text: /*
   * Copyright (c) 2017-2019 Cisco and/or its affiliates.
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at:
   *
   *     http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  /** Generate typed init functions for multiple hash table styles... */
  #include <vppinfra/bihash_16_8.h>
  #include <vppinfra/bihash_template.h>
  
  #include <vppinfra/bihash_template.c>
  
  #undef __included_bihash_template_h__
  
  #include <vppinfra/bihash_48_8.h>
  #include <vppinfra/bihash_template.h>
  
  #include <vppinfra/bihash_template.c>
  #include <vnet/session/session_lookup.h>
  #include <vnet/session/session.h>
  #include <vnet/session/application.h>
  
  /**
   * Network namespace index (i.e., fib index) to session lookup table. We
   * should have one per network protocol type but for now we only support IP4/6
   */
  static u32 *fib_index_to_table_index[2];
  
  /* *INDENT-OFF* */
  /* 16 octets */
  typedef CLIB_PACKED (struct {
    union
      {
        struct
  	{
  	  ip4_address_t src;
  	  ip4_address_t dst;
  	  u16 src_port;
  	  u16 dst_port;
  	  /* align by making this 4 octets even though its a 1-bit field
  	   * NOTE: avoid key overlap with other transports that use 5 tuples for
  	   * session identification.
  	   */
  	  u32 proto;
  	};
        u64 as_u64[2];
      };
  }) v4_connection_key_t;
  
  typedef CLIB_PACKED (struct {
    union
      {
        struct
  	{
  	  /* 48 octets */
  	  ip6_address_t src;
  	  ip6_address_t dst;
  	  u16 src_port;
  	  u16 dst_port;
  	  u32 proto;
  	  u64 unused;
  	};
        u64 as_u64[6];
      };
  }) v6_connection_key_t;
  /* *INDENT-ON* */
  
  typedef clib_bihash_kv_16_8_t session_kv4_t;
  typedef clib_bihash_kv_48_8_t session_kv6_t;
  
  always_inline void
  make_v4_ss_kv (session_kv4_t * kv, ip4_address_t * lcl, ip4_address_t * rmt,
  	       u16 lcl_port, u16 rmt_port, u8 proto)
  {
    kv->key[0] = (u64) rmt->as_u32 << 32 | (u64) lcl->as_u32;
    kv->key[1] = (u64) proto << 32 | (u64) rmt_port << 16 | (u64) lcl_port;
    kv->value = ~0ULL;
  }
  
  always_inline void
  make_v4_listener_kv (session_kv4_t * kv, ip4_address_t * lcl, u16 lcl_port,
  		     u8 proto)
  {
    kv->key[0] = (u64) lcl->as_u32;
    kv->key[1] = (u64) proto << 32 | (u64) lcl_port;
    kv->value = ~0ULL;
  }
  
  always_inline void
  make_v4_proxy_kv (session_kv4_t * kv, ip4_address_t * lcl, u8 proto)
  {
    kv->key[0] = (u64) lcl->as_u32;
    kv->key[1] = (u64) proto << 32;
    kv->value = ~0ULL;
  }
  
  always_inline void
  make_v4_ss_kv_from_tc (session_kv4_t * kv, transport_connection_t * tc)
  {
    make_v4_ss_kv (kv, &tc->lcl_ip.ip4, &tc->rmt_ip.ip4, tc->lcl_port,
  		 tc->rmt_port, tc->proto);
  }
  
  always_inline void
  make_v6_ss_kv (session_kv6_t * kv, ip6_address_t * lcl, ip6_address_t * rmt,
  	       u16 lcl_port, u16 rmt_port, u8 proto)
  {
    kv->key[0] = lcl->as_u64[0];
    kv->key[1] = lcl->as_u64[1];
    kv->key[2] = rmt->as_u64[0];
    kv->key[3] = rmt->as_u64[1];
    kv->key[4] = (u64) proto << 32 | (u64) rmt_port << 16 | (u64) lcl_port;
    kv->key[5] = 0;
    kv->value = ~0ULL;
  }
  
  always_inline void
  make_v6_listener_kv (session_kv6_t * kv, ip6_address_t * lcl, u16 lcl_port,
  		     u8 proto)
  {
    kv->key[0] = lcl->as_u64[0];
    kv->key[1] = lcl->as_u64[1];
    kv->key[2] = 0;
    kv->key[3] = 0;
    kv->key[4] = (u64) proto << 32 | (u64) lcl_port;
    kv->key[5] = 0;
    kv->value = ~0ULL;
  }
  
  always_inline void
  make_v6_proxy_kv (session_kv6_t * kv, ip6_address_t * lcl, u8 proto)
  {
    kv->key[0] = lcl->as_u64[0];
    kv->key[1] = lcl->as_u64[1];
    kv->key[2] = 0;
    kv->key[3] = 0;
    kv->key[4] = (u64) proto << 32;
    kv->key[5] = 0;
    kv->value = ~0ULL;
  }
  
  always_inline void
  make_v6_ss_kv_from_tc (session_kv6_t * kv, transport_connection_t * tc)
  {
    make_v6_ss_kv (kv, &tc->lcl_ip.ip6, &tc->rmt_ip.ip6, tc->lcl_port,
  		 tc->rmt_port, tc->proto);
  }
  
  static session_table_t *
  session_table_get_or_alloc (u8 fib_proto, u8 fib_index)
  {
    session_table_t *st;
    u32 table_index;
    if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
      {
        st = session_table_alloc ();
        table_index = session_table_index (st);
        vec_validate (fib_index_to_table_index[fib_proto], fib_index);
        fib_index_to_table_index[fib_proto][fib_index] = table_index;
        st->active_fib_proto = fib_proto;
        session_table_init (st, fib_proto);
        return st;
      }
    else
      {
        table_index = fib_index_to_table_index[fib_proto][fib_index];
        return session_table_get (table_index);
      }
  }
  
  static session_table_t *
  session_table_get_or_alloc_for_connection (transport_connection_t * tc)
  {
    u32 fib_proto;
    fib_proto = transport_connection_fib_proto (tc);
    return session_table_get_or_alloc (fib_proto, tc->fib_index);
  }
  
  static session_table_t *
  session_table_get_for_connection (transport_connection_t * tc)
  {
    u32 fib_proto = transport_connection_fib_proto (tc);
    if (vec_len (fib_index_to_table_index[fib_proto]) <= tc->fib_index)
      return 0;
    return
      session_table_get (fib_index_to_table_index[fib_proto][tc->fib_index]);
  }
  
  static session_table_t *
  session_table_get_for_fib_index (u32 fib_proto, u32 fib_index)
  {
    if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
      return 0;
    return session_table_get (fib_index_to_table_index[fib_proto][fib_index]);
  }
  
  u32
  session_lookup_get_index_for_fib (u32 fib_proto, u32 fib_index)
  {
    if (vec_len (fib_index_to_table_index[fib_proto]) <= fib_index)
      return SESSION_TABLE_INVALID_INDEX;
    return fib_index_to_table_index[fib_proto][fib_index];
  }
  
