misc: classifier-based packet trace filter

See .../src/vnet/classify/trace_classify.h for the business end
of the scheme.

It would be best to hash pkts, prefetch buckets, and do the primary
table lookups two at a time. The inline as given works, but perf
tuning will be required. "At least it works..."

Add "classify filter" debug cli, for example:
classify filter mask l3 ip4 src dst \
  match l3 ip4 dst 192.168.2.10 src 192.168.1.10

Add "pcap rx | tx trace ... filter" to use the current classify filter chain

Patch includes sphinx documentation and doxygen tags.

Next step: device-driver integration

Type: feature

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I05b1358a769f61e6d32470e0c87058f640486b26

2 files changed, 393 insertions, 3 deletions

diff --git a/src/vnet/classify/trace_classify.h b/src/vnet/classify/trace_classify.h
new file mode 100644
index 00000000000..bc25ecd0ff7
--- /dev/null
+++ b/src/vnet/classify/trace_classify.h
@@ -0,0 +1,100 @@
+/*
+ * trace_classify.h - Use the classifier to decide if a packet is traced
+ *
+ * Copyright (c) 2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+#include <vppinfra/error.h>
+#include <vnet/classify/vnet_classify.h>
+
+/** @file trace_classify.h
+ * Use the vpp classifier to decide whether to trace packets
+ */
+
+/** @brief vnet_is_packet_traced
+ * @param vlib_buffer_t *b - packet to classify
+ * @param int func - 0 => use classifier w/ supplied table index
+ * @param u32 classify_table_index - classifier table index
+ * @return 0 => no trace, 1 => trace, -1 => error
+ */
+
+static inline int
+vnet_is_packet_traced_inline (vlib_buffer_t * b,
+			      u32 classify_table_index, int func)
+{
+  vnet_classify_main_t *vcm = &vnet_classify_main;
+  vnet_classify_table_t *t;
+  vnet_classify_entry_t *e;
+  u64 hash;
+
+  /*$$$ add custom classifiers here, if any */
+  if (func != 0)
+    return -1;
+
+  /* This will happen... */
+  if (pool_is_free_index (vcm->tables, classify_table_index))
+    return -1;
+
+  /* Get the table */
+  t = pool_elt_at_index (vcm->tables, classify_table_index);
+
+  /* Hash the packet */
+  hash = vnet_classify_hash_packet (t, vlib_buffer_get_current (b));
+
+  /* See if there's a matching entry */
+  e = vnet_classify_find_entry (t, vlib_buffer_get_current (b), hash,
+				0 /* time = 0, disables hit-counter */ );
+  /* Hit means trace the packet... */
+  if (e)
+    {
+      /* Manual hit accounting */
+      e->hits++;
+      return 1;
+    }
+
+  /*
+   * Look for a hit in a less-specific table.
+   * Performance hint: for this use-case, don't go there.
+   */
+  while (1)
+    {
+      /* Most likely, we're done right now */
+      if (PREDICT_TRUE (t->next_table_index == ~0))
+	return 0;
+      t = pool_elt_at_index (vcm->tables, t->next_table_index);
+
+      /* Compute hash for this table */
+      hash = vnet_classify_hash_packet (t, vlib_buffer_get_current (b));
+
+      /* See if there's a matching entry */
+      e = vnet_classify_find_entry (t, vlib_buffer_get_current (b), hash,
+				    0 /* time = 0, disables hit-counter */ );
+      if (e)
+	{
+	  /* Manual hit accounting */
+	  e->hits++;
+	  return 1;
+	}
+    }
+  /* NOTREACHED */
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/classify/vnet_classify.c b/src/vnet/classify/vnet_classify.c
index b807a2679a7..94cc2419775 100755
--- a/src/vnet/classify/vnet_classify.c
+++ b/src/vnet/classify/vnet_classify.c
@@ -20,6 +20,11 @@
 #include <vnet/fib/fib_table.h>
 #include <vppinfra/lock.h>
 
+/**
+ * @file
+ * @brief N-tuple classifier
+ */
+
 vnet_classify_main_t vnet_classify_main;
 
