diff options
32 files changed, 765 insertions, 115 deletions
diff --git a/plugins/ila-plugin/ila/ila.c b/plugins/ila-plugin/ila/ila.c index 029dd219467..90dde5f25af 100644 --- a/plugins/ila-plugin/ila/ila.c +++ b/plugins/ila-plugin/ila/ila.c @@ -752,7 +752,7 @@ ila_add_del_entry (ila_add_del_entry_args_t * args) /* * Create a route that results in the ILA entry */ - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; fib_prefix_t pfx = { .fp_addr = { .ip6 = e->ila_address, diff --git a/plugins/lb-plugin/lb/lb.c b/plugins/lb-plugin/lb/lb.c index 69bd660aba3..1d9b987095b 100644 --- a/plugins/lb-plugin/lb/lb.c +++ b/plugins/lb-plugin/lb/lb.c @@ -594,7 +594,7 @@ int lb_vip_del_ass(u32 vip_index, ip46_address_t *addresses, u32 n) static void lb_vip_add_adjacency(lb_main_t *lbm, lb_vip_t *vip) { dpo_proto_t proto = 0; - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; fib_prefix_t pfx = {}; if (lb_vip_is_ip4(vip)) { pfx.fp_addr.ip4 = vip->prefix.ip4; diff --git a/plugins/sixrd-plugin/sixrd/sixrd.c b/plugins/sixrd-plugin/sixrd/sixrd.c index 65d353a4592..cdc0c880356 100644 --- a/plugins/sixrd-plugin/sixrd/sixrd.c +++ b/plugins/sixrd-plugin/sixrd/sixrd.c @@ -40,7 +40,7 @@ sixrd_create_domain (ip6_address_t *ip6_prefix, u32 *sixrd_domain_index, u16 mtu) { - dpo_id_t dpo_v6 = DPO_NULL, dpo_v4 = DPO_NULL; + dpo_id_t dpo_v6 = DPO_INVALID, dpo_v4 = DPO_INVALID; sixrd_main_t *mm = &sixrd_main; fib_node_index_t fei; sixrd_domain_t *d; @@ -94,7 +94,7 @@ sixrd_create_domain (ip6_address_t *ip6_prefix, if (FIB_NODE_INDEX_INVALID != fei) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; if (fib_entry_get_dpo_for_source (fei, FIB_SOURCE_SIXRD, &dpo)) { diff --git a/vnet/Makefile.am b/vnet/Makefile.am index bff8418fb6e..56baf40715b 100644 --- a/vnet/Makefile.am +++ b/vnet/Makefile.am @@ -805,6 +805,7 @@ nobase_include_HEADERS += \ libvnet_la_SOURCES += \ vnet/dpo/dpo.c \ vnet/dpo/drop_dpo.c \ + vnet/dpo/ip_null_dpo.c \ vnet/dpo/punt_dpo.c \ vnet/dpo/receive_dpo.c \ vnet/dpo/load_balance.c \ @@ -820,6 +821,7 @@ nobase_include_HEADERS += \ vnet/dpo/punt_dpo.h \ vnet/dpo/classify_dpo.h \ vnet/dpo/receive_dpo.h \ + vnet/dpo/ip_null_dpo.h \ vnet/dpo/dpo.h ######################################## diff --git a/vnet/vnet/dpo/dpo.c b/vnet/vnet/dpo/dpo.c index 9f09dff81d1..efee6d6b4eb 100644 --- a/vnet/vnet/dpo/dpo.c +++ b/vnet/vnet/dpo/dpo.c @@ -35,6 +35,7 @@ #include <vnet/dpo/receive_dpo.h> #include <vnet/dpo/punt_dpo.h> #include <vnet/dpo/classify_dpo.h> +#include <vnet/dpo/ip_null_dpo.h> /** * Array of char* names for the DPO types and protos @@ -342,7 +343,7 @@ dpo_stack_i (u32 edge, * in order to get an atomic update of the parent we create a temporary, * from a copy of the child, and add the next_node. then we copy to the parent */ - dpo_id_t tmp = DPO_NULL; + dpo_id_t tmp = DPO_INVALID; dpo_copy(&tmp, parent); /* @@ -417,6 +418,7 @@ dpo_module_init (vlib_main_t * vm) mpls_label_dpo_module_init(); classify_dpo_module_init(); lookup_dpo_module_init(); + ip_null_dpo_module_init(); return (NULL); } diff --git a/vnet/vnet/dpo/dpo.h b/vnet/vnet/dpo/dpo.h index 7ba47569d8d..2ab936e5f00 100644 --- a/vnet/vnet/dpo/dpo.h +++ b/vnet/vnet/dpo/dpo.h @@ -94,6 +94,7 @@ typedef enum dpo_type_t_ { */ DPO_FIRST, DPO_DROP, + DPO_IP_NULL, DPO_PUNT, /** * @brief load-balancing over a choice of [un]equal cost paths @@ -116,6 +117,7 @@ typedef enum dpo_type_t_ { #define DPO_TYPES { \ [DPO_FIRST] = "dpo-invalid", \ [DPO_DROP] = "dpo-drop", \ + [DPO_IP_NULL] = "dpo-ip-null", \ [DPO_PUNT] = "dpo-punt", \ [DPO_ADJACENCY] = "dpo-adjacency", \ [DPO_ADJACENCY_INCOMPLETE] = "dpo-adjacency-incomplete", \ @@ -126,7 +128,7 @@ typedef enum dpo_type_t_ { [DPO_LOAD_BALANCE] = "dpo-load-balance", \ [DPO_LISP_CP] = "dpo-lisp-cp", \ [DPO_CLASSIFY] = "dpo-classify", \ - [DPO_MPLS_LABEL] = "dpo-mpls-label", \ + [DPO_MPLS_LABEL] = "dpo-mpls-label" \ } /** @@ -159,7 +161,7 @@ _Static_assert(sizeof(dpo_id_t) <= sizeof(u64), /** * @brief An initialiser for DPos declared on the stack. */ -#define DPO_NULL {0} +#define DPO_INVALID {0} /** * @brief Return true if the DPO object is valid, i.e. has been initialised. diff --git a/vnet/vnet/dpo/drop_dpo.h b/vnet/vnet/dpo/drop_dpo.h index e7bd8f5156e..436df36c84e 100644 --- a/vnet/vnet/dpo/drop_dpo.h +++ b/vnet/vnet/dpo/drop_dpo.h @@ -13,14 +13,8 @@ * limitations under the License. */ /** - * @brief - * A Data-Path Object is an object that represents actions that are - * applied to packets are they are switched through VPP. - * - * The DPO is a base class that is specialised by other objects to provide - * concreate actions - * - * The VLIB graph nodes are graph of types, the DPO graph is a graph of instances. + * @brief The Drop DPO will drop all packets, no questions asked. It is valid + * for any packet protocol. */ #ifndef __DROP_DPO_H__ diff --git a/vnet/vnet/dpo/ip_null_dpo.c b/vnet/vnet/dpo/ip_null_dpo.c new file mode 100644 index 00000000000..22682e4eee4 --- /dev/null +++ b/vnet/vnet/dpo/ip_null_dpo.c @@ -0,0 +1,408 @@ +/* + * Copyright (c) 2016 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/** + * @brief + * The data-path object representing dropping the packet + */ + +#include <vnet/dpo/ip_null_dpo.h> +#include <vnet/ip/ip.h> + +/** + * @brief A representation of the IP_NULL DPO + */ +typedef struct ip_null_dpo_t_ +{ + /** + * @brief The action to take on a packet + */ + ip_null_dpo_action_t ind_action; + /** + * @brief The next VLIB node + */ + u32 ind_next_index; + /** + * rate limits + */ +} ip_null_dpo_t; + +/** + * @brief the IP_NULL dpos are shared by all routes, hence they are global. + * As the neame implies this is only for IP, hence 2. + */ +static ip_null_dpo_t ip_null_dpos[2 * IP_NULL_DPO_ACTION_NUM] = { + [0] = { + /* proto ip4, no action */ + .ind_action = IP_NULL_ACTION_NONE, + }, + [1] = { + /* proto ip4, action send unreach */ + .ind_action = IP_NULL_ACTION_SEND_ICMP_UNREACH, + }, + [2] = { + /* proto ip4, action send unreach */ + .ind_action = IP_NULL_ACTION_SEND_ICMP_PROHIBIT, + }, + [3] = { + /* proto ip6, no action */ + .ind_action = IP_NULL_ACTION_NONE, + }, + [4] = { + /* proto ip6, action send unreach */ + .ind_action = IP_NULL_ACTION_SEND_ICMP_UNREACH, + }, + [5] = { + /* proto ip6, action send unreach */ + .ind_action = IP_NULL_ACTION_SEND_ICMP_PROHIBIT, + }, +}; + +/** + * @brief Action strings + */ +const char *ip_null_action_strings[] = IP_NULL_ACTIONS; + +void +ip_null_dpo_add_and_lock (dpo_proto_t proto, + ip_null_dpo_action_t action, + dpo_id_t *dpo) +{ + int i; + + ASSERT((proto == DPO_PROTO_IP4) || + (proto == DPO_PROTO_IP6)); + ASSERT(action < IP_NULL_DPO_ACTION_NUM); + + i = (proto == DPO_PROTO_IP4 ? 0 : 1); + + dpo_set(dpo, DPO_IP_NULL, proto, (i*IP_NULL_DPO_ACTION_NUM) + action); +} + +always_inline const ip_null_dpo_t* +ip_null_dpo_get (index_t indi) +{ + return (&ip_null_dpos[indi]); +} + +static void +ip_null_dpo_lock (dpo_id_t *dpo) +{ + /* + * not maintaining a lock count on the ip_null, they are const global and + * never die. + */ +} +static void +ip_null_dpo_unlock (dpo_id_t *dpo) +{ +} + +static u8* +format_ip_null_dpo (u8 *s, va_list *ap) +{ + index_t index = va_arg(*ap, index_t); + CLIB_UNUSED(u32 indent) = va_arg(*ap, u32); + const ip_null_dpo_t *ind; + dpo_proto_t proto; + + ind = ip_null_dpo_get(index); + proto = (index < IP_NULL_DPO_ACTION_NUM ? DPO_PROTO_IP4 : DPO_PROTO_IP6); + + return (format(s, "%U-null action:%s", + format_dpo_proto, proto, + ip_null_action_strings[ind->ind_action])); +} + +const static dpo_vft_t ip_null_vft = { + .dv_lock = ip_null_dpo_lock, + .dv_unlock = ip_null_dpo_unlock, + .dv_format = format_ip_null_dpo, +}; + +/** + * @brief The per-protocol VLIB graph nodes that are assigned to a ip_null + * object. + * + * this means that these graph nodes are ones from which a ip_null is the + * parent object in the DPO-graph. + */ +const static char* const ip4_null_nodes[] = +{ + "ip4-null", + NULL, +}; +const static char* const ip6_null_nodes[] = +{ + "ip6-null", + NULL, +}; + +const static char* const * const ip_null_nodes[DPO_PROTO_NUM] = +{ + [DPO_PROTO_IP4] = ip4_null_nodes, + [DPO_PROTO_IP6] = ip6_null_nodes, +}; + +typedef struct ip_null_dpo_trace_t_ +{ + index_t ind_index; +} ip_null_dpo_trace_t; + +/** + * @brief Exit nodes from a IP_NULL + */ +typedef enum ip_null_next_t_ +{ + IP_NULL_NEXT_DROP, + IP_NULL_NEXT_ICMP, + IP_NULL_NEXT_NUM, +} ip_null_next_t; + +always_inline uword +ip_null_dpo_switch (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame, + u8 is_ip4) +{ + u32 n_left_from, next_index, *from, *to_next; + static f64 time_last_seed_change = -1e100; + static u32 hash_seeds[3]; + static uword hash_bitmap[256 / BITS (uword)]; + f64 time_now; + + from = vlib_frame_vector_args (frame); + n_left_from = frame->n_vectors; + + time_now = vlib_time_now (vm); + if (time_now - time_last_seed_change > 1e-1) + { + uword i; + u32 * r = clib_random_buffer_get_data (&vm->random_buffer, + sizeof (hash_seeds)); + for (i = 0; i < ARRAY_LEN (hash_seeds); i++) + hash_seeds[i] = r[i]; + + /* Mark all hash keys as been not-seen before. */ + for (i = 0; i < ARRAY_LEN (hash_bitmap); i++) + hash_bitmap[i] = 0; + + time_last_seed_change = time_now; + } + + next_index = node->cached_next_index; + + while (n_left_from > 0) + { + u32 n_left_to_next; + + vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); + + while (n_left_from > 0 && n_left_to_next > 0) + { + u32 a0, b0, c0, m0, drop0; + vlib_buffer_t *p0; + u32 bi0, indi0, next0; + const ip_null_dpo_t *ind0; + uword bm0; + + bi0 = from[0]; + to_next[0] = bi0; + from += 1; + to_next += 1; + n_left_from -= 1; + n_left_to_next -= 1; + + p0 = vlib_get_buffer (vm, bi0); + + /* lookup dst + src mac */ + indi0 = vnet_buffer (p0)->ip.adj_index[VLIB_TX]; + ind0 = ip_null_dpo_get(indi0); + next0 = IP_NULL_NEXT_DROP; + + /* + * rate limit - don't DoS the sender. + */ + a0 = hash_seeds[0]; + b0 = hash_seeds[1]; + c0 = hash_seeds[2]; + + if (is_ip4) + { + ip4_header_t *ip0 = vlib_buffer_get_current (p0); + + a0 ^= ip0->dst_address.data_u32; + b0 ^= ip0->src_address.data_u32; + + hash_v3_finalize32 (a0, b0, c0); + } + else + { + ip6_header_t *ip0 = vlib_buffer_get_current (p0); + + a0 ^= ip0->dst_address.as_u32[0]; + b0 ^= ip0->src_address.as_u32[0]; + c0 ^= ip0->src_address.as_u32[1]; + + hash_v3_mix32 (a0, b0, c0); + + a0 ^= ip0->dst_address.as_u32[1]; + b0 ^= ip0->src_address.as_u32[2]; + c0 ^= ip0->src_address.as_u32[3]; + + hash_v3_finalize32 (a0, b0, c0); + } + + c0 &= BITS (hash_bitmap) - 1; + c0 = c0 / BITS (uword); + m0 = (uword) 1 << (c0 % BITS (uword)); + + bm0 = hash_bitmap[c0]; + drop0 = (bm0 & m0) != 0; + + /* Mark it as seen. */ + hash_bitmap[c0] = bm0 | m0; + + if (PREDICT_FALSE(!drop0)) + { + if (is_ip4) + { + /* + * There's a trade-off here. This conditinal statement + * versus a graph node per-condition. Given the number + * expect number of packets to