24 #include <vpp/app/version.h> 43 #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__) 49 #define vl_api_version(n,v) static u32 api_version=(v); 58 #define REPLY_MSG_ID_BASE am->msg_id_base 63 #define foreach_acl_plugin_api_msg \ 64 _(ACL_PLUGIN_GET_VERSION, acl_plugin_get_version) \ 65 _(ACL_PLUGIN_CONTROL_PING, acl_plugin_control_ping) \ 66 _(ACL_ADD_REPLACE, acl_add_replace) \ 68 _(ACL_INTERFACE_ADD_DEL, acl_interface_add_del) \ 69 _(ACL_INTERFACE_SET_ACL_LIST, acl_interface_set_acl_list) \ 70 _(ACL_DUMP, acl_dump) \ 71 _(ACL_INTERFACE_LIST_DUMP, acl_interface_list_dump) \ 72 _(MACIP_ACL_ADD, macip_acl_add) \ 73 _(MACIP_ACL_ADD_REPLACE, macip_acl_add_replace) \ 74 _(MACIP_ACL_DEL, macip_acl_del) \ 75 _(MACIP_ACL_INTERFACE_ADD_DEL, macip_acl_interface_add_del) \ 76 _(MACIP_ACL_DUMP, macip_acl_dump) \ 77 _(MACIP_ACL_INTERFACE_GET, macip_acl_interface_get) \ 78 _(MACIP_ACL_INTERFACE_LIST_DUMP, macip_acl_interface_list_dump) 83 .version = VPP_BUILD_VER,
84 .description =
"Access Control Lists",
140 int msg_size =
sizeof (*rmp);
150 memset (rmp, 0, msg_size);
152 ntohs (VL_API_ACL_PLUGIN_GET_VERSION_REPLY + am->
msg_id_base);
171 rmp->
vpe_pid = ntohl (getpid ());
178 u32 * acl_list_index,
u8 * tag)
186 if (*acl_list_index != ~0)
193 (
"acl-plugin-error: Trying to replace nonexistent ACL %d (tag %s)",
194 *acl_list_index, tag);
195 return VNET_API_ERROR_NO_SUCH_ENTRY;
201 (
"acl-plugin-warning: supplied no rules for ACL %d (tag %s)",
202 *acl_list_index, tag);
211 for (i = 0; i <
count; i++)
214 memset (r, 0,
sizeof (*r));
238 if (~0 == *acl_list_index)
242 memset (a, 0,
sizeof (*a));
244 *acl_list_index = a - am->
acls;
248 a = am->
acls + *acl_list_index;
254 a->
rules = acl_new_rules;
256 memcpy (a->
tag, tag, sizeof (a->
tag));
270 return VNET_API_ERROR_NO_SUCH_ENTRY;
279 return VNET_API_ERROR_ACL_IN_USE_INBOUND;
288 return VNET_API_ERROR_ACL_IN_USE_OUTBOUND;
345 _(
" dmac smac etype ")
346 _(ether) __ __ __ __ __ __
v __ __ __ __ __ __
v __ __
v 353 _(" ttl pr checksum ")
362 _("L4 T/U sport dport ")
373 _(" dmac smac etype ")
374 _(ether) __ __ __ __ __ __
v __ __ __ __ __ __
v __ __
v 376 _(0x0000) __ __ __ __
378 _(0x0004) __ __
XX __
389 _("L4T/U sport dport ")
390 _(tcpudp)
XX XX XX XX _(padpad) __ __ __ __ _(padeth) __ __;
393 _(" dmac smac dot1q etype ")
394 _(ether) __ __ __ __ __ __
v __ __ __ __ __ __
v XX XX __ __
v XX XX v 395 _(padpad) __ __ __ __
396 _(padpad) __ __ __ __
397 _(padpad) __ __ __ __
401 _(" dmac smac dot1ad dot1q etype ")
402 _(ether) __ __ __ __ __ __
v __ __ __ __ __ __
v XX XX __ __
XX XX __ __
v XX XX v 403 _(padpad) __ __ __ __
404 _(padpad) __ __ __ __
421 while ((0ULL == *p64) && ((
u8 *) p64 - p) <
size)
425 return (p64 - (
u64 *) p) / 2;
430 u32 mask_len,
u32 next_table_index,
431 u32 miss_next_index,
u32 * table_index,
437 u32 match = (mask_len / 16) - skip;
438 u8 *skip_mask_ptr = mask + 16 * skip;
439 u32 current_data_flag = 0;
440 int current_data_offset = 0;
446 memory_size, skip, match,
447 next_table_index, miss_next_index,
448 table_index, current_data_flag,
449 current_data_offset, is_add,
457 u32 mask_len,
u32 next_table_index,
458 u32 miss_next_index,
u32 * table_index,
464 u32 match = (mask_len / 16) - skip;
465 u8 *skip_mask_ptr = mask + 16 * skip;
466 u32 current_data_flag = 0;
467 int current_data_offset = 0;
474 memory_size, skip, match,
475 next_table_index, miss_next_index,
476 table_index, current_data_flag,
477 current_data_offset, is_add,