 #if VALIDATION_SCAFFOLDING
@@ -939,6 +944,10 @@ unformat_ip4_mask (unformat_input_t * input, va_list * args)
   u8 *mask = 0;
   u8 found_something = 0;
   ip4_header_t *ip;
+  u32 src_prefix_len = 32;
+  u32 src_prefix_mask = ~0;
+  u32 dst_prefix_len = 32;
+  u32 dst_prefix_mask = ~0;
 
 #define _(a) u8 a=0;
   foreach_ip4_proto_field;
@@ -953,6 +962,18 @@ unformat_ip4_mask (unformat_input_t * input, va_list * args)
 	version = 1;
       else if (unformat (input, "hdr_length"))
 	hdr_length = 1;
+      else if (unformat (input, "src/%d", &src_prefix_len))
+	{
+	  src_address = 1;
+	  src_prefix_mask &= ~((1 << (32 - src_prefix_len)) - 1);
+	  src_prefix_mask = clib_host_to_net_u32 (src_prefix_mask);
+	}
+      else if (unformat (input, "dst/%d", &dst_prefix_len))
+	{
+	  dst_address = 1;
+	  dst_prefix_mask &= ~((1 << (32 - dst_prefix_len)) - 1);
+	  dst_prefix_mask = clib_host_to_net_u32 (dst_prefix_mask);
+	}
       else if (unformat (input, "src"))
 	src_address = 1;
       else if (unformat (input, "dst"))
@@ -982,6 +1003,12 @@ unformat_ip4_mask (unformat_input_t * input, va_list * args)
   foreach_ip4_proto_field;
 #undef _
 
+  if (src_address)
+    ip->src_address.as_u32 = src_prefix_mask;
+
+  if (dst_address)
+    ip->dst_address.as_u32 = dst_prefix_mask;
+
   ip->ip_version_and_header_length = 0;
 
   if (version)
@@ -1577,7 +1604,7 @@ classify_table_command_fn (vlib_main_t * vm,
   if (!is_add && table_index == ~0)
     return clib_error_return (0, "table index required for delete");
 
-  rv = vnet_classify_add_del_table (cm, mask, nbuckets, memory_size,
+  rv = vnet_classify_add_del_table (cm, mask, nbuckets, (u32) memory_size,
 				    skip, match, next_table_index,
 				    miss_next_index, &table_index,
 				    current_data_flag, current_data_offset,
@@ -1595,7 +1622,8 @@ classify_table_command_fn (vlib_main_t * vm,
 }
 
 /* *INDENT-OFF* */
-VLIB_CLI_COMMAND (classify_table, static) = {
+VLIB_CLI_COMMAND (classify_table, static) =
+{
   .path = "classify table",
   .short_help =
   "classify table [miss-next|l2-miss_next|acl-miss-next <next_index>]"
@@ -1607,6 +1635,268 @@ VLIB_CLI_COMMAND (classify_table, static) = {
 };
 /* *INDENT-ON* */
 
