summaryrefslogtreecommitdiffstats
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
2023-11-09ipsec: IPsec fix constant propagationMaxime Peim1-2/+3
In some anti-replay, some functions weren't using the boolean telling if the window was huge or not. Hence, limiting the constant propagation at compilation. Type: fix Change-Id: Ie5f2dda38339bb32113c6f7b2b82c82135fc92a8 Signed-off-by: Maxime Peim <mpeim@cisco.com>
2023-11-08tls: avoid reads after tcp transport removedFlorin Coras1-4/+18
Make sure underlying transport connection is not removed on rescheduled read event. Type: fix Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I0137a2e43aa84d9442279e036c25771aeefd207f
2023-11-08dev: remove unused codeDamjan Marion3-37/+0
Change-Id: If380e4ab6ca30243137fd31fbe51845c0414721a Type: improvement Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-08dev: interrupt mode supportDamjan Marion10-154/+306
Type: improvement Change-Id: I4a0578598182339bcf76e6b01da76b590a06f773 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-07af_packet: remove UNIX_FILE_EVENT_EDGE_TRIGGERED flagArtem Glazychev1-1/+0
af_packet does not process data until the interface is UP. If after interface creation, but before it is UP, the host interfaces are flooded, then blocking case may occur - VPP interface will never be able to process the data. If the EDGE_TRIGGERED flag is set, the event will not arrive, because nothing new is happening anymore (probably because the queue is already full). Therefore, we need to use LEVEL_TRIGGERED (default value), which indicates that there is still unprocessed data (accumulated after interface creation, but before it was UP). Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: Ied459fd194149d09f226bcb0a5907b3e327b148a
2023-11-07flowprobe: fix clearing interface state on feature disablingAlexander Chernavin1-0/+3
As a result of recent fixes, all currently stored flows of an interface are deleted when the feature is being disabled for the interface. This includes stopping the timer and freeing the flow entries for further reuse. The problem is that meta information is not cleared in the flow entries being deleted. For example, packet delta count will keep its value. The next flow that gets one of these pool entries will already have a non-zero packet count. So the counting of packets will start from a non-zero value. And incorrect packet delta count will be exported for that flow. With this fix, clear meta information too when clearing interface state. Also, update the corresponding test to cover this case. Type: fix Change-Id: I9a73b3958adfd1676e66b0ed50f1478920671cca Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
2023-11-07build: disable bogus warnings for GCC 12Jieqiang Wang1-0/+8
The array bounds and string overread check on GCC 12 report a dozen of false positives that result in VPP build failures on ubuntu 22.04. Work around this build issue by unconditionally disabling these two warnings if C compiler is GCC 12 or newer version. Type: fix Signed-off-by: Jieqiang Wang <jieqiang.wang@arm.com> Change-Id: I999e847bb625ebdf3ef5f11b11598c553f306670
2023-11-07misc: silence -Wmaybe-uninitialized warningsJieqiang Wang4-4/+4
GCC 12 complains about such errors while the code itself looks good. Type: fix Signed-off-by: Jieqiang Wang <jieqiang.wang@arm.com> Change-Id: I021719fdbf7d9bd93a12eac76aeac8cbca13a810
2023-11-06vppinfra: fix ASAN issue in vec_foreach_pointer and pool_foreach_pointerDamjan Marion2-5/+6
Change-Id: If9381ae7283488b352a3c22f85732cd56ac6bfd9 Type: fix Fixes: 9937359, 91ff0e9 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-06ipsec: delete redundant codeDengfeng Liu1-4/+0
Type: fix Change-Id: I0de1c51455b0d3958c75ab5626a318ac656adbe7 Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>
2023-11-06dpdk: correct the printing of Rx offloading flagsJieqiang Wang1-1/+1
DPDK added new Rx checksum flags[1] to handle cases like the virtual drivers. Current check of flags is not strict enough for flags like RTE_MBUF_F_RX_IP_CKSUM_NONE and will always be true no matter the checksum in packet is good or bad. Fix this issue by comparing the result of AND operation with the correspinding Rx checksum flags. Before this patch, packet trace prints the offload flags as below: Packet Offload Flags PKT_RX_IP_CKSUM_GOOD (0x0080) IP cksum of RX pkt. is valid PKT_RX_IP_CKSUM_NONE (0x0090) no IP cksum of RX pkt. PKT_RX_L4_CKSUM_GOOD (0x0100) L4 cksum of RX pkt. is valid PKT_RX_L4_CKSUM_NONE (0x0108) no L4 cksum of RX pkt. After this patch, packet offload flags would be like: Packet Offload Flags PKT_RX_IP_CKSUM_GOOD (0x0080) IP cksum of RX pkt. is valid PKT_RX_L4_CKSUM_GOOD (0x0100) L4 cksum of RX pkt. is valid Type: fix [1] https://github.com/DPDK/dpdk/commit/5842289a546ceb0072bd7faccb93821e21848e07 Signed-off-by: Jieqiang Wang <jieqiang.wang@arm.com> Change-Id: I3182022d9ccd46b2fc55bb3edfbfac9062ed7c89
