46 s =
format (s,
"SYN_FILTER4: next index %d, %s",
57 #define foreach_syn_filter_error \ 58 _(THROTTLED, "TCP SYN packet throttle drops") \ 59 _(OK, "TCP SYN packets passed") 63 #define _(sym,str) SYN_FILTER_ERROR_##sym, 70 #define _(sym,string) string, 87 u32 n_left_from, *from, *to_next;
89 u32 ok_syn_packets = 0;
96 u8 *c0 = 0, *c1 = 0, *c2 = 0, *c3 = 0;
108 while (n_left_from > 0)
114 while (n_left_from >= 8 && n_left_to_next >= 4)
116 u32 bi0, bi1, bi2, bi3;
118 u32 next0, next1, next2, next3;
121 u32 not_a_syn0 = 1, not_a_syn1 = 1, not_a_syn2 = 1, not_a_syn3 = 1;
122 u64 hash0, hash1, hash2, hash3;
145 to_next[0] = bi0 = from[0];
146 to_next[1] = bi1 = from[1];
147 to_next[2] = bi2 = from[2];
148 to_next[3] = bi3 = from[3];
174 if (ip0->
protocol != IP_PROTOCOL_TCP)
192 b0->
error = node->
errors[SYN_FILTER_ERROR_THROTTLED];
211 if (ip1->
protocol != IP_PROTOCOL_TCP)
229 b1->
error = node->
errors[SYN_FILTER_ERROR_THROTTLED];
248 if (ip2->
protocol != IP_PROTOCOL_TCP)
266 b2->
error = node->
errors[SYN_FILTER_ERROR_THROTTLED];
285 if (ip3->
protocol != IP_PROTOCOL_TCP)
303 b3->
error = node->
errors[SYN_FILTER_ERROR_THROTTLED];
320 to_next, n_left_to_next,
322 next0, next1, next2, next3);
325 while (n_left_from > 0 && n_left_to_next > 0)
352 if (ip0->
protocol != IP_PROTOCOL_TCP)
370 b0->
error = node->
errors[SYN_FILTER_ERROR_THROTTLED];
390 to_next, n_left_to_next,
398 SYN_FILTER_ERROR_OK, ok_syn_packets);
406 .name =
"syn-filter-4",
407 .vector_size =
sizeof (
u32),
429 .arc_name =
"ip4-local",
430 .node_name =
"syn-filter-4",
444 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
449 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
471 sw_if_index, enable_disable, 0, 0);
482 u32 sw_if_index = ~0;
483 int enable_disable = 1;
497 if (sw_if_index == ~0)
507 case VNET_API_ERROR_INVALID_SW_IF_INDEX:
509 (0,
"Invalid interface, only works on physical ports");
512 case VNET_API_ERROR_UNIMPLEMENTED:
514 "Device driver doesn't support redirection");
517 case VNET_API_ERROR_INVALID_VALUE:
520 case VNET_API_ERROR_INVALID_VALUE_2:
533 .path =
"ip syn filter",
534 .short_help =
"ip syn filter <interface-name> [disable]",
vnet_config_main_t config_main
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
u8 runtime_data[0]
Function dependent node-runtime data.
u32 current_config_index
Used by feature subgraph arcs to visit enabled feature nodes.
vnet_main_t * vnet_get_main(void)
vnet_interface_main_t interface_main
static f64 vlib_time_now(vlib_main_t *vm)
#define vlib_validate_buffer_enqueue_x4(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, bi2, bi3, next0, next1, next2, next3)
Finish enqueueing four buffers forward in the graph.
static u64 clib_xxhash(u64 key)
struct _vlib_node_registration vlib_node_registration_t
static vnet_sw_interface_t * vnet_get_sw_interface(vnet_main_t *vnm, u32 sw_if_index)
unformat_function_t unformat_vnet_sw_interface
static uword syn_filter4_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
vlib_error_t * errors
Vector of errors for this node.
struct _tcp_header tcp_header_t
static vlib_node_registration_t syn_filter4_node
(constructor) VLIB_REGISTER_NODE (syn_filter4_node)
static u8 * format_syn_filter4_trace(u8 *s, va_list *args)
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
#define clib_error_return(e, args...)
static void * ip4_next_header(ip4_header_t *i)
int syn_filter_enable_disable(u32 sw_if_index, int enable_disable)
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
static void * vnet_get_config_data(vnet_config_main_t *cm, u32 *config_index, u32 *next_index, u32 n_data_bytes)
static void * vlib_node_get_runtime_data(vlib_main_t *vm, u32 node_index)
Get node runtime private data by node index.
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
#define foreach_vlib_main(body)
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
vlib_error_t error
Error code for buffers to be enqueued to error handler.
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
#define CLIB_PREFETCH(addr, size, type)
vnet_feature_arc_registration_t vnet_feat_arc_ip4_local
#define VLIB_BUFFER_IS_TRACED
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
#define VLIB_CLI_COMMAND(x,...)
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
VNET_FEATURE_INIT(syn_filter_4, static)
#define VLIB_NODE_FLAG_TRACE
#define VNET_FEATURES(...)
#define foreach_syn_filter_error
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
vnet_sw_interface_t * sw_interfaces
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
VLIB_NODE_FUNCTION_MULTIARCH(syn_filter4_node, syn_filter4_node_fn)
struct _vnet_feature_arc_registration vnet_feature_arc_registration_t
feature registration object
#define VLIB_REGISTER_NODE(x,...)
vnet_sw_interface_type_t type
static char * syn_filter4_error_strings[]
u16 flags
Copy of main node flags.
vnet_feature_config_main_t * feature_config_mains
feature config main objects
#define CLIB_CACHE_LINE_BYTES
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
vnet_feature_main_t feature_main
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
static clib_error_t * syn_filter_enable_disable_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)