FD.io VPP  v19.08.3-2-gbabecb413
Vector Packet Processing
dataplane_node.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include <stddef.h>
16 #include <netinet/in.h>
17 
18 #include <vlib/vlib.h>
19 #include <vnet/vnet.h>
20 #include <vnet/pg/pg.h>
21 #include <vppinfra/error.h>
22 
23 
24 #include <acl/acl.h>
25 #include <vnet/ip/icmp46_packet.h>
26 
27 #include <plugins/acl/fa_node.h>
28 #include <plugins/acl/acl.h>
32 
33 #include <vppinfra/bihash_40_8.h>
35 
36 typedef struct
37 {
43  u64 packet_info[6];
47 
48 /* *INDENT-OFF* */
49 #define foreach_acl_fa_error \
50 _(ACL_DROP, "ACL deny packets") \
51 _(ACL_PERMIT, "ACL permit packets") \
52 _(ACL_NEW_SESSION, "new sessions added") \
53 _(ACL_EXIST_SESSION, "existing session packets") \
54 _(ACL_CHECK, "checked packets") \
55 _(ACL_RESTART_SESSION_TIMER, "restart session timer") \
56 _(ACL_TOO_MANY_SESSIONS, "too many sessions to add new") \
57 /* end of errors */
58 
59 typedef enum
60 {
61 #define _(sym,str) ACL_FA_ERROR_##sym,
63 #undef _
66 
67 /* *INDENT-ON* */
68 
69 typedef struct
70 {
75 
76 /* packet trace format function */
77 static u8 *
78 format_nonip_in_out_trace (u8 * s, u32 is_output, va_list * args)
79 {
80  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
81  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
82  nonip_in_out_trace_t *t = va_arg (*args, nonip_in_out_trace_t *);
83 
84  s = format (s, "%s: sw_if_index %d next_index %x ethertype %x",
85  is_output ? "OUT-ETHER-WHITELIST" : "IN-ETHER-WHITELIST",
86  t->sw_if_index, t->next_index, t->ethertype);
87  return s;
88 }
89 
90 static u8 *
91 format_l2_nonip_in_trace (u8 * s, va_list * args)
92 {
93  return format_nonip_in_out_trace (s, 0, args);
94 }
95 
96 static u8 *
97 format_l2_nonip_out_trace (u8 * s, va_list * args)
98 {
99  return format_nonip_in_out_trace (s, 1, args);
100 }
101 
102 #define foreach_nonip_in_error \
103 _(DROP, "dropped inbound non-whitelisted non-ip packets") \
104 _(PERMIT, "permitted inbound whitelisted non-ip packets") \
105 
106 
107 #define foreach_nonip_out_error \
108 _(DROP, "dropped outbound non-whitelisted non-ip packets") \
109 _(PERMIT, "permitted outbound whitelisted non-ip packets") \
110 
111 
112 /* *INDENT-OFF* */
113 
114 typedef enum
115 {
116 #define _(sym,str) FA_IN_NONIP_ERROR_##sym,
118 #undef _
121 
122 static char *fa_in_nonip_error_strings[] = {
123 #define _(sym,string) string,
125 #undef _
126 };
127 
128 typedef enum
129 {
130 #define _(sym,str) FA_OUT_NONIP_ERROR_##sym,
132 #undef _
135 
136 static char *fa_out_nonip_error_strings[] = {
137 #define _(sym,string) string,
139 #undef _
140 };
141 /* *INDENT-ON* */
142 
143 
144 always_inline int
145 is_permitted_ethertype (acl_main_t * am, int sw_if_index0, int is_output,
146  u16 ethertype)
147 {
148  u16 **v = is_output
151  u16 *whitelist = vec_elt (v, sw_if_index0);
152  int i;
153 
154  if (vec_len (whitelist) == 0)
155  return 1;
156 
157  for (i = 0; i < vec_len (whitelist); i++)
158  if (whitelist[i] == ethertype)
159  return 1;
160  return 0;
161 }
162 
163 #define get_u16(addr) ( *((u16 *)(addr)) )
164 
