FD.io VPP  v18.10-34-gcce845e
Vector Packet Processing
dataplane_node.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include <stddef.h>
16 #include <netinet/in.h>
17 
18 #include <vlib/vlib.h>
19 #include <vnet/vnet.h>
20 #include <vnet/pg/pg.h>
21 #include <vppinfra/error.h>
22 
23 
24 #include <acl/acl.h>
25 #include <vnet/ip/icmp46_packet.h>
26 
27 #include <plugins/acl/fa_node.h>
28 #include <plugins/acl/acl.h>
32 
33 #include <vppinfra/bihash_40_8.h>
35 
36 typedef struct
37 {
43  u64 packet_info[6];
47 
48 /* *INDENT-OFF* */
49 #define foreach_acl_fa_error \
50 _(ACL_DROP, "ACL deny packets") \
51 _(ACL_PERMIT, "ACL permit packets") \
52 _(ACL_NEW_SESSION, "new sessions added") \
53 _(ACL_EXIST_SESSION, "existing session packets") \
54 _(ACL_CHECK, "checked packets") \
55 _(ACL_RESTART_SESSION_TIMER, "restart session timer") \
56 _(ACL_TOO_MANY_SESSIONS, "too many sessions to add new") \
57 /* end of errors */
58 
59 typedef enum
60 {
61 #define _(sym,str) ACL_FA_ERROR_##sym,
63 #undef _
66 
67 /* *INDENT-ON* */
68 
70 get_current_policy_epoch (acl_main_t * am, int is_input, u32 sw_if_index0)
71 {
72  u32 **p_epoch_vec =
73  is_input ? &am->input_policy_epoch_by_sw_if_index :
75  u16 current_policy_epoch =
76  sw_if_index0 < vec_len (*p_epoch_vec) ? vec_elt (*p_epoch_vec,
77  sw_if_index0)
78  : (is_input * FA_POLICY_EPOCH_IS_INPUT);
79  return current_policy_epoch;
80 }
81 
84  vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip6,
85  int is_input, int is_l2_path, u32 * l2_feat_next_node_index,
86  vlib_node_registration_t * acl_fa_node)
87 {
88  u32 n_left, *from;
89  u32 pkts_acl_checked = 0;
90  u32 pkts_new_session = 0;
91  u32 pkts_exist_session = 0;
92  u32 pkts_acl_permit = 0;
93  u32 pkts_restart_session_timer = 0;
94  u32 trace_bitmap = 0;
95  acl_main_t *am = &acl_main;
96  fa_5tuple_t fa_5tuple;
97  vlib_node_runtime_t *error_node;
98  u64 now = clib_cpu_time_now ();
99  uword thread_index = os_get_thread_index ();
100  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
101 
102  u16 nexts[VLIB_FRAME_SIZE], *next;
103  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
104 
105  from = vlib_frame_vector_args (frame);
106 
107  error_node = vlib_node_get_runtime (vm, acl_fa_node->index);
108 
109  vlib_get_buffers (vm, from, bufs, frame->n_vectors);
110  /* set the initial values for the current buffer the next pointers */
111  b = bufs;
112  next = nexts;
113 
114  n_left = frame->n_vectors;
115  while (n_left > 0)
116  {
117  u32 next0 = 0;
118  u8 action = 0;
119  u32 sw_if_index0;
120  u32 lc_index0 = ~0;
121  int acl_check_needed = 1;
122  u32 match_acl_in_index = ~0;
123  u32 match_acl_pos = ~0;
124  u32 match_rule_index = ~0;
125  u8 error0 = 0;
126 
127  n_left -= 1;
128 
129  if (is_input)
130  sw_if_index0 = vnet_buffer (b[0])->sw_if_index[VLIB_RX];
131  else
132  sw_if_index0 = vnet_buffer (b[0])->sw_if_index[VLIB_TX];
133 
134  if (is_input)
135  lc_index0 = am->input_lc_index_by_sw_if_index[sw_if_index0];
136  else
137  lc_index0 = am->output_lc_index_by_sw_if_index[sw_if_index0];
138 
139  u16 current_policy_epoch =
140  get_current_policy_epoch (am, is_input, sw_if_index0);
141 
142 
143  /*
144  * Extract the L3/L4 matching info into a 5-tuple structure.
145  */
146 
147  acl_fill_5tuple (&acl_main, sw_if_index0, b[0], is_ip6,
148  is_input, is_l2_path, &fa_5tuple);
149 
150 #ifdef FA_NODE_VERBOSE_DEBUG
152  ("ACL_FA_NODE_DBG: packet 5-tuple %016llx %016llx %016llx %016llx %016llx %016llx",
153  fa_5tuple.kv.key[0], fa_5tuple.kv.key[1], fa_5tuple.kv.key[2],
154  fa_5tuple.kv.key[3], fa_5tuple.kv.key[4], fa_5tuple.kv.value);
155 #endif
156 
157  /* Try to match an existing session first */
158 
159  if (acl_fa_ifc_has_sessions (am, sw_if_index0))
160  {
161  u64 value_sess = ~0ULL;
163  (am, is_ip6, sw_if_index0, &fa_5tuple, &value_sess)
164  && (value_sess != ~0ULL))
165  {
166  trace_bitmap |= 0x80000000;
167  error0 = ACL_FA_ERROR_ACL_EXIST_SESSION;
168  fa_full_session_id_t f_sess_id;
169 
170  f_sess_id.as_u64 = value_sess;
171  ASSERT (f_sess_id.thread_index < vec_len (vlib_mains));
172 
173  fa_session_t *sess =
174  get_session_ptr (am, f_sess_id.thread_index,
175  f_sess_id.session_index);
176  int old_timeout_type = fa_session_get_timeout_type (am, sess);
177  action =
178  acl_fa_track_session (am, is_input, sw_if_index0, now,
179  sess, &fa_5tuple);
180  /* expose the session id to the tracer */
181  match_rule_index = f_sess_id.session_index;
182  int new_timeout_type = fa_session_get_timeout_type (am, sess);
183  acl_check_needed = 0;
184  pkts_exist_session += 1;
185  /* Tracking might have changed the session timeout type, e.g. from transient to established */
186  if (PREDICT_FALSE (old_timeout_type != new_timeout_type))
187  {
188  acl_fa_restart_timer_for_session (am, now, f_sess_id);
189  pkts_restart_session_timer++;
190  trace_bitmap |=
191  0x00010000 + ((0xff & old_timeout_type) << 8) +
192  (0xff & new_timeout_type);
193  }
194  /*
195  * I estimate the likelihood to be very low - the VPP needs
196  * to have >64K interfaces to start with and then on
197  * exactly 64K indices apart needs to be exactly the same
198  * 5-tuple... Anyway, since this probability is nonzero -
199  * print an error and drop the unlucky packet.
200  * If this shows up in real world, we would need to bump
201  * the hash key length.
202  */
203  if (PREDICT_FALSE (sess->sw_if_index != sw_if_index0))
204  {
206  ("BUG: session LSB16(sw_if_index) and 5-tuple collision!");
207  acl_check_needed = 0;
208  action = 0;
209  }
211  {
212  /* if the MSB of policy epoch matches but not the LSB means it is a stale session */
213  if ((0 ==
214  ((current_policy_epoch ^
215  f_sess_id.intf_policy_epoch) &
217  && (current_policy_epoch !=
218  f_sess_id.intf_policy_epoch))
219  {
220  /* delete session and increment the counter */
223  sw_if_index0);
225  sw_if_index0)++;
227  (am, f_sess_id, now))
228  {
229  /* delete the session only if we were able to unlink it */
230  acl_fa_two_stage_delete_session (am, sw_if_index0,
231  f_sess_id, now);
232  }
233  acl_check_needed = 1;
234  trace_bitmap |= 0x40000000;
235  }
236  }
237  }
238  }
239 
240  if (acl_check_needed)
241  {
242  action = 0; /* deny by default */
244  (fa_5tuple_opaque_t *) &
245  fa_5tuple, is_ip6, &action,
246  &match_acl_pos,
247  &match_acl_in_index,
