16 #include <netinet/in.h> 49 #define foreach_acl_fa_error \ 50 _(ACL_DROP, "ACL deny packets") \ 51 _(ACL_PERMIT, "ACL permit packets") \ 52 _(ACL_NEW_SESSION, "new sessions added") \ 53 _(ACL_EXIST_SESSION, "existing session packets") \ 54 _(ACL_CHECK, "checked packets") \ 55 _(ACL_RESTART_SESSION_TIMER, "restart session timer") \ 56 _(ACL_TOO_MANY_SESSIONS, "too many sessions to add new") \ 61 #define _(sym,str) ACL_FA_ERROR_##sym, 75 u16 current_policy_epoch =
79 return current_policy_epoch;
85 int is_input,
int is_l2_path,
u32 * l2_feat_next_node_index,
89 u32 pkts_acl_checked = 0;
90 u32 pkts_new_session = 0;
91 u32 pkts_exist_session = 0;
92 u32 pkts_acl_permit = 0;
93 u32 pkts_restart_session_timer = 0;
121 int acl_check_needed = 1;
122 u32 match_acl_in_index = ~0;
123 u32 match_acl_pos = ~0;
124 u32 match_rule_index = ~0;
139 u16 current_policy_epoch =
148 is_input, is_l2_path, &fa_5tuple);
150 #ifdef FA_NODE_VERBOSE_DEBUG 152 (
"ACL_FA_NODE_DBG: packet 5-tuple %016llx %016llx %016llx %016llx %016llx %016llx",
153 fa_5tuple.kv.key[0], fa_5tuple.kv.key[1], fa_5tuple.kv.key[2],
154 fa_5tuple.kv.key[3], fa_5tuple.kv.key[4], fa_5tuple.kv.value);
161 u64 value_sess = ~0ULL;
163 (am, is_ip6, sw_if_index0, &fa_5tuple, &value_sess)
164 && (value_sess != ~0ULL))
166 trace_bitmap |= 0x80000000;
167 error0 = ACL_FA_ERROR_ACL_EXIST_SESSION;
170 f_sess_id.
as_u64 = value_sess;
183 acl_check_needed = 0;
184 pkts_exist_session += 1;
189 pkts_restart_session_timer++;
191 0x00010000 + ((0xff & old_timeout_type) << 8) +
192 (0xff & new_timeout_type);
206 (
"BUG: session LSB16(sw_if_index) and 5-tuple collision!");
207 acl_check_needed = 0;
214 ((current_policy_epoch ^
217 && (current_policy_epoch !=
227 (am, f_sess_id, now))
233 acl_check_needed = 1;
234 trace_bitmap |= 0x40000000;
240 if (acl_check_needed)
245 fa_5tuple, is_ip6, &action,
248 &match_rule_index, &trace_bitmap);
251 pkts_acl_permit += 1;
264 current_policy_epoch);
266 now, sess, &fa_5tuple);
267 pkts_new_session += 1;
272 error0 = ACL_FA_ERROR_ACL_TOO_MANY_SESSIONS;
286 #ifdef FA_NODE_VERBOSE_DEBUG 288 (
"ACL_FA_NODE_DBG: sw_if_index %d lc_index %d action %d acl_index %d rule_index %d",
289 sw_if_index0, lc_index0, action, match_acl_in_index,
294 && (b[0]->
flags & VLIB_BUFFER_IS_TRACED)))
319 pkts_acl_checked += 1;
325 ACL_FA_ERROR_ACL_CHECK, pkts_acl_checked);
327 ACL_FA_ERROR_ACL_PERMIT, pkts_acl_permit);
329 ACL_FA_ERROR_ACL_NEW_SESSION,
332 ACL_FA_ERROR_ACL_EXIST_SESSION,
335 ACL_FA_ERROR_ACL_RESTART_SESSION_TIMER,
336 pkts_restart_session_timer);
424 return format (s,
"lc_index %d (lsb16 of sw_if_index %d) l3 %s%s %U -> %U" 425 " l4 proto %d l4_valid %d port %d -> %d tcp flags (%s) %02x rsvd %x",
429 pkt.is_nonfirst_fragment ?
" non-initial fragment" :
"",
436 return format (s,
"lc_index %d (lsb16 of sw_if_index %d) l3 %s%s %U -> %U" 437 " l4 proto %d l4_valid %d port %d -> %d tcp flags (%s) %02x rsvd %x",
441 pkt.is_nonfirst_fragment ?