487 u32 ip4_table_index = ~0;
488 u32 ip6_table_index = ~0;
489 u32 dot1q_table_index = ~0;
490 u32 dot1ad_table_index = ~0;
512 sizeof (ip4_5tuple_mask) - 1, ~0,
514 &ip4_table_index, 0);
524 &ip6_table_index, 0);
533 ~0, &dot1q_table_index, 0);
542 ~0, &dot1ad_table_index, 0);
552 u32 ip4_table_index = ~0;
553 u32 ip6_table_index = ~0;
554 u32 dot1q_table_index = ~0;
555 u32 dot1ad_table_index = ~0;
578 sizeof (ip4_5tuple_mask) - 1, ~0,
580 &ip4_table_index, 0);
590 &ip6_table_index, 0);
599 ~0, &dot1q_table_index, 0);
608 ~0, &dot1ad_table_index, 0);
616 u8 is_dot1ad,
u8 is_ip6)
637 idx = (is_dot1ad) ? 20 : 16;
658 match[idx + 1] = 0xdd;
664 match[idx + 1] = 0x00;
668 session_idx, 0, 0, 0, 1);
671 match[idx + 1] = 0xff;
685 u32 ip4_table_index = ~0;
686 u32 ip6_table_index = ~0;
687 u32 dot1q_table_index = ~0;
688 u32 dot1ad_table_index = ~0;
697 sizeof (ip4_5tuple_mask) - 1, ~0,
699 &ip4_table_index, 1);
707 &ip6_table_index, 1);
711 sizeof (ip4_5tuple_mask) - 1, ~0,
713 &ip4_table_index, 0);
720 ~0, &dot1ad_table_index, 1);
724 dot1ad_table_index, ~0,
725 &dot1q_table_index, 1);
730 ~0, &dot1ad_table_index, 0);
734 &ip6_table_index, 0);
736 sizeof (ip4_5tuple_mask) - 1, ~0,
738 &ip4_table_index, 0);
744 ip6_table_index, dot1q_table_index);
749 sizeof (ip4_5tuple_mask) - 1, ~0,
751 &ip4_table_index, 0);
755 &ip6_table_index, 0);
758 ~0, &dot1q_table_index, 0);
761 ~0, &dot1ad_table_index, 0);
790 u32 ip4_table_index = ~0;
791 u32 ip6_table_index = ~0;
792 u32 dot1q_table_index = ~0;
793 u32 dot1ad_table_index = ~0;
802 sizeof (ip4_5tuple_mask) - 1, ~0,
804 &ip4_table_index, 1);
811 &ip6_table_index, 1);
815 sizeof (ip4_5tuple_mask) - 1, ~0,
817 &ip4_table_index, 0);
824 ~0, &dot1ad_table_index, 1);
828 dot1ad_table_index, ~0,
829 &dot1q_table_index, 1);
834 ~0, &dot1ad_table_index, 0);
838 &ip6_table_index, 0);
840 sizeof (ip4_5tuple_mask) - 1, ~0,
842 &ip4_table_index, 0);
848 ip6_table_index, dot1q_table_index);
851 (
"ACL enabling on interface sw_if_index %d, setting tables to the following: ip4: %d ip6: %d\n",
852 sw_if_index, ip4_table_index, ip6_table_index);
858 &ip6_table_index, 0);
860 sizeof (ip4_5tuple_mask) - 1, ~0,
862 &ip4_table_index, 0);
865 ~0, &dot1q_table_index, 0);
868 ~0, &dot1ad_table_index, 0);
902 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
927 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
957 return VNET_API_ERROR_NO_SUCH_ENTRY;
970 (
"ACL %d is already applied inbound on sw_if_index %d (index %d)",
971 acl_list_index, sw_if_index, index);
974 return VNET_API_ERROR_ACL_IN_USE_INBOUND;
996 (
"ACL %d is already applied outbound on sw_if_index %d (index %d)",
997 acl_list_index, sw_if_index, index);
1000 return VNET_API_ERROR_ACL_IN_USE_OUTBOUND;
1008 &acl_list_index, 1);
1023 int rv = VNET_API_ERROR_NO_SUCH_ENTRY;
1031 if (acl_list_index ==
1066 if (acl_list_index ==
1116 u32 acl_list_index =
1146 u32 acl_list_index =
1172 int rv = VNET_API_ERROR_NO_SUCH_ENTRY;
1212 for (i = 0; i <
vec_len (mv); i++)
1214 if ((mv[i].prefix_len == prefix_len) && (mv[
i].
is_ipv6 == is_ipv6)
1215 && (0 == memcmp (mv[i].mac_mask, mac_mask, 6)))
1230 unsigned int mac_bits_set = 0;
1231 unsigned int mac_byte;
1233 for (i = 0; i < 6; i++)
1236 for (; mac_byte; mac_byte >>= 1)
1237 mac_bits_set += mac_byte & 1;
1274 u32 match_type_index;
1280 for (i = 0; i < a->
count; i++)
1288 match_type_index =
vec_len (mvec);
1290 memcpy (mvec[match_type_index].mac_mask,
1298 mvec[match_type_index].