248  &match_rule_index, &trace_bitmap);
249  error0 = action;
250  if (1 == action)
251  pkts_acl_permit += 1;
252  if (2 == action)
253  {
254  if (!acl_fa_can_add_session (am, is_input, sw_if_index0))
255  acl_fa_try_recycle_session (am, is_input, thread_index,
256  sw_if_index0, now);
257 
258  if (acl_fa_can_add_session (am, is_input, sw_if_index0))
259  {
260  fa_session_t *sess =
261  acl_fa_add_session (am, is_input, is_ip6,
262  sw_if_index0,
263  now, &fa_5tuple,
264  current_policy_epoch);
265  acl_fa_track_session (am, is_input, sw_if_index0,
266  now, sess, &fa_5tuple);
267  pkts_new_session += 1;
268  }
269  else
270  {
271  action = 0;
272  error0 = ACL_FA_ERROR_ACL_TOO_MANY_SESSIONS;
273  }
274  }
275  }
276 
277 
278 
279  if (action > 0)
280  {
281  if (is_l2_path)
282  next0 = vnet_l2_feature_next (b[0], l2_feat_next_node_index, 0);
283  else
284  vnet_feature_next (&next0, b[0]);
285  }
286 #ifdef FA_NODE_VERBOSE_DEBUG
288  ("ACL_FA_NODE_DBG: sw_if_index %d lc_index %d action %d acl_index %d rule_index %d",
289  sw_if_index0, lc_index0, action, match_acl_in_index,
290  match_rule_index);
291 #endif
292 
294  && (b[0]->flags & VLIB_BUFFER_IS_TRACED)))
295  {
296  acl_fa_trace_t *t = vlib_add_trace (vm, node, b[0], sizeof (*t));
297  t->sw_if_index = sw_if_index0;
298  t->lc_index = lc_index0;
299  t->next_index = next0;
300  t->match_acl_in_index = match_acl_in_index;
301  t->match_rule_index = match_rule_index;
302  t->packet_info[0] = fa_5tuple.kv_40_8.key[0];
303  t->packet_info[1] = fa_5tuple.kv_40_8.key[1];
304  t->packet_info[2] = fa_5tuple.kv_40_8.key[2];
305  t->packet_info[3] = fa_5tuple.kv_40_8.key[3];
306  t->packet_info[4] = fa_5tuple.kv_40_8.key[4];
307  t->packet_info[5] = fa_5tuple.kv_40_8.value;
308  t->action = action;
309  t->trace_bitmap = trace_bitmap;
310  }
311 
312  next0 = next0 < node->n_next_nodes ? next0 : 0;
313  if (0 == next0)
314  b[0]->error = error_node->errors[error0];
315  next[0] = next0;
316 
317  next++;
318  b++;
319  pkts_acl_checked += 1;
320  }
321 
322  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
323 
324  vlib_node_increment_counter (vm, acl_fa_node->index,
325  ACL_FA_ERROR_ACL_CHECK, pkts_acl_checked);
326  vlib_node_increment_counter (vm, acl_fa_node->index,
327  ACL_FA_ERROR_ACL_PERMIT, pkts_acl_permit);
328  vlib_node_increment_counter (vm, acl_fa_node->index,
329  ACL_FA_ERROR_ACL_NEW_SESSION,
330  pkts_new_session);
331  vlib_node_increment_counter (vm, acl_fa_node->index,
332  ACL_FA_ERROR_ACL_EXIST_SESSION,
333  pkts_exist_session);
334  vlib_node_increment_counter (vm, acl_fa_node->index,
335  ACL_FA_ERROR_ACL_RESTART_SESSION_TIMER,
336  pkts_restart_session_timer);
337  return frame->n_vectors;
338 }
339 
342  vlib_node_runtime_t * node,
343  vlib_frame_t * frame)
344 {
345  acl_main_t *am = &acl_main;
346  return acl_fa_node_fn (vm, node, frame, 1, 1, 1,
349 }
350 
353  vlib_node_runtime_t * node,
354  vlib_frame_t * frame)
355 {
356  acl_main_t *am = &acl_main;
357  return acl_fa_node_fn (vm, node, frame, 0, 1, 1,
360 }
361 
364  vlib_node_runtime_t * node,
365  vlib_frame_t * frame)
366 {