2023-11-06pci: remove unnecessary ioctl() call and improve logging in vfio_set_irqsDamjan Marion3-34/+49
Type: improvement Change-Id: Ic8e2785bf375882defe5a1d299948d522cdd4895 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-06pci: fix VFIO set IRQ codeDamjan Marion1-2/+2
Type: fix Fixes: 599a16b Change-Id: I954e037ab944028798f9aa2a93f45322c8c7b4bb Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-04bonding: add checks for sw_if_index in apiStanislav Zaikin1-0/+12
Type: fix Signed-off-by: Stanislav Zaikin <stanislav.zaikin@46labs.com> Change-Id: I16b48460b3fcd82bbb89c375402cb2455414d8bb
2023-11-03vppinfra: refactor interrupt codeDamjan Marion11-165/+127
Type: improvement Change-Id: Ie6987736faf7d8a641762e276775da8ee0c03ea4 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-03dev: strip debig log function name prefix during compilationDamjan Marion6-32/+14
Type: improvement Change-Id: I9b9bb37a0895366b412f042b0e2da5bbdd477325 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-02tcp: fix reset w pktFlorin Coras1-24/+3
Do not add ip header as that's added by tcp output and fix checksum. Type: fix Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I9439acf5c66184af0350b1d4d7406b3feb2e79a1
2023-11-02iavf: new driver using new dev infraDamjan Marion16-4/+4582
Type: feature Change-Id: I9ae0dbf28b4571a37c568b587b771f90c06f200d Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-02dev: new device driver infraDamjan Marion33-5/+5454
Type: feature Change-Id: I20c56e0d3103624407f18365c2bc1273dea5c199 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-11-01tcp: remove redundant ack checksFlorin Coras1-18/+0
Type: improvement Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I4001f39afde8c33b60c15f74034bcce013fbbf70
2023-11-01tcp: allow ooo data in syn-rcvdFlorin Coras1-9/+0
As long as ack and segment are legitimate accept ooo data as we transition to established. Type: improvement Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I85cdc65d70cb8ae689a9ce9bbe4f86228b1ac533
2023-11-01tcp: postpone cleanup on connect failuresFlorin Coras1-2/+6
Type: fix Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I231b319d4d7aa3e17cc8cfe8aaa4762995a5b2c4
2023-10-31hsa: use common app session interface in echo testsFilip Tehlar4-86/+56
Type: test Change-Id: Ib320cfb5e20f12614c013a92ac15490f8ca3a7ce Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
2023-10-31ipsec: separate UDP and UDP-encapsulated ESP packet processingvinay tripathi1-8/+33
This fix differentiates UDP and UDP-encapsulated ESP packets processing. While UDP-encapsulated ESP traffic is processed as IPsec traffic, UDP as other plain-text protocols is NOT dispatched against SPD policies. Key logic is taken from RFC 3948, and is based on the fact that the checksum of UDP packet encapsulating ESP packet must be zero. Type: fix Signed-off-by: vinay tripathi <vinayx.tripathi@intel.com> Change-Id: Ib1b4d240eea8e89f2daf17ec833905f26cdb31bd
2023-10-31ipsec: move udp/esp packet processing in the inline function ↵vinay tripathi1-174/+181
ipsec_esp_packet_process This inline function is introduced to simplify code readability and allows to splitting of UDP and ESP processing in the next step. Type: improvement Change-Id: Ida4d6abbed141ac74d4d285900777778eb8a5a1d Signed-off-by: Vinay Tripathi <vinayx.tripathi@intel.com>
2023-10-30hsa: preallocate sessions on server sideFilip Tehlar1-107/+110
Type: test Change-Id: Ib809f5a6c9e2f08d87f0070231df04d5f0040ca0 Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
2023-10-30vcl: propagate correctly EADDRINUSE for UDP bindMohammed Hawari1-2/+6
Change-Id: Ia8b5421cbaaf861ddb3ad7aeca53a077ff18864e Signed-off-by: Mohammed Hawari <mohammed@hawari.fr> Type: fix
2023-10-30ipsec: huge anti-replay window supportMaxime Peim13-178/+695
Type: improvement Since RFC4303 does not specify the anti-replay window size, VPP should support multiple window size. It is done through a clib_bitmap. Signed-off-by: Maxime Peim <mpeim@cisco.com> Change-Id: I3dfe30efd20018e345418bef298ec7cec19b1cfc
2023-10-30flowprobe: fix accumulation of tcp flags in flow entriesAlexander Chernavin1-0/+1
Currently, TCP flags of a flow entry don't get reset once the flow is exported (unlike other meta information about a flow - packet delta count and octet delta count). So TCP flags are accumulated as long as the flow is active. When the flow expires, it is exported the last time, and its pool entry is freed for further reuse. The next flow that gets this pool entry will already have non-zero TCP flags. If it's a TCP flow, the flags will keep being accumulated. This might look fine when exported. If it's a non-TCP flow, that will definitely look erroneous. With this fix, reset TCP flags once the flow is exported. Also, cover the reuse case with tests. Type: fix Change-Id: I5f8560afffcfe107909117d3d063e8a69793437e Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
2023-10-27session: fix bind replies with errorsFlorin Coras1-1/+1
Type: fix Signed-off-by: Mohammed Hawari <mohammed@hawari.fr> Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: Icdff3528fcaf863b400b9aca6c30d284bc17d5f0
2023-10-27hsa: fix coverity warningFilip Tehlar1-0/+5
Type: test Change-Id: Iba94edb7eb439ddc994d9a16cb52108373d052ce Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
2023-10-26devices: remove unused codeDamjan Marion4-39/+0
Type: improvement Change-Id: I2427e1a93e89e9a7ac884b84352b96cf523ae11e Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-10-26hsa: unify echo test setupFilip Tehlar10-544/+1026
Type: test Change-Id: I8665492c2f7755901a428aacdb27e98329ff557a Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
2023-10-26build: allow for reproducible buildsAndrew Yourtchenko1-1/+16
Setting and using the SOURCE_DATE_EPOCH variable takes care of most of the magic necessary. https://reproducible-builds.org/docs/source-date-epoch/ vpp-ext-deps packages after this change is being built with that date set to date of the last modification of the subtree (similar logic to deriving the "number" for the package version) For the rest of the packages, pinning the following three variables should result in bit-identical artifacts across multiple runs: export SOURCE_DATE_EPOCH=$(date +%s) export VPP_BUILD_HOST="buildhost" export VPP_BUILD_USER="builduser" Add a blurb in the docs describing this new functionality. Type: improvement Change-Id: I71b085f0577b2358aa98f01dafd8e392239420a6 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
2023-10-25lisp: fix missing symbol issueDamjan Marion2-3/+0
Type: fix Change-Id: I9373dabcdb2c4ba987e732b59e63b52603010873 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-10-25buffers: buffer name is vector, not c stringDamjan Marion1-6/+7
Type: fix Fixes: 8973b07 Change-Id: Iba6e29bab35be0148b469965c3af8391b5ab9140 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-10-25marvell: fix compilation issuesDamjan Marion3-9/+4
Type: fix Fixes: unknown Change-Id: I81ee03aaea2e1e6ffb9d6ee91db7fb9acd6debb7 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-10-25fib: only update glean for interface if necessaryMatthew Smith2-8/+81
Type: improvement If an interface address is added, the glean adjacency for it's covering prefix is updated with that address. In the case of multiple addresses within the same prefix being added, the most recently added one will end up being used as the sender protocol address for ARP requests. Similar behavior occurs when an interface address is deleted. The glean adjacency is updated to some appropriate entry under it's covering prefix. If there were multiple interface addresses configured, we may update the address on the adjacency even though the address currently in use is not the one being deleted. Add a new value PROVIDES_GLEAN to fib_entry_src_flag_t. The flag identifies whether a source interface entry is being used as the address for the glean adjacency for the covering prefix. Update logic so that the glean is only updated on adding an interface address if there is not already a sibling entry in use which has the flag set. Also, only update the glean on deleting an interface address if the address being deleted has the flag set. Also update unit test which validates expected behavior in the case where multiple addresses within a prefix are configured on an interface. Signed-off-by: Matthew Smith <mgsmith@netgate.com> Change-Id: I7d918b8dd703735b20ec76e0a60af6d7e571b766
2023-10-24crypto: fix algo selectionDmitry Valter1-1/+4
Check if crypto ops vector is matching actual ops instead if blindly dereferencing it. Type: fix Signed-off-by: Dmitry Valter <d-valter@yandex-team.com> Change-Id: Ib88ab44137d9360ee96228e72349a62b2fa7a7e0
2023-10-18flowprobe: fix sending L4 fields in L2 template and flowsAlexander Chernavin2-3/+13
