FD.io VPP  v17.04.2-2-ga8f93f8
Vector Packet Processing
acl.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef included_acl_h
16 #define included_acl_h
17 
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/l2/l2_output.h>
21 
22 
23 #include <vppinfra/hash.h>
24 #include <vppinfra/error.h>
25 #include <vppinfra/bitmap.h>
26 #include <vppinfra/elog.h>
27 #include "bihash_40_8.h"
28 #include "fa_node.h"
29 
30 #define ACL_PLUGIN_VERSION_MAJOR 1
31 #define ACL_PLUGIN_VERSION_MINOR 2
32 
35 
36 void input_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap);
37 void output_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap);
38 
44 };
45 
46 
47 enum address_e { IP4, IP6 };
48 typedef struct
49 {
50  enum address_e type;
51  union {
54  } addr;
55 } address_t;
56 
57 /*
58  * ACL rules
59  */
60 typedef struct
61 {
64  ip46_address_t src;
66  ip46_address_t dst;
75 } acl_rule_t;
76 
77 typedef struct
78 {
81  u8 src_mac[6];
82  u8 src_mac_mask[6];
83  ip46_address_t src_ip_addr;
86 
87 /*
88  * ACL
89  */
90 typedef struct
91 {
92  u8 tag[64];
95 } acl_list_t;
96 
97 typedef struct
98 {
99  u8 tag[64];
102  /* References to the classifier tables that will enforce the rules */
107 
108 typedef struct {
109  /* API message ID base */
111 
112  acl_list_t *acls; /* Pool of ACLs */
113  macip_acl_list_t *macip_acls; /* Pool of MAC-IP ACLs */
114 
115  /* ACLs associated with interfaces */
118 
119  /*
120  * Classify tables used to grab the packets for the ACL check,
121  * and serving as the 5-tuple session tables at the same time
122  */
127 
128  /* MACIP (input) ACLs associated with the interfaces */
130 
131  /* next indices for our nodes in the l2-classify tables */
134 
135  /* next node indices for feature bitmap */
136  u32 acl_in_node_feat_next_node_index[32];
137  u32 acl_out_node_feat_next_node_index[32];
138 
139  /* ACL match actions (must be coherent across in/out ACLs to next indices (can differ) */
140 
141  u32 acl_in_ip4_match_next[256];
142  u32 acl_in_ip6_match_next[256];
143  u32 acl_out_ip4_match_next[256];
144  u32 acl_out_ip6_match_next[256];
146 
147  /* bitmaps when set the processing is enabled on the interface */
150  /* bitmap, when set the hash is initialized */
152  clib_bihash_40_8_t *fa_sessions_by_sw_if_index;
153  /* pool for FA session data. See fa_node.h */
155  /* The process node which is responsible to deleting the sessions */
157  /* FA session timeouts, in seconds */
158  u32 session_timeout_sec[ACL_N_TIMEOUTS];
159  /* session add/delete counters */
162 
163  /* L2 datapath glue */
164 
165  /* active next indices within L2 classifiers - switch old/new path */
170  /* saved next indices within L2 classifiers for ip4/ip6 fa L2 nodes */
175  /* next node indices for L2 dispatch */
176  u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32];
177  u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32];
178  u32 fa_acl_out_ip4_l2_node_feat_next_node_index[32];
179  u32 fa_acl_out_ip6_l2_node_feat_next_node_index[32];
180 
181  /* EH values that we can skip over */
183 
184  /* whether to match L4 ACEs with ports on the non-initial fragment */
186 
187  /* conn table per-interface conn table parameters */
191 
192  /*
193  * If the cleaner has to delete more than this number
194  * of connections, it halves the sleep time.