  /**
   * Add transport connection to a session table
   *
   * Session lookup 5-tuple (src-ip, dst-ip, src-port, dst-port, session-type)
   * is added to requested session table.
   *
   * @param tc 		transport connection to be added
   * @param value	 	value to be stored
   *
   * @return non-zero if failure
   */
  int
  session_lookup_add_connection (transport_connection_t * tc, u64 value)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_kv6_t kv6;
  
    st = session_table_get_or_alloc_for_connection (tc);
    if (!st)
      return -1;
    if (tc->is_ip4)
      {
        make_v4_ss_kv_from_tc (&kv4, tc);
        kv4.value = value;
        return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4,
  				       1 /* is_add */ );
      }
    else
      {
        make_v6_ss_kv_from_tc (&kv6, tc);
        kv6.value = value;
        return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6,
  				       1 /* is_add */ );
      }
  }
  
  int
  session_lookup_add_session_endpoint (u32 table_index,
  				     session_endpoint_t * sep, u64 value)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_kv6_t kv6;
  
    st = session_table_get (table_index);
    if (!st)
      return -1;
    if (sep->is_ip4)
      {
        make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
  			   sep->transport_proto);
        kv4.value = value;
        return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4, 1);
      }
    else
      {
        make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
  			   sep->transport_proto);
        kv6.value = value;
        return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6, 1);
      }
  }
  
  int
  session_lookup_del_session_endpoint (u32 table_index,
  				     session_endpoint_t * sep)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_kv6_t kv6;
  
    st = session_table_get (table_index);
    if (!st)
      return -1;
    if (sep->is_ip4)
      {
        make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
  			   sep->transport_proto);
        return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4, 0);
      }
    else
      {
        make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
  			   sep->transport_proto);
        return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6, 0);
      }
  }
  
  /**
   * Delete transport connection from session table
   *
   * @param table_index	session table index
   * @param tc		transport connection to be removed
   *
   * @return non-zero if failure
   */
  int
  session_lookup_del_connection (transport_connection_t * tc)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_kv6_t kv6;
  
    st = session_table_get_for_connection (tc);
    if (!st)
      return -1;
    if (tc->is_ip4)
      {
        make_v4_ss_kv_from_tc (&kv4, tc);
        return clib_bihash_add_del_16_8 (&st->v4_session_hash, &kv4,
  				       0 /* is_add */ );
      }
    else
      {
        make_v6_ss_kv_from_tc (&kv6, tc);
        return clib_bihash_add_del_48_8 (&st->v6_session_hash, &kv6,
  				       0 /* is_add */ );
      }
  }
  
  int
  session_lookup_del_session (session_t * s)
  {
    transport_connection_t *ts;
    ts = transport_get_connection (session_get_transport_proto (s),
  				 s->connection_index, s->thread_index);
    return session_lookup_del_connection (ts);
  }
  
  static u8
  session_lookup_action_index_is_valid (u32 action_index)
  {
    if (action_index == SESSION_RULES_TABLE_ACTION_ALLOW
        || action_index == SESSION_RULES_TABLE_INVALID_INDEX)
      return 0;
    return 1;
  }
  
  static u64
  session_lookup_action_to_handle (u32 action_index)
  {
    switch (action_index)
      {
      case SESSION_RULES_TABLE_ACTION_DROP:
        return SESSION_DROP_HANDLE;
      case SESSION_RULES_TABLE_ACTION_ALLOW:
      case SESSION_RULES_TABLE_INVALID_INDEX:
        return SESSION_INVALID_HANDLE;
      default:
        /* application index */
        return action_index;
      }
  }
  
  static session_t *
  session_lookup_app_listen_session (u32 app_index, u8 fib_proto,
  				   u8 transport_proto)
  {
    application_t *app;
    app = application_get_if_valid (app_index);
    if (!app)
      return 0;
  
    return app_worker_first_listener (application_get_default_worker (app),
  				    fib_proto, transport_proto);
  }
  
  static session_t *
  session_lookup_action_to_session (u32 action_index, u8 fib_proto,
  				  u8 transport_proto)
  {
    u32 app_index;
    app_index = session_lookup_action_to_handle (action_index);
    /* Nothing sophisticated for now, action index is app index */
    return session_lookup_app_listen_session (app_index, fib_proto,
  					    transport_proto);
  }
  
  /** UNUSED */
  session_t *
  session_lookup_rules_table_session4 (session_table_t * st, u8 proto,
  				     ip4_address_t * lcl, u16 lcl_port,
  				     ip4_address_t * rmt, u16 rmt_port)
  {
    session_rules_table_t *srt = &st->session_rules[proto];
    u32 action_index, app_index;
    action_index = session_rules_table_lookup4 (srt, lcl, rmt, lcl_port,
  					      rmt_port);
    app_index = session_lookup_action_to_handle (action_index);
    /* Nothing sophisticated for now, action index is app index */
    return session_lookup_app_listen_session (app_index, FIB_PROTOCOL_IP4,
  					    proto);
  }
  
  /** UNUSED */
  session_t *
  session_lookup_rules_table_session6 (session_table_t * st, u8 proto,
  				     ip6_address_t * lcl, u16 lcl_port,
  				     ip6_address_t * rmt, u16 rmt_port)
  {
    session_rules_table_t *srt = &st->session_rules[proto];
    u32 action_index, app_index;
    action_index = session_rules_table_lookup6 (srt, lcl, rmt, lcl_port,
  					      rmt_port);
    app_index = session_lookup_action_to_handle (action_index);
    return session_lookup_app_listen_session (app_index, FIB_PROTOCOL_IP6,
  					    proto);
  }
  
