summaryrefslogtreecommitdiffstats
path: root/src/plugins/acl/acl.c
diff options
context:
space:
mode:
authorAndrew Yourtchenko <ayourtch@gmail.com>2018-10-06 09:26:02 +0200
committerJohn Lo <loj@cisco.com>2018-10-20 15:15:45 +0000
commitc1f87942da3f6daeb4c30002929828e86035cee2 (patch)
tree677181dba699066b3c1f1d6e827ad9e43005fbbe /src/plugins/acl/acl.c
parent270055a41accbb421d9016eb972fcd4ea0343671 (diff)
acl-plugin: use the L2 feature arc infrastructure instead of L2 classifier for plumbing
This makes ACL plugin use the new feature arcs, which slightly increases performance. Since for ethertype whitelisting we were using the L2 classifier, to retain the functionality, make a simple node doing that, and plug it into non-ip L2 feature arc whenever needed. Change-Id: I3add377a6c790117dd3fd056e5615cb4c4438cf4 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Diffstat (limited to 'src/plugins/acl/acl.c')
-rw-r--r--src/plugins/acl/acl.c699
1 files changed, 38 insertions, 661 deletions
diff --git a/src/plugins/acl/acl.c b/src/plugins/acl/acl.c
index 866c6ffc5f0..2af2d7a8b70 100644
--- a/src/plugins/acl/acl.c
+++ b/src/plugins/acl/acl.c
@@ -20,6 +20,7 @@
#include <acl/acl.h>
#include <vnet/l2/l2_classify.h>
+#include <vnet/l2/l2_in_out_feat_arc.h>
#include <vnet/classify/in_out_acl.h>
#include <vpp/app/version.h>
@@ -489,86 +490,6 @@ acl_del_list (u32 acl_list_index)
return 0;
}
-/* Some aids in ASCII graphing the content */
-#define XX "\377"
-#define __ "\000"
-#define _(x)
-#define v
-/* *INDENT-OFF* */
-
-u8 ip4_5tuple_mask[] =
- _(" dmac smac etype ")
- _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v
- _(" v ihl totlen ")
- _(0x0000)
- __ __ __ __
- _(" ident fl+fo ")
- _(0x0004)
- __ __ __ __
- _(" ttl pr checksum ")
- _(0x0008)
- __ XX __ __
- _(" src address ")
- _(0x000C)
- XX XX XX XX
- _(" dst address ")
- _(0x0010)
- XX XX XX XX
- _("L4 T/U sport dport ")
- _(tcpudp)
- XX XX XX XX
- _(padpad)
- __ __ __ __
- _(padpad)
- __ __ __ __
- _(padeth)
- __ __;
-
- u8 ip6_5tuple_mask[] =
- _(" dmac smac etype ")
- _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v __ __ v
- _(" v tc + flow ")
- _(0x0000) __ __ __ __
- _(" plen nh hl ")
- _(0x0004) __ __ XX __
- _(" src address ")
- _(0x0008) XX XX XX XX
- _(0x000C) XX XX XX XX
- _(0x0010) XX XX XX XX
- _(0x0014) XX XX XX XX
- _(" dst address ")
- _(0x0018) XX XX XX XX
- _(0x001C) XX XX XX XX
- _(0x0020) XX XX XX XX
- _(0x0024) XX XX XX XX
- _("L4T/U sport dport ")
- _(tcpudp) XX XX XX XX _(padpad) __ __ __ __ _(padeth) __ __;
-
- u8 dot1q_5tuple_mask[] =
- _(" dmac smac dot1q etype ")
- _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v XX XX __ __ v XX XX v
- _(padpad) __ __ __ __
- _(padpad) __ __ __ __
- _(padpad) __ __ __ __
- _(padeth) __ __;
-
- u8 dot1ad_5tuple_mask[] =
- _(" dmac smac dot1ad dot1q etype ")
- _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v XX XX __ __ XX XX __ __ v XX XX v
- _(padpad) __ __ __ __
- _(padpad) __ __ __ __
- _(padeth) __ __;
-
- u8 ethertype_mask[] =
- _(" dmac smac etype ")
- _(ether) __ __ __ __ __ __ v __ __ __ __ __ __ v XX XX __ __;
-
-/* *INDENT-ON* */
-#undef XX
-#undef __
-#undef _
-#undef v
-
static int
