classifier-based ACL: refactor + add output ACL

For implementation of MACIP ACLs enhancement (VPP-1088), an outbound
classifier-based ACL would be needed. There was an existing incomplete
code for outbound ACLs, it looked almost exact copy of input ACLs, minus
the various enhancements, trying to sync that code seemed error-prone
and cumbersome to maintain in the longer run.

This change refactors the input+output ACLs processing into a unified
routine (thus any changes will have effect on both), and also adds
the API to set the output interface ACL, with the same format
and semantics as the existing input one (except working on output
ACL of course).

WARNING: IP outbound ACL in L3 mode clobbers the ip.* fields
in the vnet_buffer_opaque_t, since the code is using l2_classify.*
The net_buffer (p0)->ip.save_rewrite_length is rescued into
l2_classify.pad.l2_len, and used to rewind the header in case of
drop, so that ipX_drop prints something sensible.

Change-Id: I62f814f1e3650e504474a3a5359edb8a0a8836ed
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

6 files changed, 230 insertions, 77 deletions

diff --git a/src/vnet/classify/classify.api b/src/vnet/classify/classify.api
index c22d6104704..7320d5ffa90 100644
--- a/src/vnet/classify/classify.api
+++ b/src/vnet/classify/classify.api
@@ -384,6 +384,28 @@ autoreply define input_acl_set_interface
   u8 is_add;
 };
 
+/** \brief Set/unset output ACL interface
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param sw_if_index - interface to set/unset output ACL
+    @param ip4_table_index - ip4 classify table index (~0 for skip)
+    @param ip6_table_index - ip6 classify table index (~0 for skip)
+    @param l2_table_index  -  l2 classify table index (~0 for skip)
+    @param is_add - Set output ACL if non-zero, else unset
+    Note: User is recommeneded to use just one valid table_index per call.
+          (ip4_table_index, ip6_table_index, or l2_table_index)
+*/
+autoreply define output_acl_set_interface
+{
+  u32 client_index;
+  u32 context;
+  u32 sw_if_index;
+  u32 ip4_table_index;
+  u32 ip6_table_index;
+  u32 l2_table_index;
+  u8 is_add;
+};
+
 /*
  * Local Variables:
  * eval: (c-set-style "gnu")
diff --git a/src/vnet/classify/classify_api.c b/src/vnet/classify/classify_api.c
index 1893f6e7191..2cf79f3875d 100644
--- a/src/vnet/classify/classify_api.c
+++ b/src/vnet/classify/classify_api.c
@@ -24,7 +24,7 @@
 #include <vnet/api_errno.h>
 
 #include <vnet/classify/vnet_classify.h>
-#include <vnet/classify/input_acl.h>
+#include <vnet/classify/in_out_acl.h>
 #include <vnet/classify/policer_classify.h>
 #include <vnet/classify/flow_classify.h>
 #include <vnet/l2/l2_classify.h>
@@ -60,7 +60,8 @@ _(FLOW_CLASSIFY_SET_INTERFACE, flow_classify_set_interface)             \
 _(FLOW_CLASSIFY_DUMP, flow_classify_dump)                               \
 _(INPUT_ACL_SET_INTERFACE, input_acl_set_interface)                     \
 _(CLASSIFY_SET_INTERFACE_IP_TABLE, classify_set_interface_ip_table)     \
-_(CLASSIFY_SET_INTERFACE_L2_TABLES, classify_set_interface_l2_tables)
+_(CLASSIFY_SET_INTERFACE_L2_TABLES, classify_set_interface_l2_tables)   \
+_(OUTPUT_ACL_SET_INTERFACE, output_acl_set_interface)
 
 #define foreach_classify_add_del_table_field    \
 _(table_index)                                  \
@@ -269,19 +270,21 @@ static void
   u32 sw_if_index = ntohl (mp->sw_if_index);
   u32 *acl = 0;
 
-  vec_validate (acl, INPUT_ACL_N_TABLES - 1);
+  vec_validate (acl, IN_OUT_ACL_N_TABLES - 1);
   vec_set (acl, ~0);
 
   VALIDATE_SW_IF_INDEX (mp);
 
-  input_acl_main_t *am = &input_acl_main;
+  in_out_acl_main_t *am = &in_out_acl_main;
 
   int if_idx;
   u32 type;
 
