} + +static inline u8 * +hpack_encode_custom_header (u8 *dst, const u8 *name, u32 name_len, + const u8 *value, u32 value_len) +{ + u32 orig_len, actual_size; + u8 *a, *b; + + orig_len = vec_len (dst); + /* one extra byte for 4 bit prefix */ + vec_add2 (dst, a, name_len + value_len + HPACK_ENCODED_INT_MAX_LEN * 2 + 1); + b = a; + /* Literal Header Field without Indexing — New Name */ + *b++ = 0x00; + b = hpack_encode_string (b, name, name_len); + b = hpack_encode_string (b, value, value_len); + actual_size = b - a; + vec_set_len (dst, orig_len + actual_size); + return dst; +} + +static inline u8 * +hpack_encode_status_code (u8 *dst, http_status_code_t sc) +{ + u32 orig_len, actual_size; + u8 *a, *b; + +#define encode_common_sc(_index) \ + vec_add2 (dst, a, 1); \ + *a++ = 0x80 | _index; + + switch (sc) + { + case HTTP_STATUS_OK: + encode_common_sc (8); + break; + case HTTP_STATUS_NO_CONTENT: + encode_common_sc (9); + break; + case HTTP_STATUS_PARTIAL_CONTENT: + encode_common_sc (10); + break; + case HTTP_STATUS_NOT_MODIFIED: + encode_common_sc (11); + break; + case HTTP_STATUS_BAD_REQUEST: + encode_common_sc (12); + break; + case HTTP_STATUS_NOT_FOUND: + encode_common_sc (13); + break; + case HTTP_STATUS_INTERNAL_ERROR: + encode_common_sc (14); + break; + default: + orig_len = vec_len (dst); + vec_add2 (dst, a, 5); + b = a; + /* Literal Header Field without Indexing — Indexed Name */ + *b++ = 8; + b = hpack_encode_string (b, (const u8 *) http_status_code_str[sc], 3); + actual_size = b - a; + vec_set_len (dst, orig_len + actual_size); + break; + } + return dst; +} + +static inline u8 * +hpack_encode_content_len (u8 *dst, u64 content_len) +{ + u8 digit_buffer[20]; + u8 *d = digit_buffer + sizeof (digit_buffer); + u32 orig_len, actual_size; + u8 *a, *b; + + orig_len = vec_len (dst); + vec_add2 (dst, a, 3 + sizeof (digit_buffer)); + b = a; + + /* static table index 28 */ + *b++ = 0x0F; + *b++ = 0x0D; + do + { + *--d = '0' + content_len % 10; + content_len /= 10; + } + while (content_len); + + b = hpack_encode_string (b, d, digit_buffer + sizeof (digit_buffer) - d); + actual_size = b - a; + vec_set_len (dst, orig_len + actual_size); + return dst; +} + +__clib_export void +hpack_serialize_response (u8 *app_headers, u32 app_headers_len, + hpack_response_control_data_t *control_data, + u8 **dst) +{ + u8 *p, *end; + + p = *dst; + + /* status code must be first since it is pseudo-header */ + p = hpack_encode_status_code (p, control_data->sc); + + /* server name */ + p = hpack_encode_header (p, HTTP_HEADER_SERVER, control_data->server_name, + control_data->server_name_len); + + /* date */ + p = hpack_encode_header (p, HTTP_HEADER_DATE, control_data->date, + control_data->date_len); + + /* content length if any */ + if (control_data->content_len != HPACK_ENCODER_SKIP_CONTENT_LEN) + p = hpack_encode_content_len (p, control_data->content_len); + + if (!app_headers_len) + { + *dst = p; + return; + } + + end = app_headers + app_headers_len; + while (app_headers < end) + { + /* custom header name? */ + u32 *tmp = (u32 *) app_headers; + if (PREDICT_FALSE (*tmp & HTTP_CUSTOM_HEADER_NAME_BIT)) + { + http_custom_token_t *name, *value; + name = (http_custom_token_t *) app_headers; + u32 name_len = name->len & ~HTTP_CUSTOM_HEADER_NAME_BIT; + app_headers += sizeof (http_custom_token_t) + name_len; + value = (http_custom_token_t *) app_headers; + app_headers += sizeof (http_custom_token_t) + value->len; + p = hpack_encode_custom_header (p, name->token, name_len, + value->token, value->len); + } + else + { + http_app_header_t *header; + header = (http_app_header_t *) app_headers; + app_headers += sizeof (http_app_header_t) + header->value.len; + p = hpack_encode_header (p, header->name, header->value.token, + header->value.len); + } + } + + *dst = p; +} diff --git a/src/plugins/http/http2/hpack.h b/src/plugins/http/http2/hpack.h new file mode 100644 index 00000000000..2a2936b7611 --- /dev/null +++ b/src/plugins/http/http2/hpack.h @@ -0,0 +1,180 @@ +/* SPDX-License-Identifier: Apache-2.0 + * Copyright(c) 2025 Cisco Systems, Inc. + */ + +#ifndef SRC_PLUGINS_HTTP_HPACK_H_ +#define SRC_PLUGINS_HTTP_HPACK_H_ + +#include <vppinfra/types.h> +#include <http/http2/http2.h> + +#define HPACK_INVALID_INT CLIB_UWORD_MAX +#if uword_bits == 64 +#define HPACK_ENCODED_INT_MAX_LEN 10 +#else +#define HPACK_ENCODED_INT_MAX_LEN 6 +#endif + +#define HPACK_DEFAULT_HEADER_TABLE_SIZE 4096 +#define HPACK_DYNAMIC_TABLE_ENTRY_OVERHEAD 32 +#define HPACK_ENCODER_SKIP_CONTENT_LEN ((u64) ~0) + +typedef struct +{ + u8 *buf; + uword name_len; +} hpack_dynamic_table_entry_t; + +typedef struct +{ + /* SETTINGS_HEADER_TABLE_SIZE */ + u32 max_size; + /* dynamic table size update */ + u32 size; + /* current usage (each entry = 32 + name len + value len) */ + u32 used; + /* ring buffer */ + hpack_dynamic_table_entry_t *entries; +} hpack_dynamic_table_t; + +enum +{ +#define _(bit, name, str) HPACK_PSEUDO_HEADER_##name##_PARSED = (1 << bit), + foreach_http2_pseudo_header +#undef _ +}; + +typedef struct +{ + http_req_method_t method; + http_url_scheme_t scheme; + u8 *authority; + u32 authority_len; + u8 *path; + u32 path_len; + u8 *headers; + u32 headers_len; + u16 parsed_bitmap; +} hpack_request_control_data_t; + +typedef struct +{ + http_status_code_t sc; + u64 content_len; + u8 *server_name; + u32 server_name_len; + u8 *date; + u32 date_len; +} hpack_response_control_data_t; + +/** + * Decode unsigned variable-length integer (RFC7541 section 5.1) + * + * @param src Pointer to source buffer which will be advanced + * @param end End of the source buffer + * @param prefix_len Number of bits of the prefix (between 1 and 8) + * + * @return Decoded integer or @c HPACK_INVALID_INT in case of error + */ +uword hpack_decode_int (u8 **src, u8 *end, u8 prefix_len); + +/** + * Encode given value as unsigned variable-length integer (RFC7541 section 5.1) + * + * @param dst Pointer to destination buffer, should have enough space + * @param value Integer value to encode (up to @c CLIB_WORD_MAX) + * @param prefix_len Number of bits of the prefix (between 1 and 8) + * + * @return Advanced pointer to the destination buffer + * + * @note Encoded integer will take maximum @c HPACK_ENCODED_INT_MAX_LEN bytes + */ +u8 *hpack_encode_int (u8 *dst, uword value, u8 prefix_len); + +/** + * Decode + * + * @param src Pointer to source buffer which will be advanced + * @param end End of the source buffer + * @param buf Pointer to the buffer where string is decoded which will be + * advanced by number of written bytes + * @param buf_len Length the buffer, will be decreased + * + * @return @c HTTP2_ERROR_NO_ERROR on success + * + * @note Caller is responsible to check if there is somthing left in source + * buffer first + */ +http2_error_t hpack_decode_huffman (u8 **src, u8 *end, u8 **buf, + uword *buf_len); + +/** + * Encode given string in Huffman codes. + * + * @param dst Pointer to destination buffer, should have enough space + * @param value String to encode + * @param value_len Length of the string + * + * @return Advanced pointer to the destination buffer + */ +u8 *hpack_encode_huffman (u8 *dst, const u8 *value, uword value_len); + +/** + * Number of bytes required to encode given string in Huffman codes + * + * @param value Pointer to buffer with string to encode + * @param value_len Length of the string + * + * @return number of bytes required to encode string in Huffman codes, round up + * to byte boundary + */ +uword hpack_huffman_encoded_len (const u8 *value, uword value_len); + +/** + * Initialize HPACK dynamic table + * + * @param table Dynamic table to initialize + * @param max_size Maximum table size (SETTINGS_HEADER_TABLE_SIZE) + */ +void hpack_dynamic_table_init (hpack_dynamic_table_t *table, u32 max_size); + +/** + * Free HPACK dynamic table + * + * @param table Dynamic table to free + */ +void hpack_dynamic_table_free (hpack_dynamic_table_t *table); + +u8 *format_hpack_dynamic_table (u8 *s, va_list *args); + +/** + * Request parser + * + * @param src Header block to parse + * @param src_len Length of header block + * @param dst Buffer where headers will be decoded + * @param dst_len Length of buffer for decoded headers + * @param control_data Preparsed pseudo-headers + * @param headers List of regular headers + * @param dynamic_table Decoder dynamic table + * + * @return @c HTTP2_ERROR_NO_ERROR on success, connection error otherwise + */ +http2_error_t hpack_parse_request (u8 *src, u32 src_len, u8 *dst, u32 dst_len, + hpack_request_control_data_t *control_data, + http_field_line_t **headers, + hpack_dynamic_table_t *dynamic_table); + +/** + * Serialize response + * + * @param app_headers App header list + * @param app_headers_len App header list length + * @param control_data Header values set by protocol layer + * @param dst Vector where serialized headers will be added + */ +void hpack_serialize_response (u8 *app_headers, u32 app_headers_len, + hpack_response_control_data_t *control_data, + u8 **dst); + +#endif /* SRC_PLUGINS_HTTP_HPACK_H_ */ diff --git a/src/plugins/http/http2/http2.h b/src/plugins/http/http2/http2.h new file mode 100644 index 00000000000..9fc95344771 --- /dev/null +++ b/src/plugins/http/http2/http2.h @@ -0,0 +1,97 @@ +/* SPDX-License-Identifier: Apache-2.0 + * Copyright(c) 2025 Cisco Systems, Inc. + */ + +#ifndef SRC_PLUGINS_HTTP_HTTP2_H_ +#define SRC_PLUGINS_HTTP_HTTP2_H_ + +#include <vppinfra/format.h> +#include <vppinfra/types.h> + +/* RFC9113 section 7 */ +#define foreach_http2_error \ + _ (NO_ERROR, "NO_ERROR") \ + _ (PROTOCOL_ERROR, "PROTOCOL_ERROR") \ + _ (INTERNAL_ERROR, "INTERNAL_ERROR") \ + _ (FLOW_CONTROL_ERROR, "FLOW_CONTROL_ERROR") \ + _ (SETTINGS_TIMEOUT, "SETTINGS_TIMEOUT") \ + _ (STREAM_CLOSED, "STREAM_CLOSED") \ + _ (FRAME_SIZE_ERROR, "FRAME_SIZE_ERROR") \ + _ (REFUSED_STREAM, "REFUSED_STREAM") \ + _ (CANCEL, "CANCEL") \ + _ (COMPRESSION_ERROR, "COMPRESSION_ERROR") \ + _ (CONNECT_ERROR, "CONNECT_ERROR") \ + _ (ENHANCE_YOUR_CALM, "ENHANCE_YOUR_CALM") \ + _ (INADEQUATE_SECURITY, "INADEQUATE_SECURITY") \ + _ (HTTP_1_1_REQUIRED, "HTTP_1_1_REQUIRED") + +typedef enum http2_error_ +{ +#define _(s, str) HTTP2_ERROR_##s, + foreach_http2_error +#undef _ +} http2_error_t; + +static inline u8 * +format_http2_error (u8 *s, va_list *va) +{ + http2_error_t e = va_arg (*va, http2_error_t); + u8 *t = 0; + + switch (e) + { +#define _(s, str) \ + case HTTP2_ERROR_##s: \ + t = (u8 *) str; \ + break; + foreach_http2_error +#undef _ + default : return format (s, "BUG: unknown"); + } + return format (s, "%s", t); +} + +#define foreach_http2_pseudo_header \ + _ (0, METHOD, "method") \ + _ (1, SCHEME, "scheme") \ + _ (2, AUTHORITY, "authority") \ + _ (3, PATH, "path") \ + _ (4, STATUS, "status") + +/* value, label, member, min, max, default_value, err_code */ +#define foreach_http2_settings \ + _ (1, HEADER_TABLE_SIZE, header_table_size, 0, CLIB_U32_MAX, 4096, \ + HTTP2_ERROR_NO_ERROR) \ + _ (2, ENABLE_PUSH, enable_push, 0, 1, 1, HTTP2_ERROR_PROTOCOL_ERROR) \ + _ (3, MAX_CONCURRENT_STREAMS, max_concurrent_streams, 0, CLIB_U32_MAX, \ + CLIB_U32_MAX, HTTP2_ERROR_NO_ERROR) \ + _ (4, INITIAL_WINDOW_SIZE, initial_window_size, 0, 0x7FFFFFFF, 65535, \ + HTTP2_ERROR_FLOW_CONTROL_ERROR) \ + _ (5, MAX_FRAME_SIZE, max_frame_size, 16384, 16777215, 16384, \ + HTTP2_ERROR_PROTOCOL_ERROR) \ + _ (6, MAX_HEADER_LIST_SIZE, max_header_list_size, 0, CLIB_U32_MAX, \ + CLIB_U32_MAX, HTTP2_ERROR_NO_ERROR) + +typedef enum +{ +#define _(value, label, member, min, max, default_value, err_code) \ + HTTP2_SETTINGS_##label = value, + foreach_http2_settings +#undef _ +} http_settings_t; + +typedef struct +{ +#define _(value, label, member, min, max, default_value, err_code) u32 member; + foreach_http2_settings +#undef _ +} http2_conn_settings_t; + +static const http2_conn_settings_t http2_default_conn_settings = { +#define _(value, label, member, min, max, default_value, err_code) \ + default_value, + foreach_http2_settings +#undef _ +}; + +#endif /* SRC_PLUGINS_HTTP_HTTP2_H_ */ diff --git a/src/plugins/http/http2/huffman_table.h b/src/plugins/http/http2/huffman_table.h new file mode 100644 index 00000000000..66afffbc54a --- /dev/null +++ b/src/plugins/http/http2/huffman_table.h @@ -0,0 +1,319 @@ +/* SPDX-License-Identifier: Apache-2.0 + * Copyright(c) 2025 Cisco Systems, Inc. + */ + +/* generated by mk_huffman_table.py */ + +#ifndef SRC_PLUGINS_HTTP_HUFFMAN_TABLE_H_ +#define SRC_PLUGINS_HTTP_HUFFMAN_TABLE_H_ + +#include <vppinfra/types.h> + +typedef struct +{ + u8 code_len; + u32 code; +} hpack_huffman_symbol_t; + +static hpack_huffman_symbol_t huff_sym_table[] = { + { 13, 0x1ff8 }, { 23, 0x7fffd8 }, { 28, 0xfffffe2 }, { 28, 0xfffffe3 }, + { 28, 0xfffffe4 }, { 28, 0xfffffe5 }, { 28, 0xfffffe6 }, { 28, 0xfffffe7 }, + { 28, 0xfffffe8 }, { 24, 0xffffea }, { 30, 0x3ffffffc }, { 28, 0xfffffe9 }, + { 28, 0xfffffea }, { 30, 0x3ffffffd }, { 28, 0xfffffeb }, { 28, 0xfffffec }, + { 28, 0xfffffed }, { 28, 0xfffffee }, { 28, 0xfffffef }, { 28, 0xffffff0 }, + { 28, 0xffffff1 }, { 28, 0xffffff2 }, { 30, 0x3ffffffe }, { 28, 0xffffff3 }, + { 28, 0xffffff4 }, { 28, 0xffffff5 }, { 28, 0xffffff6 }, { 28, 0xffffff7 }, + { 28, 0xffffff8 }, { 28, 0xffffff9 }, { 28, 0xffffffa }, { 28, 0xffffffb }, + { 6, 0x14 }, { 10, 0x3f8 }, { 10, 0x3f9 }, { 12, 0xffa }, + { 13, 0x1ff9 }, { 6, 0x15 }, { 8, 0xf8 }, { 11, 0x7fa }, + { 10, 0x3fa }, { 10, 0x3fb }, { 8, 0xf9 }, { 11, 0x7fb }, + { 8, 0xfa }, { 6, 0x16 }, { 6, 0x17 }, { 6, 0x18 }, + { 5, 0x0 }, { 5, 0x1 }, { 5, 0x2 }, { 6, 0x19 }, + { 6, 0x1a }, { 6, 0x1b }, { 6, 0x1c }, { 6, 0x1d }, + { 6, 0x1e }, { 6, 0x1f }, { 7, 0x5c }, { 8, 0xfb }, + { 15, 0x7ffc }, { 6, 0x20 }, { 12, 0xffb }, { 10, 0x3fc }, + { 13, 0x1ffa }, { 6, 0x21 }, { 7, 0x5d }, { 7, 0x5e }, + { 7, 0x5f }, { 7, 0x60 }, { 7, 0x61 }, { 7, 0x62 }, + { 7, 0x63 }, { 7, 0x64 }, { 7, 0x65 }, { 7, 0x66 }, + { 7, 0x67 }, { 7, 0x68 }, { 7, 0x69 }, { 7, 0x6a }, + { 7, 0x6b }, { 7, 0x6c }, { 7, 0x6d }, { 7, 0x6e }, + { 7, 0x6f }, { 7, 0x70 }, { 7, 0x71 }, { 7, 0x72 }, + { 8, 0xfc }, { 7, 0x73 }, { 8, 0xfd }, { 13, 0x1ffb }, + { 19, 0x7fff0 }, { 13, 0x1ffc }, { 14, 0x3ffc }, { 6, 0x22 }, + { 15, 0x7ffd }, { 5, 0x3 }, { 6, 0x23 }, { 5, 0x4 }, + { 6, 0x24 }, { 5, 0x5 }, { 6, 0x25 }, { 6, 0x26 }, + { 6, 0x27 }, { 5, 0x6 }, { 7, 0x74 }, { 7, 0x75 }, + { 6, 0x28 }, { 6, 0x29 }, { 6, 0x2a }, { 5, 0x7 }, + { 6, 0x2b }, { 7, 0x76 }, { 6, 0x2c }, { 5, 0x8 }, + { 5, 0x9 }, { 6, 0x2d }, { 7, 0x77 }, { 7, 0x78 }, + { 7, 0x79 }, { 7, 0x7a }, { 7, 0x7b }, { 15, 0x7ffe }, + { 11, 0x7fc }, { 14, 0x3ffd }, { 13, 0x1ffd }, { 28, 0xffffffc }, + { 20, 0xfffe6 }, { 22, 0x3fffd2 }, { 20, 0xfffe7 }, { 20, 0xfffe8 }, + { 22, 0x3fffd3 }, { 22, 0x3fffd4 }, { 22, 0x3fffd5 }, { 23, 0x7fffd9 }, + { 22, 0x3fffd6 }, { 23, 0x7fffda }, { 23, 0x7fffdb }, { 23, 0x7fffdc }, + { 23, 0x7fffdd }, { 23, 0x7fffde }, { 24, 0xffffeb }, { 23, 0x7fffdf }, + { 24, 0xffffec }, { 24, 0xffffed }, { 22, 0x3fffd7 }, { 23, 0x7fffe0 }, + { 24, 0xffffee }, { 23, 0x7fffe1 }, { 23, 0x7fffe2 }, { 23, 0x7fffe3 }, + { 23, 0x7fffe4 }, { 21, 0x1fffdc }, { 22, 0x3fffd8 }, { 23, 0x7fffe5 }, + { 22, 0x3fffd9 }, { 23, 0x7fffe6 }, { 23, 0x7fffe7 }, { 24, 0xffffef }, + { 22, 0x3fffda }, { 21, 0x1fffdd }, { 20, 0xfffe9 }, { 22, 0x3fffdb }, + { 22, 0x3fffdc }, { 23, 0x7fffe8 }, { 23, 0x7fffe9 }, { 21, 0x1fffde }, + { 23, 0x7fffea }, { 22, 0x3fffdd }, { 22, 0x3fffde }, { 24, 0xfffff0 }, + { 21, 0x1fffdf }, { 22, 0x3fffdf }, { 23, 0x7fffeb }, { 23, 0x7fffec }, + { 21, 0x1fffe0 }, { 21, 0x1fffe1 }, { 22, 0x3fffe0 }, { 21, 0x1fffe2 }, + { 23, 0x7fffed }, { 22, 0x3fffe1 }, { 23, 0x7fffee }, { 23, 0x7fffef }, + { 20, 0xfffea }, { 22, 0x3fffe2 }, { 22, 0x3fffe3 }, { 22, 0x3fffe4 }, + { 23, 0x7ffff0 }, { 22, 0x3fffe5 }, { 22, 0x3fffe6 }, { 23, 0x7ffff1 }, + { 26, 0x3ffffe0 }, { 26, 0x3ffffe1 }, { 20, 0xfffeb }, { 19, 0x7fff1 }, + { 22, 0x3fffe7 }, { 23, 0x7ffff2 }, { 22, 0x3fffe8 }, { 25, 0x1ffffec }, + { 26, 0x3ffffe2 }, { 26, 0x3ffffe3 }, { 26, 0x3ffffe4 }, { 27, 0x7ffffde }, + { 27, 0x7ffffdf }, { 26, 0x3ffffe5 }, { 24, 0xfffff1 }, { 25, 0x1ffffed }, + { 19, 0x7fff2 }, { 21, 0x1fffe3 }, { 26, 0x3ffffe6 }, { 27, 0x7ffffe0 }, + { 27, 0x7ffffe1 }, { 26, 0x3ffffe7 }, { 27, 0x7ffffe2 }, { 24, 0xfffff2 }, + { 21, 0x1fffe4 }, { 21, 0x1fffe5 }, { 26, 0x3ffffe8 }, { 26, 0x3ffffe9 }, + { 28, 0xffffffd }, { 27, 0x7ffffe3 }, { 27, 0x7ffffe4 }, { 27, 0x7ffffe5 }, + { 20, 0xfffec }, { 24, 0xfffff3 }, { 20, 0xfffed }, { 21, 0x1fffe6 }, + { 22, 0x3fffe9 }, { 21, 0x1fffe7 }, { 21, 0x1fffe8 }, { 23, 0x7ffff3 }, + { 22, 0x3fffea }, { 22, 0x3fffeb }, { 25, 0x1ffffee }, { 25, 0x1ffffef }, + { 24, 0xfffff4 }, { 24, 0xfffff5 }, { 26, 0x3ffffea }, { 23, 0x7ffff4 }, + { 26, 0x3ffffeb }, { 27, 0x7ffffe6 }, { 26, 0x3ffffec }, { 26, 0x3ffffed }, + { 27, 0x7ffffe7 }, { 27, 0x7ffffe8 }, { 27, 0x7ffffe9 }, { 27, 0x7ffffea }, + { 27, 0x7ffffeb }, { 28, 0xffffffe }, { 27, 0x7ffffec }, { 27, 0x7ffffed }, + { 27, 0x7ffffee }, { 27, 0x7ffffef }, { 27, 0x7fffff0 }, { 26, 0x3ffffee }, +}; + +typedef struct +{ + u8 symbol; + u8 code_len; +} hpack_huffman_code_t; + +static hpack_huffman_code_t huff_code_table_fast[] = { + { 0x30, 5 }, { 0x30, 5 }, { 0x30, 5 }, { 0x30, 5 }, { 0x30, 5 }, { 0x30, 5 }, + { 0x30, 5 }, { 0x30, 5 }, { 0x31, 5 }, { 0x31, 5 }, { 0x31, 5 }, { 0x31, 5 }, + { 0x31, 5 }, { 0x31, 5 }, { 0x31, 5 }, { 0x31, 5 }, { 0x32, 5 }, { 0x32, 5 }, + { 0x32, 5 }, { 0x32, 5 }, { 0x32, 5 }, { 0x32, 5 }, { 0x32, 5 }, { 0x32, 5 }, + { 0x61, 5 }, { 0x61, 5 }, { 0x61, 5 }, { 0x61, 5 }, { 0x61, 5 }, { 0x61, 5 }, + { 0x61, 5 }, { 0x61, 5 }, { 0x63, 5 }, { 0x63, 5 }, { 0x63, 5 }, { 0x63, 5 }, + { 0x63, 5 }, { 0x63, 5 }, { 0x63, 5 }, { 0x63, 5 }, { 0x65, 5 }, { 0x65, 5 }, + { 0x65, 5 }, { 0x65, 5 }, { 0x65, 5 }, { 0x65, 5 }, { 0x65, 5 }, { 0x65, 5 }, + { 0x69, 5 }, { 0x69, 5 }, { 0x69, 5 }, { 0x69, 5 }, { 0x69, 5 }, { 0x69, 5 }, + { 0x69, 5 }, { 0x69, 5 }, { 0x6F, 5 }, { 0x6F, 5 }, { 0x6F, 5 }, { 0x6F, 5 }, + { 0x6F, 5 }, { 0x6F, 5 }, { 0x6F, 5 }, { 0x6F, 5 }, { 0x73, 5 }, { 0x73, 5 }, + { 0x73, 5 }, { 0x73, 5 }, { 0x73, 5 }, { 0x73, 5 }, { 0x73, 5 }, { 0x73, 5 }, + { 0x74, 5 }, { 0x74, 5 }, { 0x74, 5 }, { 0x74, 5 }, { 0x74, 5 }, { 0x74, 5 }, + { 0x74, 5 }, { 0x74, 5 }, { 0x20, 6 }, { 0x20, 6 }, { 0x20, 6 }, { 0x20, 6 }, + { 0x25, 6 }, { 0x25, 6 }, { 0x25, 6 }, { 0x25, 6 }, { 0x2D, 6 }, { 0x2D, 6 }, + { 0x2D, 6 }, { 0x2D, 6 }, { 0x2E, 6 }, { 0x2E, 6 }, { 0x2E, 6 }, { 0x2E, 6 }, + { 0x2F, 6 }, { 0x2F, 6 }, { 0x2F, 6 }, { 0x2F, 6 }, { 0x33, 6 }, { 0x33, 6 }, + { 0x33, 6 }, { 0x33, 6 }, { 0x34, 6 }, { 0x34, 6 }, { 0x34, 6 }, { 0x34, 6 }, + { 0x35, 6 }, { 0x35, 6 }, { 0x35, 6 }, { 0x35, 6 }, { 0x36, 6 }, { 0x36, 6 }, + { 0x36, 6 }, { 0x36, 6 }, { 0x37, 6 }, { 0x37, 6 }, { 0x37, 6 }, { 0x37, 6 }, + { 0x38, 6 }, { 0x38, 6 }, { 0x38, 6 }, { 0x38, 6 }, { 0x39, 6 }, { 0x39, 6 }, + { 0x39, 6 }, { 0x39, 6 }, { 0x3D, 6 }, { 0x3D, 6 }, { 0x3D, 6 }, { 0x3D, 6 }, + { 0x41, 6 }, { 0x41, 6 }, { 0x41, 6 }, { 0x41, 6 }, { 0x5F, 6 }, { 0x5F, 6 }, + { 0x5F, 6 }, { 0x5F, 6 }, { 0x62, 6 }, { 0x62, 6 }, { 0x62, 6 }, { 0x62, 6 }, + { 0x64, 6 }, { 0x64, 6 }, { 0x64, 6 }, { 0x64, 6 }, { 0x66, 6 }, { 0x66, 6 }, + { 0x66, 6 }, { 0x66, 6 }, { 0x67, 6 }, { 0x67, 6 }, { 0x67, 6 }, { 0x67, 6 }, + { 0x68, 6 }, { 0x68, 6 }, { 0x68, 6 }, { 0x68, 6 }, { 0x6C, 6 }, { 0x6C, 6 }, + { 0x6C, 6 }, { 0x6C, 6 }, { 0x6D, 6 }, { 0x6D, 6 }, { 0x6D, 6 }, { 0x6D, 6 }, + { 0x6E, 6 }, { 0x6E, 6 }, { 0x6E, 6 }, { 0x6E, 6 }, { 0x70, 6 }, { 0x70, 6 }, + { 0x70, 6 }, { 0x70, 6 }, { 0x72, 6 }, { 0x72, 6 }, { 0x72, 6 }, { 0x72, 6 }, + { 0x75, 6 }, { 0x75, 6 }, { 0x75, 6 }, { 0x75, 6 }, { 0x3A, 7 }, { 0x3A, 7 }, + { 0x42, 7 }, { 0x42, 7 }, { 0x43, 7 }, { 0x43, 7 }, { 0x44, 7 }, { 0x44, 7 }, + { 0x45, 7 }, { 0x45, 7 }, { 0x46, 7 }, { 0x46, 7 }, { 0x47, 7 }, { 0x47, 7 }, + { 0x48, 7 }, { 0x48, 7 }, { 0x49, 7 }, { 0x49, 7 }, { 0x4A, 7 }, { 0x4A, 7 }, + { 0x4B, 7 }, { 0x4B, 7 }, { 0x4C, 7 }, { 0x4C, 7 }, { 0x4D, 7 }, { 0x4D, 7 }, + { 0x4E, 7 }, { 0x4E, 7 }, { 0x4F, 7 }, { 0x4F, 7 }, { 0x50, 7 }, { 0x50, 7 }, + { 0x51, 7 }, { 0x51, 7 }, { 0x52, 7 }, { 0x52, 7 }, { 0x53, 7 }, { 0x53, 7 }, + { 0x54, 7 }, { 0x54, 7 }, { 0x55, 7 }, { 0x55, 7 }, { 0x56, 7 }, { 0x56, 7 }, + { 0x57, 7 }, { 0x57, 7 }, { 0x59, 7 }, { 0x59, 7 }, { 0x6A, 7 }, { 0x6A, 7 }, + { 0x6B, 7 }, { 0x6B, 7 }, { 0x71, 7 }, { 0x71, 7 }, { 0x76, 7 }, { 0x76, 7 }, + { 0x77, 7 }, { 0x77, 7 }, { 0x78, 7 }, { 0x78, 7 }, { 0x79, 7 }, { 0x79, 7 }, + { 0x7A, 7 }, { 0x7A, 7 }, { 0x26, 8 }, { 0x2A, 8 }, { 0x2C, 8 }, { 0x3B, 8 }, + { 0x58, 8 }, { 0x5A, 8 }, { 0x00, 0 }, { 0x00, 0 }, +}; + +typedef struct +{ + u32 first_code; + u8 code_len; + u8 symbols[29]; +} hpack_huffman_group_t; + +/* clang-format off */ + +static hpack_huffman_group_t huff_code_table_slow[] = { + { + 0x3f8, /* first_code */ + 10, /* code_len */ + { + 0x21, 0x22, 0x28, 0x29, 0x3F, + } /* symbols */ + }, + { + 0x7fa, /* first_code */ + 11, /* code_len */ + { + 0x27, 0x2B, 0x7C, + } /* symbols */ + }, + { + 0xffa, /* first_code */ + 12, /* code_len */ + { + 0x23, 0x3E, + } /* symbols */ + }, + { + 0x1ff8, /* first_code */ + 13, /* code_len */ + { + 0x00, 0x24, 0x40, 0x5B, 0x5D, 0x7E, + } /* symbols */ + }, + { + 0x3ffc, /* first_code */ + 14, /* code_len */ + { + 0x5E, 0x7D, + } /* symbols */ + }, + { + 0x7ffc, /* first_code */ + 15, /* code_len */ + { + 0x3C, 0x60, 0x7B, + } /* symbols */ + }, + { + 0x7fff0, /* first_code */ + 19, /* code_len */ + { + 0x5C, 0xC3, 0xD0, + } /* symbols */ + }, + { + 0xfffe6, /* first_code */ + 20, /* code_len */ + { + 0x80, 0x82, 0x83, 0xA2, 0xB8, 0xC2, 0xE0, 0xE2, + } /* symbols */ + }, + { + 0x1fffdc, /* first_code */ + 21, /* code_len */ + { + 0x99, 0xA1, 0xA7, 0xAC, 0xB0, 0xB1, 0xB3, 0xD1, 0xD8, 0xD9, + 0xE3, 0xE5, 0xE6, + } /* symbols */ + }, + { + 0x3fffd2, /* first_code */ + 22, /* code_len */ + { + 0x81, 0x84, 0x85, 0x86, 0x88, 0x92, 0x9A, 0x9C, 0xA0, 0xA3, + 0xA4, 0xA9, 0xAA, 0xAD, 0xB2, 0xB5, 0xB9, 0xBA, 0xBB, 0xBD, + 0xBE, 0xC4, 0xC6, 0xE4, 0xE8, 0xE9, + } /* symbols */ + }, + { + 0x7fffd8, /* first_code */ + 23, /* code_len */ + { + 0x01, 0x87, 0x89, 0x8A, 0x8B, 0x8C, 0x8D, 0x8F, 0x93, 0x95, + 0x96, 0x97, 0x98, 0x9B, 0x9D, 0x9E, 0xA5, 0xA6, 0xA8, 0xAE, + 0xAF, 0xB4, 0xB6, 0xB7, 0xBC, 0xBF, 0xC5, 0xE7, 0xEF, + } /* symbols */ + }, + { + 0xffffea, /* first_code */ + 24, /* code_len */ + { + 0x09, 0x8E, 0x90, 0x91, 0x94, 0x9F, 0xAB, 0xCE, 0xD7, 0xE1, + 0xEC, 0xED, + } /* symbols */ + }, + { + 0x1ffffec, /* first_code */ + 25, /* code_len */ + { + 0xC7, 0xCF, 0xEA, 0xEB, + } /* symbols */ + }, + { + 0x3ffffe0, /* first_code */ + 26, /* code_len */ + { + 0xC0, 0xC1, 0xC8, 0xC9, 0xCA, 0xCD, 0xD2, 0xD5, 0xDA, 0xDB, + 0xEE, 0xF0, 0xF2, 0xF3, 0xFF, + } /* symbols */ + }, + { + 0x7ffffde, /* first_code */ + 27, /* code_len */ + { + 0xCB, 0xCC, 0xD3, 0xD4, 0xD6, 0xDD, 0xDE, 0xDF, 0xF1, 0xF4, + 0xF5, 0xF6, 0xF7, 0xF8, 0xFA, 0xFB, 0xFC, 0xFD, 0xFE, + } /* symbols */ + }, + { + 0xfffffe2, /* first_code */ + 28, /* code_len */ + { + 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x0B, 0x0C, 0x0E, + 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x17, 0x18, 0x19, + 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x7F, 0xDC, 0xF9, + } /* symbols */ + }, + { + 0x3ffffffc, /* first_code */ + 30, /* code_len */ + { + 0x0A, 0x0D, 0x16, + } /* symbols */ + }, +}; + +/* clang format-on */ + +always_inline hpack_huffman_group_t * +hpack_huffman_get_group (u32 value) +{ + if (value < 0xFF400000) + return &huff_code_table_slow[0]; + else if (value < 0xFFA00000) + return &huff_code_table_slow[1]; + else if (value < 0xFFC00000) + return &huff_code_table_slow[2]; + else if (value < 0xFFF00000) + return &huff_code_table_slow[3]; + else if (value < 0xFFF80000) + return &huff_code_table_slow[4]; + else if (value < 0xFFFE0000) + return &huff_code_table_slow[5]; + else if (value < 0xFFFE6000) + return &huff_code_table_slow[6]; + else if (value < 0xFFFEE000) + return &huff_code_table_slow[7]; + else if (value < 0xFFFF4800) + return &huff_code_table_slow[8]; + else if (value < 0xFFFFB000) + return &huff_code_table_slow[9]; + else if (value < 0xFFFFEA00) + return &huff_code_table_slow[10]; + else if (value < 0xFFFFF600) + return &huff_code_table_slow[11]; + else if (value < 0xFFFFF800) + return &huff_code_table_slow[12]; + else if (value < 0xFFFFFBC0) + return &huff_code_table_slow[13]; + else if (value < 0xFFFFFE20) + return &huff_code_table_slow[14]; + else if (value < 0xFFFFFFF0) + return &huff_code_table_slow[15]; + else + return &huff_code_table_slow[16]; +} + +#endif /* SRC_PLUGINS_HTTP_HUFFMAN_TABLE_H_ */ diff --git a/src/plugins/http/http_header_names.h b/src/plugins/http/http_header_names.h index 99acac786db..1778daf10d9 100644 --- a/src/plugins/http/http_header_names.h +++ b/src/plugins/http/http_header_names.h @@ -8,7 +8,8 @@ #include <http/http.h> static http_token_t http_header_names[] = { -#define _(sym, str) { http_token_lit (str) }, +#define _(sym, str_canonical, str_lower, hpack_index) \ + { http_token_lit (str_canonical) }, foreach_http_header_name #undef _ }; diff --git a/src/plugins/http/http_plugin.rst b/src/plugins/http/http_plugin.rst index 995e55e6f0f..4e799a57668 100644 --- a/src/plugins/http/http_plugin.rst +++ b/src/plugins/http/http_plugin.rst @@ -15,7 +15,7 @@ Usage ----- The plugin exposes following inline functions: ``http_validate_abs_path_syntax``, ``http_validate_query_syntax``, -``http_percent_decode``, ``http_path_remove_dot_segments``, ``http_build_header_table``, ``http_get_header``, +``http_percent_decode``, ``http_path_sanitize``, ``http_build_header_table``, ``http_get_header``, ``http_reset_header_table``, ``http_free_header_table``, ``http_init_headers_ctx``, ``http_add_header``, ``http_add_custom_header``, ``http_validate_target_syntax``, ``http_parse_authority``, ``http_serialize_authority``, ``http_parse_masque_host_port``, ``http_decap_udp_payload_datagram``, ``http_encap_udp_payload_datagram``, diff --git a/src/plugins/http/http_private.h b/src/plugins/http/http_private.h index 187d1fe8215..154a63d2402 100644 --- a/src/plugins/http/http_private.h +++ b/src/plugins/http/http_private.h @@ -138,6 +138,26 @@ typedef struct http_req_ http_upgrade_proto_t upgrade_proto; } http_req_t; +#define foreach_http_conn_flags \ + _ (HO_DONE, "ho-done") \ + _ (NO_APP_SESSION, "no-app-session") \ + _ (PENDING_TIMER, "pending-timer") \ + _ (IS_SERVER, "is-server") + +typedef enum http_conn_flags_bit_ +{ +#define _(sym, str) HTTP_CONN_F_BIT_##sym, + foreach_http_conn_flags +#undef _ +} http_conn_flags_bit_t; + +typedef enum http_conn_flags_ +{ +#define _(sym, str) HTTP_CONN_F_##sym = 1 << HTTP_CONN_F_BIT_##sym, + foreach_http_conn_flags +#undef _ +} __clib_packed http_conn_flags_t; + typedef struct http_tc_ { union @@ -155,10 +175,9 @@ typedef struct http_tc_ http_conn_state_t state; u32 timer_handle; u32 timeout; - u8 pending_timer; u8 *app_name; u8 *host; - u8 is_server; + http_conn_flags_t flags; http_udp_tunnel_mode_t udp_tunnel_mode; http_req_t *req_pool; /* multiplexing => request per stream */ @@ -174,6 +193,8 @@ typedef struct http_main_ http_worker_t *wrk; http_conn_t *listener_pool; http_conn_t *ho_conn_pool; + u32 *postponed_ho_free; + u32 *ho_free_list; u32 app_index; u8 **rx_bufs; diff --git a/src/plugins/http/http_timer.h b/src/plugins/http/http_timer.h index 3bd12f7821d..50f634c5397 100644 --- a/src/plugins/http/http_timer.h +++ b/src/plugins/http/http_timer.h @@ -59,7 +59,7 @@ http_conn_timer_stop (http_conn_t *hc) { http_tw_ctx_t *twc = &http_tw_ctx; - hc->pending_timer = 0; + hc->flags &= ~HTTP_CONN_F_PENDING_TIMER; if (hc->timer_handle == HTTP_TIMER_HANDLE_INVALID) return; diff --git a/src/plugins/http/test/http_test.c b/src/plugins/http/test/http_test.c index bfaa285eb35..f44d3cbd31b 100644 --- a/src/plugins/http/test/http_test.c +++ b/src/plugins/http/test/http_test.c @@ -6,6 +6,8 @@ #include <vpp/app/version.h> #include <http/http.h> #include <http/http_header_names.h> +#include <http/http2/hpack.h> +#include <http/http2/frame.h> #define HTTP_TEST_I(_cond, _comment, _args...) \ ({ \ @@ -533,6 +535,771 @@ http_test_http_header_table (vlib_main_t *vm) return 0; } +static int +http_test_parse_request (const