summaryrefslogtreecommitdiffstats
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
2021-10-12unittest: fix crypto key len coverity warningFlorin Coras1-1/+1
Type: fix Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: Id41e22345be3ec401813ba43ddc7d92666784eb4
2021-10-12api: cli coverity fixesFlorin Coras1-2/+2
Type: fix Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I515be7ea213250fe89a2b2be06f3636fe8f493a8
2021-10-12ipsec: Performance improvement of ipsec4_output_node using flow cacheGovindarajan Mohandoss8-17/+266
Adding flow cache support to improve outbound IPv4/IPSec SPD lookup performance. Details about flow cache: Mechanism: 1. First packet of a flow will undergo linear search in SPD table. Once a policy match is found, a new entry will be added into the flow cache. From 2nd packet onwards, the policy lookup will happen in flow cache. 2. The flow cache is implemented using bihash without collision handling. This will avoid the logic to age out or recycle the old flows in flow cache. Whenever a collision occurs, old entry will be overwritten by the new entry. Worst case is when all the 256 packets in a batch result in collision and fall back to linear search. Average and best case will be O(1). 3. The size of flow cache is fixed and decided based on the number of flows to be supported. The default is set to 1 million flows. This can be made as a configurable option as a next step. 4. Whenever a SPD rule is added/deleted by the control plane, the flow cache entries will be completely deleted (reset) in the control plane. The assumption here is that SPD rule add/del is not a frequent operation from control plane. Flow cache reset is done, by putting the data plane in fall back mode, to bypass flow cache and do linear search till the SPD rule add/delete operation is complete. Once the rule is successfully added/deleted, the data plane will be allowed to make use of the flow cache. The flow cache will be reset only after flushing out the inflight packets from all the worker cores using vlib_worker_wait_one_loop(). Details about bihash usage: 1. A new bihash template (16_8) is added to support IPv4 5 tuple. BIHASH_KVP_PER_PAGE and BIHASH_KVP_AT_BUCKET_LEVEL are set to 1 in the new template. It means only one KVP is supported per bucket. 2. Collision handling is avoided by calling BV (clib_bihash_add_or_overwrite_stale) function. Through the stale callback function pointer, the KVP entry will be overwritten during collision. 3. Flow cache reset is done using BV (clib_bihash_foreach_key_value_pair) function. Through the callback function pointer, the KVP value is reset to ~0ULL. MRR performance numbers with 1 core, 1 ESP Tunnel, null-encrypt, 64B for different SPD policy matching indices: SPD Policy index : 1 10 100 1000 Throughput : MPPS/MPPS MPPS/MPPS MPPS/MPPS KPPS/MPPS (Baseline/Optimized) ARM Neoverse N1 : 5.2/4.84 4.55/4.84 2.11/4.84 329.5/4.84 ARM TX2 : 2.81/2.6 2.51/2.6 1.27/2.6 176.62/2.6 INTEL SKX : 4.93/4.48 4.29/4.46 2.05/4.48 336.79/4.47 Next Steps: Following can be made as a configurable option through startup conf at IPSec level: 1. Enable/Disable Flow cache. 2. Bihash configuration like number of buckets and memory size. 3. Dual/Quad loop unroll can be applied around bihash to further improve the performance. 4. The same flow cache logic can be applied for IPv6 as well as in IPSec inbound direction. A deeper and wider flow cache using bihash_40_8 can replace existing bihash_16_8, to make it common for both IPv4 and IPv6 in both outbound and inbound directions. Following changes are made based on the review comments: 1. ON/OFF flow cache through startup conf. Default: OFF 2. Flow cache stale entry detection using epoch counter. 3. Avoid host order endianness conversion during flow cache lookup. 4. Move IPSec startup conf to a common file. 5. Added SPD flow cache unit test case 6. Replaced bihash with vectors to implement flow cache. 7. ipsec_add_del_policy API is not mpsafe. Cleaned up inflight packets check in control plane. Type: improvement Signed-off-by: mgovind <govindarajan.Mohandoss@arm.com> Signed-off-by: Zachary Leaf <zachary.leaf@arm.com> Tested-by: Jieqiang Wang <jieqiang.wang@arm.com> Change-Id: I62b4d6625fbc6caf292427a5d2046aa5672b2006