+static int
+filter_table_mask_compare (void *a1, void *a2)
+{
+  vnet_classify_main_t *cm = &vnet_classify_main;
+  u32 *ti1 = a1;
+  u32 *ti2 = a2;
+  u32 n1 = 0, n2 = 0;
+  vnet_classify_table_t *t1, *t2;
+  u8 *m1, *m2;
+  int i;
+
+  t1 = pool_elt_at_index (cm->tables, *ti1);
+  t2 = pool_elt_at_index (cm->tables, *ti2);
+
+  m1 = (u8 *) (t1->mask);
+  m2 = (u8 *) (t2->mask);
+
+  for (i = 0; i < vec_len (t1->mask) * sizeof (u32x4); i++)
+    {
+      n1 += count_set_bits (m1[0]);
+      m1++;
+    }
+
+  for (i = 0; i < vec_len (t2->mask) * sizeof (u32x4); i++)
+    {
+      n2 += count_set_bits (m2[0]);
+      m2++;
+    }
+
+  /* Reverse sort: descending number of set bits */
+  if (n1 < n2)
+    return 1;
+  else if (n1 > n2)
+    return -1;
+  else
+    return 0;
+}
+
+static clib_error_t *
+classify_filter_command_fn (vlib_main_t * vm,
+			    unformat_input_t * input,
+			    vlib_cli_command_t * cmd)
+{
+  u32 nbuckets = 8;
+  vnet_main_t *vnm = vnet_get_main ();
+  uword memory_size = (uword) (128 << 10);
+  u32 skip = ~0;
+  u32 match = ~0;
+  u8 *match_vector;
+  int is_add = 1;
+  int del_chain = 0;
+  u32 table_index = ~0;
+  u32 next_table_index = ~0;
+  u32 miss_next_index = ~0;
+  u32 current_data_flag = 0;
+  int current_data_offset = 0;
+  int i;
+  vnet_classify_table_t *t;
+  u8 *mask = 0;
+  vnet_classify_main_t *cm = &vnet_classify_main;
+  int rv = 0;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "del"))
+	is_add = 0;
+      else if (unformat (input, "buckets %d", &nbuckets))
+	;
+      else if (unformat (input, "mask %U", unformat_classify_mask,
+			 &mask, &skip, &match))
+	;
+      else if (unformat (input, "memory-size %U", unformat_memory_size,
+			 &memory_size))
+	;
+      else
+	break;
+    }
+
+  if (is_add && mask == 0 && table_index == ~0)
+    return clib_error_return (0, "Mask required");
+
+  if (is_add && skip == ~0 && table_index == ~0)
+    return clib_error_return (0, "skip count required");
+
+  if (is_add && match == ~0 && table_index == ~0)
+    return clib_error_return (0, "match count required");
+
+  if (!is_add)
+    {
+      if (vec_len (vnm->classify_filter_table_indices) == 0)
+	return clib_error_return (0, "No classify filter set...");
+
+      del_chain = 1;
+      table_index = vnm->classify_filter_table_indices[0];
+      vec_reset_length (vnm->classify_filter_table_indices);
+    }
+
+  /* see if we already have a table for that... */
+
+  if (is_add)
+    {
+      for (i = 0; i < vec_len (vnm->classify_filter_table_indices); i++)
+	{
+	  t = pool_elt_at_index (cm->tables, i);
+	  /* classifier geometry mismatch, can't use this table */
+	  if (t->match_n_vectors != match || t->skip_n_vectors != skip)
+	    continue;
+	  /* Masks aren't congruent, can't use this table */
+	  if (vec_len (t->mask) != vec_len (mask))
+	    continue;
+	  /* Masks aren't bit-for-bit identical, can't use this table */
+	  if (memcmp (t->mask, mask, vec_len (mask)))
+	    continue;
+
+	  /* Winner... */
+	  table_index = i;
+	  goto found_table;
+	}
+    }
+
+  rv = vnet_classify_add_del_table (cm, mask, nbuckets, memory_size,
+				    skip, match, next_table_index,
+				    miss_next_index, &table_index,
+				    current_data_flag, current_data_offset,
+				    is_add, del_chain);
+  vec_free (mask);
+
+  switch (rv)
+    {
+    case 0:
+      break;
+
+    default:
+      return clib_error_return (0, "vnet_classify_add_del_table returned %d",
+				rv);
+    }
+
+  if (is_add == 0)
+    return 0;
+
+  /* Remember the table */
+  vec_add1 (vnm->classify_filter_table_indices, table_index);
+
+found_table:
+
+  /* Now try to parse a session */
+  if (unformat (input, "match %U", unformat_classify_match,
+		cm, &match_vector, table_index) == 0)
+    return 0;
+
+
+  /*
+   * We use hit or miss to determine whether to trace or pcap pkts
+   * so the session setup is very limited