char *first_req, uword first_req_len, + const char *second_req, uword second_req_len, + const char *third_req, uword third_req_len, + hpack_dynamic_table_t *dynamic_table) +{ + http2_error_t rv; + u8 *buf = 0; + hpack_request_control_data_t control_data; + http_field_line_t *headers = 0; + u16 parsed_bitmap = 0; + + static http2_error_t (*_hpack_parse_request) ( + u8 * src, u32 src_len, u8 * dst, u32 dst_len, + hpack_request_control_data_t * control_data, http_field_line_t * *headers, + hpack_dynamic_table_t * dynamic_table); + + _hpack_parse_request = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_parse_request"); + + parsed_bitmap = + HPACK_PSEUDO_HEADER_METHOD_PARSED | HPACK_PSEUDO_HEADER_SCHEME_PARSED | + HPACK_PSEUDO_HEADER_PATH_PARSED | HPACK_PSEUDO_HEADER_AUTHORITY_PARSED; + + /* first request */ + vec_validate_init_empty (buf, 254, 0); + memset (&control_data, 0, sizeof (control_data)); + rv = _hpack_parse_request ((u8 *) first_req, (u32) first_req_len, buf, 254, + &control_data, &headers, dynamic_table); + if (rv != HTTP2_ERROR_NO_ERROR || + control_data.parsed_bitmap != parsed_bitmap || + control_data.method != HTTP_REQ_GET || + control_data.scheme != HTTP_URL_SCHEME_HTTP || + control_data.path_len != 1 || control_data.authority_len != 15 || + dynamic_table->used != 57 || vec_len (headers) != 0) + return 1; + if (memcmp (control_data.path, "/", 1)) + return 1; + if (memcmp (control_data.authority, "www.example.com", 15)) + return 1; + vec_free (headers); + vec_free (buf); + + /* second request */ + vec_validate_init_empty (buf, 254, 0); + memset (&control_data, 0, sizeof (control_data)); + rv = _hpack_parse_request ((u8 *) second_req, (u32) second_req_len, buf, 254, + &control_data, &headers, dynamic_table); + if (rv != HTTP2_ERROR_NO_ERROR || + control_data.parsed_bitmap != parsed_bitmap || + control_data.method != HTTP_REQ_GET || + control_data.scheme != HTTP_URL_SCHEME_HTTP || + control_data.path_len != 1 || control_data.authority_len != 15 || + dynamic_table->used != 110 || vec_len (headers) != 1 || + control_data.headers_len != 21) + return 2; + if (memcmp (control_data.path, "/", 1)) + return 2; + if (memcmp (control_data.authority, "www.example.com", 15)) + return 2; + if (headers[0].name_len != 13 || headers[0].value_len != 8) + return 2; + if (memcmp (control_data.headers + headers[0].name_offset, "cache-control", + 13)) + return 2; + if (memcmp (control_data.headers + headers[0].value_offset, "no-cache", 8)) + return 2; + vec_free (headers); + vec_free (buf); + + /* third request */ + vec_validate_init_empty (buf, 254, 0); + memset (&control_data, 0, sizeof (control_data)); + rv = _hpack_parse_request ((u8 *) third_req, (u32) third_req_len, buf, 254, + &control_data, &headers, dynamic_table); + if (rv != HTTP2_ERROR_NO_ERROR || + control_data.parsed_bitmap != parsed_bitmap || + control_data.method != HTTP_REQ_GET || + control_data.scheme != HTTP_URL_SCHEME_HTTPS || + control_data.path_len != 11 || control_data.authority_len != 15 || + dynamic_table->used != 164 || vec_len (headers) != 1 || + control_data.headers_len != 22) + return 3; + if (memcmp (control_data.path, "/index.html", 11)) + return 3; + if (memcmp (control_data.authority, "www.example.com", 15)) + return 3; + if (headers[0].name_len != 10 || headers[0].value_len != 12) + return 3; + if (memcmp (control_data.headers + headers[0].name_offset, "custom-key", 10)) + return 3; + if (memcmp (control_data.headers + headers[0].value_offset, "custom-value", + 12)) + return 3; + vec_free (headers); + vec_free (buf); + + return 0; +} + +static int +http_test_hpack (vlib_main_t *vm) +{ + vlib_cli_output (vm, "hpack_decode_int"); + + static uword (*_hpack_decode_int) (u8 * *pos, u8 * end, u8 prefix_len); + _hpack_decode_int = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_decode_int"); + + u8 *pos, *end, *input = 0; + uword value; +#define TEST(i, pl, e) \ + vec_validate (input, sizeof (i) - 2); \ + memcpy (input, i, sizeof (i) - 1); \ + pos = input; \ + end = vec_end (input); \ + value = _hpack_decode_int (&pos, end, (u8) pl); \ + HTTP_TEST ((value == (uword) e && pos == end), \ + "%U with prefix length %u is %llu", format_hex_bytes, input, \ + vec_len (input), (u8) pl, value); \ + vec_free (input); + + TEST ("\x00", 8, 0); + TEST ("\x2A", 8, 42); + TEST ("\x72", 4, 2); + TEST ("\x7F\x00", 7, 127); + TEST ("\x7F\x01", 7, 128); + TEST ("\x9F\x9A\x0A", 5, 1337); + TEST ("\xFF\x80\x01", 7, 255); + /* max value to decode is CLIB_WORD_MAX, CLIB_UWORD_MAX is error */ + TEST ("\x7F\x80\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x7F", 7, CLIB_WORD_MAX); + +#undef TEST + +#define N_TEST(i, pl) \ + vec_validate (input, sizeof (i) - 2); \ + memcpy (input, i, sizeof (i) - 1); \ + pos = input; \ + end = vec_end (input); \ + value = _hpack_decode_int (&pos, end, (u8) pl); \ + HTTP_TEST ((value == HPACK_INVALID_INT), \ + "%U with prefix length %u should be invalid", format_hex_bytes, \ + input, vec_len (input), (u8) pl); \ + vec_free (input); + + /* incomplete */ + N_TEST ("\x7F", 7); + N_TEST ("\x0F\xFF\xFF", 4); + /* overflow */ + N_TEST ("\x0F\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00", 4); + N_TEST ("\x0F\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00", 4); + +#undef N_TEST + + vlib_cli_output (vm, "hpack_encode_int"); + + static u8 *(*_hpack_encode_int) (u8 * dst, uword value, u8 prefix_len); + _hpack_encode_int = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_encode_int"); + + u8 *buf = 0; + u8 *p; + +#define TEST(v, pl, e) \ + vec_validate_init_empty (buf, 15, 0); \ + p = _hpack_encode_int (buf, v, (u8) pl); \ + HTTP_TEST (((p - buf) == (sizeof (e) - 1) && !memcmp (buf, e, p - buf)), \ + "%llu with prefix length %u is encoded as %U", v, (u8) pl, \ + format_hex_bytes, buf, p - buf); \ + vec_free (buf); + + TEST (0, 8, "\x00"); + TEST (2, 4, "\x02"); + TEST (42, 8, "\x2A"); + TEST (127, 7, "\x7F\x00"); + TEST (128, 7, "\x7F\x01"); + TEST (255, 7, "\x7F\x80\x01"); + TEST (1337, 5, "\x1F\x9A\x0A"); + TEST (CLIB_WORD_MAX, 7, "\x7F\x80\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x7F"); +#undef TEST + + vlib_cli_output (vm, "hpack_decode_string"); + + static http2_error_t (*_hpack_decode_string) (u8 * *src, u8 * end, u8 * *buf, + uword * buf_len); + _hpack_decode_string = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_decode_string"); + + u8 *bp; + uword blen, len; + http2_error_t rv; + +#define TEST(i, e) \ + vec_validate (input, sizeof (i) - 2); \ + memcpy (input, i, sizeof (i) - 1); \ + pos = input; \ + vec_validate_init_empty (buf, 63, 0); \ + bp = buf; \ + blen = vec_len (buf); \ + rv = _hpack_decode_string (&pos, vec_end (input), &bp, &blen); \ + len = vec_len (buf) - blen; \ + HTTP_TEST ((len == strlen (e) && !memcmp (buf, e, len) && \ + pos == vec_end (input) && bp == buf + len && \ + rv == HTTP2_ERROR_NO_ERROR), \ + "%U is decoded as %U", format_hex_bytes, input, vec_len (input), \ + format_http_bytes, buf, len); \ + vec_free (input); \ + vec_free (buf); + + /* raw coding */ + TEST ("\x07private", "private"); + /* Huffman coding */ + TEST ("\x85\xAE\xC3\x77\x1A\x4B", "private"); + TEST ("\x86\xA8\xEB\x10\x64\x9C\xBF", "no-cache"); + TEST ("\x8C\xF1\xE3\xC2\xE5\xF2\x3A\x6B\xA0\xAB\x90\xF4\xFF", + "www.example.com"); + TEST ("\x96\xD0\x7A\xBE\x94\x10\x54\xD4\x44\xA8\x20\x05\x95\x04\x0B\x81\x66" + "\xE0\x82\xA6\x2D\x1B\xFF", + "Mon, 21 Oct 2013 20:13:21 GMT") + TEST ("\xAD\x94\xE7\x82\x1D\xD7\xF2\xE6\xC7\xB3\x35\xDF\xDF\xCD\x5B\x39\x60" + "\xD5\xAF\x27\x08\x7F\x36\x72\xC1\xAB\x27\x0F\xB5\x29\x1F\x95\x87\x31" + "\x60\x65\xC0\x03\xED\x4E\xE5\xB1\x06\x3D\x50\x07", + "foo=ASDJKHQKBZXOQWEOPIUAXQWEOIU; max-age=3600; version=1"); + TEST ("\x8A\x9C\xB4\x50\x75\x3C\x1E\xCA\x24\xFE\x3F", "hello world!") + TEST ("\x8A\xFF\xFE\x03\x18\xC6\x31\x8C\x63\x18\xC7", "\\aaaaaaaaaaaa"); + TEST ("\x8C\x1F\xFF\xF0\x18\xC6\x31\x80\x03\x18\xC6\x31\x8F", + "a\\aaaaa00aaaaaaa"); + TEST ("\x87\x1F\xFF\xF0\xFF\xFE\x11\xFF", "a\\\\b"); + TEST ("\x84\x1F\xF9\xFE\xA3", "a?'b"); + TEST ("\x84\x1F\xFA\xFF\x23", "a'?b"); + TEST ("\x8D\x1F\xFF\xFF\xFF\x0C\x63\x18\xC0\x01\x8C\x63\x18\xC7", + "\x61\xF9\x61\x61\x61\x61\x61\x30\x30\x61\x61\x61\x61\x61\x61\x61") +#undef TEST + +#define N_TEST(i, e) \ + vec_validate (input, sizeof (i) - 2); \ + memcpy (input, i, sizeof (i) - 1); \ + pos = input; \ + vec_validate_init_empty (buf, 15, 0); \ + bp = buf; \ + blen = vec_len (buf); \ + rv = _hpack_decode_string (&pos, vec_end (input), &bp, &blen); \ + HTTP_TEST ((rv == e), "%U should be invalid (%U)", format_hex_bytes, input, \ + vec_len (input), format_http2_error, rv); \ + vec_free (input); \ + vec_free (buf); + + /* incomplete */ + N_TEST ("\x87", HTTP2_ERROR_COMPRESSION_ERROR); + N_TEST ("\x07priv", HTTP2_ERROR_COMPRESSION_ERROR); + /* invalid length */ + N_TEST ("\x7Fprivate", HTTP2_ERROR_COMPRESSION_ERROR); + /* invalid EOF */ + N_TEST ("\x81\x8C", HTTP2_ERROR_COMPRESSION_ERROR); + /* not enough space for decoding */ + N_TEST ( + "\x96\xD0\x7A\xBE\x94\x10\x54\xD4\x44\xA8\x20\x05\x95\x04\x0B\x81\x66" + "\xE0\x82\xA6\x2D\x1B\xFF", + HTTP2_ERROR_INTERNAL_ERROR); +#undef N_TEST + + vlib_cli_output (vm, "hpack_encode_string"); + + static u8 *(*_hpack_encode_string) (u8 * dst, const u8 *value, + uword value_len); + _hpack_encode_string = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_encode_string"); + +#define TEST(i, e) \ + vec_validate (input, sizeof (i) - 2); \ + memcpy (input, i, sizeof (i) - 1); \ + pos = input; \ + vec_validate_init_empty (buf, 63, 0); \ + p = _hpack_encode_string (buf, input, vec_len (input)); \ + HTTP_TEST (((p - buf) == (sizeof (e) - 1) && !memcmp (buf, e, p - buf)), \ + "%v is encoded as %U", input, format_hex_bytes, buf, p - buf); \ + vec_free (input); \ + vec_free (buf); + + /* Huffman coding */ + TEST ("private", "\x85\xAE\xC3\x77\x1A\x4B"); + TEST ("no-cache", "\x86\xA8\xEB\x10\x64\x9C\xBF"); + TEST ("www.example.com", + "\x8C\xF1\xE3\xC2\xE5\xF2\x3A\x6B\xA0\xAB\x90\xF4\xFF"); + TEST ("Mon, 21 Oct 2013 20:13:21 GMT", + "\x96\xD0\x7A\xBE\x94\x10\x54\xD4\x44\xA8\x20\x05\x95\x04\x0B\x81\x66" + "\xE0\x82\xA6\x2D\x1B\xFF") + TEST ("foo=ASDJKHQKBZXOQWEOPIUAXQWEOIU; max-age=3600; version=1", + "\xAD\x94\xE7\x82\x1D\xD7\xF2\xE6\xC7\xB3\x35\xDF\xDF\xCD\x5B\x39\x60" + "\xD5\xAF\x27\x08\x7F\x36\x72\xC1\xAB\x27\x0F\xB5\x29\x1F\x95\x87\x31" + "\x60\x65\xC0\x03\xED\x4E\xE5\xB1\x06\x3D\x50\x07"); + TEST ("hello world!", "\x8A\x9C\xB4\x50\x75\x3C\x1E\xCA\x24\xFE\x3F") + TEST ("\\aaaaaaaaaaaa", "\x8A\xFF\xFE\x03\x18\xC6\x31\x8C\x63\x18\xC7"); + /* raw coding */ + TEST ("[XZ]", "\x4[XZ]"); +#undef TEST + + vlib_cli_output (vm, "hpack_decode_header"); + + static http2_error_t (*_hpack_decode_header) ( + u8 * *src, u8 * end, u8 * *buf, uword * buf_len, u32 * name_len, + u32 * value_len, hpack_dynamic_table_t * dt); + + _hpack_decode_header = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_decode_header"); + + static void (*_hpack_dynamic_table_init) (hpack_dynamic_table_t * table, + u32 max_size); + + _hpack_dynamic_table_init = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_dynamic_table_init"); + + static void (*_hpack_dynamic_table_free) (hpack_dynamic_table_t * table); + + _hpack_dynamic_table_free = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_dynamic_table_free"); + + u32 name_len, value_len; + hpack_dynamic_table_t table; + + _hpack_dynamic_table_init (&table, 128); + +#define TEST(i, e_name, e_value, dt_size) \ + vec_validate (input, sizeof (i) - 2); \ + memcpy (input, i, sizeof (i) - 1); \ + pos = input; \ + vec_validate_init_empty (buf, 63, 0); \ + bp = buf; \ + blen = vec_len (buf); \ + rv = _hpack_decode_header (&pos, vec_end (input), &bp, &blen, &name_len, \ + &value_len, &table); \ + len = vec_len (buf) - blen; \ + HTTP_TEST ((rv == HTTP2_ERROR_NO_ERROR && table.used == dt_size && \ + name_len == strlen (e_name) && value_len == strlen (e_value) && \ + !memcmp (buf, e_name, name_len) && \ + !memcmp (buf + name_len, e_value, value_len) && \ + vec_len (buf) == (blen + name_len + value_len) && \ + pos == vec_end (input) && bp == buf + name_len + value_len), \ + "%U is decoded as '%U: %U'", format_hex_bytes, input, \ + vec_len (input), format_http_bytes, buf, name_len, \ + format_http_bytes, buf + name_len, value_len); \ + vec_free (input); \ + vec_free (buf); + + /* C.2.1. Literal Header Field with Indexing */ + TEST ("\x40\x0A\x63\x75\x73\x74\x6F\x6D\x2D\x6B\x65\x79\x0D\x63\x75\x73\x74" + "\x6F\x6D\x2D\x68\x65\x61\x64\x65\x72", + "custom-key", "custom-header", 55); + /* C.2.2. Literal Header Field without Indexing */ + TEST ("\x04\x0C\x2F\x73\x61\x6D\x70\x6C\x65\x2F\x70\x61\x74\x68", ":path", + "/sample/path", 55); + /* C.2.3. Literal Header Field Never Indexed */ + TEST ("\x10\x08\x70\x61\x73\x73\x77\x6F\x72\x64\x06\x73\x65\x63\x72\x65\x74", + "password", "secret", 55); + /* C.2.4. Indexed Header Field */ + TEST ("\x82", ":method", "GET", 55); + TEST ("\xBE", "custom-key", "custom-header", 55); + /* Literal Header Field with Indexing - enough space in dynamic table */ + TEST ("\x41\x0F\x77\x77\x77\x2E\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63\x6F\x6D", + ":authority", "www.example.com", 112); + /* verification */ + TEST ("\xBE", ":authority", "www.example.com", 112); + TEST ("\xBF", "custom-key", "custom-header", 112); + /* Literal Header Field with Indexing - eviction */ + TEST ("\x58\x08\x6E\x6F\x2D\x63\x61\x63\x68\x65", "cache-control", + "no-cache", 110); + /* verification */ + TEST ("\xBE", "cache-control", "no-cache", 110); + TEST ("\xBF", ":authority", "www.example.com", 110); + /* Literal Header Field with Indexing - eviction */ + TEST ("\x40\x0A\x63\x75\x73\x74\x6F\x6D\x2D\x6B\x65\x79\x0D\x63\x75\x73\x74" + "\x6F\x6D\x2D\x68\x65\x61\x64\x65\x72", + "custom-key", "custom-header", 108); + /* verification */ + TEST ("\xBE", "custom-key", "custom-header", 108); + TEST ("\xBF", "cache-control", "no-cache", 108); + /* Literal Header Field with Indexing - eviction */ + TEST ("\x41\x0F\x77\x77\x77\x2E\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63\x6F\x6D", + ":authority", "www.example.com", 112); + /* verification */ + TEST ("\xBE", ":authority", "www.example.com", 112); + TEST ("\xBF", "custom-key", "custom-header", 112); + /* Literal Header Field with Indexing - eviction with reference */ + TEST ("\x7F\x00\x0C\x63\x75\x73\x74\x6F\x6D\x2D\x76\x61\x6C\x75\x65", + "custom-key", "custom-value", 111); + /* verification */ + TEST ("\xBE", "custom-key", "custom-value", 111); + TEST ("\xBF", ":authority", "www.example.com", 111); +#undef TEST + + _hpack_dynamic_table_free (&table); + + vlib_cli_output (vm, "hpack_parse_request"); + + int result; + /* C.3. Request Examples without Huffman Coding */ + _hpack_dynamic_table_init (&table, HPACK_DEFAULT_HEADER_TABLE_SIZE); + result = http_test_parse_request ( + http_token_lit ("\x82\x86\x84\x41\x0F\x77\x77\x77\x2E\x65\x78\x61" + "\x6D\x70\x6C\x65\x2E\x63\x6F\x6D"), + http_token_lit ( + "\x82\x86\x84\xBE\x58\x08\x6E\x6F\x2D\x63\x61\x63\x68\x65"), + http_token_lit ( + "\x82\x87\x85\xBF\x40\x0A\x63\x75\x73\x74\x6F\x6D\x2D\x6B" + "\x65\x79\x0C\x63\x75\x73\x74\x6F\x6D\x2D\x76\x61\x6C\x75\x65"), + &table); + _hpack_dynamic_table_free (&table); + HTTP_TEST ((result == 0), "request without Huffman Coding (result=%d)", + result); + /* C.4. Request Examples with Huffman Coding */ + _hpack_dynamic_table_init (&table, HPACK_DEFAULT_HEADER_TABLE_SIZE); + result = http_test_parse_request ( + http_token_lit ( + "\x82\x86\x84\x41\x8C\xF1\xE3\xC2\xE5\xF2\x3A\x6B\xA0\xAB\x90\xF4\xFF"), + http_token_lit ("\x82\x86\x84\xBE\x58\x86\xA8\xEB\x10\x64\x9C\xBF"), + http_token_lit ("\x82\x87\x85\xBF\x40\x88\x25\xA8\x49\xE9\x5B\xA9\x7D\x7F" + "\x89\x25\xA8\x49\xE9\x5B\xB8\xE8\xB4\xBF"), + &table); + _hpack_dynamic_table_free (&table); + HTTP_TEST ((result == 0), "request with Huffman Coding (result=%d)", result); + + vlib_cli_output (vm, "hpack_serialize_response"); + + hpack_response_control_data_t resp_cd; + u8 *server_name; + u8 *date; + + static void (*_hpack_serialize_response) ( + u8 * app_headers, u32 app_headers_len, + hpack_response_control_data_t * control_data, u8 * *dst); + + _hpack_serialize_response = + vlib_get_plugin_symbol ("http_plugin.so", "hpack_serialize_response"); + + server_name = format (0, "http unit tests"); + date = format (0, "Mon, 21 Oct 2013 20:13:21 GMT"); + + vec_validate (buf, 127); + vec_reset_length (buf); + resp_cd.sc = HTTP_STATUS_GATEWAY_TIMEOUT; + resp_cd.content_len = HPACK_ENCODER_SKIP_CONTENT_LEN; + resp_cd.server_name = server_name; + resp_cd.server_name_len = vec_len (server_name); + resp_cd.date = date; + resp_cd.date_len = vec_len (date); + u8 expected1[] = + "\x08\x03\x35\x30\x34\x0F\x27\x8B\x9D\x29\xAD\x4B\x6A\x32\x54\x49\x50\x94" + "\x7F\x0F\x12\x96\xD0\x7A\xBE\x94\x10\x54\xD4\x44\xA8\x20\x05\x95\x04\x0B" + "\x81\x66\xE0\x82\xA6\x2D\x1B\xFF"; + _hpack_serialize_response (0, 0, &resp_cd, &buf); + HTTP_TEST ((vec_len (buf) == (sizeof (expected1) - 1) && + !memcmp (buf, expected1, sizeof (expected1) - 1)), + "response encoded as %U", format_hex_bytes, buf, vec_len (buf)); + vec_reset_length (buf); + + resp_cd.sc = HTTP_STATUS_OK; + resp_cd.content_len = 1024; + http_headers_ctx_t headers; + u8 *headers_buf = 0; + vec_validate (headers_buf, 127); + http_init_headers_ctx (&headers, headers_buf, vec_len (headers_buf)); + http_add_header (&headers, HTTP_HEADER_CONTENT_TYPE, + http_token_lit ("text/plain")); + http_add_header (&headers, HTTP_HEADER_CACHE_STATUS, + http_token_lit ("ExampleCache; hit")); + http_add_custom_header (&headers, http_token_lit ("sandwich"), + http_token_lit ("spam")); + u8 expected2[] = + "\x88\x0F\x27\x8B\x9D\x29\xAD\x4B\x6A\x32\x54\x49\x50\x94\x7F\x0F\x12\x96" + "\xD0\x7A\xBE\x94\x10\x54\xD4\x44\xA8\x20\x05\x95\x04\x0B\x81\x66\xE0\x82" + "\xA6\x2D\x1B\xFF\x0F\x0D\x83\x08\x04\xD7\x0F\x10\x87\x49\x7C\xA5\x8A\xE8" + "\x19\xAA\x00\x88\x20\xC9\x39\x56\x42\x46\x9B\x51\x8D\xC1\xE4\x74\xD7\x41" + "\x6F\x0C\x93\x97\xED\x49\xCC\x9F\x00\x86\x40\xEA\x93\xC1\x89\x3F\x83\x45" + "\x63\xA7"; + _hpack_serialize_response (headers_buf, headers.tail_offset, &resp_cd, &buf); + HTTP_TEST ((vec_len (buf) == (sizeof (expected2) - 1) && + !memcmp (buf, expected2, sizeof (expected2) - 1)), + "response encoded as %U", format_hex_bytes, buf, vec_len (buf)); + vec_free (buf); + vec_free (headers_buf); + vec_free (server_name); + vec_free (date); + + return 0; +} + +static int +http_test_h2_frame (vlib_main_t *vm) +{ + static void (*_http2_frame_header_read) (u8 * src, + http2_frame_header_t * fh); + + _http2_frame_header_read = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_header_read"); + + vlib_cli_output (vm, "http2_frame_read_settings"); + + static http2_error_t (*_http2_frame_read_settings) ( + http2_conn_settings_t * settings, u8 * payload, u32 payload_len); + + _http2_frame_read_settings = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_read_settings"); + + http2_error_t rv; + http2_frame_header_t fh = { 0 }; + http2_conn_settings_t conn_settings = http2_default_conn_settings; + + u8 settings[] = { 0x0, 0x0, 0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x0, 0x3, 0x0, 0x0, 0x0, 0x64, 0x0, 0x4, 0x40, + 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0 }; + _http2_frame_header_read (settings, &fh); + HTTP_TEST ((fh.flags == 0 && fh.type == HTTP2_FRAME_TYPE_SETTINGS && + fh.stream_id == 0 && fh.length == 18), + "frame identified as SETTINGS"); + + rv = _http2_frame_read_settings ( + &conn_settings, settings + HTTP2_FRAME_HEADER_SIZE, fh.length); + HTTP_TEST ((rv == HTTP2_ERROR_NO_ERROR && + conn_settings.max_concurrent_streams == 100 && + conn_settings.initial_window_size == 1073741824 && + conn_settings.enable_push == 0), + "SETTINGS frame payload parsed") + + u8 settings_ack[] = { 0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0 }; + _http2_frame_header_read (settings_ack, &fh); + HTTP_TEST ((fh.flags == HTTP2_FRAME_FLAG_ACK && + fh.type == HTTP2_FRAME_TYPE_SETTINGS && fh.stream_id == 0 && + fh.length == 0), + "frame identified as SETTINGS ACK"); + + vlib_cli_output (vm, "http2_frame_write_settings_ack"); + + static void (*_http2_frame_write_settings_ack) (u8 * *dst); + + _http2_frame_write_settings_ack = vlib_get_plugin_symbol ( + "http_plugin.so", "http2_frame_write_settings_ack"); + + u8 *buf = 0; + + _http2_frame_write_settings_ack (&buf); + HTTP_TEST ((vec_len (buf) == sizeof (settings_ack)) && + !memcmp (buf, settings_ack, sizeof (settings_ack)), + "SETTINGS ACK frame written"); + vec_free (buf); + + vlib_cli_output (vm, "http2_frame_write_settings"); + + static void (*_http2_frame_write_settings) ( + http2_settings_entry_t * settings, u8 * *dst); + + _http2_frame_write_settings = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_write_settings"); + + http2_settings_entry_t *settings_list = 0; + vec_validate (settings_list, 2); + settings_list[0].identifier = HTTP2_SETTINGS_MAX_CONCURRENT_STREAMS; + settings_list[0].value = 100; + settings_list[1].identifier = HTTP2_SETTINGS_INITIAL_WINDOW_SIZE; + settings_list[1].value = 1073741824; + settings_list[2].identifier = HTTP2_SETTINGS_ENABLE_PUSH; + settings_list[2].value = 0; + + _http2_frame_write_settings (settings_list, &buf); + HTTP_TEST ((vec_len (buf) == sizeof (settings) && + !memcmp (buf, settings, sizeof (settings))), + "SETTINGS frame written"); + vec_free (settings_list); + vec_free (buf); + + vlib_cli_output (vm, "http2_frame_read_window_update"); + + static http2_error_t (*_http2_frame_read_window_update) ( + u32 * increment, u8 * payload, u32 payload_len); + + _http2_frame_read_window_update = vlib_get_plugin_symbol ( + "http_plugin.so", "http2_frame_read_window_update"); + + u32 win_increment; + u8 win_update[] = { 0x0, 0x0, 0x4, 0x8, 0x0, 0x0, 0x0, + 0x0, 0x0, 0x3f, 0xff, 0x0, 0x1 }; + _http2_frame_header_read (win_update, &fh); + HTTP_TEST ((fh.flags == 0 && fh.type == HTTP2_FRAME_TYPE_WINDOW_UPDATE && + fh.stream_id == 0 && fh.length == 4), + "frame identified as WINDOW_UPDATE"); + + rv = _http2_frame_read_window_update ( + &win_increment, win_update + HTTP2_FRAME_HEADER_SIZE, fh.length); + HTTP_TEST ((rv == HTTP2_ERROR_NO_ERROR && win_increment == 1073676289), + "WINDOW_UPDATE frame payload parsed") + + vlib_cli_output (vm, "http2_frame_write_window_update"); + + static void (*_http2_frame_write_window_update) (u32 increment, + u32 stream_id, u8 * *dst); + + _http2_frame_write_window_update = vlib_get_plugin_symbol ( + "http_plugin.so", "http2_frame_write_window_update"); + + _http2_frame_write_window_update (1073676289, 0, &buf); + HTTP_TEST ((vec_len (buf) == sizeof (win_update) && + !memcmp (buf, win_update, sizeof (win_update))), + "WINDOW_UPDATE frame written"); + vec_free (buf); + + vlib_cli_output (vm, "http2_frame_read_rst_stream"); + + static http2_error_t (*_http2_frame_read_rst_stream) ( + u32 * error_code, u8 * payload, u32 payload_len); + + _http2_frame_read_rst_stream = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_read_rst_stream"); + + u32 error_code; + u8 rst_stream[] = { 0x0, 0x0, 0x4, 0x3, 0x0, 0x0, 0x0, + 0x0, 0x5, 0x0, 0x0, 0x0, 0x01 }; + _http2_frame_header_read (rst_stream, &fh); + HTTP_TEST ((fh.flags == 0 && fh.type == HTTP2_FRAME_TYPE_RST_STREAM && + fh.stream_id == 5 && fh.length == 4), + "frame identified as RST_STREAM"); + + rv = _http2_frame_read_rst_stream ( + &error_code, rst_stream + HTTP2_FRAME_HEADER_SIZE, fh.length); + HTTP_TEST ( + (rv == HTTP2_ERROR_NO_ERROR && error_code == HTTP2_ERROR_PROTOCOL_ERROR), + "RST_STREAM frame payload parsed") + + vlib_cli_output (vm, "http2_frame_write_rst_stream"); + + static void (*_http2_frame_write_rst_stream) (u32 increment, u32 stream_id, + u8 * *dst); + + _http2_frame_write_rst_stream = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_write_rst_stream"); + + _http2_frame_write_rst_stream (HTTP2_ERROR_PROTOCOL_ERROR, 5, &buf); + HTTP_TEST ((vec_len (buf) == sizeof (rst_stream) && + !memcmp (buf, rst_stream, sizeof (rst_stream))), + "RST_STREAM frame written"); + vec_free (buf); + + vlib_cli_output (vm, "http2_frame_read_goaway"); + + static http2_error_t (*_http2_frame_read_goaway) ( + u32 * error_code, u32 * last_stream_id, u8 * payload, u32 payload_len); + + _http2_frame_read_goaway = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_read_goaway"); + + u32 last_stream_id; + u8 goaway[] = { 0x0, 0x0, 0x8, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2 }; + + _http2_frame_header_read (goaway, &fh); + HTTP_TEST ((fh.flags == 0 && fh.type == HTTP2_FRAME_TYPE_GOAWAY && + fh.stream_id == 0 && fh.length == 8), + "frame identified as GOAWAY"); + + rv = _http2_frame_read_goaway (&error_code, &last_stream_id, + goaway + HTTP2_FRAME_HEADER_SIZE, fh.length); + HTTP_TEST ((rv == HTTP2_ERROR_NO_ERROR && + error_code == HTTP2_ERROR_INTERNAL_ERROR && last_stream_id == 5), + "GOAWAY frame payload parsed") + + vlib_cli_output (vm, "http2_frame_write_goaway"); + + static void (*_http2_frame_write_goaway) (http2_error_t error_code, + u32 last_stream_id, u8 * *dst); + + _http2_frame_write_goaway = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_write_goaway"); + + _http2_frame_write_goaway (HTTP2_ERROR_INTERNAL_ERROR, 5, &buf); + HTTP_TEST ((vec_len (buf) == sizeof (goaway) && + !memcmp (buf, goaway, sizeof (goaway))), + "GOAWAY frame written"); + vec_free (buf); + + vlib_cli_output (vm, "http2_frame_read_headers"); + + static http2_error_t (*_http2_frame_read_headers) ( + u8 * *headers, u32 * headers_len, u8 * payload, u32 payload_len, u8 flags); + + _http2_frame_read_headers = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_read_headers"); + + u8 *h; + u32 h_len; + u8 headers[] = { 0x0, 0x0, 0x28, 0x1, 0x5, 0x0, 0x0, 0x0, 0x3, 0x3f, + 0xe1, 0x1f, 0x82, 0x4, 0x88, 0x62, 0x7b, 0x69, 0x1d, 0x48, + 0x5d, 0x3e, 0x53, 0x86, 0x41, 0x88, 0xaa, 0x69, 0xd2, 0x9a, + 0xc4, 0xb9, 0xec, 0x9b, 0x7a, 0x88, 0x25, 0xb6, 0x50, 0xc3, + 0xab, 0xb8, 0x15, 0xc1, 0x53, 0x3, 0x2a, 0x2f, 0x2a }; + + _http2_frame_header_read (headers, &fh); + HTTP_TEST ((fh.flags == + (HTTP2_FRAME_FLAG_END_HEADERS | HTTP2_FRAME_FLAG_END_STREAM) && + fh.type == HTTP2_FRAME_TYPE_HEADERS && fh.stream_id == 3 && + fh.length == 40), + "frame identified as HEADERS"); + + rv = _http2_frame_read_headers ( + &h, &h_len, headers + HTTP2_FRAME_HEADER_SIZE, fh.length, fh.flags); + HTTP_TEST ((rv == HTTP2_ERROR_NO_ERROR && h_len == 40 && + *h == headers[HTTP2_FRAME_HEADER_SIZE]), + "HEADERS frame payload parsed") + + vlib_cli_output (vm, "http2_frame_write_headers_header"); + + static void (*_http2_frame_write_headers_header) ( + u32 headers_len, u32 stream_id, u8 flags, u8 * dst); + + _http2_frame_write_headers_header = vlib_get_plugin_symbol ( + "http_plugin.so", "http2_frame_write_headers_header"); + + u8 *p = http2_frame_header_alloc (&buf); + _http2_frame_write_headers_header ( + 40, 3, HTTP2_FRAME_FLAG_END_HEADERS | HTTP2_FRAME_FLAG_END_STREAM, p); + HTTP_TEST ((vec_len (buf) == HTTP2_FRAME_HEADER_SIZE && + !memcmp (buf, headers, HTTP2_FRAME_HEADER_SIZE)), + "HEADERS frame header written"); + vec_free (buf); + + vlib_cli_output (vm, "http2_frame_read_data"); + + static http2_error_t (*_http2_frame_read_data) ( + u8 * *data, u32 * data_len, u8 * payload, u32 payload_len, u8 flags); + + _http2_frame_read_data = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_read_data"); + + u8 *d; + u32 d_len; + u8 data[] = { 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, + 0x6e, 0x6f, 0x74, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64 }; + + _http2_frame_header_read (data, &fh); + HTTP_TEST ((fh.flags == HTTP2_FRAME_FLAG_END_STREAM && + fh.type == HTTP2_FRAME_TYPE_DATA && fh.stream_id == 3 && + fh.length == 9), + "frame identified as DATA"); + + rv = _http2_frame_read_data (&d, &d_len, data + HTTP2_FRAME_HEADER_SIZE, + fh.length, fh.flags); + HTTP_TEST ((rv == HTTP2_ERROR_NO_ERROR && d_len == 9 && + *d == data[HTTP2_FRAME_HEADER_SIZE]), + "DATA frame payload parsed") + + vlib_cli_output (vm, "http2_frame_write_data_header"); + + static void (*_http2_frame_write_data_header) ( + u32 headers_len, u32 stream_id, u8 flags, u8 * dst); + + _http2_frame_write_data_header = + vlib_get_plugin_symbol ("http_plugin.so", "http2_frame_write_data_header"); + + p = http2_frame_header_alloc (&buf); + _http2_frame_write_data_header (9, 3, HTTP2_FRAME_FLAG_END_STREAM, p); + HTTP_TEST ((vec_len (buf) == HTTP2_FRAME_HEADER_SIZE && + !memcmp (buf, data, HTTP2_FRAME_HEADER_SIZE)), + "DATA frame header written"); + vec_free (buf); + + return 0; +} + static clib_error_t * test_http_command_fn (vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd) @@ -550,6 +1317,10 @@ test_http_command_fn (vlib_main_t *vm, unformat_input_t *input, res = http_test_http_token_is_case (vm); else if (unformat (input, "header-table")) res = http_test_http_header_table (vm); + else if (unformat (input, "hpack")) + res = http_test_hpack (vm); + else if (unformat (input, "h2-frame")) + res = http_test_h2_frame (vm); else if (unformat (input, "all")) { if ((res = http_test_parse_authority (vm))) @@ -562,6 +1333,10 @@ test_http_command_fn (vlib_main_t *vm, unformat_input_t *input, goto done; if ((res = http_test_http_header_table (vm))) goto done; + if ((res = http_test_hpack (vm))) + goto done; + if ((res = http_test_h2_frame (vm))) + goto done; } else break; diff --git a/src/plugins/http_static/static_server.c b/src/plugins/http_static/static_server.c index 074416873e3..d7958fd3f1f 100644 --- a/src/plugins/http_static/static_server.c +++ b/src/plugins/http_static/static_server.c @@ -27,9 +27,41 @@ /*? %%clicmd:group_label Static HTTP Server %% ?