367  acl_main_t *am = &acl_main;
368  return acl_fa_node_fn (vm, node, frame, 1, 0, 1,
371 }
372 
375  vlib_node_runtime_t * node,
376  vlib_frame_t * frame)
377 {
378  acl_main_t *am = &acl_main;
379  return acl_fa_node_fn (vm, node, frame, 0, 0, 1,
382 }
383 
384 /**** L3 processing path nodes ****/
385 
388  vlib_node_runtime_t * node,
389  vlib_frame_t * frame)
390 {
391  return acl_fa_node_fn (vm, node, frame, 1, 1, 0, 0, &acl_in_fa_ip6_node);
392 }
393 
396  vlib_node_runtime_t * node,
397  vlib_frame_t * frame)
398 {
399  return acl_fa_node_fn (vm, node, frame, 0, 1, 0, 0, &acl_in_fa_ip4_node);
400 }
401 
404  vlib_node_runtime_t * node,
405  vlib_frame_t * frame)
406 {
407  return acl_fa_node_fn (vm, node, frame, 1, 0, 0, 0, &acl_out_fa_ip6_node);
408 }
409 
412  vlib_node_runtime_t * node,
413  vlib_frame_t * frame)
414 {
415  return acl_fa_node_fn (vm, node, frame, 0, 0, 0, 0, &acl_out_fa_ip4_node);
416 }
417 
418 static u8 *
419 format_fa_5tuple (u8 * s, va_list * args)
420 {
421  fa_5tuple_t *p5t = va_arg (*args, fa_5tuple_t *);
422 
423  if (p5t->pkt.is_ip6)
424  return format (s, "lc_index %d (lsb16 of sw_if_index %d) l3 %s%s %U -> %U"
425  " l4 proto %d l4_valid %d port %d -> %d tcp flags (%s) %02x rsvd %x",
426  p5t->pkt.lc_index, p5t->l4.lsb_of_sw_if_index,
427  "ip6",
428  p5t->
429  pkt.is_nonfirst_fragment ? " non-initial fragment" : "",
431  &p5t->ip6_addr[1], p5t->l4.proto, p5t->pkt.l4_valid,
432  p5t->l4.port[0], p5t->l4.port[1],
433  p5t->pkt.tcp_flags_valid ? "valid" : "invalid",
434  p5t->pkt.tcp_flags, p5t->pkt.flags_reserved);
435  else
436  return format (s, "lc_index %d (lsb16 of sw_if_index %d) l3 %s%s %U -> %U"
437  " l4 proto %d l4_valid %d port %d -> %d tcp flags (%s) %02x rsvd %x",
438  p5t->pkt.lc_index, p5t->l4.lsb_of_sw_if_index,
439  "ip4",
440  p5t->
441  pkt.is_nonfirst_fragment ? " non-initial fragment" : "",
443  &p5t->ip4_addr[1], p5t->l4.proto, p5t->pkt.l4_valid,
444  p5t->l4.port[0], p5t->l4.port[1],
445  p5t->pkt.tcp_flags_valid ? "valid" : "invalid",
446  p5t->pkt.tcp_flags, p5t->pkt.flags_reserved);
447 }
448 
449 #ifndef CLIB_MARCH_VARIANT
450 u8 *
451 format_acl_plugin_5tuple (u8 * s, va_list * args)
452 {
453  return format_fa_5tuple (s, args);
454 }
455 #endif
456 
457 /* packet trace format function */
458 static u8 *
459 format_acl_plugin_trace (u8 * s, va_list * args)
460 {
461  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
462  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
463  acl_fa_trace_t *t = va_arg (*args, acl_fa_trace_t *);
464 
465  s =
466  format (s,
467  "acl-plugin: lc_index: %d, sw_if_index %d, next index %d, action: %d, match: acl %d rule %d trace_bits %08x\n"
468  " pkt info %016llx %016llx %016llx %016llx %016llx %016llx",
469  t->lc_index, t->sw_if_index, t->next_index, t->action,
471  t->packet_info[0], t->packet_info[1], t->packet_info[2],
472  t->packet_info[3], t->packet_info[4], t->packet_info[5]);
473 
474  /* Now also print out the packet_info in a form usable by humans */
475  s = format (s, "\n %U", format_fa_5tuple, t->packet_info);
476  return s;
477 }
478 
479 /* *INDENT-OFF* */
480 