167  vlib_node_runtime_t * node, vlib_frame_t * frame,
168  int is_output)
169 {
170  acl_main_t *am = &acl_main;
171  u32 n_left, *from;
172  u16 nexts[VLIB_FRAME_SIZE], *next;
173  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
174  vlib_node_runtime_t *error_node;
175 
176  from = vlib_frame_vector_args (frame);
177  error_node = vlib_node_get_runtime (vm, node->node_index);
178  vlib_get_buffers (vm, from, bufs, frame->n_vectors);
179  /* set the initial values for the current buffer the next pointers */
180  b = bufs;
181  next = nexts;
182 
183  n_left = frame->n_vectors;
184  while (n_left > 0)
185  {
186  u32 next_index = 0;
187  u32 sw_if_index0 =
188  vnet_buffer (b[0])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
189  u16 ethertype = 0;
190 
191  int error0 = 0;
192 
194  u8 *l3h0 = (u8 *) h0 + vnet_buffer (b[0])->l2.l2_len;
195  ethertype = clib_net_to_host_u16 (get_u16 (l3h0 - 2));
196 
197  if (is_permitted_ethertype (am, sw_if_index0, is_output, ethertype))
198  vnet_feature_next (&next_index, b[0]);
199 
200  next[0] = next_index;
201 
202  if (0 == next[0])
203  b[0]->error = error_node->errors[error0];
204 
206  && (b[0]->flags & VLIB_BUFFER_IS_TRACED)))
207  {
209  vlib_add_trace (vm, node, b[0], sizeof (*t));
210  t->sw_if_index = sw_if_index0;
211  t->ethertype = ethertype;
212  t->next_index = next[0];
213  }
214  next[0] = next[0] < node->n_next_nodes ? next[0] : 0;
215 
216  next++;
217  b++;
218  n_left--;
219  }
220  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
221 
222  return frame->n_vectors;
223 }
224 
226  vlib_node_runtime_t * node,
227  vlib_frame_t * frame)
228 {
229  return nonip_in_out_node_fn (vm, node, frame, 0);
230 }
231 
233  vlib_node_runtime_t * node,
234  vlib_frame_t * frame)
235 {
236  return nonip_in_out_node_fn (vm, node, frame, 1);
237 }
238 
239 
240 /* *INDENT-OFF* */
241 
243 {
244  .name = "acl-plugin-in-nonip-l2",
245  .vector_size = sizeof (u32),
246  .format_trace = format_l2_nonip_in_trace,
248  .n_errors = ARRAY_LEN (fa_in_nonip_error_strings),
249  .error_strings = fa_in_nonip_error_strings,
250  .n_next_nodes = ACL_FA_N_NEXT,
251  .next_nodes =
252  {
253  [ACL_FA_ERROR_DROP] = "error-drop",
254  }
255 };
256 
257 VNET_FEATURE_INIT (acl_in_l2_nonip_fa_feature, static) =
258 {
259  .arc_name = "l2-input-nonip",
260  .node_name = "acl-plugin-in-nonip-l2",
261  .runs_before = VNET_FEATURES ("l2-input-feat-arc-end"),
262 };
263 
265 {
266  .name = "acl-plugin-out-nonip-l2",
267  .vector_size = sizeof (u32),
268  .format_trace = format_l2_nonip_out_trace,
271  .error_strings = fa_out_nonip_error_strings,
272  .n_next_nodes = ACL_FA_N_NEXT,
273  .next_nodes =
274  {
275  [ACL_FA_ERROR_DROP] = "error-drop",
276  }
277 };
278 
279 VNET_FEATURE_INIT (acl_out_l2_nonip_fa_feature, static) =
280 {
281  .arc_name = "l2-output-nonip",
282  .node_name = "acl-plugin-out-nonip-l2",
283  .runs_before = VNET_FEATURES ("l2-output-feat-arc-end"),
284 };
285 
286 /* *INDENT-ON* */
287 
288 
289 
291 get_current_policy_epoch (acl_main_t * am, int is_input, u32 sw_if_index0)
292 {
293  u32 **p_epoch_vec =