*/ #define HSS_FIFO_THRESH (16 << 10) - +#define HSS_HEADER_BUF_MAX_SIZE 16192 hss_main_t hss_main; +static int +hss_add_header (hss_session_t *hs, http_header_name_t name, const char *value, + uword value_len) +{ + u32 needed_size = 0; + while (http_add_header (&hs->resp_headers, name, value, value_len) == -1) + { + if (needed_size) + { + http_truncate_headers_list (&hs->resp_headers); + hs->data_len = 0; + return -1; + } + else + needed_size = hs->resp_headers.tail_offset + + sizeof (http_app_header_t) + value_len; + if (needed_size < HSS_HEADER_BUF_MAX_SIZE) + { + vec_resize (hs->headers_buf, sizeof (http_app_header_t) + value_len); + hs->resp_headers.len = needed_size; + hs->resp_headers.buf = hs->headers_buf; + } + else + { + http_truncate_headers_list (&hs->resp_headers); + hs->data_len = 0; + return -1; + } + } + return 0; +} + static hss_session_t * hss_session_alloc (u32 thread_index) { @@ -175,8 +207,9 @@ hss_session_send_data (hss_url_handler_args_t *args) /* Set content type only if we have some response data */ if (hs->data_len) - http_add_header (&hs->resp_headers, HTTP_HEADER_CONTENT_TYPE, - http_content_type_token (args->ct)); + if (hss_add_header (hs, HTTP_HEADER_CONTENT_TYPE, + http_content_type_token (args->ct))) + args->sc = HTTP_STATUS_INTERNAL_ERROR; start_send_data (hs, args->sc); } @@ -305,8 +338,9 @@ try_url_handler (hss_main_t *hsm, hss_session_t *hs, http_req_method_t rt, /* Set content type only if we have some response data */ if (hs->data_len) - http_add_header (&hs->resp_headers, HTTP_HEADER_CONTENT_TYPE, - http_content_type_token (args.ct)); + if (hss_add_header (hs, HTTP_HEADER_CONTENT_TYPE, + http_content_type_token (args.ct))) + sc = HTTP_STATUS_INTERNAL_ERROR; start_send_data (hs, sc); @@ -383,8 +417,10 @@ try_index_file (hss_main_t *hsm, hss_session_t *hs, u8 *path) vec_free (port_str); - http_add_header (&hs->resp_headers, HTTP_HEADER_LOCATION, - (const char *) redirect, vec_len (redirect)); + if (hss_add_header (hs, HTTP_HEADER_LOCATION, (const char *) redirect, + vec_len (redirect))) + return HTTP_STATUS_INTERNAL_ERROR; + vec_free (redirect); hs->data_len = 0; hs->free_data = 1; @@ -406,8 +442,8 @@ try_file_handler (hss_main_t *hsm, hss_session_t *hs, http_req_method_t rt, if (!hsm->www_root) return -1; - /* Remove dot segments to prevent path traversal */ - sanitized_path = http_path_remove_dot_segments (target); + /* Sanitize received path */ + sanitized_path = http_path_sanitize (target); /* * Construct the file to open @@ -463,13 +499,16 @@ try_file_handler (hss_main_t *hsm, hss_session_t *hs, http_req_method_t rt, * Last-Modified */ type = content_type_from_request (target); - http_add_header (&hs->resp_headers, HTTP_HEADER_CONTENT_TYPE, - http_content_type_token (type)); - http_add_header (&hs->resp_headers, HTTP_HEADER_CACHE_CONTROL, - (const char *) hsm->max_age_formatted, - vec_len (hsm->max_age_formatted)); - http_add_header (&hs->resp_headers, HTTP_HEADER_LAST_MODIFIED, - (const char *) last_modified, vec_len (last_modified)); + if (hss_add_header (hs, HTTP_HEADER_CONTENT_TYPE, + http_content_type_token (type)) || + hss_add_header (hs, HTTP_HEADER_CACHE_CONTROL, + (const char *) hsm->max_age_formatted, + vec_len (hsm->max_age_formatted)) || + hss_add_header (hs, HTTP_HEADER_LAST_MODIFIED, + (const char *) last_modified, vec_len (last_modified))) + { + sc = HTTP_STATUS_INTERNAL_ERROR; + } done: vec_free (sanitized_path); @@ -510,6 +549,7 @@ hss_ts_rx_callback (session_t *ts) if (hs->free_data) vec_free (hs->data); hs->data = 0; + hs->data_len = 0; http_init_headers_ctx (&hs->resp_headers, hs->headers_buf, vec_len (hs->headers_buf)); @@ -520,9 +560,10 @@ hss_ts_rx_callback (session_t *ts) if (msg.type != HTTP_MSG_REQUEST || (msg.method_type != HTTP_REQ_GET && msg.method_type != HTTP_REQ_POST)) { - http_add_header (&hs->resp_headers, HTTP_HEADER_ALLOW, - http_token_lit ("GET, POST")); - start_send_data (hs, HTTP_STATUS_METHOD_NOT_ALLOWED); + if (hss_add_header (hs, HTTP_HEADER_ALLOW, http_token_lit ("GET, POST"))) + start_send_data (hs, HTTP_STATUS_INTERNAL_ERROR); + else + start_send_data (hs, HTTP_STATUS_METHOD_NOT_ALLOWED); goto err_done; } diff --git a/src/plugins/ioam/export-vxlan-gpe/vxlan_gpe_ioam_export.c b/src/plugins/ioam/export-vxlan-gpe/vxlan_gpe_ioam_export.c index 1606f72224f..ca6483b3329 100644 --- a/src/plugins/ioam/export-vxlan-gpe/vxlan_gpe_ioam_export.c +++ b/src/plugins/ioam/export-vxlan-gpe/vxlan_gpe_ioam_export.c @@ -21,7 +21,7 @@ #include <vnet/vnet.h> #include <vnet/plugin/plugin.h> #include <ioam/export-common/ioam_export.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> #include <vlibapi/api.h> #include <vlibmemory/api.h> diff --git a/src/plugins/ioam/export-vxlan-gpe/vxlan_gpe_node.c b/src/plugins/ioam/export-vxlan-gpe/vxlan_gpe_node.c index 839fd80b443..17084767c1e 100644 --- a/src/plugins/ioam/export-vxlan-gpe/vxlan_gpe_node.c +++ b/src/plugins/ioam/export-vxlan-gpe/vxlan_gpe_node.c @@ -16,8 +16,8 @@ #include <vnet/vnet.h> #include <vppinfra/error.h> #include <vnet/ip/ip.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> -#include <vnet/vxlan-gpe/vxlan_gpe_packet.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe_packet.h> #include <ioam/export-common/ioam_export.h> typedef struct diff --git a/src/plugins/ioam/lib-vxlan-gpe/ioam_decap.c b/src/plugins/ioam/lib-vxlan-gpe/ioam_decap.c index 801faa98066..d8d52e9f0a1 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/ioam_decap.c +++ b/src/plugins/ioam/lib-vxlan-gpe/ioam_decap.c @@ -17,8 +17,7 @@ #include <vnet/vnet.h> #include <vnet/ip/ip.h> #include <vnet/ethernet/ethernet.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam_packet.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam_util.h> @@ -68,8 +67,8 @@ vxlan_gpe_decap_ioam (vlib_main_t * vm, vlib_frame_t * from_frame, u8 is_ipv6) { u32 n_left_from, next_index, *from, *to_next; - vxlan_gpe_main_t *ngm = &vxlan_gpe_main; vxlan_gpe_ioam_main_t *hm = &vxlan_gpe_ioam_main; + vxlan_gpe_main_t *ngm = hm->gpe_main; from = vlib_frame_vector_args (from_frame); n_left_from = from_frame->n_vectors; diff --git a/src/plugins/ioam/lib-vxlan-gpe/ioam_encap.c b/src/plugins/ioam/lib-vxlan-gpe/ioam_encap.c index de375df4f7c..9c742d8c293 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/ioam_encap.c +++ b/src/plugins/ioam/lib-vxlan-gpe/ioam_encap.c @@ -17,7 +17,7 @@ #include <vnet/vnet.h> #include <vnet/ip/ip.h> #include <vnet/ethernet/ethernet.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam_packet.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam_util.h> @@ -71,7 +71,8 @@ vxlan_gpe_encap_ioam_v4 (vlib_main_t * vm, vlib_frame_t * from_frame) { u32 n_left_from, next_index, *from, *to_next; - vxlan_gpe_main_t *ngm = &vxlan_gpe_main; + vxlan_gpe_ioam_main_t *sm = &vxlan_gpe_ioam_main; + vxlan_gpe_main_t *ngm = sm->gpe_main; from = vlib_frame_vector_args (from_frame); n_left_from = from_frame->n_vectors; diff --git a/src/plugins/ioam/lib-vxlan-gpe/ioam_pop.c b/src/plugins/ioam/lib-vxlan-gpe/ioam_pop.c index 2fa0aa29450..a80662b9d12 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/ioam_pop.c +++ b/src/plugins/ioam/lib-vxlan-gpe/ioam_pop.c @@ -17,7 +17,7 @@ #include <vnet/vnet.h> #include <vnet/ip/ip.h> #include <vnet/ethernet/ethernet.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h> /* Statistics (not really errors) */ @@ -231,7 +231,8 @@ vxlan_gpe_pop_ioam (vlib_main_t * vm, vlib_frame_t * from_frame, u8 is_ipv6) { u32 n_left_from, next_index, *from, *to_next; - vxlan_gpe_main_t *ngm = &vxlan_gpe_main; + vxlan_gpe_ioam_main_t *sm = &vxlan_gpe_ioam_main; + vxlan_gpe_main_t *ngm = sm->gpe_main; from = vlib_frame_vector_args (from_frame); n_left_from = from_frame->n_vectors; diff --git a/src/plugins/ioam/lib-vxlan-gpe/ioam_transit.c b/src/plugins/ioam/lib-vxlan-gpe/ioam_transit.c index e3c82725e26..02233cf9841 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/ioam_transit.c +++ b/src/plugins/ioam/lib-vxlan-gpe/ioam_transit.c @@ -18,7 +18,7 @@ #include <vnet/ip/ip.h> #include <vnet/udp/udp_local.h> #include <vnet/ethernet/ethernet.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam_packet.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam_util.h> diff --git a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_api.c b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_api.c index d61832d975a..6de1760b6b7 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_api.c +++ b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_api.c @@ -80,9 +80,9 @@ static void vl_api_vxlan_gpe_ioam_vni_enable_t_handler clib_error_t *error; vxlan4_gpe_tunnel_key_t key4; uword *p = NULL; - vxlan_gpe_main_t *gm = &vxlan_gpe_main; vxlan_gpe_tunnel_t *t = 0; vxlan_gpe_ioam_main_t *hm = &vxlan_gpe_ioam_main; + vxlan_gpe_main_t *gm = hm->gpe_main; u32 vni; @@ -130,7 +130,8 @@ static void vl_api_vxlan_gpe_ioam_vni_disable_t_handler clib_error_t *error; vxlan4_gpe_tunnel_key_t key4; uword *p = NULL; - vxlan_gpe_main_t *gm = &vxlan_gpe_main; + vxlan_gpe_ioam_main_t *hm = &vxlan_gpe_ioam_main; + vxlan_gpe_main_t *gm = hm->gpe_main; vxlan_gpe_tunnel_t *t = 0; u32 vni; @@ -214,6 +215,13 @@ ioam_vxlan_gpe_init (vlib_main_t * vm) vlib_node_t *vxlan_gpe_decap_node = NULL; uword next_node = 0; + sm->gpe_main = + vlib_get_plugin_symbol ("vxlan-gpe_plugin.so", "vxlan_gpe_main"); + if (sm->gpe_main == 0) + { + return clib_error_return (0, "vxlan-gpe_plugin.so is not loaded"); + } + sm->vlib_main = vm; sm->vnet_main = vnet_get_main (); sm->unix_time_0 = (u32) time (0); /* Store starting time */ @@ -231,7 +239,7 @@ ioam_vxlan_gpe_init (vlib_main_t * vm) vlib_get_node_by_name (vm, (u8 *) "vxlan4-gpe-input"); next_node = vlib_node_add_next (vm, vxlan_gpe_decap_node->index, decap_node_index); - vxlan_gpe_register_decap_protocol (VXLAN_GPE_PROTOCOL_IOAM, next_node); + sm->gpe_main->register_decap_protocol (VXLAN_GPE_PROTOCOL_IOAM, next_node); vec_new (vxlan_gpe_ioam_sw_interface_t, pool_elts (sm->sw_interfaces)); sm->dst_by_ip4 = hash_create_mem (0, sizeof (fib_prefix_t), sizeof (uword)); @@ -243,7 +251,9 @@ ioam_vxlan_gpe_init (vlib_main_t * vm) return 0; } -VLIB_INIT_FUNCTION (ioam_vxlan_gpe_init); +VLIB_INIT_FUNCTION (ioam_vxlan_gpe_init) = { + .runs_after = VLIB_INITS ("vxlan_gpe_init"), +}; /* * fd.io coding-style-patch-verification: ON diff --git a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam.c b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam.c index 327afc3fb61..f83c6e1ecc3 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam.c +++ b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam.c @@ -12,8 +12,8 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -#include <vnet/vxlan-gpe/vxlan_gpe.h> -#include <vnet/vxlan-gpe/vxlan_gpe_packet.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe_packet.h> #include <vnet/ip/format.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h> #include <vnet/dpo/load_balance.h> @@ -423,7 +423,7 @@ vxlan_gpe_set_ioam_rewrite_command_fn (vlib_main_t * vxlan4_gpe_tunnel_key_t key4; vxlan6_gpe_tunnel_key_t key6; uword *p; - vxlan_gpe_main_t *gm = &vxlan_gpe_main; + vxlan_gpe_main_t *gm = hm->gpe_main; vxlan_gpe_tunnel_t *t = 0; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { diff --git a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h index 0711b87abbe..f9374c9bb95 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h +++ b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam.h @@ -15,12 +15,11 @@ #ifndef __included_vxlan_gpe_ioam_h__ #define __included_vxlan_gpe_ioam_h__ -#include <vnet/vxlan-gpe/vxlan_gpe.h> -#include <vnet/vxlan-gpe/vxlan_gpe_packet.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe_packet.h> #include <ioam/lib-vxlan-gpe/vxlan_gpe_ioam_packet.h> #include <vnet/ip/ip.h> - typedef struct vxlan_gpe_sw_interface_ { u32 sw_if_index; @@ -100,7 +99,8 @@ typedef struct vxlan_gpe_ioam_main_ vlib_main_t *vlib_main; /** State convenience vnet_main_t */ vnet_main_t *vnet_main; - + /** State convenience vxlan_gpe_main_t */ + vxlan_gpe_main_t *gpe_main; } vxlan_gpe_ioam_main_t; extern vxlan_gpe_ioam_main_t vxlan_gpe_ioam_main; diff --git a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_packet.h b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_packet.h index a7ef859ec58..515529ce794 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_packet.h +++ b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_packet.h @@ -15,8 +15,8 @@ #ifndef __included_vxlan_gpe_ioam_packet_h__ #define __included_vxlan_gpe_ioam_packet_h__ -#include <vnet/vxlan-gpe/vxlan_gpe.h> -#include <vnet/vxlan-gpe/vxlan_gpe_packet.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe_packet.h> #include <vnet/ip/ip.h> diff --git a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_trace.c b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_trace.c index 9c783c747d0..9b1b8b824ff 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_trace.c +++ b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_trace.c @@ -16,8 +16,8 @@ #include <vnet/vnet.h> #include <vppinfra/error.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> -#include <vnet/vxlan-gpe/vxlan_gpe_packet.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe_packet.h> #include <vppinfra/hash.h> #include <vppinfra/error.h> diff --git a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_util.h b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_util.h index c0ad8d9d03a..db7fd5651b1 100644 --- a/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_util.h +++ b/src/plugins/ioam/lib-vxlan-gpe/vxlan_gpe_ioam_util.h @@ -15,8 +15,8 @@ #ifndef __included_vxlan_gpe_ioam_util_h__ #define __included_vxlan_gpe_ioam_util_h__ -#include <vnet/vxlan-gpe/vxlan_gpe.h> -#include <vnet/vxlan-gpe/vxlan_gpe_packet.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe_packet.h> #include <vnet/ip/ip.h> diff --git a/src/plugins/linux-cp/lcp.api b/src/plugins/linux-cp/lcp.api index e7eaa5a3669..8b0fdb5eb53 100644 --- a/src/plugins/linux-cp/lcp.api +++ b/src/plugins/linux-cp/lcp.api @@ -177,6 +177,42 @@ autoendian define lcp_itf_pair_details option in_progress; }; +/** \brief Enable linux-cp-punt-xc for a given ethertype + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param ethertype - the ethertype to enable +*/ +autoreply define lcp_ethertype_enable +{ + u32 client_index; + u32 context; + u16 ethertype; +}; + +/** \brief Get the enabled ethertypes for linux-cp-punt-xc + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request +*/ +define lcp_ethertype_get +{ + u32 client_index; + u32 context; +}; + +/** \brief Reply to get the enabled ethertypes for linux-cp-punt-xc + @param context - sender context, to match reply w/ request + @param retval - return code for the request + @param count - number of enabled ethertypes + @param ethertypes - array of enabled ethertypes +*/ +define lcp_ethertype_get_reply +{ + u32 context; + i32 retval; + u16 count; + u16 ethertypes[count]; +}; + service { rpc lcp_itf_pair_get returns lcp_itf_pair_get_reply stream lcp_itf_pair_details; diff --git a/src/plugins/linux-cp/lcp_api.c b/src/plugins/linux-cp/lcp_api.c index 74421230e9d..0db502988d7 100644 --- a/src/plugins/linux-cp/lcp_api.c +++ b/src/plugins/linux-cp/lcp_api.c @@ -280,6 +280,40 @@ vl_api_lcp_itf_pair_replace_end_t_handler ( REPLY_MACRO (VL_API_LCP_ITF_PAIR_REPLACE_END_REPLY); } +static void +vl_api_lcp_ethertype_enable_t_handler (vl_api_lcp_ethertype_enable_t *mp) +{ + vl_api_lcp_ethertype_enable_reply_t *rmp; + int rv; + + rv = lcp_ethertype_enable (mp->ethertype); + + REPLY_MACRO (VL_API_LCP_ETHERTYPE_ENABLE_REPLY); +} + +static void +vl_api_lcp_ethertype_get_t_handler (vl_api_lcp_ethertype_get_t *mp) +{ + vl_api_lcp_ethertype_get_reply_t *rmp; + ethernet_type_t *ethertypes = vec_new (ethernet_type_t, 0); + u16 count = 0; + int rv = 0; + + rv = lcp_ethertype_get_enabled (ðertypes); + if (!rv) + count = vec_len (ethertypes); + + REPLY_MACRO3 (VL_API_LCP_ETHERTYPE_GET_REPLY, sizeof (u16) * count, ({ + rmp->count = htons (count); + for (int i = 0; i < count; i++) + { + rmp->ethertypes[i] = htons (ethertypes[i]); + } + })); + + vec_free (ethertypes); +} + /* * Set up the API message handling tables */ diff --git a/src/plugins/linux-cp/lcp_cli.c b/src/plugins/linux-cp/lcp_cli.c index 0dcf600b301..e89afd2a753 100644 --- a/src/plugins/linux-cp/lcp_cli.c +++ b/src/plugins/linux-cp/lcp_cli.c @@ -337,6 +337,62 @@ VLIB_CLI_COMMAND (lcp_itf_pair_show_cmd_node, static) = { .is_mp_safe = 1, }; +static clib_error_t * +lcp_ethertype_enable_cmd (vlib_main_t *vm, unformat_input_t *input, + vlib_cli_command_t *cmd) +{ + ethernet_type_t ethertype; + int rv; + + if (!unformat (input, "%U", unformat_ethernet_type_host_byte_order, + ðertype)) + return clib_error_return (0, "Invalid ethertype"); + + rv = lcp_ethertype_enable (ethertype); + if (rv) + return clib_error_return (0, "Failed to enable ethertype (%d)", rv); + + return 0; +} + +VLIB_CLI_COMMAND (lcp_ethertype_enable_command, static) = { + .path = "lcp ethertype enable", + .short_help = + "lcp ethertype enable (<hex_ethertype_num>|<uc_ethertype_name>)", + .function = lcp_ethertype_enable_cmd, +}; + +static clib_error_t * +lcp_ethertype_show_cmd (vlib_main_t *vm, unformat_input_t *input, + vlib_cli_command_t *cmd) +{ + ethernet_type_t *ethertypes = vec_new (ethernet_type_t, 0); + ethernet_type_t *etype; + int rv; + + rv = lcp_ethertype_get_enabled (ðertypes); + if (rv) + { + vec_free (ethertypes); + return clib_error_return (0, "Failed to get enabled ethertypes (%d)", + rv); + } + + vec_foreach (etype, ethertypes) + { + vlib_cli_output (vm, "0x%04x", *etype); + } + + vec_free (ethertypes); + return 0; +} + +VLIB_CLI_COMMAND (lcp_ethertype_show_command, static) = { + .path = "show lcp ethertype", + .short_help = "show lcp ethertype", + .function = lcp_ethertype_show_cmd, +}; + clib_error_t * lcp_cli_init (vlib_main_t *vm) { diff --git a/src/plugins/linux-cp/lcp_interface.c b/src/plugins/linux-cp/lcp_interface.c index 9a6b9b11be5..31864f791af 100644 --- a/src/plugins/linux-cp/lcp_interface.c +++ b/src/plugins/linux-cp/lcp_interface.c @@ -1230,6 +1230,53 @@ lcp_itf_pair_link_up_down (vnet_main_t *vnm, u32 hw_if_index, u32 flags) return 0; } +int +lcp_ethertype_enable (ethernet_type_t ethertype) +{ + ethernet_main_t *em = ðernet_main; + ethernet_type_info_t *eti; + vlib_main_t *vm = vlib_get_main (); + vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) "linux-cp-punt-xc"); + + if (!node) + return VNET_API_ERROR_UNIMPLEMENTED; + + eti = ethernet_get_type_info (em, ethertype); + if (!eti) + return VNET_API_ERROR_INVALID_VALUE; + + if (eti->node_index != ~0 && eti->node_index != node->index) + return VNET_API_ERROR_INVALID_REGISTRATION; + + ethernet_register_input_type (vm, ethertype, node->index); + return 0; +} + +int +lcp_ethertype_get_enabled (ethernet_type_t **ethertypes_vec) +{ + ethernet_main_t *em = ðernet_main; + ethernet_type_info_t *eti; + vlib_main_t *vm = vlib_get_main (); + vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) "linux-cp-punt-xc"); + + if (!ethertypes_vec) + return VNET_API_ERROR_INVALID_ARGUMENT; + + if (!node) + return VNET_API_ERROR_UNIMPLEMENTED; + + vec_foreach (eti, em->type_infos) + { + if (eti->node_index == node->index) + { + vec_add1 (*ethertypes_vec, eti->type); + } + } + + return 0; +} + VNET_HW_INTERFACE_LINK_UP_DOWN_FUNCTION (lcp_itf_pair_link_up_down); static clib_error_t * diff --git a/src/plugins/linux-cp/lcp_interface.h b/src/plugins/linux-cp/lcp_interface.h index cfcd3925a15..8cf6d3f4da1 100644 --- a/src/plugins/linux-cp/lcp_interface.h +++ b/src/plugins/linux-cp/lcp_interface.h @@ -18,6 +18,7 @@ #include <vnet/dpo/dpo.h> #include <vnet/adj/adj.h> #include <vnet/ip/ip_types.h> +#include <vnet/ethernet/ethernet.h> #include <plugins/linux-cp/lcp.h> @@ -198,6 +199,18 @@ void lcp_itf_pair_sync_state (lcp_itf_pair_t *lip); void lcp_itf_pair_sync_state_hw (vnet_hw_interface_t *hi); void lcp_itf_pair_sync_state_all (); +/** + * Enable linux-cp-punt-xc for a given ethertype. + * @param ethertype - ethertype to enable + */ +int lcp_ethertype_enable (ethernet_type_t ethertype); + +/** + * Get the list of ethertypes enabled for linux-cp-punt-xc. + * @param ethertypes_vec - pointer to a vector to store the list of ethertypes + */ +int lcp_ethertype_get_enabled (ethernet_type_t **ethertypes_vec); + /* * fd.io coding-style-patch-verification: ON * diff --git a/src/plugins/linux-cp/lcp_node.c b/src/plugins/linux-cp/lcp_node.c index 241cc5e4bff..9fa1aa5bd66 100644 --- a/src/plugins/linux-cp/lcp_node.c +++ b/src/plugins/linux-cp/lcp_node.c @@ -39,40 +39,51 @@ typedef enum { -#define _(sym, str) LIP_PUNT_NEXT_##sym, +#define _(sym, str) LIP_PUNT_XC_NEXT_##sym, foreach_lip_punt #undef _ - LIP_PUNT_N_NEXT, -} lip_punt_next_t; + LIP_PUNT_XC_N_NEXT, +} lip_punt_xc_next_t; -typedef struct lip_punt_trace_t_ +typedef struct lip_punt_xc_trace_t_ { + bool is_xc; u32 phy_sw_if_index; u32 host_sw_if_index; -} lip_punt_trace_t; +} lip_punt_xc_trace_t; /* packet trace format function */ static u8 * -format_lip_punt_trace (u8 *s, va_list *args) +format_lip_punt_xc_trace (u8 *s, va_list *args) { CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); - lip_punt_trace_t *t = va_arg (*args, lip_punt_trace_t *); + lip_punt_xc_trace_t *t = va_arg (*args, lip_punt_xc_trace_t *); - s = - format (s, "lip-punt: %u -> %u", t->phy_sw_if_index, t->host_sw_if_index); + if (t->is_xc) + { + s = format (s, "lip-xc: %u -> %u", t->host_sw_if_index, + t->phy_sw_if_index); + } + else + { + s = format (s, "lip-punt: %u -> %u", t->phy_sw_if_index, + t->host_sw_if_index); + } return s; } /** * Pass punted packets from the PHY to the HOST. + * Conditionally x-connect packets from the HOST to the PHY. */ -VLIB_NODE_FN (lip_punt_node) -(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame) +static_always_inline u32 +lip_punt_xc_inline (vlib_main_t *vm, vlib_node_runtime_t *node, + vlib_frame_t *frame, bool check_xc) { u32 n_left_from, *from, *to_next, n_left_to_next; - lip_punt_next_t next_index; + lip_punt_xc_next_t next_index; next_index = node->cached_next_index; n_left_from = frame->n_vectors; @@ -89,6 +100,7 @@ VLIB_NODE_FN (lip_punt_node) u32 next0 = ~0; u32 bi0, lipi0; u32 sw_if_index0; + bool is_xc0 = 0; u8 len0; bi0 = to_next[0] = from[0]; @@ -97,18 +109,33 @@ VLIB_NODE_FN (lip_punt_node) to_next += 1; n_left_from -= 1; n_left_to_next -= 1; - next0 = LIP_PUNT_NEXT_DROP; + next0 = LIP_PUNT_XC_NEXT_DROP; b0 = vlib_get_buffer (vm, bi0); sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX]; lipi0 = lcp_itf_pair_find_by_phy (sw_if_index0); - if (PREDICT_FALSE (lipi0 == INDEX_INVALID)) - goto trace0; + + /* + * lip_punt_node: expect sw_if_index0 is phy in an itf pair + * lip_punt_xc_node: if sw_if_index0 is not phy, expect it is host + */ + if (!check_xc && (PREDICT_FALSE (lipi0 == INDEX_INVALID))) + { + goto trace0; + } + else if (check_xc && (lipi0 == INDEX_INVALID)) + { + is_xc0 = 1; + lipi0 = lcp_itf_pair_find_by_host (sw_if_index0); + if (PREDICT_FALSE (lipi0 == INDEX_INVALID)) + goto trace0; + } lip0 = lcp_itf_pair_get (lipi0); - next0 = LIP_PUNT_NEXT_IO; - vnet_buffer (b0)->sw_if_index[VLIB_TX] = lip0->lip_host_sw_if_index; + next0 = LIP_PUNT_XC_NEXT_IO; + vnet_buffer (b0)->sw_if_index[VLIB_TX] = + is_xc0 ? lip0->lip_phy_sw_if_index : lip0->lip_host_sw_if_index; if (PREDICT_TRUE (lip0->lip_host_type == LCP_ITF_HOST_TAP)) { @@ -129,10 +156,22 @@ VLIB_NODE_FN (lip_punt_node) trace0: if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED))) { - lip_punt_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); - t->phy_sw_if_index = sw_if_index0; - t->host_sw_if_index = - (lipi0 == INDEX_INVALID) ? ~0 : lip0->lip_host_sw_if_index; + lip_punt_xc_trace_t *t = + vlib_add_trace (vm, node, b0, sizeof (*t)); + + t->is_xc = is_xc0; + if (is_xc0) + { + t->phy_sw_if_index = + (lipi0 == INDEX_INVALID) ? ~0 : lip0->lip_phy_sw_if_index; + t->host_sw_if_index = sw_if_index0; + } + else + { + t->phy_sw_if_index = sw_if_index0; + t->host_sw_if_index = + (lipi0 == INDEX_INVALID) ? ~0 : lip0->lip_host_sw_if_index; + } } vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, @@ -145,16 +184,41 @@ VLIB_NODE_FN (lip_punt_node) return frame->n_vectors; } +VLIB_NODE_FN (lip_punt_node) +(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame) +{ + return (lip_punt_xc_inline (vm, node, frame, false /* xc */)); +} + +VLIB_NODE_FN (lip_punt_xc_node) +(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame) +{ + return (lip_punt_xc_inline (vm, node, frame, true /* xc */)); +} + VLIB_REGISTER_NODE (lip_punt_node) = { .name = "linux-cp-punt", .vector_size = sizeof (u32), - .format_trace = format_lip_punt_trace, + .format_trace = format_lip_punt_xc_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + + .n_next_nodes = LIP_PUNT_XC_N_NEXT, + .next_nodes = { + [LIP_PUNT_XC_NEXT_DROP] = "error-drop", + [LIP_PUNT_XC_NEXT_IO] = "interface-output", + }, +}; + +VLIB_REGISTER_NODE (lip_punt_xc_node) = { + .name = "linux-cp-punt-xc", + .vector_size = sizeof (u32), + .format_trace = format_lip_punt_xc_trace, .type = VLIB_NODE_TYPE_INTERNAL, - .n_next_nodes = LIP_PUNT_N_NEXT, + .n_next_nodes = LIP_PUNT_XC_N_NEXT, .next_nodes = { - [LIP_PUNT_NEXT_DROP] = "error-drop", - [LIP_PUNT_NEXT_IO] = "interface-output", + [LIP_PUNT_XC_NEXT_DROP] = "error-drop", + [LIP_PUNT_XC_NEXT_IO] = "interface-output", }, }; @@ -190,7 +254,7 @@ VLIB_NODE_FN (lcp_punt_l3_node) (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame) { u32 n_left_from, *from, *to_next, n_left_to_next; - lip_punt_next_t next_index; + lip_punt_xc_next_t next_index; next_index = node->cached_next_index; n_left_from = frame->n_vectors; diff --git a/src/plugins/nsh/nsh.c b/src/plugins/nsh/nsh.c index a2c24e27b26..06dd45be944 100644 --- a/src/plugins/nsh/nsh.c +++ b/src/plugins/nsh/nsh.c @@ -20,7 +20,7 @@ #include <nsh/nsh.h> #include <gre/gre.h> #include <vxlan/vxlan.