TLDK udwfwd test case: - csit - Integration tests

Integration tests
Grokmirror user
about summary refs log tree commit diff stats
path: root/tests/perf/10ge2p1x520-eth-l2xcbase-eth-4vhost-2vm-ndrpdrdisc.robot
diff options
author	Qun Wan <qun.wan@intel.com>	2017-03-30 14:36:56 -0400
committer	Peter Mikus <pmikus@cisco.com>	2017-06-07 05:24:57 +0000
commit	7436d8bdf60bca9b80fb76781e1f709bbcd435da (patch)
tree	53a49da5dd22a88cf70c22848468f6d3a336a050 /tests/perf/10ge2p1x520-eth-l2xcbase-eth-4vhost-2vm-ndrpdrdisc.robot
parent	d058458cb57eaa68c9aafe03fa823e7489664bf0 (diff)
TLDK udwfwd test case:
- ip fragement for ipv4 - ip reassemble for ipv4 - ip checksum for ipv4 - ip checksum for ipv6 - ip fragment for ipv6 added the genpcap.py script to generate the pcap files and corresponding test scripts Change-Id: I01329dbb0ecd3c3a5dd7a63ef1dea01b2e717da5 Signed-off-by: qun wan <qun.wan@intel.com>
Diffstat (limited to 'tests/perf/10ge2p1x520-eth-l2xcbase-eth-4vhost-2vm-ndrpdrdisc.robot')
0 files changed, 0 insertions, 0 deletions
'>332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488
.. _aclwithvpp:

Access Control Lists (ACLs) with FD.io VPP
==========================================

This section is overview of the options available to implement ACLs in
FD.io VPP. As there are a number of way's to address ACL-like functionality,
it is worth a separate survey of these options with some commentary on
features and performance

All performance numbers and examples from this document are reused from
the `FD.io CSIT v19.04 performance report <https://docs.fd.io/csit/rls1904/report/>`__
All information and performance is accurate for
`FD.io VPP 19.04 <https://git.fd.io/vpp/tag/?h=v19.04>`__ release. The
sections *performance* & *operational data* below correlate directly with
those sections from the FD.io CSIT performance report.

Summary
-------

+---------------------+-----------+-----------------------------------+
| Option              | Relative  | Features & Notes                  |
|                     | Performan |                                   |
|                     | ce        |                                   |
+=====================+===========+===================================+
| :ref:`aclplugin`    | Lowest    | Match on restricted L2-L4 fields, |
|                     |           | stateful & stateless              |
+---------------------+-----------+-----------------------------------+
| :ref:`vppcop`       | Highest   | Match on Layer 3 IPs, stateless   |
|                     | (software |                                   |
|                     | only)     |                                   |
+---------------------+-----------+-----------------------------------+
| :ref:`vppflow`      | Highest   | Match on restricted L2-L4 fields, |
|                     | (accelera | stateless, limited number of      |
|                     | ted)      | flows                             |
+---------------------+-----------+-----------------------------------+
| :ref:`classifiers`  | TBD       | Match on any field in the first   |
|                     |           | 80 bytes, Not measured            |
+---------------------+-----------+-----------------------------------+

FD.io VPP ACL Options
---------------------

.. _aclplugin:

The FD.io VPP ACL Plugin
~~~~~~~~~~~~~~~~~~~~~~~~

The plugin was originally developed as part of FD.io VPP and OpenStack
integration. The plugin needs to be enabled on specific interfaces.

Supports stateful and stateless ACLs on …
""""""""""""""""""""""""""""""""""""""""""

- MACs
- IPS
- UDP Ports
- TCP Ports & Flags
- ICMP Messages

Directional
"""""""""""

* Input ACLs

  * Run before the IP flow classification.

* ACLs

  * Run before interface output.

Actions
"""""""
- Permit (sl)
- Drop (sf)
- Permit+Reflect (sf)

Stateful (sf)
"""""""""""""

- Actions: permit+reflect
- Most heavily optimized, as are the most common use case.
- Faster because stateful uses a flow cache, it means the ACL hit is only taken once, up front for the flow and then becomes just look-up.
- Uses more memory, less deterministic as the flow cache makes it
  more susceptible to the effects of the memory hierarchy and
  locality.

Stateless (sl)
""""""""""""""

-  Actions : permit, drop
-  Less optimized, less common use case.
-  Slower as there is no flow-cache, every new packet incurs the same
   amount ACL processing.
-  Uses less memory, and are more deterministic (compared to
   stateful).

Operational Data
----------------

Input/Stateless
~~~~~~~~~~~~~~~