-  for (type = 0; type < INPUT_ACL_N_TABLES; type++)
+  for (type = 0; type < IN_OUT_ACL_N_TABLES; type++)
     {
-      u32 *vec_tbl = am->classify_table_index_by_sw_if_index[type];
+      u32 *vec_tbl =
+	am->classify_table_index_by_sw_if_index[IN_OUT_ACL_INPUT_TABLE_GROUP]
+	[type];
       if (vec_len (vec_tbl))
 	{
 	  for (if_idx = 0; if_idx < vec_len (vec_tbl); if_idx++)
@@ -301,9 +304,9 @@ static void
    REPLY_MACRO2(VL_API_CLASSIFY_TABLE_BY_INTERFACE_REPLY,
    ({
      rmp->sw_if_index = ntohl(sw_if_index);
-     rmp->l2_table_id = ntohl(acl[INPUT_ACL_TABLE_L2]);
-     rmp->ip4_table_id = ntohl(acl[INPUT_ACL_TABLE_IP4]);
-     rmp->ip6_table_id = ntohl(acl[INPUT_ACL_TABLE_IP6]);
+     rmp->l2_table_id = ntohl(acl[IN_OUT_ACL_TABLE_L2]);
+     rmp->ip4_table_id = ntohl(acl[IN_OUT_ACL_TABLE_IP4]);
+     rmp->ip6_table_id = ntohl(acl[IN_OUT_ACL_TABLE_IP6]);
    }));
    /* *INDENT-ON* */
   vec_free (acl);
@@ -585,6 +588,29 @@ static void vl_api_input_acl_set_interface_t_handler
   REPLY_MACRO (VL_API_INPUT_ACL_SET_INTERFACE_REPLY);
 }
 
+static void vl_api_output_acl_set_interface_t_handler
+  (vl_api_output_acl_set_interface_t * mp)
+{
+  vlib_main_t *vm = vlib_get_main ();
+  vl_api_output_acl_set_interface_reply_t *rmp;
+  int rv;
+
+  VALIDATE_SW_IF_INDEX (mp);
+
+  u32 ip4_table_index = ntohl (mp->ip4_table_index);
+  u32 ip6_table_index = ntohl (mp->ip6_table_index);
+  u32 l2_table_index = ntohl (mp->l2_table_index);
+  u32 sw_if_index = ntohl (mp->sw_if_index);
+
+  rv = vnet_set_output_acl_intfc (vm, sw_if_index, ip4_table_index,
+				  ip6_table_index, l2_table_index,
+				  mp->is_add);
+
+  BAD_SW_IF_INDEX_LABEL;
+
+  REPLY_MACRO (VL_API_OUTPUT_ACL_SET_INTERFACE_REPLY);
+}
+
 /*
  * classify_api_hookup
  * Add vpe's API message handlers to the table.
diff --git a/src/vnet/classify/input_acl.c b/src/vnet/classify/in_out_acl.c
index cf5053ef3ac..a34f6cec61a 100644
--- a/src/vnet/classify/input_acl.c
+++ b/src/vnet/classify/in_out_acl.c
@@ -14,62 +14,69 @@
  */
 #include <vnet/ip/ip.h>
 #include <vnet/classify/vnet_classify.h>
-#include <vnet/classify/input_acl.h>
+#include <vnet/classify/in_out_acl.h>
 
-input_acl_main_t input_acl_main;
+in_out_acl_main_t in_out_acl_main;
 
 static int
-vnet_inacl_ip_feature_enable (vlib_main_t * vnm,
-			      input_acl_main_t * am,
-			      u32 sw_if_index,
-			      input_acl_table_id_t tid, int feature_enable)
+vnet_in_out_acl_ip_feature_enable (vlib_main_t * vnm,
+				   in_out_acl_main_t * am,
+				   u32 sw_if_index,
+				   in_out_acl_table_id_t tid,
+				   int feature_enable, int is_output)
 {
 
-  if (tid == INPUT_ACL_TABLE_L2)
+  if (tid == IN_OUT_ACL_TABLE_L2)
     {
-      l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_ACL,
-				  feature_enable);
+      l2input_intf_bitmap_enable (sw_if_index,
+				  is_output ? L2OUTPUT_FEAT_ACL :
+				  L2INPUT_FEAT_ACL, feature_enable);
     }
   else
     {				/* IP[46] */
       vnet_feature_config_main_t *fcm;
       u8 arc;
 