count_skip (u8 * p, u32 size)
{
@@ -585,33 +506,6 @@ count_skip (u8 * p, u32 size)
}
static int
-acl_classify_add_del_table_tiny (vnet_classify_main_t * cm, u8 * mask,
- u32 mask_len, u32 next_table_index,
- u32 miss_next_index, u32 * table_index,
- int is_add)
-{
- u32 nbuckets = 1;
- u32 memory_size = 2 << 13;
- u32 skip = count_skip (mask, mask_len);
- u32 match = (mask_len / 16) - skip;
- u8 *skip_mask_ptr = mask + 16 * skip;
- u32 current_data_flag = 0;
- int current_data_offset = 0;
-
- if (0 == match)
- match = 1;
- void *oldheap = clib_mem_set_heap (cm->vlib_main->heap_base);
- int ret = vnet_classify_add_del_table (cm, skip_mask_ptr, nbuckets,
- memory_size, skip, match,
- next_table_index, miss_next_index,
- table_index, current_data_flag,
- current_data_offset, is_add,
- 1 /* delete_chain */ );
- clib_mem_set_heap (oldheap);
- return ret;
-}
-
-static int
acl_classify_add_del_table_small (vnet_classify_main_t * cm, u8 * mask,
u32 mask_len, u32 next_table_index,
u32 miss_next_index, u32 * table_index,
@@ -640,502 +534,13 @@ acl_classify_add_del_table_small (vnet_classify_main_t * cm, u8 * mask,
}
static int
-acl_unhook_l2_input_classify (acl_main_t * am, u32 sw_if_index)
-{
- vnet_classify_main_t *cm = &vnet_classify_main;
- u32 ip4_table_index = ~0;
- u32 ip6_table_index = ~0;
- u32 dot1q_table_index = ~0;
- u32 dot1ad_table_index = ~0;
- u32 etype_table_index = ~0;
- void *oldheap = acl_set_heap (am);
-
- vec_validate_init_empty (am->acl_ip4_input_classify_table_by_sw_if_index,
- sw_if_index, ~0);
- vec_validate_init_empty (am->acl_ip6_input_classify_table_by_sw_if_index,
- sw_if_index, ~0);
- vec_validate_init_empty (am->acl_dot1q_input_classify_table_by_sw_if_index,
- sw_if_index, ~0);
- vec_validate_init_empty (am->acl_dot1ad_input_classify_table_by_sw_if_index,
- sw_if_index, ~0);
- vec_validate_init_empty (am->acl_etype_input_classify_table_by_sw_if_index,
- sw_if_index, ~0);
-
- /* switch to global heap while calling vnet_* functions */
- clib_mem_set_heap (cm->vlib_main->heap_base);
- vnet_l2_input_classify_enable_disable (sw_if_index, 0);
-
- if (am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- ip4_table_index =
- am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index];
- am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip4,
- &ip4_table_index, 0);
- }
- if (am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- ip6_table_index =
- am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index];
- am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip6,
- &ip6_table_index, 0);
- }
- if (am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- dot1q_table_index =
- am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index];
- am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- ~0, &dot1q_table_index, 0);
- }
- if (am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- dot1ad_table_index =
- am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index];
- am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
- sizeof (dot1ad_5tuple_mask) - 1, ~0,
- ~0, &dot1ad_table_index, 0);
- }
- if (am->acl_etype_input_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- etype_table_index =