Test Case: 10ge2p1x520-ethip4udp-ip4base-iacl1sl-10kflows-ndrpdr
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

.. code-block:: console

       DUT1: 
       Thread 0 vpp_main (lcore 1) 
       Time 3.8, average vectors/node 0.00, last 128 main loops 0.00 per node 0.00 
         vector rates in 0.0000e0, out 0.0000e0, drop 0.0000e0, punt 0.0000e0 
                    Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
       acl-plugin-fa-cleaner-process   any wait                 0               0              14          1.29e3            0.00 
       acl-plugin-fa-worker-cleaner-pinterrupt wa               7               0               0          9.18e2            0.00 
       api-rx-from-ring                 active                  0               0              52          8.96e4            0.00 
       dpdk-process                    any wait                 0               0               1          1.35e4            0.00 
       fib-walk                        any wait                 0               0               2          2.69e3            0.00 
       ip6-icmp-neighbor-discovery-ev  any wait                 0               0               4          1.32e3            0.00 
       lisp-retry-service              any wait                 0               0               2          2.90e3            0.00 
       unix-epoll-input                 polling              7037               0               0          1.25e6            0.00 
       vpe-oam-process                 any wait                 0               0               2          2.28e3            0.00 

       Thread 1 vpp_wk_0 (lcore 2) 
       Time 3.8, average vectors/node 249.02, last 128 main loops 32.00 per node 273.07 
         vector rates in 6.1118e6, out 6.1118e6, drop 0.0000e0, punt 0.0000e0 
                    Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
       TenGigabitEtherneta/0/0-output   active              47106        11721472               0          9.47e0          248.83 
       TenGigabitEtherneta/0/0-tx       active              47106        11721472               0          4.22e1          248.83 
       TenGigabitEtherneta/0/1-output   active              47106        11721472               0          1.02e1          248.83 
       TenGigabitEtherneta/0/1-tx       active              47106        11721472               0          4.18e1          248.83 
       acl-plugin-fa-worker-cleaner-pinterrupt wa               7               0               0          1.39e3            0.00 
       acl-plugin-in-ip4-fa             active              94107        23442944               0          1.75e2          249.11 
       dpdk-input                       polling             47106        23442944               0          4.64e1          497.66 
       ethernet-input                   active              94212        23442944               0          1.55e1          248.83 
       ip4-input-no-checksum            active              94107        23442944               0          3.23e1          249.11 
       ip4-lookup                       active              94107        23442944               0          2.91e1          249.11 
       ip4-rewrite                      active              94107        23442944               0          2.48e1          249.11 
       unix-epoll-input                 polling                46               0               0          1.54e3            0.00

Input/Stateful
~~~~~~~~~~~~~~

Test Case: 64b-1t1c-ethip4udp-ip4base-iacl1sf-10kflows-ndrpdr
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

.. code-block:: console

       DUT1: 
       Thread 0 vpp_main (lcore 1) 
       Time 3.9, average vectors/node 0.00, last 128 main loops 0.00 per node 0.00 
         vector rates in 0.0000e0, out 0.0000e0, drop 0.0000e0, punt 0.0000e0 
                    Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
       acl-plugin-fa-cleaner-process   any wait                 0               0              16          1.40e3            0.00 
       acl-plugin-fa-worker-cleaner-pinterrupt wa               8               0               0          8.97e2            0.00 
       api-rx-from-ring                 active                  0               0              52          7.12e4            0.00 
       dpdk-process                    any wait                 0               0               1          1.69e4            0.00 
       fib-walk                        any wait                 0               0               2          2.55e3            0.00 
       ip4-reassembly-expire-walk      any wait                 0               0               1          1.27e4            0.00 
       ip6-icmp-neighbor-discovery-ev  any wait                 0               0               4          1.09e3            0.00 
       ip6-reassembly-expire-walk      any wait                 0               0               1          2.57e3            0.00 
       lisp-retry-service              any wait                 0               0               2          1.18e4            0.00 
       statseg-collector-process       time wait                0               0               1          6.38e3            0.00 
       unix-epoll-input                 polling              6320               0               0          1.41e6            0.00 
       vpe-oam-process                 any wait                 0               0               2          7.53e3            0.00 

       Thread 1 vpp_wk_0 (lcore 2) 
       Time 3.9, average vectors/node 252.74, last 128 main loops 32.00 per node 273.07 
         vector rates in 7.5833e6, out 7.5833e6, drop 0.0000e0, punt 0.0000e0 
                    Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
       TenGigabitEtherneta/0/0-output   active              58325        14738944               0          9.41e0          252.70 
       TenGigabitEtherneta/0/0-tx       active              58325        14738944               0          4.32e1          252.70 
       TenGigabitEtherneta/0/1-output   active              58323        14738944               0          1.02e1          252.71 
       TenGigabitEtherneta/0/1-tx       active              58323        14738944               0          4.31e1          252.71 
       acl-plugin-fa-worker-cleaner-pinterrupt wa               8               0               0          1.62e3            0.00 
       acl-plugin-in-ip4-fa             active             116628        29477888               0          1.01e2          252.75 
       dpdk-input                       polling             58325        29477888               0          4.63e1          505.41 
       ethernet-input                   active             116648        29477888               0          1.53e1          252.71 
       ip4-input-no-checksum            active             116628        29477888               0          3.21e1          252.75 
       ip4-lookup                       active             116628        29477888               0          2.90e1          252.75 
       ip4-rewrite                      active             116628        29477888               0          2.48e1          252.75 
       unix-epoll-input                 polling                57               0               0          2.39e3            0.00  
                           
Output/Stateless
~~~~~~~~~~~~~~~~

