FD.io VPP  v18.01.2-1-g9b554f3
Vector Packet Processing
input_acl.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include <vnet/ip/ip.h>
18 
20 
21 static int
23  input_acl_main_t * am,
24  u32 sw_if_index,
25  input_acl_table_id_t tid, int feature_enable)
26 {
27 
28  if (tid == INPUT_ACL_TABLE_L2)
29  {
30  l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_ACL,
31  feature_enable);
32  }
33  else
34  { /* IP[46] */
36  u8 arc;
37 
38  if (tid == INPUT_ACL_TABLE_IP4)
39  {
40  vnet_feature_enable_disable ("ip4-unicast", "ip4-inacl",
41  sw_if_index, feature_enable, 0, 0);
42  arc = vnet_get_feature_arc_index ("ip4-unicast");
43  }
44  else
45  {
46  vnet_feature_enable_disable ("ip6-unicast", "ip6-inacl",
47  sw_if_index, feature_enable, 0, 0);
48  arc = vnet_get_feature_arc_index ("ip6-unicast");
49  }
50 
52  am->vnet_config_main[tid] = &fcm->config_main;
53  }
54 
55  return 0;
56 }
57 
58 int
60  u32 ip4_table_index,
61  u32 ip6_table_index, u32 l2_table_index, u32 is_add)
62 {
65  u32 acl[INPUT_ACL_N_TABLES] = { ip4_table_index, ip6_table_index,
66  l2_table_index
67  };
68  u32 ti;
69 
70  /* Assume that we've validated sw_if_index in the API layer */
71 
72  for (ti = 0; ti < INPUT_ACL_N_TABLES; ti++)
73  {
74  if (acl[ti] == ~0)
75  continue;
76 
77  if (pool_is_free_index (vcm->tables, acl[ti]))
78  return VNET_API_ERROR_NO_SUCH_TABLE;
79 
81  (am->classify_table_index_by_sw_if_index[ti], sw_if_index, ~0);
82 
83  /* Reject any DEL operation with wrong sw_if_index */
84  if (!is_add &&
85  (acl[ti] !=
86  am->classify_table_index_by_sw_if_index[ti][sw_if_index]))
87  {
89  ("Non-existent intf_idx=%d with table_index=%d for delete",
90  sw_if_index, acl[ti]);
91  return VNET_API_ERROR_NO_SUCH_TABLE;
92  }
93 
94  /* Return ok on ADD operaton if feature is already enabled */
95  if (is_add &&
96  am->classify_table_index_by_sw_if_index[ti][sw_if_index] != ~0)
97  return 0;
98 
99  vnet_inacl_ip_feature_enable (vm, am, sw_if_index, ti, is_add);
100 
101  if (is_add)
102  am->classify_table_index_by_sw_if_index[ti][sw_if_index] = acl[ti];
103  else
104  am->classify_table_index_by_sw_if_index[ti][sw_if_index] = ~0;
105  }
106 
107  return 0;
108 }
109 
110 static clib_error_t *
112  unformat_input_t * input, vlib_cli_command_t * cmd)
113 {
114  vnet_main_t *vnm = vnet_get_main ();
115  u32 sw_if_index = ~0;
116  u32 ip4_table_index = ~0;
117  u32 ip6_table_index = ~0;
118  u32 l2_table_index = ~0;
119  u32 is_add = 1;
120  u32 idx_cnt = 0;
121  int rv;
122 
124  {
125  if (unformat (input, "intfc %U", unformat_vnet_sw_interface,
126  vnm, &sw_if_index))
127  ;
128  else if (unformat (input, "ip4-table %d", &ip4_table_index))
129  idx_cnt++;
130  else if (unformat (input, "ip6-table %d", &ip6_table_index))
131  idx_cnt++;
132  else if (unformat (input, "l2-table %d", &l2_table_index))
133  idx_cnt++;
134  else if (unformat (input, "del"))
135  is_add = 0;
136  else
137  break;
138  }
139 
140  if (sw_if_index == ~0)
141  return clib_error_return (0, "Interface must be specified.");
142 
143  if (!idx_cnt)
144  return clib_error_return (0, "Table index should be specified.");
145 
146  if (idx_cnt > 1)
147  return clib_error_return (0, "Only one table index per API is allowed.");
148 
149  rv = vnet_set_input_acl_intfc (vm, sw_if_index, ip4_table_index,
150  ip6_table_index, l2_table_index, is_add);
151 
152  switch (rv)
153  {
154  case 0:
155  break;
156 
157  case VNET_API_ERROR_NO_MATCHING_INTERFACE:
158  return clib_error_return (0, "No such interface");
159 
160  case VNET_API_ERROR_NO_SUCH_ENTRY:
161  return clib_error_return (0, "No such classifier table");
162  }
163  return 0;
164 }
165 
166 /*
167  * Configure interface to enable/disble input ACL feature:
168  * intfc - interface name to be configured as input ACL
169  * Ip4-table <index> [del] - enable/disable IP4 input ACL
170  * Ip6-table <index> [del] - enable/disable IP6 input ACL
171  * l2-table <index> [del] - enable/disable Layer2 input ACL
172  *
173  * Note: Only one table index per API call is allowed.
174  *
175  */
176 /* *INDENT-OFF* */
177 VLIB_CLI_COMMAND (set_input_acl_command, static) = {
178  .path = "set interface input acl",
179  .short_help =
180  "set interface input acl intfc <int> [ip4-table <index>]\n"
181  " [ip6-table <index>] [l2-table <index>] [del]",
182  .function = set_input_acl_command_fn,
183 };
184 /* *INDENT-ON* */
185 
186 clib_error_t *
188 {
190  clib_error_t *error = 0;
191 
192  if ((error = vlib_call_init_function (vm, ip_inacl_init)))
193  return error;
194 
195  am->vlib_main = vm;
196  am->vnet_main = vnet_get_main ();
198 
199  return 0;
200 }
201 
203 
204 uword
205 unformat_acl_type (unformat_input_t * input, va_list * args)
206 {
207  u32 *acl_type = va_arg (*args, u32 *);
208  u32 tid = INPUT_ACL_N_TABLES;
209 
211  {
212  if (unformat (input, "ip4"))
213  tid = INPUT_ACL_TABLE_IP4;
214  else if (unformat (input, "ip6"))
215  tid = INPUT_ACL_TABLE_IP6;
216  else if (unformat (input, "l2"))
217  tid = INPUT_ACL_TABLE_L2;
218  else
219  break;
220  }
221 
222  *acl_type = tid;
223  return 1;
224 }
225 
226 u8 *
227 format_vnet_inacl_info (u8 * s, va_list * va)
228 {
229  input_acl_main_t *am = va_arg (*va, input_acl_main_t *);
230  int sw_if_idx = va_arg (*va, int);
231  u32 tid = va_arg (*va, u32);
232 
233  if (tid == ~0)
234  {
235  s = format (s, "%10s%20s\t\t%s", "Intfc idx", "Classify table",
236  "Interface name");
237  return s;
238  }
239 
240  s = format (s, "%10d%20d\t\t%U", sw_if_idx, tid,
241  format_vnet_sw_if_index_name, am->vnet_main, sw_if_idx);
242 
243  return s;
244 }
245 
246 static clib_error_t *
248  unformat_input_t * input, vlib_cli_command_t * cmd)
249 {
251  u32 type = INPUT_ACL_N_TABLES;
252  int i;
253  u32 *vec_tbl;
254 
256  {
257  if (unformat (input, "type %U", unformat_acl_type, &type))
258  ;
259  else
260  break;
261  }
262 
263  if (type == INPUT_ACL_N_TABLES)
264  return clib_error_return (0, "Invalid input ACL table type.");
265 
266  vec_tbl = am->classify_table_index_by_sw_if_index[type];
267 
268  if (vec_len (vec_tbl))
269  vlib_cli_output (vm, "%U", format_vnet_inacl_info, am, ~0 /* hdr */ , ~0);
270  else
271  vlib_cli_output (vm, "No input ACL tables configured");
272 
273  for (i = 0; i < vec_len (vec_tbl); i++)
274  {
275  if (vec_elt (vec_tbl, i) == ~0)
276  continue;
277 
279  am, i, vec_elt (vec_tbl, i));
280  }
281 
282  return 0;
283 }
284 
285 /* *INDENT-OFF* */
286 VLIB_CLI_COMMAND (show_inacl_command, static) = {
287  .path = "show inacl",
288  .short_help = "show inacl type [ip4|ip6|l2]",
289  .function = show_inacl_command_fn,
290 };
291 /* *INDENT-ON* */
292 
293 /*
294  * fd.io coding-style-patch-verification: ON
295  *
296  * Local Variables:
297  * eval: (c-set-style "gnu")
298  * End:
299  */
vnet_config_main_t config_main
Definition: feature.h:65
sll srl srl sll sra u16x4 i
Definition: vector_sse2.h:337
vnet_main_t * vnet_main
Definition: input_acl.h:45
u8 vnet_get_feature_arc_index(const char *s)
Definition: feature.c:127
vnet_main_t * vnet_get_main(void)
