acl-plugin: use the L2 feature arc infrastructure instead of L2 classifier for plumbing

This makes ACL plugin use the new feature arcs, which slightly increases performance.

Since for ethertype whitelisting we were using the L2 classifier, to retain
the functionality, make a simple node doing that, and plug it into non-ip
L2 feature arc whenever needed.

Change-Id: I3add377a6c790117dd3fd056e5615cb4c4438cf4
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

1 files changed, 38 insertions, 661 deletions

diff --git a/src/plugins/acl/acl.c b/src/plugins/acl/acl.c
index 866c6ffc5f0..2af2d7a8b70 100644
--- a/src/plugins/acl/acl.c
+++ b/src/plugins/acl/acl.c
@@ -20,6 +20,7 @@
 #include <acl/acl.h>
 
 #include <vnet/l2/l2_classify.h>
+#include <vnet/l2/l2_in_out_feat_arc.h>
 #include <vnet/classify/in_out_acl.h>
 #include <vpp/app/version.h>
 
@@ -489,86 +490,6 @@ acl_del_list (u32 acl_list_index)
   return 0;
 }
 
-/* Some aids in ASCII graphing the content */
-#define XX "\377"
-#define __ "\000"
-#define _(x)
-#define v
-/* *INDENT-OFF* */
-
-u8 ip4_5tuple_mask[] =
-  _("             dmac               smac            etype ")
-  _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v
-  _("        v ihl totlen   ")
-  _(0x0000)
-  __ __ __ __
-  _("        ident fl+fo    ")
-  _(0x0004)
-  __ __ __ __
-  _("       ttl pr checksum ")
-  _(0x0008)
-  __ XX __ __
-  _("        src address    ")
-  _(0x000C)
-  XX XX XX XX
-  _("        dst address    ")
-  _(0x0010)
-  XX XX XX XX
-  _("L4 T/U  sport dport    ")
-  _(tcpudp)
-  XX XX XX XX
-  _(padpad)
-  __ __ __ __
-  _(padpad)
-  __ __ __ __
-  _(padeth)
-  __ __;
-
- u8 ip6_5tuple_mask[] =
-  _("             dmac               smac            etype ")
-  _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v
-  _("        v  tc + flow ")
-  _(0x0000) __ __ __ __
-  _("        plen  nh hl  ")
-  _(0x0004) __ __ XX __
-  _("        src address  ")
-  _(0x0008) XX XX XX XX
-  _(0x000C) XX XX XX XX
-  _(0x0010) XX XX XX XX
-  _(0x0014) XX XX XX XX
-  _("        dst address  ")
-  _(0x0018) XX XX XX XX
-  _(0x001C) XX XX XX XX
-  _(0x0020) XX XX XX XX
-  _(0x0024) XX XX XX XX
-  _("L4T/U  sport dport   ")
-  _(tcpudp) XX XX XX XX _(padpad) __ __ __ __ _(padeth) __ __;
-
- u8 dot1q_5tuple_mask[] =
-   _("             dmac               smac          dot1q         etype ")
-   _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v XX XX __ __ v XX XX v
-   _(padpad) __ __ __ __
-   _(padpad) __ __ __ __
-   _(padpad) __ __ __ __
-   _(padeth) __ __;
-
- u8 dot1ad_5tuple_mask[] =
-   _("             dmac               smac          dot1ad      dot1q         etype ")
-   _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v XX XX __ __ XX XX __ __ v XX XX v
-   _(padpad) __ __ __ __
-   _(padpad) __ __ __ __
-   _(padeth) __ __;
-
- u8 ethertype_mask[] =
-   _("             dmac               smac          etype ")
-   _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v XX XX __ __;
-
-/* *INDENT-ON* */
-#undef XX
-#undef __
-#undef _
-#undef v
-
 static int
 count_skip (u8 * p, u32 size)
 {
@@ -585,33 +506,6 @@ count_skip (u8 * p, u32 size)
 }
 