Test Case: 64b-1t1c-ethip4udp-ip4base-oacl10sl-10kflows-ndrpdr
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

   .. code-block:: console

       DUT1: 
        Thread 0 vpp_main (lcore 1) 
        Time 3.8, average vectors/node 0.00, last 128 main loops 0.00 per node 0.00 
          vector rates in 0.0000e0, out 0.0000e0, drop 0.0000e0, punt 0.0000e0 
                     Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
        acl-plugin-fa-cleaner-process   any wait                 0               0              14          1.43e3            0.00 
        acl-plugin-fa-worker-cleaner-pinterrupt wa               7               0               0          9.23e2            0.00 
        api-rx-from-ring                 active                  0               0              52          8.01e4            0.00 
        dpdk-process                    any wait                 0               0               1          1.59e6            0.00 
        fib-walk                        any wait                 0               0               2          6.81e3            0.00 
        ip6-icmp-neighbor-discovery-ev  any wait                 0               0               4          2.81e3            0.00 
        lisp-retry-service              any wait                 0               0               2          3.64e3            0.00 
        unix-epoll-input                 polling              4842               0               0          1.81e6            0.00 
        vpe-oam-process                 any wait                 0               0               1          2.24e4            0.00 
         
        Thread 1 vpp_wk_0 (lcore 2) 
        Time 3.8, average vectors/node 249.29, last 128 main loops 36.00 per node 271.06 
          vector rates in 5.9196e6, out 5.9196e6, drop 0.0000e0, punt 0.0000e0 
                     Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
        TenGigabitEtherneta/0/0-output   active              45595        11363584               0          9.22e0          249.23 
        TenGigabitEtherneta/0/0-tx       active              45595        11363584               0          4.25e1          249.23 
        TenGigabitEtherneta/0/1-output   active              45594        11363584               0          9.75e0          249.23 
        TenGigabitEtherneta/0/1-tx       active              45594        11363584               0          4.21e1          249.23 
        acl-plugin-fa-worker-cleaner-pinterrupt wa               7               0               0          1.28e3            0.00 
        acl-plugin-out-ip4-fa            active              91155        22727168               0          1.78e2          249.32 
        dpdk-input                       polling             45595        22727168               0          4.64e1          498.46 
        ethernet-input                   active              91189        22727168               0          1.56e1          249.23 
        interface-output                 active              91155        22727168               0          1.13e1          249.32 
        ip4-input-no-checksum            active              91155        22727168               0          1.95e1          249.32 
        ip4-lookup                       active              91155        22727168               0          2.88e1          249.32 
        ip4-rewrite                      active              91155        22727168               0          3.53e1          249.32 
        unix-epoll-input                 polling                44               0               0          1.53e3            0.00 
                           
