geneve gtpu vxlan vxlan-gpe: VRF-aware bypass node

Bypass node MUST NOT intercept a packet if destination IP doesn’t match
a local address.  However IP address interpretation depends on the VRF,
hence bypass node must take that into account.

This patch also factors-out common VTEP management and checking code.

Type: improvement
Signed-off-by: Nick Zavaritsky <nick.zavaritsky@emnify.com>
Change-Id: I5665d94882bbf45d15f8da140c7ada528ec7fa94

3 files changed, 27 insertions, 76 deletions

diff --git a/src/vnet/geneve/decap.c b/src/vnet/geneve/decap.c
index e30a56c0327..a04c1d41e90 100644
--- a/src/vnet/geneve/decap.c
+++ b/src/vnet/geneve/decap.c
@@ -865,8 +865,10 @@ ip_geneve_bypass_inline (vlib_main_t * vm,
   u32 *from, *to_next, n_left_from, n_left_to_next, next_index;
   vlib_node_runtime_t *error_node =
     vlib_node_get_runtime (vm, ip4_input_node.index);
-  ip4_address_t addr4;		/* last IPv4 address matching a local VTEP address */
-  ip6_address_t addr6;		/* last IPv6 address matching a local VTEP address */
+  vtep4_key_t last_vtep4;	/* last IPv4 address / fib index
+				   matching a local VTEP address */
+  vtep6_key_t last_vtep6;	/* last IPv6 address / fib index
+				   matching a local VTEP address */
 
   from = vlib_frame_vector_args (frame);
   n_left_from = frame->n_vectors;
@@ -876,9 +878,9 @@ ip_geneve_bypass_inline (vlib_main_t * vm,
     ip4_forward_next_trace (vm, node, frame, VLIB_TX);
 
   if (is_ip4)
-    addr4.data_u32 = ~0;
+    vtep4_key_init (&last_vtep4);
   else
-    ip6_address_set_zero (&addr6);
+    vtep6_key_init (&last_vtep6);
 
   while (n_left_from > 0)
     {
@@ -962,21 +964,13 @@ ip_geneve_bypass_inline (vlib_main_t * vm,
 	  /* Validate DIP against VTEPs */
 	  if (is_ip4)
 	    {
-	      if (addr4.as_u32 != ip40->dst_address.as_u32)
-		{
-		  if (!hash_get (vxm->vtep4, ip40->dst_address.as_u32))
-		    goto exit0;	/* no local VTEP for GENEVE packet */
-		  addr4 = ip40->dst_address;
-		}
+	      if (!vtep4_check (&vxm->vtep_table, b0, ip40, &last_vtep4))
+		goto exit0;	/* no local VTEP for GENEVE packet */
 	    }
 	  else
 	    {
-	      if (!ip6_address_is_equal (&addr6, &ip60->dst_address))
-		{
-		  if (!hash_get_mem (vxm->vtep6, &ip60->dst_address))
-		    goto exit0;	/* no local VTEP for GENEVE packet */
-		  addr6 = ip60->dst_address;
-		}
+	      if (!vtep6_check (&vxm->vtep_table, b0, ip60, &last_vtep6))
+		goto exit0;	/* no local VTEP for GENEVE packet */
 	    }
 
 	  flags0 = b0->flags;
@@ -1048,21 +1042,13 @@ ip_geneve_bypass_inline (vlib_main_t * vm,
 	  /* Validate DIP against VTEPs */
 	  if (is_ip4)
 	    {
-	      if (addr4.as_u32 != ip41->dst_address.as_u32)
-		{
-		  if (!hash_get (vxm->vtep4, ip41->dst_address.as_u32))
-		    goto exit1;	/* no local VTEP for GENEVE packet */
-		  addr4 = ip41->dst_address;
-		}
+	      if (!vtep4_check (&vxm->vtep_table, b1, ip41, &last_vtep4))
+		goto exit1;	/* no local VTEP for GENEVE packet */
 	    }
 	  else
 	    {
-	      if (!ip6_address_is_equal (&addr6, &ip61->dst_address))
-		{
-		  if (!hash_get_mem (vxm->vtep6, &ip61->dst_address))
-		    goto exit1;	/* no local VTEP for GENEVE packet */
-		  addr6 = ip61->dst_address;
-		}
+	      if (!vtep6_check (&vxm->vtep_table, b1, ip61, &last_vtep6))
+		goto exit1;	/* no local VTEP for GENEVE packet */
 	    }
 
 	  flags1 = b1->flags;
@@ -1170,21 +1156,13 @@ ip_geneve_bypass_inline (vlib_main_t * vm,
 	  /* Validate DIP against VTEPs */
 	  if (is_ip4)
 	    {
-	      if (addr4.as_u32 != ip40->dst_address.as_u32)
-		{
-		  if (!hash_get (vxm->vtep4, ip40->dst_address.as_u32))
-		    goto exit;	/* no local VTEP for GENEVE packet */
-		  addr4 = ip40->dst_address;
-		}
+	      if (!vtep4_check (&vxm->vtep_table, b0, ip40, &last_vtep4))
+		goto exit;	/* no local VTEP for GENEVE packet */
 	    }
 	  else
 	    {
-	      if (!ip6_address_is_equal (&addr6, &ip60->dst_address))
-		{
-		  if (!hash_get_mem (vxm->vtep6, &ip60->dst_address))
-		    goto exit;	/* no local VTEP for GENEVE packet */
-		  addr6 = ip60->dst_address;
-		}
+	      if (!vtep6_check (&vxm->vtep_table, b0, ip60, &last_vtep6))
+		goto exit;	/* no local VTEP for GENEVE packet */
 	    }
 
 	  flags0 = b0->flags;
diff --git a/src/vnet/geneve/geneve.c b/src/vnet/geneve/geneve.c
index 501ab7f9845..52664b389a4 100644
--- a/src/vnet/geneve/geneve.c
+++ b/src/vnet/geneve/geneve.c
@@ -292,35 +292,6 @@ geneve_decap_next_is_valid (geneve_main_t * vxm, u32 is_ip6,
   return decap_next_index < r->n_next_nodes;
 }
 