481 static char *acl_fa_error_strings[] = {
482 #define _(sym,string) string,
484 #undef _
485 };
486 
488 {
489  .name = "acl-plugin-in-ip6-l2",
490  .vector_size = sizeof (u32),
491  .format_trace = format_acl_plugin_trace,
492  .type = VLIB_NODE_TYPE_INTERNAL,
493  .n_errors = ARRAY_LEN (acl_fa_error_strings),
494  .error_strings = acl_fa_error_strings,
495  .n_next_nodes = ACL_FA_N_NEXT,
496  .next_nodes =
497  {
498  [ACL_FA_ERROR_DROP] = "error-drop",
499  }
500 };
501 
503 {
504  .name = "acl-plugin-in-ip4-l2",
505  .vector_size = sizeof (u32),
506  .format_trace = format_acl_plugin_trace,
507  .type = VLIB_NODE_TYPE_INTERNAL,
508  .n_errors = ARRAY_LEN (acl_fa_error_strings),
509  .error_strings = acl_fa_error_strings,
510  .n_next_nodes = ACL_FA_N_NEXT,
511  .next_nodes =
512  {
513  [ACL_FA_ERROR_DROP] = "error-drop",
514  }
515 };
516 
518 {
519  .name = "acl-plugin-out-ip6-l2",
520  .vector_size = sizeof (u32),
521  .format_trace = format_acl_plugin_trace,
522  .type = VLIB_NODE_TYPE_INTERNAL,
523  .n_errors = ARRAY_LEN (acl_fa_error_strings),
524  .error_strings = acl_fa_error_strings,
525  .n_next_nodes = ACL_FA_N_NEXT,
526  .next_nodes =
527  {
528  [ACL_FA_ERROR_DROP] = "error-drop",
529  }
530 };
531 
533 {
534  .name = "acl-plugin-out-ip4-l2",
535  .vector_size = sizeof (u32),
536  .format_trace = format_acl_plugin_trace,
537  .type = VLIB_NODE_TYPE_INTERNAL,
538  .n_errors = ARRAY_LEN (acl_fa_error_strings),
539  .error_strings = acl_fa_error_strings,
540  .n_next_nodes = ACL_FA_N_NEXT,
541  .next_nodes =
542  {
543  [ACL_FA_ERROR_DROP] = "error-drop",
544  }
545 };
546 
547 
549 {
550  .name = "acl-plugin-in-ip6-fa",
551  .vector_size = sizeof (u32),
552  .format_trace = format_acl_plugin_trace,
553  .type = VLIB_NODE_TYPE_INTERNAL,
554  .n_errors = ARRAY_LEN (acl_fa_error_strings),
555  .error_strings = acl_fa_error_strings,
556  .n_next_nodes = ACL_FA_N_NEXT,
557  .next_nodes =
558  {
559  [ACL_FA_ERROR_DROP] = "error-drop",
560  }
561 };
562 
563 VNET_FEATURE_INIT (acl_in_ip6_fa_feature, static) =
564 {
565  .arc_name = "ip6-unicast",
566  .node_name = "acl-plugin-in-ip6-fa",
567  .runs_before = VNET_FEATURES ("ip6-flow-classify"),
568 };
569 
571 {
572  .name = "acl-plugin-in-ip4-fa",
573  .vector_size = sizeof (u32),
574  .format_trace = format_acl_plugin_trace,
575  .type = VLIB_NODE_TYPE_INTERNAL,
576  .n_errors = ARRAY_LEN (acl_fa_error_strings),
577  .error_strings = acl_fa_error_strings,
578  .n_next_nodes = ACL_FA_N_NEXT,
579  .next_nodes =
580  {
581  [ACL_FA_ERROR_DROP] = "error-drop",
582  }
583 };
584 
585 VNET_FEATURE_INIT (acl_in_ip4_fa_feature, static) =
586 {
587  .arc_name = "ip4-unicast",
588  .node_name = "acl-plugin-in-ip4-fa",
589  .runs_before = VNET_FEATURES ("ip4-flow-classify"),
590 };
591 
592 
594 {
595  .name = "acl-plugin-out-ip6-fa",
596  .vector_size = sizeof (u32),
597  .format_trace = format_acl_plugin_trace,
598  .type = VLIB_NODE_TYPE_INTERNAL,
599  .n_errors = ARRAY_LEN (acl_fa_error_strings),
600  .error_strings = acl_fa_error_strings,
601  .n_next_nodes = ACL_FA_N_NEXT,
602  .next_nodes =
603  {
