aboutsummaryrefslogtreecommitdiffstats
path: root/src/vnet/session/application_namespace.c
AgeCommit message (Collapse)AuthorFilesLines
2024-11-08session: validate appns index in vnet_session_rule_add_delSteven Luong1-0/+8
vnet_session_rule_add_del may be called with a bogus appns index from the API. Validate the appns index is indeed valid. Type: fix Change-Id: Ife1b5b9ab0b180ececa74008d2ef92045a9e8b58 Signed-off-by: Steven Luong <sluong@cisco.com>
2024-11-06session: session table holding free appns indexSteven Luong1-3/+5
session table may be shared among multiple appns's. app ns add id blue secret 1 if tap0 app ns add id red secret 1 if tap0 session table holds the last added app_ns's appns_index. If the last app_ns is deleted, session table is not free since there is still an appns which uses the same session table. In that case, session table is holding the free app_ns's appns_index and it can cause problem. The fix is to modify appns_index in session table to hold a vector of appns_index's instead of just the appns_index that was last added. When the app ns is deleted, remove the deleted appns_index from the session table's vector of appns_index's. Type: fix Change-Id: Ied8bc97f185071dc89b9b56656e18efbd2995131 Signed-off-by: Steven Luong <sluong@cisco.com>
2024-09-06session: add Source Deny ListSteven Luong1-0/+11
With this feature, session enable is now modified to have 3 modes of operation session enable -- only enable session session enable rt-backend sdl -- enable session with sdl session enable rt-backend rule-table -- enable session with rule-table session rule tables are now created on demand, upon adding first rule to the rule table. refactor session table to remove depenency from sesssion rules table. Now session rules table APIs take srtg_handle and transport proto instead of srt pointer. Type: feature Change-Id: Idde6a9b2f46b29bb931f9039636562575572aa14 Signed-off-by: Steven Luong <sluong@cisco.com>
2024-07-24session: delete and add application namespace do not create the global ↵Steven Luong1-64/+2
session table When an application namespace is added, we call session_table_is_alloced to see if we need to allocate a new session table. That check returns true even if we removed the session table. The fix is when we delete an application's global session table, we need to invalidate fib_index_to_table_index. Fixed test_vcl test script to run two tests back to back. The 1st test deletes the application namespace at the end. The 2nd test adds the application namespace in the beginning. Type: fix Fixes: 67bae20b05cb46e5f6d19afeaf1f7a52a5309d59 Change-Id: I67f5cc1b726a07659597a9479df011717db08d0a Signed-off-by: Steven Luong <sluong@cisco.com>
2024-07-15session: application namespace may reference a deleted vrf tableSteven Luong1-5/+68
lock the vrf table when adding an application namespace and unlock the vrf table when deleting an application namespace. Free the session table when no more application namespace uses it anymore to avoid memory leaks. Type: fix Change-Id: I10422c9a3b549bd4403962c925e29dd61a058eb0 Signed-off-by: Steven Luong <sluong@cisco.com>
2024-03-12misc: remove GNU Indent directivesDamjan Marion1-6/+0
Type: refactor Change-Id: I5235bf3e9aff58af6ba2c14e8c6529c4fc9ec86c Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-07-26session: use session error type instead of vnet errorFilip Tehlar1-8/+7
Type: improvement Change-Id: Ie0bad9e03ac2e29da23af01ee7f63cb44489ad9c Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
2023-04-28session: update due to clib_socket refactoringNathan Skrzypczak1-19/+3
After the clib_socket_init syntax changed, the behavior of VCL socket creation was broken. This patch introduces app_namespace_add_del_v4 to address the behavioral change. Type: refactor Change-Id: Ice016bdb372233fd3317f166d45625e086e9b4df Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-10-05session: Add session_sapi_enable_disableNathan Skrzypczak1-3/+8