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> #include <vnet/l2/l2_classify.h> #include <vnet/adj/adj.h> #include <vpp/app/version.h> @@ -182,7 +182,8 @@ nsh_md2_set_next_ioam_export_override (uword next) clib_error_t * nsh_init (vlib_main_t * vm) { - vlib_node_t *node, *gre4_input, *gre6_input; + vlib_node_t *node, *gre4_input, *gre6_input, *vxlan4_gpe_input, + *vxlan6_gpe_input; nsh_main_t *nm = &nsh_main; clib_error_t *error = 0; uword next_node; @@ -222,20 +223,24 @@ nsh_init (vlib_main_t * vm) /* Add dispositions to nodes that feed nsh-input */ //alagalah - validate we don't really need to use the node value + vxlan4_gpe_input = vlib_get_node_by_name (vm, (u8 *) "vxlan4-gpe-input"); + vxlan6_gpe_input = vlib_get_node_by_name (vm, (u8 *) "vxlan6-gpe-input"); + nm->vgm = vlib_get_plugin_symbol ("vxlan-gpe_plugin.so", "vxlan_gpe_main"); + if (vxlan4_gpe_input == 0 || vxlan6_gpe_input == 0 || nm->vgm == 0) + { + error = clib_error_return (0, "vxlan_gpe_plugin.so is not loaded"); + return error; + } next_node = - vlib_node_add_next (vm, vxlan4_gpe_input_node.index, - nm->nsh_input_node_index); - vlib_node_add_next (vm, vxlan4_gpe_input_node.index, - nm->nsh_proxy_node_index); - vlib_node_add_next (vm, vxlan4_gpe_input_node.index, + vlib_node_add_next (vm, vxlan4_gpe_input->index, nm->nsh_input_node_index); + vlib_node_add_next (vm, vxlan4_gpe_input->index, nm->nsh_proxy_node_index); + vlib_node_add_next (vm, vxlan4_gpe_input->index, nsh_aware_vnf_proxy_node.index); - vxlan_gpe_register_decap_protocol (VXLAN_GPE_PROTOCOL_NSH, next_node); + nm->vgm->register_decap_protocol (VXLAN_GPE_PROTOCOL_NSH, next_node); - vlib_node_add_next (vm, vxlan6_gpe_input_node.index, - nm->nsh_input_node_index); - vlib_node_add_next (vm, vxlan6_gpe_input_node.index, - nm->nsh_proxy_node_index); - vlib_node_add_next (vm, vxlan6_gpe_input_node.index, + vlib_node_add_next (vm, vxlan6_gpe_input->index, nm->nsh_input_node_index); + vlib_node_add_next (vm, vxlan6_gpe_input->index, nm->nsh_proxy_node_index); + vlib_node_add_next (vm, vxlan6_gpe_input->index, nsh_aware_vnf_proxy_node.index); gre4_input = vlib_get_node_by_name (vm, (u8 *) "gre4-input"); @@ -280,7 +285,9 @@ nsh_init (vlib_main_t * vm) return error; } -VLIB_INIT_FUNCTION (nsh_init); +VLIB_INIT_FUNCTION (nsh_init) = { + .runs_after = VLIB_INITS ("vxlan_gpe_init"), +}; VLIB_PLUGIN_REGISTER () = { .version = VPP_BUILD_VER, diff --git a/src/plugins/nsh/nsh.h b/src/plugins/nsh/nsh.h index 86a9a7e95c3..c408ddb99a2 100644 --- a/src/plugins/nsh/nsh.h +++ b/src/plugins/nsh/nsh.h @@ -18,6 +18,7 @@ #include <vnet/vnet.h> #include <nsh/nsh_packet.h> #include <vnet/ip/ip4_packet.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> typedef struct { u16 class; @@ -166,6 +167,10 @@ typedef struct { /* convenience */ vlib_main_t * vlib_main; vnet_main_t * vnet_main; + + /* vxlan gpe plugin */ + vxlan_gpe_main_t *vgm; + } nsh_main_t; extern nsh_main_t nsh_main; diff --git a/src/plugins/nsh/nsh_pop.c b/src/plugins/nsh/nsh_pop.c index 8de319e158b..d66cfc9de27 100644 --- a/src/plugins/nsh/nsh_pop.c +++ b/src/plugins/nsh/nsh_pop.c @@ -19,7 +19,7 @@ #include <vnet/plugin/plugin.h> #include <nsh/nsh.h> #include <vnet/gre/packet.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <plugins/vxlan-gpe/vxlan_gpe.h> #include <vnet/l2/l2_classify.h> #include <vlibapi/api.h> diff --git a/src/plugins/ping/ping_api.c b/src/plugins/ping/ping_api.c index 5578fa560f2..a5af1033d0e 100644 --- a/src/plugins/ping/ping_api.c +++ b/src/plugins/ping/ping_api.c @@ -122,16 +122,22 @@ vl_api_want_ping_finished_events_t_handler ( while ((sleep_interval = time_ping_sent + ping_interval - vlib_time_now (vm)) > 0.0) { - uword event_type; + uword event_count; vlib_process_wait_for_event_or_clock (vm, sleep_interval); - event_type = vlib_process_get_events (vm, 0); - if (event_type == ~0) + if (dst_addr.version == AF_IP4) + event_count = + vlib_process_get_events_with_type (vm, 0, PING_RESPONSE_IP4); + else if (dst_addr.version == AF_IP6) + event_count = + vlib_process_get_events_with_type (vm, 0, PING_RESPONSE_IP6); + else break; - if (event_type == PING_RESPONSE_IP4 || - event_type == PING_RESPONSE_IP6) - reply_count += 1; + if (event_count == 0) + break; + + reply_count += 1; } } diff --git a/src/plugins/unittest/ipsec_test.c b/src/plugins/unittest/ipsec_test.c index b505c58de3f..869d53367b6 100644 --- a/src/plugins/unittest/ipsec_test.c +++ b/src/plugins/unittest/ipsec_test.c @@ -54,14 +54,11 @@ test_ipsec_command_fn (vlib_main_t *vm, unformat_input_t *input, if (irt) { - irt->seq = seq_num & 0xffffffff; - irt->seq_hi = seq_num >> 32; + irt->seq64 = seq_num; /* clear the window */ - if (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa)) - clib_bitmap_zero (irt->replay_window_huge); - else - irt->replay_window = 0; + uword_bitmap_clear (irt->replay_window, + irt->anti_replay_window_size / uword_bits); } ipsec_sa_unlock (sa_index); diff --git a/src/plugins/unittest/session_test.c b/src/plugins/unittest/session_test.c index 993f1be41a9..f0e5d4b4f3d 100644 --- a/src/plugins/unittest/session_test.c +++ b/src/plugins/unittest/session_test.c @@ -16,6 +16,7 @@ #include <arpa/inet.h> #include <vnet/session/application.h> #include <vnet/session/session.h> +#include <vnet/session/transport.h> #include <sys/epoll.h> #include <vnet/session/session_rules_table.h> @@ -50,6 +51,11 @@ placeholder_session_reset_callback (session_t * s) volatile u32 connected_session_index = ~0; volatile u32 connected_session_thread = ~0; +static u32 placeholder_accept; +volatile u32 accepted_session_index; +volatile u32 accepted_session_thread; +volatile int app_session_error = 0; + int placeholder_session_connected_callback (u32 app_index, u32 api_context, session_t * s, session_error_t err) @@ -81,13 +87,22 @@ placeholder_del_segment_callback (u32 client_index, u64 segment_handle) void placeholder_session_disconnect_callback (session_t * s) { - clib_warning ("called..."); + if (!(s->session_index == connected_session_index && + s->thread_index == connected_session_thread) && + !(s->session_index == accepted_session_index && + s->thread_index == accepted_session_thread)) + { + clib_warning (0, "unexpected disconnect s %u thread %u", + s->session_index, s->thread_index); + app_session_error = 1; + } + vnet_disconnect_args_t da = { + .handle = session_handle (s), + .app_index = app_worker_get (s->app_wrk_index)->app_index + }; + vnet_disconnect_session (&da); } -static u32 placeholder_accept; -volatile u32 accepted_session_index; -volatile u32 accepted_session_thread; - int placeholder_session_accept_callback (session_t * s) { @@ -105,12 +120,39 @@ placeholder_server_rx_callback (session_t * s) return -1; } +void +placeholder_cleanup_callback (session_t *s, session_cleanup_ntf_t ntf) +{ + if (ntf == SESSION_CLEANUP_TRANSPORT) + return; + + if (s->session_index == connected_session_index && + s->thread_index == connected_session_thread) + { + connected_session_index = ~0; + connected_session_thread = ~0; + } + else if (s->session_index == accepted_session_index && + s->thread_index == accepted_session_thread) + { + accepted_session_index = ~0; + accepted_session_thread = ~0; + } + else + { + clib_warning (0, "unexpected cleanup s %u thread %u", s->session_index, + s->thread_index); + app_session_error = 1; + } +} + static session_cb_vft_t placeholder_session_cbs = { .session_reset_callback = placeholder_session_reset_callback, .session_connected_callback = placeholder_session_connected_callback, .session_accept_callback = placeholder_session_accept_callback, .session_disconnect_callback = placeholder_session_disconnect_callback, .builtin_app_rx_callback = placeholder_server_rx_callback, + .session_cleanup_callback = placeholder_cleanup_callback, .add_segment_callback = placeholder_add_segment_callback, .del_segment_callback = placeholder_del_segment_callback, }; @@ -278,6 +320,7 @@ session_test_endpoint_cfg (vlib_main_t * vm, unformat_input_t * input) u64 options[APP_OPTIONS_N_OPTIONS], placeholder_secret = 1234; u16 placeholder_server_port = 1234, placeholder_client_port = 5678; session_endpoint_cfg_t server_sep = SESSION_ENDPOINT_CFG_NULL; + u32 client_vrf = 0, server_vrf = 1; ip4_address_t intf_addr[3]; transport_connection_t *tc; session_t *s; @@ -288,25 +331,25 @@ session_test_endpoint_cfg (vlib_main_t * vm, unformat_input_t * input) * Create the loopbacks */ intf_addr[0].as_u32 = clib_host_to_net_u32 (0x01010101); - session_create_lookpback (0, &sw_if_index[0], &intf_addr[0]); + session_create_lookpback (client_vrf, &sw_if_index[0], &intf_addr[0]); intf_addr[1].as_u32 = clib_host_to_net_u32 (0x02020202); - session_create_lookpback (1, &sw_if_index[1], &intf_addr[1]); + session_create_lookpback (server_vrf, &sw_if_index[1], &intf_addr[1]); - session_add_del_route_via_lookup_in_table (0, 1, &intf_addr[1], 32, - 1 /* is_add */ ); - session_add_del_route_via_lookup_in_table (1, 0, &intf_addr[0], 32, - 1 /* is_add */ ); + session_add_del_route_via_lookup_in_table ( + client_vrf, server_vrf, &intf_addr[1], 32, 1 /* is_add */); + session_add_del_route_via_lookup_in_table ( + server_vrf, client_vrf, &intf_addr[0], 32, 1 /* is_add */); /* * Insert namespace */ - appns_id = format (0, "appns1"); + appns_id = format (0, "appns_server"); vnet_app_namespace_add_del_args_t ns_args = { .ns_id = appns_id, .secret = placeholder_secret, - .sw_if_index = sw_if_index[1], - .ip4_fib_id = 0, + .sw_if_index = sw_if_index[1], /* server interface*/ + .ip4_fib_id = 0, /* sw_if_index takes precedence */ .is_add = 1 }; error = vnet_app_namespace_add_del (&ns_args); @@ -357,10 +400,10 @@ session_test_endpoint_cfg (vlib_main_t * vm, unformat_input_t * input) * Connect and force lcl ip */ client_sep.is_ip4 = 1; - client_sep.ip.ip4.as_u32 = clib_host_to_net_u32 (0x02020202); + client_sep.ip.ip4.as_u32 = intf_addr[1].as_u32; client_sep.port = placeholder_server_port; client_sep.peer.is_ip4 = 1; - client_sep.peer.ip.ip4.as_u32 = clib_host_to_net_u32 (0x01010101); + client_sep.peer.ip.ip4.as_u32 = intf_addr[0].as_u32; client_sep.peer.port = placeholder_client_port; client_sep.transport_proto = TRANSPORT_PROTO_TCP; @@ -401,6 +444,35 @@ session_test_endpoint_cfg (vlib_main_t * vm, unformat_input_t * input) SESSION_TEST ((tc->lcl_port == placeholder_client_port), "ports should be equal"); + /* Disconnect server session, should lead to faster port cleanup on client */ + vnet_disconnect_args_t disconnect_args = { + .handle = + session_make_handle (accepted_session_index, accepted_session_thread), + .app_index = server_index, + }; + + error = vnet_disconnect_session (&disconnect_args); + SESSION_TEST ((error == 0), "disconnect should work"); + + /* wait for stuff to happen */ + tries = 0; + while (connected_session_index != ~0 && ++tries < 100) + { + vlib_worker_thread_barrier_release (vm); + vlib_process_suspend (vm, 100e-3); + vlib_worker_thread_barrier_sync (vm); + } + + /* Active closes take longer to cleanup, don't wait */ + + clib_warning ("waited %.1f seconds for disconnect", tries / 10.0); + SESSION_TEST ((connected_session_index == ~0), "session should not exist"); + SESSION_TEST ((connected_session_thread == ~0), "thread should not exist"); + SESSION_TEST (transport_port_local_in_use () == 0, + "port should be cleaned up"); + SESSION_TEST ((app_session_error == 0), "no app session errors"); + + /* Start cleanup by detaching apps */ vnet_app_detach_args_t detach_args = { .app_index = server_index, .api_client_index = ~0, @@ -416,13 +488,167 @@ session_test_endpoint_cfg (vlib_main_t * vm, unformat_input_t * input) /* Allow the disconnects to finish before removing the routes. */ vlib_process_suspend (vm, 10e-3); - session_add_del_route_via_lookup_in_table (0, 1, &intf_addr[1], 32, - 0 /* is_add */ ); - session_add_del_route_via_lookup_in_table (1, 0, &intf_addr[0], 32, - 0 /* is_add */ ); + session_add_del_route_via_lookup_in_table ( + client_vrf, server_vrf, &intf_addr[1], 32, 0 /* is_add */); + session_add_del_route_via_lookup_in_table ( + server_vrf, client_vrf, &intf_addr[0], 32, 0 /* is_add */); session_delete_loopback (sw_if_index[0]); session_delete_loopback (sw_if_index[1]); + + /* + * Redo the test but with client in the non-default namespace + */ + + /* Create the loopbacks */ + client_vrf = 1; + server_vrf = 0; + session_create_lookpback (client_vrf, &sw_if_index[0], &intf_addr[0]); + session_create_lookpback (server_vrf, &sw_if_index[1], &intf_addr[1]); + + session_add_del_route_via_lookup_in_table ( + client_vrf, server_vrf, &intf_addr[1], 32, 1 /* is_add */); + session_add_del_route_via_lookup_in_table ( + server_vrf, client_vrf, &intf_addr[0], 32, 1 /* is_add */); + + /* Insert new client namespace */ + vec_free (appns_id); + appns_id = format (0, "appns_client"); + ns_args.ns_id = appns_id; + ns_args.sw_if_index = sw_if_index[0]; /* client interface*/ + ns_args.is_add = 1; + + error = vnet_app_namespace_add_del (&ns_args); + SESSION_TEST ((error == 0), "app ns insertion should succeed: %U", + format_session_error, error); + + /* Attach client */ + attach_args.name = format (0, "session_test_client"); + attach_args.namespace_id = appns_id; + attach_args.options[APP_OPTIONS_ADD_SEGMENT_SIZE] = 0; + attach_args.options[APP_OPTIONS_NAMESPACE_SECRET] = placeholder_secret; + attach_args.api_client_index = ~0; + + error = vnet_application_attach (&attach_args); + SESSION_TEST ((error == 0), "client app attached: %U", format_session_error, + error); + client_index = attach_args.app_index; + vec_free (attach_args.name); + + /* Attach server */ + attach_args.name = format (0, "session_test_server"); + attach_args.namespace_id = 0; + attach_args.options[APP_OPTIONS_ADD_SEGMENT_SIZE] = 32 << 20; + attach_args.options[APP_OPTIONS_NAMESPACE_SECRET] = 0; + attach_args.api_client_index = ~0; + error = vnet_application_attach (&attach_args); + SESSION_TEST ((error == 0), "server app attached: %U", format_session_error, + error); + vec_free (attach_args.name); + server_index = attach_args.app_index; + + /* Bind server */ + clib_memset (&server_sep, 0, sizeof (server_sep)); + server_sep.is_ip4 = 1; + server_sep.port = placeholder_server_port; + bind_args.sep_ext = server_sep; + bind_args.app_index = server_index; + error = vnet_listen (&bind_args); + SESSION_TEST ((error == 0), "server bind should work: %U", + format_session_error, error); + + /* Connect client */ + connected_session_index = connected_session_thread = ~0; + accepted_session_index = accepted_session_thread = ~0; + clib_memset (&client_sep, 0, sizeof (client_sep)); + client_sep.is_ip4 = 1; + client_sep.ip.ip4.as_u32 = intf_addr[1].as_u32; + client_sep.port = placeholder_server_port; + client_sep.peer.is_ip4 = 1; + client_sep.peer.ip.ip4.as_u32 = intf_addr[0].as_u32; + client_sep.peer.port = placeholder_client_port; + client_sep.transport_proto = TRANSPORT_PROTO_TCP; + + connect_args.sep_ext = client_sep; + connect_args.app_index = client_index; + error = vnet_connect (&connect_args); + SESSION_TEST ((error == 0), "connect should work"); + + /* wait for stuff to happen */ + while (connected_session_index == ~0 && ++tries < 100) + { + vlib_worker_thread_barrier_release (vm); + vlib_process_suspend (vm, 100e-3); + vlib_worker_thread_barrier_sync (vm); + } + while (accepted_session_index == ~0 && ++tries < 100) + { + vlib_worker_thread_barrier_release (vm); + vlib_process_suspend (vm, 100e-3); + vlib_worker_thread_barrier_sync (vm); + } + + clib_warning ("waited %.1f seconds for connections", tries / 10.0); + SESSION_TEST ((connected_session_index != ~0), "session should exist"); + SESSION_TEST ((connected_session_thread != ~0), "thread should exist"); + SESSION_TEST ((accepted_session_index != ~0), "session should exist"); + SESSION_TEST ((accepted_session_thread != ~0), "thread should exist"); + s = session_get (connected_session_index, connected_session_thread); + tc = session_get_transport (s); + SESSION_TEST ((tc != 0), "transport should exist"); + SESSION_TEST ( + (memcmp (&tc->lcl_ip, &client_sep.peer.ip, sizeof (tc->lcl_ip)) == 0), + "ips should be equal"); + SESSION_TEST ((tc->lcl_port == placeholder_client_port), + "ports should be equal"); + + /* Disconnect server session, for faster port cleanup on client */ + disconnect_args.app_index = server_index; + disconnect_args.handle = + session_make_handle (accepted_session_index, accepted_session_thread); + + error = vnet_disconnect_session (&disconnect_args); + SESSION_TEST ((error == 0), "disconnect should work"); + + /* wait for stuff to happen */ + tries = 0; + while (connected_session_index != ~0 && ++tries < 100) + { + vlib_worker_thread_barrier_release (vm); + vlib_process_suspend (vm, 100e-3); + vlib_worker_thread_barrier_sync (vm); + } + + /* Active closes take longer to cleanup, don't wait */ + + clib_warning ("waited %.1f seconds for disconnect", tries / 10.0); + SESSION_TEST ((connected_session_index == ~0), "session should not exist"); + SESSION_TEST ((connected_session_thread == ~0), "thread should not exist"); + SESSION_TEST ((app_session_error == 0), "no app session errors"); + SESSION_TEST (transport_port_local_in_use () == 0, + "port should be cleaned up"); + + /* Start cleanup by detaching apps */ + detach_args.app_index = server_index; + vnet_application_detach (&detach_args); + detach_args.app_index = client_index; + vnet_application_detach (&detach_args); + + ns_args.is_add = 0; + error = vnet_app_namespace_add_del (&ns_args); + SESSION_TEST ((error == 0), "app ns delete should succeed: %d", error); + + /* Allow the disconnects to finish before removing the routes. */ + vlib_process_suspend (vm, 10e-3); + + session_add_del_route_via_lookup_in_table ( + client_vrf, server_vrf, &intf_addr[1], 32, 0 /* is_add */); + session_add_del_route_via_lookup_in_table ( + server_vrf, client_vrf, &intf_addr[0], 32, 0 /* is_add */); + + session_delete_loopback (sw_if_index[0]); + session_delete_loopback (sw_if_index[1]); + return 0; } @@ -1781,6 +2007,11 @@ session_test_proxy (vlib_main_t * vm, unformat_input_t * input) unformat_free (&tmp_input); vec_free (attach_args.name); session_delete_loopback (sw_if_index); + + /* Revert default appns sw_if_index */ + app_ns = app_namespace_get_default (); + app_ns->sw_if_index = ~0; + return 0; } diff --git a/src/plugins/unittest/tcp_test.c b/src/plugins/unittest/tcp_test.c index bd39474ce93..4b53bc18906 100644 --- a/src/plugins/unittest/tcp_test.c +++ b/src/plugins/unittest/tcp_test.c @@ -1005,7 +1005,7 @@ static void tcp_test_set_time (u32 thread_index, u32 val) { session_main.wrk[thread_index].last_vlib_time = val; - tcp_set_time_now (&tcp_main.wrk_ctx[thread_index], val); + tcp_set_time_now (&tcp_main.wrk[thread_index], val); } static int diff --git a/src/plugins/urpf/urpf_dp.h b/src/plugins/urpf/urpf_dp.h index b17fed7e04b..edb4ec79171 100644 --- a/src/plugins/urpf/urpf_dp.h +++ b/src/plugins/urpf/urpf_dp.h @@ -98,8 +98,8 @@ urpf_perform_check_x1 (ip_address_family_t af, vlib_dir_t dir, lb_index = ip4_fib_forwarding_lookup (fib_index, &ip->src_address); /* Pass multicast. */ - lpass = (ip4_address_is_multicast (&ip->src_address) || - ip4_address_is_global_broadcast (&ip->src_address)); + lpass = (ip4_address_is_multicast (&ip->dst_address) || + ip4_address_is_global_broadcast (&ip->dst_address)); } else { @@ -108,7 +108,7 @@ urpf_perform_check_x1 (ip_address_family_t af, vlib_dir_t dir, ip = (ip6_header_t *) h; lb_index = ip6_fib_table_fwding_lookup (fib_index, &ip->src_address); - lpass = ip6_address_is_multicast (&ip->src_address); + lpass = ip6_address_is_multicast (&ip->dst_address); } llb = load_balance_get (lb_index); @@ -157,10 +157,10 @@ urpf_perform_check_x2 (ip_address_family_t af, vlib_dir_t dir, ip4_fib_forwarding_lookup_x2 (fib_index0, fib_index1, &ip0->src_address, &ip1->src_address, &lb_index0, &lb_index1); /* Pass multicast. */ - lpass0 = (ip4_address_is_multicast (&ip0->src_address) || - ip4_address_is_global_broadcast (&ip0->src_address)); - lpass1 = (ip4_address_is_multicast (&ip1->src_address) || - ip4_address_is_global_broadcast (&ip1->src_address)); + lpass0 = (ip4_address_is_multicast (&ip0->dst_address) || + ip4_address_is_global_broadcast (&ip0->dst_address)); + lpass1 = (ip4_address_is_multicast (&ip1->dst_address) || + ip4_address_is_global_broadcast (&ip1->dst_address)); } else { @@ -171,8 +171,8 @@ urpf_perform_check_x2 (ip_address_family_t af, vlib_dir_t dir, lb_index0 = ip6_fib_table_fwding_lookup (fib_index0, &ip0->src_address); lb_index1 = ip6_fib_table_fwding_lookup (fib_index1, &ip1->src_address); - lpass0 = ip6_address_is_multicast (&ip0->src_address); - lpass1 = ip6_address_is_multicast (&ip1->src_address); + lpass0 = ip6_address_is_multicast (&ip0->dst_address); + lpass1 = ip6_address_is_multicast (&ip1->dst_address); } llb0 = load_balance_get (lb_index0); diff --git a/src/plugins/vrrp/vrrp_periodic.c b/src/plugins/vrrp/vrrp_periodic.c index 5f9d7ae938e..e3a374a112d 100644 --- a/src/plugins/vrrp/vrrp_periodic.c +++ b/src/plugins/vrrp/vrrp_periodic.c @@ -187,7 +187,19 @@ vrrp_periodic_process (vlib_main_t * vm, timer = pool_elt_at_index (pm->vr_timers, next_timer); timeout = timer->expire_time - now; - vlib_process_wait_for_event_or_clock (vm, timeout); + /* + * Adding a virtual MAC to some NICs can take a significant amount + * of time (~1s). If a lot of VRs enter the master state around the + * same time, the process node can stay active for a very long time + * processing all of the transitions. + * + * Try to force a 10us sleep between processing events to ensure + * that the process node does not prevent API messages and RPCs + * from being handled for an extended period. This prevents + * vlib_process_wait_for_event_or_clock() from returning + * immediately. + */ + vlib_process_wait_for_event_or_clock (vm, clib_max (timeout, 10e-6)); } event_type = vlib_process_get_events (vm, (uword **) & event_data); diff --git a/src/plugins/vxlan-gpe/CMakeLists.txt b/src/plugins/vxlan-gpe/CMakeLists.txt new file mode 100644 index 00000000000..987ebcc2df9 --- /dev/null +++ b/src/plugins/vxlan-gpe/CMakeLists.txt @@ -0,0 +1,32 @@ +# Copyright (c) 2024 OpenInfra Foundation Europe +# Copyright (c) 2025 Cisco and/or its affiliates. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +add_vpp_plugin(vxlan-gpe + SOURCES + encap.c + decap.c + vxlan_gpe.c + vxlan_gpe_api.c + vxlan_gpe_packet.h + plugin.c + + INSTALL_HEADERS + vxlan_gpe.h + + MULTIARCH_SOURCES + decap.c + + API_FILES + vxlan_gpe.api +) diff --git a/src/vnet/vxlan-gpe/FEATURE.yaml b/src/plugins/vxlan-gpe/FEATURE.yaml index f4ec2f4c517..f4ec2f4c517 100644 --- a/src/vnet/vxlan-gpe/FEATURE.yaml +++ b/src/plugins/vxlan-gpe/FEATURE.yaml diff --git a/src/vnet/vxlan-gpe/decap.c b/src/plugins/vxlan-gpe/decap.c index d4c7424630d..29f03e3b380 100644 --- a/src/vnet/vxlan-gpe/decap.c +++ b/src/plugins/vxlan-gpe/decap.c @@ -22,7 +22,7 @@ #include <vlib/vlib.h> #include <vnet/udp/udp_local.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <vxlan-gpe/vxlan_gpe.h> /** * @brief Struct for VXLAN GPE decap packet tracing @@ -617,7 +617,7 @@ VLIB_NODE_FN (vxlan6_gpe_input_node) (vlib_main_t * vm, */ static char *vxlan_gpe_error_strings[] = { #define vxlan_gpe_error(n,s) s, -#include <vnet/vxlan-gpe/vxlan_gpe_error.def> +#include <vxlan-gpe/vxlan_gpe_error.def> #undef vxlan_gpe_error #undef _ }; diff --git a/src/vnet/vxlan-gpe/dir.dox b/src/plugins/vxlan-gpe/dir.dox index c154733b21f..c154733b21f 100644 --- a/src/vnet/vxlan-gpe/dir.dox +++ b/src/plugins/vxlan-gpe/dir.dox diff --git a/src/vnet/vxlan-gpe/encap.c b/src/plugins/vxlan-gpe/encap.c index a769861577d..d8bab921493 100644 --- a/src/vnet/vxlan-gpe/encap.c +++ b/src/plugins/vxlan-gpe/encap.c @@ -23,7 +23,7 @@ #include <vnet/ip/ip.h> #include <vnet/ethernet/ethernet.h> #include <vnet/udp/udp_inlines.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <vxlan-gpe/vxlan_gpe.h> /** Statistics (not really errors) */ #define foreach_vxlan_gpe_encap_error \ diff --git a/src/plugins/vxlan-gpe/plugin.c b/src/plugins/vxlan-gpe/plugin.c new file mode 100644 index 00000000000..5a711a39d78 --- /dev/null +++ b/src/plugins/vxlan-gpe/plugin.c @@ -0,0 +1,26 @@ +/* + * plugin.c: vxlan-gpe + * + * Copyright (c) OpenInfra Foundation Europe. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include <vlib/vlib.h> +#include <vnet/plugin/plugin.h> +#include <vpp/app/version.h> +// register a plugin + +VLIB_PLUGIN_REGISTER () = { + .version = VPP_BUILD_VER, + .description = "VxLan GPE Tunnels", +}; diff --git a/src/vnet/vxlan-gpe/vxlan-gpe-rfc.txt b/src/plugins/vxlan-gpe/vxlan-gpe-rfc.txt index 35cee50f573..35cee50f573 100644 --- a/src/vnet/vxlan-gpe/vxlan-gpe-rfc.txt +++ b/src/plugins/vxlan-gpe/vxlan-gpe-rfc.txt diff --git a/src/vnet/vxlan-gpe/vxlan_gpe.api b/src/plugins/vxlan-gpe/vxlan_gpe.api index 3cbd7ab7f71..3cbd7ab7f71 100644 --- a/src/vnet/vxlan-gpe/vxlan_gpe.api +++ b/src/plugins/vxlan-gpe/vxlan_gpe.api diff --git a/src/vnet/vxlan-gpe/vxlan_gpe.c b/src/plugins/vxlan-gpe/vxlan_gpe.c index 5a5262ea9db..abb2049a356 100644 --- a/src/vnet/vxlan-gpe/vxlan_gpe.c +++ b/src/plugins/vxlan-gpe/vxlan_gpe.c @@ -17,7 +17,7 @@ * @brief Common utility functions for IPv4 and IPv6 VXLAN GPE tunnels * */ -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <vxlan-gpe/vxlan_gpe.h> #include <vnet/fib/fib.h> #include <vnet/ip/format.h> #include <vnet/fib/fib_entry.h> @@ -44,7 +44,7 @@ * You can refer to this kind of L2 overlay bridge domain as a VXLAN-GPE segment. */ -vxlan_gpe_main_t vxlan_gpe_main; +vxlan_gpe_main_t vxlan_gpe_main __clib_export; static u8 * format_decap_next (u8 * s, va_list * args) @@ -1212,11 +1212,13 @@ VNET_FEATURE_INIT (ip6_vxlan_gpe_bypass, static) = * @return error * */ -clib_error_t * -vxlan_gpe_init (vlib_main_t * vm) +__clib_export clib_error_t * +vxlan_gpe_init (vlib_main_t *vm) { vxlan_gpe_main_t *ngm = &vxlan_gpe_main; + ngm->register_decap_protocol = vxlan_gpe_register_decap_protocol; + ngm->unregister_decap_protocol = vxlan_gpe_unregister_decap_protocol; ngm->vnet_main = vnet_get_main (); ngm->vlib_main = vm; diff --git a/src/vnet/vxlan-gpe/vxlan_gpe.h b/src/plugins/vxlan-gpe/vxlan_gpe.h index aabaafeee6f..138ae840ef5 100644 --- a/src/vnet/vxlan-gpe/vxlan_gpe.h +++ b/src/plugins/vxlan-gpe/vxlan_gpe.h @@ -29,7 +29,7 @@ #include <vnet/l2/l2_output.h> #include <vnet/l2/l2_bd.h> #include <vnet/ethernet/ethernet.h> -#include <vnet/vxlan-gpe/vxlan_gpe_packet.h> +#include <vxlan-gpe/vxlan_gpe_packet.h> #include <vnet/ip/ip4_packet.h> #include <vnet/ip/ip6_packet.h> #include <vnet/udp/udp_packet.h> @@ -196,11 +196,16 @@ typedef enum typedef enum { #define vxlan_gpe_error(n,s) VXLAN_GPE_ERROR_##n, -#include <vnet/vxlan-gpe/vxlan_gpe_error.def> +#include <plugins/vxlan-gpe/vxlan_gpe_error.def> #undef vxlan_gpe_error VXLAN_GPE_N_ERROR, } vxlan_gpe_input_error_t; +typedef void (*vxlan_gpe_register_decap_protocol_callback_t) ( + u8 protocol_id, uword next_node_index); +typedef void (*vxlan_gpe_unregister_decap_protocol_callback_t) ( + u8 protocol_id, uword next_node_index); + /** Struct for VXLAN GPE node state */ typedef struct { @@ -233,6 +238,10 @@ typedef struct /** List of next nodes for the decap indexed on protocol */ uword decap_next_node_list[VXLAN_GPE_PROTOCOL_MAX]; + + /* export callbacks to register/unregister decapsulation protocol */ + vxlan_gpe_register_decap_protocol_callback_t register_decap_protocol; + vxlan_gpe_unregister_decap_protocol_callback_t unregister_decap_protocol; } vxlan_gpe_main_t; extern vxlan_gpe_main_t vxlan_gpe_main; @@ -279,13 +288,10 @@ typedef enum VXLAN_GPE_ENCAP_N_NEXT } vxlan_gpe_encap_next_t; - +void vxlan_gpe_register_decap_protocol (u8 protocol_id, uword next_node_index); void vxlan_gpe_unregister_decap_protocol (u8 protocol_id, uword next_node_index); -void vxlan_gpe_register_decap_protocol (u8 protocol_id, - uword next_node_index); - void vnet_int_vxlan_gpe_bypass_mode (u32 sw_if_index, u8 is_ip6, u8 is_enable); diff --git a/src/vnet/vxlan-gpe/vxlan_gpe_api.c b/src/plugins/vxlan-gpe/vxlan_gpe_api.c index cc74e1f58d4..e82445498e8 100644 --- a/src/vnet/vxlan-gpe/vxlan_gpe_api.c +++ b/src/plugins/vxlan-gpe/vxlan_gpe_api.c @@ -23,13 +23,13 @@ #include <vnet/interface.h> #include <vnet/api_errno.h> #include <vnet/feature/feature.h> -#include <vnet/vxlan-gpe/vxlan_gpe.h> +#include <vxlan-gpe/vxlan_gpe.h> #include <vnet/fib/fib_table.h> #include <vnet/format_fns.h> #include <vnet/ip/ip_types_api.h> -#include <vnet/vxlan-gpe/vxlan_gpe.api_enum.h> -#include <vnet/vxlan-gpe/vxlan_gpe.api_types.h> +#include <vxlan-gpe/vxlan_gpe.api_enum.h> +#include <vxlan-gpe/vxlan_gpe.api_types.h> #define REPLY_MSG_ID_BASE msg_id_base #include <vlibapi/api_helper_macros.h> diff --git a/src/vnet/vxlan-gpe/vxlan_gpe_error.def b/src/plugins/vxlan-gpe/vxlan_gpe_error.def index 9cf1b1cb656..9cf1b1cb656 100644 --- a/src/vnet/vxlan-gpe/vxlan_gpe_error.def +++ b/src/plugins/vxlan-gpe/vxlan_gpe_error.def diff --git a/src/vnet/vxlan-gpe/vxlan_gpe_packet.h b/src/plugins/vxlan-gpe/vxlan_gpe_packet.h index f5e5ddc2347..f5e5ddc2347 100644 --- a/src/vnet/vxlan-gpe/vxlan_gpe_packet.h +++ b/src/plugins/vxlan-gpe/vxlan_gpe_packet.h diff --git a/src/scripts/host-stack/cc_plots.py b/src/scripts/host-stack/cc_plots.py deleted file mode 100755 index f7953f223d4..00000000000 --- a/src/scripts/host-stack/cc_plots.py +++ /dev/null @@ -1,246 +0,0 @@ -#!