- am->acl_etype_input_classify_table_by_sw_if_index[sw_if_index];
- am->acl_etype_input_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, ethertype_mask,
- sizeof (ethertype_mask) - 1, ~0,
- ~0, &etype_table_index, 0);
- }
- clib_mem_set_heap (oldheap);
- return 0;
-}
-
-static int
-acl_unhook_l2_output_classify (acl_main_t * am, u32 sw_if_index)
-{
- vnet_classify_main_t *cm = &vnet_classify_main;
- u32 ip4_table_index = ~0;
- u32 ip6_table_index = ~0;
- u32 dot1q_table_index = ~0;
- u32 dot1ad_table_index = ~0;
- u32 etype_table_index = ~0;
- void *oldheap = acl_set_heap (am);
-
- vec_validate_init_empty (am->acl_ip4_output_classify_table_by_sw_if_index,
- sw_if_index, ~0);
- vec_validate_init_empty (am->acl_ip6_output_classify_table_by_sw_if_index,
- sw_if_index, ~0);
- vec_validate_init_empty (am->acl_dot1q_output_classify_table_by_sw_if_index,
- sw_if_index, ~0);
- vec_validate_init_empty
- (am->acl_dot1ad_output_classify_table_by_sw_if_index, sw_if_index, ~0);
- vec_validate_init_empty (am->acl_etype_output_classify_table_by_sw_if_index,
- sw_if_index, ~0);
-
- /* switch to global heap while calling vnet_* functions */
- clib_mem_set_heap (cm->vlib_main->heap_base);
-
- vnet_l2_output_classify_enable_disable (sw_if_index, 0);
-
- if (am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- ip4_table_index =
- am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index];
- am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip4,
- &ip4_table_index, 0);
- }
- if (am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- ip6_table_index =
- am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index];
- am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip6,
- &ip6_table_index, 0);
- }
- if (am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- dot1q_table_index =
- am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index];
- am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- ~0, &dot1q_table_index, 0);
- }
- if (am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- dot1ad_table_index =
- am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index];
- am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
- sizeof (dot1ad_5tuple_mask) - 1, ~0,
- ~0, &dot1ad_table_index, 0);
- }
- if (am->acl_etype_output_classify_table_by_sw_if_index[sw_if_index] != ~0)
- {
- etype_table_index =
- am->acl_etype_output_classify_table_by_sw_if_index[sw_if_index];
- am->acl_etype_output_classify_table_by_sw_if_index[sw_if_index] = ~0;
- acl_classify_add_del_table_tiny (cm, ethertype_mask,
- sizeof (ethertype_mask) - 1, ~0,
- ~0, &etype_table_index, 0);
- }
- clib_mem_set_heap (oldheap);
- return 0;
-}
-
-static void
-acl_add_vlan_session (acl_main_t * am, u32 table_index, u8 is_output,
- u8 is_dot1ad, u8 is_ip6)
-{
- vnet_classify_main_t *cm = &vnet_classify_main;
- u8 *match;
- u32 next_acl;
- u8 idx;
- u8 session_idx;
-
- if (is_ip6)
- {
- next_acl =
- (is_output) ? am->
- l2_output_classify_next_acl_ip6 : am->l2_input_classify_next_acl_ip6;
- }
- else
- {
- next_acl =
- (is_output) ? am->
- l2_output_classify_next_acl_ip4 : am->l2_input_classify_next_acl_ip4;
- }
- match = (is_dot1ad) ? dot1ad_5tuple_mask : dot1q_5tuple_mask;
