fix(c-dash): Maximal value of TIME_PERIOD for data - csit

diff options

author	Tibor Frank <tifrank@cisco.com>	2023-04-05 15:04:41 +0200
committer	Tibor Frank <tifrank@cisco.com>	2023-04-05 15:04:41 +0200
commit	5fd2b2e7e7e046fe6264ba6c3b234085284677b9 (patch)
tree	9f55f78f8e1c94c0bf1b09524bed06f1bcac5dde /resources/tools/dash/app/pal
parent	acaf4ee531c90c0cc166ddfe3c7880ba7c30fc17 (diff)

fix(c-dash): Maximal value of TIME_PERIOD for dataoper-230411

Signed-off-by: Tibor Frank <tifrank@cisco.com> Change-Id: Ief6a0005c9097dd3013e3917ab9dfad8a446a6a5

Diffstat (limited to 'resources/tools/dash/app/pal')

0 files changed, 0 insertions, 0 deletions

/* * Copyright (c) 2016 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include <stddef.h> #include <vnet/vnet.h> #include <vnet/plugin/plugin.h> #include <acl/acl.h> #include <vnet/l2/l2_classify.h> #include <vnet/classify/input_acl.h> #include <vpp/app/version.h> #include <vlibapi/api.h> #include <vlibmemory/api.h> #include <vlibsocket/api.h> /* define message IDs */ #include <acl/acl_msg_enum.h> /* define message structures */ #define vl_typedefs #include <acl/acl_all_api_h.h> #undef vl_typedefs /* define generated endian-swappers */ #define vl_endianfun #include <acl/acl_all_api_h.h> #undef vl_endianfun /* instantiate all the print functions we know about */ #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__) #define vl_printfun #include <acl/acl_all_api_h.h> #undef vl_printfun /* Get the API version number */ #define vl_api_version(n,v) static u32 api_version=(v); #include <acl/acl_all_api_h.h> #undef vl_api_version #include "fa_node.h" acl_main_t acl_main; #define REPLY_MSG_ID_BASE am->msg_id_base #include <vlibapi/api_helper_macros.h> /* List of message types that this plugin understands */ #define foreach_acl_plugin_api_msg \ _(ACL_PLUGIN_GET_VERSION, acl_plugin_get_version) \ _(ACL_ADD_REPLACE, acl_add_replace) \ _(ACL_DEL, acl_del) \ _(ACL_INTERFACE_ADD_DEL, acl_interface_add_del) \ _(ACL_INTERFACE_SET_ACL_LIST, acl_interface_set_acl_list) \ _(ACL_DUMP, acl_dump) \ _(ACL_INTERFACE_LIST_DUMP, acl_interface_list_dump) \ _(MACIP_ACL_ADD, macip_acl_add) \ _(MACIP_ACL_DEL, macip_acl_del) \ _(MACIP_ACL_INTERFACE_ADD_DEL, macip_acl_interface_add_del) \ _(MACIP_ACL_DUMP, macip_acl_dump) \ _(MACIP_ACL_INTERFACE_GET, macip_acl_interface_get) /* *INDENT-OFF* */ VLIB_PLUGIN_REGISTER () = { .version = VPP_BUILD_VER, .description = "Access Control Lists", }; /* *INDENT-ON* */ static void vl_api_acl_plugin_get_version_t_handler (vl_api_acl_plugin_get_version_t * mp) { acl_main_t *am = &acl_main; vl_api_acl_plugin_get_version_reply_t *rmp; int msg_size = sizeof (*rmp); unix_shared_memory_queue_t *q; q = vl_api_client_index_to_input_queue (mp->client_index); if (q == 0) { return; } rmp = vl_msg_api_alloc (msg_size); memset (rmp, 0, msg_size); rmp->_vl_msg_id = ntohs (VL_API_ACL_PLUGIN_GET_VERSION_REPLY + am->msg_id_base); rmp->context = mp->context; rmp->major = htonl (ACL_PLUGIN_VERSION_MAJOR); rmp->minor = htonl (ACL_PLUGIN_VERSION_MINOR); vl_msg_api_send_shmem (q, (u8 *) & rmp); } static int acl_add_list (u32 count, vl_api_acl_rule_t rules[], u32 * acl_list_index, u8 * tag) { acl_main_t *am = &acl_main; acl_list_t *a; acl_rule_t *r; acl_rule_t *acl_new_rules; int i; if (*acl_list_index != ~0) { /* They supplied some number, let's see if this ACL exists */ if (pool_is_free_index (am->acls, *acl_list_index)) { /* tried to replace a non-existent ACL, no point doing anything */ return -1; } } /* Create and populate the rules */ acl_new_rules = clib_mem_alloc_aligned (sizeof (acl_rule_t) * count, CLIB_CACHE_LINE_BYTES); if (!acl_new_rules) { /* Could not allocate rules. New or existing ACL - bail out regardless */ return -1; } for (i = 0; i < count; i++) { r = &acl_new_rules[i]; r->is_permit = rules[i].is_permit; r->is_ipv6 = rules[i].is_ipv6; if (r->is_ipv6) { memcpy (&r->src, rules[i].src_ip_addr, sizeof (r->src)); memcpy (&r->dst, rules[i].dst_ip_addr, sizeof (r->dst)); } else { memcpy (&r->src.ip4, rules[i].src_ip_addr, sizeof (r->src.ip4)); memcpy (&r->dst.ip4, rules[i].dst_ip_addr, sizeof (r->dst.ip4)); } r->src_prefixlen = rules[i].src_ip_prefix_len; r->dst_prefixlen = rules[i].dst_ip_prefix_len; r->proto = rules[i].proto; r->src_port_or_type_first = ntohs ( rules[i].srcport_or_icmptype_first ); r->src_port_or_type_last = ntohs ( rules[i].srcport_or_icmptype_last ); r->dst_port_or_code_first = ntohs ( rules[i].dstport_or_icmpcode_first ); r->dst_port_or_code_last = ntohs ( rules[i].dstport_or_icmpcode_last ); r->tcp_flags_value = rules[i].tcp_flags_value; r->tcp_flags_mask = rules[i].tcp_flags_mask; } if (~0 == *acl_list_index) { /* Get ACL index */ pool_get_aligned (am->acls, a, CLIB_CACHE_LINE_BYTES); memset (a, 0, sizeof (*a)); /* Will return the newly allocated ACL index */ *acl_list_index = a - am->acls; } else { a = am->acls + *acl_list_index; /* Get rid of the old rules */ clib_mem_free (a->rules); } a->rules = acl_new_rules; a->count = count; memcpy (a->tag, tag, sizeof (a->tag)); return 0; } static int acl_del_list (u32 acl_list_index) { acl_main_t *am = &acl_main; acl_list_t *a; int i, ii; if (pool_is_free_index (am->acls, acl_list_index)) { return -1; } /* delete any references to the ACL */ for (i = 0; i < vec_len (am->output_acl_vec_by_sw_if_index); i++) { for (ii = 0; ii < vec_len (am->output_acl_vec_by_sw_if_index[i]); /* see body */ ) { if (acl_list_index == am->output_acl_vec_by_sw_if_index[i][ii]) { vec_del1 (am->output_acl_vec_by_sw_if_index[i], ii); } else { ii++; } } } for (i = 0; i < vec_len (am->input_acl_vec_by_sw_if_index); i++) { for (ii = 0; ii < vec_len (am->input_acl_vec_by_sw_if_index[i]); /* see body */ ) { if (acl_list_index == am->input_acl_vec_by_sw_if_index[i][ii]) { vec_del1 (am->input_acl_vec_by_sw_if_index[i], ii); } else { ii++; } } } /* now we can delete the ACL itself */ a = &am->acls[acl_list_index]; if (a->rules) { clib_mem_free (a->rules); } pool_put (am->acls, a); return 0; } /* Some aids in ASCII graphing the content */ #define XX "\377" #define __ "\000" #define _(x) #define v u8 ip4_5tuple_mask[] = _(" dmac smac etype ") _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v _(" v ihl totlen ") _(0x0000) __ __ __ __ _(" ident fl+fo ") _(0x0004) __ __ __ __ _(" ttl pr checksum ") _(0x0008) __ XX __ __ _(" src address ") _(0x000C) XX XX XX XX _(" dst address ") _(0x0010) XX XX XX XX _("L4 T/U sport dport ") _(tcpudp) XX XX XX XX _(padpad) __ __ __ __ _(padpad) __ __ __ __ _(padeth) __ __; u8 ip6_5tuple_mask[] = _(" dmac smac etype ") _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v _(" v tc + flow ") _(0x0000) __ __ __ __ _(" plen nh hl ") _(0x0004) __ __ XX __ _(" src address ") _(0x0008) XX XX XX XX _(0x000C) XX XX XX XX _(0x0010) XX XX XX XX _(0x0014) XX XX XX XX _(" dst address ") _(0x0018) XX XX XX XX _(0x001C) XX XX XX XX _(0x0020) XX XX XX XX _(0x0024) XX XX XX XX _("L4T/U sport dport ") _(tcpudp) XX XX XX XX _(padpad) __ __ __ __ _(padeth) __ __; #undef XX #undef __ #undef _ #undef v static int count_skip (u8 * p, u32 size) { u64 *p64 = (u64 *) p; /* Be tolerant to null pointer */ if (0 == p) return 0; while ((0ULL == *p64) && ((u8 *) p64 - p) < size) { p64++; } return (p64 - (u64 *) p) / 2; } static int acl_classify_add_del_table_big (vnet_classify_main_t * cm, u8 * mask, u32 mask_len, u32 next_table_index, u32 miss_next_index, u32 * table_index, int is_add) { u32 nbuckets = 65536; u32 memory_size = 2 << 30; u32 skip = count_skip (mask, mask_len); u32 match = (mask_len / 16) - skip; u8 *skip_mask_ptr = mask + 16 * skip; u32 current_data_flag = 0; int current_data_offset = 0; if (0 == match) match = 1; return vnet_classify_add_del_table (cm, skip_mask_ptr, nbuckets, memory_size, skip, match, next_table_index, miss_next_index, table_index, current_data_flag, current_data_offset, is_add, 1 /* delete_chain */); } static int acl_classify_add_del_table_small (vnet_classify_main_t * cm, u8 * mask, u32 mask_len, u32 next_table_index, u32 miss_next_index, u32 * table_index, int is_add) { u32 nbuckets = 32; u32 memory_size = 2 << 20; u32 skip = count_skip (mask, mask_len); u32 match = (mask_len / 16) - skip; u8 *skip_mask_ptr = mask + 16 * skip; u32 current_data_flag = 0; int current_data_offset = 0; if (0 == match) match = 1; return vnet_classify_add_del_table (cm, skip_mask_ptr, nbuckets, memory_size, skip, match, next_table_index, miss_next_index, table_index, current_data_flag, current_data_offset, is_add, 1 /* delete_chain */); } static int acl_unhook_l2_input_classify (acl_main_t * am, u32 sw_if_index) { vnet_classify_main_t *cm = &vnet_classify_main; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; vec_validate_init_empty (am->acl_ip4_input_classify_table_by_sw_if_index, sw_if_index, ~0); vec_validate_init_empty (am->acl_ip6_input_classify_table_by_sw_if_index, sw_if_index, ~0); vnet_l2_input_classify_enable_disable (sw_if_index, 0); if (am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] != ~0) { ip4_table_index = am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index]; am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] = ~0; acl_classify_add_del_table_big (cm, ip4_5tuple_mask, sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_input_classify_next_acl_ip4, &ip4_table_index, 0); } if (am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] != ~0) { ip6_table_index = am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index]; am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] = ~0; acl_classify_add_del_table_big (cm, ip6_5tuple_mask, sizeof (ip6_5tuple_mask) - 1, ~0, am->l2_input_classify_next_acl_ip6, &ip6_table_index, 0); } return 0; } static int acl_unhook_l2_output_classify (acl_main_t * am, u32 sw_if_index) { vnet_classify_main_t *cm = &vnet_classify_main; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; vec_validate_init_empty (am->acl_ip4_output_classify_table_by_sw_if_index, sw_if_index, ~0); vec_validate_init_empty (am->acl_ip6_output_classify_table_by_sw_if_index, sw_if_index, ~0); vnet_l2_output_classify_enable_disable (sw_if_index, 0); if (am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] != ~0) { ip4_table_index = am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index]; am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] = ~0; acl_classify_add_del_table_big (cm, ip4_5tuple_mask, sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_output_classify_next_acl_ip4, &ip4_table_index, 0); } if (am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] != ~0) { ip6_table_index = am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index]; am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] = ~0; acl_classify_add_del_table_big (cm, ip6_5tuple_mask, sizeof (ip6_5tuple_mask) - 1, ~0, am->l2_output_classify_next_acl_ip6, &ip6_table_index, 0); } return 0; } static int acl_hook_l2_input_classify (acl_main_t * am, u32 sw_if_index) { vnet_classify_main_t *cm = &vnet_classify_main; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; int rv; /* in case there were previous tables attached */ acl_unhook_l2_input_classify (am, sw_if_index); rv = acl_classify_add_del_table_big (cm, ip4_5tuple_mask, sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_input_classify_next_acl_ip4, &ip4_table_index, 1); if (rv) return rv; rv = acl_classify_add_del_table_big (cm, ip6_5tuple_mask, sizeof (ip6_5tuple_mask) - 1, ~0, am->l2_input_classify_next_acl_ip6, &ip6_table_index, 1); if (rv) { acl_classify_add_del_table_big (cm, ip4_5tuple_mask, sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_input_classify_next_acl_ip4, &ip4_table_index, 0); return rv; } rv = vnet_l2_input_classify_set_tables (sw_if_index, ip4_table_index, ip6_table_index, ~0); clib_warning ("ACL enabling on interface sw_if_index %d, setting tables to the following: ip4: %d ip6: %d\n", sw_if_index, ip4_table_index, ip6_table_index); if (rv) { acl_classify_add_del_table_big (cm, ip6_5tuple_mask, sizeof (ip6_5tuple_mask) - 1, ~0, am->l2_input_classify_next_acl_ip6, &ip6_table_index, 0); acl_classify_add_del_table_big (cm, ip4_5tuple_mask, sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_input_classify_next_acl_ip4, &ip4_table_index, 0); return rv; } am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] = ip4_table_index; am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] = ip6_table_index; vnet_l2_input_classify_enable_disable (sw_if_index, 1); return rv; } static int acl_hook_l2_output_classify (acl_main_t * am, u32 sw_if_index) { vnet_classify_main_t *cm = &vnet_classify_main; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; int rv; /* in case there were previous tables attached */ acl_unhook_l2_output_classify (am, sw_if_index); rv = acl_classify_add_del_table_big (cm, ip4_5tuple_mask, sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_output_classify_next_acl_ip4, &ip4_table_index, 1); if (rv) return rv; rv = acl_classify_add_del_table_big (cm, ip6_5tuple_mask, sizeof (ip6_5tuple_mask) - 1, ~0, am->l2_output_classify_next_acl_ip6, &ip6_table_index, 1); if (rv) { acl_classify_add_del_table_big (cm, ip4_5tuple_mask, sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_output_classify_next_acl_ip4, &ip4_table_index, 0); return rv; } rv = vnet_l2_output_classify_set_tables (sw_if_index, ip4_table_index, ip6_table_index, ~0); clib_warning ("ACL enabling on interface sw_if_index %d, setting tables to the following: ip4: %d ip6: %d\n", sw_if_index, ip4_table_index, ip6_table_index); if (rv) { acl_classify_add_del_table_big (cm, ip6_5tuple_mask, sizeof (ip6_5tuple_mask) - 1, ~0, am->l2_output_classify_next_acl_ip6, &ip6_table_index, 0); acl_classify_add_del_table_big (cm, ip4_5tuple_mask, sizeof (ip4_5tuple_mask) - 1, ~0, am->l2_output_classify_next_acl_ip4, &ip4_table_index, 0); return rv; } am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] = ip4_table_index; am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] = ip6_table_index; vnet_l2_output_classify_enable_disable (sw_if_index, 1); return rv; } int acl_interface_in_enable_disable (acl_main_t * am, u32 sw_if_index, int enable_disable) { int rv; /* Utterly wrong? */ if (pool_is_free_index (am->vnet_main->interface_main.sw_interfaces, sw_if_index)) return VNET_API_ERROR_INVALID_SW_IF_INDEX; acl_fa_enable_disable(sw_if_index, 1, enable_disable); if (enable_disable) { rv = acl_hook_l2_input_classify (am, sw_if_index); } else { rv = acl_unhook_l2_input_classify (am, sw_if_index); } return rv; } int acl_interface_out_enable_disable (acl_main_t * am, u32 sw_if_index, int enable_disable) { int rv; /* Utterly wrong? */ if (pool_is_free_index (am->vnet_main->interface_main.sw_interfaces, sw_if_index)) return VNET_API_ERROR_INVALID_SW_IF_INDEX; acl_fa_enable_disable(sw_if_index, 0, enable_disable); if (enable_disable) { rv = acl_hook_l2_output_classify (am, sw_if_index); } else { rv = acl_unhook_l2_output_classify (am, sw_if_index); } return rv; } static int acl_interface_add_inout_acl (u32 sw_if_index, u8 is_input, u32 acl_list_index) { acl_main_t *am = &acl_main; if (is_input) { vec_validate (am->input_acl_vec_by_sw_if_index, sw_if_index); vec_add (am->input_acl_vec_by_sw_if_index[sw_if_index], &acl_list_index, 1); acl_interface_in_enable_disable (am, sw_if_index, 1); } else { vec_validate (am->output_acl_vec_by_sw_if_index, sw_if_index); vec_add (am->output_acl_vec_by_sw_if_index[sw_if_index], &acl_list_index, 1); acl_interface_out_enable_disable (am, sw_if_index, 1); } return 0; } static int acl_interface_del_inout_acl (u32 sw_if_index, u8 is_input, u32 acl_list_index) { acl_main_t *am = &acl_main; int i; int rv = -1; if (is_input) { vec_validate (am->input_acl_vec_by_sw_if_index, sw_if_index); for (i = 0; i < vec_len (am->input_acl_vec_by_sw_if_index[sw_if_index]); i++) { if (acl_list_index == am->input_acl_vec_by_sw_if_index[sw_if_index][i]) { vec_del1 (am->input_acl_vec_by_sw_if_index[sw_if_index], i); rv = 0; break; } } if (0 == vec_len (am->input_acl_vec_by_sw_if_index[sw_if_index])) { acl_interface_in_enable_disable (am, sw_if_index, 0); } } else { vec_validate (am->output_acl_vec_by_sw_if_index, sw_if_index); for (i = 0; i < vec_len (am->output_acl_vec_by_sw_if_index[sw_if_index]); i++) { if (acl_list_index == am->output_acl_vec_by_sw_if_index[sw_if_index][i]) { vec_del1 (am->output_acl_vec_by_sw_if_index[sw_if_index], i); rv = 0; break; } } if (0 == vec_len (am->output_acl_vec_by_sw_if_index[sw_if_index])) { acl_interface_out_enable_disable (am, sw_if_index, 0); } } return rv; } static void acl_interface_reset_inout_acls (u32 sw_if_index, u8 is_input) { acl_main_t *am = &acl_main; if (is_input) { acl_interface_in_enable_disable (am, sw_if_index, 0); vec_validate (am->input_acl_vec_by_sw_if_index, sw_if_index); vec_reset_length (am->input_acl_vec_by_sw_if_index[sw_if_index]); } else { acl_interface_out_enable_disable (am, sw_if_index, 0); vec_validate (am->output_acl_vec_by_sw_if_index, sw_if_index); vec_reset_length (am->output_acl_vec_by_sw_if_index[sw_if_index]); } } static int acl_interface_add_del_inout_acl (u32 sw_if_index, u8 is_add, u8 is_input, u32 acl_list_index) { int rv = -1; if (is_add) { rv = acl_interface_add_inout_acl (sw_if_index, is_input, acl_list_index); } else { rv = acl_interface_del_inout_acl (sw_if_index, is_input, acl_list_index); } return rv; } typedef struct { u8 is_ipv6; u8 mac_mask[6]; u8 prefix_len; u32 