/usr/bin/env python3 - -import sys -import re -import argparse -import matplotlib.pyplot as plt -from matplotlib.lines import Line2D - - -class Point: - "CC event" - - def __init__(self, x, y): - self.x = x - self.y = y - - -def listx(points): - return list(map(lambda pt: pt.x, points)) - - -def listy(points): - return list(map(lambda pt: pt.y, points)) - - -def plot_data(d): - plt.figure(1) - - cwndx = listx(d["cwnd"]) - cwndy = listy(d["cwnd"]) - congx = listx(d["congestion"]) - congy = listy(d["congestion"]) - rcvrdx = listx(d["recovered"]) - rcvrdy = listy(d["recovered"]) - rxttx = listx(d["rxtTimeout"]) - rxtty = listy(d["rxtTimeout"]) - - # cwnd/ssthresh/cc events - plt.subplot(311) - plt.title("cwnd/ssthresh") - pcwnd = plt.plot(cwndx, cwndy, "r") - psst = plt.plot(cwndx, d["ssthresh"], "y-") - pcong = plt.plot(congx, congy, "yo") - precov = plt.plot(rcvrdx, rcvrdy, "co") - prxtt = plt.plot(rxttx, rxtty, "mo") - - marker1 = Line2D(range(1), range(1), color="r") - marker2 = Line2D(range(1), range(1), color="y") - marker3 = Line2D(range(1), range(1), color="w", marker="o", markerfacecolor="y") - marker4 = Line2D(range(1), range(1), color="w", marker="o", markerfacecolor="c") - marker5 = Line2D(range(1), range(1), color="w", marker="o", markerfacecolor="m") - plt.legend( - (marker1, marker2, marker3, marker4, marker5), - ("cwnd", "ssthresh", "congestion", "recovered", "rxt-timeout"), - loc=4, - ) - axes = plt.gca() - axes.set_ylim([-20e4, max(cwndy) + 20e4]) - - # snd variables - plt.subplot(312) - plt.title("cc variables") - plt.plot(cwndx, d["space"], "g-", markersize=1) - plt.plot(cwndx, d["flight"], "b-", markersize=1) - plt.plot(cwndx, d["sacked"], "m:", markersize=1) - plt.plot(cwndx, d["lost"], "y:", markersize=1) - plt.plot(cwndx, d["cc-space"], "k:", markersize=1) - plt.plot(cwndx, cwndy, "ro", markersize=2) - - plt.plot(congx, congy, "y^", markersize=10, markerfacecolor="y") - plt.plot(rcvrdx, rcvrdy, "c^", markersize=10, markerfacecolor="c") - plt.plot(rxttx, rxtty, "m^", markersize=10, markerfacecolor="m") - - # plt.plot(cwndx, d["snd_wnd"], 'ko', markersize=1) - plt.legend( - ( - "snd-space", - "flight", - "sacked", - "lost", - "cc-space", - "cwnd", - "congestion", - "recovered", - "rxt-timeout", - ), - loc=1, - ) - - # rto/srrt/rttvar - plt.subplot(313) - plt.title("rtt") - plt.plot(cwndx, d["srtt"], "g-") - plt.plot(cwndx, [x / 1000 for x in d["mrtt-us"]], "r-") - plt.plot(cwndx, d["rttvar"], "b-") - plt.legend(["srtt", "mrtt-us", "rttvar"]) - axes = plt.gca() - # plt.plot(cwndx, rto, 'r-') - # axes.set_ylim([0, int(max(rto[2:len(rto)])) + 50]) - - # show - plt.show() - - -def find_pattern(file_path, session_idx): - is_active_open = 1 - listener_pattern = "l\[\d\]" - if is_active_open: - initial_pattern = "\[\d\](\.\d+:\d+\->\.\d+:\d+)\s+open:\s" - else: - initial_pattern = "\[\d\](\.\d+:\d+\->\.\d+:\d+)\s" - idx = 0 - f = open(file_path, "r") - for line in f: - # skip listener lines (server) - if re.search(listener_pattern, line) != None: - continue - match = re.search(initial_pattern, line) - if match == None: - continue - if idx < session_idx: - idx += 1 - continue - filter_pattern = str(match.group(1)) + "\s+(.+)" - print("pattern is %s" % filter_pattern) - f.close() - return filter_pattern - raise Exception("Could not find initial pattern") - - -def compute_time(min, sec, msec): - return int(min) * 60 + int(sec) + int(msec) / 1000.0 - - -def run(file_path, session_idx): - filter_sessions = 1 - filter_pattern = "" - - patterns = { - "time": "^\d+:(\d+):(\d+):(\d+):\d+", - "listener": "l\[\d\]", - "cc": "cwnd (\d+) flight (\d+) space (\d+) ssthresh (\d+) snd_wnd (\d+)", - "cc-snd": "cc_space (\d+) sacked (\d+) lost (\d+)", - "rtt": "rto (\d+) srtt (\d+) mrtt-us (\d+) rttvar (\d+)", - "rxtt": "rxt-timeout", - "congestion": "congestion", - "recovered": "recovered", - } - d = { - "cwnd": [], - "space": [], - "flight": [], - "ssthresh": [], - "snd_wnd": [], - "cc-space": [], - "lost": [], - "sacked": [], - "rto": [], - "srtt": [], - "mrtt-us": [], - "rttvar": [], - "rxtTimeout": [], - "congestion": [], - "recovered": [], - } - - if filter_sessions: - filter_pattern = find_pattern(file_path, session_idx) - f = open(file_path, "r") - - stats_index = 0 - start_time = 0 - - for line in f: - # skip listener lines (server) - if re.search(patterns["listener"], line) != None: - continue - # filter sessions - if filter_sessions: - match = re.search(filter_pattern, line) - if match == None: - continue - - original_line = line - line = match.group(1) - match = re.search(patterns["time"], original_line) - if match == None: - print("something went wrong! no time!") - continue - time = compute_time(match.group(1), match.group(2), match.group(3)) - if start_time == 0: - start_time = time - - time = time - start_time - match = re.search(patterns["cc"], line) - if match != None: - d["cwnd"].append(Point(time, int(match.group(1)))) - d["flight"].append(int(match.group(2))) - d["space"].append(int(match.group(3))) - d["ssthresh"].append(int(match.group(4))) - d["snd_wnd"].append(int(match.group(5))) - stats_index += 1 - continue - match = re.search(patterns["cc-snd"], line) - if match != None: - d["cc-space"].append(int(match.group(1))) - d["sacked"].append(int(match.group(2))) - d["lost"].append(int(match.group(3))) - match = re.search(patterns["rtt"], line) - if match != None: - d["rto"].append(int(match.group(1))) - d["srtt"].append(int(match.group(2))) - d["mrtt-us"].append(int(match.group(3))) - d["rttvar"].append(int(match.group(4))) - if stats_index == 0: - continue - match = re.search(patterns["rxtt"], line) - if match != None: - d["rxtTimeout"].append(Point(time, d["cwnd"][stats_index - 1].y + 1e4)) - continue - match = re.search(patterns["congestion"], line) - if match != None: - d["congestion"].append(Point(time, d["cwnd"][stats_index - 1].y - 1e4)) - continue - match = re.search(patterns["recovered"], line) - if match != None: - d["recovered"].append(Point(time, d["cwnd"][stats_index - 1].y)) - continue - - plot_data(d) - - -if __name__ == "__main__": - parser = argparse.ArgumentParser(description="Plot tcp cc logs") - parser.add_argument( - "-f", action="store", dest="file", required=True, help="elog file in txt format" - ) - parser.add_argument( - "-s", - action="store", - dest="session_index", - default=0, - help="session index for which to plot cc logs", - ) - results = parser.parse_args() - run(results.file, int(results.session_index)) diff --git a/src/scripts/host-stack/convert_evt b/src/scripts/host-stack/convert_evt deleted file mode 100755 index 1aba67d0268..00000000000 --- a/src/scripts/host-stack/convert_evt +++ /dev/null @@ -1,12 +0,0 @@ -#!/usr/bin/env bash - -# This depends on c2cpel and cpeldump. Enable their compilation by: -# ccmake build-root/build-vpp-native/vpp/ -# and turning on VPP_BUILD_PERFTOOL - -BIN_PATH=../../../build-root/install-vpp-native/vpp/bin -C2CPEL_BIN=$BIN_PATH/c2cpel -CPELDUMP_BIN=$BIN_PATH/cpeldump - -$C2CPEL_BIN --in $1 --out /tmp/tmp_file.cpel -$CPELDUMP_BIN --in /tmp/tmp_file.cpel --out $2 diff --git a/src/vcl/vcl_locked.c b/src/vcl/vcl_locked.c index f38df8fbf47..7ba9fab25fa 100644 --- a/src/vcl/vcl_locked.c +++ b/src/vcl/vcl_locked.c @@ -743,6 +743,7 @@ vls_listener_wrk_start_listen (vcl_locked_session_t * vls, u32 wrk_index) if (ls->flags & VCL_SESSION_F_PENDING_LISTEN) return; + ls->flags &= ~VCL_SESSION_F_LISTEN_NO_MQ; vcl_send_session_listen (wrk, ls); vls_listener_wrk_set (vls, wrk_index, 1 /* is_active */); @@ -759,7 +760,7 @@ vls_listener_wrk_stop_listen (vcl_locked_session_t * vls, u32 wrk_index) if (s->session_state != VCL_STATE_LISTEN) return; vcl_send_session_unlisten (wrk, s); - s->session_state = VCL_STATE_LISTEN_NO_MQ; + s->flags |= VCL_SESSION_F_LISTEN_NO_MQ; vls_listener_wrk_set (vls, wrk_index, 0 /* is_active */ ); } @@ -912,7 +913,7 @@ vls_share_session (vls_worker_t * vls_wrk, vcl_locked_session_t * vls) if (s->session_state == VCL_STATE_LISTEN) { - s->session_state = VCL_STATE_LISTEN_NO_MQ; + s->flags |= VCL_SESSION_F_LISTEN_NO_MQ; s->rx_fifo = s->tx_fifo = 0; } else if (s->rx_fifo) @@ -1384,36 +1385,41 @@ vls_mp_checks (vcl_locked_session_t * vls, int is_add) switch (s->session_state) { case VCL_STATE_LISTEN: - if (is_add) + if (!(s->flags & VCL_SESSION_F_LISTEN_NO_MQ)) { - vls_listener_wrk_set (vls, vls->vcl_wrk_index, 1 /* is_active */); - break; + if (is_add) + { + vls_listener_wrk_set (vls, vls->vcl_wrk_index, + 1 /* is_active */); + break; + } + /* Although removal from epoll means listener no longer accepts new + * sessions, the accept queue built by vpp cannot be drained by + * stopping the listener. Morover, some applications, e.g., nginx, + * might constantly remove and add listeners to their epfds. Removing + * listeners in such situations causes a lot of churn in vpp as + * segments and segment managers need to be recreated. */ + /* vls_listener_wrk_stop_listen (vls, vls->vcl_wrk_index); */ + } + else + { + if (!is_add) + break; + + /* Register worker as listener */ + vls_listener_wrk_start_listen (vls, vls->vcl_wrk_index); + + /* If owner worker did not attempt to accept/xpoll on the session, + * force a listen stop for it, since it may not be interested in + * accepting new sessions. + * This is pretty much a hack done to give app workers the illusion + * that it is fine to listen and not accept new sessions for a + * given listener. Without it, we would accumulate unhandled + * accepts on the passive worker message queue. */ + owner_wrk = vls_shared_get_owner (vls); + if (!vls_listener_wrk_is_active (vls, owner_wrk)) + vls_listener_wrk_stop_listen (vls, owner_wrk); } - /* Although removal from epoll means listener no longer accepts new - * sessions, the accept queue built by vpp cannot be drained by stopping - * the listener. Morover, some applications, e.g., nginx, might - * constantly remove and add listeners to their epfds. Removing - * listeners in such situations causes a lot of churn in vpp as segments - * and segment managers need to be recreated. */ - /* vls_listener_wrk_stop_listen (vls, vls->vcl_wrk_index); */ - break; - case VCL_STATE_LISTEN_NO_MQ: - if (!is_add) - break; - - /* Register worker as listener */ - vls_listener_wrk_start_listen (vls, vls->vcl_wrk_index); - - /* If owner worker did not attempt to accept/xpoll on the session, - * force a listen stop for it, since it may not be interested in - * accepting new sessions. - * This is pretty much a hack done to give app workers the illusion - * that it is fine to listen and not accept new sessions for a - * given listener. Without it, we would accumulate unhandled - * accepts on the passive worker message queue. */ - owner_wrk = vls_shared_get_owner (vls); - if (!vls_listener_wrk_is_active (vls, owner_wrk)) - vls_listener_wrk_stop_listen (vls, owner_wrk); break; default: break; diff --git a/src/vcl/vcl_private.c b/src/vcl/vcl_private.c index d9814394f0d..6892688da5a 100644 --- a/src/vcl/vcl_private.c +++ b/src/vcl/vcl_private.c @@ -201,17 +201,17 @@ vcl_worker_detach_sessions (vcl_worker_t *wrk) { if (s->session_state == VCL_STATE_LISTEN) { - s->session_state = VCL_STATE_LISTEN_NO_MQ; + s->flags |= VCL_SESSION_F_LISTEN_NO_MQ; continue; } if ((s->flags & VCL_SESSION_F_IS_VEP) || - s->session_state == VCL_STATE_LISTEN_NO_MQ || s->session_state == VCL_STATE_CLOSED) continue; hash_set (seg_indices_map, s->tx_fifo->segment_index, 1); s->session_state = VCL_STATE_DETACHED; + s->flags |= VCL_SESSION_F_APP_CLOSING; vec_add2 (wrk->unhandled_evts_vector, e, 1); e->event_type = SESSION_CTRL_EVT_DISCONNECTED; e->session_index = s->session_index; @@ -221,11 +221,22 @@ vcl_worker_detach_sessions (vcl_worker_t *wrk) hash_foreach (seg_index, val, seg_indices_map, ({ vec_add1 (seg_indices, seg_index); })); + /* If multi-threaded apps, wait for all threads to hopefully finish + * their blocking operations */ + if (wrk->pre_wait_fn) + wrk->pre_wait_fn (VCL_INVALID_SESSION_INDEX); + sleep (1); + if (wrk->post_wait_fn) + wrk->post_wait_fn (VCL_INVALID_SESSION_INDEX); + vcl_segment_detach_segments (seg_indices); /* Detach worker's mqs segment */ vcl_segment_detach (vcl_vpp_worker_segment_handle (wrk->wrk_index)); + wrk->app_event_queue = 0; + wrk->ctrl_mq = 0; + vec_free (seg_indices); hash_free (seg_indices_map); } @@ -364,8 +375,8 @@ vcl_session_read_ready (vcl_session_t * s) } else { - return (s->session_state == VCL_STATE_DISCONNECT) ? - VPPCOM_ECONNRESET : VPPCOM_ENOTCONN; + return (s->session_state == VCL_STATE_DISCONNECT) ? VPPCOM_ECONNRESET : + VPPCOM_ENOTCONN; } } @@ -773,9 +784,6 @@ vcl_session_state_str (vcl_session_state_t state) case VCL_STATE_UPDATED: st = "STATE_UPDATED"; break; - case VCL_STATE_LISTEN_NO_MQ: - st = "STATE_LISTEN_NO_MQ"; - break; default: st = "UNKNOWN_STATE"; break; diff --git a/src/vcl/vcl_private.h b/src/vcl/vcl_private.h index c98e1cde9b1..c92bb58169d 100644 --- a/src/vcl/vcl_private.h +++ b/src/vcl/vcl_private.h @@ -71,7 +71,6 @@ typedef enum vcl_session_state_ VCL_STATE_DISCONNECT, VCL_STATE_DETACHED, VCL_STATE_UPDATED, - VCL_STATE_LISTEN_NO_MQ, } vcl_session_state_t; typedef struct epoll_event vppcom_epoll_event_t; @@ -144,6 +143,7 @@ typedef enum vcl_session_flags_ VCL_SESSION_F_PENDING_FREE = 1 << 7, VCL_SESSION_F_PENDING_LISTEN = 1 << 8, VCL_SESSION_F_APP_CLOSING = 1 << 9, + VCL_SESSION_F_LISTEN_NO_MQ = 1 << 10, } __clib_packed vcl_session_flags_t; typedef enum vcl_worker_wait_ @@ -563,9 +563,8 @@ vcl_session_table_lookup_listener (vcl_worker_t * wrk, u64 handle) return 0; } - ASSERT (s->session_state == VCL_STATE_LISTEN - || s->session_state == VCL_STATE_LISTEN_NO_MQ - || vcl_session_is_connectable_listener (wrk, s)); + ASSERT (s->session_state == VCL_STATE_LISTEN || + vcl_session_is_connectable_listener (wrk, s)); return s; } diff --git a/src/vcl/vppcom.c b/src/vcl/vppcom.c index 19d58c349b7..b4f985e5562 100644 --- a/src/vcl/vppcom.c +++ b/src/vcl/vppcom.c @@ -519,8 +519,7 @@ vcl_session_reset_handler (vcl_worker_t * wrk, } /* Caught a reset before actually accepting the session */ - if (session->session_state == VCL_STATE_LISTEN || - session->session_state == VCL_STATE_LISTEN_NO_MQ) + if (session->session_state == VCL_STATE_LISTEN) { if (!vcl_flag_accepted_session (session, reset_msg->handle, VCL_ACCEPTED_F_RESET)) @@ -712,8 +711,7 @@ vcl_session_disconnected_handler (vcl_worker_t * wrk, return 0; /* Caught a disconnect before actually accepting the session */ - if (session->session_state == VCL_STATE_LISTEN || - session->session_state == VCL_STATE_LISTEN_NO_MQ) + if (session->session_state == VCL_STATE_LISTEN) { if (!vcl_flag_accepted_session (session, msg->handle, VCL_ACCEPTED_F_CLOSED)) @@ -1085,8 +1083,7 @@ vcl_handle_mq_event (vcl_worker_t * wrk, session_event_t * e) * VPP_CLOSING state instead can been marked as ACCEPTED_F_CLOSED. */ if (vcl_session_has_attr (s, VCL_SESS_ATTR_NONBLOCK) && - !(s->session_state == VCL_STATE_LISTEN || - s->session_state == VCL_STATE_LISTEN_NO_MQ)) + !(s->session_state == VCL_STATE_LISTEN)) { s->session_state = VCL_STATE_VPP_CLOSING; s->flags |= VCL_SESSION_F_PENDING_DISCONNECT; @@ -1114,8 +1111,7 @@ vcl_handle_mq_event (vcl_worker_t * wrk, session_event_t * e) * DISCONNECT state instead can been marked as ACCEPTED_F_RESET. */ if (vcl_session_has_attr (s, VCL_SESS_ATTR_NONBLOCK) && - !(s->session_state == VCL_STATE_LISTEN || - s->session_state == VCL_STATE_LISTEN_NO_MQ)) + !(s->session_state == VCL_STATE_LISTEN)) { s->flags |= VCL_SESSION_F_PENDING_DISCONNECT; s->session_state = VCL_STATE_DISCONNECT; @@ -1331,6 +1327,12 @@ vppcom_session_unbind (u32 session_handle) } clib_fifo_free (session->accept_evts_fifo); + if (session->flags & VCL_SESSION_F_LISTEN_NO_MQ) + { + vcl_session_free (wrk, session); + return VPPCOM_OK; + } + vcl_send_session_unlisten (wrk, session); VDBG (0, "session %u [0x%llx]: sending unbind!", session->session_index, @@ -1425,10 +1427,11 @@ vcl_api_retry_attach (vcl_worker_t *wrk) { if (s->flags & VCL_SESSION_F_IS_VEP) continue; - if (s->session_state == VCL_STATE_LISTEN_NO_MQ) + if (s->session_state == VCL_STATE_LISTEN) vppcom_session_listen (vcl_session_handle (s), 10); else - VDBG (0, "internal error: unexpected state %d", s->session_state); + VDBG (0, "reattach error: %u unexpected state %d", s->session_index, + s->session_state); } } @@ -1769,12 +1772,20 @@ vppcom_session_listen (uint32_t listen_sh, uint32_t q_len) return VPPCOM_EBADFD; listen_vpp_handle = listen_session->vpp_handle; - if (listen_session->session_state == VCL_STATE_LISTEN) + if (listen_session->session_state == VCL_STATE_LISTEN && + !(listen_session->flags & VCL_SESSION_F_LISTEN_NO_MQ)) + { + VDBG (0, "session %u [0x%llx]: already in listen state!", listen_sh, + listen_vpp_handle); + return VPPCOM_OK; + } + if (PREDICT_FALSE (!wrk->ctrl_mq)) { - VDBG (0, "session %u [0x%llx]: already in listen state!", - listen_sh, listen_vpp_handle); + listen_session->session_state = VCL_STATE_LISTEN; + listen_session->flags |= VCL_SESSION_F_LISTEN_NO_MQ; return VPPCOM_OK; } + listen_session->flags &= ~VCL_SESSION_F_LISTEN_NO_MQ; VDBG (0, "session %u: sending vpp listen request...", listen_sh); @@ -1851,7 +1862,6 @@ again: return VPPCOM_EBADFD; if ((ls->session_state != VCL_STATE_LISTEN) && - (ls->session_state != VCL_STATE_LISTEN_NO_MQ) && (!vcl_session_is_connectable_listener (wrk, ls))) { VDBG (0, "ERROR: session [0x%llx]: not in listen state! state (%s)", @@ -2653,6 +2663,9 @@ vcl_select_handle_mq_event (vcl_worker_t * wrk, session_event_t * e, *bits_set += 1; } break; + case SESSION_CTRL_EVT_BOUND: + vcl_session_bound_handler (wrk, (session_bound_msg_t *) e->data); + break; case SESSION_CTRL_EVT_UNLISTEN_REPLY: vcl_session_unlisten_reply_handler (wrk, e->data); break; diff --git a/src/vnet/CMakeLists.txt b/src/vnet/CMakeLists.txt index a071709542a..9e7734e20cb 100644 --- a/src/vnet/CMakeLists.txt +++ b/src/vnet/CMakeLists.txt @@ -750,29 +750,6 @@ list(APPEND VNET_HEADERS list(APPEND VNET_API_FILES mpls/mpls.api) ############################################################################## -# Tunnel protocol: vxlan-gpe -############################################################################## - -list(APPEND VNET_SOURCES - vxlan-gpe/vxlan_gpe.c - vxlan-gpe/encap.c - vxlan-gpe/decap.c - vxlan-gpe/vxlan_gpe_api.c -) - -list (APPEND VNET_MULTIARCH_SOURCES - vxlan-gpe/decap.c -) - -list(APPEND VNET_HEADERS - vxlan-gpe/vxlan_gpe.h - vxlan-gpe/vxlan_gpe_packet.h - vxlan-gpe/vxlan_gpe_error.def -) - -list(APPEND VNET_API_FILES vxlan-gpe/vxlan_gpe.api) - -############################################################################## # ipv6 segment routing ############################################################################## diff --git a/src/vnet/dpo/load_balance.c b/src/vnet/dpo/load_balance.c index 8f2a0de6ea8..f6f9392a42b 100644 --- a/src/vnet/dpo/load_balance.c +++ b/src/vnet/dpo/load_balance.c @@ -1030,6 +1030,7 @@ load_balance_module_init (void) * This should never be used, but just in case, stack it on a drop. */ lbi = load_balance_create(1, DPO_PROTO_IP4, 0); + ASSERT(0 == lbi); load_balance_set_bucket(lbi, 0, drop_dpo_get(DPO_PROTO_IP4)); load_balance_logger = @@ -1038,6 +1039,12 @@ load_balance_module_init (void) load_balance_map_module_init(); } +void +load_balance_pool_alloc (uword size) +{ + pool_alloc_aligned(load_balance_pool, size, CLIB_CACHE_LINE_BYTES); +} + static clib_error_t * load_balance_show (vlib_main_t * vm, unformat_input_t * input, diff --git a/src/vnet/dpo/load_balance.h b/src/vnet/dpo/load_balance.h index eee073f5892..76aa7982401 100644 --- a/src/vnet/dpo/load_balance.h +++ b/src/vnet/dpo/load_balance.h @@ -260,5 +260,6 @@ load_balance_get_bucket_i (const load_balance_t *lb, } extern void load_balance_module_init(void); +extern void load_balance_pool_alloc (uword size); #endif diff --git a/src/vnet/fib/fib_entry.c b/src/vnet/fib/fib_entry.c index adf880b8bbb..c86941fce9a 100644 --- a/src/vnet/fib/fib_entry.c +++ b/src/vnet/fib/fib_entry.c @@ -1772,6 +1772,12 @@ fib_entry_module_init (void) fib_entry_track_module_init(); } +void +fib_entry_pool_alloc (uword size) +{ + pool_alloc(fib_entry_pool, size); +} + fib_route_path_t * fib_entry_encode (fib_node_index_t fib_entry_index) { diff --git a/src/vnet/fib/fib_entry.h b/src/vnet/fib/fib_entry.h index 7331f803ec4..2c88d1e5f6a 100644 --- a/src/vnet/fib/fib_entry.h +++ b/src/vnet/fib/fib_entry.h @@ -480,6 +480,7 @@ extern void fib_entry_set_flow_hash_config(fib_node_index_t fib_entry_index, flow_hash_config_t hash_config); extern void fib_entry_module_init(void); +extern void fib_entry_pool_alloc(uword size); extern u32 fib_entry_get_stats_index(fib_node_index_t fib_entry_index); diff --git a/src/vnet/ip/ip4_mtrie.c b/src/vnet/ip/ip4_mtrie.c index 00855f7db43..df70dc9edca 100644 --- a/src/vnet/ip/ip4_mtrie.c +++ b/src/vnet/ip/ip4_mtrie.c @@ -190,7 +190,7 @@ ip4_mtrie_8_init (ip4_mtrie_8_t *m) { ip4_mtrie_8_ply_t *root; - pool_get (ip4_ply_pool, root); + pool_get_aligned (ip4_ply_pool, root, CLIB_CACHE_LINE_BYTES); m->root_ply = root - ip4_ply_pool; ply_8_init (root, IP4_MTRIE_LEAF_EMPTY, 0, 0); @@ -853,13 +853,19 @@ ip4_mtrie_module_init (vlib_main_t * vm) clib_error_t *error = NULL; /* Burn one ply so index 0 is taken */ - pool_get (ip4_ply_pool, p); + pool_get_aligned (ip4_ply_pool, p, CLIB_CACHE_LINE_BYTES); return (error); } VLIB_INIT_FUNCTION (ip4_mtrie_module_init); +void +ip4_mtrie_pool_alloc (uword size) +{ + pool_alloc_aligned (ip4_ply_pool, size, CLIB_CACHE_LINE_BYTES); +} + /* * fd.io coding-style-patch-verification: ON * diff --git a/src/vnet/ip/ip4_mtrie.h b/src/vnet/ip/ip4_mtrie.h index 16c524745be..2631f07eb2b 100644 --- a/src/vnet/ip/ip4_mtrie.h +++ b/src/vnet/ip/ip4_mtrie.h @@ -179,6 +179,11 @@ format_function_t format_ip4_mtrie_8; extern ip4_mtrie_8_ply_t *ip4_ply_pool; /** + * @brief Pre-allocate the pool of plys + */ +extern void ip4_mtrie_pool_alloc (uword size); + +/** * Is the leaf terminal (i.e. an LB index) or non-terminal (i.e. a PLY index) */ always_inline u32 diff --git a/src/vnet/ip/ip_init.c b/src/vnet/ip/ip_init.c index c2490f196ef..cfc3644a1bf 100644 --- a/src/vnet/ip/ip_init.c +++ b/src/vnet/ip/ip_init.c @@ -38,6 +38,9 @@ */ #include <vnet/ip/ip.h> +#include <vnet/ip/ip4_mtrie.h> +#include <vnet/fib/fib_entry.h> +#include <vnet/dpo/load_balance.h> ip_main_t ip_main; @@ -112,6 +115,39 @@ VLIB_INIT_FUNCTION (ip_main_init) = { "flow_classify_init"), }; +static clib_error_t * +ip_config_init (vlib_main_t *vm, unformat_input_t *input) +{ + uword lbsz = 0, fibentrysz = 0, mtriesz = 0; + + while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (input, "load-balance-pool-size %U", unformat_memory_size, + &lbsz)) + ; + else if (unformat (input, "fib-entry-pool-size %U", unformat_memory_size, + &fibentrysz)) + ; + else if (unformat (input, "ip4-mtrie-pool-size %U", unformat_memory_size, + &mtriesz)) + ; + else + return clib_error_return (0, "unknown input `%U'", + format_unformat_error, input); + } + + if (lbsz) + load_balance_pool_alloc (lbsz); + if (fibentrysz) + fib_entry_pool_alloc (fibentrysz); + if (mtriesz) + ip4_mtrie_pool_alloc (mtriesz); + + return 0; +} + +VLIB_CONFIG_FUNCTION (ip_config_init, "l3fib"); + /* * fd.io coding-style-patch-verification: ON * diff --git a/src/vnet/ipsec/ah_decrypt.c b/src/vnet/ipsec/ah_decrypt.c index 6b62ff7f05c..30ea4429a75 100644 --- a/src/vnet/ipsec/ah_decrypt.c +++ b/src/vnet/ipsec/ah_decrypt.c @@ -202,16 +202,8 @@ ah_decrypt_inline (vlib_main_t * vm, pd->seq = clib_host_to_net_u32 (ah0->seq_no); /* anti-replay check */ - if (PREDICT_FALSE (irt->anti_reply_huge)) - { - anti_replay_result = ipsec_sa_anti_replay_and_sn_advance ( - irt, pd->seq, ~0, false, &pd->seq_hi, true); - } - else - { - anti_replay_result = ipsec_sa_anti_replay_and_sn_advance ( - irt, pd->seq, ~0, false, &pd->seq_hi, false); - } + anti_replay_result = ipsec_sa_anti_replay_and_sn_advance ( + irt, pd->seq, ~0, false, &pd->seq_hi); if (anti_replay_result) { ah_decrypt_set_next_index (b[0], node, vm->thread_index, @@ -317,32 +309,16 @@ ah_decrypt_inline (vlib_main_t * vm, if (PREDICT_TRUE (irt->integ_icv_size)) { /* redo the anti-reply check. see esp_decrypt for details */ - if (PREDICT_FALSE (irt->anti_reply_huge)) + if (ipsec_sa_anti_replay_and_sn_advance (irt, pd->seq, pd->seq_hi, + true, NULL)) { - if (ipsec_sa_anti_replay_and_sn_advance ( - irt, pd->seq, pd->seq_hi, true, NULL, true)) - { - ah_decrypt_set_next_index ( - b[0], node, vm->thread_index, AH_DECRYPT_ERROR_REPLAY, 0, - next, AH_DECRYPT_NEXT_DROP, pd->sa_index); - goto trace; - } - n_lost = ipsec_sa_anti_replay_advance ( - irt, thread_index, pd->seq, pd->seq_hi, true); - } - else - { - if (ipsec_sa_anti_replay_and_sn_advance ( - irt, pd->seq, pd->seq_hi, true, NULL, false)) - { - ah_decrypt_set_next_index ( - b[0], node, vm->thread_index, AH_DECRYPT_ERROR_REPLAY, 0, - next, AH_DECRYPT_NEXT_DROP, pd->sa_index); - goto trace; - } - n_lost = ipsec_sa_anti_replay_advance ( - irt, thread_index, pd->seq, pd->seq_hi, false); + ah_decrypt_set_next_index (b[0], node, vm->thread_index, + AH_DECRYPT_ERROR_REPLAY, 0, next, + AH_DECRYPT_NEXT_DROP, pd->sa_index); + goto trace; } + n_lost = ipsec_sa_anti_replay_advance (irt, thread_index, pd->seq, + pd->seq_hi); vlib_prefetch_simple_counter ( &ipsec_sa_err_counters[IPSEC_SA_ERROR_LOST], thread_index, pd->sa_index); diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c index 345a60a7fdd..928f1b06f9b 100644 --- a/src/vnet/ipsec/esp_decrypt.c +++ b/src/vnet/ipsec/esp_decrypt.c @@ -60,8 +60,7 @@ typedef enum typedef struct { u32 seq; - u32 sa_seq; - u32 sa_seq_hi; + u64 sa_seq64; u32 pkt_seq_hi; ipsec_crypto_alg_t crypto_alg; ipsec_integ_alg_t integ_alg; @@ -81,10 +80,10 @@ format_esp_decrypt_trace (u8 * s, va_list * args) esp_decrypt_trace_t *t = va_arg (*args, esp_decrypt_trace_t *); s = format (s, - "esp: crypto %U integrity %U pkt-seq %d sa-seq %u sa-seq-hi %u " + "esp: crypto %U integrity %U pkt-seq %d sa-seq %lu " "pkt-seq-hi %u", format_ipsec_crypto_alg, t->crypto_alg, format_ipsec_integ_alg, - t->integ_alg, t->seq, t->sa_seq, t->sa_seq_hi, t->pkt_seq_hi); + t->integ_alg, t->seq, t->sa_seq64, t->pkt_seq_hi); return s; } @@ -810,32 +809,16 @@ esp_decrypt_post_crypto (vlib_main_t *vm, vlib_node_runtime_t *node, * a sequence s, s+1, s+2, s+3, ... s+n and nothing will prevent any * implementation, sequential or batching, from decrypting these. */ - if (PREDICT_FALSE (irt->anti_reply_huge)) + if (ipsec_sa_anti_replay_and_sn_advance (irt, pd->seq, pd->seq_hi, true, + NULL)) { - if (ipsec_sa_anti_replay_and_sn_advance (irt, pd->seq, pd->seq_hi, true, - NULL, true)) - { - esp_decrypt_set_next_index (b, node, vm->thread_index, - ESP_DECRYPT_ERROR_REPLAY, 0, next, - ESP_DECRYPT_NEXT_DROP, pd->sa_index); - return; - } - n_lost = ipsec_sa_anti_replay_advance (irt, vm->thread_index, pd->seq, - pd->seq_hi, true); - } - else - { - if (ipsec_sa_anti_replay_and_sn_advance (irt, pd->seq, pd->seq_hi, true, - NULL, false)) - { - esp_decrypt_set_next_index (b, node, vm->thread_index, - ESP_DECRYPT_ERROR_REPLAY, 0, next, - ESP_DECRYPT_NEXT_DROP, pd->sa_index); - return; - } - n_lost = ipsec_sa_anti_replay_advance (irt, vm->thread_index, pd->seq, - pd->seq_hi, false); + esp_decrypt_set_next_index (b, node, vm->thread_index, + ESP_DECRYPT_ERROR_REPLAY, 0, next, + ESP_DECRYPT_NEXT_DROP, pd->sa_index); + return; } + n_lost = + ipsec_sa_anti_replay_advance (irt, vm->thread_index, pd->seq, pd->seq_hi); vlib_prefetch_simple_counter (&ipsec_sa_err_counters[IPSEC_SA_ERROR_LOST], vm->thread_index, pd->sa_index); @@ -1205,16 +1188,8 @@ esp_decrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, pd->current_length = b[0]->current_length; /* anti-reply