  /**
   * Lookup listener for session endpoint in table
   *
   * @param table_index table where the endpoint should be looked up
   * @param sep session endpoint to be looked up
   * @param use_rules flag that indicates if the session rules of the table
   * 		    should be used
   * @return invalid handle if nothing is found, the handle of a valid listener
   * 	   or an action derived handle if a rule is hit
   */
  u64
  session_lookup_endpoint_listener (u32 table_index, session_endpoint_t * sep,
  				  u8 use_rules)
  {
    session_rules_table_t *srt;
    session_table_t *st;
    u32 ai;
    int rv;
  
    st = session_table_get (table_index);
    if (!st)
      return SESSION_INVALID_HANDLE;
    if (sep->is_ip4)
      {
        session_kv4_t kv4;
        ip4_address_t lcl4;
  
        make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
  			   sep->transport_proto);
        rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
        if (rv == 0)
  	return kv4.value;
        if (use_rules)
  	{
  	  clib_memset (&lcl4, 0, sizeof (lcl4));
  	  srt = &st->session_rules[sep->transport_proto];
  	  ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
  					    sep->port);
  	  if (session_lookup_action_index_is_valid (ai))
  	    return session_lookup_action_to_handle (ai);
  	}
      }
    else
      {
        session_kv6_t kv6;
        ip6_address_t lcl6;
  
        make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
  			   sep->transport_proto);
        rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
        if (rv == 0)
  	return kv6.value;
  
        if (use_rules)
  	{
  	  clib_memset (&lcl6, 0, sizeof (lcl6));
  	  srt = &st->session_rules[sep->transport_proto];
  	  ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
  					    sep->port);
  	  if (session_lookup_action_index_is_valid (ai))
  	    return session_lookup_action_to_handle (ai);
  	}
      }
    return SESSION_INVALID_HANDLE;
  }
  
  /**
   * Look up endpoint in local session table
   *
   * The result, for now, is an application index and it may in the future
   * be extended to a more complicated "action object". The only action we
   * emulate now is "drop" and for that we return a special app index.
   *
   * Lookup logic is to check in order:
   * - the rules in the table (connect acls)
   * - session sub-table for a listener
   * - session sub-table for a local listener (zeroed addr)
   *
   * @param table_index table where the lookup should be done
   * @param sep session endpoint to be looked up
   * @return session handle that can be interpreted as an adjacency
   */
  u64
  session_lookup_local_endpoint (u32 table_index, session_endpoint_t * sep)
  {
    session_rules_table_t *srt;
    session_table_t *st;
    u32 ai;
    int rv;
  
    st = session_table_get (table_index);
    if (!st)
      return SESSION_INVALID_INDEX;
    ASSERT (st->is_local);
  
    if (sep->is_ip4)
      {
        session_kv4_t kv4;
        ip4_address_t lcl4;
  
        /*
         * Check if endpoint has special rules associated
         */
        clib_memset (&lcl4, 0, sizeof (lcl4));
        srt = &st->session_rules[sep->transport_proto];
        ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
  					sep->port);
        if (session_lookup_action_index_is_valid (ai))
  	return session_lookup_action_to_handle (ai);
  
        /*
         * Check if session endpoint is a listener
         */
        make_v4_listener_kv (&kv4, &sep->ip.ip4, sep->port,
  			   sep->transport_proto);
        rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
        if (rv == 0)
  	return kv4.value;
  
        /*
         * Zero out the ip. Logic is that connect to local ips, say
         * 127.0.0.1:port, can match 0.0.0.0:port
         */
        if (ip4_is_local_host (&sep->ip.ip4))
  	{
  	  kv4.key[0] = 0;
  	  rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
  	  if (rv == 0)
  	    return kv4.value;
  	}
        else
  	{
  	  kv4.key[0] = 0;
  	}
  
        /*
         * Zero out the port and check if we have proxy
         */
        kv4.key[1] = 0;
        rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
        if (rv == 0)
  	return kv4.value;
      }
    else
      {
        session_kv6_t kv6;
        ip6_address_t lcl6;
  
        clib_memset (&lcl6, 0, sizeof (lcl6));
        srt = &st->session_rules[sep->transport_proto];
        ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
  					sep->port);
        if (session_lookup_action_index_is_valid (ai))
  	return session_lookup_action_to_handle (ai);
  
        make_v6_listener_kv (&kv6, &sep->ip.ip6, sep->port,
  			   sep->transport_proto);
        rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
        if (rv == 0)
  	return kv6.value;
  
        /*
         * Zero out the ip. Same logic as above.
         */
  
        if (ip6_is_local_host (&sep->ip.ip6))
  	{
  	  kv6.key[0] = kv6.key[1] = 0;
  	  rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
  	  if (rv == 0)
  	    return kv6.value;
  	}
        else
  	{
  	  kv6.key[0] = kv6.key[1] = 0;
  	}
  
        /*
         * Zero out the port. Same logic as above.
         */
        kv6.key[4] = kv6.key[5] = 0;
        rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
        if (rv == 0)
  	return kv6.value;
      }
    return SESSION_INVALID_HANDLE;
  }
  
  static inline session_t *
  session_lookup_listener4_i (session_table_t * st, ip4_address_t * lcl,
  			    u16 lcl_port, u8 proto, u8 use_wildcard)
  {
    session_kv4_t kv4;
    int rv;
  
    /*
     * First, try a fully formed listener
     */
    make_v4_listener_kv (&kv4, lcl, lcl_port, proto);
    rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
    if (rv == 0)
      return listen_session_get ((u32) kv4.value);
  
    /*
     * Zero out the lcl ip and check if any 0/0 port binds have been done
     */
    if (use_wildcard)
      {
        kv4.key[0] = 0;
        rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
        if (rv == 0)
  	return listen_session_get ((u32) kv4.value);
      }
    else
      {
        kv4.key[0] = 0;
      }
  
    /*
     * Zero out port and check if we have a proxy set up for our ip
     */
    make_v4_proxy_kv (&kv4, lcl, proto);
    rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
    if (rv == 0)
      return listen_session_get ((u32) kv4.value);
  
    return 0;
  }
  
  session_t *
  session_lookup_listener4 (u32 fib_index, ip4_address_t * lcl, u16 lcl_port,
  			  u8 proto)
  {
    session_table_t *st;
    st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
    if (!st)
      return 0;
    return session_lookup_listener4_i (st, lcl, lcl_port, proto, 0);
  }
  
  static session_t *
  session_lookup_listener6_i (session_table_t * st, ip6_address_t * lcl,
  			    u16 lcl_port, u8 proto, u8 ip_wildcard)
  {
    session_kv6_t kv6;
    int rv;
  
    make_v6_listener_kv (&kv6, lcl, lcl_port, proto);
    rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
    if (rv == 0)
      return listen_session_get ((u32) kv6.value);
  