2021-10-12session: set actual lcl ip on accepted ctFlorin Coras1-1/+1
Type: improvement Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: Ic2ba5fa234a394acb524b61573fc49f2d58c2dea
2021-10-12memif: fix the memif crash when slave disconnectMohsin Kazmi1-1/+2
Type: fix Fixes: 3effb4e63068 ("memif: integrate with new tx infra") memif is recently integrated with new tx infra. But it introduces a crash when slave disconnect from master but interface is not deleted. Disconnect routine was missing unregister of all tx queues. This patch fixes it. Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com> Change-Id: I81c59cc1a03561248ec8595d5e3caa54f421833e
2021-10-12Revert "nat: static mappings in flow hash"Ole Troan27-1058/+1457
This reverts commit 69b7599e4b061a8996205f0304232ede84cb70d4. Type: fix Signed-off-by: Ole Troan <ot@cisco.com> Change-Id: If531b122ae5a9f91c2fe6eaa0da69922a91f16d3
2021-10-12nat: static mappings in flow hashKlement Sekera27-1457/+1058
Put static mappings in flow hash, drop existing hash tables used for static mappings. Drop refcount variables and use hash table as a single point of truth. Allow creating a static mapping conflicting with dynamic mapping, which will take precedence after dynamic mapping is freed, so that the existing flow can finish transferring data. Type: fix Signed-off-by: Klement Sekera <ksekera@cisco.com> Change-Id: Ieeba691d83a83887d0a0baccd5f3832f66126096
2021-10-11api: set missing handlersFilip Tehlar1-0/+3
Type: fix Signed-off-by: Filip Tehlar <ftehlar@cisco.com> Change-Id: I1fdefeaa4661c03e819b2f2f25762c633f9ab42c
2021-10-11vat: move memset after initFilip Tehlar2-2/+2
Type: fix Signed-off-by: Filip Tehlar <ftehlar@cisco.com> Change-Id: Ia65fd2f99dfe6538411c247aeb9691c590c2e00b
2021-10-11l3xc: skip load balancing if not multipathBenoît Ganne1-5/+5
Type: improvement Change-Id: I3d8e1c7a83530bbc4b1751358ad7d034476ff13f Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-11ip: fix fib and mfib locksNathan Skrzypczak13-96/+99
This patches fixes an issue that could cause fib locks to underflow: if an API user deletes a fib and quickly recreates it, the fib may not have been actually deleted. As a result, the lock would not be incremented on the create call leading to the fib potentially disappearing afterwards - or to the lock to underflow when the fib is deleted again. In order to keep the existing API semantics, we use the locks with API and CLI source as flags. This means we need to use a different counter for the interface-related locks. This also prevents an issue where an interface being bound to a vrf via API and released via CLI could mess up the lock counter. Finally, this will help with cleaning up the interface-related locks on interface deletion in a later patch. Type: fix Change-Id: I93030a7660646d6dd179ddf27fe4e708aa11b90e Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com> Signed-off-by: Aloys Augustin <aloaugus@cisco.com>
2021-10-11docs: nitfixes in FEATURE.yamlNathan Skrzypczak8-9/+9
Type: improvement Change-Id: Iec585880085b12b08594a0640822cd831455d594 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-10-11af_xdp: ensure at least one queue is createdJoshua Roys1-1/+4