604  [ACL_FA_ERROR_DROP] = "error-drop",
605  }
606 };
607 
608 VNET_FEATURE_INIT (acl_out_ip6_fa_feature, static) =
609 {
610  .arc_name = "ip6-output",
611  .node_name = "acl-plugin-out-ip6-fa",
612  .runs_before = VNET_FEATURES ("interface-output"),
613 };
614 
616 {
617  .name = "acl-plugin-out-ip4-fa",
618  .vector_size = sizeof (u32),
619  .format_trace = format_acl_plugin_trace,
620  .type = VLIB_NODE_TYPE_INTERNAL,
621  .n_errors = ARRAY_LEN (acl_fa_error_strings),
622  .error_strings = acl_fa_error_strings,
623  .n_next_nodes = ACL_FA_N_NEXT,
624  /* edit / add dispositions here */
625  .next_nodes =
626  {
627  [ACL_FA_ERROR_DROP] = "error-drop",
628  }
629 };
630 
631 VNET_FEATURE_INIT (acl_out_ip4_fa_feature, static) =
632 {
633  .arc_name = "ip4-output",
634  .node_name = "acl-plugin-out-ip4-fa",
635  .runs_before = VNET_FEATURES ("interface-output"),
636 };
637 
638 /* *INDENT-ON* */
639 
640 /*
641  * fd.io coding-style-patch-verification: ON
642  *
643  * Local Variables:
644  * eval: (c-set-style "gnu")
645  * End:
646  */
vlib_node_registration_t acl_in_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip4_node)
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
Definition: vec.h:437
u32 * input_policy_epoch_by_sw_if_index
Definition: acl.h:184
static fa_session_t * acl_fa_add_session(acl_main_t *am, int is_input, int is_ip6, u32 sw_if_index, u64 now, fa_5tuple_t *p5tuple, u16 current_policy_epoch)
u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32]
Definition: acl.h:262
static void acl_fill_5tuple(acl_main_t *am, u32 sw_if_index0, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_t *p5tuple_pkt)
#define CLIB_UNUSED(x)
Definition: clib.h:81
static int acl_fa_conn_list_delete_session(acl_main_t *am, fa_full_session_id_t sess_id, u64 now)
vlib_node_registration_t acl_out_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip4_node)
fa_session_l4_key_t l4
Definition: fa_node.h:71
fa_packet_info_t pkt
Definition: fa_node.h:73
vlib_node_registration_t acl_out_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip6_node)
acl_fa_error_t
vlib_node_registration_t acl_in_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip4_node)
unsigned long u64
Definition: types.h:89
static u64 clib_cpu_time_now(void)
Definition: time.h:73
static int acl_fa_ifc_has_sessions(acl_main_t *am, int sw_if_index0)
static int acl_fa_two_stage_delete_session(acl_main_t *am, u32 sw_if_index, fa_full_session_id_t sess_id, u64 now)
u32 * output_policy_epoch_by_sw_if_index
Definition: acl.h:185
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
static uword acl_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_input, int is_l2_path, u32 *l2_feat_next_node_index, vlib_node_registration_t *acl_fa_node)
#define VLIB_NODE_FN(node)
Definition: node.h:187
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:472
vlib_main_t ** vlib_mains
Definition: buffer.c:303
unsigned char u8
Definition: types.h:56
static u32 vnet_l2_feature_next(vlib_buffer_t *b, u32 *next_nodes, u32 feat_bit)
Return the graph node index for the feature corresponding to the next set bit after clearing the curr...