Output/Stateful
~~~~~~~~~~~~~~~

Test Case: 64b-1t1c-ethip4udp-ip4base-oacl10sf-10kflows-ndrpdr
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

.. code-block:: console

       DUT1: 
        Thread 0 vpp_main (lcore 1) 
        Time 3.8, average vectors/node 0.00, last 128 main loops 0.00 per node 0.00 
          vector rates in 0.0000e0, out 0.0000e0, drop 0.0000e0, punt 0.0000e0 
                     Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
        acl-plugin-fa-cleaner-process   any wait                 0               0              16          1.47e3            0.00 
        acl-plugin-fa-worker-cleaner-pinterrupt wa               8               0               0          8.51e2            0.00 
        api-rx-from-ring                 active                  0               0              50          7.24e4            0.00 
        dpdk-process                    any wait                 0               0               2          1.93e4            0.00 
        fib-walk                        any wait                 0               0               2          2.02e3            0.00 
        ip4-reassembly-expire-walk      any wait                 0               0               1          3.96e3            0.00 
        ip6-icmp-neighbor-discovery-ev  any wait                 0               0               4          9.84e2            0.00 
        ip6-reassembly-expire-walk      any wait                 0               0               1          3.76e3            0.00 
        lisp-retry-service              any wait                 0               0               2          1.49e4            0.00 
        statseg-collector-process       time wait                0               0               1          4.98e3            0.00 
        unix-epoll-input                 polling              5653               0               0          1.55e6            0.00 
        vpe-oam-process                 any wait                 0               0               2          1.90e3            0.00 
         
        Thread 1 vpp_wk_0 (lcore 2) 
        Time 3.8, average vectors/node 250.85, last 128 main loops 36.00 per node 271.06 
          vector rates in 7.2686e6, out 7.2686e6, drop 0.0000e0, punt 0.0000e0 
                     Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
        TenGigabitEtherneta/0/0-output   active              55639        13930752               0          9.33e0          250.38 
        TenGigabitEtherneta/0/0-tx       active              55639        13930752               0          4.27e1          250.38 
        TenGigabitEtherneta/0/1-output   active              55636        13930758               0          9.81e0          250.39 
        TenGigabitEtherneta/0/1-tx       active              55636        13930758               0          4.33e1          250.39 
        acl-plugin-fa-worker-cleaner-pinterrupt wa               8               0               0          1.62e3            0.00 
        acl-plugin-out-ip4-fa            active             110988        27861510               0          1.04e2          251.03 
        dpdk-input                       polling             55639        27861510               0          4.62e1          500.76 
        ethernet-input                   active             111275        27861510               0          1.55e1          250.38 
        interface-output                 active             110988        27861510               0          1.21e1          251.03 
        ip4-input-no-checksum            active             110988        27861510               0          1.95e1          251.03 
        ip4-lookup                       active             110988        27861510               0          2.89e1          251.03 
        ip4-rewrite                      active             110988        27861510               0          3.55e1          251.03 
        unix-epoll-input                 polling                54               0               0          2.43e3            0.00  
                           
Performance
-----------

+---------------------------------------+-------+-------------------+
| Test Case                             | MPPS  | Cycles per packet |
+---------------------------------------+-------+-------------------+
| ethip4-ip4base                        | 18.26 | 136               |
+---------------------------------------+-------+-------------------+
| ethip4ip4udp-ip4base-iacl1sl-10kflows | 9.134 | 273               |
+---------------------------------------+-------+-------------------+
| ethip4ip4udp-ip4base-iacl1sf-10kflows | 11.06 | 226               |
+---------------------------------------+-------+-------------------+

Input ACLS (SKX)
~~~~~~~~~~~~~~~~

.. figure:: /_images/ip4-2n-iacl.png

Output ACLs (HSW)
~~~~~~~~~~~~~~~~~

.. figure:: /_images/ip4-3n-oacl.png

Configuration
-------------

Stateful
~~~~~~~~

.. code-block:: console

       $ sudo vppctl ip_add_del_route 20.20.20.0/24 via 1.1.1.2  sw_if_index 1 resolve-attempts 10 count 1     
       $ sudo vppctl acl_add_replace  ipv4 permit src 30.30.30.1/32 dst 40.40.40.1/32 sport 1000 dport 1000, ipv4 permit+reflect src 10.10.10.0/24, ipv4 permit+reflect src 20.20.20.0/24        
       $ sudo vppctl acl_interface_set_acl_list sw_if_index 2 input 0 
       $ sudo vppctl acl_interface_set_acl_list sw_if_index 1 input 0 
                           