-      if (tid == INPUT_ACL_TABLE_IP4)
+      if (tid == IN_OUT_ACL_TABLE_IP4)
 	{
-	  vnet_feature_enable_disable ("ip4-unicast", "ip4-inacl",
+	  char *arc_name = is_output ? "ip4-output" : "ip4-unicast";
+	  vnet_feature_enable_disable (arc_name,
+				       is_output ? "ip4-outacl" : "ip4-inacl",
 				       sw_if_index, feature_enable, 0, 0);
-	  arc = vnet_get_feature_arc_index ("ip4-unicast");
+	  arc = vnet_get_feature_arc_index (arc_name);
 	}
       else
 	{
-	  vnet_feature_enable_disable ("ip6-unicast", "ip6-inacl",
+	  char *arc_name = is_output ? "ip6-output" : "ip6-unicast";
+	  vnet_feature_enable_disable (arc_name,
+				       is_output ? "ip6-outacl" : "ip6-inacl",
 				       sw_if_index, feature_enable, 0, 0);
-	  arc = vnet_get_feature_arc_index ("ip6-unicast");
+	  arc = vnet_get_feature_arc_index (arc_name);
 	}
 
       fcm = vnet_get_feature_arc_config_main (arc);
-      am->vnet_config_main[tid] = &fcm->config_main;
+      am->vnet_config_main[is_output][tid] = &fcm->config_main;
     }
 
   return 0;
 }
 
 int
-vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
-			  u32 ip4_table_index,
-			  u32 ip6_table_index, u32 l2_table_index, u32 is_add)
+vnet_set_in_out_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+			   u32 ip4_table_index,
+			   u32 ip6_table_index, u32 l2_table_index,
+			   u32 is_add, u32 is_output)
 {
-  input_acl_main_t *am = &input_acl_main;
+  in_out_acl_main_t *am = &in_out_acl_main;
   vnet_classify_main_t *vcm = am->vnet_classify_main;
-  u32 acl[INPUT_ACL_N_TABLES] = { ip4_table_index, ip6_table_index,
+  u32 acl[IN_OUT_ACL_N_TABLES] = { ip4_table_index, ip6_table_index,
     l2_table_index
   };
   u32 ti;
 
   /* Assume that we've validated sw_if_index in the API layer */
 
-  for (ti = 0; ti < INPUT_ACL_N_TABLES; ti++)
+  for (ti = 0; ti < IN_OUT_ACL_N_TABLES; ti++)
     {
       if (acl[ti] == ~0)
 	continue;
@@ -78,12 +85,14 @@ vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
 	return VNET_API_ERROR_NO_SUCH_TABLE;
 
       vec_validate_init_empty
-	(am->classify_table_index_by_sw_if_index[ti], sw_if_index, ~0);
+	(am->classify_table_index_by_sw_if_index[is_output][ti], sw_if_index,
+	 ~0);
 
       /* Reject any DEL operation with wrong sw_if_index */
       if (!is_add &&
 	  (acl[ti] !=
-	   am->classify_table_index_by_sw_if_index[ti][sw_if_index]))
+	   am->classify_table_index_by_sw_if_index[is_output][ti]
+	   [sw_if_index]))
 	{
 	  clib_warning
 	    ("Non-existent intf_idx=%d with table_index=%d for delete",
@@ -93,23 +102,49 @@ vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
 
       /* Return ok on ADD operaton if feature is already enabled */
       if (is_add &&
-	  am->classify_table_index_by_sw_if_index[ti][sw_if_index] != ~0)
+	  am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index]
+	  != ~0)
 	return 0;
 
-      vnet_inacl_ip_feature_enable (vm, am, sw_if_index, ti, is_add);
+      vnet_in_out_acl_ip_feature_enable (vm, am, sw_if_index, ti, is_add,
+					 is_output);
 
       if (is_add)
-	am->classify_table_index_by_sw_if_index[ti][sw_if_index] = acl[ti];
+	am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] =
+	  acl[ti];
       else
-	am->classify_table_index_by_sw_if_index[ti][sw_if_index] = ~0;
+	am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] =
+	  ~0;
     }
 