count++;
1313 memset (mask, 0,
sizeof (mask));
1314 memcpy (&mask[6], mt->
mac_mask, 6);
1315 memset (&mask[12], 0xff, 2);
1316 memcpy (&mask[14 + 8], mt->
mac_mask, 6);
1319 mask[14 + 14 + i] = 0xff;
1322 0xff - ((1 << (8 - mt->
prefix_len % 8)) - 1);
1324 mask_len = ((14 + 14 + ((mt->
prefix_len + 7) / 8) +
1327 (~0 == last_table) ? 0 : ~0,
1339 u32 *last_tag_table;
1345 for (tags = 2; tags >= 0; tags--)
1347 memset (mask, 0,
sizeof (mask));
1348 memcpy (&mask[6], mt->
mac_mask, 6);
1353 memset (&mask[12], 0xff, 2);
1357 memset (&mask[12], 0xff, 2);
1358 memset (&mask[16], 0xff, 2);
1362 memset (&mask[12], 0xff, 2);
1363 memset (&mask[16], 0xff, 2);
1364 memset (&mask[20], 0xff, 2);
1370 mask[l3_src_offs +
i] = 0xff;
1375 0xff - ((1 << (8 - mt->
prefix_len % 8)) - 1);
1381 mask_len = ((l3_src_offs + ((mt->
prefix_len + 7) / 8) +
1384 (~0 == last_table) ? 0 : ~0,
1386 last_table = *last_tag_table;
1388 memset (&mask[12], 0,
sizeof (mask) - 12);
1397 for (i = 0; i < a->
count; i++)
1410 ASSERT (match_type_index != ~0);
1413 for (tags = 2; tags >= 0; tags--)
1415 memset (mask, 0,
sizeof (mask));
1443 mask[eth + 1] = 0xdd;
1449 mask[eth + 1] = 0x00;
1455 i, 0, action, metadata, 1);
1456 memset (&mask[12], 0,
sizeof (mask) - 12);
1461 if (!is6 && (mvec[match_type_index].arp_table_index != ~0))
1463 memset (mask, 0,
sizeof (mask));
1471 [match_type_index].arp_table_index,
1473 i, 0, action, metadata, 1);
1528 u32 * acl_list_index,
u8 * tag)
1537 if (*acl_list_index != ~0)
1544 (
"acl-plugin-error: Trying to replace nonexistent MACIP ACL %d (tag %s)",
1545 *acl_list_index, tag);
1546 return VNET_API_ERROR_NO_SUCH_ENTRY;
1553 (
"acl-plugin-warning: Trying to create empty MACIP ACL (tag %s)",
1557 if (~0 != *acl_list_index)
1564 for (i = 0; i <
count; i++)
1566 r = &acl_new_rules[
i];
1571 if (rules[i].is_ipv6)
1578 if (~0 == *acl_list_index)
1582 memset (a, 0,
sizeof (*a));
1596 a->
rules = acl_new_rules;
1598 memcpy (a->
tag, tag, sizeof (a->
tag));
1616 u32 macip_acl_index;
1623 if (~0 == macip_acl_index)
1624 return VNET_API_ERROR_NO_SUCH_ENTRY;
1639 u32 macip_acl_index)
1645 return VNET_API_ERROR_NO_SUCH_ENTRY;
1671 return VNET_API_ERROR_NO_SUCH_ENTRY;
1736 if (supplied_len < expected_len)
1738 clib_warning (
"%s: Supplied message length %d is less than expected %d",
1739 where, supplied_len, expected_len);
1757 u32 expected_len =
sizeof (*mp) + acl_count *
sizeof (mp->
r[0]);
1765 rv = VNET_API_ERROR_INVALID_VALUE;
1780 vl_api_acl_del_reply_t *rmp;
1794 vl_api_acl_interface_add_del_reply_t *rmp;
1798 rv = VNET_API_ERROR_INVALID_SW_IF_INDEX;
1812 vl_api_acl_interface_set_acl_list_reply_t *rmp;
1819 rv = VNET_API_ERROR_INVALID_SW_IF_INDEX;
1825 for (i = 0; i < mp->
count; i++)
1830 rv = VNET_API_ERROR_NO_SUCH_ENTRY;
1835 for (i = 0; i < mp->
count; i++)
1839 ntohl (mp->
acls[i]));
1844 REPLY_MACRO (VL_API_ACL_INTERFACE_SET_ACL_LIST_REPLY);
1880 int msg_size =
sizeof (*mp) +
sizeof (mp->
r[0]) * acl->
count;
1884 memset (mp, 0, msg_size);
1885 mp->_vl_msg_id = ntohs (VL_API_ACL_DETAILS + am->
msg_id_base);
1891 memcpy (mp->
tag, acl->
tag, sizeof (mp->
tag));
1894 for (i = 0; i < acl->
count; i++)
1926 send_acl_details(am, q, acl, mp->context);
1950 u32 sw_if_index,
u32 context)
1965 count = n_input + n_output;
1967 msg_size =
sizeof (*mp);
1968 msg_size +=
sizeof (mp->
acls[0]) * count;
1971 memset (mp, 0, msg_size);
1973 ntohs (VL_API_ACL_INTERFACE_LIST_DETAILS + am->
msg_id_base);
1980 for (i = 0; i < n_input; i++)
1984 for (i = 0; i < n_output; i++)
1986 mp->
acls[n_input +
i] =
2015 send_acl_interface_list_details(am, q, swif->sw_if_index, mp->context);
2035 u32 acl_list_index = ~0;
2037 u32 expected_len =
sizeof (*mp) + acl_count *
sizeof (mp->
r[0]);
2045 rv = VNET_API_ERROR_INVALID_VALUE;
2064 u32 expected_len =
sizeof (*mp) + acl_count *
sizeof (mp->
r[0]);
2072 rv = VNET_API_ERROR_INVALID_VALUE;
2087 vl_api_macip_acl_del_reply_t *rmp;
2100 vl_api_macip_acl_interface_add_del_reply_t *rmp;
2106 rv = VNET_API_ERROR_INVALID_SW_IF_INDEX;
2112 REPLY_MACRO (VL_API_MACIP_ACL_INTERFACE_ADD_DEL_REPLY);
2123 int msg_size =
sizeof (*mp) + (acl ?
sizeof (mp->
r[0]) * acl->
count : 0);
2126 memset (mp, 0, msg_size);
2127 mp->_vl_msg_id = ntohs (VL_API_MACIP_ACL_DETAILS + am->
msg_id_base);
2133 memcpy (mp->
tag, acl->
tag, sizeof (mp->
tag));
2137 for (i = 0; i < acl->
count; i++)
2146 memcpy (rules[i].src_ip_addr, &r->
src_ip_addr.ip6,
2149 memcpy (rules[i].src_ip_addr, &r->
src_ip_addr.ip4,
2184 send_macip_acl_details (am, q, acl,
2208 int msg_size =
sizeof (*rmp) +
sizeof (rmp->
acls[0]) * count;
2219 memset (rmp, 0, msg_size);
2221 ntohs (VL_API_MACIP_ACL_INTERFACE_GET_REPLY + am->
msg_id_base);
2223 rmp->
count = htonl (count);
2224 for (i = 0; i <
count; i++)
2236 u32 acl_index,
u32 context)
2240 int msg_size =
sizeof (*rmp) +
sizeof (rmp->
acls[0]);
2243 memset (rmp, 0, msg_size);
2245 ntohs (VL_API_MACIP_ACL_INTERFACE_LIST_DETAILS + am->
msg_id_base);
2251 rmp->
acls[0] = htonl (acl_index);
2270 if (sw_if_index == ~0)
2300 vl_msg_api_set_handlers((VL_API_##N + am->msg_id_base), \ 2302 vl_api_##n##_t_handler, \ 2304 vl_api_##n##_t_endian, \ 2305 vl_api_##n##_t_print, \ 2306 sizeof(vl_api_##n##_t), 1); 2313 #define vl_msg_name_crc_list 2315 #undef vl_msg_name_crc_list 2320 #define _(id,n,crc) \ 2321 vl_msg_api_add_msg_name_crc (apim, #n "_" #crc, id + am->msg_id_base); 2322 foreach_vl_msg_name_crc_acl;
2382 clib_warning (
"Unknown timeout type %d", timeout_type);
2401 if ((eh < 256) && (value < 2))
2449 if (
unformat (input,
"skip-ipv6-extension-header %u %u", &eh_val, &val))
2457 if (
unformat (input,
"use-hash-acl-matching %u", &val))
2462 if (
unformat (input,
"l4-match-nonfirst-fragment %u", &val))
2471 if (
unformat (input,
"validate %u", &val))
2473 else if (
unformat (input,
"trace %u", &val))
2479 if (
unformat (input,
"validate %u", &val))
2481 else if (
unformat (input,
"trace %u", &val))
2492 if (
unformat (input,
"max-entries"))
2497 "expecting maximum number of entries, got `%U`",
2507 if (
unformat (input,
"hash-table-buckets"))
2512 "expecting maximum number of hash table buckets, got `%U`",
2522 if (
unformat (input,
"hash-table-memory"))
2527 "expecting maximum amount of hash table memory, got `%U`",
2545 if (!
unformat (input,
"%u", &timeout))
2548 "expecting timeout value in seconds, got `%U`",
2564 if (!
unformat (input,
"%u", &timeout))
2567 "expecting timeout value in seconds, got `%U`",
2580 if (!
unformat (input,
"%u", &timeout))
2583 "expecting timeout value in seconds, got `%U`",
2606 u8 *
a = va_arg (*args,
u8 *);
2607 return format (s,
"%02x:%02x:%02x:%02x:%02x:%02x",
2608 a[0], a[1], a[2], a[3], a[4], a[5]);
2616 out =
format (out,
"%s action %d ip %U/%d mac %U mask %U",
2640 "MACIP acl_index: %d, count: %d (true len %d) tag {%s} is free pool slot: %d\n",
2644 " ip4_table_index %d, ip6_table_index %d, l2_table_index %d\n",
2682 #define PRINT_AND_RESET(vm, out0) do { vlib_cli_output(vm, "%v", out0); vec_reset_length(out0); } while(0) 2687 u8 *out0 =
format (0,
"acl-index %u count %u tag {%s}\n", acl_index,
2691 for (j = 0; j < am->
acls[acl_index].
count; j++)
2694 out0 =
format (out0,
" %4d: %s ", j, r->
is_ipv6 ?
"ipv6" :
"ipv4");
2719 out0 =
format (out0,
"\n");
2724 #undef PRINT_AND_RESET 2739 if ((acl_index != ~0) && (acl_index !=
i))
2768 (void)
unformat (input,
"index %u", &acl_index);
2784 if ((sw_if_index != ~0) && (sw_if_index != swi))
2831 u64 five_tuple[6] = { 0, 0, 0, 0, 0, 0 };
2834 (input,
"%llx %llx %llx %llx %llx %llx", &five_tuple[0], &five_tuple[1],
2835 &five_tuple[2], &five_tuple[3], &five_tuple[4], &five_tuple[5]))
2852 u32 sw_if_index = ~0;
2853 (void)
unformat (input,
"sw_if_index %u", &sw_if_index);
2854 int show_acl =
unformat (input,
"acl");
2891 u32 show_session_thread_id,
2892 u32 show_session_session_index)
2902 vlib_cli_output (vm,
"Sessions total: add %lu - del %lu = %lu", n_adds,
2903 n_dels, n_adds - n_dels);
2910 if (show_session_thread_id == wk
2914 show_session_session_index);
2919 " info: %016llx %016llx %016llx %016llx %016llx %016llx",
2920 m[0], m[1], m[2], m[3], m[4], m[5]);
2943 (pw->fa_session_adds_by_sw_if_index)
2945 pw->fa_session_adds_by_sw_if_index
2950 (pw->fa_session_dels_by_sw_if_index)
2952 pw->fa_session_dels_by_sw_if_index
2954 vlib_cli_output (vm,
2955 " sw_if_index %d: add %lu - del %lu = %lu",
2970 head_session_index);
2971 if (~0 != head_session_index)
3010 #define _(cnt, desc) vlib_cli_output(vm, " %20lu: %s", am->cnt, desc); 3016 "Sessions per interval: min %lu max %lu increment: %f ms current: %f ms",
3032 u32 show_bihash_verbose = 0;
3033 u32 show_session_thread_id = ~0;
3034 u32 show_session_session_index = ~0;
3035 (void)
unformat (input,
"thread %u index %u", &show_session_thread_id,
3036 &show_session_session_index);
3037 (void)
unformat (input,
"verbose %u", &show_bihash_verbose);
3040 show_session_session_index);
3055 vlib_cli_output(vm,
" %3d: %016llx %016llx %016llx %016llx %016llx %016llx refcount %d",
3056 mte - am->ace_mask_type_pool,
3057 mte->mask.kv.key[0], mte->mask.kv.key[1], mte->mask.kv.key[2],
3058 mte->mask.kv.key[3], mte->mask.kv.key[4], mte->mask.kv.value, mte->refcount);
3072 if ((acl_index != ~0) && (acl_index !=
i))
3089 " %4d: %016llx %016llx %016llx %016llx %016llx %016llx mask index %d acl %d rule %d action %d src/dst portrange not ^2: %d,%d\n",
3090 j, m[0], m[1], m[2], m[3], m[4], m[5],
