summaryrefslogtreecommitdiffstats
path: root/src/vnet/classify
diff options
context:
space:
mode:
Diffstat (limited to 'src/vnet/classify')
-rw-r--r--src/vnet/classify/classify.api22
-rw-r--r--src/vnet/classify/classify_api.c44
-rw-r--r--src/vnet/classify/in_out_acl.c (renamed from src/vnet/classify/input_acl.c)188
-rw-r--r--src/vnet/classify/in_out_acl.h (renamed from src/vnet/classify/input_acl.h)50
-rw-r--r--src/vnet/classify/vnet_classify.c2
-rw-r--r--src/vnet/classify/vnet_classify.h1
6 files changed, 230 insertions, 77 deletions
diff --git a/src/vnet/classify/classify.api b/src/vnet/classify/classify.api
index c22d6104704..7320d5ffa90 100644
--- a/src/vnet/classify/classify.api
+++ b/src/vnet/classify/classify.api
@@ -384,6 +384,28 @@ autoreply define input_acl_set_interface
u8 is_add;
};
+/** \brief Set/unset output ACL interface
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param sw_if_index - interface to set/unset output ACL
+ @param ip4_table_index - ip4 classify table index (~0 for skip)
+ @param ip6_table_index - ip6 classify table index (~0 for skip)
+ @param l2_table_index - l2 classify table index (~0 for skip)
+ @param is_add - Set output ACL if non-zero, else unset
+ Note: User is recommeneded to use just one valid table_index per call.
+ (ip4_table_index, ip6_table_index, or l2_table_index)
+*/
+autoreply define output_acl_set_interface
+{
+ u32 client_index;
+ u32 context;
+ u32 sw_if_index;
+ u32 ip4_table_index;
+ u32 ip6_table_index;
+ u32 l2_table_index;
+ u8 is_add;
+};
+
/*
* Local Variables:
* eval: (c-set-style "gnu")
diff --git a/src/vnet/classify/classify_api.c b/src/vnet/classify/classify_api.c
index 1893f6e7191..2cf79f3875d 100644
--- a/src/vnet/classify/classify_api.c
+++ b/src/vnet/classify/classify_api.c
@@ -24,7 +24,7 @@
#include <vnet/api_errno.h>
#include <vnet/classify/vnet_classify.h>
-#include <vnet/classify/input_acl.h>
+#include <vnet/classify/in_out_acl.h>
#include <vnet/classify/policer_classify.h>
#include <vnet/classify/flow_classify.h>
#include <vnet/l2/l2_classify.h>
@@ -60,7 +60,8 @@ _(FLOW_CLASSIFY_SET_INTERFACE, flow_classify_set_interface) \
_(FLOW_CLASSIFY_DUMP, flow_classify_dump) \
_(INPUT_ACL_SET_INTERFACE, input_acl_set_interface) \
_(CLASSIFY_SET_INTERFACE_IP_TABLE, classify_set_interface_ip_table) \
-_(CLASSIFY_SET_INTERFACE_L2_TABLES, classify_set_interface_l2_tables)
+_(CLASSIFY_SET_INTERFACE_L2_TABLES, classify_set_interface_l2_tables) \
+_(OUTPUT_ACL_SET_INTERFACE, output_acl_set_interface)
#define foreach_classify_add_del_table_field \
_(table_index) \
@@ -269,19 +270,21 @@ static void
u32 sw_if_index = ntohl (mp->sw_if_index);
u32 *acl = 0;
- vec_validate (acl, INPUT_ACL_N_TABLES - 1);
+ vec_validate (acl, IN_OUT_ACL_N_TABLES - 1);
vec_set (acl, ~0);
VALIDATE_SW_IF_INDEX (mp);
- input_acl_main_t *am = &input_acl_main;
+ in_out_acl_main_t *am = &in_out_acl_main;
int if_idx;
u32 type;
- for (type = 0; type < INPUT_ACL_N_TABLES; type++)
+ for (type = 0; type < IN_OUT_ACL_N_TABLES; type++)
{