Stateless
~~~~~~~~~

.. code-block:: console

       $ sudo vppctl ip_add_del_route 20.20.20.0/24 via 1.1.1.2  sw_if_index 1 resolve-attempts 10 count 1     
       $ sudo vppctl acl_add_replace  ipv4 permit src 30.30.30.1/32 dst 40.40.40.1/32 sport 1000 dport 1000, ipv4 permit src 10.10.10.0/24, ipv4 permit src 20.20.20.0/24        
       $ sudo vppctl acl_interface_set_acl_list sw_if_index 2 input 0 
       $ sudo vppctl acl_interface_set_acl_list sw_if_index 1 input 0
              
Links
~~~~~

-  `FD.io Security Groups overview <https://wiki.fd.io/view/VPP/SecurityGroups>`__
-  `Reflexive Access Control Lists <https://packetlife.net/blog/2008/nov/25/reflexive-access-lists/>`__
-  `Andrew Yuort's Blog on ACLs <http://stdio.be/blog/2017-12-09-Debugging-VPP-MACIP-ACLs/>`__

.. _vppcop:

FD.io VPP COP
-------------

IPv4/IPv6 white-lists using the FD.io VPP FIB, with support for multiple
nested white-lists.

Design notes:
~~~~~~~~~~~~~

- The cop graph nodes (input & white-list) make reuse of the FD.io VPP in FIB 2.0 implementation. Essentially
  a successful lookup in the FIB, indicates that a packet has been white-listed and may be forwarded.

- cop-input: Determines if the frame is IPv4 or IPv6, and forwards to ipN-copwhitelist graph node.

- ipN-copwhitelist: uses the ip4_fib_[mtrie,lookup] functions to confirm the packet's ip matches a route in the white-list fib.

- Match: if it matches, it is then either sent to the next whitelist or to the ip layer.

- No Match: if it there is not match, it is sent to error-drop.

Operational Data
~~~~~~~~~~~~~~~~

Note: the double-pass of the ip4-lookup and ip4-rewrite.

.. code-block:: console

    DUT1: 
     Thread 0 vpp_main (lcore 1) 
     Time 3.9, average vectors/node 0.00, last 128 main loops 0.00 per node 0.00 
       vector rates in 0.0000e0, out 0.0000e0, drop 0.0000e0, punt 0.0000e0 
                  Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
     api-rx-from-ring                 active                  0               0              53          4.20e4            0.00 
     dpdk-process                    any wait                 0               0               1          1.75e4            0.00 
     fib-walk                        any wait                 0               0               2          1.59e3            0.00 
     ip4-reassembly-expire-walk      any wait                 0               0               1          2.20e3            0.00 
     ip6-icmp-neighbor-discovery-ev  any wait                 0               0               4          1.14e3            0.00 
     ip6-reassembly-expire-walk      any wait                 0               0               1          1.50e3            0.00 
     lisp-retry-service              any wait                 0               0               2          2.19e3            0.00 
     statseg-collector-process       time wait                0               0               1          2.48e3            0.00 
     unix-epoll-input                 polling              2800               0               0          3.15e6            0.00 
     vpe-oam-process                 any wait                 0               0               2          7.00e2            0.00 

     Thread 1 vpp_wk_0 (lcore 2) 
     Time 3.9, average vectors/node 220.84, last 128 main loops 20.87 per node 190.86 
       vector rates in 1.0724e7, out 1.0724e7, drop 0.0000e0, punt 0.0000e0 
                  Name                 State         Calls          Vectors        Suspends         Clocks       Vectors/Call   
     TenGigabitEtherneta/0/0-output   active              94960        20698112               0          1.03e1          217.97 
     TenGigabitEtherneta/0/0-tx       active              94960        20698112               0          3.97e1          217.97 
     TenGigabitEtherneta/0/1-output   active              92238        20698112               0          9.92e0          224.39 
     TenGigabitEtherneta/0/1-tx       active              92238        20698112               0          4.26e1          224.39 
     cop-input                        active              94960        20698112               0          1.98e1          217.97 
     dpdk-input                       polling             95154        41396224               0          4.58e1          435.04 
     ethernet-input                   active              92238        20698112               0          1.59e1          224.39 
     ip4-cop-whitelist                active              94960        20698112               0          3.24e1          217.97 
     ip4-input                        active              94960        20698112               0          3.13e1          217.97 
     ip4-input-no-checksum            active              92238        20698112               0          2.23e1          224.39 
     ip4-lookup                       active             187198        41396224               0          3.08e1          221.14 
     ip4-rewrite                      active             187198        41396224               0          2.47e1          221.14 
     unix-epoll-input                 polling                93               0               0          1.35e3            0.00 
                    