 static int
-acl_classify_add_del_table_tiny (vnet_classify_main_t * cm, u8 * mask,
-				 u32 mask_len, u32 next_table_index,
-				 u32 miss_next_index, u32 * table_index,
-				 int is_add)
-{
-  u32 nbuckets = 1;
-  u32 memory_size = 2 << 13;
-  u32 skip = count_skip (mask, mask_len);
-  u32 match = (mask_len / 16) - skip;
-  u8 *skip_mask_ptr = mask + 16 * skip;
-  u32 current_data_flag = 0;
-  int current_data_offset = 0;
-
-  if (0 == match)
-    match = 1;
-  void *oldheap = clib_mem_set_heap (cm->vlib_main->heap_base);
-  int ret = vnet_classify_add_del_table (cm, skip_mask_ptr, nbuckets,
-					 memory_size, skip, match,
-					 next_table_index, miss_next_index,
-					 table_index, current_data_flag,
-					 current_data_offset, is_add,
-					 1 /* delete_chain */ );
-  clib_mem_set_heap (oldheap);
-  return ret;
-}
-
-static int
 acl_classify_add_del_table_small (vnet_classify_main_t * cm, u8 * mask,
 				  u32 mask_len, u32 next_table_index,
 				  u32 miss_next_index, u32 * table_index,
@@ -640,502 +534,13 @@ acl_classify_add_del_table_small (vnet_classify_main_t * cm, u8 * mask,
 }
 
