FD.io VPP  v17.01.1-3-gc6833f8
Vector Packet Processing
acl.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef included_acl_h
16 #define included_acl_h
17 
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/ethernet/ethernet.h>
21 #include <vnet/l2/l2_output.h>
22 
23 
24 #include <vppinfra/hash.h>
25 #include <vppinfra/error.h>
26 #include <vppinfra/elog.h>
27 
28 #define ACL_PLUGIN_VERSION_MAJOR 1
29 #define ACL_PLUGIN_VERSION_MINOR 1
30 
33 
34 void input_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap);
35 void output_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap);
36 
37 enum address_e { IP4, IP6 };
38 typedef struct
39 {
41  union {
44  } addr;
45 } address_t;
46 
47 /*
48  * ACL rules
49  */
50 typedef struct
51 {
54  ip46_address_t src;
56  ip46_address_t dst;
65 } acl_rule_t;
66 
67 typedef struct
68 {
71  u8 src_mac[6];
72  u8 src_mac_mask[6];
73  ip46_address_t src_ip_addr;
76 
77 /*
78  * ACL
79  */
80 typedef struct
81 {
82  u8 tag[64];
85 } acl_list_t;
86 
87 typedef struct
88 {
89  u8 tag[64];
92  /* References to the classifier tables that will enforce the rules */
97 
98 typedef struct {
99  /* API message ID base */
101 
102  acl_list_t *acls; /* Pool of ACLs */
103  macip_acl_list_t *macip_acls; /* Pool of MAC-IP ACLs */
104 
105  /* ACLs associated with interfaces */
108 
109  /*
110  * Classify tables used to grab the packets for the ACL check,
111  * and serving as the 5-tuple session tables at the same time
112  */
117 
118  /* MACIP (input) ACLs associated with the interfaces */
120 
121  /* next indices for our nodes in the l2-classify tables */
124 
125  /* next node indices for feature bitmap */
126  u32 acl_in_node_feat_next_node_index[32];
127  u32 acl_out_node_feat_next_node_index[32];
128 
129  /* ACL match actions (must be coherent across in/out ACLs to next indices (can differ) */
130 
131  u32 acl_in_ip4_match_next[256];
132  u32 acl_in_ip6_match_next[256];
133  u32 acl_out_ip4_match_next[256];
134  u32 acl_out_ip6_match_next[256];
136 
137 
138  /* convenience */
142 } acl_main_t;
143 
144 extern acl_main_t acl_main;
145 
146 
147 #endif
acl_rule_t * rules
Definition: acl.h:84
macip_acl_rule_t * rules
Definition: acl.h:91
u32 * acl_ip4_output_classify_table_by_sw_if_index
Definition: acl.h:115
u8 is_ipv6
Definition: acl.h:53
Definition: acl.h:38
u32 ** input_acl_vec_by_sw_if_index
Definition: acl.h:106
u16 msg_id_base
Definition: acl.h:100
bad routing header type(not 4)") sr_error (NO_MORE_SEGMENTS
void input_acl_packet_match(u32 sw_if_index, vlib_buffer_t *b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
Definition: acl.c:970
u8 dst_prefixlen
Definition: acl.h:57
u32 * acl_ip6_input_classify_table_by_sw_if_index
Definition: acl.h:114
u32 count
Definition: acl.h:83
u32 l2_table_index
Definition: acl.h:95
ip6_address_t ip6
Definition: acl.h:42
struct _vlib_node_registration vlib_node_registration_t
Definition: acl.h:37
vlib_node_registration_t acl_out_node
(constructor) VLIB_REGISTER_NODE (acl_out_node)
Definition: node_out.c:155
u16 dst_port_or_code_last
Definition: acl.h:62
u8 src_prefixlen
Definition: acl.h:55
ip46_address_t src_ip_addr
Definition: acl.h:73
Definition: acl.h:37
address_e
Definition: acl.h:37
vnet_main_t * vnet_main
Definition: acl.h:140
ip46_address_t src
Definition: acl.h:54
u8 src_prefixlen
Definition: acl.h:74
u8 is_permit
Definition: acl.h:52
u32 ip4_table_index
Definition: acl.h:93
u32 n_match_actions
Definition: acl.h:135
ip4_address_t ip4
Definition: acl.h:43
u32 * acl_ip4_input_classify_table_by_sw_if_index
Definition: acl.h:113
ip46_address_t dst
Definition: acl.h:56
u16 dst_port_or_code_first
Definition: acl.h:61
vlib_node_registration_t acl_in_node
(constructor) VLIB_REGISTER_NODE (acl_in_node)
Definition: node_in.c:154
u8 proto
Definition: acl.h:58
u16 src_port_or_type_first
Definition: acl.h:59
ethernet_main_t * ethernet_main
Definition: acl.h:141
Definition: acl.h:50
Definition: acl.h:98
u8 is_ipv6
Definition: acl.h:70
unsigned int u32
Definition: types.h:88
u16 src_port_or_type_last
Definition: acl.h:60
u32 count
Definition: acl.h:90
vlib_main_t * vlib_main
Definition: acl.h:139
u32 * macip_acl_by_sw_if_index
Definition: acl.h:119
u32 * acl_ip6_output_classify_table_by_sw_if_index
Definition: acl.h:116
unsigned short u16
Definition: types.h:57
macip_acl_list_t * macip_acls
Definition: acl.h:103
unsigned char u8
Definition: types.h:56
u32 l2_input_classify_next_acl
Definition: acl.h:122
u32 ip6_table_index
Definition: acl.h:94
u8 tcp_flags_mask
Definition: acl.h:64
void output_acl_packet_match(u32 sw_if_index, vlib_buffer_t *b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
Definition: acl.c:1006
u32 l2_output_classify_next_acl
Definition: acl.h:123
u8 tcp_flags_value
Definition: acl.h:63
vhost_vring_addr_t addr
Definition: vhost-user.h:81
Definition: acl.h:80
acl_list_t * acls
Definition: acl.h:102
acl_main_t acl_main
Definition: acl.c:57
u32 ** output_acl_vec_by_sw_if_index
Definition: acl.h:107
u8 is_permit
Definition: acl.h:69