- u32 *vec_tbl = am->classify_table_index_by_sw_if_index[type];
+ u32 *vec_tbl =
+ am->classify_table_index_by_sw_if_index[IN_OUT_ACL_INPUT_TABLE_GROUP]
+ [type];
if (vec_len (vec_tbl))
{
for (if_idx = 0; if_idx < vec_len (vec_tbl); if_idx++)
@@ -301,9 +304,9 @@ static void
REPLY_MACRO2(VL_API_CLASSIFY_TABLE_BY_INTERFACE_REPLY,
({
rmp->sw_if_index = ntohl(sw_if_index);
- rmp->l2_table_id = ntohl(acl[INPUT_ACL_TABLE_L2]);
- rmp->ip4_table_id = ntohl(acl[INPUT_ACL_TABLE_IP4]);
- rmp->ip6_table_id = ntohl(acl[INPUT_ACL_TABLE_IP6]);
+ rmp->l2_table_id = ntohl(acl[IN_OUT_ACL_TABLE_L2]);
+ rmp->ip4_table_id = ntohl(acl[IN_OUT_ACL_TABLE_IP4]);
+ rmp->ip6_table_id = ntohl(acl[IN_OUT_ACL_TABLE_IP6]);
}));
/* *INDENT-ON* */
vec_free (acl);
@@ -585,6 +588,29 @@ static void vl_api_input_acl_set_interface_t_handler
REPLY_MACRO (VL_API_INPUT_ACL_SET_INTERFACE_REPLY);
}
+static void vl_api_output_acl_set_interface_t_handler
+ (vl_api_output_acl_set_interface_t * mp)
+{
+ vlib_main_t *vm = vlib_get_main ();
+ vl_api_output_acl_set_interface_reply_t *rmp;
+ int rv;
+
+ VALIDATE_SW_IF_INDEX (mp);
+
+ u32 ip4_table_index = ntohl (mp->ip4_table_index);
+ u32 ip6_table_index = ntohl (mp->ip6_table_index);
+ u32 l2_table_index = ntohl (mp->l2_table_index);
+ u32 sw_if_index = ntohl (mp->sw_if_index);
+
+ rv = vnet_set_output_acl_intfc (vm, sw_if_index, ip4_table_index,
+ ip6_table_index, l2_table_index,
+ mp->is_add);
+
+ BAD_SW_IF_INDEX_LABEL;
+
+ REPLY_MACRO (VL_API_OUTPUT_ACL_SET_INTERFACE_REPLY);
+}
+
/*
* classify_api_hookup
* Add vpe's API message handlers to the table.
diff --git a/src/vnet/classify/input_acl.c b/src/vnet/classify/in_out_acl.c
index cf5053ef3ac..a34f6cec61a 100644
--- a/src/vnet/classify/input_acl.c
+++ b/src/vnet/classify/in_out_acl.c
@@ -14,62 +14,69 @@
*/
#include <vnet/ip/ip.h>
#include <vnet/classify/vnet_classify.h>
-#include <vnet/classify/input_acl.h>
+#include <vnet/classify/in_out_acl.h>
-input_acl_main_t input_acl_main;
+in_out_acl_main_t in_out_acl_main;
static int
-vnet_inacl_ip_feature_enable (vlib_main_t * vnm,
- input_acl_main_t * am,
- u32 sw_if_index,
- input_acl_table_id_t tid, int feature_enable)
+vnet_in_out_acl_ip_feature_enable (vlib_main_t * vnm,
+ in_out_acl_main_t * am,
+ u32 sw_if_index,
+ in_out_acl_table_id_t tid,
+ int feature_enable, int is_output)
{
- if (tid == INPUT_ACL_TABLE_L2)
+ if (tid == IN_OUT_ACL_TABLE_L2)
{
- l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_ACL,
- feature_enable);
+ l2input_intf_bitmap_enable (sw_if_index,
+ is_output ? L2OUTPUT_FEAT_ACL :
+ L2INPUT_FEAT_ACL, feature_enable);
}
else
{ /* IP[46] */
vnet_feature_config_main_t *fcm;
u8 arc;
- if (tid == INPUT_ACL_TABLE_IP4)
+ if (tid == IN_OUT_ACL_TABLE_IP4)
{
- vnet_feature_enable_disable ("ip4-unicast", "ip4-inacl",
+ char *arc_name = is_output ? "ip4-output" : "ip4-unicast";
+ vnet_feature_enable_disable (arc_name,
+ is_output ? "ip4-outacl" : "ip4-inacl",
sw_if_index, feature_enable, 0, 0);
- arc = vnet_get_feature_arc_index ("ip4-unicast");
+ arc = vnet_get_feature_arc_index (arc_name);
}
else
{
- vnet_feature_enable_disable ("ip6-unicast", "ip6-inacl",
+ char *arc_name = is_output ? "ip6-output" : "ip6-unicast";
+ vnet_feature_enable_disable (arc_name,
+ is_output ? "ip6-outacl" : "ip6-inacl",
sw_if_index, feature_enable, 0, 0);
- arc = vnet_get_feature_arc_index ("ip6-unicast");
+ arc = vnet_get_feature_arc_index (arc_name);
}
fcm = vnet_get_feature_arc_config_main (arc);
- am->vnet_config_main[tid] = &fcm->config_main;
+ am->vnet_config_main[is_output][tid] = &fcm->config_main;
}
return 0;
}
int
-vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
- u32 ip4_table_index,
- u32 ip6_table_index, u32 l2_table_index, u32 is_add)
+vnet_set_in_out_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+ u32 ip4_table_index,
+ u32 ip6_table_index, u32 l2_table_index,
+ u32 is_add, u32 is_output)
{
- input_acl_main_t *am = &input_acl_main;
+ in_out_acl_main_t *am = &in_out_acl_main;
vnet_classify_main_t *vcm = am->vnet_classify_main;
- u32 acl[INPUT_ACL_N_TABLES] = { ip4_table_index, ip6_table_index,
+ u32 acl[IN_OUT_ACL_N_TABLES] = { ip4_table_index, ip6_table_index,
l2_table_index
};
u32 ti;
/* Assume that we've validated sw_if_index in the API layer */
- for (ti = 0; ti < INPUT_ACL_N_TABLES; ti++)
+ for (ti = 0; ti < IN_OUT_ACL_N_TABLES; ti++)
{
if (acl[ti] == ~0)
continue;
@@ -78,12 +85,14 @@ vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
return VNET_API_ERROR_NO_SUCH_TABLE;
vec_validate_init_empty
- (am->classify_table_index_by_sw_if_index[ti], sw_if_index, ~0);
+ (am->classify_table_index_by_sw_if_index[is_output][ti], sw_if_index,
+ ~0);
/* Reject any DEL operation with wrong sw_if_index */
if (!is_add &&
(acl[ti] !=
- am->classify_table_index_by_sw_if_index[ti][sw_if_index]))
+ am->classify_table_index_by_sw_if_index[is_output][ti]
+ [sw_if_index]))
{
clib_warning
("Non-existent intf_idx=%d with table_index=%d for delete",
@@ -93,23 +102,49 @@ vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
/* Return ok on ADD operaton if feature is already enabled */
if (is_add &&
- am->classify_table_index_by_sw_if_index[ti][sw_if_index] != ~0)
+ am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index]
+ != ~0)
return 0;
- vnet_inacl_ip_feature_enable (vm, am, sw_if_index, ti, is_add);
+ vnet_in_out_acl_ip_feature_enable (vm, am, sw_if_index, ti, is_add,
+ is_output);
if (is_add)
- am->classify_table_index_by_sw_if_index[ti][sw_if_index] = acl[ti];
+ am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] =
+ acl[ti];
else
- am->classify_table_index_by_sw_if_index[ti][sw_if_index] = ~0;
+ am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] =
+ ~0;
}
return 0;
}
+int
+vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+ u32 ip4_table_index,
+ u32 ip6_table_index, u32 l2_table_index, u32 is_add)
+{
+ return vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index,
+ ip6_table_index, l2_table_index, is_add,
+ IN_OUT_ACL_INPUT_TABLE_GROUP);
+}
+
+int
+vnet_set_output_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+ u32 ip4_table_index,
+ u32 ip6_table_index, u32 l2_table_index,
+ u32 is_add)
+{
+ return vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index,
+ ip6_table_index, l2_table_index, is_add,
+ IN_OUT_ACL_OUTPUT_TABLE_GROUP);
+}
+
static clib_error_t *
-set_input_acl_command_fn (vlib_main_t * vm,
- unformat_input_t * input, vlib_cli_command_t * cmd)
+set_in_out_acl_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd,
+ u32 is_output)
{
vnet_main_t *vnm = vnet_get_main ();
u32 sw_if_index = ~0;
@@ -146,8 +181,9 @@ set_input_acl_command_fn (vlib_main_t * vm,
if (idx_cnt > 1)
return clib_error_return (0, "Only one table index per API is allowed.");
- rv = vnet_set_input_acl_intfc (vm, sw_if_index, ip4_table_index,
- ip6_table_index, l2_table_index, is_add);
+ rv = vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index,
+ ip6_table_index, l2_table_index, is_add,
+ is_output);
switch (rv)
{
@@ -163,8 +199,24 @@ set_input_acl_command_fn (vlib_main_t * vm,
return 0;
}
+static clib_error_t *
+set_input_acl_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ return set_in_out_acl_command_fn (vm, input, cmd,
+ IN_OUT_ACL_INPUT_TABLE_GROUP);
+}
+
+static clib_error_t *
+set_output_acl_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ return set_in_out_acl_command_fn (vm, input, cmd,
+ IN_OUT_ACL_OUTPUT_TABLE_GROUP);
+}
+
/*
- * Configure interface to enable/disble input ACL feature:
+ * Configure interface to enable/disble input/output ACL features:
* intfc - interface name to be configured as input ACL
* Ip4-table <index> [del] - enable/disable IP4 input ACL
* Ip6-table <index> [del] - enable/disable IP6 input ACL
@@ -181,15 +233,22 @@ VLIB_CLI_COMMAND (set_input_acl_command, static) = {
" [ip6-table <index>] [l2-table <index>] [del]",
.function = set_input_acl_command_fn,
};
+VLIB_CLI_COMMAND (set_output_acl_command, static) = {
+ .path = "set interface output acl",
+ .short_help =
+ "set interface output acl intfc <int> [ip4-table <index>]\n"
+ " [ip6-table <index>] [l2-table <index>] [del]",
+ .function = set_output_acl_command_fn,
+};
/* *INDENT-ON* */
clib_error_t *
-input_acl_init (vlib_main_t * vm)
+in_out_acl_init (vlib_main_t * vm)
{
- input_acl_main_t *am = &input_acl_main;
+ in_out_acl_main_t *am = &in_out_acl_main;
clib_error_t *error = 0;
- if ((error = vlib_call_init_function (vm, ip_inacl_init)))
+ if ((error = vlib_call_init_function (vm, ip_in_out_acl_init)))
return error;
am->vlib_main = vm;
@@ -199,22 +258,22 @@ input_acl_init (vlib_main_t * vm)
return 0;
}
-VLIB_INIT_FUNCTION (input_acl_init);
+VLIB_INIT_FUNCTION (in_out_acl_init);
uword
unformat_acl_type (unformat_input_t * input, va_list * args)
{
u32 *acl_type = va_arg (*args, u32 *);
- u32 tid = INPUT_ACL_N_TABLES;
+ u32 tid = IN_OUT_ACL_N_TABLES;
while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
{
if (unformat (input, "ip4"))
- tid = INPUT_ACL_TABLE_IP4;
+ tid = IN_OUT_ACL_TABLE_IP4;
else if (unformat (input, "ip6"))
- tid = INPUT_ACL_TABLE_IP6;
+ tid = IN_OUT_ACL_TABLE_IP6;
else if (unformat (input, "l2"))
- tid = INPUT_ACL_TABLE_L2;
+ tid = IN_OUT_ACL_TABLE_L2;
else
break;
}
@@ -224,9 +283,9 @@ unformat_acl_type (unformat_input_t * input, va_list * args)
}
u8 *
-format_vnet_inacl_info (u8 * s, va_list * va)
+format_vnet_in_out_acl_info (u8 * s, va_list * va)
{
- input_acl_main_t *am = va_arg (*va, input_acl_main_t *);
+ in_out_acl_main_t *am = va_arg (*va, in_out_acl_main_t *);
int sw_if_idx = va_arg (*va, int);
u32 tid = va_arg (*va, u32);
@@ -244,11 +303,12 @@ format_vnet_inacl_info (u8 * s, va_list * va)
}
static clib_error_t *
-show_inacl_command_fn (vlib_main_t * vm,
- unformat_input_t * input, vlib_cli_command_t * cmd)
+show_in_out_acl_command_fn (vlib_main_t * vm,
+ unformat_input_t * input,
+ vlib_cli_command_t * cmd, u32 is_output)
{
- input_acl_main_t *am = &input_acl_main;
- u32 type = INPUT_ACL_N_TABLES;
+ in_out_acl_main_t *am = &in_out_acl_main;
+ u32 type = IN_OUT_ACL_N_TABLES;
int i;
u32 *vec_tbl;
@@ -260,34 +320,58 @@ show_inacl_command_fn (vlib_main_t * vm,
break;
}
- if (type == INPUT_ACL_N_TABLES)
- return clib_error_return (0, "Invalid input ACL table type.");
+ if (type == IN_OUT_ACL_N_TABLES)
+ return clib_error_return (0, is_output ? "Invalid output ACL table type."
+ : "Invalid input ACL table type.");
- vec_tbl = am->classify_table_index_by_sw_if_index[type];
+ vec_tbl = am->classify_table_index_by_sw_if_index[is_output][type];
if (vec_len (vec_tbl))
- vlib_cli_output (vm, "%U", format_vnet_inacl_info, am, ~0 /* hdr */ , ~0);
+ vlib_cli_output (vm, "%U", format_vnet_in_out_acl_info, am, ~0 /* hdr */ ,
+ ~0);
else
- vlib_cli_output (vm, "No input ACL tables configured");
+ vlib_cli_output (vm, is_output ? "No output ACL tables configured"
+ : "No input ACL tables configured");
for (i = 0; i < vec_len (vec_tbl); i++)
{
if (vec_elt (vec_tbl, i) == ~0)
continue;
- vlib_cli_output (vm, "%U", format_vnet_inacl_info,
+ vlib_cli_output (vm, "%U", format_vnet_in_out_acl_info,
am, i, vec_elt (vec_tbl, i));
}
return 0;
}
+static clib_error_t *
+show_inacl_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ return show_in_out_acl_command_fn (vm, input, cmd,
+ IN_OUT_ACL_INPUT_TABLE_GROUP);
+}
+
+static clib_error_t *
+show_outacl_command_fn (vlib_main_t * vm,
+ unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+ return show_in_out_acl_command_fn (vm, input, cmd,
+ IN_OUT_ACL_OUTPUT_TABLE_GROUP);
+}
+
/* *INDENT-OFF* */
VLIB_CLI_COMMAND (show_inacl_command, static) = {
.path = "show inacl",
.short_help = "show inacl type [ip4|ip6|l2]",
.function = show_inacl_command_fn,
};
+VLIB_CLI_COMMAND (show_outacl_command, static) = {
+ .path = "show outacl",
+ .short_help = "show outacl type [ip4|ip6|l2]",
+ .function = show_outacl_command_fn,
+};
/* *INDENT-ON* */
/*
diff --git a/src/vnet/classify/input_acl.h b/src/vnet/classify/in_out_acl.h
index a5f3bac6b99..be0323055d8 100644
--- a/src/vnet/classify/input_acl.h
+++ b/src/vnet/classify/in_out_acl.h
@@ -13,8 +13,8 @@
* limitations under the License.