   return 0;
 }
 
+int
+vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+			  u32 ip4_table_index,
+			  u32 ip6_table_index, u32 l2_table_index, u32 is_add)
+{
+  return vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index,
+				    ip6_table_index, l2_table_index, is_add,
+				    IN_OUT_ACL_INPUT_TABLE_GROUP);
+}
+
+int
+vnet_set_output_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+			   u32 ip4_table_index,
+			   u32 ip6_table_index, u32 l2_table_index,
+			   u32 is_add)
+{
+  return vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index,
+				    ip6_table_index, l2_table_index, is_add,
+				    IN_OUT_ACL_OUTPUT_TABLE_GROUP);
+}
+
 static clib_error_t *
-set_input_acl_command_fn (vlib_main_t * vm,
-			  unformat_input_t * input, vlib_cli_command_t * cmd)
+set_in_out_acl_command_fn (vlib_main_t * vm,
+			   unformat_input_t * input, vlib_cli_command_t * cmd,
+			   u32 is_output)
 {
   vnet_main_t *vnm = vnet_get_main ();
   u32 sw_if_index = ~0;
@@ -146,8 +181,9 @@ set_input_acl_command_fn (vlib_main_t * vm,
   if (idx_cnt > 1)
     return clib_error_return (0, "Only one table index per API is allowed.");
 
-  rv = vnet_set_input_acl_intfc (vm, sw_if_index, ip4_table_index,
-				 ip6_table_index, l2_table_index, is_add);
+  rv = vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index,
+				  ip6_table_index, l2_table_index, is_add,
+				  is_output);
 
   switch (rv)
     {
@@ -163,8 +199,24 @@ set_input_acl_command_fn (vlib_main_t * vm,
   return 0;
 }
 
+static clib_error_t *
+set_input_acl_command_fn (vlib_main_t * vm,
+			  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  return set_in_out_acl_command_fn (vm, input, cmd,
+				    IN_OUT_ACL_INPUT_TABLE_GROUP);
+}
+
+static clib_error_t *
+set_output_acl_command_fn (vlib_main_t * vm,
+			   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  return set_in_out_acl_command_fn (vm, input, cmd,
+				    IN_OUT_ACL_OUTPUT_TABLE_GROUP);
+}
+
 /*
- * Configure interface to enable/disble input ACL feature:
+ * Configure interface to enable/disble input/output ACL features:
  * intfc - interface name to be configured as input ACL
  * Ip4-table <index> [del] - enable/disable IP4 input ACL
  * Ip6-table <index> [del] - enable/disable IP6 input ACL
@@ -181,15 +233,22 @@ VLIB_CLI_COMMAND (set_input_acl_command, static) = {
     "  [ip6-table <index>] [l2-table <index>] [del]",
     .function = set_input_acl_command_fn,
 };
+VLIB_CLI_COMMAND (set_output_acl_command, static) = {
+    .path = "set interface output acl",
+    .short_help =
+    "set interface output acl intfc <int> [ip4-table <index>]\n"
+    "  [ip6-table <index>] [l2-table <index>] [del]",
+    .function = set_output_acl_command_fn,
+};
 /* *INDENT-ON* */
 
 clib_error_t *
-input_acl_init (vlib_main_t * vm)
+in_out_acl_init (vlib_main_t * vm)
 {
-  input_acl_main_t *am = &input_acl_main;
+  in_out_acl_main_t *am = &in_out_acl_main;
   clib_error_t *error = 0;
 
-  if ((error = vlib_call_init_function (vm, ip_inacl_init)))
+  if ((error = vlib_call_init_function (vm, ip_in_out_acl_init)))
     return error;
 
   am->vlib_main = vm;
@@ -199,22 +258,22 @@ input_acl_init (vlib_main_t * vm)
   return 0;
 }
 
-VLIB_INIT_FUNCTION (input_acl_init);
+VLIB_INIT_FUNCTION (in_out_acl_init);
 
 uword
 unformat_acl_type (unformat_input_t * input, va_list * args)
 {
   u32 *acl_type = va_arg (*args, u32 *);
-  u32 tid = INPUT_ACL_N_TABLES;
+  u32 tid = IN_OUT_ACL_N_TABLES;
 