195  */
196 
197 #define ACL_FA_DEFAULT_MAX_DELETED_SESSIONS_PER_INTERVAL 100
199 
200  /*
201  * If the cleaner deletes less than these connections,
202  * it increases the wait time by the "increment"
203  */
204 
205 #define ACL_FA_DEFAULT_MIN_DELETED_SESSIONS_PER_INTERVAL 1
207 
208 #define ACL_FA_DEFAULT_CLEANER_WAIT_TIME_INCREMENT 0.1
210 
212  u32 fa_conn_list_head[ACL_N_TIMEOUTS];
213  u32 fa_conn_list_tail[ACL_N_TIMEOUTS];
214 
215  /* Counters for the cleaner thread */
216 
217 #define foreach_fa_cleaner_counter \
218  _(fa_cleaner_cnt_delete_by_sw_index, "delete_by_sw_index events") \
219  _(fa_cleaner_cnt_delete_by_sw_index_ok, "delete_by_sw_index handled ok") \
220  _(fa_cleaner_cnt_unknown_event, "unknown events received") \
221  _(fa_cleaner_cnt_deleted_sessions, "sessions deleted") \
222  _(fa_cleaner_cnt_timer_restarted, "session idle timers restarted") \
223  _(fa_cleaner_cnt_wait_with_timeout, "event wait with timeout called") \
224  _(fa_cleaner_cnt_wait_without_timeout, "event wait w/o timeout called") \
225  _(fa_cleaner_cnt_event_cycles, "total event cycles") \
226  _(fa_cleaner_cnt_already_deleted, "try to delete already deleted conn") \
227 /* end of counters */
228 #define _(id, desc) u32 id;
230 #undef _
231 
232  /* convenience */
235 } acl_main_t;
236 
237 #define foreach_acl_eh \
238  _(HOPBYHOP , 0 , "IPv6ExtHdrHopByHop") \
239  _(ROUTING , 43 , "IPv6ExtHdrRouting") \
240  _(DESTOPT , 60 , "IPv6ExtHdrDestOpt") \
241  _(FRAGMENT , 44 , "IPv6ExtHdrFragment") \
242  _(MOBILITY , 135, "Mobility Header") \
243  _(HIP , 139, "Experimental use Host Identity Protocol") \
244  _(SHIM6 , 140, "Shim6 Protocol") \
245  _(EXP1 , 253, "Use for experimentation and testing") \
246  _(EXP2 , 254, "Use for experimentation and testing")
247 
248 /*
249 
250  "No Next Header" is not a header.
251  Also, Fragment header needs special processing.
252 
253  _(NONEXT , 59 , "NoNextHdr") \
254 
255 
256 ESP is hiding its internal format, so no point in trying to go past it.
257 
258  _(ESP , 50 , "EncapsulatingSecurityPayload") \
259 
260 
261 AH has a special treatment of its length, it is in 32-bit words, not 64-bit words like the rest.
262 
263  _(AUTH , 51 , "Authentication Header") \
264 
265 
266 */
267 
268 
269  typedef enum {
270  #define _(N, v, s) ACL_EH_##N = v,
272  #undef _
273  } acl_eh_t;
274 
275 
276 
277 extern acl_main_t acl_main;
278 
279 
280 #endif
acl_rule_t * rules
Definition: acl.h:94
macip_acl_rule_t * rules
Definition: acl.h:101
u32 * acl_ip4_output_classify_table_by_sw_if_index
Definition: acl.h:125
u32 fa_cleaner_node_index
Definition: acl.h:156
uword * fa_out_acl_on_sw_if_index
Definition: acl.h:149
u8 is_ipv6
Definition: acl.h:63
u64 fa_current_cleaner_timer_wait_interval
Definition: acl.h:211
Definition: acl.h:48
u32 ** input_acl_vec_by_sw_if_index
Definition: acl.h:116
u16 msg_id_base
Definition: acl.h:110
uword * fa_in_acl_on_sw_if_index
Definition: acl.h:148
int l4_match_nonfirst_fragment
Definition: acl.h:185
void input_acl_packet_match(u32 sw_if_index, vlib_buffer_t *b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
Definition: acl.c:905
u8 dst_prefixlen
Definition: acl.h:67
u32 * acl_ip6_input_classify_table_by_sw_if_index
Definition: acl.h:124
u32 count
Definition: acl.h:93
u32 l2_table_index
Definition: acl.h:105
ip6_address_t ip6
Definition: acl.h:52
struct _vlib_node_registration vlib_node_registration_t
Definition: acl.h:47
u32 l2_input_classify_next_acl_ip4