 static int
-acl_unhook_l2_input_classify (acl_main_t * am, u32 sw_if_index)
-{
-  vnet_classify_main_t *cm = &vnet_classify_main;
-  u32 ip4_table_index = ~0;
-  u32 ip6_table_index = ~0;
-  u32 dot1q_table_index = ~0;
-  u32 dot1ad_table_index = ~0;
-  u32 etype_table_index = ~0;
-  void *oldheap = acl_set_heap (am);
-
-  vec_validate_init_empty (am->acl_ip4_input_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-  vec_validate_init_empty (am->acl_ip6_input_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-  vec_validate_init_empty (am->acl_dot1q_input_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-  vec_validate_init_empty (am->acl_dot1ad_input_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-  vec_validate_init_empty (am->acl_etype_input_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-
-  /* switch to global heap while calling vnet_* functions */
-  clib_mem_set_heap (cm->vlib_main->heap_base);
-  vnet_l2_input_classify_enable_disable (sw_if_index, 0);
-
-  if (am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      ip4_table_index =
-	am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				       sizeof (ip4_5tuple_mask) - 1, ~0,
-				       am->l2_input_classify_next_acl_ip4,
-				       &ip4_table_index, 0);
-    }
-  if (am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      ip6_table_index =
-	am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				       sizeof (ip6_5tuple_mask) - 1, ~0,
-				       am->l2_input_classify_next_acl_ip6,
-				       &ip6_table_index, 0);
-    }
-  if (am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      dot1q_table_index =
-	am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				       sizeof (ip6_5tuple_mask) - 1, ~0,
-				       ~0, &dot1q_table_index, 0);
-    }
-  if (am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      dot1ad_table_index =
-	am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
-				       sizeof (dot1ad_5tuple_mask) - 1, ~0,
-				       ~0, &dot1ad_table_index, 0);
-    }
-  if (am->acl_etype_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      etype_table_index =
-	am->acl_etype_input_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_etype_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, ethertype_mask,
-				       sizeof (ethertype_mask) - 1, ~0,
-				       ~0, &etype_table_index, 0);
-    }
-  clib_mem_set_heap (oldheap);
-  return 0;
-}
-
-static int
-acl_unhook_l2_output_classify (acl_main_t * am, u32 sw_if_index)
-{
-  vnet_classify_main_t *cm = &vnet_classify_main;
-  u32 ip4_table_index = ~0;
-  u32 ip6_table_index = ~0;
-  u32 dot1q_table_index = ~0;
-  u32 dot1ad_table_index = ~0;
-  u32 etype_table_index = ~0;
-  void *oldheap = acl_set_heap (am);
-
-  vec_validate_init_empty (am->acl_ip4_output_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-  vec_validate_init_empty (am->acl_ip6_output_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-  vec_validate_init_empty (am->acl_dot1q_output_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-  vec_validate_init_empty
-    (am->acl_dot1ad_output_classify_table_by_sw_if_index, sw_if_index, ~0);
-  vec_validate_init_empty (am->acl_etype_output_classify_table_by_sw_if_index,
-			   sw_if_index, ~0);
-
-  /* switch to global heap while calling vnet_* functions */
-  clib_mem_set_heap (cm->vlib_main->heap_base);
-
-  vnet_l2_output_classify_enable_disable (sw_if_index, 0);
-
-  if (am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      ip4_table_index =
-	am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				       sizeof (ip4_5tuple_mask) - 1, ~0,
-				       am->l2_output_classify_next_acl_ip4,
-				       &ip4_table_index, 0);
-    }
-  if (am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      ip6_table_index =
-	am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				       sizeof (ip6_5tuple_mask) - 1, ~0,
-				       am->l2_output_classify_next_acl_ip6,
-				       &ip6_table_index, 0);
-    }
-  if (am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      dot1q_table_index =
-	am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				       sizeof (ip6_5tuple_mask) - 1, ~0,
-				       ~0, &dot1q_table_index, 0);
-    }
-  if (am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      dot1ad_table_index =
-	am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
-				       sizeof (dot1ad_5tuple_mask) - 1, ~0,
-				       ~0, &dot1ad_table_index, 0);
-    }
-  if (am->acl_etype_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
-    {
-      etype_table_index =
-	am->acl_etype_output_classify_table_by_sw_if_index[sw_if_index];
-      am->acl_etype_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
-      acl_classify_add_del_table_tiny (cm, ethertype_mask,
-				       sizeof (ethertype_mask) - 1, ~0,
-				       ~0, &etype_table_index, 0);
-    }
-  clib_mem_set_heap (oldheap);
-  return 0;
-}
-
-static void
-acl_add_vlan_session (acl_main_t * am, u32 table_index, u8 is_output,
-		      u8 is_dot1ad, u8 is_ip6)
-{
-  vnet_classify_main_t *cm = &vnet_classify_main;
-  u8 *match;
-  u32 next_acl;
-  u8 idx;
-  u8 session_idx;
-
-  if (is_ip6)
-    {
-      next_acl =
-	(is_output) ? am->
-	l2_output_classify_next_acl_ip6 : am->l2_input_classify_next_acl_ip6;
-    }
-  else
-    {
-      next_acl =
-	(is_output) ? am->
-	l2_output_classify_next_acl_ip4 : am->l2_input_classify_next_acl_ip4;
-    }
-  match = (is_dot1ad) ? dot1ad_5tuple_mask : dot1q_5tuple_mask;
-  idx = (is_dot1ad) ? 20 : 16;
-  if (is_dot1ad)
-    {
-      /* 802.1ad ethertype */
-      match[12] = 0x88;
-      match[13] = 0xa8;
-      /* 802.1q ethertype */
-      match[16] = 0x81;
-      match[17] = 0x00;
-    }
-  else
-    {
-      /* 802.1q ethertype */
-      match[12] = 0x81;
-      match[13] = 0x00;
-    }
-
-  /* add sessions to vlan tables per ethernet_type */
-  if (is_ip6)
-    {
-      match[idx] = 0x86;
-      match[idx + 1] = 0xdd;
-      session_idx = 1;
-    }
-  else
-    {
-      match[idx] = 0x08;
-      match[idx + 1] = 0x00;
-      session_idx = 0;
-    }
-  vnet_classify_add_del_session (cm, table_index, match, next_acl,
-				 session_idx, 0, 0, 0, 1);
-  /* reset the mask back to being a mask */
-  match[idx] = 0xff;
-  match[idx + 1] = 0xff;
-  match[12] = 0xff;
-  match[13] = 0xff;
-  if (is_dot1ad)
-    {
-      match[16] = 0xff;
-      match[17] = 0xff;
-    }
-}
-
-static int
 intf_has_etype_whitelist (acl_main_t * am, u32 sw_if_index, int is_input)
 {
   u16 **v = is_input
     ? am->input_etype_whitelist_by_sw_if_index
     : am->output_etype_whitelist_by_sw_if_index;
-  return ((vec_len (v) > sw_if_index) && vec_elt (v, sw_if_index));
-}
-
-static int
-etype_whitelist_add_sessions (acl_main_t * am, u32 sw_if_index, int is_input,
-			      u32 etype_table_index)
-{
-  vnet_classify_main_t *cm = &vnet_classify_main;
-  u16 **v = is_input
-    ? am->input_etype_whitelist_by_sw_if_index
-    : am->output_etype_whitelist_by_sw_if_index;
-  u8 *match = ethertype_mask;
-
-  int i;
-  int rv = 0;
-  u16 *whitelist = vec_elt (v, sw_if_index);
-  u32 next = ~0;		/* permit */
-  for (i = 0; i < vec_len (whitelist); i++)
-    {
-      /* big-endian */
-      match[12] = (whitelist[i] >> 8) & 0xff;
-      match[13] = whitelist[i] & 0xff;
-      rv = rv
-	|| vnet_classify_add_del_session (cm, etype_table_index, match, next,
-					  whitelist[i], 0, 0, 0, 1);
-    }
-
-  /* restore the mask */
-  match[12] = 0xff;
-  match[13] = 0xff;
-  return rv;
-}
-
-static int
-acl_hook_l2_input_classify (acl_main_t * am, u32 sw_if_index)
-{
-  vnet_classify_main_t *cm = &vnet_classify_main;
-  u32 ip4_table_index = ~0;
-  u32 ip6_table_index = ~0;
-  u32 dot1q_table_index = ~0;
-  u32 dot1ad_table_index = ~0;
-  u32 etype_table_index = ~0;
-  int rv;
-
-  void *prevheap = clib_mem_set_heap (cm->vlib_main->heap_base);
-
-  /* in case there were previous tables attached */
-  acl_unhook_l2_input_classify (am, sw_if_index);
-  rv =
-    acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				     sizeof (ip4_5tuple_mask) - 1, ~0,
-				     am->l2_input_classify_next_acl_ip4,
-				     &ip4_table_index, 1);
-  if (rv)
-    goto done;
-
-  rv =
-    acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				     sizeof (ip6_5tuple_mask) - 1, ~0,
-				     am->l2_input_classify_next_acl_ip6,
-				     &ip6_table_index, 1);
-  if (rv)
-    {
-      acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				       sizeof (ip4_5tuple_mask) - 1, ~0,
-				       am->l2_input_classify_next_acl_ip4,
-				       &ip4_table_index, 0);
-      goto done;
-    }
-
-  if (intf_has_etype_whitelist (am, sw_if_index, 1))
-    {
-      acl_classify_add_del_table_tiny (cm, ethertype_mask, sizeof (ethertype_mask) - 1, ~0, 0,	/* drop if no match */
-				       &etype_table_index, 1);
-      etype_whitelist_add_sessions (am, sw_if_index, 1, etype_table_index);
-    }
-
-  rv =
-    acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
-				     sizeof (dot1ad_5tuple_mask) - 1,
-				     etype_table_index, ~0,
-				     &dot1ad_table_index, 1);
-  rv =
-    acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask,
-				     sizeof (dot1q_5tuple_mask) - 1,
-				     dot1ad_table_index, ~0,
-				     &dot1q_table_index, 1);
-  if (rv)
-    {
-      acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
-				       sizeof (dot1ad_5tuple_mask) - 1, ~0,
-				       ~0, &dot1ad_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				       sizeof (ip6_5tuple_mask) - 1, ~0,
-				       am->l2_input_classify_next_acl_ip6,
-				       &ip6_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				       sizeof (ip4_5tuple_mask) - 1, ~0,
-				       am->l2_input_classify_next_acl_ip4,
-				       &ip4_table_index, 0);
-      goto done;
-    }
-
-  rv =
-    vnet_l2_input_classify_set_tables (sw_if_index, ip4_table_index,
-				       ip6_table_index, dot1q_table_index);
-
-  if (rv)
-    {
-      acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				       sizeof (ip4_5tuple_mask) - 1, ~0,
-				       am->l2_input_classify_next_acl_ip4,
-				       &ip4_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				       sizeof (ip6_5tuple_mask) - 1, ~0,
-				       am->l2_input_classify_next_acl_ip6,
-				       &ip6_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask,
-				       sizeof (dot1q_5tuple_mask) - 1, ~0,
-				       ~0, &dot1q_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
-				       sizeof (dot1ad_5tuple_mask) - 1, ~0,
-				       ~0, &dot1ad_table_index, 0);
-      goto done;
-    }
-
-  /* add sessions to vlan tables per ethernet_type */
-  acl_add_vlan_session (am, dot1q_table_index, 0, 0, 0);
-  acl_add_vlan_session (am, dot1q_table_index, 0, 0, 1);
-  acl_add_vlan_session (am, dot1ad_table_index, 0, 1, 0);
-  acl_add_vlan_session (am, dot1ad_table_index, 0, 1, 1);
-
-  am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] =
-    ip4_table_index;
-  am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] =
-    ip6_table_index;
-  am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] =
-    dot1q_table_index;
-  am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] =
-    dot1ad_table_index;
-  am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] =
-    dot1ad_table_index;
-  am->acl_etype_input_classify_table_by_sw_if_index[sw_if_index] =
-    etype_table_index;
-
-  vnet_l2_input_classify_enable_disable (sw_if_index, 1);
-done:
-  clib_mem_set_heap (prevheap);
-  return rv;
-}
-
-static int
-acl_hook_l2_output_classify (acl_main_t * am, u32 sw_if_index)
-{
-  vnet_classify_main_t *cm = &vnet_classify_main;
-  u32 ip4_table_index = ~0;
-  u32 ip6_table_index = ~0;
-  u32 dot1q_table_index = ~0;
-  u32 dot1ad_table_index = ~0;
-  u32 etype_table_index = ~0;
-  int rv;
-
-  void *prevheap = clib_mem_set_heap (cm->vlib_main->heap_base);
-
-  /* in case there were previous tables attached */
-  acl_unhook_l2_output_classify (am, sw_if_index);
-  rv =
-    acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				     sizeof (ip4_5tuple_mask) - 1, ~0,
-				     am->l2_output_classify_next_acl_ip4,
-				     &ip4_table_index, 1);
-  if (rv)
-    goto done;
-  rv =
-    acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				     sizeof (ip6_5tuple_mask) - 1, ~0,
-				     am->l2_output_classify_next_acl_ip6,
-				     &ip6_table_index, 1);
-  if (rv)
-    {
-      acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				       sizeof (ip4_5tuple_mask) - 1, ~0,
-				       am->l2_output_classify_next_acl_ip4,
-				       &ip4_table_index, 0);
-      goto done;
-    }
-
-  if (intf_has_etype_whitelist (am, sw_if_index, 0))
-    {
-      acl_classify_add_del_table_tiny (cm, ethertype_mask, sizeof (ethertype_mask) - 1, ~0, 0,	/* drop if no match */
-				       &etype_table_index, 1);
-      etype_whitelist_add_sessions (am, sw_if_index, 0, etype_table_index);
-    }
-
-
-  rv =
-    acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
-				     sizeof (dot1ad_5tuple_mask) - 1,
-				     etype_table_index, ~0,
-				     &dot1ad_table_index, 1);
-  rv =
-    acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask,
-				     sizeof (dot1q_5tuple_mask) - 1,
-				     dot1ad_table_index, ~0,
-				     &dot1q_table_index, 1);
-  if (rv)
-    {
-      acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
-				       sizeof (dot1ad_5tuple_mask) - 1, ~0,
-				       ~0, &dot1ad_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				       sizeof (ip6_5tuple_mask) - 1, ~0,
-				       am->l2_output_classify_next_acl_ip6,
-				       &ip6_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				       sizeof (ip4_5tuple_mask) - 1, ~0,
-				       am->l2_output_classify_next_acl_ip4,
-				       &ip4_table_index, 0);
-      goto done;
-    }
-
-  rv =
-    vnet_l2_output_classify_set_tables (sw_if_index, ip4_table_index,
-					ip6_table_index, dot1q_table_index);
-/*
-  clib_warning
-    ("ACL enabling on interface sw_if_index %d, setting tables to the following: ip4: %d ip6: %d\n",
-     sw_if_index, ip4_table_index, ip6_table_index);
-*/
-  if (rv)
-    {
-      acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
-				       sizeof (ip6_5tuple_mask) - 1, ~0,
-				       am->l2_output_classify_next_acl_ip6,
-				       &ip6_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
-				       sizeof (ip4_5tuple_mask) - 1, ~0,
-				       am->l2_output_classify_next_acl_ip4,
-				       &ip4_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask,
-				       sizeof (dot1q_5tuple_mask) - 1, ~0,
-				       ~0, &dot1q_table_index, 0);
-      acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
-				       sizeof (dot1ad_5tuple_mask) - 1, ~0,
-				       ~0, &dot1ad_table_index, 0);
-      goto done;
-    }
-
-  /* add sessions to vlan tables per ethernet_type */
-  acl_add_vlan_session (am, dot1q_table_index, 1, 0, 0);
-  acl_add_vlan_session (am, dot1q_table_index, 1, 0, 1);
-  acl_add_vlan_session (am, dot1ad_table_index, 1, 1, 0);
-  acl_add_vlan_session (am, dot1ad_table_index, 1, 1, 1);
-
-  am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] =
-    ip4_table_index;
-  am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] =
-    ip6_table_index;
-  am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] =
-    dot1q_table_index;
-  am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] =
-    dot1ad_table_index;
-  am->acl_etype_output_classify_table_by_sw_if_index[sw_if_index] =
-    etype_table_index;
-
-  vnet_l2_output_classify_enable_disable (sw_if_index, 1);
-done:
-  clib_mem_set_heap (prevheap);
-  return rv;
+  u16 *whitelist = (vec_len (v) > sw_if_index) ? vec_elt (v, sw_if_index) : 0;
+  return vec_len (whitelist) > 0;
 }
 