count; u32 table_index; u32 arp_table_index; } macip_match_type_t; static u32 macip_find_match_type (macip_match_type_t * mv, u8 * mac_mask, u8 prefix_len, u8 is_ipv6) { u32 i; if (mv) { for (i = 0; i < vec_len (mv); i++) { if ((mv[i].prefix_len == prefix_len) && (mv[i].is_ipv6 == is_ipv6) && (0 == memcmp (mv[i].mac_mask, mac_mask, 6))) { return i; } } } return ~0; } /* Get metric used to sort match types. The more specific and the more often seen - the bigger the metric */ static int match_type_metric (macip_match_type_t * m) { /* FIXME: count the ones in the MAC mask as well, check how well this heuristic works in real life */ return m->prefix_len + m->is_ipv6 + 10 * m->count; } static int match_type_compare (macip_match_type_t * m1, macip_match_type_t * m2) { /* Ascending sort based on the metric values */ return match_type_metric (m1) - match_type_metric (m2); } /* Get the offset of L3 source within ethernet packet */ static int get_l3_src_offset(int is6) { if(is6) return (sizeof(ethernet_header_t) + offsetof(ip6_header_t, src_address)); else return (sizeof(ethernet_header_t) + offsetof(ip4_header_t, src_address)); } static int macip_create_classify_tables (acl_main_t * am, u32 macip_acl_index) { macip_match_type_t *mvec = NULL; macip_match_type_t *mt; macip_acl_list_t *a = &am->macip_acls[macip_acl_index]; int i; u32 match_type_index; u32 last_table; u8 mask[5 * 16]; vnet_classify_main_t *cm = &vnet_classify_main; /* Count the number of different types of rules */ for (i = 0; i < a->count; i++) { if (~0 == (match_type_index = macip_find_match_type (mvec, a->rules[i].src_mac_mask, a->rules[i].src_prefixlen, a->rules[i].is_ipv6))) { match_type_index = vec_len (mvec); vec_validate (mvec, match_type_index); memcpy (mvec[match_type_index].mac_mask, a->rules[match_type_index].src_mac_mask, 6); mvec[match_type_index].prefix_len = a->rules[i].src_prefixlen; mvec[match_type_index].is_ipv6 = a->rules[i].is_ipv6; mvec[match_type_index].table_index = ~0; } mvec[match_type_index].count++; } /* Put the most frequently used tables last in the list so we can create classifier tables in reverse order */ vec_sort_with_function (mvec, match_type_compare); /* Create the classifier tables */ last_table = ~0; /* First add ARP tables */ vec_foreach (mt, mvec) { int mask_len; int is6 = mt->is_ipv6; mt->arp_table_index = ~0; if (!is6) { memset (mask, 0, sizeof (mask)); memcpy (&mask[6], mt->mac_mask, 6); memset (&mask[12], 0xff, 2); /* ethernet protocol */ memcpy (&mask[14 + 8], mt->mac_mask, 6); for (i = 0; i < (mt->prefix_len / 8); i++) mask[14 + 14 + i] = 0xff; if (mt->prefix_len % 8) mask[14 + 14 + (mt->prefix_len / 8)] = 0xff - ((1 << (8 - mt->prefix_len % 8)) - 1); mask_len = ((14 + 14 + ((mt->prefix_len+7) / 8) + (sizeof (u32x4)-1))/sizeof(u32x4)) * sizeof (u32x4); acl_classify_add_del_table_small (cm, mask, mask_len, last_table, (~0 == last_table) ? 0 : ~0, &mt->arp_table_index, 1); last_table = mt->arp_table_index; } } /* Now add IP[46] tables */ vec_foreach (mt, mvec) { int mask_len; int is6 = mt->is_ipv6; int l3_src_offs = get_l3_src_offset(is6); memset (mask, 0, sizeof (mask)); memcpy (&mask[6], mt->mac_mask, 6); for (i = 0; i < (mt->prefix_len / 8); i++) { mask[l3_src_offs + i] = 0xff; } if (mt->prefix_len % 8) { mask[l3_src_offs + (mt->prefix_len / 8)] = 0xff - ((1 << (8 - mt->prefix_len % 8)) - 1); } /* * Round-up the number of bytes needed to store the prefix, * and round up the number of vectors too */ mask_len = ((l3_src_offs + ((mt->prefix_len+7) / 8) + (sizeof (u32x4)-1))/sizeof(u32x4)) * sizeof (u32x4); acl_classify_add_del_table_small (cm, mask, mask_len, last_table, (~0 == last_table) ? 0 : ~0, &mt->table_index, 1); last_table = mt->table_index; } a->ip4_table_index = ~0; a->ip6_table_index = ~0; a->l2_table_index = last_table; /* Populate the classifier tables with rules from the MACIP ACL */ for (i = 0; i < a->count; i++) { u32 action = 0; u32 metadata = 0; int is6 = a->rules[i].is_ipv6; int l3_src_offs = get_l3_src_offset(is6); memset (mask, 0, sizeof (mask)); memcpy (&mask[6], a->rules[i].src_mac, 6); memset (&mask[12], 0xff, 2); /* ethernet protocol */ if (is6) { memcpy (&mask[l3_src_offs], &a->rules[i].src_ip_addr.ip6, 16); mask[12] = 0x86; mask[13] = 0xdd; } else { memcpy (&mask[l3_src_offs], &a->rules[i].src_ip_addr.ip4, 4); mask[12] = 0x08; mask[13] = 0x00; } match_type_index = macip_find_match_type (mvec, a->rules[i].src_mac_mask, a->rules[i].src_prefixlen, a->rules[i].is_ipv6); /* add session to table mvec[match_type_index].table_index; */ vnet_classify_add_del_session (cm, mvec[match_type_index].table_index, mask, a->rules[i].is_permit ? ~0 : 0, i, 0, action, metadata, 1); /* add ARP table entry too */ if (!is6 && (mvec[match_type_index].arp_table_index != ~0)) { memset (mask, 0, sizeof (mask)); memcpy (&mask[6], a->rules[i].src_mac, 6); mask[12] = 0x08; mask[13] = 0x06; memcpy (&mask[14 + 8], a->rules[i].src_mac, 6); memcpy (&mask[14 + 14], &a->rules[i].src_ip_addr.ip4, 4); vnet_classify_add_del_session (cm, mvec[match_type_index].arp_table_index, mask, a->rules[i].is_permit ? ~0 : 0, i, 0, action, metadata, 1); } } return 0; } static void macip_destroy_classify_tables (acl_main_t * am, u32 macip_acl_index) { vnet_classify_main_t *cm = &vnet_classify_main; macip_acl_list_t *a = &am->macip_acls[macip_acl_index]; if (a->ip4_table_index != ~0) { acl_classify_add_del_table_small (cm, 0, ~0, ~0, ~0, &a->ip4_table_index, 0); a->ip4_table_index = ~0; } if (a->ip6_table_index != ~0) { acl_classify_add_del_table_small (cm, 0, ~0, ~0, ~0, &a->ip6_table_index, 0); a->ip6_table_index = ~0; } if (a->l2_table_index != ~0) { acl_classify_add_del_table_small (cm, 0, ~0, ~0, ~0, &a->l2_table_index, 0); a->l2_table_index = ~0; } } static int macip_acl_add_list (u32 count, vl_api_macip_acl_rule_t