   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
     {
       if (unformat (input, "ip4"))
-	tid = INPUT_ACL_TABLE_IP4;
+	tid = IN_OUT_ACL_TABLE_IP4;
       else if (unformat (input, "ip6"))
-	tid = INPUT_ACL_TABLE_IP6;
+	tid = IN_OUT_ACL_TABLE_IP6;
       else if (unformat (input, "l2"))
-	tid = INPUT_ACL_TABLE_L2;
+	tid = IN_OUT_ACL_TABLE_L2;
       else
 	break;
     }
@@ -224,9 +283,9 @@ unformat_acl_type (unformat_input_t * input, va_list * args)
 }
 
 u8 *
-format_vnet_inacl_info (u8 * s, va_list * va)
+format_vnet_in_out_acl_info (u8 * s, va_list * va)
 {
-  input_acl_main_t *am = va_arg (*va, input_acl_main_t *);
+  in_out_acl_main_t *am = va_arg (*va, in_out_acl_main_t *);
   int sw_if_idx = va_arg (*va, int);
   u32 tid = va_arg (*va, u32);
 
@@ -244,11 +303,12 @@ format_vnet_inacl_info (u8 * s, va_list * va)
 }
 
 static clib_error_t *
-show_inacl_command_fn (vlib_main_t * vm,
-		       unformat_input_t * input, vlib_cli_command_t * cmd)
+show_in_out_acl_command_fn (vlib_main_t * vm,
+			    unformat_input_t * input,
+			    vlib_cli_command_t * cmd, u32 is_output)
 {
-  input_acl_main_t *am = &input_acl_main;
-  u32 type = INPUT_ACL_N_TABLES;
+  in_out_acl_main_t *am = &in_out_acl_main;
+  u32 type = IN_OUT_ACL_N_TABLES;
   int i;
   u32 *vec_tbl;
 
@@ -260,34 +320,58 @@ show_inacl_command_fn (vlib_main_t * vm,
 	break;
     }
 
-  if (type == INPUT_ACL_N_TABLES)
-    return clib_error_return (0, "Invalid input ACL table type.");
+  if (type == IN_OUT_ACL_N_TABLES)
+    return clib_error_return (0, is_output ? "Invalid output ACL table type."
+			      : "Invalid input ACL table type.");
 
-  vec_tbl = am->classify_table_index_by_sw_if_index[type];
+  vec_tbl = am->classify_table_index_by_sw_if_index[is_output][type];
 
   if (vec_len (vec_tbl))
-    vlib_cli_output (vm, "%U", format_vnet_inacl_info, am, ~0 /* hdr */ , ~0);
+    vlib_cli_output (vm, "%U", format_vnet_in_out_acl_info, am, ~0 /* hdr */ ,
+		     ~0);
   else
-    vlib_cli_output (vm, "No input ACL tables configured");
+    vlib_cli_output (vm, is_output ? "No output ACL tables configured"
+		     : "No input ACL tables configured");
 
   for (i = 0; i < vec_len (vec_tbl); i++)
     {
       if (vec_elt (vec_tbl, i) == ~0)
 	continue;
 
-      vlib_cli_output (vm, "%U", format_vnet_inacl_info,
+      vlib_cli_output (vm, "%U", format_vnet_in_out_acl_info,
 		       am, i, vec_elt (vec_tbl, i));
     }
 
   return 0;
 }
 
+static clib_error_t *
+show_inacl_command_fn (vlib_main_t * vm,
+		       unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  return show_in_out_acl_command_fn (vm, input, cmd,
+				     IN_OUT_ACL_INPUT_TABLE_GROUP);
+}
+
+static clib_error_t *
+show_outacl_command_fn (vlib_main_t * vm,
+			unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  return show_in_out_acl_command_fn (vm, input, cmd,
+				     IN_OUT_ACL_OUTPUT_TABLE_GROUP);
+}
+
 /* *INDENT-OFF* */
 VLIB_CLI_COMMAND (show_inacl_command, static) = {
     .path = "show inacl",
     .short_help = "show inacl type [ip4|ip6|l2]",
     .function = show_inacl_command_fn,
 };
+VLIB_CLI_COMMAND (show_outacl_command, static) = {
+    .path = "show outacl",
+    .short_help = "show outacl type [ip4|ip6|l2]",
+    .function = show_outacl_command_fn,
+};
 /* *INDENT-ON* */
 
 /*
diff --git a/src/vnet/classify/input_acl.h b/src/vnet/classify/in_out_acl.h
index a5f3bac6b99..be0323055d8 100644
--- a/src/vnet/classify/input_acl.h
+++ b/src/vnet/classify/in_out_acl.h
@@ -13,8 +13,8 @@
  * limitations under the License.
  */
 
