GBP: add allowed ethertypes to contracts

Change-Id: I74782d3b9b71a071bb500c34866a017b8ee15767
Signed-off-by: Neale Ranns <nranns@cisco.com>

1 files changed, 81 insertions, 50 deletions

diff --git a/src/plugins/gbp/gbp_policy.c b/src/plugins/gbp/gbp_policy.c
index 3b204ff4da8..174223e09f7 100644
--- a/src/plugins/gbp/gbp_policy.c
+++ b/src/plugins/gbp/gbp_policy.c
@@ -106,6 +106,19 @@ gbp_rule_l2_redirect (const gbp_rule_t * gu, vlib_buffer_t * b0)
   return (dpo->dpoi_next_node);
 }
 
+always_inline u8
+gbp_policy_is_ethertype_allowed (const gbp_contract_t * gc0, u16 ethertype)
+{
+  u16 *et;
+
+  vec_foreach (et, gc0->gc_allowed_ethertypes)
+  {
+    if (*et == ethertype)
+      return (1);
+  }
+  return (0);
+}
+
 static uword
 gbp_policy_inline (vlib_main_t * vm,
 		   vlib_node_runtime_t * node,
@@ -130,9 +143,9 @@ gbp_policy_inline (vlib_main_t * vm,
 	{
 	  const ethernet_header_t *h0;
 	  const gbp_endpoint_t *ge0;
+	  const gbp_contract_t *gc0;
 	  gbp_policy_next_t next0;
 	  gbp_contract_key_t key0;
-	  gbp_contract_t *gc0;
 	  u32 bi0, sw_if_index0;
 	  vlib_buffer_t *b0;
 	  index_t gci0;
@@ -204,66 +217,84 @@ gbp_policy_inline (vlib_main_t * vm,
 
 		  if (INDEX_INVALID != gci0)
 		    {
+		      u32 rule_match_p0, trace_bitmap0;
 		      fa_5tuple_opaque_t pkt_5tuple0;
-		      u8 action0 = 0;
 		      u32 acl_pos_p0, acl_match_p0;
-		      u32 rule_match_p0, trace_bitmap0;
-		      u8 *h0, l2_len0;
+		      u8 is_ip60, l2_len0, action0;
+		      const gbp_rule_t *gu;
 		      u16 ether_type0;
-		      u8 is_ip60 = 0;
+		      const u8 *h0;
 
+		      action0 = 0;
 		      gc0 = gbp_contract_get (gci0);
 		      l2_len0 = vnet_buffer (b0)->l2.l2_len;
 		      h0 = vlib_buffer_get_current (b0);
 
-		      ether_type0 =
-			clib_net_to_host_u16 (*(u16 *) (h0 + l2_len0 - 2));
-
-		      is_ip60 = (ether_type0 == ETHERNET_TYPE_IP6) ? 1 : 0;
-		      /*
-		       * tests against the ACL
-		       */
-		      acl_plugin_fill_5tuple_inline (gm->
-						     acl_plugin.p_acl_main,
-						     gc0->gc_lc_index, b0,
-						     is_ip60,
-						     /* is_input */ 0,
-						     /* is_l2_path */ 1,
-						     &pkt_5tuple0);
-		      acl_plugin_match_5tuple_inline (gm->
-						      acl_plugin.p_acl_main,
-						      gc0->gc_lc_index,
-						      &pkt_5tuple0, is_ip60,
-						      &action0, &acl_pos_p0,
-						      &acl_match_p0,
-						      &rule_match_p0,
-						      &trace_bitmap0);
-
-		      if (action0 > 0)
-			{
-			  gbp_rule_t *gu;
+		      ether_type0 = *(u16 *) (h0 + l2_len0 - 2);
 
-			  vnet_buffer2 (b0)->gbp.flags |= VXLAN_GBP_GPFLAGS_A;
-			  gu = gbp_rule_get (gc0->gc_rules[rule_match_p0]);
+		      if (!gbp_policy_is_ethertype_allowed (gc0, ether_type0))
+			{
+			  /*
+			   * black list model so drop
+			   */
+			  goto trace;
+			}
 
-			  switch (gu->gu_action)
+		      if ((ether_type0 ==
+			   clib_net_to_host_u16 (ETHERNET_TYPE_IP6))
+			  || (ether_type0 ==
+			      clib_net_to_host_u16 (ETHERNET_TYPE_IP4)))
+			{
+			  is_ip60 =
+			    (ether_type0 ==
+			     clib_net_to_host_u16 (ETHERNET_TYPE_IP6)) ? 1 :
+			    0;
+			  /*
+			   * tests against the ACL
+			   */
+			  acl_plugin_fill_5tuple_inline (gm->
+							 acl_plugin.p_acl_main,
+							 gc0->gc_lc_index, b0,
+							 is_ip60,
+							 /* is_input */ 0,
+							 /* is_l2_path */ 1,
+							 &pkt_5tuple0);
+			  acl_plugin_match_5tuple_inline (gm->
+							  acl_plugin.p_acl_main,
+							  gc0->gc_lc_index,
+							  &pkt_5tuple0,
+							  is_ip60, &action0,
+							  &acl_pos_p0,
+							  &acl_match_p0,
+							  &rule_match_p0,
+							  &trace_bitmap0);
+
+			  if (action0 > 0)
 			    {
-			    case GBP_RULE_PERMIT:
-			      next0 = vnet_l2_feature_next
-				(b0,
-				 gpm->l2_output_feat_next
-				 [is_port_based],
-				 (is_port_based ?
-				  L2OUTPUT_FEAT_GBP_POLICY_PORT :
-				  L2OUTPUT_FEAT_GBP_POLICY_MAC));
-			      break;
-			    case GBP_RULE_DENY:
-			      ASSERT (0);
-			      next0 = 0;
-			      break;
-			    case GBP_RULE_REDIRECT:
-			      next0 = gbp_rule_l2_redirect (gu, b0);
-			      break;
+			      vnet_buffer2 (b0)->gbp.flags |=
+				VXLAN_GBP_GPFLAGS_A;
+			      gu =
+				gbp_rule_get (gc0->gc_rules[rule_match_p0]);
+
+			      switch (gu->gu_action)
+				{
+				case GBP_RULE_PERMIT:
+				  next0 = vnet_l2_feature_next
+				    (b0,
+				     gpm->l2_output_feat_next
+				     [is_port_based],
+				     (is_port_based ?
+				      L2OUTPUT_FEAT_GBP_POLICY_PORT :
+				      L2OUTPUT_FEAT_GBP_POLICY_MAC));
+				  break;
+				case GBP_RULE_DENY:
+				  ASSERT (0);
+				  next0 = 0;
+				  break;
+				case GBP_RULE_REDIRECT:
+				  next0 = gbp_rule_l2_redirect (gu, b0);
+				  break;
+				}
 			    }
 			}
 		    }