 static void
@@ -1166,14 +571,22 @@ acl_interface_in_enable_disable (acl_main_t * am, u32 sw_if_index,
 
   acl_fa_enable_disable (sw_if_index, 1, enable_disable);
 
-  if (enable_disable)
-    {
-      rv = acl_hook_l2_input_classify (am, sw_if_index);
-    }
-  else
-    {
-      rv = acl_unhook_l2_input_classify (am, sw_if_index);
-    }
+  void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
+  rv = vnet_l2_feature_enable_disable ("l2-input-ip4", "acl-plugin-in-ip4-l2",
+				       sw_if_index, enable_disable, 0, 0);
+  if (rv)
+    clib_error ("Could not enable on input");
+  rv = vnet_l2_feature_enable_disable ("l2-input-ip6", "acl-plugin-in-ip6-l2",
+				       sw_if_index, enable_disable, 0, 0);
+  if (rv)
+    clib_error ("Could not enable on input");
+
+  if (intf_has_etype_whitelist (am, sw_if_index, 1))
+    vnet_l2_feature_enable_disable ("l2-input-nonip",
+				    "acl-plugin-in-nonip-l2", sw_if_index,
+				    enable_disable, 0, 0);
+
+  clib_mem_set_heap (oldheap);
 
   am->in_acl_on_sw_if_index =
     clib_bitmap_set (am->in_acl_on_sw_if_index, sw_if_index, enable_disable);
@@ -1185,7 +598,7 @@ static int
 acl_interface_out_enable_disable (acl_main_t * am, u32 sw_if_index,
 				  int enable_disable)
 {
-  int rv;
+  int rv = 0;
 
   /* Utterly wrong? */
   if (pool_is_free_index (am->vnet_main->interface_main.sw_interfaces,
@@ -1198,14 +611,24 @@ acl_interface_out_enable_disable (acl_main_t * am, u32 sw_if_index,
 
   acl_fa_enable_disable (sw_if_index, 0, enable_disable);
 