reach a null route is 0 + * we favour the run-time cost over the graph complexity + */ + if (IP_NULL_ACTION_SEND_ICMP_UNREACH == ind0->ind_action) + { + next0 = IP_NULL_NEXT_ICMP; + icmp4_error_set_vnet_buffer( + p0, + ICMP4_destination_unreachable, + ICMP4_destination_unreachable_destination_unreachable_host, + 0); + } + else if (IP_NULL_ACTION_SEND_ICMP_PROHIBIT == ind0->ind_action) + { + next0 = IP_NULL_NEXT_ICMP; + icmp4_error_set_vnet_buffer( + p0, + ICMP4_destination_unreachable, + ICMP4_destination_unreachable_host_administratively_prohibited, + 0); + } + } + else + { + if (IP_NULL_ACTION_SEND_ICMP_UNREACH == ind0->ind_action) + { + next0 = IP_NULL_NEXT_ICMP; + icmp6_error_set_vnet_buffer( + p0, + ICMP6_destination_unreachable, + ICMP6_destination_unreachable_no_route_to_destination, + 0); + } + else if (IP_NULL_ACTION_SEND_ICMP_PROHIBIT == ind0->ind_action) + { + next0 = IP_NULL_NEXT_ICMP; + icmp6_error_set_vnet_buffer( + p0, + ICMP6_destination_unreachable, + ICMP6_destination_unreachable_destination_administratively_prohibited, + 0); + } + } + } + + if (PREDICT_FALSE (p0->flags & VLIB_BUFFER_IS_TRACED)) + { + ip_null_dpo_trace_t *tr = vlib_add_trace (vm, node, p0, + sizeof (*tr)); + tr->ind_index = indi0; + } + vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, + n_left_to_next, bi0, next0); + } + + vlib_put_next_frame (vm, node, next_index, n_left_to_next); + } + + return frame->n_vectors; +} + +static u8 * +format_ip_null_dpo_trace (u8 * s, va_list * args) +{ + CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); + CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); + ip_null_dpo_trace_t *t = va_arg (*args, ip_null_dpo_trace_t *); + + s = format (s, "%U", format_ip_null_dpo, t->ind_index, 0); + return s; +} + +static uword +ip4_null_dpo_switch (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (ip_null_dpo_switch(vm, node, frame, 1)); +} + +/** + * @brief + */ +VLIB_REGISTER_NODE (ip4_null_dpo_node) = { + .function = ip4_null_dpo_switch, + .name = "ip4-null", + .vector_size = sizeof (u32), + + .format_trace = format_ip_null_dpo_trace, + .n_next_nodes = IP_NULL_NEXT_NUM, + .next_nodes = { + [IP_NULL_NEXT_DROP] = "ip4-drop", + [IP_NULL_NEXT_ICMP] = "ip4-icmp-error", + }, +}; + +static uword +ip6_null_dpo_switch (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (ip_null_dpo_switch(vm, node, frame, 0)); +} + +/** + * @brief + */ +VLIB_REGISTER_NODE (ip6_null_dpo_node) = { + .function = ip6_null_dpo_switch, + .name = "ip6-null", + .vector_size = sizeof (u32), + + .format_trace = format_ip_null_dpo_trace, + .n_next_nodes = IP_NULL_NEXT_NUM, + .next_nodes = { + [IP_NULL_NEXT_DROP] = "ip6-drop", + [IP_NULL_NEXT_ICMP] = "ip6-icmp-error", + }, +}; + +void +ip_null_dpo_module_init (void) +{ + dpo_register(DPO_IP_NULL, &ip_null_vft, ip_null_nodes); +} diff --git a/vnet/vnet/dpo/ip_null_dpo.h b/vnet/vnet/dpo/ip_null_dpo.h new file mode 100644 index 00000000000..002a2a7016d --- /dev/null +++ b/vnet/vnet/dpo/ip_null_dpo.h @@ -0,0 +1,56 @@ +/* + * Copyright (c) 2016 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/** + * @brief + * The IP NULL DPO represents the rubbish bin for IP traffic. Without specifying an + * action (i.e. send IMCP type X to sender) it is equivalent to using a drop DPO. + * However, in contrast to the drop DPO any route that resovles via a NULL, is + * considered to 'resolved' by FIB, i.e. a IP NULL is used when the control plane + * is explicitly expressing the desire to drop packets. Drop DPOs are used + * internally by FIB when resolution is not possible. + * + * Any replies to sender are rate limited. + */ + +#ifndef __IP_NULL_DPO_H__ +#define __IP_NULL_DPO_H__ + +#include <vnet/dpo/dpo.h> + +/** + * @brief Actions to take when a packet encounters the NULL DPO + */ +typedef enum ip_null_dpo_action_t_ +{ + IP_NULL_ACTION_NONE, + IP_NULL_ACTION_SEND_ICMP_UNREACH, + IP_NULL_ACTION_SEND_ICMP_PROHIBIT, +} ip_null_dpo_action_t; + +#define IP_NULL_ACTIONS { \ + [IP_NULL_ACTION_NONE] = "discard", \ + [IP_NULL_ACTION_SEND_ICMP_UNREACH] = "send-unreachable", \ + [IP_NULL_ACTION_SEND_ICMP_PROHIBIT] = "send-prohibited", \ +} + +#define IP_NULL_DPO_ACTION_NUM (IP_NULL_ACTION_SEND_ICMP_PROHIBIT+1) + +extern void ip_null_dpo_add_and_lock (dpo_proto_t proto, + ip_null_dpo_action_t action, + dpo_id_t *dpo); + +extern void ip_null_dpo_module_init(void); + +#endif diff --git a/vnet/vnet/fib/fib_entry.c b/vnet/vnet/fib/fib_entry.c index 404f0f40da7..1047c50e1d2 100644 --- a/vnet/vnet/fib/fib_entry.c +++ b/vnet/vnet/fib/fib_entry.c @@ -753,39 +753,26 @@ fib_entry_post_update_actions (fib_entry_t *fib_entry, fib_entry_post_install_actions(fib_entry, source, old_flags); } -void -fib_entry_special_add (fib_node_index_t fib_entry_index, - fib_source_t source, - fib_entry_flag_t flags, - const dpo_id_t *dpo) +static void +fib_entry_source_change (fib_entry_t *fib_entry, + fib_source_t best_source, + fib_source_t new_source, + fib_entry_flag_t old_flags) { - fib_source_t best_source; - fib_entry_flag_t bflags; - fib_entry_t *fib_entry; - fib_entry_src_t *bsrc; - - fib_entry = fib_entry_get(fib_entry_index); - - bsrc = fib_entry_get_best_src_i(fib_entry); - best_source = fib_entry_src_get_source(bsrc); - bflags = fib_entry_src_get_flags(bsrc); - - fib_entry = fib_entry_src_action_add(fib_entry, source, flags, dpo); - /* * if the path list for the source passed is invalid, * then we need to create a new one. else we are