Performance
~~~~~~~~~~~

+-------------------------------+-------+-------------------+
| Test Case                     | MPPS  | Cycles per packet |
+-------------------------------+-------+-------------------+
| ethip4-ip4base                | 18.81 | 132               |
+-------------------------------+-------+-------------------+
| ethip4-ip4base-copwhtlistbase | 15.12 | 165               |
+-------------------------------+-------+-------------------+

.. figure:: /_images/ip4-acl-features-ndr.png

Configuration
~~~~~~~~~~~~~

Note: a new VRF 1 is created which holds the whitelist, which then
applied to the interface 1.

.. code-block:: console

    $ sudo vppctl ip_add_del_route 10.10.10.0/24 via 1.1.1.1  sw_if_index 2 resolve-attempts 10 count 1     
    $ sudo vppctl ip_table_add_del table 1  
    $ sudo vppctl ip_add_del_route 20.20.20.0/24  vrf 1  resolve-attempts 10 count 1    local 
    $ sudo vppctl cop_whitelist_enable_disable sw_if_index 1 ip4 fib-id 1 
    $ sudo vppctl cop_interface_enable_disable sw_if_index 1  
                    
Links
~~~~~

-  `FIB 2.0: Hierarchical, Protocol Independent. <https://wiki.fd.io/images/7/71/FIB_2.0_-_Hierarchical,_Protocol_Independent..pdf>`__

.. _vppflow:

FD.io VPP Flow
--------------

FD.io VPP Flow adds the ability for FD.io VPP to support matching of
flows and taking an associated action. This information is then used to
program hardware accelerations such as those available on network cards,
e.g. Intel® Ethernet Flow Director technology on the Intel® Ethernet
Controller X710/XXV710/XL710.

Supports
~~~~~~~~

Actions
"""""""

-  Count: don't now what this does, presume it count's matches.
-  Mark: Associate a matched flow with arbitrary data such as vxlan tunnel, for a lookup in the redirect graph node.
-  Buffer Advance: Can be used advance to an encapsulated ethernet or ip header.
-  Redirect to node: When you see a packet from flow xyz, the next node in FD.io VPP is the indicated graph node.
-  Redirect to queue: When you see a packet from flow xyz, is to redirect to rx queue n.
-  Drop: When you see a packet from flow xyz, drop the packet (next node is error drop).

Design Notes
~~~~~~~~~~~~

-  Currently the only place in FD.io VPP that this is used, is to accelerate VXLAN bypassing the Ethernet and IP Layers.
-  Flow uses DPDK rte_flow API under the hood for those network interfaces programmed through DPDK.
-  Redirect to node: worth remember that if you are bypassing a graph, you are bypassing all the checks in the graph node, e.e time-to-live, crcs and the like.

Operational Data
~~~~~~~~~~~~~~~~

FD.io CSIT numbers for VXLan do not use FD.io Flow support.

Performance
~~~~~~~~~~~

FD.io CSIT numbers for VXLan do not use FD.io Flow support.

Configuration
~~~~~~~~~~~~~

-  `Flow API <https://git.fd.io/vpp/tree/src/vnet/flow/flow.h>`__

.. _classifiers:

FD.io VPP Classifiers
---------------------

The most flexible form of ACLs in FD.io VPP enable the user to match anywhere in the first
80 bytes of the packet header.

Configuration
~~~~~~~~~~~~~

Match an IPv6….

.. code-block:: console

    $ sudo vppctl classify table mask l3 ip6 dst buckets 64
    $ sudo vppctl classify session hit-next 0 table-index 0 match l3 ip6 dst 2001:db8:1::2 opaque-index 42
    $ sudo vppctl set interface l2 input classify intfc host-s0_s1 ip6-table 0
                           
Links
~~~~~

-  `Overview of classifiers <https://wiki.fd.io/view/VPP/SecurityGroups#Existing_functionality>`__
-  `FD.io VPP Classifiers Overview <https://wiki.fd.io/view/VPP/Introduction_To_N-tuple_Classifiers>`__
-  `FD.io VPP Classifiers CLI <https://docs.fd.io/vpp/19.04/clicmd_src_vnet_classify.html>`__
-  `Sample Code from Andrew Yourt <http://stdio.be/vpp/t/aytest-bridge-tap-py.txt>`__

context:
space:
mode: