FD.io VPP  v18.10-34-gcce845e
Vector Packet Processing
gbp_policy.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <plugins/gbp/gbp.h>
17 
18 /**
19  * Grouping of global data for the GBP source EPG classification feature
20  */
21 typedef struct gbp_policy_main_t_
22 {
23  /**
24  * Next nodes for L2 output features
25  */
28 
30 
31 #define foreach_gbp_policy \
32  _(DENY, "deny")
33 
34 typedef enum
35 {
36 #define _(sym,str) GBP_ERROR_##sym,
38 #undef _
41 
42 static char *gbp_policy_error_strings[] = {
43 #define _(sym,string) string,
45 #undef _
46 };
47 
48 typedef enum
49 {
50 #define _(sym,str) GBP_POLICY_NEXT_##sym,
52 #undef _
55 
56 /**
57  * per-packet trace data
58  */
59 typedef struct gbp_policy_trace_t_
60 {
61  /* per-pkt trace data */
66 
67 static uword
69  vlib_node_runtime_t * node, vlib_frame_t * frame)
70 {
73  u32 n_left_from, *from, *to_next;
74  u32 next_index;
75 
76  next_index = 0;
77  n_left_from = frame->n_vectors;
78  from = vlib_frame_vector_args (frame);
79 
80  while (n_left_from > 0)
81  {
82  u32 n_left_to_next;
83 
84  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
85 
86  while (n_left_from > 0 && n_left_to_next > 0)
87  {
88  const gbp_endpoint_t *gep0;
89  gbp_policy_next_t next0;
90  gbp_contract_key_t key0;
91  gbp_contract_value_t value0 = {
92  .as_u64 = ~0,
93  };
94  u32 bi0, sw_if_index0;
95  vlib_buffer_t *b0;
96 
97  next0 = GBP_POLICY_NEXT_DENY;
98  bi0 = from[0];
99  to_next[0] = bi0;
100  from += 1;
101  to_next += 1;
102  n_left_from -= 1;
103  n_left_to_next -= 1;
104 
105  b0 = vlib_get_buffer (vm, bi0);
106 
107  /*
108  * determine the src and dst EPG
109  */
110  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX];
111  gep0 = gbp_endpoint_get_itf (sw_if_index0);
112  key0.gck_dst = gep0->ge_epg_id;
113  key0.gck_src = vnet_buffer2 (b0)->gbp.src_epg;
114 
115  if (EPG_INVALID != key0.gck_src)
116  {
117  if (PREDICT_FALSE (key0.gck_src == key0.gck_dst))
118  {
119  /*
120  * intra-epg allowed
121  */
122  next0 = vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
123  L2OUTPUT_FEAT_GBP_POLICY);
124  }
125  else
126  {
127  value0.as_u64 = gbp_acl_lookup (&key0);
128 
129  if (~0 != value0.gc_lc_index)
130  {
131  fa_5tuple_opaque_t pkt_5tuple0;
132  u8 action0 = 0;
133  u32 acl_pos_p0, acl_match_p0;
134  u32 rule_match_p0, trace_bitmap0;
135  u8 *h0, l2_len0;
136  u16 ether_type0;
137  u8 is_ip60 = 0;
138 
139  l2_len0 = vnet_buffer (b0)->l2.l2_len;
140  h0 = vlib_buffer_get_current (b0);
141 
142  ether_type0 =
143  clib_net_to_host_u16 (*(u16 *) (h0 + l2_len0 - 2));
144 
145  is_ip60 = (ether_type0 == ETHERNET_TYPE_IP6) ? 1 : 0;
146  /*
147  * tests against the ACL
148  */
151  value0.gc_lc_index, b0,
152  is_ip60,
153  /* is_input */ 0,
154  /* is_l2_path */ 1,
155  &pkt_5tuple0);
158  value0.gc_lc_index,
159  &pkt_5tuple0, is_ip60,
160  &action0, &acl_pos_p0,
161  &acl_match_p0,
162  &rule_match_p0,
163  &trace_bitmap0);
164 
165  if (action0 > 0)
166  next0 =
168  L2OUTPUT_FEAT_GBP_POLICY);
169  }
170  }
171  }
172  else
173  {
174  /*
175  * the src EPG is not set when the packet arrives on an EPG
176  * uplink interface and we do not need to apply policy
177  */
178  next0 = vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
179  L2OUTPUT_FEAT_GBP_POLICY);
180  }
181 
182  if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED)))
183  {
184  gbp_policy_trace_t *t =
185  vlib_add_trace (vm, node, b0, sizeof (*t));
186  t->src_epg = key0.gck_src;
187  t->dst_epg = key0.gck_dst;
188  t->acl_index = value0.gc_acl_index;
189  }
190 
191  /* verify speculative enqueue, maybe switch current next frame */
192  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
193  to_next, n_left_to_next,
194  bi0, next0);
195  }
196 
197  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
198  }
199 
200  return frame->n_vectors;
201 }
202 
203 /* packet trace format function */
204 static u8 *
205 format_gbp_policy_trace (u8 * s, va_list * args)
206 {
207  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
208  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
209  gbp_policy_trace_t *t = va_arg (*args, gbp_policy_trace_t *);
210 
211  s =
212  format (s, "src:%d, dst:%d, acl:%d", t->src_epg, t->dst_epg,
213  t->acl_index);
214 
215  return s;
216 }
217 
218 /* *INDENT-OFF* */
220  .function = gbp_policy,
221  .name = "gbp-policy",
222  .vector_size = sizeof (u32),
223  .format_trace = format_gbp_policy_trace,
224  .type = VLIB_NODE_TYPE_INTERNAL,
225 
226  .n_errors = ARRAY_LEN(gbp_policy_error_strings),
227  .error_strings = gbp_policy_error_strings,
228 
229  .n_next_nodes = GBP_POLICY_N_NEXT,
230 
231  .next_nodes = {
232  [GBP_POLICY_NEXT_DENY] = "error-drop",
233  },
234 };
235 
237 
238 /* *INDENT-ON* */
239 
240 static clib_error_t *
242 {
244  clib_error_t *error = 0;
245 
246  /* Initialize the feature next-node indexes */
248  gbp_policy_node.index,
251  gpm->l2_output_feat_next);
252 
253  return error;
254 }
255 
257 
258 /*
259  * fd.io coding-style-patch-verification: ON
260  *
261  * Local Variables:
262  * eval: (c-set-style "gnu")
263  * End:
264  */
u16 epg_id_t
Definition: gbp_types.h:21
A Group Based Policy Endpoint.