updating * an existing. */ - if (source < best_source) + if (new_source < best_source) { /* * we have a new winning source. */ fib_entry_src_action_deactivate(fib_entry, best_source); - fib_entry_src_action_activate(fib_entry, source); + fib_entry_src_action_activate(fib_entry, new_source); } - else if (source > best_source) + else if (new_source > best_source) { /* * the new source loses. nothing to do here. @@ -800,13 +787,56 @@ fib_entry_special_add (fib_node_index_t fib_entry_index, * But the path-list was updated, which will contribute new forwarding, * so install it. */ - fib_entry_src_action_deactivate(fib_entry, source); - fib_entry_src_action_activate(fib_entry, source); + fib_entry_src_action_deactivate(fib_entry, new_source); + fib_entry_src_action_activate(fib_entry, new_source); } - fib_entry_post_update_actions(fib_entry, source, bflags); + fib_entry_post_update_actions(fib_entry, new_source, old_flags); +} + +void +fib_entry_special_add (fib_node_index_t fib_entry_index, + fib_source_t source, + fib_entry_flag_t flags, + const dpo_id_t *dpo) +{ + fib_source_t best_source; + fib_entry_flag_t bflags; + fib_entry_t *fib_entry; + fib_entry_src_t *bsrc; + + fib_entry = fib_entry_get(fib_entry_index); + + bsrc = fib_entry_get_best_src_i(fib_entry); + best_source = fib_entry_src_get_source(bsrc); + bflags = fib_entry_src_get_flags(bsrc); + + fib_entry = fib_entry_src_action_add(fib_entry, source, flags, dpo); + fib_entry_source_change(fib_entry, best_source, source, bflags); +} + +void +fib_entry_special_update (fib_node_index_t fib_entry_index, + fib_source_t source, + fib_entry_flag_t flags, + const dpo_id_t *dpo) +{ + fib_source_t best_source; + fib_entry_flag_t bflags; + fib_entry_t *fib_entry; + fib_entry_src_t *bsrc; + + fib_entry = fib_entry_get(fib_entry_index); + + bsrc = fib_entry_get_best_src_i(fib_entry); + best_source = fib_entry_src_get_source(bsrc); + bflags = fib_entry_src_get_flags(bsrc); + + fib_entry = fib_entry_src_action_update(fib_entry, source, flags, dpo); + fib_entry_source_change(fib_entry, best_source, source, bflags); } + void fib_entry_path_add (fib_node_index_t fib_entry_index, fib_source_t source, diff --git a/vnet/vnet/fib/fib_entry.h b/vnet/vnet/fib/fib_entry.h index bfebe5dd6c8..2b7ea636acb 100644 --- a/vnet/vnet/fib/fib_entry.h +++ b/vnet/vnet/fib/fib_entry.h @@ -446,6 +446,10 @@ extern void fib_entry_special_add(fib_node_index_t fib_entry_index, fib_source_t source, fib_entry_flag_t flags, const dpo_id_t *dpo); +extern void fib_entry_special_update(fib_node_index_t fib_entry_index, + fib_source_t source, + fib_entry_flag_t flags, + const dpo_id_t *dpo); extern fib_entry_src_flag_t fib_entry_special_remove(fib_node_index_t fib_entry_index, fib_source_t source); diff --git a/vnet/vnet/fib/fib_entry_src.c b/vnet/vnet/fib/fib_entry_src.c index 66bb3df2843..2cbdf187c05 100644 --- a/vnet/vnet/fib/fib_entry_src.c +++ b/vnet/vnet/fib/fib_entry_src.c @@ -745,6 +745,56 @@ fib_entry_src_action_add (fib_entry_t *fib_entry, return (fib_entry); } +/* + * fib_entry_src_action_update + * + * Adding a source can result in a new fib_entry being created, which + * can inturn mean the pool is realloc'd and thus the entry passed as + * an argument it also realloc'd + * @return the original entry + */ +fib_entry_t * +fib_entry_src_action_update (fib_entry_t *fib_entry, + fib_source_t source, + fib_entry_flag_t flags, + const dpo_id_t *dpo) +{ + fib_node_index_t fib_entry_index, old_path_list_index; + fib_entry_src_t *esrc; + + esrc = fib_entry_src_find_or_create(fib_entry, source, NULL); + + if (NULL == esrc) + return (fib_entry_src_action_add(fib_entry, source, flags, dpo)); + + old_path_list_index = esrc->fes_pl; + esrc->fes_entry_flags = flags; + + /* + * save variable so we can recover from a fib_entry realloc. + */ + fib_entry_index = fib_entry_get_index(fib_entry); + + if (NULL != fib_entry_src_vft[source].fesv_add) + { + fib_entry_src_vft[source].fesv_add(esrc, + fib_entry, + flags, + fib_entry_get_proto(fib_entry), + dpo); + } + + fib_entry = fib_entry_get(fib_entry_index); + + esrc->fes_flags |= FIB_ENTRY_SRC_FLAG_ADDED; + + fib_path_list_lock(esrc->fes_pl); + fib_path_list_unlock(old_path_list_index); + + return (fib_entry); +} + + fib_entry_src_flag_t fib_entry_src_action_remove (fib_entry_t *fib_entry, fib_source_t source) diff --git a/vnet/vnet/fib/fib_entry_src.h b/vnet/vnet/fib/fib_entry_src.h index d70aabc9c00..0b98c1c35c0 100644 --- a/vnet/vnet/fib/fib_entry_src.h +++ b/vnet/vnet/fib/fib_entry_src.h @@ -233,6 +233,10 @@ extern fib_entry_t* fib_entry_src_action_add(fib_entry_t *fib_entry, fib_source_t source, fib_entry_flag_t flags, const dpo_id_t *dpo); +extern fib_entry_t* fib_entry_src_action_update(fib_entry_t *fib_entry, + fib_source_t source, + fib_entry_flag_t flags, + const dpo_id_t *dpo); extern fib_entry_src_flag_t fib_entry_src_action_remove(fib_entry_t *fib_entry, fib_source_t source); diff --git a/vnet/vnet/fib/fib_entry_src_mpls.c b/vnet/vnet/fib/fib_entry_src_mpls.c index 4079d8fc8cd..4c316f79a84 100644 --- a/vnet/vnet/fib/fib_entry_src_mpls.c +++ b/vnet/vnet/fib/fib_entry_src_mpls.c @@ -104,7 +104,7 @@ fib_entry_src_mpls_set_data (fib_entry_src_t *src, .fp_label = label, }; fib_node_index_t fib_index; - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; /* * adding a new local label. make sure the MPLS fib exists. diff --git a/vnet/vnet/fib/fib_path.c b/vnet/vnet/fib/fib_path.c index