    /* Zero out the lcl ip */
    if (ip_wildcard)
      {
        kv6.key[0] = kv6.key[1] = 0;
        rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
        if (rv == 0)
  	return listen_session_get ((u32) kv6.value);
      }
    else
      {
        kv6.key[0] = kv6.key[1] = 0;
      }
  
    make_v6_proxy_kv (&kv6, lcl, proto);
    rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
    if (rv == 0)
      return listen_session_get ((u32) kv6.value);
    return 0;
  }
  
  session_t *
  session_lookup_listener6 (u32 fib_index, ip6_address_t * lcl, u16 lcl_port,
  			  u8 proto)
  {
    session_table_t *st;
    st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
    if (!st)
      return 0;
    return session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
  }
  
  /**
   * Lookup listener, exact or proxy (inaddr_any:0) match
   */
  session_t *
  session_lookup_listener (u32 table_index, session_endpoint_t * sep)
  {
    session_table_t *st;
    st = session_table_get (table_index);
    if (!st)
      return 0;
    if (sep->is_ip4)
      return session_lookup_listener4_i (st, &sep->ip.ip4, sep->port,
  				       sep->transport_proto, 0);
    else
      return session_lookup_listener6_i (st, &sep->ip.ip6, sep->port,
  				       sep->transport_proto, 0);
    return 0;
  }
  
  /**
   * Lookup listener wildcard match
   */
  session_t *
  session_lookup_listener_wildcard (u32 table_index, session_endpoint_t * sep)
  {
    session_table_t *st;
    st = session_table_get (table_index);
    if (!st)
      return 0;
    if (sep->is_ip4)
      return session_lookup_listener4_i (st, &sep->ip.ip4, sep->port,
  				       sep->transport_proto,
  				       1 /* use_wildcard */ );
    else
      return session_lookup_listener6_i (st, &sep->ip.ip6, sep->port,
  				       sep->transport_proto,
  				       1 /* use_wildcard */ );
    return 0;
  }
  
  int
  session_lookup_add_half_open (transport_connection_t * tc, u64 value)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_kv6_t kv6;
  
    st = session_table_get_or_alloc_for_connection (tc);
    if (!st)
      return 0;
    if (tc->is_ip4)
      {
        make_v4_ss_kv_from_tc (&kv4, tc);
        kv4.value = value;
        return clib_bihash_add_del_16_8 (&st->v4_half_open_hash, &kv4,
  				       1 /* is_add */ );
      }
    else
      {
        make_v6_ss_kv_from_tc (&kv6, tc);
        kv6.value = value;
        return clib_bihash_add_del_48_8 (&st->v6_half_open_hash, &kv6,
  				       1 /* is_add */ );
      }
  }
  
  int
  session_lookup_del_half_open (transport_connection_t * tc)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_kv6_t kv6;
  
    st = session_table_get_for_connection (tc);
    if (!st)
      return -1;
    if (tc->is_ip4)
      {
        make_v4_ss_kv_from_tc (&kv4, tc);
        return clib_bihash_add_del_16_8 (&st->v4_half_open_hash, &kv4,
  				       0 /* is_add */ );
      }
    else
      {
        make_v6_ss_kv_from_tc (&kv6, tc);
        return clib_bihash_add_del_48_8 (&st->v6_half_open_hash, &kv6,
  				       0 /* is_add */ );
      }
  }
  
  u64
  session_lookup_half_open_handle (transport_connection_t * tc)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_kv6_t kv6;
    int rv;
  
    st = session_table_get_for_fib_index (transport_connection_fib_proto (tc),
  					tc->fib_index);
    if (!st)
      return HALF_OPEN_LOOKUP_INVALID_VALUE;
    if (tc->is_ip4)
      {
        make_v4_ss_kv (&kv4, &tc->lcl_ip.ip4, &tc->rmt_ip.ip4, tc->lcl_port,
  		     tc->rmt_port, tc->proto);
        rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
        if (rv == 0)
  	return kv4.value;
      }
    else
      {
        make_v6_ss_kv (&kv6, &tc->lcl_ip.ip6, &tc->rmt_ip.ip6, tc->lcl_port,
  		     tc->rmt_port, tc->proto);
        rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
        if (rv == 0)
  	return kv6.value;
      }
    return HALF_OPEN_LOOKUP_INVALID_VALUE;
  }
  
  transport_connection_t *
  session_lookup_half_open_connection (u64 handle, u8 proto, u8 is_ip4)
  {
    if (handle != HALF_OPEN_LOOKUP_INVALID_VALUE)
      {
        u32 sst = session_type_from_proto_and_ip (proto, is_ip4);
        return transport_get_half_open (sst, handle & 0xFFFFFFFF);
      }
    return 0;
  }
  
  /**
   * Lookup connection with ip4 and transport layer information
   *
   * This is used on the fast path so it needs to be fast. Thereby,
   * duplication of code and 'hacks' allowed.
   *
   * The lookup is incremental and returns whenever something is matched. The
   * steps are:
   * - Try to find an established session
   * - Try to find a half-open connection
   * - Try session rules table
   * - Try to find a fully-formed or local source wildcarded (listener bound to
   *   all interfaces) listener session
   * - return 0
   *
   * @param fib_index	index of fib wherein the connection was received
   * @param lcl		local ip4 address
   * @param rmt		remote ip4 address
   * @param lcl_port	local port
   * @param rmt_port	remote port
   * @param proto		transport protocol (e.g., tcp, udp)
   * @param thread_index	thread index for request
   * @param is_filtered	return flag that indicates if connection was filtered.
   *
   * @return pointer to transport connection, if one is found, 0 otherwise
   */
  transport_connection_t *
  session_lookup_connection_wt4 (u32 fib_index, ip4_address_t * lcl,
  			       ip4_address_t * rmt, u16 lcl_port,
  			       u16 rmt_port, u8 proto, u32 thread_index,
  			       u8 * result)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_t *s;
    u32 action_index;
    int rv;
  
    st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
    if (PREDICT_FALSE (!st))
      return 0;
  
    /*
     * Lookup session amongst established ones
     */
    make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
    rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
    if (rv == 0)
      {
        if (PREDICT_FALSE ((u32) (kv4.value >> 32) != thread_index))
  	{
  	  *result = SESSION_LOOKUP_RESULT_WRONG_THREAD;
  	  return 0;
  	}
        s = session_get (kv4.value & 0xFFFFFFFFULL, thread_index);
        return transport_get_connection (proto, s->connection_index,
  				       thread_index);
      }
  
