From 9137e5400699bed9f7c0095187839a8b38273100 Mon Sep 17 00:00:00 2001 From: Dave Barach Date: Fri, 13 Sep 2019 17:47:50 -0400 Subject: misc: classifier-based packet trace filter See .../src/vnet/classify/trace_classify.h for the business end of the scheme. It would be best to hash pkts, prefetch buckets, and do the primary table lookups two at a time. The inline as given works, but perf tuning will be required. "At least it works..." Add "classify filter" debug cli, for example: classify filter mask l3 ip4 src dst \ match l3 ip4 dst 192.168.2.10 src 192.168.1.10 Add "pcap rx | tx trace ... filter" to use the current classify filter chain Patch includes sphinx documentation and doxygen tags. Next step: device-driver integration Type: feature Signed-off-by: Dave Barach Change-Id: I05b1358a769f61e6d32470e0c87058f640486b26 --- src/vnet/classify/trace_classify.h | 100 +++++++++++++ src/vnet/classify/vnet_classify.c | 296 ++++++++++++++++++++++++++++++++++++- 2 files changed, 393 insertions(+), 3 deletions(-) create mode 100644 src/vnet/classify/trace_classify.h (limited to 'src/vnet/classify') diff --git a/src/vnet/classify/trace_classify.h b/src/vnet/classify/trace_classify.h new file mode 100644 index 00000000000..bc25ecd0ff7 --- /dev/null +++ b/src/vnet/classify/trace_classify.h @@ -0,0 +1,100 @@ +/* + * trace_classify.h - Use the classifier to decide if a packet is traced + * + * Copyright (c) 2019 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include +#include +#include +#include + +/** @file trace_classify.h + * Use the vpp classifier to decide whether to trace packets + */ + +/** @brief vnet_is_packet_traced + * @param vlib_buffer_t *b - packet to classify + * @param int func - 0 => use classifier w/ supplied table index + * @param u32 classify_table_index - classifier table index + * @return 0 => no trace, 1 => trace, -1 => error + */ + +static inline int +vnet_is_packet_traced_inline (vlib_buffer_t * b, + u32 classify_table_index, int func) +{ + vnet_classify_main_t *vcm = &vnet_classify_main; + vnet_classify_table_t *t; + vnet_classify_entry_t *e; + u64 hash; + + /*$$$ add custom classifiers here, if any */ + if (func != 0) + return -1; + + /* This will happen... */ + if (pool_is_free_index (vcm->tables, classify_table_index)) + return -1; + + /* Get the table */ + t = pool_elt_at_index (vcm->tables, classify_table_index); + + /* Hash the packet */ + hash = vnet_classify_hash_packet (t, vlib_buffer_get_current (b)); + + /* See if there's a matching entry */ + e = vnet_classify_find_entry (t, vlib_buffer_get_current (b), hash, + 0 /* time = 0, disables hit-counter */ ); + /* Hit means trace the packet... */ + if (e) + { + /* Manual hit accounting */ + e->hits++; + return 1; + } + + /* + * Look for a hit in a less-specific table. + * Performance hint: for this use-case, don't go there. + */ + while (1) + { + /* Most likely, we're done right now */ + if (PREDICT_TRUE (t->next_table_index == ~0)) + return 0; + t = pool_elt_at_index (vcm->tables, t->next_table_index); + + /* Compute hash for this table */ + hash = vnet_classify_hash_packet (t, vlib_buffer_get_current (b)); + + /* See if there's a matching entry */ + e = vnet_classify_find_entry (t, vlib_buffer_get_current (b), hash, + 0 /* time = 0, disables hit-counter */ ); + if (e) + { + /* Manual hit accounting */ + e->hits++; + return 1; + } + } + /* NOTREACHED */ +} + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/vnet/classify/vnet_classify.c b/src/vnet/classify/vnet_classify.c index b807a2679a7..94cc2419775 100755 --- a/src/vnet/classify/vnet_classify.c +++ b/src/vnet/classify/vnet_classify.c @@ -20,6 +20,11 @@ #include #include +/** + * @file + * @brief N-tuple classifier + */ + vnet_classify_main_t vnet_classify_main; #if VALIDATION_SCAFFOLDING @@ -939,6 +944,10 @@ unformat_ip4_mask (unformat_input_t * input, va_list * args) u8 *mask = 0; u8 found_something = 0; ip4_header_t *ip; + u32 src_prefix_len = 32; + u32 src_prefix_mask = ~0; + u32 dst_prefix_len = 32; + u32 dst_prefix_mask = ~0; #define _(a) u8 a=0; foreach_ip4_proto_field; @@ -953,6 +962,18 @@ unformat_ip4_mask (unformat_input_t * input, va_list * args) version = 1; else if (unformat (input, "hdr_length")) hdr_length = 1; + else if (unformat (input, "src/%d", &src_prefix_len)) + { + src_address = 1; + src_prefix_mask &= ~((1 << (32 - src_prefix_len)) - 1); + src_prefix_mask = clib_host_to_net_u32 (src_prefix_mask); + } + else if (unformat (input, "dst/%d", &dst_prefix_len)) + { + dst_address = 1; + dst_prefix_mask &= ~((1 << (32 - dst_prefix_len)) - 1); + dst_prefix_mask = clib_host_to_net_u32 (dst_prefix_mask); + } else if (unformat (input, "src")) src_address = 1; else if (unformat (input, "dst")) @@ -982,6 +1003,12 @@ unformat_ip4_mask (unformat_input_t * input, va_list * args) foreach_ip4_proto_field; #undef _ + if (src_address) + ip->src_address.as_u32 = src_prefix_mask; + + if (dst_address) + ip->dst_address.as_u32 = dst_prefix_mask; + ip->ip_version_and_header_length = 0; if (version) @@ -1577,7 +1604,7 @@ classify_table_command_fn (vlib_main_t * vm, if (!is_add && table_index == ~0) return clib_error_return (0, "table index required for delete"); - rv = vnet_classify_add_del_table (cm, mask, nbuckets, memory_size, + rv = vnet_classify_add_del_table (cm, mask, nbuckets, (u32) memory_size, skip, match, next_table_index, miss_next_index, &table_index, current_data_flag, current_data_offset, @@ -1595,7 +1622,8 @@ classify_table_command_fn (vlib_main_t * vm, } /* *INDENT-OFF* */ -VLIB_CLI_COMMAND (classify_table, static) = { +VLIB_CLI_COMMAND (classify_table, static) = +{ .path = "classify table", .short_help = "classify table [miss-next|l2-miss_next|acl-miss-next ]" @@ -1607,6 +1635,268 @@ VLIB_CLI_COMMAND (classify_table, static) = { }; /* *INDENT-ON* */ +static int +filter_table_mask_compare (void *a1, void *a2) +{ + vnet_classify_main_t *cm = &vnet_classify_main; + u32 *ti1 = a1; + u32 *ti2 = a2; + u32 n1 = 0, n2 = 0; + vnet_classify_table_t *t1, *t2; + u8 *m1, *m2; + int i; + + t1 = pool_elt_at_index (cm->tables, *ti1); + t2 = pool_elt_at_index (cm->tables, *ti2); + + m1 = (u8 *) (t1->mask); + m2 = (u8 *) (t2->mask); + + for (i = 0; i < vec_len (t1->mask) * sizeof (u32x4); i++) + { + n1 += count_set_bits (m1[0]); + m1++; + } + + for (i = 0; i < vec_len (t2->mask) * sizeof (u32x4); i++) + { + n2 += count_set_bits (m2[0]); + m2++; + } + + /* Reverse sort: descending number of set bits */ + if (n1 < n2) + return 1; + else if (n1 > n2) + return -1; + else + return 0; +} + +static clib_error_t * +classify_filter_command_fn (vlib_main_t * vm, + unformat_input_t * input, + vlib_cli_command_t * cmd) +{ + u32 nbuckets = 8; + vnet_main_t *vnm = vnet_get_main (); + uword memory_size = (uword) (128 << 10); + u32 skip = ~0; + u32 match = ~0; + u8 *match_vector; + int is_add = 1; + int del_chain = 0; + u32 table_index = ~0; + u32 next_table_index = ~0; + u32 miss_next_index = ~0; + u32 current_data_flag = 0; + int current_data_offset = 0; + int i; + vnet_classify_table_t *t; + u8 *mask = 0; + vnet_classify_main_t *cm = &vnet_classify_main; + int rv = 0; + + while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) + { + if (unformat (input, "del")) + is_add = 0; + else if (unformat (input, "buckets %d", &nbuckets)) + ; + else if (unformat (input, "mask %U", unformat_classify_mask, + &mask, &skip, &match)) + ; + else if (unformat (input, "memory-size %U", unformat_memory_size, + &memory_size)) + ; + else + break; + } + + if (is_add && mask == 0 && table_index == ~0) + return clib_error_return (0, "Mask required"); + + if (is_add && skip == ~0 && table_index == ~0) + return clib_error_return (0, "skip count required"); + + if (is_add && match == ~0 && table_index == ~0) + return clib_error_return (0, "match count required"); + + if (!is_add) + { + if (vec_len (vnm->classify_filter_table_indices) == 0) + return clib_error_return (0, "No classify filter set..."); + + del_chain = 1; + table_index = vnm->classify_filter_table_indices[0]; + vec_reset_length (vnm->classify_filter_table_indices); + } + + /* see if we already have a table for that... */ + + if (is_add) + { + for (i = 0; i < vec_len (vnm->classify_filter_table_indices); i++) + { + t = pool_elt_at_index (cm->tables, i); + /* classifier geometry mismatch, can't use this table */ + if (t->match_n_vectors != match || t->skip_n_vectors != skip) + continue; + /* Masks aren't congruent, can't use this table */ + if (vec_len (t->mask) != vec_len (mask)) + continue; + /* Masks aren't bit-for-bit identical, can't use this table */ + if (memcmp (t->mask, mask, vec_len (mask))) + continue; + + /* Winner... */ + table_index = i; + goto