Currently, when L2 and L4 recording is enabled on the L2 datapath, the L2 template will contain L4 fields and L2 flows will be exported with those fields always set to zero. With this fix, when L4 recording is enabled, add L4 fields to templates other than the L2 template (i.e. to the IP4, IP6, L2_IP4, and L2_IP6 templates). And export L2 flows without L4 fields. Also, cover that case in the tests. Type: fix Change-Id: Id5ed8b99af5634fb9d5c6e695203344782fdac01 Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
2023-10-18memif: contention between memif_disconnect and memif RX/TX threadsSteven Luong1-0/+11
memif_disconect may be called without barrier sync. It removes stuff in mq without protection which may cause troubles for memif RX/TX worker threads. The fix is to protect mq removal in memif_disconnect. Type: fix Change-Id: I368c466d1f13df98980dfa87e8442fbcd822a428 Signed-off-by: Steven Luong <sluong@cisco.com>
2023-10-17buffers: introduce vlib_buffer_template_tDamjan Marion4-79/+91
Type: improvement Change-Id: Ie86a5edf2ada21355543e9a0382052b16ff86927 Signed-off-by: Damjan Marion <damarion@cisco.com>
2023-10-16tcp: initialize connection index on rst w packetFlorin Coras1-0/+1
Type: fix Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: Ie01d7e8d6eddf3ba88f2cd6eb8369c8ec8179cb4
2023-10-16tcp: allow fins in syns in syn-rcvdFlorin Coras1-7/+11
Also make sure connection is properly cleaned up. Type: fix Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I02f83e9a1e17cbbbd2ee74044d02049b2fd2f21c
2023-10-16tcp: handle syn-ack in fin-wait-2 in rcv processFlorin Coras1-0/+2
Type: fix Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: If74e04498423bed42593e79ec92482421cfda8d2
2023-10-16ip-neighbor: do not use sas to determine NS source addressOle Troan1-2/+3
Using the source address selection algorithm to determine the best source of an NS for address resolution risks incompatible behavior. It may choose a source address that is off-link to the other host. Which may drop it. A safer approach is to always use the link-local address as the SA. It's recommended to pick a source that an application will later use, as VPP is mostly a router, that rarely applies. And regardlessly we have no mechanism to signal from an application that triggered address resolutiuon what source address it intends to use. Type: fix Change-Id: I3c5de66e41505f3682767706ef1195a20e4f0e54 Signed-off-by: Ole Troan <otroan@employees.org>
2023-10-16flowprobe: fix corrupted packets sent after feature disablingAlexander Chernavin3-2/+54
When IPFIX flow record generation is enabled on an interface and the active timer is set, flows will be saved and then exported according to the active and passive timers. If then disable the feature on the interface, the flow entries currently saved will remain in the state tables. They will gradually expire and be exported. The problem is that the template for them has already been removed. And they will be sent with zero template ID which will make them unreadable. A similar problem will occur if feature settings are "changed" on the interface - i.e. disable the feature and re-enable it with different settings (e.g. set a different datapath). The remaining flows that correspond to the previous feature settings will be eventually sent either with zero template ID or with template ID that corresponds to the current feature settings on the interface (and look like garbage data). With this fix, flush the current buffers before template removal and clear the remaining flows of the interface during feature disabling. Type: fix Change-Id: I1e57db06adfdd3a02fed1a6a89b5418f85a35e16 Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
2023-10-16nat: add ipfix rate-limiter for nat44-ed, nat44-ei and nat64Vladislav Grishenko3-5/+54
This prevents ipfix flood with the repeating events and allows to enable nat64 max_session and max_bibs events. Also fix wrong endian for det44 and nat64 ipfix tests, now should be fine with extended tests enabled. Max session per user event @ nat44-ei requires more precise rate limiter per user address, probably with sparse vec, not handled. Type: improvement Signed-off-by: Vladislav Grishenko <themiron@yandex-team.ru> Change-Id: Ib20cc1ee3f81e7acc88a415fe83b4e2deae2a836
2023-10-16npt66: icmp6 alg to handle icmp6 error messagesOle Troan1-1/+76
Support rewriting the inner packet for ICMP6 error messages. Type: feature Change-Id: I7e11f53626037075a23310f1cb7e673b0cb52843 Signed-off-by: Ole Troan <otroan@employees.org>
2023-10-16ip-neighbor: add ip neighbor flushOle Troan1-2/+11
Flushing the neighbor cache was only available through API. Add CLI command. Either flushes whole table (IP4,IP6) or all neighbors on specified interface. Type: improvement Change-Id: Ia8c68fb032a2dfd940a136edc2aee80db5c37685 Signed-off-by: Ole Troan <otroan@employees.org>