Definition: gbp_endpoint.h:46
#define CLIB_UNUSED(x)
Definition: clib.h:81
gbp_policy_next_t
Definition: gbp_policy.c:48
char ** l2output_get_feat_names(void)
Definition: l2_output.c:39
#define vnet_buffer2(b)
Definition: buffer.h:389
The key for an Contract.
Definition: gbp_contract.h:24
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
unsigned char u8
Definition: types.h:56
static u32 vnet_l2_feature_next(vlib_buffer_t *b, u32 *next_nodes, u32 feat_bit)
Return the graph node index for the feature corresponding to the next set bit after clearing the curr...
Definition: feat_bitmap.h:94
static acl_plugin_methods_t acl_plugin
static uword gbp_policy(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: gbp_policy.c:68
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:163
static char * gbp_policy_error_strings[]
Definition: gbp_policy.c:42
per-packet trace data
Definition: gbp_policy.c:59
unsigned int u32
Definition: types.h:88
vlib_node_registration_t gbp_policy_node
(constructor) VLIB_REGISTER_NODE (gbp_policy_node)
Definition: gbp_policy.c:219
#define foreach_gbp_policy
Definition: gbp_policy.c:31
static void acl_plugin_fill_5tuple_inline(void *p_acl_main, u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
#define gm
Definition: dlmalloc.c:1217
struct gbp_policy_trace_t_ gbp_policy_trace_t
per-packet trace data
unsigned short u16
Definition: types.h:57
u32 gc_lc_index
lookup context and acl index
Definition: gbp_contract.h:52
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:205
The value for an Contract.
Definition: gbp_contract.h:43
#define PREDICT_FALSE(x)
Definition: clib.h:107
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:364
static clib_error_t * gbp_policy_init(vlib_main_t *vm)
Definition: gbp_policy.c:241
u32 l2_output_feat_next[32]
Next nodes for L2 output features.
Definition: gbp_policy.c:26
static u64 gbp_acl_lookup(gbp_contract_key_t *key)
Definition: gbp_contract.h:101
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:155
u16 n_vectors
Definition: node.h:401
vlib_main_t * vm
Definition: buffer.c:294
static void feat_bitmap_init_next_nodes(vlib_main_t *vm, u32 node_index, u32 num_features, char **feat_names, u32 *next_nodes)
Initialize the feature next-node indexes of a graph node.
Definition: feat_bitmap.h:43
static gbp_endpoint_t * gbp_endpoint_get_itf(u32 sw_if_index)
Definition: gbp_endpoint.h:122
#define ARRAY_LEN(x)
Definition: clib.h:61
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:455
epg_id_t gck_src
source and destination EPGs for which the ACL applies
Definition: gbp_contract.h:33
VLIB_NODE_FUNCTION_MULTIARCH(gbp_policy_node, gbp_policy)
gbp_main_t gbp_main
Definition: gbp_api.c:69
static gbp_policy_main_t gbp_policy_main
Definition: gbp_policy.c:29
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
static u8 * format_gbp_policy_trace(u8 *s, va_list *args)
Definition: gbp_policy.c:205
#define EPG_INVALID
Definition: gbp_types.h:22
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:57
Definition: defs.h:47
struct gbp_policy_main_t_ gbp_policy_main_t
Grouping of global data for the GBP source EPG classification feature.
epg_id_t ge_epg_id
The endpoint&#39;s designated EPG.
Definition: gbp_endpoint.h:66
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:267
Group Base Policy (GBP) defines:
Definition: gbp.h:43
#define vnet_buffer(b)
Definition: buffer.h:344
gbp_policy_error_t
Definition: gbp_policy.c:34
Grouping of global data for the GBP source EPG classification feature.
Definition: gbp_policy.c:21
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:116
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:58