16 #ifndef included_acl_inlines_h 17 #define included_acl_inlines_h 28 #define LOAD_SYMBOL_FROM_PLUGIN_TO(p, s, st) \ 30 st = vlib_get_plugin_symbol(p, #s); \ 32 return clib_error_return(0, \ 33 "Plugin %s and/or symbol %s not found.", p, #s); \ 36 #define LOAD_SYMBOL(s) LOAD_SYMBOL_FROM_PLUGIN_TO("acl_plugin.so", s, s) 90 static u8 icmp_protos_v4v6[] = { IP_PROTOCOL_ICMP, IP_PROTOCOL_ICMP6 };
104 protocol) + l3_offset);
106 #ifdef FA_NODE_VERBOSE_DEBUG 107 clib_warning (
"ACL_FA_NODE_DBG: proto: %d, l4_offset: %d", proto,
122 frag_offset = clib_net_to_host_u16(frag_offset) >> 3;
139 l4_offset += 8 * (1 + (
u16) nwords);
141 #ifdef FA_NODE_VERBOSE_DEBUG 142 clib_warning (
"ACL_FA_NODE_DBG: new proto: %d, new offset: %d",
155 protocol) + l3_offset);
157 u16 flags_and_fragment_offset;
161 flags_and_fragment_offset)) + l3_offset,
162 sizeof(flags_and_fragment_offset));
163 flags_and_fragment_offset = clib_net_to_host_u16 (flags_and_fragment_offset);
174 tmp_l4.
proto = proto;
180 if (icmp_protos_v4v6[is_ip6] == proto)
185 l4_offset + offsetof (icmp46_header_t,
190 l4_offset + offsetof (icmp46_header_t,
194 else if ((IP_PROTOCOL_TCP == proto) || (IP_PROTOCOL_UDP == proto))
201 tmp_l4.
port[0] = clib_net_to_host_u16 (ports[0]);
202 tmp_l4.
port[1] = clib_net_to_host_u16 (ports[1]);
223 int is_input,
int is_l2_path,
fa_5tuple_t * p5tuple_pkt)
236 l3_offset =
vnet_buffer(b0)->ip.save_rewrite_length;
264 uint32_t a1 = clib_net_to_host_u32 (addr1->
as_u32);
265 uint32_t a2 = clib_net_to_host_u32 (addr2->
as_u32);
266 uint32_t mask0 = 0xffffffff - ((1 << (32 - prefixlen)) - 1);
267 return (a1 & mask0) == a2;
279 if (memcmp (addr1, addr2, prefixlen / 8))
286 u8 b1 = *((
u8 *) addr1 + 1 + prefixlen / 8);
287 u8 b2 = *((
u8 *) addr2 + 1 + prefixlen / 8);
288 u8 mask0 = (0xff - ((1 << (8 - (prefixlen % 8))) - 1));
289 return (b1 & mask0) == b2;
301 return ((port >= port_first) && (port <= port_last));
306 int is_ip6,
u8 * r_action,
u32 * r_acl_match_p,
307 u32 * r_rule_match_p,
u32 * trace_bitmap)
316 *r_acl_match_p = acl_index;
318 *r_rule_match_p = -1;
322 a = am->
acls + acl_index;
323 for (i = 0; i < a->
count; i++)
355 *trace_bitmap |= 0x80000000;
358 *r_acl_match_p = acl_index;
368 #ifdef FA_NODE_VERBOSE_DEBUG 370 (
"ACL_FA_NODE_DBG acl %d rule %d pkt proto %d match rule %d",
379 #ifdef FA_NODE_VERBOSE_DEBUG 381 (
"ACL_FA_NODE_DBG acl %d rule %d pkt sport %d match rule [%d..%d]",
391 #ifdef FA_NODE_VERBOSE_DEBUG 393 (
"ACL_FA_NODE_DBG acl %d rule %d pkt dport %d match rule [%d..%d]",
403 #ifdef FA_NODE_VERBOSE_DEBUG 404 clib_warning (
"ACL_FA_NODE_DBG acl %d rule %d FULL-MATCH, action %d",
409 *r_acl_match_p = acl_index;
419 int is_ip6,
u8 * r_action,
u32 * r_acl_match_p,
420 u32 * r_rule_match_p,
u32 * trace_bitmap)
424 r_acl_match_p, r_rule_match_p, trace_bitmap);
429 int is_ip6,
u8 *r_action,
u32 *acl_pos_p,
u32 * acl_match_p,
430 u32 * rule_match_p,
u32 * trace_bitmap)
440 for (i = 0; i <
vec_len (acl_vector); i++)
442 #ifdef FA_NODE_VERBOSE_DEBUG 443 clib_warning (
"ACL_FA_NODE_DBG: Trying to match ACL: %d",
447 (am, acl_vector[i], pkt_5tuple, is_ip6, &action,
448 acl_match_p, rule_match_p, trace_bitmap))
455 if (vec_len (acl_vector) > 0)
459 #ifdef FA_NODE_VERBOSE_DEBUG 460 clib_warning (
"ACL_FA_NODE_DBG: No ACL on lc_index %d", lc_index);
482 #ifdef FA_NODE_VERBOSE_DEBUG 483 clib_warning(
"PORTMATCH: %d <= %d <= %d && %d <= %d <= %d ?",
557 u64 *pmatch = (
u64 *) match;
560 int mask_type_index, order_index;
561 u32 curr_match_index = (~0 - 1);
574 DBG (
"TRYING TO MATCH: %016llx %016llx %016llx %016llx %016llx %016llx",
575 pmatch[0], pmatch[1], pmatch[2], pmatch[3], pmatch[4], pmatch[5]);
577 for (order_index = 0; order_index <
vec_len ((*hash_applied_mask_info_vec));
590 pmatch = (
u64 *) match;
601 *pkey++ = *pmatch++ & *pmask++;
602 *pkey++ = *pmatch++ & *pmask++;
603 *pkey++ = *pmatch++ & *pmask++;
604 *pkey++ = *pmatch++ & *pmask++;
605 *pkey++ = *pmatch++ & *pmask++;
606 *pkey++ = *pmatch++ & *pmask++;
623 u32 curr_index = result_val->applied_entry_index;
628 for (i = 0; i <
vec_len (crs); i++)