3102 " %4d: acl %d rule %d action %d bitmask-ready rule %d next %d prev %d tail %d hitcount %lld",
3122 if ((sw_if_index != ~0) && (sw_if_index != swi))
3189 u32 sw_if_index = ~0;
3190 int show_acl_hash_info = 0;
3191 int show_applied_info = 0;
3192 int show_mask_type = 0;
3193 int show_bihash = 0;
3194 u32 show_bihash_verbose = 0;
3198 show_acl_hash_info = 1;
3201 unformat (input,
"index %u", &acl_index);
3203 else if (
unformat (input,
"applied"))
3205 show_applied_info = 1;
3206 unformat (input,
"sw_if_index %u", &sw_if_index);
3215 unformat (input,
"verbose %u", &show_bihash_verbose);
3219 (show_mask_type || show_acl_hash_info || show_applied_info
3224 show_acl_hash_info = 1;
3225 show_applied_info = 1;
3230 if (show_acl_hash_info)
3232 if (show_applied_info)
3253 .path =
"set acl-plugin",
3254 .short_help =
"set acl-plugin session timeout {{udp idle}|tcp {idle|transient}} <seconds>",
3259 .path =
"show acl-plugin acl",
3260 .short_help =
"show acl-plugin acl [index N]",
3265 .path =
"show acl-plugin decode 5tuple",
3266 .short_help =
"show acl-plugin decode 5tuple XXXX XXXX XXXX XXXX XXXX XXXX",
3271 .path =
"show acl-plugin interface",
3272 .short_help =
"show acl-plugin interface [sw_if_index N] [acl]",
3277 .path =
"show acl-plugin memory",
3278 .short_help =
"show acl-plugin memory",
3283 .path =
"show acl-plugin sessions",
3284 .short_help =
"show acl-plugin sessions",
3289 .path =
"show acl-plugin tables",
3290 .short_help =
"show acl-plugin tables [ acl [index N] | applied [ sw_if_index N ] | mask | hash [verbose N] ]",
3295 .path =
"show acl-plugin macip acl",
3296 .short_help =
"show acl-plugin macip acl",
3301 .path =
"show acl-plugin macip interface",
3302 .short_help =
"show acl-plugin macip interface",
3307 .path =
"clear acl-plugin sessions",
3308 .short_help =
"clear acl-plugin sessions",
3317 u32 conn_table_hash_buckets;
3318 u32 conn_table_hash_memory_size;
3319 u32 conn_table_max_entries;
3322 u32 hash_lookup_hash_buckets;
3323 u32 hash_lookup_hash_memory;
3328 (input,
"connection hash buckets %d", &conn_table_hash_buckets))
3330 else if (
unformat (input,
"connection hash memory %d",
3331 &conn_table_hash_memory_size))
3333 else if (
unformat (input,
"connection count max %d",
3334 &conn_table_max_entries))
3336 else if (
unformat (input,
"main heap size %d", &main_heap_size))
3338 else if (
unformat (input,
"hash lookup heap size %d", &hash_heap_size))
3340 else if (
unformat (input,
"hash lookup hash buckets %d",
3341 &hash_lookup_hash_buckets))
3343 else if (
unformat (input,
"hash lookup hash memory %d",
3344 &hash_lookup_hash_memory))
3360 memset (am, 0,
sizeof (*am));
3364 u8 *name =
format (0,
"acl_%08x%c", api_version, 0);
3422 am->fa_cleaner_cnt_delete_by_sw_index = 0;
3423 am->fa_cleaner_cnt_delete_by_sw_index_ok = 0;
3424 am->fa_cleaner_cnt_unknown_event = 0;
3425 am->fa_cleaner_cnt_timer_restarted = 0;
3426 am->fa_cleaner_cnt_wait_with_timeout = 0;
3429 #define _(N, v, s) am->fa_ipv6_known_eh_bitmap = clib_bitmap_set(am->fa_ipv6_known_eh_bitmap, v, 1);
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
u32 * acl_ip4_output_classify_table_by_sw_if_index
static int macip_acl_interface_add_acl(acl_main_t *am, u32 sw_if_index, u32 macip_acl_index)
u32 fa_cleaner_node_index
u32 session_timeout_sec[ACL_N_TIMEOUTS]
static u8 * format_bitmap_hex(u8 *s, va_list *args)
Format a bitmap as a string of hex bytes.
Use acl_interface_set_acl_list instead Append/remove an ACL index to/from the list of ACLs checked fo...
#define vec_foreach_index(var, v)
Iterate over vector indices.
u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32]
static int macip_acl_interface_add_del_acl(u32 sw_if_index, u8 is_add, u32 acl_list_index)
static clib_error_t * acl_clear_aclplugin_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static int acl_set_skip_ipv6_eh(u32 eh, u32 value)
static int acl_hook_l2_output_classify(acl_main_t *am, u32 sw_if_index)
u16 vl_msg_api_get_msg_ids(const char *name, int n)
static int verify_message_len(void *mp, u32 expected_len, char *where)
static int acl_classify_add_del_table_tiny(vnet_classify_main_t *cm, u8 *mask, u32 mask_len, u32 next_table_index, u32 miss_next_index, u32 *table_index, int is_add)
#define UDP_SESSION_IDLE_TIMEOUT_SEC
void acl_plugin_hash_acl_set_trace_heap(acl_main_t *am, int on)
static void send_macip_acl_details(acl_main_t *am, unix_shared_memory_queue_t *q, macip_acl_list_t *acl, u32 context)
u32 * acl_dot1ad_input_classify_table_by_sw_if_index
sll srl srl sll sra u16x4 i
static clib_error_t * acl_init(vlib_main_t *vm)
static void acl_setup_fa_nodes(void)
static void send_macip_acl_interface_list_details(acl_main_t *am, unix_shared_memory_queue_t *q, u32 sw_if_index, u32 acl_index, u32 context)
void show_fa_sessions_hash(vlib_main_t *vm, u32 verbose)
int acl_interface_out_enable_disable(acl_main_t *am, u32 sw_if_index, int enable_disable)
char ** l2output_get_feat_names(void)
static int acl_interface_del_inout_acl(u32 sw_if_index, u8 is_input, u32 acl_list_index)
uword * pending_clear_sw_if_index_bitmap
static void vl_api_acl_plugin_get_version_t_handler(vl_api_acl_plugin_get_version_t *mp)
int acl_interface_in_enable_disable(acl_main_t *am, u32 sw_if_index, int enable_disable)
u64 fa_current_cleaner_timer_wait_interval
Set the vector of input/output ACLs checked for an interface.
#define foreach_acl_plugin_api_msg
u32 ** input_acl_vec_by_sw_if_index
Dump the list(s) of ACL applied to specific or all interfaces.
vnet_main_t * vnet_get_main(void)
vl_api_macip_acl_rule_t r[count]
static void acl_plugin_print_pae(vlib_main_t *vm, int j, applied_hash_ace_entry_t *pae)
static int count_skip(u8 *p, u32 size)
vnet_interface_main_t interface_main
static void vl_api_acl_add_replace_t_handler(vl_api_acl_add_replace_t *mp)
static void vl_api_macip_acl_dump_t_handler(vl_api_macip_acl_dump_t *mp)
union fa_session_t::@311 tcp_flags_seen
int l4_match_nonfirst_fragment
void * mheap_alloc(void *memory, uword size)
Control ping from the client to the server response.
#define ACL_FA_CONN_TABLE_DEFAULT_HASH_NUM_BUCKETS
#define ACL_PLUGIN_VERSION_MINOR
static clib_error_t * acl_plugin_config(vlib_main_t *vm, unformat_input_t *input)
#define ACL_PLUGIN_HASH_LOOKUP_HASH_MEMORY
#define REPLY_MACRO2(t, body)
static void vl_api_macip_acl_add_t_handler(vl_api_macip_acl_add_t *mp)
u32 * acl_ip6_input_classify_table_by_sw_if_index
void vnet_l2_input_classify_enable_disable(u32 sw_if_index, int enable_disable)
Enable/disable l2 input classification on a specific interface.
static mheap_t * mheap_header(u8 *v)
static uword * clib_bitmap_set(uword *ai, uword i, uword value)
Sets the ith bit of a bitmap to new_value Removes trailing zeros from the bitmap. ...
u64 session_timeout[ACL_N_TIMEOUTS]
fa_session_t * fa_sessions_pool
u32 l2_input_classify_next_acl_ip4
applied_hash_acl_info_t * output_applied_hash_acl_info_by_sw_if_index
u16 dstport_or_icmpcode_last
#define MHEAP_FLAG_THREAD_SAFE
#define pool_len(p)
Number of elements in pool vector.
u8 * format_mheap(u8 *s, va_list *va)
static u32 macip_find_match_type(macip_match_type_t *mv, u8 *mac_mask, u8 prefix_len, u8 is_ipv6)
#define vec_reset_length(v)
Reset vector length to zero NULL-pointer tolerant.
Details about one MACIP ACL.
u32 fa_acl_out_ip4_l2_node_feat_next_node_index[32]
f64 fa_cleaner_wait_time_increment
#define vec_add(V, E, N)
Add N elements to end of vector V (no header, unspecified alignment)
void hash_acl_add(acl_main_t *am, int acl_index)
static void acl_add_vlan_session(acl_main_t *am, u32 table_index, u8 is_output, u8 is_dot1ad, u8 is_ip6)
uword fa_conn_table_hash_memory_size
u16 dst_port_or_code_last
static clib_error_t * acl_sw_interface_add_del(vnet_main_t *vnm, u32 sw_if_index, u32 is_add)
u32 l2_output_classify_next_acl_ip4
ip46_address_t src_ip_addr
void mv(vnet_classify_table_t *t)
u32 next_applied_entry_index
void acl_plugin_hash_acl_set_validate_heap(acl_main_t *am, int on)
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
#define VLIB_INIT_FUNCTION(x)
static int acl_is_not_defined(acl_main_t *am, u32 acl_list_index)
static clib_error_t * acl_show_aclplugin_acl_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u16 dstport_or_icmpcode_first
u64 fa_conn_table_max_entries
static void acl_plugin_show_interface(acl_main_t *am, u32 sw_if_index, int show_acl)
uword vlib_node_add_next_with_slot(vlib_main_t *vm, uword node_index, uword next_node_index, uword slot)
u64 cnt_session_timer_restarted
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
Add or delete a MACIP ACL to/from interface.
static clib_error_t * acl_show_aclplugin_interface_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define clib_error_return(e, args...)
static u8 * format_acl_action(u8 *s, u8 action)
#define ACL_FA_CONN_TABLE_DEFAULT_MAX_ENTRIES
static void acl_print_acl(vlib_main_t *vm, acl_main_t *am, int acl_index)
int vnet_l2_output_classify_set_tables(u32 sw_if_index, u32 ip4_table_index, u32 ip6_table_index, u32 other_table_index)
Set l2 per-protocol, per-interface output classification tables.
#define vec_search(v, E)
Search a vector for the index of the entry that matches.
VNET_SW_INTERFACE_ADD_DEL_FUNCTION(acl_sw_interface_add_del)
static clib_error_t * acl_show_aclplugin_decode_5tuple_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
void hash_acl_unapply(acl_main_t *am, u32 sw_if_index, u8 is_input, int acl_index)
u32 * inbound_sw_if_index_list
void * vl_msg_api_alloc(int nbytes)
Reply to add/replace MACIP ACL.
u32 fa_acl_out_ip6_l2_node_feat_next_node_index[32]
static u8 * my_macip_acl_rule_t_pretty_format(u8 *out, va_list *args)
u32 * acl_ip4_input_classify_table_by_sw_if_index
uword * mask_type_index_bitmap
int vnet_classify_add_del_session(vnet_classify_main_t *cm, u32 table_index, u8 *match, u32 hit_next_index, u32 opaque_index, i32 advance, u8 action, u32 metadata, int is_add)
static int acl_unhook_l2_input_classify(acl_main_t *am, u32 sw_if_index)
static clib_error_t * acl_show_aclplugin_memory_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
applied_hash_acl_info_t * input_applied_hash_acl_info_by_sw_if_index
static int acl_hook_l2_input_classify(acl_main_t *am, u32 sw_if_index)
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Details about a single MACIP ACL contents.
static void acl_set_session_max_entries(u32 value)
Control ping from client to api server request.
u8 dst_portrange_not_powerof2
static void setup_message_id_table(acl_main_t *am, api_main_t *apim)
static void vlib_process_signal_event(vlib_main_t *vm, uword node_index, uword type_opaque, uword data)
#define ACL_FA_DEFAULT_CLEANER_WAIT_TIME_INCREMENT
u16 dst_port_or_code_first
#define TCP_SESSION_IDLE_TIMEOUT_SEC
static void vl_api_acl_dump_t_handler(vl_api_acl_dump_t *mp)
static void acl_plugin_show_tables_applied_info(acl_main_t *am, u32 sw_if_index)
uword * fa_ipv6_known_eh_bitmap
Replace an existing ACL in-place or create a new ACL.
#define ACL_FA_DEFAULT_MIN_DELETED_SESSIONS_PER_INTERVAL
hash_acl_info_t * hash_acl_infos
#define pool_put(P, E)
Free an object E in pool P.
void acl_plugin_acl_set_validate_heap(acl_main_t *am, int on)
Details about a single ACL contents.
static clib_error_t * acl_show_aclplugin_tables_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define VLIB_CONFIG_FUNCTION(x, n,...)
#define vec_del1(v, i)
Delete the element at index I.
vl_api_acl_rule_t r[count]
static int get_l3_src_offset(int is6)
void show_hash_acl_hash(vlib_main_t *vm, acl_main_t *am, u32 verbose)
static int macip_maybe_apply_unapply_classifier_tables(acl_main_t *am, u32 acl_index, int is_apply)
u32 l2_input_classify_next_acl_ip6
int interrupt_is_unwanted
static u8 * my_format_mac_address(u8 *s, va_list *args)
static void send_acl_details(acl_main_t *am, unix_shared_memory_queue_t *q, acl_list_t *acl, u32 context)
u16 src_port_or_type_first
u64 fa_min_deleted_sessions_per_interval
static int match_type_compare(macip_match_type_t *m1, macip_match_type_t *m2)
API main structure, used by both vpp and binary API clients.
static void acl_plugin_show_tables_acl_hash_info(acl_main_t *am, u32 acl_index)
#define pool_get_aligned(P, E, A)
Allocate an object E from a pool P (general version).
vl_api_acl_rule_t r[count]
static int acl_unhook_l2_output_classify(acl_main_t *am, u32 sw_if_index)
uword * mask_type_index_bitmap
Dump the list(s) of MACIP ACLs applied to specific or all interfaces.
static int match_type_metric(macip_match_type_t *m)
static int macip_acl_del_list(u32 acl_list_index)
Dump one or all defined MACIP ACLs.
static int acl_classify_add_del_table_small(vnet_classify_main_t *cm, u8 *mask, u32 mask_len, u32 next_table_index, u32 miss_next_index, u32 *table_index, int is_add)
static void acl_plugin_show_acl(acl_main_t *am, u32 acl_index)
applied_hash_ace_entry_t ** output_hash_entry_vec_by_sw_if_index
u64 fa_session_total_adds
#define vec_free(V)
Free vector's memory (no header).
void acl_plugin_acl_set_trace_heap(acl_main_t *am, int on)
static void feat_bitmap_init_next_nodes(vlib_main_t *vm, u32 node_index, u32 num_features, char **feat_names, u32 *next_nodes)
Initialize the feature next-node indexes of a graph node.
u8 * format_acl_plugin_5tuple(u8 *s, va_list *args)
u32 * outbound_sw_if_index_list
static void * clib_mem_set_heap(void *heap)
u16 srcport_or_icmptype_first
#define PRINT_AND_RESET(vm, out0)
void hash_acl_delete(acl_main_t *am, int acl_index)
Reply to add/replace ACL.
#define clib_warning(format, args...)
static int acl_interface_add_inout_acl(u32 sw_if_index, u8 is_input, u32 acl_list_index)
Reply with the vector of MACIP ACLs by sw_if_index.
unix_shared_memory_queue_t * vl_api_client_index_to_input_queue(u32 index)
int vnet_l2_input_classify_set_tables(u32 sw_if_index, u32 ip4_table_index, u32 ip6_table_index, u32 other_table_index)
Set l2 per-protocol, per-interface input classification tables.
int use_hash_acl_matching
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
#define foreach_fa_cleaner_counter
vl_api_macip_acl_rule_t r[count]
void acl_fa_enable_disable(u32 sw_if_index, int is_input, int enable_disable)
#define VLIB_CLI_COMMAND(x,...)
struct _vnet_classify_main vnet_classify_main_t
u16 srcport_or_icmptype_last
static clib_error_t * acl_show_aclplugin_macip_acl_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define ACL_PLUGIN_HASH_LOOKUP_HASH_BUCKETS
u32 hash_lookup_hash_buckets
void vl_msg_api_send_shmem(unix_shared_memory_queue_t *q, u8 *elem)
static void vl_api_acl_interface_add_del_t_handler(vl_api_acl_interface_add_del_t *mp)
static int macip_acl_interface_del_acl(acl_main_t *am, u32 sw_if_index)
static void vl_api_macip_acl_del_t_handler(vl_api_macip_acl_del_t *mp)
u16 src_port_or_type_last
MACIP Access List Rule entry.
