classifier-based ACL: refactor + add output ACL - vpp

diff options

author	Andrew Yourtchenko <ayourtch@gmail.com>	2018-02-07 11:37:02 +0100
committer	John Lo <loj@cisco.com>	2018-02-07 18:01:09 +0000
commit	815d7d5637fbffd20bf81c74fd59dac8e4fe4d94 (patch)
tree	2e7fef7406a2df664b8d3e16d9336e6d59a255ab /src/vnet/ip/ip6_error.h
parent	dac03527f64216e132953a1a1d47b414e6841c68 (diff)

classifier-based ACL: refactor + add output ACL

For implementation of MACIP ACLs enhancement (VPP-1088), an outbound classifier-based ACL would be needed. There was an existing incomplete code for outbound ACLs, it looked almost exact copy of input ACLs, minus the various enhancements, trying to sync that code seemed error-prone and cumbersome to maintain in the longer run. This change refactors the input+output ACLs processing into a unified routine (thus any changes will have effect on both), and also adds the API to set the output interface ACL, with the same format and semantics as the existing input one (except working on output ACL of course). WARNING: IP outbound ACL in L3 mode clobbers the ip.* fields in the vnet_buffer_opaque_t, since the code is using l2_classify.* The net_buffer (p0)->ip.save_rewrite_length is rescued into l2_classify.pad.l2_len, and used to rewind the header in case of drop, so that ipX_drop prints something sensible. Change-Id: I62f814f1e3650e504474a3a5359edb8a0a8836ed Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

Diffstat (limited to 'src/vnet/ip/ip6_error.h')

-rw-r--r--

src/vnet/ip/ip6_error.h

1 files changed, 3 insertions, 0 deletions

/* * Copyright (c) 2015 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /* Copyright (c) 2001, 2002, 2003 Eliot Dresselhaus Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ #ifndef included_mheap_h #define included_mheap_h #if USE_DLMALLOC == 0 #include <vppinfra/vec.h> #include <vppinfra/error.h> /* clib_error_t */ #include <vppinfra/mem.h> /* clib_mem_usage_t */ #include <vppinfra/format.h> /* for unformat_input_t */ /* Allocate size bytes. New heap and offset are returned. offset == ~0 means allocation failed. */ always_inline void * mheap_get (void *v, uword size, uword * offset_return) { return mheap_get_aligned (v, size, 0, 0, offset_return); } /* Create allocation heap of given size. * The actual usable size is smaller than the requested size. * memory_bytes must be greater than mheap_page_size + sizeof (mheap_t) + 16. * Otherwise, allocation may fail and return 0. */ void *mheap_alloc (void *memory, uword memory_bytes); void *mheap_alloc_with_flags (void *memory, uword memory_bytes, uword flags); void *mheap_alloc_with_lock (void *memory, uword size, int locked); #define mheap_free(v) (v) = _mheap_free(v) void *_mheap_free (void *v); void mheap_foreach (void *v, uword (*func) (void *arg, void *v, void *elt_data, uword elt_size), void *arg); /* Format mheap data structures as string. */ u8 *format_mheap (u8 * s, va_list * va); /* Validate internal consistency. */ void mheap_validate (void *h); /* Query bytes used. */ uword mheap_bytes (void *v); void mheap_usage (void *v, clib_mem_usage_t * usage); /* Enable disable tracing. */ void mheap_trace (void *v, int enable); /* Test routine. */ int test_mheap_main (unformat_input_t * input); #else /* USE_DLMALLOC */ /* Format mheap data structures as string. */ u8 *format_mheap (u8 * s, va_list * va); void *mheap_alloc_with_lock (void *memory, uword size, int locked); #endif /* USE_DLMALLOC */ #endif /* included_mheap_h */ /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */


context:
space:
mode: