FD.io VPP  v18.07-rc0-415-g6c78436
Vector Packet Processing
dataplane_node.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include <stddef.h>
16 #include <netinet/in.h>
17 
18 #include <vlib/vlib.h>
19 #include <vnet/vnet.h>
20 #include <vnet/pg/pg.h>
21 #include <vppinfra/error.h>
22 
23 
24 #include <acl/acl.h>
25 #include <vnet/ip/icmp46_packet.h>
26 
27 #include <plugins/acl/fa_node.h>
28 #include <plugins/acl/acl.h>
32 
33 #include <vppinfra/bihash_40_8.h>
35 
36 typedef struct
37 {
43  u64 packet_info[6];
47 
48 /* *INDENT-OFF* */
49 #define foreach_acl_fa_error \
50 _(ACL_DROP, "ACL deny packets") \
51 _(ACL_PERMIT, "ACL permit packets") \
52 _(ACL_NEW_SESSION, "new sessions added") \
53 _(ACL_EXIST_SESSION, "existing session packets") \
54 _(ACL_CHECK, "checked packets") \
55 _(ACL_RESTART_SESSION_TIMER, "restart session timer") \
56 _(ACL_TOO_MANY_SESSIONS, "too many sessions to add new") \
57 /* end of errors */
58 
59 typedef enum
60 {
61 #define _(sym,str) ACL_FA_ERROR_##sym,
63 #undef _
66 
67 /* *INDENT-ON* */
68 
69 
72  vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip6,
73  int is_input, int is_l2_path, u32 * l2_feat_next_node_index,
74  vlib_node_registration_t * acl_fa_node)
75 {
76  u32 n_left, *from;
77  u32 pkts_acl_checked = 0;
78  u32 pkts_new_session = 0;
79  u32 pkts_exist_session = 0;
80  u32 pkts_acl_permit = 0;
81  u32 pkts_restart_session_timer = 0;
82  u32 trace_bitmap = 0;
83  acl_main_t *am = &acl_main;
84  fa_5tuple_t fa_5tuple;
85  vlib_node_runtime_t *error_node;
86  u64 now = clib_cpu_time_now ();
87  uword thread_index = os_get_thread_index ();
88  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
89 
90  u16 nexts[VLIB_FRAME_SIZE], *next;
91  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
92 
93  from = vlib_frame_vector_args (frame);
94 
95  error_node = vlib_node_get_runtime (vm, acl_fa_node->index);
96 
97  vlib_get_buffers (vm, from, bufs, frame->n_vectors);
98  /* set the initial values for the current buffer the next pointers */
99  b = bufs;
100  next = nexts;
101 
102  n_left = frame->n_vectors;
103  while (n_left > 0)
104  {
105  u32 next0 = 0;
106  u8 action = 0;
107  u32 sw_if_index0;
108  u32 lc_index0 = ~0;
109  int acl_check_needed = 1;
110  u32 match_acl_in_index = ~0;
111  u32 match_acl_pos = ~0;
112  u32 match_rule_index = ~0;
113  u8 error0 = 0;
114 
115  n_left -= 1;
116 
117  if (is_input)
118  sw_if_index0 = vnet_buffer (b[0])->sw_if_index[VLIB_RX];
119  else
120  sw_if_index0 = vnet_buffer (b[0])->sw_if_index[VLIB_TX];
121 
122  if (is_input)
123  lc_index0 = am->input_lc_index_by_sw_if_index[sw_if_index0];
124  else
125  lc_index0 = am->output_lc_index_by_sw_if_index[sw_if_index0];
126 
127 
128  u32 **p_epoch_vec =
129  is_input ? &am->input_policy_epoch_by_sw_if_index :
131  u16 current_policy_epoch =
132  sw_if_index0 < vec_len (*p_epoch_vec) ? vec_elt (*p_epoch_vec,
133  sw_if_index0)
134  : (is_input * FA_POLICY_EPOCH_IS_INPUT);
135  /*
136  * Extract the L3/L4 matching info into a 5-tuple structure.
137  */
138 
139  acl_plugin_fill_5tuple_inline (&acl_main, lc_index0, b[0], is_ip6,
140  is_input, is_l2_path,
141  (fa_5tuple_opaque_t *) & fa_5tuple);
142  fa_5tuple.l4.lsb_of_sw_if_index = sw_if_index0 & 0xffff;
143  fa_5tuple.pkt.mask_type_index_lsb = ~0;
144 #ifdef FA_NODE_VERBOSE_DEBUG
146  ("ACL_FA_NODE_DBG: packet 5-tuple %016llx %016llx %016llx %016llx %016llx %016llx",
147  fa_5tuple.kv.key[0], fa_5tuple.kv.key[1], fa_5tuple.kv.key[2],
148  fa_5tuple.kv.key[3], fa_5tuple.kv.key[4], fa_5tuple.kv.value);
149 #endif
150 
151  /* Try to match an existing session first */
152 
153  if (acl_fa_ifc_has_sessions (am, sw_if_index0))
154  {
155  u64 value_sess = ~0ULL;
157  (am, is_ip6, sw_if_index0, &fa_5tuple, &value_sess)
158  && (value_sess != ~0ULL))
159  {
160  trace_bitmap |= 0x80000000;
161  error0 = ACL_FA_ERROR_ACL_EXIST_SESSION;
162  fa_full_session_id_t f_sess_id;
163 
164  f_sess_id.as_u64 = value_sess;
165  ASSERT (f_sess_id.thread_index < vec_len (vlib_mains));
166 
167  fa_session_t *sess =
168  get_session_ptr (am, f_sess_id.thread_index,
169  f_sess_id.session_index);
170  int old_timeout_type = fa_session_get_timeout_type (am, sess);
171  action =
172  acl_fa_track_session (am, is_input, sw_if_index0, now,
173  sess, &fa_5tuple);
174  /* expose the session id to the tracer */
175  match_rule_index = f_sess_id.session_index;
176  int new_timeout_type = fa_session_get_timeout_type (am, sess);
177  acl_check_needed = 0;
178  pkts_exist_session += 1;
179  /* Tracking might have changed the session timeout type, e.g. from transient to established */
180  if (PREDICT_FALSE (old_timeout_type != new_timeout_type))
181  {
182  acl_fa_restart_timer_for_session (am, now, f_sess_id);
183  pkts_restart_session_timer++;
184  trace_bitmap |=
185  0x00010000 + ((0xff & old_timeout_type) << 8) +
186  (0xff & new_timeout_type);
187  }
188  /*
189  * I estimate the likelihood to be very low - the VPP needs
190  * to have >64K interfaces to start with and then on
191  * exactly 64K indices apart needs to be exactly the same
192  * 5-tuple... Anyway, since this probability is nonzero -
193  * print an error and drop the unlucky packet.
194  * If this shows up in real world, we would need to bump
195  * the hash key length.
196  */
197  if (PREDICT_FALSE (sess->sw_if_index != sw_if_index0))
198  {
200  ("BUG: session LSB16(sw_if_index) and 5-tuple collision!");
201  acl_check_needed = 0;
202  action = 0;
203  }
205  {
206  /* if the MSB of policy epoch matches but not the LSB means it is a stale session */
207  if ((0 ==
208  ((current_policy_epoch ^
209  f_sess_id.intf_policy_epoch) &
211  && (current_policy_epoch !=
212  f_sess_id.intf_policy_epoch))
213  {
214  /* delete session and increment the counter */
217  sw_if_index0);
219  sw_if_index0)++;
221  (am, f_sess_id, now))
222  {
223  /* delete the session only if we were able to unlink it */
224  acl_fa_two_stage_delete_session (am, sw_if_index0,
225  f_sess_id, now);
226  }
227  acl_check_needed = 1;
228  trace_bitmap |= 0x40000000;
229  }
230  }
231  }
232  }
233 
234  if (acl_check_needed)
235  {
236  action = 0; /* deny by default */
238  (fa_5tuple_opaque_t *) &
239  fa_5tuple, is_ip6, &action,
240  &match_acl_pos,
241  &match_acl_in_index,
242  &match_rule_index, &trace_bitmap);
243  error0 = action;
244  if (1 == action)
245  pkts_acl_permit += 1;
246  if (2 == action)
247  {
248  if (!acl_fa_can_add_session (am, is_input, sw_if_index0))
249  acl_fa_try_recycle_session (am, is_input, thread_index,
250  sw_if_index0, now);
251 
252  if (acl_fa_can_add_session (am, is_input, sw_if_index0))
253  {
254  fa_session_t *sess =
255  acl_fa_add_session (am, is_input, is_ip6,
256  sw_if_index0,
257  now, &fa_5tuple,
258  current_policy_epoch);
259  acl_fa_track_session (am, is_input, sw_if_index0,
260  now, sess, &fa_5tuple);
261  pkts_new_session += 1;
262  }
263  else
264  {
265  action = 0;
266  error0 = ACL_FA_ERROR_ACL_TOO_MANY_SESSIONS;
267  }
268  }
269  }
270 
271 
272 
273  if (action > 0)
274  {
275  if (is_l2_path)
276  next0 = vnet_l2_feature_next (b[0], l2_feat_next_node_index, 0);
277  else
278  vnet_feature_next (sw_if_index0, &next0, b[0]);
279  }
280 #ifdef FA_NODE_VERBOSE_DEBUG
282  ("ACL_FA_NODE_DBG: sw_if_index %d lc_index %d action %d acl_index %d rule_index %d",
283  sw_if_index0, lc_index0, action, match_acl_in_index,
284  match_rule_index);
285 #endif
286 
288  && (b[0]->flags & VLIB_BUFFER_IS_TRACED)))
289  {
290  acl_fa_trace_t *t = vlib_add_trace (vm, node, b[0], sizeof (*t));
291  t->sw_if_index = sw_if_index0;
292  t->lc_index = lc_index0;
293  t->next_index = next0;
294  t->match_acl_in_index = match_acl_in_index;
295  t->match_rule_index = match_rule_index;
296  t->packet_info[0] = fa_5tuple.kv_40_8.key[0];
297  t->packet_info[1] = fa_5tuple.kv_40_8.key[1];
298  t->packet_info[2] = fa_5tuple.kv_40_8.key[2];
299  t->packet_info[3] = fa_5tuple.kv_40_8.key[3];
300  t->packet_info[4] = fa_5tuple.kv_40_8.key[4];
301  t->packet_info[5] = fa_5tuple.kv_40_8.value;
302  t->action = action;
303  t->trace_bitmap = trace_bitmap;
304  }
305 
306  next0 = next0 < node->n_next_nodes ? next0 : 0;
307  if (0 == next0)
308  b[0]->error = error_node->errors[error0];
309  next[0] = next0;
310 
311  next++;
312  b++;
313  pkts_acl_checked += 1;
314  }
315 
316  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
317 
318  vlib_node_increment_counter (vm, acl_fa_node->index,
319  ACL_FA_ERROR_ACL_CHECK, pkts_acl_checked);
320  vlib_node_increment_counter (vm, acl_fa_node->index,
321  ACL_FA_ERROR_ACL_PERMIT, pkts_acl_permit);
322  vlib_node_increment_counter (vm, acl_fa_node->index,
323  ACL_FA_ERROR_ACL_NEW_SESSION,
324  pkts_new_session);
325  vlib_node_increment_counter (vm, acl_fa_node->index,
326  ACL_FA_ERROR_ACL_EXIST_SESSION,
327  pkts_exist_session);
328  vlib_node_increment_counter (vm, acl_fa_node->index,
329  ACL_FA_ERROR_ACL_RESTART_SESSION_TIMER,
330  pkts_restart_session_timer);
331  return frame->n_vectors;
332 }
333 
336  vlib_node_runtime_t * node,
337  vlib_frame_t * frame)
338 {
339  acl_main_t *am = &acl_main;
340  return acl_fa_node_fn (vm, node, frame, 1, 1, 1,
343 }
344 
347  vlib_node_runtime_t * node,
348  vlib_frame_t * frame)
349 {
350  acl_main_t *am = &acl_main;
351  return acl_fa_node_fn (vm, node, frame, 0, 1, 1,
354 }
355 
358  vlib_node_runtime_t * node,
359  vlib_frame_t * frame)
360 {
361  acl_main_t *am = &acl_main;
362  return acl_fa_node_fn (vm, node, frame, 1, 0, 1,
365 }
366 
369  vlib_node_runtime_t * node,
370  vlib_frame_t * frame)
371 {
372  acl_main_t *am = &acl_main;
373  return acl_fa_node_fn (vm, node, frame, 0, 0, 1,
376 }
377 
378 /**** L3 processing path nodes ****/
379 
382  vlib_node_runtime_t * node,
383  vlib_frame_t * frame)
384 {
385  return acl_fa_node_fn (vm, node, frame, 1, 1, 0, 0, &acl_in_fa_ip6_node);
386 }
387 
390  vlib_node_runtime_t * node,
391  vlib_frame_t * frame)
392 {
393  return acl_fa_node_fn (vm, node, frame, 0, 1, 0, 0, &acl_in_fa_ip4_node);
394 }
395 
398  vlib_node_runtime_t * node,
399  vlib_frame_t * frame)
400 {
401  return acl_fa_node_fn (vm, node, frame, 1, 0, 0, 0, &acl_out_fa_ip6_node);
402 }
403 
406  vlib_node_runtime_t * node,
407  vlib_frame_t * frame)
408 {
409  return acl_fa_node_fn (vm, node, frame, 0, 0, 0, 0, &acl_out_fa_ip4_node);
410 }
411 
412 #ifndef CLIB_MARCH_VARIANT
413 static u8 *
414 format_fa_5tuple (u8 * s, va_list * args)
415 {
416  fa_5tuple_t *p5t = va_arg (*args, fa_5tuple_t *);
417 
418  if (p5t->pkt.is_ip6)
419  return format (s, "lc_index %d (lsb16 of sw_if_index %d) l3 %s%s %U -> %U"
420  " l4 proto %d l4_valid %d port %d -> %d tcp flags (%s) %02x rsvd %x",
421  p5t->pkt.lc_index, p5t->l4.lsb_of_sw_if_index,
422  "ip6",
423  p5t->
424  pkt.is_nonfirst_fragment ? " non-initial fragment" : "",
426  &p5t->ip6_addr[1], p5t->l4.proto, p5t->pkt.l4_valid,
427  p5t->l4.port[0], p5t->l4.port[1],
428  p5t->pkt.tcp_flags_valid ? "valid" : "invalid",
429  p5t->pkt.tcp_flags, p5t->pkt.flags_reserved);
430  else
431  return format (s, "lc_index %d (lsb16 of sw_if_index %d) l3 %s%s %U -> %U"
432  " l4 proto %d l4_valid %d port %d -> %d tcp flags (%s) %02x rsvd %x",
433  p5t->pkt.lc_index, p5t->l4.lsb_of_sw_if_index,
434  "ip4",
435  p5t->
436  pkt.is_nonfirst_fragment ? " non-initial fragment" : "",
438  &p5t->ip4_addr[1], p5t->l4.proto, p5t->pkt.l4_valid,
439  p5t->l4.port[0], p5t->l4.port[1],
440  p5t->pkt.tcp_flags_valid ? "valid" : "invalid",
441  p5t->pkt.tcp_flags, p5t->pkt.flags_reserved);
442 }
443 
444 u8 *
445 format_acl_plugin_5tuple (u8 * s, va_list * args)
446 {
447  return format_fa_5tuple (s, args);
448 }
449 
450 /* packet trace format function */
451 u8 *
452 format_acl_plugin_trace (u8 * s, va_list * args)
453 {
454  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
455  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
456  acl_fa_trace_t *t = va_arg (*args, acl_fa_trace_t *);
457 
458  s =
459  format (s,
460  "acl-plugin: lc_index: %d, sw_if_index %d, next index %d, action: %d, match: acl %d rule %d trace_bits %08x\n"
461  " pkt info %016llx %016llx %016llx %016llx %016llx %016llx",
462  t->lc_index, t->sw_if_index, t->next_index, t->action,
464  t->packet_info[0], t->packet_info[1], t->packet_info[2],
465  t->packet_info[3], t->packet_info[4], t->packet_info[5]);
466 
467  /* Now also print out the packet_info in a form usable by humans */