Attempting to create an af_xdp interface with zerocopy where the underlying driver didn't support it would lead to a crash due to queue creation silently failing. Type: fix Signed-off-by: Joshua Roys <roysjosh@gmail.com> Change-Id: Ifd9070b8c2b3023d71120c5cf20f7e89d04e4cb3
2021-10-08tls: shutdown openssl context on app closeFlorin Coras1-0/+2
Type: improvement Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: Ie0fde16fb4e41637169474628808fddf343884f3
2021-10-08vxlan-gpe: add udp-port configuration supportArtem Glazychev7-283/+452
similar behavior as here: 839dcc0fb7313638d9b8f52a9db81350dddfe461 Type: improvement Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: I1b0a8f8f3dab48839e27df7065cf5f786cf0b5e9
2021-10-08ikev2: lazy initializationBenoît Ganne4-52/+111
- do not initialize resources if ikev2 is not used. - process IKE packets only if we have profile(s) configured Type: improvement Change-Id: I57c95a888532eafd70989096c0555ebb1d7bef25 Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-07ipsec: fix protect update log if nexthop is NULLBenoît Ganne1-2/+3
If logging is on, it will try to print the address nh. Make sure it is not NULL. Type: fix Change-Id: I81c0295865901406d86e0d822a103b4d5adffe47 Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-07wireguard: peers dump fixArtem Glazychev1-1/+1
Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: I4450b8c8b50a3be8d6a399f6a58bc0e8eb500b28
2021-10-07vppinfra: asan: improve overflow semanticBenoît Ganne4-36/+46
Type: improvement Change-Id: Ia63899b82e34f179f9efa921e4630b598f2a86cb Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-07build: fix ipsecmb version checkFan Zhang1-5/+5
Type: fix This patch fixes the chacha20-poly1305 support check in ipsecmb engine build. Signed-off-by: Fan Zhang <roy.fan.zhang@intel.com> Signed-off-by: PiotrX Kleski <piotrx.kleski@intel.com> Change-Id: I74b52a27f78a0f6a65c867dbd44a44a8f4a2ed60
2021-10-07udp: fix severity error infoFilip Tehlar4-25/+25
Type: fix Signed-off-by: Filip Tehlar <ftehlar@cisco.com> Change-Id: I415d68b39ecac546b531f6eb98bca51e7eb6f7f7
2021-10-07ip: fix path MTU node errors definitionBenoît Ganne3-3/+7
The path mtu node uses errors defined by ip fragmentation. Type: fix Change-Id: I1f173955919a4f555ab0309cd8201ec342a0ae92 Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-07ikev2: do not require optional IDr on IKE AUTHBenoît Ganne1-8/+26
IDr is optional in IKE AUTH from the initiator. In that case, the responder is free to use any matching profile and fills the corresponding IDr in the response. The initiator is then free to accept or reject it. Type: improvement Change-Id: I07a1c64a40ed22bd41767c259406238bbbab5cf4 Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-07ikev2: add logs in case of parsing errorsBenoît Ganne1-6/+24
Type: improvement Change-Id: Id0a6a9e68725ea7aa0b7da14cf54d14405a907fb Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-07ikev2: do not send IDi on responder AUTHBenoît Ganne1-1/+0
The IDi is not mentioned in the RFC for the responder AUTH message, and it confuses some IKE implementations. Type: fix Change-Id: I2bcefa1efd315412a6f5fa592668d4e0da510264 Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-07arp: source address selectionEd Warnicke2-5/+13