static int macip_create_classify_tables(acl_main_t *am, u32 macip_acl_index)
static void acl_set_timeout_sec(int timeout_type, u32 value)
static void send_acl_interface_list_details(acl_main_t *am, unix_shared_memory_queue_t *q, u32 sw_if_index, u32 context)
#define ACL_FA_DEFAULT_HEAP_SIZE
#define MHEAP_FLAG_VALIDATE
vnet_classify_main_t vnet_classify_main
static void vl_api_macip_acl_add_replace_t_handler(vl_api_macip_acl_add_replace_t *mp)
Reply to get the plugin version.
static clib_error_t * acl_plugin_api_hookup(vlib_main_t *vm)
static int macip_acl_add_list(u32 count, vl_api_macip_acl_rule_t rules[], u32 *acl_list_index, u8 *tag)
uword * serviced_sw_if_index_bitmap
vl_api_macip_acl_rule_t r[count]
u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32]
static vlib_main_t * vlib_get_main(void)
Reply to set the ACL list on an interface.
int vnet_classify_add_del_table(vnet_classify_main_t *cm, u8 *mask, u32 nbuckets, u32 memory_size, u32 skip, u32 match, u32 next_table_index, u32 miss_next_index, u32 *table_index, u8 current_data_flag, i16 current_data_offset, int is_add, int del_chain)
#define vec_elt(v, i)
Get vector value at index i.
ace_mask_type_entry_t * ace_mask_type_pool
#define MHEAP_FLAG_SMALL_OBJECT_CACHE
static void macip_acl_print(acl_main_t *am, u32 macip_acl_index)
u32 prev_applied_entry_index
u32 * macip_acl_by_sw_if_index
Get the vector of MACIP ACL IDs applied to the interfaces.
u32 * acl_ip6_output_classify_table_by_sw_if_index
static void vl_api_acl_interface_list_dump_t_handler(vl_api_acl_interface_list_dump_t *mp)
static int acl_add_list(u32 count, vl_api_acl_rule_t rules[], u32 *acl_list_index, u8 *tag)
static void vl_api_acl_del_t_handler(vl_api_acl_del_t *mp)
macip_acl_list_t * macip_acls
static clib_error_t * acl_show_aclplugin_sessions_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
Details about a single ACL contents.
static void vl_api_macip_acl_interface_list_dump_t_handler(vl_api_macip_acl_interface_list_dump_t *mp)
acl_fa_per_worker_data_t * per_worker_data
#define vec_sort_with_function(vec, f)
Sort a vector using the supplied element comparison function.
vnet_sw_interface_t * sw_interfaces
int fa_interrupt_generation
u32 ** input_sw_if_index_vec_by_acl
u64 cnt_already_deleted_sessions
void vnet_l2_output_classify_enable_disable(u32 sw_if_index, int enable_disable)
Enable/disable l2 input classification on a specific interface.
static void vl_api_acl_interface_set_acl_list_t_handler(vl_api_acl_interface_set_acl_list_t *mp)
u64 fa_max_deleted_sessions_per_interval
static clib_error_t * acl_set_aclplugin_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static void acl_interface_reset_inout_acls(u32 sw_if_index, u8 is_input)
void hash_acl_apply(acl_main_t *am, u32 sw_if_index, u8 is_input, int acl_index)
static int acl_interface_add_del_inout_acl(u32 sw_if_index, u8 is_add, u8 is_input, u32 acl_list_index)
static vlib_thread_main_t * vlib_get_thread_main()
static void acl_plugin_show_sessions(acl_main_t *am, u32 show_session_thread_id, u32 show_session_session_index)
static void copy_acl_rule_to_api_rule(vl_api_acl_rule_t *api_rule, acl_rule_t *r)
void mheap_validate(void *v)
#define vec_foreach(var, vec)
Vector iterator.
static void * acl_set_heap(acl_main_t *am)
u32 tail_applied_entry_index
u32 vl_msg_api_get_msg_length(void *msg_arg)
u32 ** output_sw_if_index_vec_by_acl
#define ACL_PLUGIN_VERSION_MAJOR
static clib_error_t * acl_show_aclplugin_macip_interface_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u32 * acl_dot1q_output_classify_table_by_sw_if_index
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
#define CLIB_CACHE_LINE_BYTES
#define ACL_PLUGIN_HASH_LOOKUP_HEAP_SIZE
u32 hash_lookup_mheap_size
u32 l2_output_classify_next_acl_ip6
static void acl_plugin_show_tables_mask_type(acl_main_t *am)
u8 src_portrange_not_powerof2
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
#define ACL_FA_DEFAULT_MAX_DELETED_SESSIONS_PER_INTERVAL
static void vl_api_acl_plugin_control_ping_t_handler(vl_api_acl_plugin_control_ping_t *mp)
u32 ** output_acl_vec_by_sw_if_index
#define TCP_SESSION_TRANSIENT_TIMEOUT_SEC
static void vl_api_macip_acl_interface_add_del_t_handler(vl_api_macip_acl_interface_add_del_t *mp)
u32 hash_lookup_hash_memory
u64 current_time_wait_interval
u32 fa_conn_table_hash_num_buckets
u32 * acl_dot1q_input_classify_table_by_sw_if_index
#define ACL_FA_CONN_TABLE_DEFAULT_HASH_MEMORY_SIZE
u64 fa_session_total_dels
struct _unix_shared_memory_queue unix_shared_memory_queue_t
static int acl_del_list(u32 acl_list_index)
static void macip_destroy_classify_tables(acl_main_t *am, u32 macip_acl_index)
static void vl_api_macip_acl_interface_get_t_handler(vl_api_macip_acl_interface_get_t *mp)
applied_hash_ace_entry_t ** input_hash_entry_vec_by_sw_if_index
static void acl_plugin_show_tables_bihash(acl_main_t *am, u32 show_bihash_verbose)
foreach_fa_cleaner_counter vlib_main_t * vlib_main
u32 * acl_dot1ad_output_classify_table_by_sw_if_index