468  s = format (s, "\n %U", format_fa_5tuple, t->packet_info);
469  return s;
470 }
471 
472 
473 /* *INDENT-OFF* */
474 
475 static char *acl_fa_error_strings[] = {
476 #define _(sym,string) string,
478 #undef _
479 };
480 
482 {
483  .name = "acl-plugin-in-ip6-l2",
484  .vector_size = sizeof (u32),
485  .format_trace = format_acl_plugin_trace,
486  .type = VLIB_NODE_TYPE_INTERNAL,
487  .n_errors = ARRAY_LEN (acl_fa_error_strings),
488  .error_strings = acl_fa_error_strings,
489  .n_next_nodes = ACL_FA_N_NEXT,
490  .next_nodes =
491  {
492  [ACL_FA_ERROR_DROP] = "error-drop",
493  }
494 };
495 
497 {
498  .name = "acl-plugin-in-ip4-l2",
499  .vector_size = sizeof (u32),
500  .format_trace = format_acl_plugin_trace,
501  .type = VLIB_NODE_TYPE_INTERNAL,
502  .n_errors = ARRAY_LEN (acl_fa_error_strings),
503  .error_strings = acl_fa_error_strings,
504  .n_next_nodes = ACL_FA_N_NEXT,
505  .next_nodes =
506  {
507  [ACL_FA_ERROR_DROP] = "error-drop",
508  }
509 };
510 
512 {
513  .name = "acl-plugin-out-ip6-l2",
514  .vector_size = sizeof (u32),
515  .format_trace = format_acl_plugin_trace,
516  .type = VLIB_NODE_TYPE_INTERNAL,
517  .n_errors = ARRAY_LEN (acl_fa_error_strings),
518  .error_strings = acl_fa_error_strings,
519  .n_next_nodes = ACL_FA_N_NEXT,
520  .next_nodes =
521  {
522  [ACL_FA_ERROR_DROP] = "error-drop",
523  }
524 };
525 
527 {
528  .name = "acl-plugin-out-ip4-l2",
529  .vector_size = sizeof (u32),
530  .format_trace = format_acl_plugin_trace,
531  .type = VLIB_NODE_TYPE_INTERNAL,
532  .n_errors = ARRAY_LEN (acl_fa_error_strings),
533  .error_strings = acl_fa_error_strings,
534  .n_next_nodes = ACL_FA_N_NEXT,
535  .next_nodes =
536  {
537  [ACL_FA_ERROR_DROP] = "error-drop",
538  }
539 };
540 
541 
543 {
544  .name = "acl-plugin-in-ip6-fa",
545  .vector_size = sizeof (u32),
546  .format_trace = format_acl_plugin_trace,
547  .type = VLIB_NODE_TYPE_INTERNAL,
548  .n_errors = ARRAY_LEN (acl_fa_error_strings),
549  .error_strings = acl_fa_error_strings,
550  .n_next_nodes = ACL_FA_N_NEXT,
551  .next_nodes =
552  {
553  [ACL_FA_ERROR_DROP] = "error-drop",
554  }
555 };
556 
557 VNET_FEATURE_INIT (acl_in_ip6_fa_feature, static) =
558 {
559  .arc_name = "ip6-unicast",
560  .node_name = "acl-plugin-in-ip6-fa",
561  .runs_before = VNET_FEATURES ("ip6-flow-classify"),
562 };
563 
565 {
566  .name = "acl-plugin-in-ip4-fa",
567  .vector_size = sizeof (u32),
568  .format_trace = format_acl_plugin_trace,
569  .type = VLIB_NODE_TYPE_INTERNAL,
570  .n_errors = ARRAY_LEN (acl_fa_error_strings),
571  .error_strings = acl_fa_error_strings,
572  .n_next_nodes = ACL_FA_N_NEXT,
573  .next_nodes =
574  {
575  [ACL_FA_ERROR_DROP] = "error-drop",
576  }
577 };
578 
579 VNET_FEATURE_INIT (acl_in_ip4_fa_feature, static) =
580 {
581  .arc_name = "ip4-unicast",
582  .node_name = "acl-plugin-in-ip4-fa",
583  .runs_before = VNET_FEATURES ("ip4-flow-classify"),
584 };
585 
586 
588 {
589  .name = "acl-plugin-out-ip6-fa",
590  .vector_size = sizeof (u32),
591  .format_trace = format_acl_plugin_trace,
592  .type = VLIB_NODE_TYPE_INTERNAL,
593  .n_errors = ARRAY_LEN (acl_fa_error_strings),
594  .error_strings = acl_fa_error_strings,