https://gerrit.fd.io/r/c/vpp/+/30197 introduced SAS and inadvertently broke ping in a variety of situations: https://jira.fd.io/browse/VPP-1992 https://jira.fd.io/browse/VPP-1970 https://lists.fd.io/g/vpp-dev/topic/84038840 all of which seem to be rooted in situations where there's literally nothing smarter ping can do for source address selection than to pick the first IP on the interface. This can happen for: 1. P2P interfaces, see attempted fix: https://gerrit.fd.io/r/c/vpp/+/32801 2. Interfaces with /32 IP addresses intentionally assigned After some discussion, this problem was partially fixed in https://gerrit.fd.io/r/c/vpp/+/33449 Unforunately, while source selection was fixed in ping, it continued to be broken in arp/nd. This gerrit builds on https://gerrit.fd.io/r/c/vpp/+/33449 and fixes arp/nd. Type: fix Ticket: VPP-1970 Ticket: VPP-1992 Fixes: e2fe097424fb169dfe01421ff17b8ccd0c26b4a6 Change-Id: Ief60c321676a15f4f30bf4cd84d50b2f1efec432 Signed-off-by: Ed Warnicke <hagbard@gmail.com>
2021-10-07perfmon: Topdown Level 1 support on SnowridgeRay Kinsella4-1/+102
Enable Topdown Level 1 support on Snowridge, enabled with standard CPU events on small core. Type: improvement Signed-off-by: Ray Kinsella <mdr@ashroe.eu> Change-Id: I58ad09383de7464265ac1b69e683f253591e3b5e
2021-10-07perfmon: check bundle is supportedRay Kinsella1-0/+23
Add a check bundle is supported before futher activation. Enable different bundles with same name, supported on different platforms. Type: improvement Signed-off-by: Ray Kinsella <mdr@ashroe.eu> Change-Id: I73e8bbd1e07c05ebccd9146d48a234eb598a2388
2021-10-07perfmon: fix peusdo eventsRay Kinsella1-1/+1
Fix peusdo events, missed populating "core" events with peusdo events. Type: fix Fixes: bf37bf6f7 Signed-off-by: Ray Kinsella <mdr@ashroe.eu> Change-Id: I569fa876f1b58540adac0b095be0ff4ade664dec
2021-10-06ip: check if interface has link-local address (addition)Artem Glazychev1-1/+6
previous - b31fbc47f5fcf8234c757558d7b0285348774086 Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: I7ea2d693d3ad5bf41ece066b3511fbfa156c1e4b
2021-10-06wireguard: add events for peerArtem Glazychev8-33/+223
we can receive events from peer about its state: -WIREGUARD_PEER_STATUS_DEAD -WIREGUARD_PEER_ESTABLISHED Type: improvement Change-Id: Ide83fbe2cfafa79ded5bcf3f6a884c26a7583db0 Signed-off-by: Artem Glazychev <artem.glazychev@xored.com>
2021-10-06session: fix severity infoFilip Tehlar1-11/+10
Type: fix Signed-off-by: Filip Tehlar <ftehlar@cisco.com> Change-Id: I6548274f8c0ae2a183b1d221cb195de445c2819f
2021-10-06wireguard: add ipv6 supportArtem Glazychev14-193/+517
Type: improvement Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: If1a7e82ce163c4c4acaa5acf45ad2b88371396f6
2021-10-06tcp: fix severity infoFilip Tehlar6-69/+69
Type: fix Signed-off-by: Filip Tehlar <ftehlar@cisco.com> Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: Ibe39bc045c3b154209a83b59ef95a37c61b32c0c
2021-10-06docs: more nitfixesNathan Skrzypczak4-46/+49
Type: fix Change-Id: I41455e1cdc62e7c0baa148630b0701b042f3b156 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-10-06build: fix lib dir in debian packagingDamjan Marion1-1/+1
Type: fix Change-Id: I64b0bbe5ba2317ab03b68f140df69a94a0dd7407 Signed-off-by: Damjan Marion <damarion@cisco.com>
2021-10-06docs: vnet comment nitfixesNathan Skrzypczak15-84/+108
Type: improvement Change-Id: Iac01d7830b53819ace8f199554be10ab89ecdb97 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-10-06vlib: doc nitfixesNathan Skrzypczak3-3/+3
Type: improvement Change-Id: I9e761f908d9d2becbc61eb0515dc6b7c1e1e036f Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-10-06ip: add classifier-based ACLs support on ip puntBenoît Ganne5-291/+301
This feature allows one to add classifier-based ACLs on packets punted from the ip infra, eg. to only whitelist specific sender(s). Type: feature Change-Id: Idab37b188583efbca980038875fc3e540cb2e880 Signed-off-by: Benoît Ganne <bganne@cisco.com>
2021-10-05session: Add session_sapi_enable_disableNathan Skrzypczak5-5/+33