check */ - if (PREDICT_FALSE (irt->anti_reply_huge)) - { - anti_replay_result = ipsec_sa_anti_replay_and_sn_advance ( - irt, pd->seq, ~0, false, &pd->seq_hi, true); - } - else - { - anti_replay_result = ipsec_sa_anti_replay_and_sn_advance ( - irt, pd->seq, ~0, false, &pd->seq_hi, false); - } + anti_replay_result = ipsec_sa_anti_replay_and_sn_advance ( + irt, pd->seq, ~0, false, &pd->seq_hi); if (anti_replay_result) { @@ -1393,8 +1368,7 @@ esp_decrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, tr->crypto_alg = sa->crypto_alg; tr->integ_alg = sa->integ_alg; tr->seq = pd->seq; - tr->sa_seq = irt->seq; - tr->sa_seq_hi = irt->seq_hi; + tr->sa_seq64 = irt->seq64; tr->pkt_seq_hi = pd->seq_hi; } @@ -1466,8 +1440,7 @@ esp_decrypt_post_inline (vlib_main_t * vm, tr->crypto_alg = sa->crypto_alg; tr->integ_alg = sa->integ_alg; tr->seq = pd->seq; - tr->sa_seq = irt->seq; - tr->sa_seq_hi = irt->seq_hi; + tr->sa_seq64 = irt->seq64; } n_left--; diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index 262a8cb8c88..d27e9827074 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -44,11 +44,9 @@ static inline u64 ipsec_sa_get_inb_seq (ipsec_sa_t *sa) { ipsec_sa_inb_rt_t *irt = ipsec_sa_get_inb_rt (sa); - u64 seq; - - seq = irt->seq; - if (ipsec_sa_is_set_USE_ESN (sa)) - seq |= (u64) irt->seq_hi << 32; + u64 seq = irt->seq64; + if (!ipsec_sa_is_set_USE_ESN (sa)) + seq = (u32) seq; return seq; } @@ -1361,7 +1359,7 @@ send_ipsec_sa_v5_details (ipsec_sa_t *sa, void *arg) mp->replay_window = clib_host_to_net_u64 (ipsec_sa_anti_replay_get_64b_window (irt)); mp->entry.anti_replay_window_size = - clib_host_to_net_u32 (IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE (irt)); + clib_host_to_net_u32 (irt->anti_replay_window_size); } if (ort) diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c index 0bbdc85aaed..e27892185e7 100644 --- a/src/vnet/ipsec/ipsec_format.c +++ b/src/vnet/ipsec/ipsec_format.c @@ -474,13 +474,12 @@ format_ipsec_sa (u8 * s, va_list * args) if (ort) s = format (s, "\n outbound thread-index:%d", ort->thread_index); if (irt) - s = format (s, "\n inbound seq %u seq-hi %u", irt->seq, irt->seq_hi); + s = format (s, "\n inbound seq %lu", irt->seq64); if (ort) s = format (s, "\n outbound seq %lu", ort->seq64); if (irt) { - s = format (s, "\n window-size: %llu", - IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE (irt)); + s = format (s, "\n window-size: %llu", irt->anti_replay_window_size); s = format (s, "\n window: Bl <- %U Tl", format_ipsec_replay_window, ipsec_sa_anti_replay_get_64b_window (irt)); } diff --git a/src/vnet/ipsec/ipsec_input.c b/src/vnet/ipsec/ipsec_input.c index 6a25f6c583c..a7c7482a125 100644 --- a/src/vnet/ipsec/ipsec_input.c +++ b/src/vnet/ipsec/ipsec_input.c @@ -211,6 +211,39 @@ ipsec_input_policy_match (ipsec_spd_t *spd, u32 sa, u32 da, return 0; } +always_inline uword +ip6_addr_match_range (ip6_address_t *a, ip6_address_t *la, ip6_address_t *ua) +{ + if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) && + (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0)) + return 1; + + return 0; +} + +always_inline ipsec_policy_t * +ipsec6_input_policy_match (ipsec_spd_t *spd, ip6_address_t *sa, + ip6_address_t *da, + ipsec_spd_policy_type_t policy_type) +{ + ipsec_main_t *im = &ipsec_main; + ipsec_policy_t *p; + u32 *i; + + vec_foreach (i, spd->policies[policy_type]) + { + p = pool_elt_at_index (im->policies, *i); + + if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6)) + continue; + + if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6)) + continue; + return p; + } + return 0; +} + always_inline ipsec_policy_t * ipsec_input_protect_policy_match (ipsec_spd_t *spd, u32 sa, u32 da, u32 spi) { @@ -263,16 +296,6 @@ ipsec_input_protect_policy_match (ipsec_spd_t *spd, u32 sa, u32 da, u32 spi) return 0; } -always_inline uword -ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la, - ip6_address_t * ua) -{ - if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) && - (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0)) - return 1; - return 0; -} - always_inline void ipsec_collect_ah_trace (vlib_buffer_t **b, vlib_node_runtime_t *node, vlib_main_t *vm, ip4_header_t *ip0, ah_header_t *ah0, @@ -514,7 +537,7 @@ udp_or_esp: has_space0 = vlib_buffer_has_space (b[0], (clib_address_t) (esp0 + 1) - (clib_address_t) ip0); - if (PREDICT_TRUE ((p0 != NULL) & (has_space0))) + if (PREDICT_TRUE ((p0 != NULL) && (has_space0))) { *ipsec_matched += 1; @@ -740,8 +763,6 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm, spd0, b, node, &ipsec_bypassed, &ipsec_dropped, &ipsec_matched, &ipsec_unprocessed, next); - if (ipsec_bypassed > 0) - goto ipsec_bypassed; } } else if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)) @@ -751,8 +772,6 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm, spd0, b, node, &ipsec_bypassed, &ipsec_dropped, &ipsec_matched, &ipsec_unprocessed, next); - if (ipsec_bypassed > 0) - goto ipsec_bypassed; } else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH) { @@ -764,7 +783,6 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm, } else { - ipsec_bypassed: ipsec_unprocessed += 1; } n_left_from -= 1; @@ -813,6 +831,142 @@ VLIB_REGISTER_NODE (ipsec4_input_node) = { extern vlib_node_registration_t ipsec6_input_node; +always_inline void +ipsec6_esp_packet_process (vlib_main_t *vm, ipsec_main_t *im, + ip6_header_t *ip0, esp_header_t *esp0, + u32 thread_index, ipsec_spd_t *spd0, + vlib_buffer_t **b, vlib_node_runtime_t *node, + u64 *ipsec_bypassed, u64 *ipsec_dropped, + u64 *ipsec_matched, u64 *ipsec_unprocessed, + u32 *next) + +{ + ipsec_policy_t *p0 = NULL; + u32 pi0 = ~0; + u8 has_space0 = 0; + ipsec_policy_t *policies[1]; + ipsec_fp_5tuple_t tuples[1]; + bool ip_v6 = true; + + if (im->fp_spd_ipv6_in_is_enabled && + PREDICT_TRUE (INDEX_INVALID != spd0->fp_spd.ip6_in_lookup_hash_idx)) + ipsec_fp_in_5tuple_from_ip6_range ( + &tuples[0], &ip0->src_address, &ip0->dst_address, + clib_net_to_host_u32 (esp0->spi), IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT); + + if (esp0->spi != 0) + { + if (im->fp_spd_ipv6_in_is_enabled && + PREDICT_TRUE (INDEX_INVALID != spd0->fp_spd.ip6_in_lookup_hash_idx)) + { + ipsec_fp_in_policy_match_n (&spd0->fp_spd, ip_v6, tuples, policies, + 1); + p0 = policies[0]; + } + else /* linear search if fast path is not enabled */ + { + p0 = ipsec6_input_protect_policy_match ( + spd0, &ip0->src_address, &ip0->dst_address, + clib_net_to_host_u32 (esp0->spi)); + } + has_space0 = vlib_buffer_has_space (b[0], (clib_address_t) (esp0 + 1) - + (clib_address_t) ip0); + + if (PREDICT_TRUE ((p0 != NULL) && (has_space0))) + { + *ipsec_matched += 1; + + pi0 = p0 - im->policies; + vlib_increment_combined_counter ( + &ipsec_spd_policy_counters, thread_index, pi0, 1, + clib_net_to_host_u16 (ip0->payload_length)); + + vnet_buffer (b[0])->ipsec.sad_index = p0->sa_index; + next[0] = im->esp6_decrypt_next_index; + vlib_buffer_advance (b[0], ((u8 *) esp0 - (u8 *) ip0)); + goto trace0; + } + } + + if (im->fp_spd_ipv6_in_is_enabled && + PREDICT_TRUE (INDEX_INVALID != spd0->fp_spd.ip6_in_lookup_hash_idx)) + { + tuples->action = IPSEC_SPD_POLICY_IP6_INBOUND_BYPASS; + ipsec_fp_in_policy_match_n (&spd0->fp_spd, ip_v6, tuples, policies, 1); + p0 = policies[0]; + } + else + { + p0 = + ipsec6_input_policy_match (spd0, &ip0->src_address, &ip0->dst_address, + IPSEC_SPD_POLICY_IP6_INBOUND_BYPASS); + } + + if (PREDICT_TRUE ((p0 != NULL))) + { + *ipsec_bypassed += 1; + + pi0 = p0 - im->policies; + vlib_increment_combined_counter ( + &ipsec_spd_policy_counters, thread_index, pi0, 1, + clib_net_to_host_u16 (ip0->payload_length)); + goto trace0; + } + else + { + p0 = NULL; + pi0 = ~0; + } + + if (im->fp_spd_ipv6_in_is_enabled && + PREDICT_TRUE (INDEX_INVALID != spd0->fp_spd.ip6_in_lookup_hash_idx)) + { + tuples->action = IPSEC_SPD_POLICY_IP6_INBOUND_DISCARD; + ipsec_fp_in_policy_match_n (&spd0->fp_spd, ip_v6, tuples, policies, 1); + p0 = policies[0]; + } + else + { + p0 = + ipsec6_input_policy_match (spd0, &ip0->src_address, &ip0->dst_address, + IPSEC_SPD_POLICY_IP6_INBOUND_DISCARD); + } + + if (PREDICT_TRUE ((p0 != NULL))) + { + *ipsec_dropped += 1; + + pi0 = p0 - im->policies; + vlib_increment_combined_counter ( + &ipsec_spd_policy_counters, thread_index, pi0, 1, + clib_net_to_host_u16 (ip0->payload_length)); + next[0] = IPSEC_INPUT_NEXT_DROP; + goto trace0; + } + else + { + p0 = 0; + pi0 = ~0; + } + + /* Drop by default if no match on PROTECT, BYPASS or DISCARD */ + *ipsec_unprocessed += 1; + next[0] = IPSEC_INPUT_NEXT_DROP; + +trace0: + if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) && + PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED)) + { + ipsec_input_trace_t *tr = vlib_add_trace (vm, node, b[0], sizeof (*tr)); + + tr->proto = ip0->protocol; + tr->sa_id = p0 ? p0->sa_id : ~0; + tr->spi = has_space0 ? clib_net_to_host_u32 (esp0->spi) : ~0; + tr->seq = has_space0 ? clib_net_to_host_u32 (esp0->seq) : ~0; + tr->spd = spd0->id; + tr->policy_index = pi0; + } +} VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm, vlib_node_runtime_t * node, @@ -822,9 +976,6 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm, ipsec_main_t *im = &ipsec_main; u32 ipsec_unprocessed = 0; u32 ipsec_matched = 0; - ipsec_policy_t *policies[1]; - ipsec_fp_5tuple_t tuples[1]; - bool ip_v6 = true; from = vlib_frame_vector_args (from_frame); n_left_from = from_frame->n_vectors; @@ -843,12 +994,13 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm, u32 bi0, next0, pi0 = ~0; vlib_buffer_t *b0; ip6_header_t *ip0; - esp_header_t *esp0; + esp_header_t *esp0 = NULL; ip4_ipsec_config_t *c0; ipsec_spd_t *spd0; ipsec_policy_t *p0 = 0; - ah_header_t *ah0; u32 header_size = sizeof (ip0[0]); + u64 ipsec_unprocessed = 0, ipsec_matched = 0; + u64 ipsec_dropped = 0, ipsec_bypassed = 0; bi0 = to_next[0] = from[0]; from += 1; @@ -864,113 +1016,76 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm, spd0 = pool_elt_at_index (im->spds, c0->spd_index); ip0 = vlib_buffer_get_current (b0); + + if (ip0->protocol == IP_PROTOCOL_UDP) + { + udp_header_t *udp0 = (udp_header_t *) ((u8 *) ip0 + header_size); + + /* RFC5996 Section 2.23: "Port 4500 is reserved for + * UDP-encapsulated ESP and IKE." + * RFC5996 Section 3.1: "IKE messages use UDP ports 500 and/or + 4500" + */ + if ((clib_host_to_net_u16 (500) == udp0->dst_port) || + (clib_host_to_net_u16 (4500) == udp0->dst_port)) + esp0 = (esp_header_t *) ((u8 *) udp0 + sizeof (udp_header_t)); + } + else if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP) esp0 = (esp_header_t *) ((u8 *) ip0 + header_size); - ah0 = (ah_header_t *) ((u8 *) ip0 + header_size); - if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)) - { -#if 0 - clib_warning - ("packet received from %U to %U spi %u size %u spd_id %u", - format_ip6_address, &ip0->src_address, format_ip6_address, - &ip0->dst_address, clib_net_to_host_u32 (esp0->spi), - clib_net_to_host_u16 (ip0->payload_length) + header_size, - spd0->id); -#endif - if (im->fp_spd_ipv6_in_is_enabled && - PREDICT_TRUE (INDEX_INVALID != - spd0->fp_spd.ip6_in_lookup_hash_idx)) - { - ipsec_fp_in_5tuple_from_ip6_range ( - &tuples[0], &ip0->src_address, &ip0->dst_address, - clib_net_to_host_u32 (esp0->spi), - IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT); - ipsec_fp_in_policy_match_n (&spd0->fp_spd, ip_v6, tuples, - policies, 1); - p0 = policies[0]; - } - else - p0 = ipsec6_input_protect_policy_match ( - spd0, &ip0->src_address, &ip0->dst_address, - clib_net_to_host_u32 (esp0->spi)); - - if (PREDICT_TRUE (p0 != 0)) - { - ipsec_matched += 1; - - pi0 = p0 - im->policies; - vlib_increment_combined_counter - (&ipsec_spd_policy_counters, - thread_index, pi0, 1, - clib_net_to_host_u16 (ip0->payload_length) + - header_size); - - vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; - next0 = im->esp6_decrypt_next_index; - vlib_buffer_advance (b0, header_size); - /* TODO Add policy matching for bypass and discard policy - * type */ - goto trace0; - } - else - { - pi0 = ~0; - ipsec_unprocessed += 1; - next0 = IPSEC_INPUT_NEXT_DROP; - } - } + if (esp0 != NULL) + { + ipsec6_esp_packet_process (vm, im, ip0, esp0, thread_index, spd0, + &b0, node, &ipsec_bypassed, + &ipsec_dropped, &ipsec_matched, + &ipsec_unprocessed, &next0); + } else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH) { - p0 = ipsec6_input_protect_policy_match (spd0, - &ip0->src_address, - &ip0->dst_address, - clib_net_to_host_u32 - (ah0->spi)); - - if (PREDICT_TRUE (p0 != 0)) - { - ipsec_matched += 1; - pi0 = p0 - im->policies; - vlib_increment_combined_counter - (&ipsec_spd_policy_counters, - thread_index, pi0, 1, - clib_net_to_host_u16 (ip0->payload_length) + - header_size); - - vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; - next0 = im->ah6_decrypt_next_index; - goto trace0; - } - else - { - pi0 = ~0; - ipsec_unprocessed += 1; - next0 = IPSEC_INPUT_NEXT_DROP; - } + ah_header_t *ah0 = (ah_header_t *) ((u8 *) ip0 + header_size); + + p0 = ipsec6_input_protect_policy_match ( + spd0, &ip0->src_address, &ip0->dst_address, + clib_net_to_host_u32 (ah0->spi)); + + if (PREDICT_TRUE (p0 != 0)) + { + ipsec_matched += 1; + pi0 = p0 - im->policies; + vlib_increment_combined_counter ( + &ipsec_spd_policy_counters, thread_index, pi0, 1, + clib_net_to_host_u16 (ip0->payload_length) + header_size); + + vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; + next0 = im->ah6_decrypt_next_index; + if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) && + PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) + { + ipsec_input_trace_t *tr = + vlib_add_trace (vm, node, b0, sizeof (*tr)); + + if (p0) + { + tr->sa_id = p0->sa_id; + tr->policy_type = p0->type; + } + + tr->proto = ip0->protocol; + tr->spi = clib_net_to_host_u32 (ah0->spi); + tr->spd = spd0->id; + tr->policy_index = pi0; + } + } + else + { + pi0 = ~0; + ipsec_unprocessed += 1; + next0 = IPSEC_INPUT_NEXT_DROP; + } } else { - ipsec_unprocessed += 1; - } - - trace0: - if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) && - PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) - { - ipsec_input_trace_t *tr = - vlib_add_trace (vm, node, b0, sizeof (*tr)); - - if (p0) - { - tr->sa_id = p0->sa_id; - tr->policy_type = p0->type; - } - - tr->proto = ip0->protocol; - tr->spi = clib_net_to_host_u32 (esp0->spi); - tr->seq = clib_net_to_host_u32 (esp0->seq); - tr->spd = spd0->id; - tr->policy_index = pi0; + ipsec_unprocessed += 1; } vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c index eb4270ac2b4..ec281cd9a11 100644 --- a/src/vnet/ipsec/ipsec_sa.c +++ b/src/vnet/ipsec/ipsec_sa.c @@ -214,7 +214,6 @@ ipsec_sa_init_runtime (ipsec_sa_t *sa) if (ipsec_sa_get_inb_rt (sa)) { ipsec_sa_inb_rt_t *irt = ipsec_sa_get_inb_rt (sa); - irt->anti_reply_huge = ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa); irt->use_anti_replay = ipsec_sa_is_set_USE_ANTI_REPLAY (sa); irt->use_esn = ipsec_sa_is_set_USE_ESN (sa); irt->is_tunnel = ipsec_sa_is_set_IS_TUNNEL (sa); @@ -426,7 +425,8 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, ipsec_sa_outb_rt_t *ort; clib_error_t *err; ipsec_sa_t *sa; - u32 sa_index; + u32 sa_index, irt_sz; + u16 thread_index = (vlib_num_workers ()) ? ~0 : 0; u64 rand[2]; uword *p; int rv; @@ -440,17 +440,35 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, pool_get_aligned_zero (im->sa_pool, sa, CLIB_CACHE_LINE_BYTES); sa_index = sa - im->sa_pool; + sa->flags = flags; + + if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) && anti_replay_window_size > 64) + /* window size rounded up to next power of 2 */ + anti_replay_window_size = 1 << max_log2 (anti_replay_window_size); + else + anti_replay_window_size = 64; + vec_validate (im->inb_sa_runtimes, sa_index); vec_validate (im->outb_sa_runtimes, sa_index); - irt = clib_mem_alloc_aligned (sizeof (ipsec_sa_inb_rt_t), - _Alignof (ipsec_sa_inb_rt_t)); + irt_sz = sizeof (ipsec_sa_inb_rt_t); + irt_sz += anti_replay_window_size / 8; + irt_sz = round_pow2 (irt_sz, CLIB_CACHE_LINE_BYTES); + + irt = clib_mem_alloc_aligned (irt_sz, alignof (ipsec_sa_inb_rt_t)); ort = clib_mem_alloc_aligned (sizeof (ipsec_sa_outb_rt_t), - _Alignof (ipsec_sa_outb_rt_t)); + alignof (ipsec_sa_outb_rt_t)); im->inb_sa_runtimes[sa_index] = irt; im->outb_sa_runtimes[sa_index] = ort; - clib_memset (irt, 0, sizeof (ipsec_sa_inb_rt_t)); - clib_memset (ort, 0, sizeof (ipsec_sa_outb_rt_t)); + + *irt = (ipsec_sa_inb_rt_t){ + .thread_index = thread_index, + .anti_replay_window_size = anti_replay_window_size, + }; + + *ort = (ipsec_sa_outb_rt_t){ + .thread_index = thread_index, + }; clib_pcg64i_srandom_r (&ort->iv_prng, rand[0], rand[1]); @@ -470,12 +488,7 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, sa->spi = spi; sa->stat_index = sa_index; sa->protocol = proto; - sa->flags = flags; sa->salt = salt; - if (irt) - irt->thread_index = (vlib_num_workers ()) ? ~0 : 0; - if (ort) - ort->thread_index = (vlib_num_workers ()) ? ~0 : 0; if (integ_alg != IPSEC_INTEG_ALG_NONE) { @@ -485,9 +498,6 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, ipsec_sa_set_crypto_alg (sa, crypto_alg); ipsec_sa_set_async_op_ids (sa); - if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) && anti_replay_window_size > 64) - ipsec_sa_set_ANTI_REPLAY_HUGE (sa); - clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key)); if (crypto_alg != IPSEC_CRYPTO_ALG_NONE) @@ -600,17 +610,8 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, ipsec_register_udp_port (dst_port, !ipsec_sa_is_set_IS_TUNNEL_V6 (sa)); } - /* window size rounded up to next power of 2 */ - if (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa)) - { - anti_replay_window_size = 1 << max_log2 (anti_replay_window_size); - irt->replay_window_huge = - clib_bitmap_set_region (0, 0, 1, anti_replay_window_size); - } - else - { - irt->replay_window = ~0; - } + for (u32 i = 0; i < anti_replay_window_size / uword_bits; i++) + irt->replay_window[i] = ~0ULL; hash_set (im->sa_index_by_sa_id, sa->id, sa_index); @@ -651,9 +652,6 @@ ipsec_sa_del (ipsec_sa_t * sa) vnet_crypto_key_del (vm, sa->crypto_sync_key_index); if (sa->integ_alg != IPSEC_INTEG_ALG_NONE) vnet_crypto_key_del (vm, sa->integ_sync_key_index); - if (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa)) - if (irt && irt->replay_window_huge) - clib_bitmap_free (irt->replay_window_huge); foreach_pointer (p, irt, ort) if (p) clib_mem_free (p); diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h index ce2964a9493..9d8c90bab41 100644 --- a/src/vnet/ipsec/ipsec_sa.h +++ b/src/vnet/ipsec/ipsec_sa.h @@ -100,8 +100,7 @@ typedef struct ipsec_key_t_ _ (32, IS_PROTECT, "Protect") \ _ (64, IS_INBOUND, "inbound") \ _ (512, IS_ASYNC, "async") \ - _ (1024, NO_ALGO_NO_DROP, "no-algo-no-drop") \ - _ (4096, ANTI_REPLAY_HUGE, "anti-replay-huge") + _ (1024, NO_ALGO_NO_DROP, "no-algo-no-drop") typedef enum ipsec_sad_flags_t_ { @@ -149,7 +148,6 @@ typedef struct u16 is_null_gmac : 1; u16 use_esn : 1; u16 use_anti_replay : 1; - u16 anti_reply_huge : 1; u16 is_protect : 1; u16 is_tunnel : 1; u16 is_transport : 1; @@ -161,16 +159,12 @@ typedef struct u8 udp_sz; u16 thread_index; u32 salt; - u32 seq; - u32 seq_hi; + u64 seq64; u16 async_op_id; vnet_crypto_key_index_t cipher_key_index; vnet_crypto_key_index_t integ_key_index; - union - { - u64 replay_window; - clib_bitmap_t *replay_window_huge; - }; + u32 anti_replay_window_size; + uword replay_window[]; } ipsec_sa_inb_rt_t; typedef struct @@ -186,20 +180,20 @@ typedef struct u16 use_anti_replay : 1; u16 drop_no_crypto : 1; u16 is_async : 1; - clib_pcg64i_random_t iv_prng; u16 cipher_op_id; u16 integ_op_id; u8 cipher_iv_size; u8 esp_block_align; u8 integ_icv_size; + ip_dscp_t t_dscp; + tunnel_encap_decap_flags_t tunnel_flags; u16 thread_index; + u16 async_op_id; u32 salt; - u64 seq64; u32 spi_be; - ip_dscp_t t_dscp; + u64 seq64; dpo_id_t dpo; - tunnel_encap_decap_flags_t tunnel_flags; - u16 async_op_id; + clib_pcg64i_random_t iv_prng; vnet_crypto_key_index_t cipher_key_index; vnet_crypto_key_index_t integ_key_index; union @@ -332,86 +326,35 @@ extern uword unformat_ipsec_key (unformat_input_t *input, va_list *args); #define IPSEC_UDP_PORT_NONE ((u16) ~0) -/* - * Anti Replay definitions - */ - -#define IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE(_irt) \ - (u32) (PREDICT_FALSE (_irt->anti_reply_huge) ? \ - clib_bitmap_bytes (_irt->replay_window_huge) * 8 : \ - BITS (_irt->replay_window)) - -#define IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE_KNOWN_WIN(_irt, _is_huge) \ - (u32) (_is_huge ? clib_bitmap_bytes (_irt->replay_window_huge) * 8 : \ - BITS (_irt->replay_window)) - -#define IPSEC_SA_ANTI_REPLAY_WINDOW_N_SEEN(_irt) \ - (u64) (PREDICT_FALSE (_irt->anti_reply_huge) ? \ - clib_bitmap_count_set_bits (_irt->replay_window_huge) : \ - count_set_bits (_irt->replay_window)) - -#define IPSEC_SA_ANTI_REPLAY_WINDOW_N_SEEN_KNOWN_WIN(_irt, _is_huge) \ - (u64) (_is_huge ? clib_bitmap_count_set_bits (_irt->replay_window_huge) : \ - count_set_bits (_irt->replay_window)) - -#define IPSEC_SA_ANTI_REPLAY_WINDOW_MAX_INDEX(_irt) \ - (u32) (IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE (_irt) - 1) - -#define IPSEC_SA_ANTI_REPLAY_WINDOW_MAX_INDEX_KNOWN_WIN(_irt, _is_huge) \ - (u32) (IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE (_irt, _is_huge) - 1) - -/* - * sequence number less than the lower bound are outside of the window - * From RFC4303 Appendix A: - * Bl = Tl - W + 1 - */ -#define IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND(_sa) \ - (u32) (_sa->seq - IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE (_sa) + 1) - -#define IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND_KNOWN_WIN(_sa, _is_huge) \ - (u32) (_sa->seq - \ - IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE_KNOWN_WIN (_sa, _is_huge) + 1) - always_inline u64 ipsec_sa_anti_replay_get_64b_window (const ipsec_sa_inb_rt_t *irt) { - if (!irt->anti_reply_huge) - return irt->replay_window; - u64 w; - u32 window_size = IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE (irt); - u32 tl_win_index = irt->seq & (window_size - 1); + u32 window_size = irt->anti_replay_window_size; + u32 tl_win_index = irt->seq64 & (window_size - 1); + uword *bmp = (uword *) irt->replay_window; if (PREDICT_TRUE (tl_win_index >= 63)) - return clib_bitmap_get_multiple (irt->replay_window_huge, - tl_win_index - 63, 64); + return uword_bitmap_get_multiple (bmp, tl_win_index - 63, 64); - w = clib_bitmap_get_multiple_no_check (irt->replay_window_huge, 0, - tl_win_index + 1) + w = uword_bitmap_get_multiple_no_check (bmp, 0, tl_win_index + 1) << (63 - tl_win_index); - w |= clib_bitmap_get_multiple_no_check (irt->replay_window_huge, - window_size - 63 + tl_win_index, - 63 - tl_win_index); + w |= uword_bitmap_get_multiple_no_check ( + bmp, window_size - 63 + tl_win_index, 63 - tl_win_index); return w; } always_inline int -ipsec_sa_anti_replay_check (const ipsec_sa_inb_rt_t *irt, u32 seq, - bool ar_huge) +ipsec_sa_anti_replay_check (const ipsec_sa_inb_rt_t *irt, u32 window_size, + u32 seq) { - u32 window_size = IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE_KNOWN_WIN (irt, ar_huge); - /* we assume that the packet is in the window. * if the packet falls left (sa->seq - seq >= window size), * the result is wrong */ - if (ar_huge) - return clib_bitmap_get (irt->replay_window_huge, seq & (window_size - 1)); - else - return (irt->replay_window >> (window_size + seq - irt->seq - 1)) & 1; - - return 0; + return uword_bitmap_is_bit_set ((uword *) irt->replay_window, + seq & (window_size - 1)); } /* @@ -431,13 +374,14 @@ ipsec_sa_anti_replay_check (const ipsec_sa_inb_rt_t *irt, u32 seq, always_inline int ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, u32 hi_seq_used, bool post_decrypt, - u32 *hi_seq_req, bool ar_huge) + u32 *hi_seq_req) { ASSERT ((post_decrypt == false) == (hi_seq_req != 0)); - u32 window_size = IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE_KNOWN_WIN (irt, ar_huge); - u32 window_lower_bound = - IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND_KNOWN_WIN (irt, ar_huge); + u32 window_size = irt->anti_replay_window_size; + u32 exp_lo = irt->seq64; + u32 exp_hi = irt->seq64 >> 32; + u32 window_lower_bound = exp_lo - window_size + 1; if (!irt->use_esn) { @@ -448,14 +392,14 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, if (!irt->use_anti_replay) return 0; - if (PREDICT_TRUE (seq > irt->seq)) + if (PREDICT_TRUE (seq > exp_lo)) return 0; /* does the packet fall out on the left of the window */ - if (irt->seq >= seq + window_size) + if (exp_lo >= seq + window_size) return 1; - return ipsec_sa_anti_replay_check (irt, seq, ar_huge); + return ipsec_sa_anti_replay_check (irt, window_size, seq); } if (!irt->use_anti_replay) @@ -473,20 +417,20 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, */ if (hi_seq_req) { - if (seq >= irt->seq) + if (seq >= exp_lo) /* The packet's sequence number is larger that the SA's. * that can't be a warp - unless we lost more than * 2^32 packets ... how could we know? */ - *hi_seq_req = irt->seq_hi; + *hi_seq_req = exp_hi; else { /* The packet's SN is less than the SAs, so either the SN has * wrapped or the SN is just old. */ - if (irt->seq - seq > (1 << 30)) + if (exp_lo - seq > (1 << 30)) /* It's really really really old => it wrapped */ - *hi_seq_req = irt->seq_hi + 1; + *hi_seq_req = exp_hi + 1; else - *hi_seq_req = irt->seq_hi; + *hi_seq_req = exp_hi; } } /* @@ -496,7 +440,7 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, return 0; } - if (PREDICT_TRUE (window_size > 0 && irt->seq >= window_size - 1)) + if (PREDICT_TRUE (exp_lo >= window_size - 1)) { /* * the last sequence number VPP received is more than one @@ -513,7 +457,7 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, */ if (post_decrypt) { - if (hi_seq_used == irt->seq_hi) + if (hi_seq_used == exp_hi) /* the high sequence number used to succesfully decrypt this * packet is the same as the last-sequence number of the SA. * that means this packet did not cause a wrap. @@ -530,7 +474,7 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, /* pre-decrypt it might be the packet that causes a wrap, we * need to decrypt it to find out */ if (hi_seq_req) - *hi_seq_req = irt->seq_hi + 1; + *hi_seq_req = exp_hi + 1; return 0; } } @@ -541,13 +485,13 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, * end of the window. */ if (hi_seq_req) - *hi_seq_req = irt->seq_hi; - if (seq <= irt->seq) + *hi_seq_req = exp_hi; + if (seq <= exp_lo) /* * The received seq number is within bounds of the window * check if it's a duplicate */ - return ipsec_sa_anti_replay_check (irt, seq, ar_huge); + return ipsec_sa_anti_replay_check (irt, window_size, seq); else /* * The received sequence number is greater than the window @@ -572,15 +516,15 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, /* * the sequence number is less than the lower bound. */ - if (seq <= irt->seq) + if (seq <= exp_lo) { /* * the packet is within the window upper bound. * check for duplicates. */ if (hi_seq_req) - *hi_seq_req = irt->seq_hi; - return ipsec_sa_anti_replay_check (irt, seq, ar_huge); + *hi_seq_req = exp_hi; + return ipsec_sa_anti_replay_check (irt, window_size, seq); } else { @@ -594,7 +538,7 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, * we've lost close to 2^32 packets. */ if (hi_seq_req) - *hi_seq_req = irt->seq_hi; + *hi_seq_req = exp_hi; return 0; } } @@ -607,8 +551,8 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, * received packet, the SA has moved on to a higher sequence number. */ if (hi_seq_req) - *hi_seq_req = irt->seq_hi - 1; - return ipsec_sa_anti_replay_check (irt, seq, ar_huge); + *hi_seq_req = exp_hi - 1; + return ipsec_sa_anti_replay_check (irt, window_size, seq); } } @@ -618,121 +562,97 @@ ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_inb_rt_t *irt, u32 seq, } always_inline u32 -ipsec_sa_anti_replay_window_shift (ipsec_sa_inb_rt_t *irt, u32 inc, - bool ar_huge) +ipsec_sa_anti_replay_window_shift (ipsec_sa_inb_rt_t *irt, u32 window_size, + u32 inc) { + uword *window = irt->replay_window; + u32 window_mask = window_size - 1; u32 n_lost = 