-static uword
-vtep_addr_ref (ip46_address_t * ip)
-{
-  uword *vtep = ip46_address_is_ip4 (ip) ?
-    hash_get (geneve_main.vtep4, ip->ip4.as_u32) :
-    hash_get_mem (geneve_main.vtep6, &ip->ip6);
-  if (vtep)
-    return ++(*vtep);
-  ip46_address_is_ip4 (ip) ?
-    hash_set (geneve_main.vtep4, ip->ip4.as_u32, 1) :
-    hash_set_mem_alloc (&geneve_main.vtep6, &ip->ip6, 1);
-  return 1;
-}
-
-static uword
-vtep_addr_unref (ip46_address_t * ip)
-{
-  uword *vtep = ip46_address_is_ip4 (ip) ?
-    hash_get (geneve_main.vtep4, ip->ip4.as_u32) :
-    hash_get_mem (geneve_main.vtep6, &ip->ip6);
-  ALWAYS_ASSERT (vtep);
-  if (--(*vtep) != 0)
-    return *vtep;
-  ip46_address_is_ip4 (ip) ?
-    hash_unset (geneve_main.vtep4, ip->ip4.as_u32) :
-    hash_unset_mem_free (&geneve_main.vtep6, &ip->ip6);
-  return 0;
-}
-
 typedef CLIB_PACKED (union
 		     {
 		     struct
@@ -498,7 +469,7 @@ int vnet_geneve_add_del_tunnel
 	   * when the forwarding for the entry updates, and the tunnel can
 	   * re-stack accordingly
 	   */
-	  vtep_addr_ref (&t->local);
+	  vtep_addr_ref (&vxm->vtep_table, t->encap_fib_index, &t->local);
 	  t->fib_entry_index = fib_entry_track (t->encap_fib_index,
 						&tun_remote_pfx,
 						FIB_NODE_TYPE_GENEVE_TUNNEL,
@@ -515,7 +486,8 @@ int vnet_geneve_add_del_tunnel
 	   */
 	  fib_protocol_t fp = fib_ip_proto (is_ip6);
 
-	  if (vtep_addr_ref (&t->remote) == 1)
+	  if (vtep_addr_ref (&vxm->vtep_table,
+			     t->encap_fib_index, &t->remote) == 1)
 	    {
 	      fib_node_index_t mfei;
 	      adj_index_t ai;
@@ -604,10 +576,11 @@ int vnet_geneve_add_del_tunnel
 
       if (!ip46_address_is_multicast (&t->remote))
 	{
-	  vtep_addr_unref (&t->local);
+	  vtep_addr_unref (&vxm->vtep_table, t->encap_fib_index, &t->local);
 	  fib_entry_untrack (t->fib_entry_index, t->sibling_index);
 	}
-      else if (vtep_addr_unref (&t->remote) == 0)
+      else if (vtep_addr_unref (&vxm->vtep_table,
+				t->encap_fib_index, &t->remote) == 0)
 	{
 	  mcast_shared_remove (&t->remote);
 	}
@@ -1118,7 +1091,7 @@ geneve_init (vlib_main_t * vm)
   vxm->geneve6_tunnel_by_key = hash_create_mem (0,
 						sizeof (geneve6_tunnel_key_t),
 						sizeof (uword));
-  vxm->vtep6 = hash_create_mem (0, sizeof (ip6_address_t), sizeof (uword));
+  vxm->vtep_table = vtep_table_create ();
   vxm->mcast_shared = hash_create_mem (0,
 				       sizeof (ip46_address_t),
 				       sizeof (mcast_shared_t));
diff --git a/src/vnet/geneve/geneve.h b/src/vnet/geneve/geneve.h
index 3bb9083fbd5..491ae23242f 100644
--- a/src/vnet/geneve/geneve.h
+++ b/src/vnet/geneve/geneve.h
@@ -19,6 +19,7 @@
 #include <vppinfra/hash.h>
 #include <vnet/vnet.h>
 #include <vnet/ip/ip.h>
+#include <vnet/ip/vtep.h>
 #include <vnet/l2/l2_input.h>
 #include <vnet/l2/l2_output.h>
 #include <vnet/l2/l2_bd.h>
@@ -167,8 +168,7 @@ typedef struct
 
   /* local VTEP IPs ref count used by geneve-bypass node to check if
      received GENEVE packet DIP matches any local VTEP address */
-  uword *vtep4;			/* local ip4 VTEPs keyed on their ip4 addr */
-  uword *vtep6;			/* local ip6 VTEPs keyed on their ip6 addr */
+  vtep_table_t vtep_table;
 
   /* mcast shared info */
   uword *mcast_shared;		/* keyed on mcast ip46 addr */