630 if (crs[i].applied_entry_index >= curr_match_index)
641 DBG (
"MATCH-RESULT: %d", curr_match_index);
642 return curr_match_index;
647 int is_ip6,
u8 *action,
u32 *acl_pos_p,
u32 * acl_match_p,
648 u32 * rule_match_p,
u32 * trace_bitmap)
653 if (match_index <
vec_len((*applied_hash_aces))) {
670 int is_ip6,
u8 * r_action,
673 u32 * r_rule_match_p,
688 r_acl_pos_p, r_acl_match_p, r_rule_match_p, trace_bitmap);
691 r_acl_pos_p, r_acl_match_p, r_rule_match_p, trace_bitmap);
695 r_acl_pos_p, r_acl_match_p, r_rule_match_p, trace_bitmap);
static void acl_fill_5tuple(acl_main_t *am, u32 sw_if_index0, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_t *p5tuple_pkt)
static int acl_plugin_single_acl_match_5tuple(void *p_acl_main, u32 acl_index, fa_5tuple_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
int l4_match_nonfirst_fragment
static int fa_acl_match_ip4_addr(ip4_address_t *addr1, ip4_address_t *addr2, int prefixlen)
clib_error_t * acl_plugin_methods_vtable_init(acl_plugin_methods_t *m)
static void acl_fill_5tuple_l3_data(acl_main_t *am, vlib_buffer_t *b0, int is_ip6, int l3_offset, fa_5tuple_t *p5tuple_pkt)
#define ethernet_buffer_header_size(b)
Determine the size of the Ethernet headers of the current frame in the buffer.
static int fa_acl_match_port(u16 port, u16 port_first, u16 port_last, int is_ip6)
static int fa_acl_match_ip6_addr(ip6_address_t *addr1, ip6_address_t *addr2, int prefixlen)
struct _tcp_header tcp_header_t
static void * get_ptr_to_offset(vlib_buffer_t *b0, int offset)
u16 dst_port_or_code_last
memset(h->entries, 0, sizeof(h->entries[0])*entries)
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
static void acl_fill_5tuple_l4_and_pkt_data(acl_main_t *am, u32 sw_if_index0, vlib_buffer_t *b0, int is_ip6, int is_input, int l3_offset, fa_session_l4_key_t *p5tuple_l4, fa_packet_info_t *p5tuple_pkt)
static int hash_multi_acl_match_5tuple(void *p_acl_main, u32 lc_index, fa_5tuple_t *pkt_5tuple, int is_ip6, u8 *action, u32 *acl_pos_p, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
static u32 multi_acl_match_get_applied_ace_index(acl_main_t *am, int is_ip6, fa_5tuple_t *match)
static void acl_plugin_fill_5tuple_inline(void *p_acl_main, u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
collision_match_rule_t * colliding_rules
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
u16 current_length
Nbytes between current data and the end of this buffer.
u16 dst_port_or_code_first
hash_applied_mask_info_t ** hash_applied_mask_info_vec_by_lc_index
uword * fa_ipv6_known_eh_bitmap
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
clib_bihash_48_8_t acl_lookup_hash
vl_api_address_union_t src_address
u16 src_port_or_type_first
#define clib_warning(format, args...)
#define clib_memcpy(a, b, c)
int use_hash_acl_matching
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
static clib_error_t * acl_plugin_exports_init(acl_plugin_methods_t *m)
applied_hash_ace_entry_t ** hash_entry_vec_by_lc_index
static uword clib_bitmap_get(uword *ai, uword i)
Gets the ith bit value from a bitmap.
static int single_acl_match_5tuple(acl_main_t *am, u32 acl_index, fa_5tuple_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
static int offset_within_packet(vlib_buffer_t *b0, int offset)
static int match_portranges(acl_main_t *am, fa_5tuple_t *match, u32 index)
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
u16 src_port_or_type_last
ace_mask_type_entry_t * ace_mask_type_pool
static int single_rule_match_5tuple(acl_rule_t *r, int is_ip6, fa_5tuple_t *pkt_5tuple)
template key/value backing page structure
acl_lookup_context_t * acl_lookup_contexts
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
clib_error_t *(* acl_plugin_methods_vtable_init_fn_t)(acl_plugin_methods_t *m)
struct clib_bihash_value offset
template key/value backing page structure
#define LOAD_SYMBOL_FROM_PLUGIN_TO(p, s, st)
ip4_address_t ip4_addr[2]
static int linear_multi_acl_match_5tuple(void *p_acl_main, u32 lc_index, fa_5tuple_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *acl_pos_p, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
ip6_address_t ip6_addr[2]