0; u32 seen = 0; - u32 window_size = IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE_KNOWN_WIN (irt, ar_huge); if (inc < window_size) { - if (ar_huge) - { - /* the number of packets we saw in this section of the window */ - clib_bitmap_t *window = irt->replay_window_huge; - u32 window_lower_bound = (irt->seq + 1) & (window_size - 1); - u32 window_next_lower_bound = - (window_lower_bound + inc) & (window_size - 1); + /* the number of packets we saw in this section of the window */ + u32 window_lower_bound = (irt->seq64 + 1) & window_mask; + u32 window_next_lower_bound = (window_lower_bound + inc) & window_mask; - uword i_block, i_word_start, i_word_end, full_words; - uword n_blocks = window_size >> log2_uword_bits; - uword mask; + uword i_block, i_word_start, i_word_end, full_words; + uword n_blocks = window_size >> log2_uword_bits; + uword mask; - i_block = window_lower_bound >> log2_uword_bits; + i_block = window_lower_bound >> log2_uword_bits; - i_word_start = window_lower_bound & (uword_bits - 1); - i_word_end = window_next_lower_bound & (uword_bits - 1); + i_word_start = window_lower_bound & (uword_bits - 1); + i_word_end = window_next_lower_bound & (uword_bits - 1); - /* We stay in the same word */ - if (i_word_start + inc <= uword_bits) - { - mask = pow2_mask (inc) << i_word_start; - seen += count_set_bits (window[i_block] & mask); - window[i_block] &= ~mask; - } - else + /* We stay in the same word */ + if (i_word_start + inc <= uword_bits) + { + mask = pow2_mask (inc) << i_word_start; + seen += count_set_bits (window[i_block] & mask); + window[i_block] &= ~mask; + } + else + { + full_words = + (inc + i_word_start - uword_bits - i_word_end) >> log2_uword_bits; + + /* count set bits in the first word */ + mask = (uword) ~0 << i_word_start; + seen += count_set_bits (window[i_block] & mask); + window[i_block] &= ~mask; + i_block = (i_block + 1) & (n_blocks - 1); + + /* count set bits in the next full words */ + /* even if the last word need to be fully counted, we treat it + * apart */ + while (full_words >= 8) { - full_words = (inc + i_word_start - uword_bits - i_word_end) >> - log2_uword_bits; - - /* count set bits in the first word */ - mask = (uword) ~0 << i_word_start; - seen += count_set_bits (window[i_block] & mask); - window[i_block] &= ~mask; - i_block = (i_block + 1) & (n_blocks - 1); - - /* count set bits in the next full words */ - /* even if the last word need to be fully counted, we treat it - * apart */ - while (full_words >= 8) + if (full_words >= 16) { - if (full_words >= 16) - { - /* prefect the next 8 blocks (64 bytes) */ - clib_prefetch_store ( - &window[(i_block + 8) & (n_blocks - 1)]); - } - - seen += count_set_bits (window[i_block]); - seen += - count_set_bits (window[(i_block + 1) & (n_blocks - 1)]); - seen += - count_set_bits (window[(i_block + 2) & (n_blocks - 1)]); - seen += - count_set_bits (window[(i_block + 3) & (n_blocks - 1)]); - seen += - count_set_bits (window[(i_block + 4) & (n_blocks - 1)]); - seen += - count_set_bits (window[(i_block + 5) & (n_blocks - 1)]); - seen += - count_set_bits (window[(i_block + 6) & (n_blocks - 1)]); - seen += - count_set_bits (window[(i_block + 7) & (n_blocks - 1)]); - window[i_block] = 0; - window[(i_block + 1) & (n_blocks - 1)] = 0; - window[(i_block + 2) & (n_blocks - 1)] = 0; - window[(i_block + 3) & (n_blocks - 1)] = 0; - window[(i_block + 4) & (n_blocks - 1)] = 0; - window[(i_block + 5) & (n_blocks - 1)] = 0; - window[(i_block + 6) & (n_blocks - 1)] = 0; - window[(i_block + 7) & (n_blocks - 1)] = 0; - - i_block = (i_block + 8) & (n_blocks - 1); - full_words -= 8; - } - while (full_words > 0) - { - // last word is treated after the loop - seen += count_set_bits (window[i_block]); - window[i_block] = 0; - i_block = (i_block + 1) & (n_blocks - 1); - full_words--; + /* prefect the next 8 blocks (64 bytes) */ + clib_prefetch_store ( + &window[(i_block + 8) & (n_blocks - 1)]); } - /* the last word */ - mask = pow2_mask (i_word_end); - seen += count_set_bits (window[i_block] & mask); - window[i_block] &= ~mask; + seen += count_set_bits (window[i_block]); + seen += count_set_bits (window[(i_block + 1) & (n_blocks - 1)]); + seen += count_set_bits (window[(i_block + 2) & (n_blocks - 1)]); + seen += count_set_bits (window[(i_block + 3) & (n_blocks - 1)]); + seen += count_set_bits (window[(i_block + 4) & (n_blocks - 1)]); + seen += count_set_bits (window[(i_block + 5) & (n_blocks - 1)]); + seen += count_set_bits (window[(i_block + 6) & (n_blocks - 1)]); + seen += count_set_bits (window[(i_block + 7) & (n_blocks - 1)]); + window[i_block] = 0; + window[(i_block + 1) & (n_blocks - 1)] = 0; + window[(i_block + 2) & (n_blocks - 1)] = 0; + window[(i_block + 3) & (n_blocks - 1)] = 0; + window[(i_block + 4) & (n_blocks - 1)] = 0; + window[(i_block + 5) & (n_blocks - 1)] = 0; + window[(i_block + 6) & (n_blocks - 1)] = 0; + window[(i_block + 7) & (n_blocks - 1)] = 0; + + i_block = (i_block + 8) & (n_blocks - 1); + full_words -= 8; + } + while (full_words > 0) + { + // last word is treated after the loop + seen += count_set_bits (window[i_block]); + window[i_block] = 0; + i_block = (i_block + 1) & (n_blocks - 1); + full_words--; } - clib_bitmap_set_no_check (window, - (irt->seq + inc) & (window_size - 1), 1); - } - else - { - /* - * count how many holes there are in the portion - * of the window that we will right shift of the end - * as a result of this increments - */ - u64 old = irt->replay_window & pow2_mask (inc); - /* the number of packets we saw in this section of the window */ - seen = count_set_bits (old); - irt->replay_window = - ((irt->replay_window) >> inc) | (1ULL << (window_size - 1)); + /* the last word */ + mask = pow2_mask (i_word_end); + seen += count_set_bits (window[i_block] & mask); + window[i_block] &= ~mask; } + uword_bitmap_set_bits_at_index (window, (irt->seq64 + inc) & window_mask, + 1); + /* * the number we missed is the size of the window section * minus the number we saw. @@ -741,24 +661,17 @@ ipsec_sa_anti_replay_window_shift (ipsec_sa_inb_rt_t *irt, u32 inc, } else { + u32 n_uwords = window_size / uword_bits; /* holes in the replay window are lost packets */ - n_lost = window_size - - IPSEC_SA_ANTI_REPLAY_WINDOW_N_SEEN_KNOWN_WIN (irt, ar_huge); + n_lost = window_size - uword_bitmap_count_set_bits (window, n_uwords); /* any sequence numbers that now fall outside the window * are forever lost */ n_lost += inc - window_size; - if (PREDICT_FALSE (ar_huge)) - { - clib_bitmap_zero (irt->replay_window_huge); - clib_bitmap_set_no_check (irt->replay_window_huge, - (irt->seq + inc) & (window_size - 1), 1); - } - else - { - irt->replay_window = 1ULL << (window_size - 1); - } + uword_bitmap_clear (window, n_uwords); + uword_bitmap_set_bits_at_index (window, (irt->seq64 + inc) & window_mask, + 1); } return n_lost; @@ -775,65 +688,44 @@ ipsec_sa_anti_replay_window_shift (ipsec_sa_inb_rt_t *irt, u32 inc, */ always_inline u64 ipsec_sa_anti_replay_advance (ipsec_sa_inb_rt_t *irt, u32 thread_index, - u32 seq, u32 hi_seq, bool ar_huge) + u32 seq, u32 hi_seq) { u64 n_lost = 0; - u32 window_size = IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE_KNOWN_WIN (irt, ar_huge); + u32 window_size = irt->anti_replay_window_size; + u32 masked_seq = seq & (window_size - 1); + u32 exp_lo = irt->seq64; + u32 exp_hi = irt->seq64 >> 32; u32 pos; if (irt->use_esn) { - int wrap = hi_seq - irt->seq_hi; + int wrap = hi_seq - exp_hi; - if (wrap == 0 && seq > irt->seq) + if (wrap == 0 && seq > exp_lo) { - pos = seq - irt->seq; - n_lost = ipsec_sa_anti_replay_window_shift (irt, pos, ar_huge); - irt->seq = seq; + pos = seq - exp_lo; + n_lost = ipsec_sa_anti_replay_window_shift (irt, window_size, pos); + irt->seq64 = (u64) exp_hi << 32 | seq; } else if (wrap > 0) { - pos = seq + ~irt->seq + 1; - n_lost = ipsec_sa_anti_replay_window_shift (irt, pos, ar_huge); - irt->seq = seq; - irt->seq_hi = hi_seq; - } - else if (wrap < 0) - { - pos = ~seq + irt->seq + 1; - if (ar_huge) - clib_bitmap_set_no_check (irt->replay_window_huge, - seq & (window_size - 1), 1); - else - irt->replay_window |= (1ULL << (window_size - 1 - pos)); + pos = seq + ~exp_lo + 1; + n_lost = ipsec_sa_anti_replay_window_shift (irt, window_size, pos); + irt->seq64 = (u64) hi_seq << 32 | seq; } else - { - pos = irt->seq - seq; - if (ar_huge) - clib_bitmap_set_no_check (irt->replay_window_huge, - seq & (window_size - 1), 1); - else - irt->replay_window |= (1ULL << (window_size - 1 - pos)); - } + uword_bitmap_set_bits_at_index (irt->replay_window, masked_seq, 1); } else { - if (seq > irt->seq) + if (seq > exp_lo) { - pos = seq - irt->seq; - n_lost = ipsec_sa_anti_replay_window_shift (irt, pos, ar_huge); - irt->seq = seq; + pos = seq - exp_lo; + n_lost = ipsec_sa_anti_replay_window_shift (irt, window_size, pos); + irt->seq64 = (u64) exp_hi << 32 | seq; } else - { - pos = irt->seq - seq; - if (ar_huge) - clib_bitmap_set_no_check (irt->replay_window_huge, - seq & (window_size - 1), 1); - else - irt->replay_window |= (1ULL << (window_size - 1 - pos)); - } + uword_bitmap_set_bits_at_index (irt->replay_window, masked_seq, 1); } return n_lost; diff --git a/src/vnet/session/application_interface.c b/src/vnet/session/application_interface.c index a62f914d43a..e2f9a6883fe 100644 --- a/src/vnet/session/application_interface.c +++ b/src/vnet/session/application_interface.c @@ -38,12 +38,12 @@ * */ uword -unformat_vnet_uri (unformat_input_t * input, va_list * args) +unformat_vnet_uri (unformat_input_t *input, va_list *args) { session_endpoint_cfg_t *sep = va_arg (*args, session_endpoint_cfg_t *); u32 transport_proto = 0, port; - if (unformat (input, "%U://%U/%d", unformat_transport_proto, + if (unformat (input, "%U://%U:%d", unformat_transport_proto, &transport_proto, unformat_ip4_address, &sep->ip.ip4, &port)) { sep->transport_proto = transport_proto; @@ -52,6 +52,54 @@ unformat_vnet_uri (unformat_input_t * input, va_list * args) return 1; } else if (unformat (input, "%U://%U/%d", unformat_transport_proto, + &transport_proto, unformat_ip4_address, &sep->ip.ip4, + &port)) + { + sep->transport_proto = transport_proto; + sep->port = clib_host_to_net_u16 (port); + sep->is_ip4 = 1; + return 1; + } + else if (unformat (input, "%U://%U", unformat_transport_proto, + &transport_proto, unformat_ip4_address, &sep->ip.ip4)) + { + sep->transport_proto = transport_proto; + if (sep->transport_proto == TRANSPORT_PROTO_HTTP) + port = 80; + else if (sep->transport_proto == TRANSPORT_PROTO_TLS) + port = 443; + else + return 0; + + sep->port = clib_host_to_net_u16 (port); + sep->is_ip4 = 1; + return 1; + } + else if (unformat (input, "%U://[%U]:%d", unformat_transport_proto, + &transport_proto, unformat_ip6_address, &sep->ip.ip6, + &port)) + { + sep->transport_proto = transport_proto; + sep->port = clib_host_to_net_u16 (port); + sep->is_ip4 = 0; + return 1; + } + else if (unformat (input, "%U://[%U]", unformat_transport_proto, + &transport_proto, unformat_ip6_address, &sep->ip.ip6)) + { + sep->transport_proto = transport_proto; + if (sep->transport_proto == TRANSPORT_PROTO_HTTP) + port = 80; + else if (sep->transport_proto == TRANSPORT_PROTO_TLS) + port = 443; + else + return 0; + + sep->port = clib_host_to_net_u16 (port); + sep->is_ip4 = 0; + return 1; + } + else if (unformat (input, "%U://%U/%d", unformat_transport_proto, &transport_proto, unformat_ip6_address, &sep->ip.ip6, &port)) { @@ -106,6 +154,45 @@ parse_uri (char *uri, session_endpoint_cfg_t *sep) return 0; } +/* Use before 'parse_uri()'. Removes target from URI and copies it to 'char + * **target'. char **target is resized automatically. + */ +session_error_t +parse_target (char **uri, char **target) +{ + u8 counter = 0; + + for (u32 i = 0; i < (u32) strlen (*uri); i++) + { + if ((*uri)[i] == '/') + counter++; + + if (counter == 3) + { + /* resize and make space for NULL terminator */ + if (vec_len (*target) < strlen (*uri) - i + 2) + vec_resize (*target, strlen (*uri) - i + 2); + + strncpy (*target, *uri + i, strlen (*uri) - i); + (*uri)[i + 1] = '\0'; + break; + } + } + + if (!*target) + { + vec_resize (*target, 2); + **target = '/'; + } + + vec_terminate_c_string (*target); + + if (!*target) + return SESSION_E_INVALID; + + return 0; +} + session_error_t vnet_bind_uri (vnet_listen_args_t *a) { diff --git a/src/vnet/session/application_interface.h b/src/vnet/session/application_interface.h index 21ed97998f2..33b61187fe3 100644 --- a/src/vnet/session/application_interface.h +++ b/src/vnet/session/application_interface.h @@ -281,6 +281,7 @@ typedef enum session_fd_flag_ } session_fd_flag_t; session_error_t parse_uri (char *uri, session_endpoint_cfg_t *sep); +session_error_t parse_target (char **uri, char **target); session_error_t vnet_bind_uri (vnet_listen_args_t *); session_error_t vnet_unbind_uri (vnet_unlisten_args_t *a); session_error_t vnet_connect_uri (vnet_connect_args_t *a); diff --git a/src/vnet/session/session.c b/src/vnet/session/session.c index 2a6ac283fb9..d65371e81e5 100644 --- a/src/vnet/session/session.c +++ b/src/vnet/session/session.c @@ -28,9 +28,17 @@ session_main_t session_main; +typedef enum +{ + SESSION_EVT_RPC, + SESSION_EVT_IO, + SESSION_EVT_SESSION, +} session_evt_family_t; + static inline int session_send_evt_to_thread (void *data, void *args, u32 thread_index, - session_evt_type_t evt_type) + session_evt_type_t evt_type, + session_evt_family_t family) { session_worker_t *wrk = session_main_get_worker (thread_index); session_event_t *evt; @@ -45,30 +53,33 @@ session_send_evt_to_thread (void *data, void *args, u32 thread_index, svm_msg_q_unlock (mq); return -2; } - switch (evt_type) + switch (family) { - case SESSION_CTRL_EVT_RPC: + case SESSION_EVT_RPC: + ASSERT (evt_type == SESSION_CTRL_EVT_RPC); msg = svm_msg_q_alloc_msg_w_ring (mq, SESSION_MQ_IO_EVT_RING); evt = (session_event_t *) svm_msg_q_msg_data (mq, &msg); evt->rpc_args.fp = data; evt->rpc_args.arg = args; break; - case SESSION_IO_EVT_RX: - case SESSION_IO_EVT_TX: - case SESSION_IO_EVT_TX_FLUSH: - case SESSION_IO_EVT_BUILTIN_RX: + case SESSION_EVT_IO: + ASSERT (evt_type == SESSION_IO_EVT_RX || evt_type == SESSION_IO_EVT_TX || + evt_type == SESSION_IO_EVT_TX_FLUSH || + evt_type == SESSION_IO_EVT_BUILTIN_RX); msg = svm_msg_q_alloc_msg_w_ring (mq, SESSION_MQ_IO_EVT_RING); evt = (session_event_t *) svm_msg_q_msg_data (mq, &msg); evt->session_index = *(u32 *) data; break; - case SESSION_IO_EVT_TX_MAIN: - case SESSION_CTRL_EVT_CLOSE: - case SESSION_CTRL_EVT_RESET: + case SESSION_EVT_SESSION: + ASSERT (evt_type == SESSION_CTRL_EVT_CLOSE || + evt_type == SESSION_CTRL_EVT_HALF_CLOSE || + evt_type == SESSION_CTRL_EVT_RESET); msg = svm_msg_q_alloc_msg_w_ring (mq, SESSION_MQ_IO_EVT_RING); evt = (session_event_t *) svm_msg_q_msg_data (mq, &msg); evt->session_handle = session_handle ((session_t *) data); break; default: + ASSERT (0); clib_warning ("evt unhandled!"); svm_msg_q_unlock (mq); return -1; @@ -88,7 +99,8 @@ int session_send_io_evt_to_thread (svm_fifo_t * f, session_evt_type_t evt_type) { return session_send_evt_to_thread (&f->vpp_session_index, 0, - f->master_thread_index, evt_type); + f->master_thread_index, evt_type, + SESSION_EVT_IO); } /* Deprecated, use session_program_* functions */ @@ -96,14 +108,16 @@ int session_send_io_evt_to_thread_custom (void *data, u32 thread_index, session_evt_type_t evt_type) { - return session_send_evt_to_thread (data, 0, thread_index, evt_type); + return session_send_evt_to_thread (data, 0, thread_index, evt_type, + SESSION_EVT_IO); } int session_program_tx_io_evt (session_handle_tu_t sh, session_evt_type_t evt_type) { return session_send_evt_to_thread ((void *) &sh.session_index, 0, - (u32) sh.thread_index, evt_type); + (u32) sh.thread_index, evt_type, + SESSION_EVT_IO); } int @@ -116,9 +130,9 @@ session_program_rx_io_evt (session_handle_tu_t sh) } else { - return session_send_evt_to_thread ((void *) &sh.session_index, 0, - (u32) sh.thread_index, - SESSION_IO_EVT_BUILTIN_RX); + return session_send_evt_to_thread ( + (void *) &sh.session_index, 0, (u32) sh.thread_index, + SESSION_IO_EVT_BUILTIN_RX, SESSION_EVT_IO); } } @@ -127,25 +141,24 @@ session_program_transport_io_evt (session_handle_tu_t sh, session_evt_type_t evt_type) { return session_send_evt_to_thread ((void *) &sh.session_index, 0, - (u32) sh.thread_index, evt_type); + (u32) sh.thread_index, evt_type, + SESSION_EVT_IO); } int session_send_ctrl_evt_to_thread (session_t * s, session_evt_type_t evt_type) { /* only events supported are disconnect, shutdown and reset */ - ASSERT (evt_type == SESSION_CTRL_EVT_CLOSE || - evt_type == SESSION_CTRL_EVT_HALF_CLOSE || - evt_type == SESSION_CTRL_EVT_RESET); - return session_send_evt_to_thread (s, 0, s->thread_index, evt_type); + return session_send_evt_to_thread (s, 0, s->thread_index, evt_type, + SESSION_EVT_SESSION); } void session_send_rpc_evt_to_thread_force (u32 thread_index, void *fp, void *rpc_args) { - session_send_evt_to_thread (fp, rpc_args, thread_index, - SESSION_CTRL_EVT_RPC); + session_send_evt_to_thread (fp, rpc_args, thread_index, SESSION_CTRL_EVT_RPC, + SESSION_EVT_RPC); } void @@ -480,115 +493,6 @@ session_alloc_for_half_open (transport_connection_t *tc) return s; } -/** - * Discards bytes from buffer chain - * - * It discards n_bytes_to_drop starting at first buffer after chain_b - */ -always_inline void -session_enqueue_discard_chain_bytes (vlib_main_t * vm, vlib_buffer_t * b, - vlib_buffer_t ** chain_b, - u32 n_bytes_to_drop) -{ - vlib_buffer_t *next = *chain_b; - u32 to_drop = n_bytes_to_drop; - ASSERT (b->flags & VLIB_BUFFER_NEXT_PRESENT); - while (to_drop && (next->flags & VLIB_BUFFER_NEXT_PRESENT)) - { - next = vlib_get_buffer (vm, next->next_buffer); - if (next->current_length > to_drop) - { - vlib_buffer_advance (next, to_drop); - to_drop = 0; - } - else - { - to_drop -= next->current_length; - next->current_length = 0; - } - } - *chain_b = next; - - if (to_drop == 0) - b->total_length_not_including_first_buffer -= n_bytes_to_drop; -} - -/** - * Enqueue buffer chain tail - */ -always_inline int -session_enqueue_chain_tail (session_t * s, vlib_buffer_t * b, - u32 offset, u8 is_in_order) -{ - vlib_buffer_t *chain_b; - u32 chain_bi, len, diff; - vlib_main_t *vm = vlib_get_main (); - u8 *data; - u32 written = 0; - int rv = 0; - - if (is_in_order && offset) - { - diff = offset - b->current_length; - if (diff > b->total_length_not_including_first_buffer) - return 0; - chain_b = b; - session_enqueue_discard_chain_bytes (vm, b, &chain_b, diff); - chain_bi = vlib_get_buffer_index (vm, chain_b); - } - else - chain_bi = b->next_buffer; - - do - { - chain_b = vlib_get_buffer (vm, chain_bi); - data = vlib_buffer_get_current (chain_b); - len = chain_b->current_length; - if (!len) - continue; - if (is_in_order) - { - rv = svm_fifo_enqueue (s->rx_fifo, len, data); - if (rv == len) - { - written += rv; - } - else if (rv < len) - { - return (rv > 0) ? (written + rv) : written; - } - else if (rv > len) - { - written += rv; - - /* written more than what was left in chain */ - if (written > b->total_length_not_including_first_buffer) - return written; - - /* drop the bytes that have already been delivered */ - session_enqueue_discard_chain_bytes (vm, b, &chain_b, rv - len); - } - } - else - { - rv = svm_fifo_enqueue_with_offset (s->rx_fifo, offset, len, data); - if (rv) - { - clib_warning ("failed to enqueue multi-buffer seg"); - return -1; - } - offset += len; - } - } - while ((chain_bi = (chain_b->flags & VLIB_BUFFER_NEXT_PRESENT) - ? chain_b->next_buffer : 0)); - - if (is_in_order) - return written; - - return 0; -} - void session_fifo_tuning (session_t * s, svm_fifo_t * f, session_ft_action_t act, u32 len) @@ -760,154 +664,6 @@ session_main_flush_enqueue_events (transport_proto_t transport_proto, wrk->session_to_enqueue[transport_proto] = handles; } -/* - * Enqueue data for delivery to app. If requested, it queues app notification - * event for later delivery. - * - * @param tc Transport connection which is to be enqueued data - * @param b Buffer to be enqueued - * @param offset Offset at which to start enqueueing if out-of-order - * @param queue_event Flag to indicate if peer is to be notified or if event - * is to be queued. The former is useful when more data is - * enqueued and only one event is to be generated. - * @param is_in_order Flag to indicate if data is in order - * @return Number of bytes enqueued or a negative value if enqueueing failed. - */ -int -session_enqueue_stream_connection (transport_connection_t * tc, - vlib_buffer_t * b, u32 offset, - u8 queue_event, u8 is_in_order) -{ - session_t *s; - int enqueued = 0, rv, in_order_off; - - s = session_get (tc->s_index, tc->thread_index); - - if (is_in_order) - { - enqueued = svm_fifo_enqueue (s->rx_fifo, - b->current_length, - vlib_buffer_get_current (b)); - if (PREDICT_FALSE ((b->flags & VLIB_BUFFER_NEXT_PRESENT) - && enqueued >= 0)) - { - in_order_off = enqueued > b->current_length ? enqueued : 0; - rv = session_enqueue_chain_tail (s, b, in_order_off, 1); - if (rv > 0) - enqueued += rv; - } - } - else - { - rv = svm_fifo_enqueue_with_offset (s->rx_fifo, offset, - b->current_length, - vlib_buffer_get_current (b)); - if (PREDICT_FALSE ((b->flags & VLIB_BUFFER_NEXT_PRESENT) && !rv)) - session_enqueue_chain_tail (s, b, offset + b->current_length, 0); - /* if something was enqueued, report even this as success for ooo - * segment handling */ - return rv; - } - - if (queue_event) - { - /* Queue RX event on this fifo. Eventually these will need to be - * flushed by calling @ref session_main_flush_enqueue_events () */ - if (!(s->flags & SESSION_F_RX_EVT)) - { - session_worker_t *wrk = session_main_get_worker (s->thread_index); - ASSERT (s->thread_index == vlib_get_thread_index ()); - s->flags |= SESSION_F_RX_EVT; - vec_add1 (wrk->session_to_enqueue[tc->proto], session_handle (s)); - } - - session_fifo_tuning (s, s->rx_fifo, SESSION_FT_ACTION_ENQUEUED, 0); - } - - return enqueued; -} - -always_inline int -session_enqueue_dgram_connection_inline (session_t *s, - session_dgram_hdr_t *hdr, - vlib_buffer_t *b, u8 proto, - u8 queue_event, u32 is_cl) -{ - int rv; - - ASSERT (svm_fifo_max_enqueue_prod (s->rx_fifo) - >= b->current_length + sizeof (*hdr)); - - if (PREDICT_TRUE (!(b->flags & VLIB_BUFFER_NEXT_PRESENT))) - { - svm_fifo_seg_t segs[2] = { - { (u8 *) hdr, sizeof (*hdr) }, - { vlib_buffer_get_current (b), b->current_length } - }; - - rv = svm_fifo_enqueue_segments (s->rx_fifo, segs, 2, - 0 /* allow_partial */ ); - } - else - { - vlib_main_t *vm = vlib_get_main (); - svm_fifo_seg_t *segs = 0, *seg; - vlib_buffer_t *it = b; - u32 n_segs = 1; - - vec_add2 (segs, seg, 1); - seg->data = (u8 *) hdr; - seg->len = sizeof (*hdr); - while (it) - { - vec_add2 (segs, seg, 1); - seg->data = vlib_buffer_get_current (it); - seg->len = it->current_length; - n_segs++; - if (!(it->flags & VLIB_BUFFER_NEXT_PRESENT)) - break; - it = vlib_get_buffer (vm, it->next_buffer); - } - rv = svm_fifo_enqueue_segments (s->rx_fifo, segs, n_segs, - 0 /* allow partial */ ); - vec_free (segs); - } - - if (queue_event && rv > 0) - { - /* Queue RX event on this fifo. Eventually these will need to be - * flushed by calling @ref session_main_flush_enqueue_events () */ - if (!(s->flags & SESSION_F_RX_EVT)) - { - u32 thread_index = - is_cl ? vlib_get_thread_index () : s->thread_index; - session_worker_t *wrk = session_main_get_worker (thread_index); - ASSERT (s->thread_index == vlib_get_thread_index () || is_cl); - s->flags |= SESSION_F_RX_EVT; - vec_add1 (wrk->session_to_enqueue[proto], session_handle (s)); - } - - session_fifo_tuning (s, s->rx_fifo, SESSION_FT_ACTION_ENQUEUED, 0); - } - return rv > 0 ? rv : 0; -} - -int -session_enqueue_dgram_connection (session_t *s, session_dgram_hdr_t *hdr, - vlib_buffer_t *b, u8 proto, u8 queue_event) -{ - return session_enqueue_dgram_connection_inline (s, hdr, b, proto, - queue_event, 0 /* is_cl */); -} - -int -session_enqueue_dgram_connection2 (session_t *s, session_dgram_hdr_t *hdr, - vlib_buffer_t *b, u8 proto, u8 queue_event) -{ - return session_enqueue_dgram_connection_inline (s, hdr, b, proto, - queue_event, 1 /* is_cl */); -} - int session_enqueue_dgram_connection_cl (session_t *s, session_dgram_hdr_t *hdr, vlib_buffer_t *b, u8 proto, diff --git a/src/vnet/session/session.h b/src/vnet/session/session.h index daa3bf97f56..d6c5cbc6085 100644 --- a/src/vnet/session/session.h +++ b/src/vnet/session/session.h @@ -151,6 +151,8 @@ typedef struct session_worker_ /** Per-app-worker bitmap of pending notifications */ uword *app_wrks_pending_ntf; + svm_fifo_seg_t *rx_segs; + int config_index; u8 dma_enabled; session_dma_transfer *dma_trans; @@ -323,6 +325,67 @@ typedef struct _session_enable_disable_args_t #define TRANSPORT_PROTO_INVALID (session_main.last_transport_proto_type + 1) #define TRANSPORT_N_PROTOS (session_main.last_transport_proto_type + 1) +/* + * Session layer functions + */ + +always_inline session_main_t * +vnet_get_session_main () +{ + return &session_main; +} + +always_inline session_worker_t * +session_main_get_worker (u32 thread_index) +{ + return vec_elt_at_index (session_main.wrk, thread_index); +} + +static inline session_worker_t * +session_main_get_worker_if_valid (u32 thread_index) +{ + if (thread_index > vec_len (session_main.wrk)) + return 0; + return session_main_get_worker (thread_index); +} + +always_inline svm_msg_q_t * +session_main_get_vpp_event_queue (u32 thread_index) +{ + return session_main_get_worker (thread_index)->vpp_event_queue; +} + +always_inline u8 +session_main_is_enabled () +{ + return session_main.is_enabled == 1; +} + +always_inline void +session_worker_stat_error_inc (session_worker_t *wrk, int error, int value) +{ + if ((-(error) >= 0 && -(error) < SESSION_N_ERRORS)) + wrk->stats.errors[-error] += value; + else + SESSION_DBG ("unknown session counter"); +} + +always_inline void +session_stat_error_inc (int error, int value) +{ + session_worker_t *wrk; + wrk = session_main_get_worker (vlib_get_thread_index ()); + session_worker_stat_error_inc (wrk, error, value); +} + +#define session_cli_return_if_not_enabled() \ + do \ + { \ + if (!session_main.is_enabled) \ + return clib_error_return (0, "session layer is not enabled"); \ + } \ + while (0) + static inline void session_evt_add_old (session_worker_t * wrk, session_evt_elt_t * elt) { @@ -517,20 +580,6 @@ uword unformat_transport_connection (unformat_input_t * input, * Interface to transport protos */ -int session_enqueue_stream_connection (transport_connection_t * tc, - vlib_buffer_t * b, u32 offset, - u8 queue_event, u8 is_in_order); -int session_enqueue_dgram_connection (session_t * s, - session_dgram_hdr_t * hdr, - vlib_buffer_t * b, u8 proto, - u8 queue_event); -int session_enqueue_dgram_connection2 (session_t *s, session_dgram_hdr_t *hdr, - vlib_buffer_t *b, u8 proto, - u8 queue_event); -int session_enqueue_dgram_connection_cl (session_t *s, - session_dgram_hdr_t *hdr, - vlib_buffer_t *b, u8 proto, - u8 queue_event); int session_stream_connect_notify (transport_connection_t * tc, session_error_t err); int session_dgram_connect_notify (transport_connection_t * tc, @@ -566,9 +615,279 @@ void session_register_transport (transport_proto_t transport_proto, u32 output_node); transport_proto_t session_add_transport_proto (void); void session_register_update_time_fn (session_update_time_fn fn, u8 is_add); +void session_main_flush_enqueue_events (transport_proto_t transport_proto, + u32 thread_index); +void session_queue_run_on_main_thread (vlib_main_t *vm); int session_tx_fifo_peek_bytes (transport_connection_t * tc, u8 * buffer, u32 offset, u32 max_bytes); u32 session_tx_fifo_dequeue_drop (transport_connection_t * tc, u32 max_bytes); +int session_enqueue_dgram_connection_cl (session_t *s, + session_dgram_hdr_t *hdr, + vlib_buffer_t *b, u8 proto, + u8 queue_event); +void session_fifo_tuning (session_t *s, svm_fifo_t *f, session_ft_action_t act, + u32 len); + +/** + * Discards bytes from buffer chain + * + * It discards n_bytes_to_drop starting at first buffer after chain_b + */ +always_inline void +session_enqueue_discard_chain_bytes (vlib_main_t *vm, vlib_buffer_t *b, + vlib_buffer_t **chain_b, + u32 n_bytes_to_drop) +{ + vlib_buffer_t *next = *chain_b; + u32 to_drop = n_bytes_to_drop; + ASSERT (b->flags & VLIB_BUFFER_NEXT_PRESENT); + while (to_drop && (next->flags & VLIB_BUFFER_NEXT_PRESENT)) + { + next = vlib_get_buffer (vm, next->next_buffer); + if (next->current_length > to_drop) + { + vlib_buffer_advance (next, to_drop); + to_drop = 0; + } + else + { + to_drop -= next->current_length; + next->current_length = 0; + } + } + *chain_b = next; + + if (to_drop == 0) + b->total_length_not_including_first_buffer -= n_bytes_to_drop; +} + +/** + * Enqueue buffer chain tail + */ +always_inline int +session_enqueue_chain_tail (session_t *s, vlib_buffer_t *b, u32 offset, + u8 is_in_order) +{ + vlib_buffer_t *chain_b; + u32 chain_bi; + + if (is_in_order) + { + session_worker_t *wrk = session_main_get_worker (s->thread_index); + u32 diff, written = 0; + + if (offset) + { + diff = offset - b->current_length; + if (diff > b->total_length_not_including_first_buffer) + return 0; + chain_b = b; + session_enqueue_discard_chain_bytes (wrk->vm, b, &chain_b, diff); + chain_bi = vlib_get_buffer_index (wrk->vm, chain_b); + } + else + { + chain_bi = b->next_buffer; + } + + chain_b = vlib_get_buffer (wrk->vm, chain_bi); + svm_fifo_seg_t *seg; + + while (chain_b) + { + vec_add2 (wrk->rx_segs, seg, 1); + seg->data = vlib_buffer_get_current (chain_b); + seg->len = chain_b->current_length; + chain_b = (chain_b->flags & VLIB_BUFFER_NEXT_PRESENT) ? + vlib_get_buffer (wrk->vm, chain_b->next_buffer) : + 0; + } + + written = svm_fifo_enqueue_segments (s->rx_fifo, wrk->rx_segs, + vec_len (wrk->rx_segs), + 1 /* allow partial*/); + + vec_reset_length (wrk->rx_segs); + + return written; + } + else + { + vlib_main_t *vm = vlib_get_main (); + int rv = 0; + u8 *data; + u32 len; + + /* TODO svm_fifo_enqueue_segments with offset */ + chain_bi = b->next_buffer; + do + { + chain_b = vlib_get_buffer (vm, chain_bi); + data = vlib_buffer_get_current (chain_b); + len = chain_b->current_length; + if (!len) + continue; + + rv = svm_fifo_enqueue_with_offset (s->rx_fifo, offset, len, data); + if (rv) + { + clib_warning ("failed to enqueue multi-buffer seg"); + return -1; + } + offset += len; + } + while ((chain_bi = (chain_b->flags & VLIB_BUFFER_NEXT_PRESENT) ? + chain_b->next_buffer : + 0)); + + return 0; + } +} + +/* + * Enqueue data for delivery to app. If requested, it queues app notification + * event for later delivery. + * + * @param tc Transport connection which is to be enqueued data + * @param b Buffer to be enqueued + * @param offset Offset at which to start enqueueing if out-of-order + * @param queue_event Flag to indicate if peer is to be notified or if event + * is to be queued. The former is useful when more data is + * enqueued and only one event is to be generated. + * @param is_in_order Flag to indicate if data is in order + * @return Number of bytes enqueued or a negative value if enqueueing failed. + */ +always_inline int +session_enqueue_stream_connection (transport_connection_t *tc, + vlib_buffer_t *b, u32 offset, + u8 queue_event, u8 is_in_order) +{ + session_t *s; + int enqueued = 0, rv, in_order_off; + + s = session_get (tc->s_index, tc->thread_index); + + if (is_in_order) + { + enqueued = svm_fifo_enqueue (s->rx_fifo, b->current_length, + vlib_buffer_get_current (b)); + if (PREDICT_FALSE ((b->flags & VLIB_BUFFER_NEXT_PRESENT) && + enqueued >= 0)) + { + in_order_off = enqueued > b->current_length ? enqueued : 0; + rv = session_enqueue_chain_tail (s, b, in_order_off, 1); + if (rv > 0) + enqueued += rv; + } + } + else + { + rv = svm_fifo_enqueue_with_offset (s->rx_fifo, offset, b->current_length, + vlib_buffer_get_current (b)); + if (PREDICT_FALSE ((b->flags & VLIB_BUFFER_NEXT_PRESENT) && !rv)) + session_enqueue_chain_tail (s, b, offset + b->current_length, 0); + /* if something was enqueued, report even this as success for ooo + * segment handling */ + return rv; + } + + if (queue_event) + { + /* Queue RX event on this fifo. Eventually these will need to be + * flushed by calling @ref session_main_flush_enqueue_events () */ + if (!