- idx = (is_dot1ad) ? 20 : 16;
- if (is_dot1ad)
- {
- /* 802.1ad ethertype */
- match[12] = 0x88;
- match[13] = 0xa8;
- /* 802.1q ethertype */
- match[16] = 0x81;
- match[17] = 0x00;
- }
- else
- {
- /* 802.1q ethertype */
- match[12] = 0x81;
- match[13] = 0x00;
- }
-
- /* add sessions to vlan tables per ethernet_type */
- if (is_ip6)
- {
- match[idx] = 0x86;
- match[idx + 1] = 0xdd;
- session_idx = 1;
- }
- else
- {
- match[idx] = 0x08;
- match[idx + 1] = 0x00;
- session_idx = 0;
- }
- vnet_classify_add_del_session (cm, table_index, match, next_acl,
- session_idx, 0, 0, 0, 1);
- /* reset the mask back to being a mask */
- match[idx] = 0xff;
- match[idx + 1] = 0xff;
- match[12] = 0xff;
- match[13] = 0xff;
- if (is_dot1ad)
- {
- match[16] = 0xff;
- match[17] = 0xff;
- }
-}
-
-static int
intf_has_etype_whitelist (acl_main_t * am, u32 sw_if_index, int is_input)
{
u16 **v = is_input
? am->input_etype_whitelist_by_sw_if_index
: am->output_etype_whitelist_by_sw_if_index;
- return ((vec_len (v) > sw_if_index) && vec_elt (v, sw_if_index));
-}
-
-static int
-etype_whitelist_add_sessions (acl_main_t * am, u32 sw_if_index, int is_input,
- u32 etype_table_index)
-{
- vnet_classify_main_t *cm = &vnet_classify_main;
- u16 **v = is_input
- ? am->input_etype_whitelist_by_sw_if_index
- : am->output_etype_whitelist_by_sw_if_index;
- u8 *match = ethertype_mask;
-
- int i;
- int rv = 0;
- u16 *whitelist = vec_elt (v, sw_if_index);
- u32 next = ~0; /* permit */
- for (i = 0; i < vec_len (whitelist); i++)
- {
- /* big-endian */
- match[12] = (whitelist[i] >> 8) & 0xff;
- match[13] = whitelist[i] & 0xff;
- rv = rv
- || vnet_classify_add_del_session (cm, etype_table_index, match, next,
- whitelist[i], 0, 0, 0, 1);
- }
-
- /* restore the mask */
- match[12] = 0xff;
- match[13] = 0xff;
- return rv;
-}
-
-static int
-acl_hook_l2_input_classify (acl_main_t * am, u32 sw_if_index)
-{
- vnet_classify_main_t *cm = &vnet_classify_main;
- u32 ip4_table_index = ~0;
- u32 ip6_table_index = ~0;
- u32 dot1q_table_index = ~0;
- u32 dot1ad_table_index = ~0;
- u32 etype_table_index = ~0;
- int rv;
-
- void *prevheap = clib_mem_set_heap (cm->vlib_main->heap_base);
-
- /* in case there were previous tables attached */
- acl_unhook_l2_input_classify (am, sw_if_index);
- rv =
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip4,
- &ip4_table_index, 1);
- if (rv)
- goto done;
-
- rv =
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip6,
- &ip6_table_index, 1);
- if (rv)
- {
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip4,
- &ip4_table_index, 0);
- goto done;
- }
-
- if (intf_has_etype_whitelist (am, sw_if_index, 1))
- {
- acl_classify_add_del_table_tiny (cm, ethertype_mask, sizeof (ethertype_mask) - 1, ~0, 0, /* drop if no match */
- &etype_table_index, 1);
- etype_whitelist_add_sessions (am, sw_if_index, 1, etype_table_index);
- }
-
- rv =
- acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
- sizeof (dot1ad_5tuple_mask) - 1,
- etype_table_index, ~0,
- &dot1ad_table_index, 1);
- rv =
- acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask,
- sizeof (dot1q_5tuple_mask) - 1,
- dot1ad_table_index, ~0,
- &dot1q_table_index, 1);
- if (rv)
- {
- acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
- sizeof (dot1ad_5tuple_mask) - 1, ~0,
- ~0, &dot1ad_table_index, 0);
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip6,
- &ip6_table_index, 0);
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip4,
- &ip4_table_index, 0);
- goto done;
- }
-
- rv =
- vnet_l2_input_classify_set_tables (sw_if_index, ip4_table_index,
- ip6_table_index, dot1q_table_index);
-
- if (rv)
- {
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip4,
- &ip4_table_index, 0);
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- am->l2_input_classify_next_acl_ip6,
- &ip6_table_index, 0);
- acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask,
- sizeof (dot1q_5tuple_mask) - 1, ~0,
- ~0, &dot1q_table_index, 0);
- acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
- sizeof (dot1ad_5tuple_mask) - 1, ~0,
- ~0, &dot1ad_table_index, 0);
- goto done;
- }
-
- /* add sessions to vlan tables per ethernet_type */
- acl_add_vlan_session (am, dot1q_table_index, 0, 0, 0);
- acl_add_vlan_session (am, dot1q_table_index, 0, 0, 1);
- acl_add_vlan_session (am, dot1ad_table_index, 0, 1, 0);
- acl_add_vlan_session (am, dot1ad_table_index, 0, 1, 1);
-
- am->acl_ip4_input_classify_table_by_sw_if_index[sw_if_index] =
- ip4_table_index;
- am->acl_ip6_input_classify_table_by_sw_if_index[sw_if_index] =
- ip6_table_index;
- am->acl_dot1q_input_classify_table_by_sw_if_index[sw_if_index] =
- dot1q_table_index;
- am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] =
- dot1ad_table_index;
- am->acl_dot1ad_input_classify_table_by_sw_if_index[sw_if_index] =
- dot1ad_table_index;
- am->acl_etype_input_classify_table_by_sw_if_index[sw_if_index] =
- etype_table_index;
-
- vnet_l2_input_classify_enable_disable (sw_if_index, 1);
-done:
- clib_mem_set_heap (prevheap);
- return rv;
-}
-
-static int
-acl_hook_l2_output_classify (acl_main_t * am, u32 sw_if_index)
-{
- vnet_classify_main_t *cm = &vnet_classify_main;
- u32 ip4_table_index = ~0;
- u32 ip6_table_index = ~0;
- u32 dot1q_table_index = ~0;
- u32 dot1ad_table_index = ~0;
- u32 etype_table_index = ~0;
- int rv;
-
- void *prevheap = clib_mem_set_heap (cm->vlib_main->heap_base);
-
- /* in case there were previous tables attached */
- acl_unhook_l2_output_classify (am, sw_if_index);
- rv =
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip4,
- &ip4_table_index, 1);
- if (rv)
- goto done;
- rv =
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip6,
- &ip6_table_index, 1);
- if (rv)
- {
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip4,
- &ip4_table_index, 0);
- goto done;
- }
-
- if (intf_has_etype_whitelist (am, sw_if_index, 0))
- {
- acl_classify_add_del_table_tiny (cm, ethertype_mask, sizeof (ethertype_mask) - 1, ~0, 0, /* drop if no match */
- &etype_table_index, 1);
- etype_whitelist_add_sessions (am, sw_if_index, 0, etype_table_index);
- }
-
-
- rv =
- acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
- sizeof (dot1ad_5tuple_mask) - 1,
- etype_table_index, ~0,
- &dot1ad_table_index, 1);
- rv =
- acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask,
- sizeof (dot1q_5tuple_mask) - 1,
- dot1ad_table_index, ~0,
- &dot1q_table_index, 1);
- if (rv)