    /*
     * Try half-open connections
     */
    rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
    if (rv == 0)
      return transport_get_half_open (proto, kv4.value & 0xFFFFFFFF);
  
    /*
     * Check the session rules table
     */
    action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
  					      rmt, lcl_port, rmt_port);
    if (session_lookup_action_index_is_valid (action_index))
      {
        if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
  	{
  	  *result = SESSION_LOOKUP_RESULT_FILTERED;
  	  return 0;
  	}
        if ((s = session_lookup_action_to_session (action_index,
  						 FIB_PROTOCOL_IP4, proto)))
  	return transport_get_listener (proto, s->connection_index);
        return 0;
      }
  
    /*
     * If nothing is found, check if any listener is available
     */
    s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1);
    if (s)
      return transport_get_listener (proto, s->connection_index);
  
    return 0;
  }
  
  /**
   * Lookup connection with ip4 and transport layer information
   *
   * Not optimized. Lookup logic is identical to that of
   * @ref session_lookup_connection_wt4
   *
   * @param fib_index	index of the fib wherein the connection was received
   * @param lcl		local ip4 address
   * @param rmt		remote ip4 address
   * @param lcl_port	local port
   * @param rmt_port	remote port
   * @param proto		transport protocol (e.g., tcp, udp)
   *
   * @return pointer to transport connection, if one is found, 0 otherwise
   */
  transport_connection_t *
  session_lookup_connection4 (u32 fib_index, ip4_address_t * lcl,
  			    ip4_address_t * rmt, u16 lcl_port, u16 rmt_port,
  			    u8 proto)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_t *s;
    u32 action_index;
    int rv;
  
    st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
    if (PREDICT_FALSE (!st))
      return 0;
  
    /*
     * Lookup session amongst established ones
     */
    make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
    rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
    if (rv == 0)
      {
        s = session_get_from_handle (kv4.value);
        return transport_get_connection (proto, s->connection_index,
  				       s->thread_index);
      }
  
    /*
     * Try half-open connections
     */
    rv = clib_bihash_search_inline_16_8 (&st->v4_half_open_hash, &kv4);
    if (rv == 0)
      return transport_get_half_open (proto, kv4.value & 0xFFFFFFFF);
  
    /*
     * Check the session rules table
     */
    action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
  					      rmt, lcl_port, rmt_port);
    if (session_lookup_action_index_is_valid (action_index))
      {
        if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
  	return 0;
        if ((s = session_lookup_action_to_session (action_index,
  						 FIB_PROTOCOL_IP4, proto)))
  	return transport_get_listener (proto, s->connection_index);
        return 0;
      }
  
    /*
     * If nothing is found, check if any listener is available
     */
    s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1);
    if (s)
      return transport_get_listener (proto, s->connection_index);
  
    return 0;
  }
  
  /**
   * Lookup session with ip4 and transport layer information
   *
   * Important note: this may look into another thread's pool table and
   * register as 'peeker'. Caller should call @ref session_pool_remove_peeker as
   * if needed as soon as possible.
   *
   * Lookup logic is similar to that of @ref session_lookup_connection_wt4 but
   * this returns a session as opposed to a transport connection and it does not
   * try to lookup half-open sessions.
   *
   * Typically used by dgram connections
   */
  session_t *
  session_lookup_safe4 (u32 fib_index, ip4_address_t * lcl, ip4_address_t * rmt,
  		      u16 lcl_port, u16 rmt_port, u8 proto)
  {
    session_table_t *st;
    session_kv4_t kv4;
    session_t *s;
    u32 action_index;
    int rv;
  
    st = session_table_get_for_fib_index (FIB_PROTOCOL_IP4, fib_index);
    if (PREDICT_FALSE (!st))
      return 0;
  
    /*
     * Lookup session amongst established ones
     */
    make_v4_ss_kv (&kv4, lcl, rmt, lcl_port, rmt_port, proto);
    rv = clib_bihash_search_inline_16_8 (&st->v4_session_hash, &kv4);
    if (rv == 0)
      return session_get_from_handle_safe (kv4.value);
  
    /*
     * Check the session rules table
     */
    action_index = session_rules_table_lookup4 (&st->session_rules[proto], lcl,
  					      rmt, lcl_port, rmt_port);
    if (session_lookup_action_index_is_valid (action_index))
      {
        if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
  	return 0;
        return session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP4,
  					       proto);
      }
  
    /*
     *  If nothing is found, check if any listener is available
     */
    if ((s = session_lookup_listener4_i (st, lcl, lcl_port, proto, 1)))
      return s;
  
    return 0;
  }
  
  /**
   * Lookup connection with ip6 and transport layer information
   *
   * This is used on the fast path so it needs to be fast. Thereby,
   * duplication of code and 'hacks' allowed.
   *
   * The lookup is incremental and returns whenever something is matched. The
   * steps are:
   * - Try to find an established session
   * - Try to find a half-open connection
   * - Try session rules table
   * - Try to find a fully-formed or local source wildcarded (listener bound to
   *   all interfaces) listener session
   * - return 0
   *
   * @param fib_index	index of the fib wherein the connection was received
   * @param lcl		local ip6 address
   * @param rmt		remote ip6 address
   * @param lcl_port	local port
   * @param rmt_port	remote port
   * @param proto		transport protocol (e.g., tcp, udp)
   * @param thread_index	thread index for request
   *
   * @return pointer to transport connection, if one is found, 0 otherwise
   */
  transport_connection_t *
  session_lookup_connection_wt6 (u32 fib_index, ip6_address_t * lcl,
  			       ip6_address_t * rmt, u16 lcl_port,
  			       u16 rmt_port, u8 proto, u32 thread_index,
  			       u8 * result)
  {
    session_table_t *st;
    session_t *s;
    session_kv6_t kv6;
    u32 action_index;
    int rv;
  
    st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
    if (PREDICT_FALSE (!st))
      return 0;
  
    make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
    rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
    if (rv == 0)
      {
        ASSERT ((u32) (kv6.value >> 32) == thread_index);
        if (PREDICT_FALSE ((u32) (kv6.value >> 32) != thread_index))
  	{
  	  *result = SESSION_LOOKUP_RESULT_WRONG_THREAD;
  	  return 0;
  	}
        s = session_get (kv6.value & 0xFFFFFFFFULL, thread_index);
        return transport_get_connection (proto, s->connection_index,
  				       thread_index);
      }
  