" non-initial fragment" :
"",
449 #ifndef CLIB_MARCH_VARIANT 467 "acl-plugin: lc_index: %d, sw_if_index %d, next index %d, action: %d, match: acl %d rule %d trace_bits %08x\n" 468 " pkt info %016llx %016llx %016llx %016llx %016llx %016llx",
482 #define _(sym,string) string, 489 .name =
"acl-plugin-in-ip6-l2",
490 .vector_size =
sizeof (
u32),
504 .name =
"acl-plugin-in-ip4-l2",
505 .vector_size =
sizeof (
u32),
519 .name =
"acl-plugin-out-ip6-l2",
520 .vector_size =
sizeof (
u32),
534 .name =
"acl-plugin-out-ip4-l2",
535 .vector_size =
sizeof (
u32),
550 .name =
"acl-plugin-in-ip6-fa",
551 .vector_size =
sizeof (
u32),
565 .arc_name =
"ip6-unicast",
566 .node_name =
"acl-plugin-in-ip6-fa",
572 .name =
"acl-plugin-in-ip4-fa",
573 .vector_size =
sizeof (
u32),
587 .arc_name =
"ip4-unicast",
588 .node_name =
"acl-plugin-in-ip4-fa",
595 .name =
"acl-plugin-out-ip6-fa",
596 .vector_size =
sizeof (
u32),
610 .arc_name =
"ip6-output",
611 .node_name =
"acl-plugin-out-ip6-fa",
617 .name =
"acl-plugin-out-ip4-fa",
618 .vector_size =
sizeof (
u32),
633 .arc_name =
"ip4-output",
634 .node_name =
"acl-plugin-out-ip4-fa",
vlib_node_registration_t acl_in_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip4_node)
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
u32 * input_policy_epoch_by_sw_if_index
static fa_session_t * acl_fa_add_session(acl_main_t *am, int is_input, int is_ip6, u32 sw_if_index, u64 now, fa_5tuple_t *p5tuple, u16 current_policy_epoch)
u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32]
static void acl_fill_5tuple(acl_main_t *am, u32 sw_if_index0, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_t *p5tuple_pkt)
static int acl_fa_conn_list_delete_session(acl_main_t *am, fa_full_session_id_t sess_id, u64 now)
vlib_node_registration_t acl_out_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip4_node)
vlib_node_registration_t acl_out_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip6_node)
vlib_node_registration_t acl_in_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip4_node)
static u64 clib_cpu_time_now(void)
static int acl_fa_ifc_has_sessions(acl_main_t *am, int sw_if_index0)
static int acl_fa_two_stage_delete_session(acl_main_t *am, u32 sw_if_index, fa_full_session_id_t sess_id, u64 now)
u32 * output_policy_epoch_by_sw_if_index
static uword acl_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_input, int is_l2_path, u32 *l2_feat_next_node_index, vlib_node_registration_t *acl_fa_node)
#define VLIB_NODE_FN(node)
vlib_error_t * errors
Vector of errors for this node.
vlib_main_t ** vlib_mains
static u32 vnet_l2_feature_next(vlib_buffer_t *b, u32 *next_nodes, u32 feat_bit)
Return the graph node index for the feature corresponding to the next set bit after clearing the curr...
vlib_node_registration_t acl_in_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip6_node)
u32 fa_acl_out_ip4_l2_node_feat_next_node_index[32]
static fa_session_t * get_session_ptr(acl_main_t *am, u16 thread_index, u32 session_index)
VNET_FEATURE_INIT(acl_in_ip6_fa_feature, static)
vlib_node_registration_t acl_out_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip6_node)
static char * acl_fa_error_strings[]
u32 fa_acl_out_ip6_l2_node_feat_next_node_index[32]
static void acl_fa_try_recycle_session(acl_main_t *am, int is_input, u16 thread_index, u32 sw_if_index, u64 now)
u64 * fa_session_epoch_change_by_sw_if_index
u32 * output_lc_index_by_sw_if_index
static u16 get_current_policy_epoch(acl_main_t *am, int is_input, u32 sw_if_index0)
vlib_error_t error
Error code for buffers to be enqueued to error handler.
#define FA_POLICY_EPOCH_IS_INPUT
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
#define foreach_acl_fa_error
#define VLIB_REGISTER_NODE(x,...)
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
static_always_inline void vnet_feature_next(u32 *next0, vlib_buffer_t *b0)
clib_bihash_kv_40_8_t kv_40_8
#define clib_warning(format, args...)
static vlib_node_runtime_t * vlib_node_get_runtime(vlib_main_t *vm, u32 node_index)
Get node runtime by node index.
static int acl_fa_restart_timer_for_session(acl_main_t *am, u64 now, fa_full_session_id_t sess_id)
static int acl_fa_find_session(acl_main_t *am, int is_ip6, u32 sw_if_index0, fa_5tuple_t *p5tuple, u64 *pvalue_sess)
static int fa_session_get_timeout_type(acl_main_t *am, fa_session_t *sess)
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
static int acl_fa_can_add_session(acl_main_t *am, int is_input, u32 sw_if_index)
#define VNET_FEATURES(...)
u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32]
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
#define vec_elt(v, i)
Get vector value at index i.
vlib_node_registration_t acl_out_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip4_node)
struct _vlib_node_registration vlib_node_registration_t
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
acl_fa_per_worker_data_t * per_worker_data
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
static_always_inline uword os_get_thread_index(void)
static u8 acl_fa_track_session(acl_main_t *am, int is_input, u32 sw_if_index, u64 now, fa_session_t *sess, fa_5tuple_t *pkt_5tuple)
static u8 * format_fa_5tuple(u8 *s, va_list *args)
u16 flags
Copy of main node flags.
ip4_address_t ip4_addr[2]
u8 * format_acl_plugin_5tuple(u8 *s, va_list *args)
u32 * input_lc_index_by_sw_if_index
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
#define VLIB_NODE_FLAG_TRACE
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
static u8 * format_acl_plugin_trace(u8 *s, va_list *args)
vlib_node_registration_t acl_in_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip6_node)
ip6_address_t ip6_addr[2]