595  .n_next_nodes = ACL_FA_N_NEXT,
596  .next_nodes =
597  {
598  [ACL_FA_ERROR_DROP] = "error-drop",
599  }
600 };
601 
602 VNET_FEATURE_INIT (acl_out_ip6_fa_feature, static) =
603 {
604  .arc_name = "ip6-output",
605  .node_name = "acl-plugin-out-ip6-fa",
606  .runs_before = VNET_FEATURES ("interface-output"),
607 };
608 
610 {
611  .name = "acl-plugin-out-ip4-fa",
612  .vector_size = sizeof (u32),
613  .format_trace = format_acl_plugin_trace,
614  .type = VLIB_NODE_TYPE_INTERNAL,
615  .n_errors = ARRAY_LEN (acl_fa_error_strings),
616  .error_strings = acl_fa_error_strings,
617  .n_next_nodes = ACL_FA_N_NEXT,
618  /* edit / add dispositions here */
619  .next_nodes =
620  {
621  [ACL_FA_ERROR_DROP] = "error-drop",
622  }
623 };
624 
625 VNET_FEATURE_INIT (acl_out_ip4_fa_feature, static) =
626 {
627  .arc_name = "ip4-output",
628  .node_name = "acl-plugin-out-ip4-fa",
629  .runs_before = VNET_FEATURES ("interface-output"),
630 };
631 #endif
632 
633 /* *INDENT-ON* */
634 
635 /*
636  * fd.io coding-style-patch-verification: ON
637  *
638  * Local Variables:
639  * eval: (c-set-style "gnu")
640  * End:
641  */
vlib_node_registration_t acl_in_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip4_node)
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
Definition: vec.h:437
u32 * input_policy_epoch_by_sw_if_index
Definition: acl.h:183
static fa_session_t * acl_fa_add_session(acl_main_t *am, int is_input, int is_ip6, u32 sw_if_index, u64 now, fa_5tuple_t *p5tuple, u16 current_policy_epoch)
u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32]
Definition: acl.h:254
#define CLIB_UNUSED(x)
Definition: clib.h:79
static int acl_fa_conn_list_delete_session(acl_main_t *am, fa_full_session_id_t sess_id, u64 now)
vlib_node_registration_t acl_out_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip4_node)
fa_session_l4_key_t l4
Definition: fa_node.h:71
fa_packet_info_t pkt
Definition: fa_node.h:73
vlib_node_registration_t acl_out_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip6_node)
acl_fa_error_t
vlib_node_registration_t acl_in_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip4_node)
unsigned long u64
Definition: types.h:89
static u64 clib_cpu_time_now(void)
Definition: time.h:73
static int acl_fa_ifc_has_sessions(acl_main_t *am, int sw_if_index0)
static int acl_fa_two_stage_delete_session(acl_main_t *am, u32 sw_if_index, fa_full_session_id_t sess_id, u64 now)
acl_main_t acl_main
Definition: jvpp_acl.h:39
u32 * output_policy_epoch_by_sw_if_index
Definition: acl.h:184
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
static uword acl_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_input, int is_l2_path, u32 *l2_feat_next_node_index, vlib_node_registration_t *acl_fa_node)
#define VLIB_NODE_FN(node)
Definition: node.h:173
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:451
vlib_main_t ** vlib_mains
Definition: buffer.c:303
unsigned char u8
Definition: types.h:56
static u32 vnet_l2_feature_next(vlib_buffer_t *b, u32 *next_nodes, u32 feat_bit)
Return the graph node index for the feature corresponding to the next set bit after clearing the curr...
