diff options
Diffstat (limited to 'src/vnet/classify')
| -rw-r--r-- | src/vnet/classify/classify.api | 22 | ||||
| -rw-r--r-- | src/vnet/classify/classify_api.c | 44 | ||||
| -rw-r--r-- | src/vnet/classify/in_out_acl.c (renamed from src/vnet/classify/input_acl.c) | 188 | ||||
| -rw-r--r-- | src/vnet/classify/in_out_acl.h (renamed from src/vnet/classify/input_acl.h) | 50 | ||||
| -rw-r--r-- | src/vnet/classify/vnet_classify.c | 2 | ||||
| -rw-r--r-- | src/vnet/classify/vnet_classify.h | 1 |
6 files changed, 230 insertions, 77 deletions
diff --git a/src/vnet/classify/classify.api b/src/vnet/classify/classify.api index c22d6104704..7320d5ffa90 100644 --- a/src/vnet/classify/classify.api +++ b/src/vnet/classify/classify.api @@ -384,6 +384,28 @@ autoreply define input_acl_set_interface u8 is_add; }; +/** \brief Set/unset output ACL interface + @param client_index - opaque cookie to identify the sender + @param context - sender context, to match reply w/ request + @param sw_if_index - interface to set/unset output ACL + @param ip4_table_index - ip4 classify table index (~0 for skip) + @param ip6_table_index - ip6 classify table index (~0 for skip) + @param l2_table_index - l2 classify table index (~0 for skip) + @param is_add - Set output ACL if non-zero, else unset + Note: User is recommeneded to use just one valid table_index per call. + (ip4_table_index, ip6_table_index, or l2_table_index) +*/ +autoreply define output_acl_set_interface +{ + u32 client_index; + u32 context; + u32 sw_if_index; + u32 ip4_table_index; + u32 ip6_table_index; + u32 l2_table_index; + u8 is_add; +}; + /* * Local Variables: * eval: (c-set-style "gnu") diff --git a/src/vnet/classify/classify_api.c b/src/vnet/classify/classify_api.c index 1893f6e7191..2cf79f3875d 100644 --- a/src/vnet/classify/classify_api.c +++ b/src/vnet/classify/classify_api.c @@ -24,7 +24,7 @@ #include <vnet/api_errno.h> #include <vnet/classify/vnet_classify.h> -#include <vnet/classify/input_acl.h> +#include <vnet/classify/in_out_acl.h> #include <vnet/classify/policer_classify.h> #include <vnet/classify/flow_classify.h> #include <vnet/l2/l2_classify.h> @@ -60,7 +60,8 @@ _(FLOW_CLASSIFY_SET_INTERFACE, flow_classify_set_interface) \ _(FLOW_CLASSIFY_DUMP, flow_classify_dump) \ _(INPUT_ACL_SET_INTERFACE, input_acl_set_interface) \ _(CLASSIFY_SET_INTERFACE_IP_TABLE, classify_set_interface_ip_table) \ -_(CLASSIFY_SET_INTERFACE_L2_TABLES, classify_set_interface_l2_tables) +_(CLASSIFY_SET_INTERFACE_L2_TABLES, classify_set_interface_l2_tables) \ +_(OUTPUT_ACL_SET_INTERFACE, output_acl_set_interface) #define foreach_classify_add_del_table_field \ _(table_index) \ @@ -269,19 +270,21 @@ static void u32 sw_if_index = ntohl (mp->sw_if_index); u32 *acl = 0; - vec_validate (acl, INPUT_ACL_N_TABLES - 1); + vec_validate (acl, IN_OUT_ACL_N_TABLES - 1); vec_set (acl, ~0); VALIDATE_SW_IF_INDEX (mp); - input_acl_main_t *am = &input_acl_main; + in_out_acl_main_t *am = &in_out_acl_main; int if_idx; u32 type; - for (type = 0; type < INPUT_ACL_N_TABLES; type++) + for (type = 0; type < IN_OUT_ACL_N_TABLES; type++) { - u32 *vec_tbl = am->classify_table_index_by_sw_if_index[type]; + u32 *vec_tbl = + am->classify_table_index_by_sw_if_index[IN_OUT_ACL_INPUT_TABLE_GROUP] + [type]; if (vec_len (vec_tbl)) { for (if_idx = 0; if_idx < vec_len (vec_tbl); if_idx++) @@ -301,9 +304,9 @@ static void REPLY_MACRO2(VL_API_CLASSIFY_TABLE_BY_INTERFACE_REPLY, ({ rmp->sw_if_index = ntohl(sw_if_index); - rmp->l2_table_id = ntohl(acl[INPUT_ACL_TABLE_L2]); - rmp->ip4_table_id = ntohl(acl[INPUT_ACL_TABLE_IP4]); - rmp->ip6_table_id = ntohl(acl[INPUT_ACL_TABLE_IP6]); + rmp->l2_table_id = ntohl(acl[IN_OUT_ACL_TABLE_L2]); + rmp->ip4_table_id = ntohl(acl[IN_OUT_ACL_TABLE_IP4]); + rmp->ip6_table_id = ntohl(acl[IN_OUT_ACL_TABLE_IP6]); })); /* *INDENT-ON* */ vec_free (acl); @@ -585,6 +588,29 @@ static void vl_api_input_acl_set_interface_t_handler REPLY_MACRO (VL_API_INPUT_ACL_SET_INTERFACE_REPLY); } +static void vl_api_output_acl_set_interface_t_handler + (vl_api_output_acl_set_interface_t * mp) +{ + vlib_main_t *vm = vlib_get_main (); + vl_api_output_acl_set_interface_reply_t *rmp; + int rv; + + VALIDATE_SW_IF_INDEX (mp); + + u32 ip4_table_index = ntohl (mp->ip4_table_index); + u32 ip6_table_index = ntohl (mp->ip6_table_index); + u32 l2_table_index = ntohl (mp->l2_table_index); + u32 sw_if_index = ntohl (mp->sw_if_index); + + rv = vnet_set_output_acl_intfc (vm, sw_if_index, ip4_table_index, + ip6_table_index, l2_table_index, + mp->is_add); + + BAD_SW_IF_INDEX_LABEL; + + REPLY_MACRO (VL_API_OUTPUT_ACL_SET_INTERFACE_REPLY); +} + /* * classify_api_hookup * Add vpe's API message handlers to the table. diff --git a/src/vnet/classify/input_acl.c b/src/vnet/classify/in_out_acl.c index cf5053ef3ac..a34f6cec61a 100644 --- a/src/vnet/classify/input_acl.c +++ b/src/vnet/classify/in_out_acl.c @@ -14,62 +14,69 @@ */ #include <vnet/ip/ip.h> #include <vnet/classify/vnet_classify.h> -#include <vnet/classify/input_acl.h> +#include <vnet/classify/in_out_acl.h> -input_acl_main_t input_acl_main; +in_out_acl_main_t in_out_acl_main; static int -vnet_inacl_ip_feature_enable (vlib_main_t * vnm, - input_acl_main_t * am, - u32 sw_if_index, - input_acl_table_id_t tid, int feature_enable) +vnet_in_out_acl_ip_feature_enable (vlib_main_t * vnm, + in_out_acl_main_t * am, + u32 sw_if_index, + in_out_acl_table_id_t tid, + int feature_enable, int is_output) { - if (tid == INPUT_ACL_TABLE_L2) + if (tid == IN_OUT_ACL_TABLE_L2) { - l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_ACL, - feature_enable); + l2input_intf_bitmap_enable (sw_if_index, + is_output ? L2OUTPUT_FEAT_ACL : + L2INPUT_FEAT_ACL, feature_enable); } else { /* IP[46] */ vnet_feature_config_main_t *fcm; u8 arc; - if (tid == INPUT_ACL_TABLE_IP4) + if (tid == IN_OUT_ACL_TABLE_IP4) { - vnet_feature_enable_disable ("ip4-unicast", "ip4-inacl", + char *arc_name = is_output ? "ip4-output" : "ip4-unicast"; + vnet_feature_enable_disable (arc_name, + is_output ? "ip4-outacl" : "ip4-inacl", sw_if_index, feature_enable, 0, 0); - arc = vnet_get_feature_arc_index ("ip4-unicast"); + arc = vnet_get_feature_arc_index (arc_name); } else { - vnet_feature_enable_disable ("ip6-unicast", "ip6-inacl", + char *arc_name = is_output ? "ip6-output" : "ip6-unicast"; + vnet_feature_enable_disable (arc_name, + is_output ? "ip6-outacl" : "ip6-inacl", sw_if_index, feature_enable, 0, 0); - arc = vnet_get_feature_arc_index ("ip6-unicast"); + arc = vnet_get_feature_arc_index (arc_name); } fcm = vnet_get_feature_arc_config_main (arc); - am->vnet_config_main[tid] = &fcm->config_main; + am->vnet_config_main[is_output][tid] = &fcm->config_main; } return 0; } int -vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index, - u32 ip4_table_index, - u32 ip6_table_index, u32 l2_table_index, u32 is_add) +vnet_set_in_out_acl_intfc (vlib_main_t * vm, u32 sw_if_index, + u32 ip4_table_index, + u32 ip6_table_index, u32 l2_table_index, + u32 is_add, u32 is_output) { - input_acl_main_t *am = &input_acl_main; + in_out_acl_main_t *am = &in_out_acl_main; vnet_classify_main_t *vcm = am->vnet_classify_main; - u32 acl[INPUT_ACL_N_TABLES] = { ip4_table_index, ip6_table_index, + u32 acl[IN_OUT_ACL_N_TABLES] = { ip4_table_index, ip6_table_index, l2_table_index }; u32 ti; /* Assume that we've validated sw_if_index in the API layer */ - for (ti = 0; ti < INPUT_ACL_N_TABLES; ti++) + for (ti = 0; ti < IN_OUT_ACL_N_TABLES; ti++) { if (acl[ti] == ~0) continue; @@ -78,12 +85,14 @@ vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index, return VNET_API_ERROR_NO_SUCH_TABLE; vec_validate_init_empty - (am->classify_table_index_by_sw_if_index[ti], sw_if_index, ~0); + (am->classify_table_index_by_sw_if_index[is_output][ti], sw_if_index, + ~0); /* Reject any DEL operation with wrong sw_if_index */ if (!is_add && (acl[ti] != - am->classify_table_index_by_sw_if_index[ti][sw_if_index])) + am->classify_table_index_by_sw_if_index[is_output][ti] + [sw_if_index])) { clib_warning ("Non-existent intf_idx=%d with table_index=%d for delete", @@ -93,23 +102,49 @@ vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index, /* Return ok on ADD operaton if feature is already enabled */ if (is_add && - am->classify_table_index_by_sw_if_index[ti][sw_if_index] != ~0) + am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] + != ~0) return 0; - vnet_inacl_ip_feature_enable (vm, am, sw_if_index, ti, is_add); + vnet_in_out_acl_ip_feature_enable (vm, am, sw_if_index, ti, is_add, + is_output); if (is_add) - am->classify_table_index_by_sw_if_index[ti][sw_if_index] = acl[ti]; + am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] = + acl[ti]; else - am->classify_table_index_by_sw_if_index[ti][sw_if_index] = ~0; + am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] = + ~0; } return 0; } +int +vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index, + u32 ip4_table_index, + u32 ip6_table_index, u32 l2_table_index, u32 is_add) +{ + return vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index, + ip6_table_index, l2_table_index, is_add, + IN_OUT_ACL_INPUT_TABLE_GROUP); +} + +int +vnet_set_output_acl_intfc (vlib_main_t * vm, u32 sw_if_index, + u32 ip4_table_index, + u32 ip6_table_index, u32 l2_table_index, + u32 is_add) +{ + return vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index, + ip6_table_index, l2_table_index, is_add, + IN_OUT_ACL_OUTPUT_TABLE_GROUP); +} + static clib_error_t * -set_input_acl_command_fn (vlib_main_t * vm, - unformat_input_t * input, vlib_cli_command_t * cmd) +set_in_out_acl_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd, + u32 is_output) { vnet_main_t *vnm = vnet_get_main (); u32 sw_if_index = ~0; @@ -146,8 +181,9 @@ set_input_acl_command_fn (vlib_main_t * vm, if (idx_cnt > 1) return clib_error_return (0, "Only one table index per API is allowed."); - rv = vnet_set_input_acl_intfc (vm, sw_if_index, ip4_table_index, - ip6_table_index, l2_table_index, is_add); + rv = vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index, + ip6_table_index, l2_table_index, is_add, + is_output); switch (rv) { @@ -163,8 +199,24 @@ set_input_acl_command_fn (vlib_main_t * vm, return 0; } +static clib_error_t * +set_input_acl_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + return set_in_out_acl_command_fn (vm, input, cmd, + IN_OUT_ACL_INPUT_TABLE_GROUP); +} + +static clib_error_t * +set_output_acl_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + return set_in_out_acl_command_fn (vm, input, cmd, + IN_OUT_ACL_OUTPUT_TABLE_GROUP); +} + /* - * Configure interface to enable/disble input ACL feature: + * Configure interface to enable/disble input/output ACL features: * intfc - interface name to be configured as input ACL * Ip4-table <index> [del] - enable/disable IP4 input ACL * Ip6-table <index> [del] - enable/disable IP6 input ACL @@ -181,15 +233,22 @@ VLIB_CLI_COMMAND (set_input_acl_command, static) = { " [ip6-table <index>] [l2-table <index>] [del]", .function = set_input_acl_command_fn, }; +VLIB_CLI_COMMAND (set_output_acl_command, static) = { + .path = "set interface output acl", + .short_help = + "set interface output acl intfc <int> [ip4-table <index>]\n" + " [ip6-table <index>] [l2-table <index>] [del]", + .function = set_output_acl_command_fn, +}; /* *INDENT-ON* */ clib_error_t * -input_acl_init (vlib_main_t * vm) +in_out_acl_init (vlib_main_t * vm) { - input_acl_main_t *am = &input_acl_main; + in_out_acl_main_t *am = &in_out_acl_main; clib_error_t *error = 0; - if ((error = vlib_call_init_function (vm, ip_inacl_init))) + if ((error = vlib_call_init_function (vm, ip_in_out_acl_init))) return error; am->vlib_main = vm; @@ -199,22 +258,22 @@ input_acl_init (vlib_main_t * vm) return 0; } -VLIB_INIT_FUNCTION (input_acl_init); +VLIB_INIT_FUNCTION (in_out_acl_init); uword unformat_acl_type (unformat_input_t * input, va_list * args) { u32 *acl_type = va_arg (*args, u32 *); - u32 tid = INPUT_ACL_N_TABLES; + u32 tid = IN_OUT_ACL_N_TABLES; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { if (unformat (input, "ip4")) - tid = INPUT_ACL_TABLE_IP4; + tid = IN_OUT_ACL_TABLE_IP4; else if (unformat (input, "ip6")) - tid = INPUT_ACL_TABLE_IP6; + tid = IN_OUT_ACL_TABLE_IP6; else if (unformat (input, "l2")) - tid = INPUT_ACL_TABLE_L2; + tid = IN_OUT_ACL_TABLE_L2; else break; } @@ -224,9 +283,9 @@ unformat_acl_type (unformat_input_t * input, va_list * args) } u8 * -format_vnet_inacl_info (u8 * s, va_list * va) +format_vnet_in_out_acl_info (u8 * s, va_list * va) { - input_acl_main_t *am = va_arg (*va, input_acl_main_t *); + in_out_acl_main_t *am = va_arg (*va, in_out_acl_main_t *); int sw_if_idx = va_arg (*va, int); u32 tid = va_arg (*va, u32); @@ -244,11 +303,12 @@ format_vnet_inacl_info (u8 * s, va_list * va) } static clib_error_t * -show_inacl_command_fn (vlib_main_t * vm, - unformat_input_t * input, vlib_cli_command_t * cmd) +show_in_out_acl_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd, u32 is_output) { - input_acl_main_t *am = &input_acl_main; - u32 type = INPUT_ACL_N_TABLES; + in_out_acl_main_t *am = &in_out_acl_main; + u32 type = IN_OUT_ACL_N_TABLES; int i; u32 *vec_tbl; @@ -260,34 +320,58 @@ show_inacl_command_fn (vlib_main_t * vm, break; } - if (type == INPUT_ACL_N_TABLES) - return clib_error_return (0, "Invalid input ACL table type."); + if (type == IN_OUT_ACL_N_TABLES) + return clib_error_return (0, is_output ? "Invalid output ACL table type." + : "Invalid input ACL table type."); - vec_tbl = am->classify_table_index_by_sw_if_index[type]; + vec_tbl = am->classify_table_index_by_sw_if_index[is_output][type]; if (vec_len (vec_tbl)) - vlib_cli_output (vm, "%U", format_vnet_inacl_info, am, ~0 /* hdr */ , ~0); + vlib_cli_output (vm, "%U", format_vnet_in_out_acl_info, am, ~0 /* hdr */ , + ~0); else - vlib_cli_output (vm, "No input ACL tables configured"); + vlib_cli_output (vm, is_output ? "No output ACL tables configured" + : "No input ACL tables configured"); for (i = 0; i < vec_len (vec_tbl); i++) { if (vec_elt (vec_tbl, i) == ~0) continue; - vlib_cli_output (vm, "%U", format_vnet_inacl_info, + vlib_cli_output (vm, "%U", format_vnet_in_out_acl_info, am, i, vec_elt (vec_tbl, i)); } return 0; } +static clib_error_t * +show_inacl_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + return show_in_out_acl_command_fn (vm, input, cmd, + IN_OUT_ACL_INPUT_TABLE_GROUP); +} + +static clib_error_t * +show_outacl_command_fn (vlib_main_t * vm, + unformat_input_t * input, vlib_cli_command_t * cmd) +{ + return show_in_out_acl_command_fn (vm, input, cmd, + IN_OUT_ACL_OUTPUT_TABLE_GROUP); +} + /* *INDENT-OFF* */ VLIB_CLI_COMMAND (show_inacl_command, static) = { .path = "show inacl", .short_help = "show inacl type [ip4|ip6|l2]", .function = show_inacl_command_fn, }; +VLIB_CLI_COMMAND (show_outacl_command, static) = { + .path = "show outacl", + .short_help = "show outacl type [ip4|ip6|l2]", + .function = show_outacl_command_fn, +}; /* *INDENT-ON* */ /* diff --git a/src/vnet/classify/input_acl.h b/src/vnet/classify/in_out_acl.h index a5f3bac6b99..be0323055d8 100644 --- a/src/vnet/classify/input_acl.h +++ b/src/vnet/classify/in_out_acl.h @@ -13,8 +13,8 @@ * limitations under the License. */ -#ifndef __included_vnet_input_acl_h__ -#define __included_vnet_input_acl_h__ +#ifndef __included_vnet_in_out_acl_h__ +#define __included_vnet_in_out_acl_h__ #include <vlib/vlib.h> #include <vnet/vnet.h> @@ -22,39 +22,59 @@ typedef enum { - INPUT_ACL_TABLE_IP4, - INPUT_ACL_TABLE_IP6, - INPUT_ACL_TABLE_L2, - INPUT_ACL_N_TABLES, -} input_acl_table_id_t; - -typedef enum -{ ACL_NEXT_INDEX_DENY, ACL_NEXT_INDEX_N_NEXT, } acl_next_index_t; +typedef enum +{ + IN_OUT_ACL_TABLE_IP4, + IN_OUT_ACL_TABLE_IP6, + IN_OUT_ACL_TABLE_L2, + IN_OUT_ACL_N_TABLES, +} in_out_acl_table_id_t; + +typedef enum +{ + IN_OUT_ACL_INPUT_TABLE_GROUP, + IN_OUT_ACL_OUTPUT_TABLE_GROUP, + IN_OUT_ACL_N_TABLE_GROUPS +} in_out_acl_table_group_id_t; + typedef struct { /* classifier table vectors */ - u32 *classify_table_index_by_sw_if_index[INPUT_ACL_N_TABLES]; + u32 + * classify_table_index_by_sw_if_index[IN_OUT_ACL_N_TABLE_GROUPS] + [IN_OUT_ACL_N_TABLES]; /* convenience variables */ vlib_main_t *vlib_main; vnet_main_t *vnet_main; vnet_classify_main_t *vnet_classify_main; - vnet_config_main_t *vnet_config_main[INPUT_ACL_N_TABLES]; -} input_acl_main_t; + vnet_config_main_t + * vnet_config_main[IN_OUT_ACL_N_TABLE_GROUPS][IN_OUT_ACL_N_TABLES]; +} in_out_acl_main_t; -extern input_acl_main_t input_acl_main; +extern in_out_acl_main_t in_out_acl_main; + +int vnet_set_in_out_acl_intfc (vlib_main_t * vm, u32 sw_if_index, + u32 ip4_table_index, + u32 ip6_table_index, + u32 l2_table_index, u32 is_add, u32 is_output); int vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index, u32 ip4_table_index, u32 ip6_table_index, u32 l2_table_index, u32 is_add); -#endif /* __included_vnet_input_acl_h__ */ +int vnet_set_output_acl_intfc (vlib_main_t * vm, u32 sw_if_index, + u32 ip4_table_index, + u32 ip6_table_index, + u32 l2_table_index, u32 is_add); + +#endif /* __included_vnet_in_out_acl_h__ */ /* * fd.io coding-style-patch-verification: ON diff --git a/src/vnet/classify/vnet_classify.c b/src/vnet/classify/vnet_classify.c index ef45d1a4167..d287a2d39cf 100644 --- a/src/vnet/classify/vnet_classify.c +++ b/src/vnet/classify/vnet_classify.c @@ -13,7 +13,7 @@ * limitations under the License. */ #include <vnet/classify/vnet_classify.h> -#include <vnet/classify/input_acl.h> +#include <vnet/classify/in_out_acl.h> #include <vnet/ip/ip.h> #include <vnet/api_errno.h> /* for API error numbers */ #include <vnet/l2/l2_classify.h> /* for L2_INPUT_CLASSIFY_NEXT_xxx */ diff --git a/src/vnet/classify/vnet_classify.h b/src/vnet/classify/vnet_classify.h index 40628015501..79e7f1a844e 100644 --- a/src/vnet/classify/vnet_classify.h +++ b/src/vnet/classify/vnet_classify.h @@ -27,6 +27,7 @@ #include <vnet/ip/ip6_packet.h> #include <vlib/cli.h> #include <vnet/l2/l2_input.h> +#include <vnet/l2/l2_output.h> #include <vnet/l2/feat_bitmap.h> #include <vnet/api_errno.h> /* for API error numbers */ |