acl-plugin: implement an optional session reclassification when ACL is (re-)applied

There were several discussions in which users would expect the sessions to be deleted
if the new policy after the change does not permit them.
There is no right or wrong answer to this question - it is a policy decision.

This patch implements an idea to approach this. It uses a per-interface-per-direction counter to designate
a "policy epoch" - a period of unchanging rulesets. The moment one removes or adds an ACL applied to
an interface, this counter increments.
The newly created connections inherit the current policy epoch in a given direction.
Likewise, this counter increments if anyone updates an ACL applied to an interface.

There is also a new (so far hidden) CLI "set acl-plugin reclassify-sessions [0|1]"
(with default being 0) which allows to enable the checking of the existing sessions
against the current policy epoch in a given direction.

The session is not verified unless there is traffic hitting that session
 *in the direction of the policy creation* - if the epoch has changed,
the session is deleted and within the same processing cycle is evaluated
against the ACL rule base and recreated - thus, it should allow traffic-driven
session state refresh without affecting the connectivity for the existing sessions.

If the packet is coming in the direction opposite to which the session was initially
created, the state adjustment is never done, because doing so generically
is not really possible without diving too deep into the special cases,
which may or may not work.

Change-Id: I9e90426492d4bd474b5e89ea8dfb75a7c9de2646
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/src/plugins/acl/acl.h b/src/plugins/acl/acl.h
index 2d4dc551470..7af5b201551 100644
--- a/src/plugins/acl/acl.h
+++ b/src/plugins/acl/acl.h
@@ -186,6 +186,15 @@ typedef struct {
   /* lookup contexts where a given ACL is used */
   u32 **lc_index_vec_by_acl;
 
+  /* input and output policy epochs by interface */
+  u32 *input_policy_epoch_by_sw_if_index;
+  u32 *output_policy_epoch_by_sw_if_index;
+
+  /* whether we need to take the epoch of the session into account */
+  int reclassify_sessions;
+
+
+
   /* Total count of interface+direction pairs enabled */
   u32 fa_total_enabled_count;