Definition: feat_bitmap.h:94
vlib_node_registration_t acl_in_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip6_node)
u32 fa_acl_out_ip4_l2_node_feat_next_node_index[32]
Definition: acl.h:256
static fa_session_t * get_session_ptr(acl_main_t *am, u16 thread_index, u32 session_index)
u16 lsb_of_sw_if_index
Definition: fa_node.h:51
format_function_t format_ip4_address
Definition: format.h:81
VNET_FEATURE_INIT(acl_in_ip6_fa_feature, static)
vlib_node_registration_t acl_out_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip6_node)
#define always_inline
Definition: clib.h:92
unsigned int u32
Definition: types.h:88
static char * acl_fa_error_strings[]
u8 * format_acl_plugin_trace(u8 *s, va_list *args)
#define VLIB_FRAME_SIZE
Definition: node.h:364
static void acl_plugin_fill_5tuple_inline(void *p_acl_main, u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
u32 fa_acl_out_ip6_l2_node_feat_next_node_index[32]
Definition: acl.h:257
static void acl_fa_try_recycle_session(acl_main_t *am, int is_input, u16 thread_index, u32 sw_if_index, u64 now)
unsigned short u16
Definition: types.h:57
u64 * fa_session_epoch_change_by_sw_if_index
Definition: fa_node.h:157
u32 * output_lc_index_by_sw_if_index
Definition: acl.h:161
#define PREDICT_FALSE(x)
Definition: clib.h:105
static_always_inline void vnet_feature_next(u32 sw_if_index, u32 *next0, vlib_buffer_t *b0)
Definition: feature.h:237
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:135
#define FA_POLICY_EPOCH_IS_INPUT
Definition: fa_node.h:103
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1168
#define foreach_acl_fa_error
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:153
u16 n_vectors
Definition: node.h:380
format_function_t format_ip6_address
Definition: format.h:99
vlib_main_t * vm
Definition: buffer.c:294
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
Definition: buffer_node.h:332
clib_bihash_kv_40_8_t kv_40_8
Definition: fa_node.h:75
#define clib_warning(format, args...)
Definition: error.h:59
static vlib_node_runtime_t * vlib_node_get_runtime(vlib_main_t *vm, u32 node_index)
Get node runtime by node index.
Definition: node_funcs.h:89
u32 sw_if_index
Definition: fa_node.h:85
#define ARRAY_LEN(x)
Definition: clib.h:59
static int acl_fa_restart_timer_for_session(acl_main_t *am, u64 now, fa_full_session_id_t sess_id)
static int acl_fa_find_session(acl_main_t *am, int is_ip6, u32 sw_if_index0, fa_5tuple_t *p5tuple, u64 *pvalue_sess)
static int fa_session_get_timeout_type(acl_main_t *am, fa_session_t *sess)
#define ASSERT(truth)
u8 tcp_flags_valid
Definition: fa_node.h:33
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
static int acl_fa_can_add_session(acl_main_t *am, int is_input, u32 sw_if_index)
#define VNET_FEATURES(...)
Definition: feature.h:391
u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32]
Definition: acl.h:255
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
#define vec_elt(v, i)
Get vector value at index i.
vlib_node_registration_t acl_out_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip4_node)
struct _vlib_node_registration vlib_node_registration_t
Definition: defs.h:47
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
acl_fa_per_worker_data_t * per_worker_data
Definition: acl.h:297
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:267
static_always_inline uword os_get_thread_index(void)
Definition: os.h:62
static u8 acl_fa_track_session(acl_main_t *am, int is_input, u32 sw_if_index, u64 now, fa_session_t *sess, fa_5tuple_t *pkt_5tuple)
#define vnet_buffer(b)
Definition: buffer.h:360
static u8 * format_fa_5tuple(u8 *s, va_list *args)
u16 flags
Copy of main node flags.
Definition: node.h:486
ip4_address_t ip4_addr[2]
Definition: fa_node.h:67
int reclassify_sessions
Definition: acl.h:187
u8 * format_acl_plugin_5tuple(u8 *s, va_list *args)
u32 * input_lc_index_by_sw_if_index
Definition: acl.h:160
u16 mask_type_index_lsb
Definition: fa_node.h:31
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
Definition: buffer_funcs.h:128
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:295
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:111
Definition: defs.h:46
vlib_node_registration_t acl_in_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip6_node)
ip6_address_t ip6_addr[2]
Definition: fa_node.h:69