b67fedffe72..e92e2333272 100644 --- a/vnet/vnet/fib/fib_path.c +++ b/vnet/vnet/fib/fib_path.c @@ -563,7 +563,7 @@ fib_path_recursive_adj_update (fib_path_t *path, fib_forward_chain_type_t fct, dpo_id_t *dpo) { - dpo_id_t via_dpo = DPO_NULL; + dpo_id_t via_dpo = DPO_INVALID; /* * get the DPO to resolve through from the via-entry diff --git a/vnet/vnet/fib/fib_path_ext.c b/vnet/vnet/fib/fib_path_ext.c index 05e62d96a54..6603b64f02f 100644 --- a/vnet/vnet/fib/fib_path_ext.c +++ b/vnet/vnet/fib/fib_path_ext.c @@ -135,7 +135,7 @@ fib_path_ext_stack (fib_path_ext_t *path_ext, break; } - dpo_id_t via_dpo = DPO_NULL; + dpo_id_t via_dpo = DPO_INVALID; /* * The next object in the graph after the imposition of the label diff --git a/vnet/vnet/fib/fib_table.c b/vnet/vnet/fib/fib_table.c index d293d8152af..54bc8081993 100644 --- a/vnet/vnet/fib/fib_table.c +++ b/vnet/vnet/fib/fib_table.c @@ -324,6 +324,48 @@ fib_table_entry_special_dpo_add (u32 fib_index, } fib_node_index_t +fib_table_entry_special_dpo_update (u32 fib_index, + const fib_prefix_t *prefix, + fib_source_t source, + fib_entry_flag_t flags, + const dpo_id_t *dpo) +{ + fib_node_index_t fib_entry_index; + fib_table_t *fib_table; + + fib_table = fib_table_get(fib_index, prefix->fp_proto); + fib_entry_index = fib_table_lookup_exact_match_i(fib_table, prefix); + + if (FIB_NODE_INDEX_INVALID == fib_entry_index) + { + fib_entry_index = fib_entry_create_special(fib_index, prefix, + source, flags, + dpo); + + fib_table_entry_insert(fib_table, prefix, fib_entry_index); + fib_table->ft_src_route_counts[source]++; + } + else + { + int was_sourced; + + was_sourced = fib_entry_is_sourced(fib_entry_index, source); + + if (was_sourced) + fib_entry_special_update(fib_entry_index, source, flags, dpo); + else + fib_entry_special_add(fib_entry_index, source, flags, dpo); + + if (was_sourced != fib_entry_is_sourced(fib_entry_index, source)) + { + fib_table->ft_src_route_counts[source]++; + } + } + + return (fib_entry_index); +} + +fib_node_index_t fib_table_entry_special_add (u32 fib_index, const fib_prefix_t *prefix, fib_source_t source, @@ -331,7 +373,7 @@ fib_table_entry_special_add (u32 fib_index, adj_index_t adj_index) { fib_node_index_t fib_entry_index; - dpo_id_t tmp_dpo = DPO_NULL; + dpo_id_t tmp_dpo = DPO_INVALID; if (ADJ_INDEX_INVALID != adj_index) { @@ -354,22 +396,6 @@ fib_table_entry_special_add (u32 fib_index, } void -fib_table_entry_special_dpo_update (fib_node_index_t fib_entry_index, - fib_source_t source, - fib_entry_flag_t flags, - const dpo_id_t *dpo) -{ - fib_prefix_t prefix; - u32 fib_index; - - fib_entry_get_prefix(fib_entry_index, &prefix); - fib_index = fib_entry_get_fib_index(fib_entry_index); - - fib_table_entry_special_dpo_add(fib_index, &prefix, source, flags, dpo); - fib_table_entry_special_remove(fib_index, &prefix, source); -} - -void fib_table_entry_special_remove (u32 fib_index, const fib_prefix_t *prefix, fib_source_t source) diff --git a/vnet/vnet/fib/fib_table.h b/vnet/vnet/fib/fib_table.h index d7c604f9de9..ef7599a7bf5 100644 --- a/vnet/vnet/fib/fib_table.h +++ b/vnet/vnet/fib/fib_table.h @@ -210,9 +210,8 @@ extern fib_node_index_t fib_table_entry_special_dpo_add(u32 fib_index, * Instead the client/source provides the DPO to link to. * Special entries are add/remove reference counted per-source. So n * 'removes' are required for n 'adds', if the entry is no longer required. - * An 'update' can only be used after an 'add' and is therefore assumed to act - * on the reference instance of that add (an update is implemented as add/remove - * pair). + * An 'update' is an 'add' if no 'add' has already been called, otherwise an 'add' + * is therefore assumed to act on the reference instance of that add. * * @param fib_entry_index * The index of the FIB entry to update @@ -229,10 +228,11 @@ extern fib_node_index_t fib_table_entry_special_dpo_add(u32 fib_index, * @return * the index of the fib_entry_t that is created (or existed already). */ -extern void fib_table_entry_special_dpo_update (fib_node_index_t fib_entry_index, - fib_source_t source, - fib_entry_flag_t stype, - const dpo_id_t *dpo); +extern fib_node_index_t fib_table_entry_special_dpo_update (u32 fib_index, + const fib_prefix_t *prefix, + fib_source_t source, + fib_entry_flag_t stype, + const dpo_id_t *dpo); /** * @brief diff --git a/vnet/vnet/fib/fib_test.c b/vnet/vnet/fib/fib_test.c index 9b4179569a9..800f4e6a667 100644 --- a/vnet/vnet/fib/fib_test.c +++ b/vnet/vnet/fib/fib_test.c @@ -23,6 +23,7 @@ #include <vnet/dpo/lookup_dpo.h> #include <vnet/dpo/drop_dpo.h> #include <vnet/dpo/receive_dpo.h> +#include <vnet/dpo/ip_null_dpo.h> #include <vnet/mpls/mpls.h> @@ -181,7 +182,7 @@ fib_test_urpf_is_equal (fib_node_index_t fei, fib_forward_chain_type_t fct, u32 num, ...) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; fib_urpf_list_t *urpf; index_t ui; va_list ap; @@ -940,7 +941,7 @@ fib_test_v4 (void) * An EXCLUSIVE route; one where the user (me) provides the exclusive * adjacency through which the route will resovle */ - dpo_id_t ex_dpo = DPO_NULL; + dpo_id_t ex_dpo = DPO_INVALID; lookup_dpo_add_or_lock_w_fib_index(fib_index, DPO_PROTO_IP4, @@ -958,6 +959,21 @@ fib_test_v4 (void) FIB_TEST(!dpo_cmp(&ex_dpo, load_balance_get_bucket(dpo->dpoi_index, 0)), "exclusive remote uses lookup DPO"); + /* + * update the exclusive to use a different DPO + */ + ip_null_dpo_add_and_lock(FIB_PROTOCOL_IP4, + IP_NULL_ACTION_SEND_ICMP_UNREACH, + &ex_dpo); + fib_table_entry_special_dpo_update(fib_index, + &ex_pfx, + FIB_SOURCE_SPECIAL, + FIB_ENTRY_FLAG_EXCLUSIVE, + &ex_dpo); + dpo = fib_entry_contribute_ip_forwarding(fei); + FIB_TEST(!dpo_cmp(&ex_dpo, load_balance_get_bucket(dpo->dpoi_index, 0)), + "exclusive remote uses now uses NULL DPO"); + fib_table_entry_special_remove(fib_index, &ex_pfx, FIB_SOURCE_SPECIAL); @@ -1181,7 +1197,7 @@ fib_test_v4 (void) /* * test the uRPF check functions */ - dpo_id_t dpo_44 = DPO_NULL; + dpo_id_t dpo_44 = DPO_INVALID; index_t urpfi; fib_entry_contribute_forwarding(fei, FIB_FORW_CHAIN_TYPE_UNICAST_IP4, &dpo_44); @@ -4822,7 +4838,7 @@ fib_test_validate_entry (fib_node_index_t fei, ...) { const load_balance_t *lb; - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; fib_prefix_t pfx; index_t fw_lbi; u32 fib_index; @@ -5214,7 +5230,7 @@ fib_test_label (void) /* * get and lock a reference to the non-eos of the via entry 1.1.1.1/32 */ - dpo_id_t non_eos_1_1_1_1 = DPO_NULL; + dpo_id_t non_eos_1_1_1_1 = DPO_INVALID; fib_entry_contribute_forwarding(fei, FIB_FORW_CHAIN_TYPE_MPLS_NON_EOS, &non_eos_1_1_1_1); @@ -5273,7 +5289,7 @@ fib_test_label (void) "2.2.2.2.2/32 LB 1 buckets via: " "label 1600 over 1.1.1.1"); - dpo_id_t dpo_44 = DPO_NULL; + dpo_id_t dpo_44 = DPO_INVALID; index_t urpfi; fib_entry_contribute_forwarding(fei, FIB_FORW_CHAIN_TYPE_UNICAST_IP4, &dpo_44); @@ -5339,7 +5355,7 @@ fib_test_label (void) * test that the pre-failover load-balance has been in-place * modified */ - dpo_id_t current = DPO_NULL; + dpo_id_t current = DPO_INVALID; fib_entry_contribute_forwarding(fei, FIB_FORW_CHAIN_TYPE_MPLS_NON_EOS, ¤t); @@ -5663,7 +5679,7 @@ fib_test_label (void) "1.1.1.2/32 LB 1 buckets via: " "label 101 over 10.10.10.1"); - dpo_id_t non_eos_1_1_1_2 = DPO_NULL; + dpo_id_t non_eos_1_1_1_2 = DPO_INVALID; fib_entry_contribute_forwarding(fib_table_lookup(fib_index, &pfx_1_1_1_1_s_32), FIB_FORW_CHAIN_TYPE_MPLS_NON_EOS, @@ -5781,7 +5797,7 @@ fib_test_label (void) .ip4.as_u32 = clib_host_to_net_u32(0x02020203), }, }; - dpo_id_t ip_1_1_1_1 = DPO_NULL; + dpo_id_t ip_1_1_1_1 = DPO_INVALID; fib_table_entry_update_one_path(fib_index, &pfx_2_2_2_3_s_32, @@ -6396,7 +6412,7 @@ lfib_test_deagg (void) const mpls_label_t deag_label = 50; const u32 lfib_index = 0; const u32 fib_index = 0; - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; const dpo_id_t *dpo1; fib_node_index_t lfe; lookup_dpo_t *lkd; diff --git a/vnet/vnet/fib/mpls_fib.c b/vnet/vnet/fib/mpls_fib.c index 8f1ccef9061..6a9b1ac2989 100644 --- a/vnet/vnet/fib/mpls_fib.c +++ b/vnet/vnet/fib/mpls_fib.c @@ -89,7 +89,7 @@ mpls_fib_index_from_table_id (u32 table_id) static u32 mpls_fib_create_with_table_id (u32 table_id) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; fib_table_t *fib_table; mpls_eos_bit_t eos; mpls_fib_t *mf; diff --git a/vnet/vnet/ip/ip4_forward.c b/vnet/vnet/ip/ip4_forward.c index 9e712f5493a..bfa9f0a54f4 100644 --- a/vnet/vnet/ip/ip4_forward.c +++ b/vnet/vnet/ip/ip4_forward.c @@ -649,7 +649,7 @@ ip4_add_interface_routes (u32 sw_if_index, lm->classify_table_index_by_sw_if_index [sw_if_index]; if (classify_table_index != (u32) ~0) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; dpo_set(&dpo, DPO_CLASSIFY, @@ -1899,10 +1899,6 @@ ip4_arp_inline (vlib_main_t * vm, adj0 = ip_get_adjacency (lm, adj_index0); ip0 = vlib_buffer_get_current (p0); - /* - * this is the Glean case, so we are ARPing for the - * packet's destination - */ a0 = hash_seeds[0]; b0 = hash_seeds[1]; c0 = hash_seeds[2]; @@ -1912,6 +1908,10 @@ ip4_arp_inline (vlib_main_t * vm, if (is_glean) { + /* + * this is the Glean case, so we are ARPing for the + * packet's destination + */ a0 ^= ip0->dst_address.data_u32; } else @@ -3296,7 +3296,7 @@ int vnet_set_ip4_classify_intfc (vlib_main_t * vm, u32 sw_if_index, if (table_index != (u32) ~0) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; dpo_set(&dpo, DPO_CLASSIFY, diff --git a/vnet/vnet/ip/ip4_source_and_port_range_check.c b/vnet/vnet/ip/ip4_source_and_port_range_check.c index 677f610fd45..6ee648cea51 100644 --- a/vnet/vnet/ip/ip4_source_and_port_range_check.c +++ b/vnet/vnet/ip/ip4_source_and_port_range_check.c @@ -955,7 +955,7 @@ add_port_range_adjacency (u32 fib_index, u32 length, u16 * low_ports, u16 * high_ports) { protocol_port_range_dpo_t *ppr_dpo; - dpo_id_t dpop = DPO_NULL; + dpo_id_t dpop = DPO_INVALID; int i, j, k; fib_node_index_t fei; @@ -985,7 +985,7 @@ add_port_range_adjacency (u32 fib_index, * the prefix is already there. * check it was sourced by us, and if so get the ragne DPO from it. */ - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; const dpo_id_t *bucket; if (fib_entry_get_dpo_for_source (fei, FIB_SOURCE_SPECIAL, &dpo)) @@ -1045,9 +1045,9 @@ add_port_range_adjacency (u32 fib_index, } else { - fib_table_entry_special_dpo_update (fei, - FIB_SOURCE_SPECIAL, - FIB_ENTRY_FLAG_NONE, &dpop); + fib_entry_special_update (fei, + FIB_SOURCE_SPECIAL, + FIB_ENTRY_FLAG_NONE, &dpop); } return 0; @@ -1088,7 +1088,7 @@ remove_port_range_adjacency (u32 fib_index, * the prefix is already there. * check it was sourced by us */ - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; const dpo_id_t *bucket; if (fib_entry_get_dpo_for_source (fei, FIB_SOURCE_SPECIAL, &dpo)) @@ -1361,7 +1361,7 @@ show_source_and_port_range_check_fn (vlib_main_t * vm, * find the longest prefix match on the address requested, * check it was sourced by us */ - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; const dpo_id_t *bucket; if (!fib_entry_get_dpo_for_source (fib_table_lookup (fib_index, &pfx), diff --git a/vnet/vnet/ip/ip6_forward.c b/vnet/vnet/ip/ip6_forward.c index 766b26c48e3..c285af9544f 100644 --- a/vnet/vnet/ip/ip6_forward.c +++ b/vnet/vnet/ip/ip6_forward.c @@ -350,7 +350,7 @@ ip6_add_interface_routes (vnet_main_t * vnm, u32 sw_if_index, lm->classify_table_index_by_sw_if_index [sw_if_index]; if (classify_table_index != (u32) ~0) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; dpo_set(&dpo, DPO_CLASSIFY, @@ -3079,7 +3079,7 @@ int vnet_set_ip6_classify_intfc (vlib_main_t * vm, u32 sw_if_index, if (table_index != (u32) ~0) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; dpo_set(&dpo, DPO_CLASSIFY, diff --git a/vnet/vnet/ip/lookup.c b/vnet/vnet/ip/lookup.c index 1f8735b54e2..78152f01c04 100644 --- a/vnet/vnet/ip/lookup.c +++ b/vnet/vnet/ip/lookup.c @@ -47,6 +47,7 @@ #include <vnet/dpo/classify_dpo.h> #include <vnet/dpo/punt_dpo.h> #include <vnet/dpo/receive_dpo.h> +#include <vnet/dpo/ip_null_dpo.h> /** * @file @@ -278,6 +279,12 @@ static uword unformat_dpo (unformat_input_t * input, va_list * args) dpo_copy(dpo, punt_dpo_get(proto)); else if (unformat (input, "local")) receive_dpo_add_or_lock(proto, ~0, NULL, dpo); + else if (unformat (input, "null-send-unreach")) + ip_null_dpo_add_and_lock(proto, IP_NULL_ACTION_SEND_ICMP_UNREACH, dpo); + else if (unformat (input, "null-send-prohibit")) + ip_null_dpo_add_and_lock(proto, IP_NULL_ACTION_SEND_ICMP_PROHIBIT, dpo); + else if (unformat (input, "null")) + ip_null_dpo_add_and_lock(proto, IP_NULL_ACTION_NONE, dpo); else if (unformat (input, "classify")) { u32 classify_table_index; @@ -337,7 +344,7 @@ vnet_ip_route_cmd (vlib_main_t * vm, { unformat_input_t _line_input, * line_input = &_line_input; fib_route_path_t *rpaths = NULL, rpath; - dpo_id_t dpo = DPO_NULL, *dpos = NULL; + dpo_id_t dpo = DPO_INVALID, *dpos = NULL; fib_prefix_t *prefixs = NULL, pfx; clib_error_t * error = NULL; mpls_label_t out_label; diff --git a/vnet/vnet/lisp-gpe/lisp_gpe_adjacency.c b/vnet/vnet/lisp-gpe/lisp_gpe_adjacency.c index dadd09db96b..8c96a25cc5d 100644 --- a/vnet/vnet/lisp-gpe/lisp_gpe_adjacency.c +++ b/vnet/vnet/lisp-gpe/lisp_gpe_adjacency.c @@ -128,7 +128,7 @@ static void lisp_gpe_adj_stack_one (lisp_gpe_adjacency_t * ladj, adj_index_t ai) { const lisp_gpe_tunnel_t *lgt; - dpo_id_t tmp = DPO_NULL; + dpo_id_t tmp = DPO_INVALID; lgt = lisp_gpe_tunnel_get (ladj->tunnel_index); fib_entry_contribute_forwarding (lgt->fib_entry_index, diff --git a/vnet/vnet/lisp-gpe/lisp_gpe_fwd_entry.c b/vnet/vnet/lisp-gpe/lisp_gpe_fwd_entry.c index 018fad4ba00..54ee86d83c5 100644 --- a/vnet/vnet/lisp-gpe/lisp_gpe_fwd_entry.c +++ b/vnet/vnet/lisp-gpe/lisp_gpe_fwd_entry.c @@ -61,7 +61,7 @@ ip_dst_fib_add_route (u32 dst_fib_index, const ip_prefix_t * dst_prefix) if (dst_fei == FIB_NODE_INDEX_INVALID || NULL == fib_entry_get_source_data (dst_fei, FIB_SOURCE_LISP)) { - dpo_id_t src_lkup_dpo = DPO_NULL; + dpo_id_t src_lkup_dpo = DPO_INVALID; /* create a new src FIB. */ src_fib_index = @@ -274,7 +274,7 @@ create_fib_entries (lisp_gpe_fwd_entry_t * lfe) if (LISP_GPE_FWD_ENTRY_TYPE_NEGATIVE == lfe->type) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; switch (lfe->action) { @@ -659,7 +659,7 @@ static void lisp_gpe_l2_update_fwding (lisp_gpe_fwd_entry_t * lfe) { lisp_gpe_main_t *lgm = &lisp_gpe_main; - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; if (LISP_GPE_FWD_ENTRY_TYPE_NEGATIVE != lfe->type) { diff --git a/vnet/vnet/map/map.c b/vnet/vnet/map/map.c index 74a99057c90..beeaf1121a6 100644 --- a/vnet/vnet/map/map.c +++ b/vnet/vnet/map/map.c @@ -166,8 +166,8 @@ map_create_domain (ip4_address_t * ip4_prefix, { u8 suffix_len, suffix_shift; map_main_t *mm = &map_main; - dpo_id_t dpo_v4 = DPO_NULL; - dpo_id_t dpo_v6 = DPO_NULL; + dpo_id_t dpo_v4 = DPO_INVALID; + dpo_id_t dpo_v6 = DPO_INVALID; fib_node_index_t fei; map_domain_t *d; @@ -275,7 +275,7 @@ map_create_domain (ip4_address_t * ip4_prefix, if (FIB_NODE_INDEX_INVALID != fei) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; if (fib_entry_get_dpo_for_source (fei, FIB_SOURCE_MAP, &dpo)) { diff --git a/vnet/vnet/mpls/interface.c b/vnet/vnet/mpls/interface.c index fc297cd10ae..726e6720bf2 100644 --- a/vnet/vnet/mpls/interface.c +++ b/vnet/vnet/mpls/interface.c @@ -934,7 +934,7 @@ int vnet_mpls_ethernet_add_del_policy_tunnel (u8 *dst, .fp_len = tp->mask_width, .fp_proto = FIB_PROTOCOL_IP4, }; - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; if (is_add) { diff --git a/vnet/vnet/sr/sr.c b/vnet/vnet/sr/sr.c index 6a7856592b8..287d52116bd 100644 --- a/vnet/vnet/sr/sr.c +++ b/vnet/vnet/sr/sr.c @@ -834,7 +834,7 @@ ip6_sr_add_del_tunnel (ip6_sr_add_del_tunnel_args_t * a) u8 hmac_key_index = 0; ip6_sr_policy_t *pt; int i; - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; /* Make sure that the rx FIB exists */ p = hash_get (im->fib_index_by_table_id, a->rx_table_id); @@ -1728,7 +1728,7 @@ ip6_sr_add_del_multicastmap (ip6_sr_add_del_multicastmap_args_t * a) * We don't handle ugly RFC-related cases yet, but I'm sure PL will complain * at some point... */ - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; dpo_set (&dpo, sr_dpo_type, DPO_PROTO_IP6, t - sm->tunnels); diff --git a/vpp-api-test/vat/api_format.c b/vpp-api-test/vat/api_format.c index 51beada2bd0..6f11083844b 100644 --- a/vpp-api-test/vat/api_format.c +++ b/vpp-api-test/vat/api_format.c @@ -5757,6 +5757,7 @@ api_ip_add_del_route (vat_main_t * vam) u8 sw_if_index_set = 0; u8 is_ipv6 = 0; u8 is_local = 0, is_drop = 0; + u8 is_unreach = 0, is_prohibit = 0; u8 create_vrf_if_needed = 0; u8 is_add = 1; u8 next_hop_weight = 1; @@ -5822,6 +5823,14 @@ api_ip_add_del_route (vat_main_t * vam) { is_drop = 1; } + else if (unformat (i, "null-send-unreach")) + { + is_unreach = 1; + } + else if (unformat (i, "null-send-prohibit")) + { + is_prohibit = 1; + } else if (unformat (i, "local")) { is_local = 1; @@ -5871,9 +5880,11 @@ api_ip_add_del_route (vat_main_t * vam) return -99; } - if (!next_hop_set && !is_drop && !is_local && !is_classify) + if (!next_hop_set && !is_drop && !is_local && + !is_classify && !is_unreach && !is_prohibit) { - errmsg ("next hop / local / drop / classify not set\n"); + errmsg + ("next hop / local / drop / unreach / prohibit / classify not set\n"); return -99; } @@ -5936,6 +5947,8 @@ api_ip_add_del_route (vat_main_t * vam) mp->is_add = is_add; mp->is_drop = is_drop; + mp->is_unreach = is_unreach; + mp->is_prohibit = is_prohibit; mp->is_ipv6 = is_ipv6; mp->is_local = is_local; mp->is_classify = is_classify; diff --git a/vpp/vpp-api/api.c b/vpp/vpp-api/api.c index cc067402d18..6ac51097df2 100644 --- a/vpp/vpp-api/api.c +++ b/vpp/vpp-api/api.c @@ -117,6 +117,7 @@ #include <vnet/dpo/receive_dpo.h> #include <vnet/dpo/lookup_dpo.h> #include <vnet/dpo/classify_dpo.h> +#include <vnet/dpo/ip_null_dpo.h> #define f64_endian(a) #define f64_print(a,b) @@ -1032,6 +1033,8 @@ static int add_del_route_t_handler (u8 is_multipath, u8 is_add, u8 is_drop, + u8 is_unreach, + u8 is_prohibit, u8 is_local, u8 is_classify, u32 classify_table_index, @@ -1090,22 +1093,29 @@ add_del_route_t_handler (u8 is_multipath, dslock (sm, 1 /* release hint */ , 2 /* tag */ ); - if (is_drop || is_local || is_classify) + if (is_drop || is_local || is_classify || is_unreach || is_prohibit) { /* * special route types that link directly to the adj */ if (is_add) { - dpo_id_t dpo = DPO_NULL; + dpo_id_t dpo = DPO_INVALID; dpo_proto_t dproto; dproto = fib_proto_to_dpo (prefix->fp_proto); if (is_drop) - dpo_copy (&dpo, drop_dpo_get (dproto)); + ip_null_dpo_add_and_lock (dproto, IP_NULL_ACTION_NONE, &dpo); else if (is_local) receive_dpo_add_or_lock (dproto, ~0, NULL, &dpo); + else if (is_unreach) + ip_null_dpo_add_and_lock (dproto, + IP_NULL_ACTION_SEND_ICMP_UNREACH, &dpo); + else if (is_prohibit) + ip_null_dpo_add_and_lock (dproto, + IP_NULL_ACTION_SEND_ICMP_PROHIBIT, + &dpo); else if (is_classify) { if (pool_is_free_index (cm->tables, @@ -1125,10 +1135,10 @@ add_del_route_t_handler (u8 is_multipath, return VNET_API_ERROR_NO_SUCH_TABLE; } - fib_table_entry_special_dpo_add (fib_index, - prefix, - FIB_SOURCE_API, - FIB_ENTRY_FLAG_EXCLUSIVE, &dpo); + fib_table_entry_special_dpo_update (fib_index, + prefix, + FIB_SOURCE_API, + FIB_ENTRY_FLAG_EXCLUSIVE, &dpo); dpo_reset (&dpo); } else @@ -1255,7 +1265,17 @@ ip4_add_del_route_t_handler (vl_api_ip_add_del_route_t * mp) memset (&nh, 0, sizeof (nh)); memcpy (&nh.ip4, mp->next_hop_address, sizeof (nh.ip4)); - return (add_del_route_t_handler (mp->is_multipath, mp->is_add, mp->is_drop, mp->is_local, mp->is_classify, mp->classify_table_index, mp->is_resolve_host, mp->is_resolve_attached, fib_index, &pfx, 1, // is_ip4 + return (add_del_route_t_handler (mp->is_multipath, + mp->is_add, + mp->is_drop, + mp->is_unreach, + mp->is_prohibit, + mp->is_local, + mp->is_classify, + mp->classify_table_index, + mp->is_resolve_host, + mp->is_resolve_attached, + fib_index, &pfx, 1, &nh, ntohl (mp->next_hop_sw_if_index), next_hop_fib_index, @@ -1290,7 +1310,17 @@ ip6_add_del_route_t_handler (vl_api_ip_add_del_route_t * mp) memset (&nh, 0, sizeof (nh)); memcpy (&nh.ip6, mp->next_hop_address, sizeof (nh.ip6)); - return (add_del_route_t_handler (mp->is_multipath, mp->is_add, mp->is_drop, mp->is_local, mp->is_classify, mp->classify_table_index, mp->is_resolve_host, mp->is_resolve_attached, fib_index, &pfx, 0, // is_ip4 + return (add_del_route_t_handler (mp->is_multipath, + mp->is_add, + mp->is_drop, + mp->is_unreach, + mp->is_prohibit, + mp->is_local, + mp->is_classify, + mp->classify_table_index, + mp->is_resolve_host, + mp->is_resolve_attached, + fib_index, &pfx, 0, &nh, ntohl (mp->next_hop_sw_if_index), next_hop_fib_index, mp->next_hop_weight, @@ -1347,6 +1377,8 @@ mpls_route_add_del_t_handler (vnet_main_t * vnm, memcpy (&nh.ip6, mp->mr_next_hop, sizeof (nh.ip6)); return (add_del_route_t_handler (mp->mr_is_multipath, mp->mr_is_add, 0, // mp->is_drop, + 0, // mp->is_unreach, + 0, // mp->is_prohibit, 0, // mp->is_local, mp->mr_is_classify, mp->mr_classify_table_index, diff --git a/vpp/vpp-api/vpe.api b/vpp/vpp-api/vpe.api index ac84bdc5cd5..c5eacce5413 100644 --- a/vpp/vpp-api/vpe.api +++ b/vpp/vpp-api/vpe.api @@ -492,7 +492,9 @@ define mpls_ip_bind_unbind_reply @param create_vrf_if_needed - @param resolve_if_needed - @param is_add - 1 if adding the route, 0 if deleting - @param is_drop - + @param is_drop - Drop the packet + @param is_unreach - Drop the packet and rate limit send ICMP unreachable + @param is_prohibit - Drop the packet and rate limit send ICMP prohibited @param is_ipv6 - 0 if an ip4 route, else ip6 @param is_local - @param is_classify - @@ -517,6 +519,8 @@ define ip_add_del_route u8 resolve_if_needed; u8 is_add; u8 is_drop; + u8 is_unreach; + u8 is_prohibit; u8 is_ipv6; u8 is_local; u8 is_classify; |