*/
-#ifndef __included_vnet_input_acl_h__
-#define __included_vnet_input_acl_h__
+#ifndef __included_vnet_in_out_acl_h__
+#define __included_vnet_in_out_acl_h__
#include <vlib/vlib.h>
#include <vnet/vnet.h>
@@ -22,39 +22,59 @@
typedef enum
{
- INPUT_ACL_TABLE_IP4,
- INPUT_ACL_TABLE_IP6,
- INPUT_ACL_TABLE_L2,
- INPUT_ACL_N_TABLES,
-} input_acl_table_id_t;
-
-typedef enum
-{
ACL_NEXT_INDEX_DENY,
ACL_NEXT_INDEX_N_NEXT,
} acl_next_index_t;
+typedef enum
+{
+ IN_OUT_ACL_TABLE_IP4,
+ IN_OUT_ACL_TABLE_IP6,
+ IN_OUT_ACL_TABLE_L2,
+ IN_OUT_ACL_N_TABLES,
+} in_out_acl_table_id_t;
+
+typedef enum
+{
+ IN_OUT_ACL_INPUT_TABLE_GROUP,
+ IN_OUT_ACL_OUTPUT_TABLE_GROUP,
+ IN_OUT_ACL_N_TABLE_GROUPS
+} in_out_acl_table_group_id_t;
+
typedef struct
{
/* classifier table vectors */
- u32 *classify_table_index_by_sw_if_index[INPUT_ACL_N_TABLES];
+ u32
+ * classify_table_index_by_sw_if_index[IN_OUT_ACL_N_TABLE_GROUPS]
+ [IN_OUT_ACL_N_TABLES];
/* convenience variables */
vlib_main_t *vlib_main;
vnet_main_t *vnet_main;
vnet_classify_main_t *vnet_classify_main;
- vnet_config_main_t *vnet_config_main[INPUT_ACL_N_TABLES];
-} input_acl_main_t;
+ vnet_config_main_t
+ * vnet_config_main[IN_OUT_ACL_N_TABLE_GROUPS][IN_OUT_ACL_N_TABLES];
+} in_out_acl_main_t;
-extern input_acl_main_t input_acl_main;
+extern in_out_acl_main_t in_out_acl_main;
+
+int vnet_set_in_out_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+ u32 ip4_table_index,
+ u32 ip6_table_index,
+ u32 l2_table_index, u32 is_add, u32 is_output);
int vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
u32 ip4_table_index,
u32 ip6_table_index,
u32 l2_table_index, u32 is_add);
-#endif /* __included_vnet_input_acl_h__ */
+int vnet_set_output_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
+ u32 ip4_table_index,
+ u32 ip6_table_index,
+ u32 l2_table_index, u32 is_add);
+
+#endif /* __included_vnet_in_out_acl_h__ */
/*
* fd.io coding-style-patch-verification: ON
diff --git a/src/vnet/classify/vnet_classify.c b/src/vnet/classify/vnet_classify.c
index ef45d1a4167..d287a2d39cf 100644
--- a/src/vnet/classify/vnet_classify.c
+++ b/src/vnet/classify/vnet_classify.c
@@ -13,7 +13,7 @@
* limitations under the License.
*/
#include <vnet/classify/vnet_classify.h>
-#include <vnet/classify/input_acl.h>
+#include <vnet/classify/in_out_acl.h>
#include <vnet/ip/ip.h>
#include <vnet/api_errno.h> /* for API error numbers */
#include <vnet/l2/l2_classify.h> /* for L2_INPUT_CLASSIFY_NEXT_xxx */
diff --git a/src/vnet/classify/vnet_classify.h b/src/vnet/classify/vnet_classify.h
index 40628015501..79e7f1a844e 100644
--- a/src/vnet/classify/vnet_classify.h
+++ b/src/vnet/classify/vnet_classify.h
@@ -27,6 +27,7 @@
#include <vnet/ip/ip6_packet.h>
#include <vlib/cli.h>
#include <vnet/l2/l2_input.h>
+#include <vnet/l2/l2_output.h>
#include <vnet/l2/feat_bitmap.h>
#include <vnet/api_errno.h> /* for API error numbers */