    /* Try half-open connections */
    rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
    if (rv == 0)
      return transport_get_half_open (proto, kv6.value & 0xFFFFFFFF);
  
    /* Check the session rules table */
    action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
  					      rmt, lcl_port, rmt_port);
    if (session_lookup_action_index_is_valid (action_index))
      {
        if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
  	{
  	  *result = SESSION_LOOKUP_RESULT_FILTERED;
  	  return 0;
  	}
        if ((s = session_lookup_action_to_session (action_index,
  						 FIB_PROTOCOL_IP6, proto)))
  	return transport_get_listener (proto, s->connection_index);
        return 0;
      }
  
    /* If nothing is found, check if any listener is available */
    s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
    if (s)
      return transport_get_listener (proto, s->connection_index);
  
    return 0;
  }
  
  /**
   * Lookup connection with ip6 and transport layer information
   *
   * Not optimized. This is used on the fast path so it needs to be fast.
   * Thereby, duplication of code and 'hacks' allowed. Lookup logic is identical
   * to that of @ref session_lookup_connection_wt4
   *
   * @param fib_index	index of the fib wherein the connection was received
   * @param lcl		local ip6 address
   * @param rmt		remote ip6 address
   * @param lcl_port	local port
   * @param rmt_port	remote port
   * @param proto		transport protocol (e.g., tcp, udp)
   *
   * @return pointer to transport connection, if one is found, 0 otherwise
   */
  transport_connection_t *
  session_lookup_connection6 (u32 fib_index, ip6_address_t * lcl,
  			    ip6_address_t * rmt, u16 lcl_port, u16 rmt_port,
  			    u8 proto)
  {
    session_table_t *st;
    session_t *s;
    session_kv6_t kv6;
    u32 action_index;
    int rv;
  
    st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
    if (PREDICT_FALSE (!st))
      return 0;
  
    make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
    rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
    if (rv == 0)
      {
        s = session_get_from_handle (kv6.value);
        return transport_get_connection (proto, s->connection_index,
  				       s->thread_index);
      }
  
    /* Try half-open connections */
    rv = clib_bihash_search_inline_48_8 (&st->v6_half_open_hash, &kv6);
    if (rv == 0)
      return transport_get_half_open (proto, kv6.value & 0xFFFFFFFF);
  
    /* Check the session rules table */
    action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
  					      rmt, lcl_port, rmt_port);
    if (session_lookup_action_index_is_valid (action_index))
      {
        if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
  	return 0;
        if ((s = session_lookup_action_to_session (action_index,
  						 FIB_PROTOCOL_IP6, proto)))
  	return transport_get_listener (proto, s->connection_index);
        return 0;
      }
  
    /* If nothing is found, check if any listener is available */
    s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1);
    if (s)
      return transport_get_listener (proto, s->connection_index);
  
    return 0;
  }
  
  /**
   * Lookup session with ip6 and transport layer information
   *
   * Important note: this may look into another thread's pool table and
   * register as 'peeker'. Caller should call @ref session_pool_remove_peeker as
   * if needed as soon as possible.
   *
   * Lookup logic is similar to that of @ref session_lookup_connection_wt6 but
   * this returns a session as opposed to a transport connection and it does not
   * try to lookup half-open sessions.
   *
   * Typically used by dgram connections
   */
  session_t *
  session_lookup_safe6 (u32 fib_index, ip6_address_t * lcl, ip6_address_t * rmt,
  		      u16 lcl_port, u16 rmt_port, u8 proto)
  {
    session_table_t *st;
    session_kv6_t kv6;
    session_t *s;
    u32 action_index;
    int rv;
  
    st = session_table_get_for_fib_index (FIB_PROTOCOL_IP6, fib_index);
    if (PREDICT_FALSE (!st))
      return 0;
  
    make_v6_ss_kv (&kv6, lcl, rmt, lcl_port, rmt_port, proto);
    rv = clib_bihash_search_inline_48_8 (&st->v6_session_hash, &kv6);
    if (rv == 0)
      return session_get_from_handle_safe (kv6.value);
  
    /* Check the session rules table */
    action_index = session_rules_table_lookup6 (&st->session_rules[proto], lcl,
  					      rmt, lcl_port, rmt_port);
    if (session_lookup_action_index_is_valid (action_index))
      {
        if (action_index == SESSION_RULES_TABLE_ACTION_DROP)
  	return 0;
        return session_lookup_action_to_session (action_index, FIB_PROTOCOL_IP6,
  					       proto);
      }
  
    /* If nothing is found, check if any listener is available */
    if ((s = session_lookup_listener6_i (st, lcl, lcl_port, proto, 1)))
      return s;
    return 0;
  }
  
  int
  vnet_session_rule_add_del (session_rule_add_del_args_t * args)
  {
    app_namespace_t *app_ns = app_namespace_get (args->appns_index);
    session_rules_table_t *srt;
    session_table_t *st;
    u32 fib_index;
    u8 fib_proto;
    int rv = 0;
  
    if (!app_ns)
      return VNET_API_ERROR_APP_INVALID_NS;
  
    if (args->scope > 3)
      return VNET_API_ERROR_INVALID_VALUE;
  
    if (args->transport_proto != TRANSPORT_PROTO_TCP
        && args->transport_proto != TRANSPORT_PROTO_UDP)
      return VNET_API_ERROR_INVALID_VALUE;
  
    if ((args->scope & SESSION_RULE_SCOPE_GLOBAL) || args->scope == 0)
      {
        fib_proto = args->table_args.rmt.fp_proto;
        fib_index = app_namespace_get_fib_index (app_ns, fib_proto);
        st = session_table_get_for_fib_index (fib_proto, fib_index);
        srt = &st->session_rules[args->transport_proto];
        if ((rv = session_rules_table_add_del (srt, &args->table_args)))
  	return rv;
      }
    if (args->scope & SESSION_RULE_SCOPE_LOCAL)
      {
        clib_memset (&args->table_args.lcl, 0, sizeof (args->table_args.lcl));
        args->table_args.lcl.fp_proto = args->table_args.rmt.fp_proto;
        args->table_args.lcl_port = 0;
        st = app_namespace_get_local_table (app_ns);
        srt = &st->session_rules[args->transport_proto];
        rv = session_rules_table_add_del (srt, &args->table_args);
      }
    return rv;
  }
  