Type: feature This adds an API message to do the switch at runtime. Change-Id: Ice6b69c57f0bfbf5668182e25593362ff4133615 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-10-05build: don't hardcode triplet, allow specifying custom lib dirDamjan Marion9-18/+21
Type: fix Change-Id: I33f364fda88914f88f9b976cb83e6d3ff466f0bb Signed-off-by: Damjan Marion <damarion@cisco.com> Signed-off-by: Ray Kinsella <mdr@ashroe.eu>
2021-10-05tap: free the tap_fds vec on interface deletionMohsin Kazmi1-0/+1
Type: fix Tap fds are stored in vector array but deleting tap was not freeing this vector. This patch fixes it. Change-Id: I5228e3b9f432c69cf2656b2ee7402360d775964b Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
2021-10-05perfmon: bundles with multiple typesRay Kinsella4-35/+147
Allow perfmon bundles to support more than one bundle type, either node or thread. Only used for topdown bundle for the moment. Type: improvement Signed-off-by: Ray Kinsella <mdr@ashroe.eu> Change-Id: Iba3653a4deb39b0a8ee8ad448a7e8f954283ccd8
2021-10-05nat: NAT44 ED api fix and improvementFilip Varga3-14/+178
Backward compatibility fix returns erroneous behavior that lets user add internally unused inside interface for the purpose of complying with the old add/dump/details API behavior. Change introduced in https://gerrit.fd.io/r/c/vpp/+/32951 removed extra inside interface that wasn't required or any how used by the output feature. This patch also changed outside interface flags to inside & outside. This fix returns the old behavior by imitating the old behavior through dummy registratoin data. Added new API calls nat44_ed_add_del_output_interface and nat44_ed_output_interface_get/details as a replacement of old API's. New API introduces simplified and cleaner way of configuring outside feature without requirement of config flags. Type: improvement Signed-off-by: Filip Varga <fivarga@cisco.com> Change-Id: I7a170f7325727c04da5e2e3ffbe3f02179531284
2021-10-04interface: free the output_node_thread_runtimesMohsin Kazmi1-0/+1
Type: fix output_node_thread_runtimes was not freed when an interface is deleted. This patch fixes it. Change-Id: I763b0109be1904d43839528a346f3b9aa8927205 Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
2021-10-04interface: remove the redundant vec_free on rx_queue_indicesMohsin Kazmi1-1/+0
Type: fix vnet_delete_hw_interface() calls vec_free on rx_queue_indices. function vnet_hw_if_unregister_all_rx_queues() is used to free rx_queue_indices which is also called by vnet_delete_hw_interface(). So, second vec_free is redundant. Change-Id: Ibda4be38fd122d33532bb384c97b0b9e5f441134 Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
2021-10-04build: Allow ipsec-mb plugin to build with libipsec_mb 0.55Nick Brown2-0/+14
The 0.55 version of libipsec_mb does not support the chacha functions used in the plugin. The missing symobls are: ipsecmb_ops_chacha_poly ipsecmb_ops_chacha_poly_chained IMB_CIPHER_DIRECTION Check for ipsecmb_ops_chacha_poly() and conditionalise the chacha code in the plugin on this. ipsec_mb 0.55 is the version currently found in Debian Stable (bullseye) Type: make Signed-off-by: Nick Brown <nickbroon@gmail.com> Change-Id: I88c962ac4f99a58b5cd61fb9b75f692e27d4ec30
2021-10-04memif: integrate with new tx infraMohsin Kazmi3-15/+17
Type: improvement Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com> Change-Id: I7c2b9891e269f23c3aa2a0abfee3cf0a0f1e2135
2021-10-04vcl: remove unsed configsFlorin Coras3-38/+2
Type: refactor Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: If755cf38e6b30e8757f2c6fb4cf5e6642fa87e52
2021-10-04hsa: do not drop the barrier when creating echo serverFilip Tehlar1-14/+1
Type: fix Signed-off-by: Filip Tehlar <ftehlar@cisco.com> Change-Id: I25d3ac72360bea130f567095b486d8e295d2f2f7