rules[], u32 * acl_list_index, u8 * tag) { acl_main_t *am = &acl_main; macip_acl_list_t *a; macip_acl_rule_t *r; macip_acl_rule_t *acl_new_rules; int i; /* Create and populate the rules */ acl_new_rules = clib_mem_alloc_aligned (sizeof (macip_acl_rule_t) * count, CLIB_CACHE_LINE_BYTES); if (!acl_new_rules) { /* Could not allocate rules. New or existing ACL - bail out regardless */ return -1; } for (i = 0; i < count; i++) { r = &acl_new_rules[i]; r->is_permit = rules[i].is_permit; r->is_ipv6 = rules[i].is_ipv6; memcpy (&r->src_mac, rules[i].src_mac, 6); memcpy (&r->src_mac_mask, rules[i].src_mac_mask, 6); if(rules[i].is_ipv6) memcpy (&r->src_ip_addr.ip6, rules[i].src_ip_addr, 16); else memcpy (&r->src_ip_addr.ip4, rules[i].src_ip_addr, 4); r->src_prefixlen = rules[i].src_ip_prefix_len; } /* Get ACL index */ pool_get_aligned (am->macip_acls, a, CLIB_CACHE_LINE_BYTES); memset (a, 0, sizeof (*a)); /* Will return the newly allocated ACL index */ *acl_list_index = a - am->macip_acls; a->rules = acl_new_rules; a->count = count; memcpy (a->tag, tag, sizeof (a->tag)); /* Create and populate the classifer tables */ macip_create_classify_tables (am, *acl_list_index); return 0; } /* No check for validity of sw_if_index - the callers were supposed to validate */ static int macip_acl_interface_del_acl (acl_main_t * am, u32 sw_if_index) { int rv; u32 macip_acl_index; macip_acl_list_t *a; vec_validate_init_empty (am->macip_acl_by_sw_if_index, sw_if_index, ~0); macip_acl_index = am->macip_acl_by_sw_if_index[sw_if_index]; /* No point in deleting MACIP ACL which is not applied */ if (~0 == macip_acl_index) return -1; a = &am->macip_acls[macip_acl_index]; /* remove the classifier tables off the interface L2 ACL */ rv = vnet_set_input_acl_intfc (am->vlib_main, sw_if_index, a->ip4_table_index, a->ip6_table_index, a->l2_table_index, 0); /* Unset the MACIP ACL index */ am->macip_acl_by_sw_if_index[sw_if_index] = ~0; return rv; } /* No check for validity of sw_if_index - the callers were supposed to validate */ static int macip_acl_interface_add_acl (acl_main_t * am, u32 sw_if_index, u32 macip_acl_index) { macip_acl_list_t *a; int rv; if (pool_is_free_index (am->macip_acls, macip_acl_index)) { return -1; } a = &am->macip_acls[macip_acl_index]; vec_validate_init_empty (am->macip_acl_by_sw_if_index, sw_if_index, ~0); /* If there already a MACIP ACL applied, unapply it */ if (~0 != am->macip_acl_by_sw_if_index[sw_if_index]) macip_acl_interface_del_acl(am, sw_if_index); am->macip_acl_by_sw_if_index[sw_if_index] = macip_acl_index; /* Apply the classifier tables for L2 ACLs */ rv = vnet_set_input_acl_intfc (am->vlib_main, sw_if_index, a->ip4_table_index, a->ip6_table_index, a->l2_table_index, 1); return rv; } static int macip_acl_del_list (u32 acl_list_index) { acl_main_t *am = &acl_main; macip_acl_list_t *a; int i; if (pool_is_free_index (am->macip_acls, acl_list_index)) { return -1; } /* delete any references to the ACL */ for (i = 0; i < vec_len (am->macip_acl_by_sw_if_index); i++) { if (am->macip_acl_by_sw_if_index[i] == acl_list_index) { macip_acl_interface_del_acl (am, i); } } /* Now that classifier tables are detached, clean them up */ macip_destroy_classify_tables (am, acl_list_index); /* now we can delete the ACL itself */ a = &am->macip_acls[acl_list_index]; if (a->rules) { clib_mem_free (a->rules); } pool_put (am->macip_acls, a); return 0; } static int macip_acl_interface_add_del_acl (u32 sw_if_index, u8 is_add, u32 acl_list_index) { acl_main_t *am = &acl_main; int rv = -1; if (is_add) { rv = macip_acl_interface_add_acl (am, sw_if_index, acl_list_index); } else { rv = macip_acl_interface_del_acl (am, sw_if_index); } return rv; } /* API message handler */ static void vl_api_acl_add_replace_t_handler (vl_api_acl_add_replace_t * mp) { vl_api_acl_add_replace_reply_t *rmp; acl_main_t *am = &acl_main; int rv; u32 acl_list_index = ntohl (mp->acl_index); rv = acl_add_list (ntohl (mp->count), mp->r, &acl_list_index, mp->tag); /* *INDENT-OFF* */ REPLY_MACRO2(VL_API_ACL_ADD_REPLACE_REPLY, ({ rmp->acl_index = htonl(acl_list_index); })); /* *INDENT-ON* */ } static void vl_api_acl_del_t_handler (vl_api_acl_del_t * mp) { acl_main_t *am = &acl_main; vl_api_acl_del_reply_t *rmp; int rv; rv = acl_del_list (ntohl (mp->acl_index)); REPLY_MACRO (VL_API_ACL_DEL_REPLY); } static void vl_api_acl_interface_add_del_t_handler (vl_api_acl_interface_add_del_t * mp) { acl_main_t *am = &acl_main; vnet_interface_main_t *im = &am->vnet_main->interface_main; u32 sw_if_index = ntohl (mp->sw_if_index); vl_api_acl_interface_add_del_reply_t *rmp; int rv = -1; if (pool_is_free_index(im->sw_interfaces, sw_if_index)) rv = VNET_API_ERROR_INVALID_SW_IF_INDEX; else rv = acl_interface_add_del_inout_acl (sw_if_index, mp->is_add, mp->is_input, ntohl (mp->acl_index)); REPLY_MACRO (VL_API_ACL_INTERFACE_ADD_DEL_REPLY); } static void vl_api_acl_interface_set_acl_list_t_handler (vl_api_acl_interface_set_acl_list_t * mp) { acl_main_t *am = &acl_main; vl_api_acl_interface_set_acl_list_reply_t *rmp; int rv = 0; int i; vnet_interface_main_t *im = &am->vnet_main->interface_main; u32 sw_if_index = ntohl (mp->sw_if_index); if (pool_is_free_index(im->sw_interfaces, sw_if_index)) rv = VNET_API_ERROR_INVALID_SW_IF_INDEX; else { acl_interface_reset_inout_acls (sw_if_index, 0); acl_interface_reset_inout_acls (sw_if_index, 1); for (i = 0; i < mp->count; i++) { acl_interface_add_del_inout_acl (sw_if_index, 1, (i < mp->n_input), ntohl (mp->acls[i])); } } REPLY_MACRO (VL_API_ACL_INTERFACE_SET_ACL_LIST_REPLY); } static void copy_acl_rule_to_api_rule (vl_api_acl_rule_t * api_rule, acl_rule_t * r) { api_rule->is_permit = r->is_permit; api_rule->is_ipv6 = r->is_ipv6; if(r->is_ipv6) { memcpy (api_rule->src_ip_addr, &r->src, sizeof (r->src)); memcpy (api_rule->dst_ip_addr, &r->dst, sizeof (r->dst)); } else { memcpy (api_rule->src_ip_addr, &r->src.ip4, sizeof (r->src.ip4)); memcpy (api_rule->dst_ip_addr, &r->dst.ip4, sizeof (r->dst.ip4)); } api_rule->src_ip_prefix_len = r->src_prefixlen; api_rule->dst_ip_prefix_len = r->dst_prefixlen; api_rule->proto = r->proto; api_rule->srcport_or_icmptype_first = htons (r->src_port_or_type_first); api_rule->srcport_or_icmptype_last = htons (r->src_port_or_type_last); api_rule->dstport_or_icmpcode_first = htons (r->dst_port_or_code_first); api_rule->dstport_or_icmpcode_last = htons (r->dst_port_or_code_last); api_rule->tcp_flags_mask = r->tcp_flags_mask; api_rule->tcp_flags_value = r->tcp_flags_value; } static void send_acl_details (acl_main_t * am, unix_shared_memory_queue_t * q, acl_list_t * acl, u32 context) { vl_api_acl_details_t *mp; vl_api_acl_rule_t *rules; int i; int msg_size = sizeof (*mp) + sizeof (mp->r[0]) * acl->count; mp = vl_msg_api_alloc (msg_size); memset (mp, 0, msg_size); mp->_vl_msg_id = ntohs (VL_API_ACL_DETAILS + am->msg_id_base); /* fill in the message */ mp->context = context; mp->count = htonl (acl->count); mp->acl_index = htonl (acl - am->acls); memcpy (mp->tag, acl->tag, sizeof (mp->tag)); // clib_memcpy (mp->r, acl->rules, acl->count * sizeof(acl->rules[0])); rules = mp->r; for (i = 0; i < acl->count; i++) { copy_acl_rule_to_api_rule (&rules[i], &acl->rules[i]); } clib_warning("Sending acl details for ACL index %d", ntohl(mp->acl_index)); vl_msg_api_send_shmem (q, (u8 *) & mp); } static void vl_api_acl_dump_t_handler (vl_api_acl_dump_t * mp) { acl_main_t *am = &acl_main; u32 acl_index; acl_list_t *acl; int rv = -1; unix_shared_memory_queue_t *q; q = vl_api_client_index_to_input_queue (mp->client_index); if (q == 0) { return; } if (mp->acl_index == ~0) { /* *INDENT-OFF* */ /* Just dump all ACLs */ pool_foreach (acl, am->acls, ({ send_acl_details(am, q, acl, mp->context); })); /* *INDENT-ON* */ } else { acl_index = ntohl (mp->acl_index); if (!pool_is_free_index (am->acls, acl_index)) { acl = &am->acls[acl_index]; send_acl_details (am, q, acl, mp->context); } } if (rv == -1) { /* FIXME API: should we signal an error here at all ? */ return; } } static void send_acl_interface_list_details (acl_main_t * am, unix_shared_memory_queue_t * q, u32 sw_if_index, u32 context) { vl_api_acl_interface_list_details_t *mp; int msg_size; int n_input; int n_output; int count; int i = 0; vec_validate (am->input_acl_vec_by_sw_if_index, sw_if_index); vec_validate (am->output_acl_vec_by_sw_if_index, sw_if_index); n_input = vec_len (am->input_acl_vec_by_sw_if_index[sw_if_index]); n_output = vec_len (am->output_acl_vec_by_sw_if_index[sw_if_index]); count = n_input + n_output; msg_size = sizeof (*mp); msg_size += sizeof (mp->acls[0]) * count; mp = vl_msg_api_alloc (msg_size); memset (mp, 0, msg_size); mp->_vl_msg_id = ntohs (VL_API_ACL_INTERFACE_LIST_DETAILS + am->msg_id_base); /* fill in the message */ mp->context = context; mp->sw_if_index = htonl (sw_if_index); mp->count = count; mp->n_input = n_input; for (i = 0; i < n_input; i++) { mp->acls[i] = htonl (am->input_acl_vec_by_sw_if_index[sw_if_index][i]); } for (i = 0; i < n_output; i++) { mp->acls[n_input + i] = htonl (am->output_acl_vec_by_sw_if_index[sw_if_index][i]); } vl_msg_api_send_shmem (q, (u8 *) & mp); } static void vl_api_acl_interface_list_dump_t_handler (vl_api_acl_interface_list_dump_t * mp) { acl_main_t *am = &acl_main; vnet_sw_interface_t *swif; vnet_interface_main_t *im = &am->vnet_main->interface_main; u32 sw_if_index; unix_shared_memory_queue_t *q; q = vl_api_client_index_to_input_queue (mp->client_index); if (q == 0) { return; } if (mp->sw_if_index == ~0) { /* *INDENT-OFF* */ pool_foreach (swif, im->sw_interfaces, ({ send_acl_interface_list_details(am, q, swif->sw_if_index, mp->context); })); /* *INDENT-ON* */ } else { sw_if_index = ntohl (mp->sw_if_index); if (!pool_is_free_index(im->sw_interfaces, sw_if_index)) send_acl_interface_list_details (am, q, sw_if_index, mp->context); } } /* MACIP ACL API handlers */ static void vl_api_macip_acl_add_t_handler (vl_api_macip_acl_add_t * mp) { vl_api_macip_acl_add_reply_t *rmp; acl_main_t *am = &acl_main; int rv; u32 acl_list_index = ~0; rv = macip_acl_add_list (ntohl (mp->count), mp->r, &acl_list_index, mp->tag); /* *INDENT-OFF* */ REPLY_MACRO2(VL_API_MACIP_ACL_ADD_REPLY, ({ rmp->acl_index = htonl(acl_list_index); })); /* *INDENT-ON* */ } static void vl_api_macip_acl_del_t_handler (vl_api_macip_acl_del_t * mp) { acl_main_t *am = &acl_main; vl_api_macip_acl_del_reply_t *rmp; int rv; rv = macip_acl_del_list (ntohl (mp->acl_index)); REPLY_MACRO (VL_API_MACIP_ACL_DEL_REPLY); } static void vl_api_macip_acl_interface_add_del_t_handler (vl_api_macip_acl_interface_add_del_t * mp) { acl_main_t *am = &acl_main; vl_api_macip_acl_interface_add_del_reply_t *rmp; int rv = -1; vnet_interface_main_t *im = &am->vnet_main->interface_main; u32 sw_if_index = ntohl (mp->sw_if_index); if (pool_is_free_index(im->sw_interfaces, sw_if_index)) rv = VNET_API_ERROR_INVALID_SW_IF_INDEX; else rv = macip_acl_interface_add_del_acl (ntohl (mp->sw_if_index), mp->is_add, ntohl (mp->acl_index)); REPLY_MACRO (VL_API_MACIP_ACL_INTERFACE_ADD_DEL_REPLY); } static void send_macip_acl_details (acl_main_t * am, unix_shared_memory_queue_t * q, macip_acl_list_t * acl, u32 context) { vl_api_macip_acl_details_t *mp; vl_api_macip_acl_rule_t *rules; macip_acl_rule_t *r; int i; int msg_size = sizeof (*mp) + (acl ? sizeof (mp->r[0]) * acl->count : 0); mp = vl_msg_api_alloc (msg_size); memset (mp, 0, msg_size); mp->_vl_msg_id = ntohs (VL_API_MACIP_ACL_DETAILS + am->msg_id_base); /* fill in the message */ mp->context = context; if (acl) { memcpy (mp->tag, acl->tag, sizeof (mp->tag)); mp->count = htonl (acl->count); mp->acl_index = htonl (acl - am->macip_acls); rules = mp->r; for (i = 0; i < acl->count; i++) { r = &acl->rules[i]; rules[i].is_permit = r->is_permit; rules[i].is_ipv6 = r->is_ipv6; memcpy (rules[i].src_mac, &r->src_mac, sizeof (r->src_mac)); memcpy (rules[i].src_mac_mask, &r->src_mac_mask, sizeof (r->src_mac_mask)); if (r->is_ipv6) memcpy (rules[i].src_ip_addr, &r->src_ip_addr.ip6, sizeof (r->src_ip_addr.ip6)); else memcpy (rules[i].src_ip_addr, &r->src_ip_addr.ip4, sizeof (r->src_ip_addr.ip4)); rules[i].src_ip_prefix_len = r->src_prefixlen; } } else { /* No martini, no party - no ACL applied to this interface. */ mp->acl_index = ~0; mp->count = 0; } vl_msg_api_send_shmem (q, (u8 *) & mp); } static void vl_api_macip_acl_dump_t_handler (vl_api_macip_acl_dump_t * mp) { acl_main_t *am = &acl_main; macip_acl_list_t *acl; unix_shared_memory_queue_t *q; q = vl_api_client_index_to_input_queue (mp->client_index); if (q == 0) { return; } if (mp->acl_index == ~0) { /* Just dump all ACLs for now, with sw_if_index = ~0 */ pool_foreach (acl, am->macip_acls, ( { send_macip_acl_details (am, q, acl, mp-> context);} )); /* *INDENT-ON* */ } else { u32 acl_index = ntohl (mp->acl_index); if (!pool_is_free_index (am->macip_acls, acl_index)) { acl = &am->macip_acls[acl_index]; send_macip_acl_details (am, q, acl, mp->context); } } } static void vl_api_macip_acl_interface_get_t_handler (vl_api_macip_acl_interface_get_t * mp) { acl_main_t *am = &acl_main; vl_api_macip_acl_interface_get_reply_t *rmp; u32 count = vec_len (am->macip_acl_by_sw_if_index); int msg_size = sizeof (*rmp) + sizeof (rmp->acls[0]) * count; unix_shared_memory_queue_t *q; int i; q = vl_api_client_index_to_input_queue (mp->client_index); if (q == 0) { return; } rmp = vl_msg_api_alloc (msg_size); memset (rmp, 0, msg_size); rmp->_vl_msg_id = ntohs (VL_API_MACIP_ACL_INTERFACE_GET_REPLY + am->msg_id_base); rmp->context = mp->context; rmp->count = htonl (count); for (i = 0; i < count; i++) { rmp->acls[i] = htonl (am->macip_acl_by_sw_if_index[i]); } vl_msg_api_send_shmem (q, (u8 *) & rmp); } /* Set up the API message handling tables */ static clib_error_t * acl_plugin_api_hookup (vlib_main_t * vm) { acl_main_t *am = &acl_main; #define _(N,n) \ vl_msg_api_set_handlers((VL_API_##N + am->msg_id_base), \ #n, \ vl_api_##n##_t_handler, \ vl_noop_handler, \ vl_api_##n##_t_endian, \ vl_api_##n##_t_print, \ sizeof(vl_api_##n##_t), 1); foreach_acl_plugin_api_msg; #undef _ return 0; } #define vl_msg_name_crc_list #include <acl/acl_all_api_h.h> #undef vl_msg_name_crc_list static void setup_message_id_table (acl_main_t * am, api_main_t * apim) { #define _(id,n,crc) \ vl_msg_api_add_msg_name_crc (apim, #n "_" #crc, id + am->msg_id_base); foreach_vl_msg_name_crc_acl; #undef _ } static void acl_setup_fa_nodes (void) { vlib_main_t *vm = vlib_get_main (); acl_main_t *am = &acl_main; vlib_node_t *n, *n4, *n6; n = vlib_get_node_by_name (vm, (u8 *) "l2-input-classify"); n4 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-in-ip4-l2"); n6 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-in-ip6-l2"); am->l2_input_classify_next_acl_ip4 = vlib_node_add_next_with_slot (vm, n->index, n4->index, ~0); am->l2_input_classify_next_acl_ip6 = vlib_node_add_next_with_slot (vm, n->index, n6->index, ~0); feat_bitmap_init_next_nodes (vm, n4->index, L2INPUT_N_FEAT, l2input_get_feat_names (), am->fa_acl_in_ip4_l2_node_feat_next_node_index); feat_bitmap_init_next_nodes (vm, n6->index, L2INPUT_N_FEAT, l2input_get_feat_names (), am->fa_acl_in_ip6_l2_node_feat_next_node_index); n = vlib_get_node_by_name (vm, (u8 *) "l2-output-classify"); n4 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-out-ip4-l2"); n6 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-out-ip6-l2"); am->l2_output_classify_next_acl_ip4 = vlib_node_add_next_with_slot (vm, n->index, n4->index, ~0); am->l2_output_classify_next_acl_ip6 = vlib_node_add_next_with_slot (vm, n->index, n6->index, ~0); feat_bitmap_init_next_nodes (vm, n4->index, L2OUTPUT_N_FEAT, l2output_get_feat_names (), am->fa_acl_out_ip4_l2_node_feat_next_node_index); feat_bitmap_init_next_nodes (vm, n6->index, L2OUTPUT_N_FEAT, l2output_get_feat_names (), am->fa_acl_out_ip6_l2_node_feat_next_node_index); } static void acl_set_timeout_sec(int timeout_type, u32 value) { acl_main_t *am = &acl_main; clib_time_t *ct = &am->vlib_main->clib_time; if (timeout_type < ACL_N_TIMEOUTS) { am->session_timeout_sec[timeout_type] = value; } else { clib_warning("Unknown timeout type %d", timeout_type); return; } am->session_timeout[timeout_type] = (u64)(((f64)value)/ct->seconds_per_clock); } static void acl_set_session_max_entries(u32 value) { acl_main_t *am = &acl_main; am->fa_conn_table_max_entries = value; } static int acl_set_skip_ipv6_eh(u32 eh, u32 value) { acl_main_t *am = &acl_main; if ((eh < 256) && (value < 2)) { am->fa_ipv6_known_eh_bitmap = clib_bitmap_set(am->fa_ipv6_known_eh_bitmap, eh, value); return 1; } else return 0; } static clib_error_t * acl_sw_interface_add_del (vnet_main_t * vnm, u32 sw_if_index, u32 is_add) { acl_main_t *am = &acl_main; if (0 == is_add) { vlib_process_signal_event (am->vlib_main, am->fa_cleaner_node_index, ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX, sw_if_index); } return 0; } VNET_SW_INTERFACE_ADD_DEL_FUNCTION (acl_sw_interface_add_del); static clib_error_t * acl_set_aclplugin_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { clib_error_t *error = 0; u32 timeout = 0; u32 val = 0; u32 eh_val = 0; uword memory_size = 0; acl_main_t *am = &acl_main; if (unformat (input, "skip-ipv6-extension-header %u %u", &eh_val, &val)) { if(!acl_set_skip_ipv6_eh(eh_val, val)) { error = clib_error_return(0, "expecting eh=0..255, value=0..1"); } goto done; } if (unformat (input, "l4-match-nonfirst-fragment %u", &val)) { am->l4_match_nonfirst_fragment = (val != 0); goto done; } if (unformat (input, "session")) { if (unformat (input, "clear")) { acl_main_t *am = &acl_main; vlib_process_signal_event (am->vlib_main, am->fa_cleaner_node_index, ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX, ~0); goto done; } if (unformat (input, "table")) { /* The commands here are for tuning/testing. No user-serviceable parts inside */ if (unformat (input, "max-entries")) { if (!unformat(input, "%u", &val)) { error = clib_error_return(0, "expecting maximum number of entries, got `%U`", format_unformat_error, input); goto done; } else { acl_set_session_max_entries(val); goto done; } } if (unformat (input, "hash-table-buckets")) { if (!unformat(input, "%u", &val)) { error = clib_error_return(0, "expecting maximum number of hash table buckets, got `%U`", format_unformat_error, input); goto done; } else { am->fa_conn_table_hash_num_buckets = val; goto done; } } if (unformat (input, "hash-table-memory")) { if (!unformat(input, "%U", unformat_memory_size, &memory_size)) { error = clib_error_return(0, "expecting maximum amount of hash table memory, got `%U`", format_unformat_error, input); goto done; } else { am->fa_conn_table_hash_memory_size = memory_size; goto done; } } goto done; } if (unformat (input, "timeout")) { if (unformat(input, "udp")) { if(unformat(input, "idle")) { if (!unformat(input, "%u", &timeout)) { error = clib_error_return(0, "expecting timeout value in seconds, got `%U`", format_unformat_error, input); goto done; } else { acl_set_timeout_sec(ACL_TIMEOUT_UDP_IDLE, timeout); goto done; } } } if (unformat(input, "tcp")) { if(unformat(input, "idle")) { if (!unformat(input, "%u", &timeout)) { error = clib_error_return(0, "expecting timeout value in seconds, got `%U`", format_unformat_error, input); goto done; } else { acl_set_timeout_sec(ACL_TIMEOUT_TCP_IDLE, timeout); goto done; } } if(unformat(input, "transient")) { if (!unformat(input, "%u", &timeout)) { error = clib_error_return(0, "expecting timeout value in seconds, got `%U`", format_unformat_error, input); goto done; } else { acl_set_timeout_sec(ACL_TIMEOUT_TCP_TRANSIENT, timeout); goto done; } } } goto done; } } done: return error; } static clib_error_t * acl_show_aclplugin_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd) { clib_error_t *error = 0; acl_main_t *am = &acl_main; vnet_interface_main_t *im = &am->vnet_main->interface_main; vnet_sw_interface_t *swif; if (unformat (input, "sessions")) { u8 * out0 = 0; pool_foreach (swif, im->sw_interfaces, ({ u32 sw_if_index = swif->sw_if_index; u64 n_adds = sw_if_index < vec_len(am->fa_session_adds_by_sw_if_index) ? am->fa_session_adds_by_sw_if_index[sw_if_index] : 0; u64 n_dels = sw_if_index < vec_len(am->fa_session_dels_by_sw_if_index) ? am->fa_session_dels_by_sw_if_index[sw_if_index] : 0; out0 = format(out0, "sw_if_index %d: add %lu - del %lu = %lu\n", sw_if_index, n_adds, n_dels, n_adds - n_dels); })); out0 = format(out0, "\n\nConn cleaner thread counters:\n"); #define _(cnt, desc) out0 = format(out0, " %20lu: %s\n", am->cnt, desc); foreach_fa_cleaner_counter; #undef _ vlib_cli_output(vm, "\n\n%s\n\n", out0); vlib_cli_output(vm, "Sessions per interval: min %lu max %lu increment: %f ms current: %f ms", am->fa_min_deleted_sessions_per_interval, am->fa_max_deleted_sessions_per_interval, am->fa_cleaner_wait_time_increment * 1000.0, ((f64)am->fa_current_cleaner_timer_wait_interval) * 1000.0/(f64)vm->clib_time.clocks_per_second); vec_free(out0); } return error; } /* *INDENT-OFF* */ VLIB_CLI_COMMAND (aclplugin_set_command, static) = { .path = "set acl-plugin", .short_help = "set acl-plugin session timeout {{udp idle}|tcp {idle|transient}} <seconds>", .function = acl_set_aclplugin_fn, }; VLIB_CLI_COMMAND (aclplugin_show_command, static) = { .path = "show acl-plugin", .short_help = "show acl-plugin sessions", .function = acl_show_aclplugin_fn, }; /* *INDENT-ON* */ static clib_error_t * acl_init (vlib_main_t * vm) { acl_main_t *am = &acl_main; clib_error_t *error = 0; memset (am, 0, sizeof (*am)); am->vlib_main = vm; am->vnet_main = vnet_get_main (); u8 *name = format (0, "acl_%08x%c", api_version, 0); /* Ask for a correctly-sized block of API message decode slots */ am->msg_id_base = vl_msg_api_get_msg_ids ((char *) name, VL_MSG_FIRST_AVAILABLE); error = acl_plugin_api_hookup (vm); /* Add our API messages to the global name_crc hash table */ setup_message_id_table (am, &api_main); vec_free (name); acl_setup_fa_nodes(); am->session_timeout_sec[ACL_TIMEOUT_TCP_TRANSIENT] = TCP_SESSION_TRANSIENT_TIMEOUT_SEC; am->session_timeout_sec[ACL_TIMEOUT_TCP_IDLE] = TCP_SESSION_IDLE_TIMEOUT_SEC; am->session_timeout_sec[ACL_TIMEOUT_UDP_IDLE] = UDP_SESSION_IDLE_TIMEOUT_SEC; am->fa_conn_table_hash_num_buckets = ACL_FA_CONN_TABLE_DEFAULT_HASH_NUM_BUCKETS; am->fa_conn_table_hash_memory_size = ACL_FA_CONN_TABLE_DEFAULT_HASH_MEMORY_SIZE; am->fa_conn_table_max_entries = ACL_FA_CONN_TABLE_DEFAULT_MAX_ENTRIES; { u8 tt; for(tt = 0; tt < ACL_N_TIMEOUTS; tt++) { am->fa_conn_list_head[tt] = ~0; am->fa_conn_list_tail[tt] = ~0; } } am->fa_min_deleted_sessions_per_interval = ACL_FA_DEFAULT_MIN_DELETED_SESSIONS_PER_INTERVAL; am->fa_max_deleted_sessions_per_interval = ACL_FA_DEFAULT_MAX_DELETED_SESSIONS_PER_INTERVAL; am->fa_cleaner_wait_time_increment = ACL_FA_DEFAULT_CLEANER_WAIT_TIME_INCREMENT; am->fa_cleaner_cnt_delete_by_sw_index = 0; am->fa_cleaner_cnt_delete_by_sw_index_ok = 0; am->fa_cleaner_cnt_unknown_event = 0; am->fa_cleaner_cnt_deleted_sessions = 0; am->fa_cleaner_cnt_timer_restarted = 0; am->fa_cleaner_cnt_wait_with_timeout = 0; #define _(N, v, s) am->fa_ipv6_known_eh_bitmap = clib_bitmap_set(am->fa_ipv6_known_eh_bitmap, v, 1); foreach_acl_eh #undef _ am->l4_match_nonfirst_fragment = 1; return error; } VLIB_INIT_FUNCTION (acl_init);


context:
space:
mode: