/* * Copyright (c) 2015 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include #include #include in_out_acl_main_t in_out_acl_main; static int vnet_in_out_acl_ip_feature_enable (vlib_main_t * vnm, in_out_acl_main_t * am, u32 sw_if_index, in_out_acl_table_id_t tid, int feature_enable, int is_output) { if (tid == IN_OUT_ACL_TABLE_L2) { if (is_output) l2output_intf_bitmap_enable (sw_if_index, L2OUTPUT_FEAT_ACL, feature_enable); else l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_ACL, feature_enable); } else { /* IP[46] */ vnet_feature_config_main_t *fcm; u8 arc; if (tid == IN_OUT_ACL_TABLE_IP4) { char *arc_name = is_output ? "ip4-output" : "ip4-unicast"; vnet_feature_enable_disable (arc_name, is_output ? "ip4-outacl" : "ip4-inacl", sw_if_index, feature_enable, 0, 0); arc = vnet_get_feature_arc_index (arc_name); } else { char *arc_name = is_output ? "ip6-output" : "ip6-unicast"; vnet_feature_enable_disable (arc_name, is_output ? "ip6-outacl" : "ip6-inacl", sw_if_index, feature_enable, 0, 0); arc = vnet_get_feature_arc_index (arc_name); } fcm = vnet_get_feature_arc_config_main (arc); am->vnet_config_main[is_output][tid] = &fcm->config_main; } return 0; } int vnet_set_in_out_acl_intfc (vlib_main_t * vm, u32 sw_if_index, u32 ip4_table_index, u32 ip6_table_index, u32 l2_table_index, u32 is_add, u32 is_output) { in_out_acl_main_t *am = &in_out_acl_main; vnet_classify_main_t *vcm = am->vnet_classify_main; u32 acl[IN_OUT_ACL_N_TABLES] = { ip4_table_index, ip6_table_index, l2_table_index }; u32 ti; /* Assume that we've validated sw_if_index in the API layer */ for (ti = 0; ti < IN_OUT_ACL_N_TABLES; ti++) { if (acl[ti] == ~0) continue; if (pool_is_free_index (vcm->tables, acl[ti])) return VNET_API_ERROR_NO_SUCH_TABLE; vec_validate_init_empty (am->classify_table_index_by_sw_if_index[is_output][ti], sw_if_index, ~0); /* Reject any DEL operation with wrong sw_if_index */ if (!is_add && (acl[ti] != am->classify_table_index_by_sw_if_index[is_output][ti] [sw_if_index])) { clib_warning ("Non-existent intf_idx=%d with table_index=%d for delete", sw_if_index, acl[ti]); return VNET_API_ERROR_NO_SUCH_TABLE; } /* Return ok on ADD operaton if feature is already enabled */ if (is_add && am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] != ~0) return 0; vnet_in_out_acl_ip_feature_enable (vm, am, sw_if_index, ti, is_add, is_output); if (is_add) am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] = acl[ti]; else am->classify_table_index_by_sw_if_index[is_output][ti][sw_if_index] = ~0; } return 0; } int vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index, u32 ip4_table_index, u32 ip6_table_index, u32 l2_table_index, u32 is_add) { return vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index, ip6_table_index, l2_table_index, is_add, IN_OUT_ACL_INPUT_TABLE_GROUP); } int vnet_set_output_acl_intfc (vlib_main_t * vm, u32 sw_if_index, u32 ip4_table_index, u32 ip6_table_index, u32 l2_table_index, u32 is_add) { return vnet_set_in_out_acl_intfc (vm, sw_if_index, ip4_table_index, ip6_table_index, l2_table_index, is_add, IN_OUT_ACL_OUTPUT_TABLE_GROUP); } static clib_error_t * set_in_out_acl_command_fn (vlib_main_t * vm, unformat_input_t * input, vlib_cli_command_t * cmd, u32 is_output) { vnet_main_t *vnm = vnet_get_main (); u32 sw_if_index = ~0; u32 ip4_table_index = ~0; u32 ip6_table_index = ~0; u32 l2_table_index = ~0; u32 is_add = 1; u32 idx_cnt = 0; int rv; while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { if (unformat (input, "intfc %U", unformat_vnet_sw_interface, vnm, &sw_if_index)) ; else if (unformat (input, "ip4-table %d", &ip4_table_index)) idx_cnt++; else if (unformat (input, "ip6-table %d", &ip6_table_index)) idx_cnt++; else if (unformat (input, "l2-table %d", &l2_table_index)) idx_cnt++; else if (unformat (input, "del")) is_add = 0; else break; } if (sw_if_index == ~0) return clib_error_return (0, "Interface must be specified."); if (!idx_cnt) return clib_err