- {
- acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
- sizeof (dot1ad_5tuple_mask) - 1, ~0,
- ~0, &dot1ad_table_index, 0);
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip6,
- &ip6_table_index, 0);
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip4,
- &ip4_table_index, 0);
- goto done;
- }
-
- rv =
- vnet_l2_output_classify_set_tables (sw_if_index, ip4_table_index,
- ip6_table_index, dot1q_table_index);
-/*
- clib_warning
- ("ACL enabling on interface sw_if_index %d, setting tables to the following: ip4: %d ip6: %d\n",
- sw_if_index, ip4_table_index, ip6_table_index);
-*/
- if (rv)
- {
- acl_classify_add_del_table_tiny (cm, ip6_5tuple_mask,
- sizeof (ip6_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip6,
- &ip6_table_index, 0);
- acl_classify_add_del_table_tiny (cm, ip4_5tuple_mask,
- sizeof (ip4_5tuple_mask) - 1, ~0,
- am->l2_output_classify_next_acl_ip4,
- &ip4_table_index, 0);
- acl_classify_add_del_table_tiny (cm, dot1q_5tuple_mask,
- sizeof (dot1q_5tuple_mask) - 1, ~0,
- ~0, &dot1q_table_index, 0);
- acl_classify_add_del_table_tiny (cm, dot1ad_5tuple_mask,
- sizeof (dot1ad_5tuple_mask) - 1, ~0,
- ~0, &dot1ad_table_index, 0);
- goto done;
- }
-
- /* add sessions to vlan tables per ethernet_type */
- acl_add_vlan_session (am, dot1q_table_index, 1, 0, 0);
- acl_add_vlan_session (am, dot1q_table_index, 1, 0, 1);
- acl_add_vlan_session (am, dot1ad_table_index, 1, 1, 0);
- acl_add_vlan_session (am, dot1ad_table_index, 1, 1, 1);
-
- am->acl_ip4_output_classify_table_by_sw_if_index[sw_if_index] =
- ip4_table_index;
- am->acl_ip6_output_classify_table_by_sw_if_index[sw_if_index] =
- ip6_table_index;
- am->acl_dot1q_output_classify_table_by_sw_if_index[sw_if_index] =
- dot1q_table_index;
- am->acl_dot1ad_output_classify_table_by_sw_if_index[sw_if_index] =
- dot1ad_table_index;
- am->acl_etype_output_classify_table_by_sw_if_index[sw_if_index] =
- etype_table_index;
-
- vnet_l2_output_classify_enable_disable (sw_if_index, 1);
-done:
- clib_mem_set_heap (prevheap);
- return rv;
+ u16 *whitelist = (vec_len (v) > sw_if_index) ? vec_elt (v, sw_if_index) : 0;
+ return vec_len (whitelist) > 0;
}
static void
@@ -1166,14 +571,22 @@ acl_interface_in_enable_disable (acl_main_t * am, u32 sw_if_index,
acl_fa_enable_disable (sw_if_index, 1, enable_disable);
- if (enable_disable)
- {
- rv = acl_hook_l2_input_classify (am, sw_if_index);
- }
- else
- {
- rv = acl_unhook_l2_input_classify (am, sw_if_index);
- }
+ void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
+ rv = vnet_l2_feature_enable_disable ("l2-input-ip4", "acl-plugin-in-ip4-l2",
+ sw_if_index, enable_disable, 0, 0);
+ if (rv)
+ clib_error ("Could not enable on input");
+ rv = vnet_l2_feature_enable_disable ("l2-input-ip6", "acl-plugin-in-ip6-l2",
+ sw_if_index, enable_disable, 0, 0);
+ if (rv)
+ clib_error ("Could not enable on input");
+
+ if (intf_has_etype_whitelist (am, sw_if_index, 1))
+ vnet_l2_feature_enable_disable ("l2-input-nonip",
+ "acl-plugin-in-nonip-l2", sw_if_index,
+ enable_disable, 0, 0);
+
+ clib_mem_set_heap (oldheap);
am->in_acl_on_sw_if_index =
clib_bitmap_set (am->in_acl_on_sw_if_index, sw_if_index, enable_disable);
@@ -1185,7 +598,7 @@ static int
acl_interface_out_enable_disable (acl_main_t * am, u32 sw_if_index,
int enable_disable)
{
- int rv;
+ int rv = 0;
/* Utterly wrong? */
if (pool_is_free_index (am->vnet_main->interface_main.sw_interfaces,
@@ -1198,14 +611,24 @@ acl_interface_out_enable_disable (acl_main_t * am, u32 sw_if_index,
acl_fa_enable_disable (sw_if_index, 0, enable_disable);
- if (enable_disable)
- {
- rv = acl_hook_l2_output_classify (am, sw_if_index);
- }
- else
- {
- rv = acl_unhook_l2_output_classify (am, sw_if_index);
- }
+ void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
+ rv =
+ vnet_l2_feature_enable_disable ("l2-output-ip4", "acl-plugin-out-ip4-l2",
+ sw_if_index, enable_disable, 0, 0);
+ if (rv)
+ clib_error ("Could not enable on output");
+ rv =
+ vnet_l2_feature_enable_disable ("l2-output-ip6", "acl-plugin-out-ip6-l2",
+ sw_if_index, enable_disable, 0, 0);
+ if (rv)
+ clib_error ("Could not enable on output");
+ if (intf_has_etype_whitelist (am, sw_if_index, 0))
+ vnet_l2_feature_enable_disable ("l2-output-nonip",
+ "acl-plugin-out-nonip-l2", sw_if_index,
+ enable_disable, 0, 0);
+
+
+ clib_mem_set_heap (oldheap);
am->out_acl_on_sw_if_index =
clib_bitmap_set (am->out_acl_on_sw_if_index, sw_if_index, enable_disable);
@@ -3115,50 +2538,6 @@ setup_message_id_table (acl_main_t * am, api_main_t * apim)
}
static void
-acl_setup_fa_nodes (void)
-{
- vlib_main_t *vm = vlib_get_main ();
- acl_main_t *am = &acl_main;
- vlib_node_t *n, *n4, *n6;
-
- n = vlib_get_node_by_name (vm, (u8 *) "l2-input-classify");
- n4 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-in-ip4-l2");
- n6 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-in-ip6-l2");
-
-
- am->l2_input_classify_next_acl_ip4 =
- vlib_node_add_next_with_slot (vm, n->index, n4->index, ~0);
- am->l2_input_classify_next_acl_ip6 =
- vlib_node_add_next_with_slot (vm, n->index, n6->index, ~0);
-
- feat_bitmap_init_next_nodes (vm, n4->index, L2INPUT_N_FEAT,
- l2input_get_feat_names (),
- am->fa_acl_in_ip4_l2_node_feat_next_node_index);
-
- feat_bitmap_init_next_nodes (vm, n6->index, L2INPUT_N_FEAT,
- l2input_get_feat_names (),
- am->fa_acl_in_ip6_l2_node_feat_next_node_index);
-
-
- n = vlib_get_node_by_name (vm, (u8 *) "l2-output-classify");
- n4 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-out-ip4-l2");
- n6 = vlib_get_node_by_name (vm, (u8 *) "acl-plugin-out-ip6-l2");
-
- am->l2_output_classify_next_acl_ip4 =
- vlib_node_add_next_with_slot (vm, n->index, n4->index, ~0);
- am->l2_output_classify_next_acl_ip6 =
- vlib_node_add_next_with_slot (vm, n->index, n6->index, ~0);
-
- feat_bitmap_init_next_nodes (vm, n4->index, L2OUTPUT_N_FEAT,
- l2output_get_feat_names (),
- am->fa_acl_out_ip4_l2_node_feat_next_node_index);
-
- feat_bitmap_init_next_nodes (vm, n6->index, L2OUTPUT_N_FEAT,
- l2output_get_feat_names (),
- am->fa_acl_out_ip6_l2_node_feat_next_node_index);
-}
-
-static void
acl_set_timeout_sec (int timeout_type, u32 value)
{
acl_main_t *am = &acl_main;
@@ -4180,8 +3559,6 @@ acl_init (vlib_main_t * vm)
if (error)
return error;
- acl_setup_fa_nodes ();
-
am->acl_mheap_size = 0; /* auto size when initializing */
am->hash_lookup_mheap_size = ACL_PLUGIN_HASH_LOOKUP_HEAP_SIZE;