+   */
+  rv = vnet_classify_add_del_session (cm, table_index,
+				      match_vector, 0 /* hit_next_index */ ,
+				      0 /* opaque_index */ ,
+				      0 /* advance */ ,
+				      0 /* action */ ,
+				      0 /* metadata */ ,
+				      1 /* is_add */ );
+
+  vec_free (match_vector);
+
+  /* Sort filter tables from most-specific mask to least-specific mask */
+  vec_sort_with_function (vnm->classify_filter_table_indices,
+			  filter_table_mask_compare);
+
+  ASSERT (vec_len (vnm->classify_filter_table_indices));
+
+  /* Setup next_table_index fields */
+  for (i = 0; i < vec_len (vnm->classify_filter_table_indices); i++)
+    {
+      t = pool_elt_at_index (cm->tables,
+			     vnm->classify_filter_table_indices[i]);
+
+      if ((i + 1) < vec_len (vnm->classify_filter_table_indices))
+	t->next_table_index = vnm->classify_filter_table_indices[i + 1];
+      else
+	t->next_table_index = ~0;
+    }
+
+  return 0;
+}
+
+/*?
+ * Construct an arbitrary set of packet classifier tables for use with
+ * "pcap rx | tx trace," and (eventually) with the vpp packet
+ * tracer
+ *
+ * Packets which match a rule in the classifier table chain
+ * will be traced. The tables are automatically ordered so that
+ * matches in the most specific table are tried first.
+ *
+ * It's reasonably likely that folks will configure a single
+ * table with one or two matches. As a result, we configure
+ * 8 hash buckets and 128K of match rule space. One can override
+ * the defaults by specifiying "buckets <nnn>" and "memory-size <xxx>"
+ * as desired.
+ *
+ * To build up complex filter chains, repeatedly issue the
+ * classify filter debug CLI command. Each command must specify the desired
+ * mask and match values. If a classifier table with a suitable mask
+ * already exists, the CLI command adds a match rule to the existing table.
+ * If not, the CLI command add a new table and the indicated mask rule
+ *
+ * Here is a terse description of the "mask <xxx>" syntax:
+ *
+ * l2 src dst proto tag1 tag2 ignore-tag1 ignore-tag2 cos1 cos2 dot1q dot1ad
+ *
+ * l3 ip4 <ip4-mask> ip6 <ip6-mask>
+ *
+ * <ip4-mask> version hdr_length src[/width] dst[/width]
+ *            tos length fragment_id ttl protocol checksum
+ *
+ * <ip6-mask> version traffic-class flow-label src dst proto
+ *            payload_length hop_limit protocol
+ *
+ * l4 tcp <tcp-mask> udp <udp_mask> src_port dst_port
+ *
+ * <tcp-mask> src dst  # ports
+ *
+ * <udp-mask> src_port dst_port
+ *
+ * To construct matches, add the values to match after the indicated keywords:
+ * in the match syntax. For example:
+ * mask l3 ip4 src -> match l3 ip4 src 192.168.1.11
+ *
+ * @cliexpar
+ * Configuring the classify filter
+ *
+ * Configure a simple classify filter, and configure pcap rx trace to use it:
+ *
+ * <b><em>classify filter mask l3 ip4 src match l3 ip4 src 192.168.1.11"</em></b><br>
+ * <b><em>pcap rx trace on max 100 filter</em></b>
+ *
+ * Configure another fairly simple filter
+ *
+ * <b><em>classify filter mask l3 ip4 src dst match l3 ip4 src 192.168.1.10 dst 192.168.2.10"</em></b>
+ *
+ * Clear all current classifier filters
+ *
+ * <b><em>classify filter del</em></b>
+ *
+ * To inspect the classifier tables, use
+ *
+ * <b><em>show classify table [verbose]</em></b>
+ * The verbose form displays all of the match rules, with hit-counters
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (classify_filter, static) =
+{
+  .path = "classify filter",
+  .short_help =
+  "classify filter mask <mask-value> match <match-value> [del]"
+  "[buckets <nn>] [memory-size <n>]",
+  .function = classify_filter_command_fn,
+};
+/* *INDENT-ON* */
+
 static u8 *
 format_vnet_classify_table (u8 * s, va_list * args)
 {
@@ -2442,7 +2732,7 @@ vnet_classify_init (vlib_main_t * vm)
 
 VLIB_INIT_FUNCTION (vnet_classify_init);
 
-#define TEST_CODE 1
+#define TEST_CODE 0
 
 #if TEST_CODE > 0