Type: feature This adds an API message to do the switch at runtime. Change-Id: Ice6b69c57f0bfbf5668182e25593362ff4133615 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-09-21session: implement app_ns deletionNathan Skrzypczak1-30/+77
Type: feature Change-Id: If0edbb21a0283d66c648a9e190d238c8cfa56353 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-09-20session: use table_format in sh app nsNathan Skrzypczak1-10/+22
Type: refactor Change-Id: I99162d80280e0f45344671b18b1ea96db90d4282 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-09-16session: Add sock_name option to add_nsNathan Skrzypczak1-21/+59
This adds a new API call to add session namespaces It now takes a netns and a sock_name. (1) If no netns is passed, sock_name will be used as socket path. Defaulting to /run/vpp/app_ns_sockets/${ns_id} (2) If a netns is passed, the sock_name has to be abstract (i.e. start with '@'). It will default to `@vpp/session/${ns_id}` and will be created in the provided netns. Type: feature Change-Id: I90e9a8e5ecca2cabe7c05335663e33c8506dc9e7 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-07-23session vcl: support abstract sockets for app nsFlorin Coras1-13/+31
App namespaces can now be associated to a linux ip netns, e.g.: app ns add id <ns_id> secret <n> sw_if_index <n> netns <netns> If session layer's app sock api is enabled, this triggers the creation of an abstract listening socket in the netns that has been configured. For the example above that would be @vpp/session/<ns_id>. Consequently, vcl, or other apps attaching to vpp, can connect to said abstract socket from an ip netns without the need to share unix domain socket files. In particular, for vcl it's enough to set app-socket-api to @vpp/session/<ns_id> in the conf file. Type: feature Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I26fdc626a760a3f423c5b8be4251623f6e9cd73a
2020-12-14misc: move to new pool_foreach macrosDamjan Marion1-4/+4
Type: refactor Change-Id: Ie67dc579e88132ddb1ee4a34cb69f96920101772 Signed-off-by: Damjan Marion <damarion@cisco.com>
2020-09-14session: add unix socket api for app attachmentFlorin Coras1-2/+74
This is an af_unix socket alternative to the binary api. To enable it, add use-app-socket-api under session stanza in startup.conf. When the socket api is enabled, attachments through the binary api are disabled. The socket api only works with memfd fifo segments, i.e., shm segments are not supported. Type: feature Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I55ffcee201d004846daeeec85c700c7e7a578d43
2019-07-23api: binary api cleanupDave Barach1-1/+2
Multiple API message handlers call vnet_get_sup_hw_interface(...) without checking the inbound sw_if_index. This can cause a pool_elt_at_index ASSERT in a debug image, and major disorder in a production image. Given that a number of places are coded as follows, add an "api_visible_or_null" variant of vnet_get_sup_hw_interface, which returns NULL given an invalid sw_if_index, or a hidden sw interface: - hw = vnet_get_sup_hw_interface (vnm, sw_if_index); + hw = vnet_get_sup_hw_interface_api_visible_or_null (vnm, sw_if_index); if (hw == NULL || memif_device_class.index != hw->dev_class_index) return clib_error_return (0, "not a memif interface"); Rename two existing xxx_safe functions -> xxx_or_null to make it obvious what they return. Type: fix Change-Id: I29996e8d0768fd9e0c5495bd91ff8bedcf2c5697 Signed-off-by: Dave Barach <dave@barachs.net>
2019-02-11session: cleanup application interfaceFlorin Coras1-10/+9
Change-Id: I89d240753b3f3c5e984aa303a7c8fa35fa59bf7f Signed-off-by: Florin Coras <fcoras@cisco.com>
2019-02-04session: cleanup part 1Florin Coras1-1/+1
Rename core data structures. This will break compatibility for out of tree builtin apps. - stream_session_t to session_t - server_rx/tx_fifo to rx/tx_fifo - stream_session.h to session_types.h - update copyright Change-Id: I414097c6e28bcbea866fbf13b8773c7db3f49325 Signed-off-by: Florin Coras <fcoras@cisco.com>