Definition: acl.h:166
vlib_node_registration_t acl_out_node
(constructor) VLIB_REGISTER_NODE (acl_out_node)
Definition: node_out.c:155
uword * fa_sessions_on_sw_if_index
Definition: acl.h:151
f64 fa_cleaner_wait_time_increment
Definition: acl.h:209
u32 fa_l2_output_classify_next_acl_ip4
Definition: acl.h:173
uword fa_conn_table_hash_memory_size
Definition: acl.h:189
u16 dst_port_or_code_last
Definition: acl.h:72
u32 l2_output_classify_next_acl_ip4
Definition: acl.h:168
u8 src_prefixlen
Definition: acl.h:65
ip46_address_t src_ip_addr
Definition: acl.h:83
Definition: acl.h:47
address_e
Definition: acl.h:47
acl_eh_t
Definition: acl.h:269
u64 fa_conn_table_max_entries
Definition: acl.h:190
vnet_main_t * vnet_main
Definition: acl.h:234
ip46_address_t src
Definition: acl.h:64
fa_session_t * fa_sessions_pool
Definition: acl.h:154
u8 src_prefixlen
Definition: acl.h:84
u8 is_permit
Definition: acl.h:62
unsigned long u64
Definition: types.h:89
u32 ip4_table_index
Definition: acl.h:103
clib_bihash_40_8_t * fa_sessions_by_sw_if_index
Definition: acl.h:152
u32 n_match_actions
Definition: acl.h:145
ip4_address_t ip4
Definition: acl.h:53
u32 * acl_ip4_input_classify_table_by_sw_if_index
Definition: acl.h:123
ip46_address_t dst
Definition: acl.h:66
u16 dst_port_or_code_first
Definition: acl.h:71
u32 fa_l2_input_classify_next_acl_ip4
Definition: acl.h:171
uword * fa_ipv6_known_eh_bitmap
Definition: acl.h:182
u32 fa_l2_output_classify_next_acl_ip6
Definition: acl.h:174
#define foreach_acl_eh
Definition: acl.h:237
u32 l2_input_classify_next_acl_ip6
Definition: acl.h:167
vlib_node_registration_t acl_in_node
(constructor) VLIB_REGISTER_NODE (acl_in_node)
Definition: node_in.c:154
u8 proto
Definition: acl.h:68
u16 src_port_or_type_first
Definition: acl.h:69
u64 fa_min_deleted_sessions_per_interval
Definition: acl.h:206
u32 fa_l2_input_classify_next_acl_ip6
Definition: acl.h:172
u64 * fa_session_dels_by_sw_if_index
Definition: acl.h:161
Definition: acl.h:60
#define foreach_fa_cleaner_counter
Definition: acl.h:217
u8 is_ipv6
Definition: acl.h:80
unsigned int u32
Definition: types.h:88
u16 src_port_or_type_last
Definition: acl.h:70
Bitmaps built as vectors of machine words.
u32 l2_output_classify_next_acl_old
Definition: acl.h:133
u64 * fa_session_adds_by_sw_if_index
Definition: acl.h:160
u64 uword
Definition: types.h:112
u32 * macip_acl_by_sw_if_index
Definition: acl.h:129
u32 * acl_ip6_output_classify_table_by_sw_if_index
Definition: acl.h:126
unsigned short u16
Definition: types.h:57
macip_acl_list_t * macip_acls
Definition: acl.h:113
double f64
Definition: types.h:142
unsigned char u8
Definition: types.h:56
u32 ip6_table_index
Definition: acl.h:104
u32 l2_input_classify_next_acl_old
Definition: acl.h:132
u8 tcp_flags_mask
Definition: acl.h:74
u64 fa_max_deleted_sessions_per_interval
Definition: acl.h:198
void output_acl_packet_match(u32 sw_if_index, vlib_buffer_t *b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
Definition: acl.c:941
u8 tcp_flags_value
Definition: acl.h:73
vhost_vring_addr_t addr
Definition: vhost-user.h:84
Definition: acl.h:90
acl_timeout_e
Definition: acl.h:39
u32 l2_output_classify_next_acl_ip6
Definition: acl.h:169
acl_list_t * acls
Definition: acl.h:112
acl_main_t acl_main
Definition: jvpp_acl.h:39
u32 ** output_acl_vec_by_sw_if_index
Definition: acl.h:117
u8 is_permit
Definition: acl.h:79
u32 fa_conn_table_hash_num_buckets
Definition: acl.h:188
foreach_fa_cleaner_counter vlib_main_t * vlib_main
Definition: acl.h:233