Definition: misc.c:47
u32 * classify_table_index_by_sw_if_index[INPUT_ACL_N_TABLES]
Definition: input_acl.h:41
static clib_error_t * set_input_acl_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: input_acl.c:111
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
unformat_function_t unformat_vnet_sw_interface
format_function_t format_vnet_sw_if_index_name
vnet_classify_main_t * vnet_classify_main
Definition: input_acl.h:46
u8 * format_vnet_inacl_info(u8 *s, va_list *va)
Definition: input_acl.c:227
static int vnet_inacl_ip_feature_enable(vlib_main_t *vnm, input_acl_main_t *am, u32 sw_if_index, input_acl_table_id_t tid, int feature_enable)
Definition: input_acl.c:22
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:111
#define clib_error_return(e, args...)
Definition: error.h:99
#define vlib_call_init_function(vm, x)
Definition: init.h:162
struct _unformat_input_t unformat_input_t
uword unformat_acl_type(unformat_input_t *input, va_list *args)
Definition: input_acl.c:205
vnet_config_main_t * vnet_config_main[INPUT_ACL_N_TABLES]
Definition: input_acl.h:47
vlib_main_t * vlib_main
Definition: input_acl.h:44
#define UNFORMAT_END_OF_INPUT
Definition: format.h:143
vlib_main_t * vm
Definition: buffer.c:283
#define clib_warning(format, args...)
Definition: error.h:59
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
Definition: pool.h:268
#define VLIB_CLI_COMMAND(x,...)
Definition: cli.h:154
struct _vnet_classify_main vnet_classify_main_t
Definition: vnet_classify.h:73
input_acl_main_t input_acl_main
Definition: input_acl.c:19
input_acl_table_id_t
Definition: input_acl.h:23
unsigned int u32
Definition: types.h:88
vnet_classify_main_t vnet_classify_main
Definition: vnet_classify.c:22
u64 uword
Definition: types.h:112
#define vec_elt(v, i)
Get vector value at index i.
u32 l2input_intf_bitmap_enable(u32 sw_if_index, u32 feature_bitmap, u32 enable)
Enable (or disable) the feature in the bitmap for the given interface.
Definition: l2_input.c:534
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
unsigned char u8
Definition: types.h:56
static clib_error_t * ip_inacl_init(vlib_main_t *vm)
Definition: ip_input_acl.c:438
static vnet_feature_config_main_t * vnet_get_feature_arc_config_main(u8 arc_index)
Definition: feature.h:149
static clib_error_t * show_inacl_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: input_acl.c:247
int vnet_set_input_acl_intfc(vlib_main_t *vm, u32 sw_if_index, u32 ip4_table_index, u32 ip6_table_index, u32 l2_table_index, u32 is_add)
Definition: input_acl.c:59
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
Definition: vec.h:481
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
Definition: cli.c:680
uword unformat(unformat_input_t *i, const char *fmt,...)
Definition: unformat.c:972
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
Definition: feature.c:229
static uword unformat_check_input(unformat_input_t *i)
Definition: format.h:169
clib_error_t * input_acl_init(vlib_main_t *vm)
Definition: input_acl.c:187