2018-10-23c11 safe string handling supportDave Barach1-1/+1
Change-Id: Ied34720ca5a6e6e717eea4e86003e854031b6eab Signed-off-by: Dave Barach <dave@barachs.net>
2018-03-29tcp: fix fib index buffer taggingFlorin Coras1-1/+1
Change-Id: I373cc252df3621d44879b8eca70aed17d7752a2a Signed-off-by: Florin Coras <fcoras@cisco.com>
2017-11-22session: more rules unit tests and cli improvementsFlorin Coras1-5/+4
Change-Id: I7e5545297ab9f2db8d7d07e44c744bdb0a0874a7 Signed-off-by: Florin Coras <fcoras@cisco.com>
2017-11-20session/tcp: filtering improvementsFlorin Coras1-3/+5
- make allow action explicit (-3) - add session lookup is_filtered return flag that is set if lookup hit a deny filter - change tcp logic to drop filtered packets when punting is enabled Change-Id: Ic38f294424663a4e108439b7571511f46f8e0be1 Signed-off-by: Florin Coras <fcoras@cisco.com>
2017-11-09session: fix app ns list cli dumpFlorin Coras1-4/+8
Change-Id: I9b0a4676d088bc7587d12023fc3a3ea53aeaba20 Signed-off-by: Florin Coras <fcoras@cisco.com>
2017-11-08session: fix show app ns table cliFlorin Coras1-10/+15
Change-Id: I188e0471636683345bd9daa779c3680a616c2244 Signed-off-by: Florin Coras <fcoras@cisco.com>
2017-11-05session: add api to dump rulesFlorin Coras1-1/+4
Change-Id: Ie42fd77e75e86a45cfe5951768c4638f27fdc3aa Signed-off-by: Florin Coras <fcoras@cisco.com>
2017-10-28session: rules tablesFlorin Coras1-0/+13
This introduces 5-tuple lookup tables that may be used to implement custom session layer actions at connection establishment time (session layer perspective). The rules table build mask-match-action lookup trees that for a given 5-tuple key return the action for the first longest match. If rules overlap, ordering is established by tuple longest match with the following descending priority: remote ip, local ip, remote port, local port. At this time, the only match action supported is to forward packets to the application identified by the action. Change-Id: Icbade6fac720fa3979820d50cd7d6137f8b635c3 Signed-off-by: Florin Coras <fcoras@cisco.com>
2017-10-27session: instantiate appns lookup table only onceFlorin Coras1-7/+10
Change-Id: I39d634b7691a524e5221c28997a737102298c281 Signed-off-by: Florin Coras <fcoras@cisco.com>
2017-10-26VCL: add session namespace support.Dave Wallace1-11/+24
Change-Id: I04f1b63e66260d99c0dd180b0295a55a9b750df7 Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
2017-10-10session: add support for application namespacingFlorin Coras1-0/+293
Applications are now provided the option to select the namespace they are to be attached to and the scope of their attachement. Application namespaces are meant to: 1) constrain the scope of communication through the network by association with source interfaces and/or fib tables that provide the source ips to be used and limit the scope of routing 2) provide a namespace local scope to session layer communication, as opposed to the global scope provided by 1). That is, sessions can be established without assistance from transport and network layers. Albeit, zero/local-host ip addresses must still be provided in session establishment messages due to existing application idiosyncrasies. This mode of communication uses shared-memory fifos (cut-through sessions) exclusively. If applications request no namespace, they are assigned to the default one, which at its turn uses the default fib. Applications can request access to both local and global scopes for a namespace. If no scope is specified, session layer defaults to the global one. When a sw_if_index is provided for a namespace, zero-ip (INADDR_ANY) binds are converted to binds to the requested interface. Change-Id: Ia0f660bbf7eec7f89673f75b4821fc7c3d58e3d1 Signed-off-by: Florin Coras <fcoras@cisco.com>