Definition: feat_bitmap.h:94
vlib_node_registration_t acl_in_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip6_node)
u32 fa_acl_out_ip4_l2_node_feat_next_node_index[32]
Definition: acl.h:264
static fa_session_t * get_session_ptr(acl_main_t *am, u16 thread_index, u32 session_index)
u16 lsb_of_sw_if_index
Definition: fa_node.h:51
format_function_t format_ip4_address
Definition: format.h:75
VNET_FEATURE_INIT(acl_in_ip6_fa_feature, static)
vlib_node_registration_t acl_out_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip6_node)
#define always_inline
Definition: clib.h:94
unsigned int u32
Definition: types.h:88
static char * acl_fa_error_strings[]
#define VLIB_FRAME_SIZE
Definition: node.h:382
u32 fa_acl_out_ip6_l2_node_feat_next_node_index[32]
Definition: acl.h:265
static void acl_fa_try_recycle_session(acl_main_t *am, int is_input, u16 thread_index, u32 sw_if_index, u64 now)
unsigned short u16
Definition: types.h:57
u64 * fa_session_epoch_change_by_sw_if_index
Definition: fa_node.h:163
u32 * output_lc_index_by_sw_if_index
Definition: acl.h:162
#define PREDICT_FALSE(x)
Definition: clib.h:107
static u16 get_current_policy_epoch(acl_main_t *am, int is_input, u32 sw_if_index0)
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:138
#define FA_POLICY_EPOCH_IS_INPUT
Definition: fa_node.h:103
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1176
#define foreach_acl_fa_error
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:155
u16 n_vectors
Definition: node.h:401
format_function_t format_ip6_address
Definition: format.h:93
vlib_main_t * vm
Definition: buffer.c:294
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
Definition: buffer_node.h:332
static_always_inline void vnet_feature_next(u32 *next0, vlib_buffer_t *b0)
Definition: feature.h:246
clib_bihash_kv_40_8_t kv_40_8
Definition: fa_node.h:75
#define clib_warning(format, args...)
Definition: error.h:59
static vlib_node_runtime_t * vlib_node_get_runtime(vlib_main_t *vm, u32 node_index)
Get node runtime by node index.
Definition: node_funcs.h:89
u32 sw_if_index
Definition: fa_node.h:85
#define ARRAY_LEN(x)
Definition: clib.h:61
static int acl_fa_restart_timer_for_session(acl_main_t *am, u64 now, fa_full_session_id_t sess_id)
static int acl_fa_find_session(acl_main_t *am, int is_ip6, u32 sw_if_index0, fa_5tuple_t *p5tuple, u64 *pvalue_sess)
static int fa_session_get_timeout_type(acl_main_t *am, fa_session_t *sess)
#define ASSERT(truth)
u8 tcp_flags_valid
Definition: fa_node.h:33
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
acl_main_t acl_main
Definition: acl.c:56
static int acl_fa_can_add_session(acl_main_t *am, int is_input, u32 sw_if_index)
#define VNET_FEATURES(...)
Definition: feature.h:386
u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32]
Definition: acl.h:263
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:57
#define vec_elt(v, i)
Get vector value at index i.
vlib_node_registration_t acl_out_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip4_node)
struct _vlib_node_registration vlib_node_registration_t
Definition: defs.h:47
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
acl_fa_per_worker_data_t * per_worker_data
Definition: acl.h:305
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:267
static_always_inline uword os_get_thread_index(void)
Definition: os.h:62
static u8 acl_fa_track_session(acl_main_t *am, int is_input, u32 sw_if_index, u64 now, fa_session_t *sess, fa_5tuple_t *pkt_5tuple)
#define vnet_buffer(b)
Definition: buffer.h:344
static u8 * format_fa_5tuple(u8 *s, va_list *args)
u16 flags
Copy of main node flags.
Definition: node.h:507
ip4_address_t ip4_addr[2]
Definition: fa_node.h:67
int reclassify_sessions
Definition: acl.h:188
u8 * format_acl_plugin_5tuple(u8 *s, va_list *args)
u32 * input_lc_index_by_sw_if_index
Definition: acl.h:161
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
Definition: buffer_funcs.h:141
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:310
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:116
static u8 * format_acl_plugin_trace(u8 *s, va_list *args)
Definition: defs.h:46
vlib_node_registration_t acl_in_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip6_node)
ip6_address_t ip6_addr[2]
Definition: fa_node.h:69