found_table; + } + } + + rv = vnet_classify_add_del_table (cm, mask, nbuckets, memory_size, + skip, match, next_table_index, + miss_next_index, &table_index, + current_data_flag, current_data_offset, + is_add, del_chain); + vec_free (mask); + + switch (rv) + { + case 0: + break; + + default: + return clib_error_return (0, "vnet_classify_add_del_table returned %d", + rv); + } + + if (is_add == 0) + return 0; + + /* Remember the table */ + vec_add1 (vnm->classify_filter_table_indices, table_index); + +found_table: + + /* Now try to parse a session */ + if (unformat (input, "match %U", unformat_classify_match, + cm, &match_vector, table_index) == 0) + return 0; + + + /* + * We use hit or miss to determine whether to trace or pcap pkts + * so the session setup is very limited + */ + rv = vnet_classify_add_del_session (cm, table_index, + match_vector, 0 /* hit_next_index */ , + 0 /* opaque_index */ , + 0 /* advance */ , + 0 /* action */ , + 0 /* metadata */ , + 1 /* is_add */ ); + + vec_free (match_vector); + + /* Sort filter tables from most-specific mask to least-specific mask */ + vec_sort_with_function (vnm->classify_filter_table_indices, + filter_table_mask_compare); + + ASSERT (vec_len (vnm->classify_filter_table_indices)); + + /* Setup next_table_index fields */ + for (i = 0; i < vec_len (vnm->classify_filter_table_indices); i++) + { + t = pool_elt_at_index (cm->tables, + vnm->classify_filter_table_indices[i]); + + if ((i + 1) < vec_len (vnm->classify_filter_table_indices)) + t->next_table_index = vnm->classify_filter_table_indices[i + 1]; + else + t->next_table_index = ~0; + } + + return 0; +} + +/*? + * Construct an arbitrary set of packet classifier tables for use with + * "pcap rx | tx trace," and (eventually) with the vpp packet + * tracer + * + * Packets which match a rule in the classifier table chain + * will be traced. The tables are automatically ordered so that + * matches in the most specific table are tried first. + * + * It's reasonably likely that folks will configure a single + * table with one or two matches. As a result, we configure + * 8 hash buckets and 128K of match rule space. One can override + * the defaults by specifiying "buckets " and "memory-size " + * as desired. + * + * To build up complex filter chains, repeatedly issue the + * classify filter debug CLI command. Each command must specify the desired + * mask and match values. If a classifier table with a suitable mask + * already exists, the CLI command adds a match rule to the existing table. + * If not, the CLI command add a new table and the indicated mask rule + * + * Here is a terse description of the "mask " syntax: + * + * l2 src dst proto tag1 tag2 ignore-tag1 ignore-tag2 cos1 cos2 dot1q dot1ad + * + * l3 ip4 ip6 + * + * version hdr_length src[/width] dst[/width] + * tos length fragment_id ttl protocol checksum + * + * version traffic-class flow-label src dst proto + * payload_length hop_limit protocol + * + * l4 tcp udp src_port dst_port + * + * src dst # ports + * + * src_port dst_port + * + * To construct matches, add the values to match after the indicated keywords: + * in the match syntax. For example: + * mask l3 ip4 src -> match l3 ip4 src 192.168.1.11 + * + * @cliexpar + * Configuring the classify filter + * + * Configure a simple classify filter, and configure pcap rx trace to use it: + * + * classify filter mask l3 ip4 src match l3 ip4 src 192.168.1.11"
+ * pcap rx trace on max 100 filter + * + * Configure another fairly simple filter + * + * classify filter mask l3 ip4 src dst match l3 ip4 src 192.168.1.10 dst 192.168.2.10" + * + * Clear all current classifier filters + * + * classify filter del + * + * To inspect the classifier tables, use + * + * show classify table [verbose] + * The verbose form displays all of the match rules, with hit-counters + * @cliexend + ?*/ +/* *INDENT-OFF* */ +VLIB_CLI_COMMAND (classify_filter, static) = +{ + .path = "classify filter", + .short_help = + "classify filter mask match [del]" + "[buckets ] [memory-size ]", + .function = classify_filter_command_fn, +}; +/* *INDENT-ON* */ + static u8 * format_vnet_classify_table (u8 * s, va_list * args) { @@ -2442,7 +2732,7 @@ vnet_classify_init (vlib_main_t * vm) VLIB_INIT_FUNCTION (vnet_classify_init); -#define TEST_CODE 1 +#define TEST_CODE 0 #if TEST_CODE > 0 -- cgit 1.2.3-korg