(s->flags & SESSION_F_RX_EVT)) + { + session_worker_t *wrk = session_main_get_worker (s->thread_index); + ASSERT (s->thread_index == vlib_get_thread_index ()); + s->flags |= SESSION_F_RX_EVT; + vec_add1 (wrk->session_to_enqueue[tc->proto], session_handle (s)); + } + + session_fifo_tuning (s, s->rx_fifo, SESSION_FT_ACTION_ENQUEUED, 0); + } + + return enqueued; +} + +always_inline int +session_enqueue_dgram_connection_inline (session_t *s, + session_dgram_hdr_t *hdr, + vlib_buffer_t *b, u8 proto, + u8 queue_event, u32 is_cl) +{ + int rv; + + ASSERT (svm_fifo_max_enqueue_prod (s->rx_fifo) >= + b->current_length + sizeof (*hdr)); + + if (PREDICT_TRUE (!(b->flags & VLIB_BUFFER_NEXT_PRESENT))) + { + svm_fifo_seg_t segs[2] = { { (u8 *) hdr, sizeof (*hdr) }, + { vlib_buffer_get_current (b), + b->current_length } }; + + rv = + svm_fifo_enqueue_segments (s->rx_fifo, segs, 2, 0 /* allow_partial */); + } + else + { + vlib_main_t *vm = vlib_get_main (); + svm_fifo_seg_t *segs = 0, *seg; + vlib_buffer_t *it = b; + u32 n_segs = 1; + + vec_add2 (segs, seg, 1); + seg->data = (u8 *) hdr; + seg->len = sizeof (*hdr); + while (it) + { + vec_add2 (segs, seg, 1); + seg->data = vlib_buffer_get_current (it); + seg->len = it->current_length; + n_segs++; + if (!(it->flags & VLIB_BUFFER_NEXT_PRESENT)) + break; + it = vlib_get_buffer (vm, it->next_buffer); + } + rv = svm_fifo_enqueue_segments (s->rx_fifo, segs, n_segs, + 0 /* allow partial */); + vec_free (segs); + } + + if (queue_event && rv > 0) + { + /* Queue RX event on this fifo. Eventually these will need to be + * flushed by calling @ref session_main_flush_enqueue_events () */ + if (!(s->flags & SESSION_F_RX_EVT)) + { + u32 thread_index = + is_cl ? vlib_get_thread_index () : s->thread_index; + session_worker_t *wrk = session_main_get_worker (thread_index); + ASSERT (s->thread_index == vlib_get_thread_index () || is_cl); + s->flags |= SESSION_F_RX_EVT; + vec_add1 (wrk->session_to_enqueue[proto], session_handle (s)); + } + + session_fifo_tuning (s, s->rx_fifo, SESSION_FT_ACTION_ENQUEUED, 0); + } + return rv > 0 ? rv : 0; +} + +always_inline int +session_enqueue_dgram_connection (session_t *s, session_dgram_hdr_t *hdr, + vlib_buffer_t *b, u8 proto, u8 queue_event) +{ + return session_enqueue_dgram_connection_inline (s, hdr, b, proto, + queue_event, 0 /* is_cl */); +} + +always_inline int +session_enqueue_dgram_connection2 (session_t *s, session_dgram_hdr_t *hdr, + vlib_buffer_t *b, u8 proto, u8 queue_event) +{ + return session_enqueue_dgram_connection_inline (s, hdr, b, proto, + queue_event, 1 /* is_cl */); +} always_inline void session_set_state (session_t *s, session_state_t session_state) @@ -753,69 +1072,6 @@ ho_session_free (session_t *s) transport_connection_t *listen_session_get_transport (session_t * s); -/* - * Session layer functions - */ - -always_inline session_main_t * -vnet_get_session_main () -{ - return &session_main; -} - -always_inline session_worker_t * -session_main_get_worker (u32 thread_index) -{ - return vec_elt_at_index (session_main.wrk, thread_index); -} - -static inline session_worker_t * -session_main_get_worker_if_valid (u32 thread_index) -{ - if (thread_index > vec_len (session_main.wrk)) - return 0; - return session_main_get_worker (thread_index); -} - -always_inline svm_msg_q_t * -session_main_get_vpp_event_queue (u32 thread_index) -{ - return session_main_get_worker (thread_index)->vpp_event_queue; -} - -always_inline u8 -session_main_is_enabled () -{ - return session_main.is_enabled == 1; -} - -always_inline void -session_worker_stat_error_inc (session_worker_t *wrk, int error, int value) -{ - if ((-(error) >= 0 && -(error) < SESSION_N_ERRORS)) - wrk->stats.errors[-error] += value; - else - SESSION_DBG ("unknown session counter"); -} - -always_inline void -session_stat_error_inc (int error, int value) -{ - session_worker_t *wrk; - wrk = session_main_get_worker (vlib_get_thread_index ()); - session_worker_stat_error_inc (wrk, error, value); -} - -#define session_cli_return_if_not_enabled() \ -do { \ - if (!session_main.is_enabled) \ - return clib_error_return (0, "session layer is not enabled"); \ -} while (0) - -void session_main_flush_enqueue_events (transport_proto_t transport_proto, - u32 thread_index); -void session_queue_run_on_main_thread (vlib_main_t * vm); - /** * Add session node pending buffer with custom node * diff --git a/src/vnet/session/session_node.c b/src/vnet/session/session_node.c index c0ff1de39bc..655f7ada09e 100644 --- a/src/vnet/session/session_node.c +++ b/src/vnet/session/session_node.c @@ -836,8 +836,7 @@ vlib_node_registration_t session_queue_node; typedef struct { - u32 session_index; - u32 server_thread_index; + u32 thread_index; } session_queue_trace_t; /* packet trace format function */ @@ -848,8 +847,7 @@ format_session_queue_trace (u8 * s, va_list * args) CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); session_queue_trace_t *t = va_arg (*args, session_queue_trace_t *); - s = format (s, "session index %d thread index %d", - t->session_index, t->server_thread_index); + s = format (s, "thread index %d", t->thread_index); return s; } @@ -880,25 +878,25 @@ enum }; static void -session_tx_trace_frame (vlib_main_t *vm, vlib_node_runtime_t *node, - u32 next_index, vlib_buffer_t **bufs, u16 n_segs, - session_t *s, u32 n_trace) +session_tx_trace_frame (vlib_main_t *vm, vlib_node_runtime_t *node, u32 *bis, + u16 *nexts, u16 n_bufs) { - vlib_buffer_t **b = bufs; + u32 n_trace = vlib_get_trace_count (vm, node), *bi = bis; + u16 *next = nexts; + vlib_buffer_t *b; - while (n_trace && n_segs) + while (n_trace && n_bufs) { - if (PREDICT_TRUE (vlib_trace_buffer (vm, node, next_index, b[0], - 1 /* follow_chain */))) + b = vlib_get_buffer (vm, bi[0]); + if (PREDICT_TRUE ( + vlib_trace_buffer (vm, node, next[0], b, 1 /* follow_chain */))) { - session_queue_trace_t *t = - vlib_add_trace (vm, node, b[0], sizeof (*t)); - t->session_index = s->session_index; - t->server_thread_index = s->thread_index; + session_queue_trace_t *t = vlib_add_trace (vm, node, b, sizeof (*t)); + t->thread_index = vm->thread_index; n_trace--; } - b++; - n_segs--; + bi++; + n_bufs--; } vlib_set_trace_count (vm, node, n_trace); } @@ -1194,7 +1192,7 @@ session_tx_not_ready (session_t * s, u8 peek_data) } else { - if (s->session_state == SESSION_STATE_TRANSPORT_DELETED) + if (s->session_state == SESSION_STATE_TRANSPORT_DELETED || !s->tx_fifo) return 2; } return 0; @@ -1402,7 +1400,7 @@ session_tx_fifo_read_and_snd_i (session_worker_t * wrk, session_evt_elt_t * elt, int *n_tx_packets, u8 peek_data) { - u32 n_trace, n_left, pbi, next_index, max_burst; + u32 n_left, pbi, next_index, max_burst; session_tx_context_t *ctx = &wrk->ctx; session_main_t *smm = &session_main; session_event_t *e = &elt->evt; @@ -1576,10 +1574,6 @@ session_tx_fifo_read_and_snd_i (session_worker_t * wrk, ctx->transport_vft->push_header (ctx->tc, ctx->transport_pending_bufs, ctx->n_segs_per_evt); - if (PREDICT_FALSE ((n_trace = vlib_get_trace_count (vm, node)) > 0)) - session_tx_trace_frame (vm, node, next_index, ctx->transport_pending_bufs, - ctx->n_segs_per_evt, ctx->s, n_trace); - if (PREDICT_FALSE (n_bufs)) vlib_buffer_free (vm, ctx->tx_buffers, n_bufs); @@ -2072,7 +2066,13 @@ session_queue_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, SESSION_EVT (SESSION_EVT_DSP_CNTRS, OLD_IO_EVTS, wrk); if (vec_len (wrk->pending_tx_buffers)) - session_flush_pending_tx_buffers (wrk, node); + { + if (PREDICT_FALSE (vlib_get_trace_count (vm, node) > 0)) + session_tx_trace_frame (vm, node, wrk->pending_tx_buffers, + wrk->pending_tx_nexts, + vec_len (wrk->pending_tx_nexts)); + session_flush_pending_tx_buffers (wrk, node); + } vlib_node_increment_counter (vm, session_queue_node.index, SESSION_QUEUE_ERROR_TX, n_tx_packets); diff --git a/src/vnet/session/transport.c b/src/vnet/session/transport.c index 015255ecf08..3bd12d82fd8 100644 --- a/src/vnet/session/transport.c +++ b/src/vnet/session/transport.c @@ -592,6 +592,7 @@ transport_endpoint_mark_used (u8 proto, u32 fib_index, ip46_address_t *ip, /* Pool reallocs with worker barrier */ lep = transport_endpoint_alloc (); clib_memcpy_fast (&lep->ep.ip, ip, sizeof (*ip)); + lep->ep.fib_index = fib_index; lep->ep.port = port; lep->proto = proto; lep->refcnt = 1; @@ -683,6 +684,13 @@ transport_port_alloc_max_tries () return tm->port_alloc_max_tries; } +u32 +transport_port_local_in_use () +{ + transport_main_t *tm = &tp_main; + return pool_elts (tm->local_endpoints) - vec_len (tm->lcl_endpts_freelist); +} + void transport_clear_stats () { diff --git a/src/vnet/session/transport.h b/src/vnet/session/transport.h index c864be139f9..de2a6becaae 100644 --- a/src/vnet/session/transport.h +++ b/src/vnet/session/transport.h @@ -253,6 +253,7 @@ void transport_share_local_endpoint (u8 proto, u32 fib_index, int transport_release_local_endpoint (u8 proto, u32 fib_index, ip46_address_t *lcl_ip, u16 port); u16 transport_port_alloc_max_tries (); +u32 transport_port_local_in_use (); void transport_clear_stats (); void transport_enable_disable (vlib_main_t * vm, u8 is_en); void transport_init (void); diff --git a/src/vnet/srv6/sr_policy_rewrite.c b/src/vnet/srv6/sr_policy_rewrite.c index a9114628f95..92586669378 100644 --- a/src/vnet/srv6/sr_policy_rewrite.c +++ b/src/vnet/srv6/sr_policy_rewrite.c @@ -503,8 +503,9 @@ update_lb (ip6_sr_policy_t * sr_policy) }; /* Add FIB entry for BSID */ - fhc = fib_table_get_flow_hash_config (sr_policy->fib_table, - FIB_PROTOCOL_IP6); + fhc = fib_table_get_flow_hash_config ( + fib_table_find (FIB_PROTOCOL_IP6, sr_policy->fib_table), + FIB_PROTOCOL_IP6); dpo_set (&sr_policy->bsid_dpo, DPO_LOAD_BALANCE, DPO_PROTO_IP6, load_balance_create (0, DPO_PROTO_IP6, fhc)); diff --git a/src/vnet/tcp/tcp.c b/src/vnet/tcp/tcp.c index 8851fb9c77e..02239d991bd 100644 --- a/src/vnet/tcp/tcp.c +++ b/src/vnet/tcp/tcp.c @@ -1467,7 +1467,7 @@ tcp_stats_collector_fn (vlib_stats_collector_data_t *d) tcp_wrk_stats_t acc = {}; tcp_worker_ctx_t *wrk; - vec_foreach (wrk, tm->wrk_ctx) + vec_foreach (wrk, tm->wrk) { #define _(name, type, str) acc.name += wrk->stats.name; foreach_tcp_wrk_stat @@ -1515,7 +1515,7 @@ tcp_main_enable (vlib_main_t * vm) int thread; /* Already initialized */ - if (tm->wrk_ctx) + if (tm->wrk) return 0; if ((error = vlib_call_init_function (vm, ip_main_init))) @@ -1537,11 +1537,11 @@ tcp_main_enable (vlib_main_t * vm) */ num_threads = 1 /* main thread */ + vtm->n_threads; - vec_validate (tm->wrk_ctx, num_threads - 1); + vec_validate (tm->wrk, num_threads - 1); n_workers = num_threads == 1 ? 1 : vtm->n_threads; prealloc_conn_per_wrk = tcp_cfg.preallocated_connections / n_workers; - wrk = &tm->wrk_ctx[0]; + wrk = &tm->wrk[0]; wrk->tco_next_node[0] = vlib_node_get_next (vm, session_queue_node.index, tcp4_output_node.index); wrk->tco_next_node[1] = vlib_node_get_next (vm, session_queue_node.index, @@ -1549,7 +1549,7 @@ tcp_main_enable (vlib_main_t * vm) for (thread = 0; thread < num_threads; thread++) { - wrk = &tm->wrk_ctx[thread]; + wrk = &tm->wrk[thread]; vec_validate (wrk->pending_deq_acked, 255); vec_validate (wrk->pending_disconnects, 255); @@ -1562,8 +1562,8 @@ tcp_main_enable (vlib_main_t * vm) if (thread > 0) { - wrk->tco_next_node[0] = tm->wrk_ctx[0].tco_next_node[0]; - wrk->tco_next_node[1] = tm->wrk_ctx[0].tco_next_node[1]; + wrk->tco_next_node[0] = tm->wrk[0].tco_next_node[0]; + wrk->tco_next_node[1] = tm->wrk[0].tco_next_node[1]; } /* diff --git a/src/vnet/tcp/tcp.h b/src/vnet/tcp/tcp.h index 8feac807d59..830b81df9ee 100644 --- a/src/vnet/tcp/tcp.h +++ b/src/vnet/tcp/tcp.h @@ -220,7 +220,7 @@ typedef struct tcp_configuration_ typedef struct _tcp_main { /** per-worker context */ - tcp_worker_ctx_t *wrk_ctx; + tcp_worker_ctx_t *wrk; /* Pool of listeners. */ tcp_connection_t *listener_pool; @@ -301,8 +301,8 @@ vnet_get_tcp_main () always_inline tcp_worker_ctx_t * tcp_get_worker (u32 thread_index) { - ASSERT (thread_index < vec_len (tcp_main.wrk_ctx)); - return &tcp_main.wrk_ctx[thread_index]; + ASSERT (thread_index < vec_len (tcp_main.wrk)); + return &tcp_main.wrk[thread_index]; } tcp_connection_t *tcp_connection_alloc (u8 thread_index); diff --git a/src/vnet/tcp/tcp_cli.c b/src/vnet/tcp/tcp_cli.c index 55bc5764df2..c14994aa440 100644 --- a/src/vnet/tcp/tcp_cli.c +++ b/src/vnet/tcp/tcp_cli.c @@ -919,7 +919,7 @@ show_tcp_stats_fn (vlib_main_t * vm, unformat_input_t * input, if (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) return clib_error_return (0, "unknown input `%U'", format_unformat_error, input); - for (thread = 0; thread < vec_len (tm->wrk_ctx); thread++) + for (thread = 0; thread < vec_len (tm->wrk); thread++) { wrk = tcp_get_worker (thread); vlib_cli_output (vm, "Thread %u:\n", thread); @@ -957,7 +957,7 @@ clear_tcp_stats_fn (vlib_main_t * vm, unformat_input_t * input, return clib_error_return (0, "unknown input `%U'", format_unformat_error, input); - for (thread = 0; thread < vec_len (tm->wrk_ctx); thread++) + for (thread = 0; thread < vec_len (tm->wrk); thread++) { wrk = tcp_get_worker (thread); clib_memset (&wrk->stats, 0, sizeof (wrk->stats)); diff --git a/src/vnet/tcp/tcp_inlines.h b/src/vnet/tcp/tcp_inlines.h index ccd0e3fe3ee..4c48f9ecfc5 100644 --- a/src/vnet/tcp/tcp_inlines.h +++ b/src/vnet/tcp/tcp_inlines.h @@ -68,7 +68,7 @@ always_inline tcp_connection_t * tcp_connection_get_if_valid (u32 conn_index, u32 thread_index) { tcp_worker_ctx_t *wrk; - if (thread_index >= vec_len (tcp_main.wrk_ctx)) + if (thread_index >= vec_len (tcp_main.wrk)) return 0; wrk = tcp_get_worker (thread_index); if (pool_is_free_index (wrk->connections, conn_index)) @@ -217,7 +217,7 @@ tcp_is_lost_fin (tcp_connection_t * tc) always_inline u32 tcp_time_tstamp (u32 thread_index) { - return tcp_main.wrk_ctx[thread_index].time_tstamp; + return tcp_main.wrk[thread_index].time_tstamp; } /** @@ -226,14 +226,13 @@ tcp_time_tstamp (u32 thread_index) always_inline u32 tcp_tstamp (tcp_connection_t * tc) { - return (tcp_main.wrk_ctx[tc->c_thread_index].time_tstamp - - tc->timestamp_delta); + return (tcp_main.wrk[tc->c_thread_index].time_tstamp - tc->timestamp_delta); } always_inline f64 tcp_time_now_us (u32 thread_index) { - return tcp_main.wrk_ctx[thread_index].time_us; + return tcp_main.wrk[thread_index].time_us; } always_inline void diff --git a/src/vnet/tcp/tcp_input.c b/src/vnet/tcp/tcp_input.c index cd3e4b7700c..15b2c92dcf1 100644 --- a/src/vnet/tcp/tcp_input.c +++ b/src/vnet/tcp/tcp_input.c @@ -217,20 +217,6 @@ static int tcp_segment_validate (tcp_worker_ctx_t * wrk, tcp_connection_t * tc0, vlib_buffer_t * b0, tcp_header_t * th0, u32 * error0) { - /* We could get a burst of RSTs interleaved with acks */ - if (PREDICT_FALSE (tc0->state == TCP_STATE_CLOSED)) - { - tcp_send_reset (tc0); - *error0 = TCP_ERROR_CONNECTION_CLOSED; - goto error; - } - - if (PREDICT_FALSE (!tcp_ack (th0) && !tcp_rst (th0) && !tcp_syn (th0))) - { - *error0 = TCP_ERROR_SEGMENT_INVALID; - goto error; - } - if (PREDICT_FALSE (tcp_options_parse (th0, &tc0->rcv_opts, 0))) { *error0 = TCP_ERROR_OPTIONS; @@ -1372,6 +1358,42 @@ tcp_established_trace_frame (vlib_main_t * vm, vlib_node_runtime_t * node, } } +always_inline int +tcp_segment_is_exception (tcp_connection_t *tc, tcp_header_t *th) +{ + /* TODO(fcoras): tcp-input should not allow segments without one of ack, rst, + * syn flags, so we shouldn't be checking for their presence. Leave the check + * in for now, remove in due time */ + ASSERT (th->flags & (TCP_FLAG_ACK | TCP_FLAG_RST | TCP_FLAG_SYN)); + return !tc || tc->state == TCP_STATE_CLOSED || + !(th->flags & (TCP_FLAG_ACK | TCP_FLAG_RST | TCP_FLAG_SYN)); +} + +always_inline void +tcp_segment_handle_exception (tcp_connection_t *tc, tcp_header_t *th, + u32 *error) +{ + if (!tc) + { + *error = TCP_ERROR_INVALID_CONNECTION; + return; + } + + /* We could get a burst of RSTs interleaved with acks */ + if (tc->state == TCP_STATE_CLOSED) + { + tcp_send_reset (tc); + *error = TCP_ERROR_CONNECTION_CLOSED; + return; + } + + if (!(th->flags & (TCP_FLAG_ACK | TCP_FLAG_RST | TCP_FLAG_SYN))) + { + *error = TCP_ERROR_SEGMENT_INVALID; + return; + } +} + always_inline uword tcp46_established_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip4) @@ -1404,15 +1426,14 @@ tcp46_established_inline (vlib_main_t * vm, vlib_node_runtime_t * node, tc = tcp_connection_get (vnet_buffer (b[0])->tcp.connection_index, thread_index); + th = tcp_buffer_hdr (b[0]); - if (PREDICT_FALSE (tc == 0)) + if (PREDICT_FALSE (tcp_segment_is_exception (tc, th))) { - error = TCP_ERROR_INVALID_CONNECTION; + tcp_segment_handle_exception (tc, th, &error); goto done; } - th = tcp_buffer_hdr (b[0]); - /* TODO header prediction fast path */ /* 1-4: check SEQ, RST, SYN */ @@ -2819,8 +2840,6 @@ tcp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, CLIB_PREFETCH (b[3]->data, 2 * CLIB_CACHE_LINE_BYTES, LOAD); } - next[0] = next[1] = TCP_INPUT_NEXT_DROP; - tc0 = tcp_input_lookup_buffer (b[0], thread_index, &error0, is_ip4, is_nolookup); tc1 = tcp_input_lookup_buffer (b[1], thread_index, &error1, is_ip4, @@ -2881,7 +2900,6 @@ tcp46_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, CLIB_PREFETCH (b[1]->data, 2 * CLIB_CACHE_LINE_BYTES, LOAD); } - next[0] = TCP_INPUT_NEXT_DROP; tc0 = tcp_input_lookup_buffer (b[0], thread_index, &error0, is_ip4, is_nolookup); if (PREDICT_TRUE (tc0 != 0)) diff --git a/src/vnet/tcp/tcp_output.c b/src/vnet/tcp/tcp_output.c index 2fd20acf241..2e8a10896eb 100644 --- a/src/vnet/tcp/tcp_output.c +++ b/src/vnet/tcp/tcp_output.c @@ -299,7 +299,7 @@ tcp_make_options (tcp_connection_t * tc, tcp_options_t * opts, void tcp_update_burst_snd_vars (tcp_connection_t * tc) { - tcp_main_t *tm = &tcp_main; + tcp_worker_ctx_t *wrk = tcp_get_worker (tc->c_thread_index); /* Compute options to be used for connection. These may be reused when * sending data or to compute the effective mss (snd_mss) */ @@ -310,8 +310,7 @@ tcp_update_burst_snd_vars (tcp_connection_t * tc) tc->snd_mss = clib_min (tc->mss, tc->rcv_opts.mss) - tc->snd_opts_len; ASSERT (tc->snd_mss > 0); - tcp_options_write (tm->wrk_ctx[tc->c_thread_index].cached_opts, - &tc->snd_opts); + tcp_options_write (wrk->cached_opts, &tc->snd_opts); tcp_update_rcv_wnd (tc); @@ -875,7 +874,6 @@ tcp_push_hdr_i (tcp_connection_t * tc, vlib_buffer_t * b, u32 snd_nxt, { u8 tcp_hdr_opts_len, flags = TCP_FLAG_ACK; u32 advertise_wnd, data_len; - tcp_main_t *tm = &tcp_main; tcp_header_t *th; data_len = b->current_length; @@ -907,9 +905,8 @@ tcp_push_hdr_i (tcp_connection_t * tc, vlib_buffer_t * b, u32 snd_nxt, if (maybe_burst) { - clib_memcpy_fast ((u8 *) (th + 1), - tm->wrk_ctx[tc->c_thread_index].cached_opts, - tc->snd_opts_len); + tcp_worker_ctx_t *wrk = tcp_get_worker (tc->c_thread_index); + clib_memcpy_fast ((u8 *) (th + 1), wrk->cached_opts, tc->snd_opts_len); } else { diff --git a/src/vnet/udp/udp_cli.c b/src/vnet/udp/udp_cli.c index 6c8992cd0de..dd1da0a01d6 100644 --- a/src/vnet/udp/udp_cli.c +++ b/src/vnet/udp/udp_cli.c @@ -97,7 +97,8 @@ format_udp_vars (u8 * s, va_list * args) s = format (s, " index %u%U flags: %U\n", uc->c_c_index, format_udp_cfg_flags, uc, format_udp_connection_flags, uc); - s = format (s, " fib_index: %u next_node: %u opaque: %u ", uc->c_fib_index); + s = format (s, " fib_index: %u next_node: %u opaque: %u ", uc->c_fib_index, + uc->next_node_index, uc->next_node_opaque); if (!(uc->flags & UDP_CONN_F_LISTEN)) s = format (s, " sw_if_index: %d mss: %u\n", uc->sw_if_index, uc->mss); else diff --git a/src/vpp-api/python/vpp_papi/vpp_papi_async.py b/src/vpp-api/python/vpp_papi/vpp_papi_async.py index d9a4fabb69e..44e2a78eeea 100644 --- a/src/vpp-api/python/vpp_papi/vpp_papi_async.py +++ b/src/vpp-api/python/vpp_papi/vpp_papi_async.py @@ -451,7 +451,8 @@ class VPPApiClient: for m in r.message_table: n = m.name self.message_table[n] = m.index - self.vpp_dictionary_maxid = len(self.message_table) + # Find the maximum index of the message table + self.vpp_dictionary_maxid = max(self.message_table.values() or [0]) # self.worker_task = asyncio.create_task(self.message_handler(event_queue)) requests = {} diff --git a/src/vpp-api/python/vpp_papi/vpp_transport_socket.py b/src/vpp-api/python/vpp_papi/vpp_transport_socket.py index 174ab74d0b8..1ba365ad6e1 100644 --- a/src/vpp-api/python/vpp_papi/vpp_transport_socket.py +++ b/src/vpp-api/python/vpp_papi/vpp_transport_socket.py @@ -177,7 +177,8 @@ class VppTransport: return 0 def msg_table_max_index(self): - return len(self.message_table) + """Return the maximum index of the message table.""" + return max(self.message_table.values() or [0]) def write(self, buf): """Send a binary-packed message to VPP.""" diff --git a/src/vpp/conf/startup.conf b/src/vpp/conf/startup.conf index a30a15ab2b1..8e7aebd8271 100644 --- a/src/vpp/conf/startup.conf +++ b/src/vpp/conf/startup.conf @@ -231,6 +231,18 @@ cpu { # update-interval <f64-seconds>, sets the segment scrape / update interval # } +## L3 FIB +# l3fib { + ## load balance pool size preallocation (expected number of objects) + # load-balance-pool-size 1M + + ## fib entry pool size preallocation (expected number of objects) + # fib-entry-pool-size 1M + + ## ip4 mtrie pool size preallocation (expected number of mtries) + # ip4-mtrie-pool-size 1K +# } + ## L2 FIB # l2fib { ## l2fib hash table size. diff --git a/src/vppinfra/bihash_vec8_8.h b/src/vppinfra/bihash_vec8_8.h index 822f1bcc51f..1532103e9c1 100644 --- a/src/vppinfra/bihash_vec8_8.h +++ b/src/vppinfra/bihash_vec8_8.h @@ -46,6 +46,7 @@ static inline void clib_bihash_mark_free_vec8_8 (clib_bihash_kv_vec8_8_t *v) { v->value = 0xFEEDFACE8BADF00DULL; + v->key = ~0ULL; } /** Decide if a clib_bihash_kv_vec8_8_t instance is free diff --git a/src/vppinfra/bitops.h b/src/vppinfra/bitops.h index c1122f59ff6..bf73bd95a84 100644 --- a/src/vppinfra/bitops.h +++ b/src/vppinfra/bitops.h @@ -195,6 +195,13 @@ next_with_same_number_of_set_bits (uword x) return ripple | ones; } +static_always_inline void +uword_bitmap_clear (uword *bmp, uword n_uwords) +{ + while (n_uwords--) + bmp++[0] = 0; +} + #define foreach_set_bit_index(i, v) \ for (uword _tmp = (v) + 0 * (uword) (i = get_lowest_set_bit_index (v)); \ _tmp; \ @@ -273,6 +280,34 @@ uword_bitmap_find_first_set (uword *bmp) return (b - bmp) * uword_bits + get_lowest_set_bit_index (b[0]); } +always_inline uword +uword_bitmap_get_multiple (uword *bmp, uword i, uword n_bits) +{ + uword rv; + + bmp += i / uword_bits; + i %= uword_bits; + + rv = (bmp[0] >> i); + rv &= pow2_mask (n_bits); + + if (i + n_bits <= uword_bits) + return rv; + + n_bits -= uword_bits - i; + rv |= (bmp[1] & pow2_mask (n_bits)) << (uword_bits - i); + + return rv; +} + +always_inline uword +uword_bitmap_get_multiple_no_check (uword *bmp, uword i, uword n_bits) +{ + bmp += i / uword_bits; + i %= uword_bits; + return ((bmp[0] >> i) & pow2_mask (n_bits)); +} + static_always_inline u32 bit_extract_u32 (u32 v, u32 mask) { diff --git a/src/vppinfra/time.c b/src/vppinfra/time.c index f1736499a0a..7c0ea44b481 100644 --- a/src/vppinfra/time.c +++ b/src/vppinfra/time.c @@ -332,6 +332,7 @@ format_clib_time (u8 * s, va_list * args) clib_time_t *c = va_arg (*args, clib_time_t *); int verbose = va_arg (*args, int); f64 now, reftime, delta_reftime_in_seconds, error; + u32 indent = format_get_indent (s); /* Compute vpp elapsed time from the CPU clock */ reftime = unix_time_now (); @@ -346,8 +347,14 @@ format_clib_time (u8 * s, va_list * args) error = now - delta_reftime_in_seconds; - s = format (s, ", reftime %.6f, error %.6f, clocks/sec %.6f", - delta_reftime_in_seconds, error, c->clocks_per_second); + s = format (s, "\n%Ucpu time %.6f now %lu last %lu since start %lu \n", + format_white_space, indent, now, clib_cpu_time_now (), + c->last_cpu_time, c->total_cpu_time); + s = format (s, "%Ureftime %.6f now %.6f last %.6f init %.6f\n", + format_white_space, indent, delta_reftime_in_seconds, reftime, + c->last_verify_reference_time, c->init_reference_time); + s = format (s, "%Uerror %.6f, clocks/sec %.6f", format_white_space, indent, + error, c->clocks_per_second); return (s); } |