-  if (enable_disable)
-    {
-      rv = acl_hook_l2_output_classify (am, sw_if_index);
-    }
-  else
-    {
-      rv = acl_unhook_l2_output_classify (am, sw_if_index);
-    }
+  void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
+  rv =
+    vnet_l2_feature_enable_disable ("l2-output-ip4", "acl-plugin-out-ip4-l2",
+				    sw_if_index, enable_disable, 0, 0);
+  if (rv)
+    clib_error ("Could not enable on output");
+  rv =
+    vnet_l2_feature_enable_disable ("l2-output-ip6", "acl-plugin-out-ip6-l2",
+				    sw_if_index, enable_disable, 0, 0);
+  if (rv)
+    clib_error ("Could not enable on output");
+  if (intf_has_etype_whitelist (am, sw_if_index, 0))
+    vnet_l2_feature_enable_disable ("l2-output-nonip",
+				    "acl-plugin-out-nonip-l2", sw_if_index,
+				    enable_disable, 0, 0);
+
+
+  clib_mem_set_heap (oldheap);
 
   am->out_acl_on_sw_if_index =
     clib_bitmap_set (am->out_acl_on_sw_if_index, sw_if_index, enable_disable);
@@ -3115,50 +2538,6 @@ setup_message_id_table (acl_main_t * am, api_main_t * apim)
 }
 
 static void
-acl_setup_fa_nodes (void)
-{
-  vlib_main_t *vm = vlib_get_main ();
-  acl_main_t *am = &acl_main;
-  vlib_node_t *n, *n4, *n6;
-
-  n = vlib_get_node_by_name (vm, (u8 *) "l2-input-classify");
-  n4 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-in-ip4-l2");
-  n6 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-in-ip6-l2");
-
-
-  am->l2_input_classify_next_acl_ip4 =
-    vlib_node_add_next_with_slot (vm, n->index, n4->index, ~0);
-  am->l2_input_classify_next_acl_ip6 =
-    vlib_node_add_next_with_slot (vm, n->index, n6->index, ~0);
-
-  feat_bitmap_init_next_nodes (vm, n4->index, L2INPUT_N_FEAT,
-			       l2input_get_feat_names (),
-			       am->fa_acl_in_ip4_l2_node_feat_next_node_index);
-
-  feat_bitmap_init_next_nodes (vm, n6->index, L2INPUT_N_FEAT,
-			       l2input_get_feat_names (),
-			       am->fa_acl_in_ip6_l2_node_feat_next_node_index);
-
-
-  n = vlib_get_node_by_name (vm, (u8 *) "l2-output-classify");
-  n4 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-out-ip4-l2");
-  n6 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-out-ip6-l2");
-
-  am->l2_output_classify_next_acl_ip4 =
-    vlib_node_add_next_with_slot (vm, n->index, n4->index, ~0);
-  am->l2_output_classify_next_acl_ip6 =
-    vlib_node_add_next_with_slot (vm, n->index, n6->index, ~0);
-
-  feat_bitmap_init_next_nodes (vm, n4->index, L2OUTPUT_N_FEAT,
-			       l2output_get_feat_names (),
-			       am->fa_acl_out_ip4_l2_node_feat_next_node_index);
-
-  feat_bitmap_init_next_nodes (vm, n6->index, L2OUTPUT_N_FEAT,
-			       l2output_get_feat_names (),
-			       am->fa_acl_out_ip6_l2_node_feat_next_node_index);
-}
-
-static void
 acl_set_timeout_sec (int timeout_type, u32 value)
 {
   acl_main_t *am = &acl_main;
@@ -4180,8 +3559,6 @@ acl_init (vlib_main_t * vm)
   if (error)
     return error;
 
-  acl_setup_fa_nodes ();
-
   am->acl_mheap_size = 0;	/* auto size when initializing */
   am->hash_lookup_mheap_size = ACL_PLUGIN_HASH_LOOKUP_HEAP_SIZE;