-#ifndef __included_vnet_input_acl_h__
-#define __included_vnet_input_acl_h__
+#ifndef __included_vnet_in_out_acl_h__
+#define __included_vnet_in_out_acl_h__
 
 #include <vlib/vlib.h>
 #include <vnet/vnet.h>
@@ -22,39 +22,59 @@
 
 typedef enum
 {
-  INPUT_ACL_TABLE_IP4,
-  INPUT_ACL_TABLE_IP6,
-  INPUT_ACL_TABLE_L2,
-  INPUT_ACL_N_TABLES,
-} input_acl_table_id_t;
-
-typedef enum
-{
   ACL_NEXT_INDEX_DENY,
   ACL_NEXT_INDEX_N_NEXT,
 } acl_next_index_t;
 
+typedef enum
+{
+  IN_OUT_ACL_TABLE_IP4,
+  IN_OUT_ACL_TABLE_IP6,
+  IN_OUT_ACL_TABLE_L2,
+  IN_OUT_ACL_N_TABLES,
+} in_out_acl_table_id_t;
+
+typedef enum
+{
+  IN_OUT_ACL_INPUT_TABLE_GROUP,
+  IN_OUT_ACL_OUTPUT_TABLE_GROUP,
+  IN_OUT_ACL_N_TABLE_GROUPS
+} in_out_acl_table_group_id_t;
+
 typedef struct
 {
 
   /* classifier table vectors */
-  u32 *classify_table_index_by_sw_if_index[INPUT_ACL_N_TABLES];
+  u32
+    * classify_table_index_by_sw_if_index[IN_OUT_ACL_N_TABLE_GROUPS]
+    [IN_OUT_ACL_N_TABLES];
 
   /* convenience variables */
   vlib_main_t *vlib_main;
   vnet_main_t *vnet_main;
   vnet_classify_main_t *vnet_classify_main;
-  vnet_config_main_t *vnet_config_main[INPUT_ACL_N_TABLES];
-} input_acl_main_t;
+    vnet_config_main_t
+    * vnet_config_main[IN_OUT_ACL_N_TABLE_GROUPS][IN_OUT_ACL_N_TABLES];
+} in_out_acl_main_t;
 
-extern input_acl_main_t input_acl_main;
+extern in_out_acl_main_t in_out_acl_main;
+
+int vnet_set_in_out_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+			       u32 ip4_table_index,
+			       u32 ip6_table_index,
+			       u32 l2_table_index, u32 is_add, u32 is_output);
 
 int vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
 			      u32 ip4_table_index,
 			      u32 ip6_table_index,
 			      u32 l2_table_index, u32 is_add);
 
-#endif /* __included_vnet_input_acl_h__ */
+int vnet_set_output_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+			       u32 ip4_table_index,
+			       u32 ip6_table_index,
+			       u32 l2_table_index, u32 is_add);
+
+#endif /* __included_vnet_in_out_acl_h__ */
 
 /*
  * fd.io coding-style-patch-verification: ON
diff --git a/src/vnet/classify/vnet_classify.c b/src/vnet/classify/vnet_classify.c
index ef45d1a4167..d287a2d39cf 100644
--- a/src/vnet/classify/vnet_classify.c
+++ b/src/vnet/classify/vnet_classify.c
@@ -13,7 +13,7 @@
  * limitations under the License.
  */
 #include <vnet/classify/vnet_classify.h>
-#include <vnet/classify/input_acl.h>
+#include <vnet/classify/in_out_acl.h>
 #include <vnet/ip/ip.h>
 #include <vnet/api_errno.h>	/* for API error numbers */
 #include <vnet/l2/l2_classify.h>	/* for L2_INPUT_CLASSIFY_NEXT_xxx */
diff --git a/src/vnet/classify/vnet_classify.h b/src/vnet/classify/vnet_classify.h
index 40628015501..79e7f1a844e 100644
--- a/src/vnet/classify/vnet_classify.h
+++ b/src/vnet/classify/vnet_classify.h
@@ -27,6 +27,7 @@
 #include <vnet/ip/ip6_packet.h>
 #include <vlib/cli.h>
 #include <vnet/l2/l2_input.h>
+#include <vnet/l2/l2_output.h>
 #include <vnet/l2/feat_bitmap.h>
 #include <vnet/api_errno.h>	/* for API error numbers */