  /**
   * Mark (global) tables as pertaining to app ns
   */
  void
  session_lookup_set_tables_appns (app_namespace_t * app_ns)
  {
    session_table_t *st;
    u32 fib_index;
    u8 fp;
  
    for (fp = 0; fp < ARRAY_LEN (fib_index_to_table_index); fp++)
      {
        fib_index = app_namespace_get_fib_index (app_ns, fp);
        st = session_table_get_for_fib_index (fp, fib_index);
        if (st)
  	st->appns_index = app_namespace_index (app_ns);
      }
  }
  
  u8 *
  format_ip4_session_lookup_kvp (u8 * s, va_list * args)
  {
    clib_bihash_kv_16_8_t *kvp = va_arg (*args, clib_bihash_kv_16_8_t *);
    u32 is_local = va_arg (*args, u32);
    v4_connection_key_t *key = (v4_connection_key_t *) kvp->key;
    session_t *session;
    app_worker_t *app_wrk;
    const u8 *app_name;
    u8 *str = 0;
  
    if (!is_local)
      {
        session = session_get_from_handle (kvp->value);
        app_wrk = app_worker_get (session->app_wrk_index);
        app_name = application_name_from_index (app_wrk->app_index);
        str = format (0, "[%U] %U:%d->%U:%d", format_transport_proto_short,
  		    key->proto, format_ip4_address, &key->src,
  		    clib_net_to_host_u16 (key->src_port), format_ip4_address,
  		    &key->dst, clib_net_to_host_u16 (key->dst_port));
        s = format (s, "%-40v%-30v", str, app_name);
      }
    else
      {
        session = session_get_from_handle (kvp->value);
        app_wrk = app_worker_get (session->app_wrk_index);
        app_name = application_name_from_index (app_wrk->app_index);
        str = format (0, "[%U] %U:%d", format_transport_proto_short, key->proto,
  		    format_ip4_address, &key->src,
  		    clib_net_to_host_u16 (key->src_port));
        s = format (s, "%-30v%-30v", str, app_name);
      }
    return s;
  }
  
  typedef struct _ip4_session_table_show_ctx_t
  {
    vlib_main_t *vm;
    u8 is_local;
  } ip4_session_table_show_ctx_t;
  
  static int
  ip4_session_table_show (clib_bihash_kv_16_8_t * kvp, void *arg)
  {
    ip4_session_table_show_ctx_t *ctx = arg;
    vlib_cli_output (ctx->vm, "%U", format_ip4_session_lookup_kvp, kvp,
  		   ctx->is_local);
    return 1;
  }
  
  void
  session_lookup_show_table_entries (vlib_main_t * vm, session_table_t * table,
  				   u8 type, u8 is_local)
  {
    ip4_session_table_show_ctx_t ctx = {
      .vm = vm,
      .is_local = is_local,
    };
    if (!is_local)
      vlib_cli_output (vm, "%-40s%-30s", "Session", "Application");
    else
      vlib_cli_output (vm, "%-30s%-30s", "Listener", "Application");
    switch (type)
      {
        /* main table v4 */
      case 0:
        ip4_session_table_walk (&table->v4_session_hash, ip4_session_table_show,
  			      &ctx);
        break;
      default:
        clib_warning ("not supported");
      }
  }
  
  static clib_error_t *
  session_rule_command_fn (vlib_main_t * vm, unformat_input_t * input,
  			 vlib_cli_command_t * cmd)
  {
    u32 proto = ~0, lcl_port, rmt_port, action = 0, lcl_plen = 0, rmt_plen = 0;
    u32 appns_index, scope = 0;
    ip46_address_t lcl_ip, rmt_ip;
    u8 is_ip4 = 1, conn_set = 0;
    u8 fib_proto, is_add = 1, *ns_id = 0;
    u8 *tag = 0;
    app_namespace_t *app_ns;
    int rv;
  
    clib_memset (&lcl_ip, 0, sizeof (lcl_ip));
    clib_memset (&rmt_ip, 0, sizeof (rmt_ip));
    while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
      {
        if (unformat (input, "del"))
  	is_add = 0;
        else if (unformat (input, "add"))
  	;
        else if (unformat (input, "appns %_%v%_", &ns_id))
  	;
        else if (unformat (input, "scope global"))
  	scope = SESSION_RULE_SCOPE_GLOBAL;
        else if (unformat (input, "scope local"))
  	scope = SESSION_RULE_SCOPE_LOCAL;
        else if (unformat (input, "scope all"))
  	scope = SESSION_RULE_SCOPE_LOCAL | SESSION_RULE_SCOPE_GLOBAL;
        else if (unformat (input, "proto %U", unformat_transport_proto, &proto))
  	;
        else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip4_address,
  			 &lcl_ip.ip4, &lcl_plen, &lcl_port,
  			 unformat_ip4_address, &rmt_ip.ip4, &rmt_plen,
  			 &rmt_port))
  	{
  	  is_ip4 = 1;
  	  conn_set = 1;
  	}
        else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip6_address,
  			 &lcl_ip.ip6, &lcl_plen, &lcl_port,
  			 unformat_ip6_address, &rmt_ip.ip6, &rmt_plen,
  			 &rmt_port))
  	{
  	  is_ip4 = 0;
  	  conn_set = 1;
  	}
        else if (unformat (input, "action %d", &action))
  	;
        else if (unformat (input, "tag %_%v%_", &tag))
  	;
        else
  	return clib_error_return (0, "unknown input `%U'",
  				  format_unformat_error, input);
      }
  
    if (proto == ~0)
      {
        vlib_cli_output (vm, "proto must be set");
        return 0;
      }
    if (is_add && !conn_set && action == ~0)
      {
        vlib_cli_output (vm, "connection and action must be set for add");
        return 0;
      }
    if (!is_add && !tag && !conn_set)
      {
        vlib_cli_output (vm, "connection or tag must be set for delete");
        return 0;
      }
    if (vec_len (tag) > SESSION_RULE_TAG_MAX_LEN)
      {
        vlib_cli_output (vm, "tag too long (max u64)");
        return 0;
      }
  
    if (ns_id)
      {
        app_ns = app_namespace_get_from_id (ns_id);
        if (!app_ns)
  	{
  	  vlib_cli_output (vm, "namespace %v does not exist", ns_id);
  	  return 0;
  	}
      }
    else
      {
        app_ns = app_namespace_get_default ();
      }
    appns_index = app_namespace_index (app_ns);
  
    fib_proto = is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
    session_rule_add_del_args_t args = {
      .transport_proto = proto,
      .table_args.lcl.fp_addr = lcl_ip,
      .table_args.lcl.fp_len = lcl_plen,
      .table_args.lcl.fp_proto = fib_proto,
      .table_args.rmt.fp_addr = rmt_ip,
      .table_args.rmt.fp_len = rmt_plen,
      .table_args.rmt.fp_proto = fib_proto,
      .table_args.lcl_port = lcl_port,
      .table_args.rmt_port = rmt_port,
      .table_args.action_index = action,
      .table_args.is_add = is_add,
      .table_args.tag = tag,
      .appns_index = appns_index,
      .scope = scope,
    };
    if ((rv = vnet_session_rule_add_del (&args)))
      return clib_error_return (0, "rule add del returned %u", rv);
  
    vec_free (tag);
    return 0;
  }
  
  /* *INDENT-OFF* */
  VLIB_CLI_COMMAND (session_rule_command, static) =
  {
    .path = "session rule",
    .short_help = "session rule [add|del] appns <ns_id> proto <proto> "
        "<lcl-ip/plen> <lcl-port> <rmt-ip/plen> <rmt-port> action <action>",
    .function = session_rule_command_fn,
  };
  /* *INDENT-ON* */
  
  void
  session_lookup_dump_rules_table (u32 fib_index, u8 fib_proto,
  				 u8 transport_proto)
  {
    vlib_main_t *vm = vlib_get_main ();
    session_rules_table_t *srt;
    session_table_t *st;
    st = session_table_get_for_fib_index (fib_index, fib_proto);
    srt = &st->session_rules[transport_proto];
    session_rules_table_cli_dump (vm, srt, fib_proto);
  }
  
  void
  session_lookup_dump_local_rules_table (u32 table_index, u8 fib_proto,
  				       u8 transport_proto)
  {
    vlib_main_t *vm = vlib_get_main ();
    session_rules_table_t *srt;
    session_table_t *st;
    st = session_table_get (table_index);
    srt = &st->session_rules[transport_proto];
    session_rules_table_cli_dump (vm, srt, fib_proto);
  }
  
  static clib_error_t *
  show_session_rules_command_fn (vlib_main_t * vm, unformat_input_t * input,
  			       vlib_cli_command_t * cmd)
  {
    u32 transport_proto = ~0, lcl_port, rmt_port, lcl_plen, rmt_plen;
    u32 fib_index, scope = 0;
    ip46_address_t lcl_ip, rmt_ip;
    u8 is_ip4 = 1, show_one = 0;
    app_namespace_t *app_ns;
    session_rules_table_t *srt;
    session_table_t *st;
    u8 *ns_id = 0, fib_proto;
  
    clib_memset (&lcl_ip, 0, sizeof (lcl_ip));
    clib_memset (&rmt_ip, 0, sizeof (rmt_ip));
    while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
      {
        if (unformat (input, "%U", unformat_transport_proto, &transport_proto))
  	;
        else if (unformat (input, "appns %_%v%_", &ns_id))
  	;
        else if (unformat (input, "scope global"))
  	scope = 1;
        else if (unformat (input, "scope local"))
  	scope = 2;
        else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip4_address,
  			 &lcl_ip.ip4, &lcl_plen, &lcl_port,
  			 unformat_ip4_address, &rmt_ip.ip4, &rmt_plen,
  			 &rmt_port))
  	{
  	  is_ip4 = 1;
  	  show_one = 1;
  	}
        else if (unformat (input, "%U/%d %d %U/%d %d", unformat_ip6_address,
  			 &lcl_ip.ip6, &lcl_plen, &lcl_port,
  			 unformat_ip6_address, &rmt_ip.ip6, &rmt_plen,
  			 &rmt_port))
  	{
  	  is_ip4 = 0;
  	  show_one = 1;
  	}
        else
  	return clib_error_return (0, "unknown input `%U'",
  				  format_unformat_error, input);
      }
  
    if (transport_proto == ~0)
      {
        vlib_cli_output (vm, "transport proto must be set");
        return 0;
      }
  
    if (ns_id)
      {
        app_ns = app_namespace_get_from_id (ns_id);
        if (!app_ns)
  	{
  	  vlib_cli_output (vm, "appns %v doesn't exist", ns_id);
  	  return 0;
  	}
      }
    else
      {
        app_ns = app_namespace_get_default ();
      }
  
    if (scope == 1 || scope == 0)
      {
        fib_proto = is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
        fib_index = is_ip4 ? app_ns->ip4_fib_index : app_ns->ip6_fib_index;
        st = session_table_get_for_fib_index (fib_proto, fib_index);
      }
    else
      {
        st = app_namespace_get_local_table (app_ns);
      }
  
    if (show_one)
      {
        srt = &st->session_rules[transport_proto];
        session_rules_table_show_rule (vm, srt, &lcl_ip, lcl_port, &rmt_ip,
  				     rmt_port, is_ip4);
        return 0;
      }
  
    vlib_cli_output (vm, "%U rules table", format_transport_proto,
  		   transport_proto);
    srt = &st->session_rules[transport_proto];
    session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4);
    session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP6);
  
    vec_free (ns_id);
    return 0;
  }
  
  /* *INDENT-OFF* */
  VLIB_CLI_COMMAND (show_session_rules_command, static) =
  {
    .path = "show session rules",
    .short_help = "show session rules [<proto> appns <id> <lcl-ip/plen> "
        "<lcl-port> <rmt-ip/plen> <rmt-port> scope <scope>]",
    .function = show_session_rules_command_fn,
  };
  /* *INDENT-ON* */
  
  void
  session_lookup_init (void)
  {
    /*
     * Allocate default table and map it to fib_index 0
     */
    session_table_t *st = session_table_alloc ();
    vec_validate (fib_index_to_table_index[FIB_PROTOCOL_IP4], 0);
    fib_index_to_table_index[FIB_PROTOCOL_IP4][0] = session_table_index (st);
    st->active_fib_proto = FIB_PROTOCOL_IP4;
    session_table_init (st, FIB_PROTOCOL_IP4);
    st = session_table_alloc ();
    vec_validate (fib_index_to_table_index[FIB_PROTOCOL_IP6], 0);
    fib_index_to_table_index[FIB_PROTOCOL_IP6][0] = session_table_index (st);
    st->active_fib_proto = FIB_PROTOCOL_IP6;
    session_table_init (st, FIB_PROTOCOL_IP6);
  }
  
  /*
   * fd.io coding-style-patch-verification: ON
   *
   * Local Variables:
   * eval: (c-set-style "gnu")
   * End:
   */
  