294  is_input ? &am->input_policy_epoch_by_sw_if_index :
296  u16 current_policy_epoch =
297  sw_if_index0 < vec_len (*p_epoch_vec) ? vec_elt (*p_epoch_vec,
298  sw_if_index0)
299  : (is_input * FA_POLICY_EPOCH_IS_INPUT);
300  return current_policy_epoch;
301 }
302 
303 always_inline void
305  vlib_buffer_t * b, u32 sw_if_index0, u32 lc_index0,
306  u16 next0, int match_acl_in_index, int match_rule_index,
307  fa_5tuple_t * fa_5tuple, u8 action, u32 trace_bitmap)
308 {
309  if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
310  {
311  acl_fa_trace_t *t = vlib_add_trace (vm, node, b, sizeof (*t));
312  t->sw_if_index = sw_if_index0;
313  t->lc_index = lc_index0;
314  t->next_index = next0;
315  t->match_acl_in_index = match_acl_in_index;
316  t->match_rule_index = match_rule_index;
317  t->packet_info[0] = fa_5tuple->kv_40_8.key[0];
318  t->packet_info[1] = fa_5tuple->kv_40_8.key[1];
319  t->packet_info[2] = fa_5tuple->kv_40_8.key[2];
320  t->packet_info[3] = fa_5tuple->kv_40_8.key[3];
321  t->packet_info[4] = fa_5tuple->kv_40_8.key[4];
322  t->packet_info[5] = fa_5tuple->kv_40_8.value;
323  t->action = action;
324  t->trace_bitmap = trace_bitmap;
325  }
326 }
327 
328 
329 always_inline int
330 stale_session_deleted (acl_main_t * am, int is_input,
331  acl_fa_per_worker_data_t * pw, u64 now,
332  u32 sw_if_index0, fa_full_session_id_t f_sess_id)
333 {
334  u16 current_policy_epoch =
335  get_current_policy_epoch (am, is_input, sw_if_index0);
336 
337  /* if the MSB of policy epoch matches but not the LSB means it is a stale session */
338  if ((0 ==
339  ((current_policy_epoch ^
340  f_sess_id.intf_policy_epoch) &
342  && (current_policy_epoch != f_sess_id.intf_policy_epoch))
343  {
344  /* delete session and increment the counter */
346  vec_elt (pw->fa_session_epoch_change_by_sw_if_index, sw_if_index0)++;
347  if (acl_fa_conn_list_delete_session (am, f_sess_id, now))
348  {
349  /* delete the session only if we were able to unlink it */
350  acl_fa_two_stage_delete_session (am, sw_if_index0, f_sess_id, now);
351  }
352  return 1;
353  }
354  else
355  return 0;
356 }
357 
358 
359 
360 
361 
362 always_inline void
363 get_sw_if_index_xN (int vector_sz, int is_input, vlib_buffer_t ** b,
364  u32 * out_sw_if_index)
365 {
366  int ii;
367  for (ii = 0; ii < vector_sz; ii++)
368  if (is_input)
369  out_sw_if_index[ii] = vnet_buffer (b[ii])->sw_if_index[VLIB_RX];
370  else
371  out_sw_if_index[ii] = vnet_buffer (b[ii])->sw_if_index[VLIB_TX];
372 }
373 
374 always_inline void
375 fill_5tuple_xN (int vector_sz, acl_main_t * am, int is_ip6, int is_input,
376  int is_l2_path, vlib_buffer_t ** b, u32 * sw_if_index,
377  fa_5tuple_t * out_fa_5tuple)
378 {
379  int ii;
380  for (ii = 0; ii < vector_sz; ii++)
381  acl_fill_5tuple (am, sw_if_index[ii], b[ii], is_ip6,
382  is_input, is_l2_path, &out_fa_5tuple[ii]);
383 }
384 
385 always_inline void
386 make_session_hash_xN (int vector_sz, acl_main_t * am, int is_ip6,
387  u32 * sw_if_index, fa_5tuple_t * fa_5tuple,
388  u64 * out_hash)
389 {
390  int ii;
391  for (ii = 0; ii < vector_sz; ii++)
392  out_hash[ii] =
393  acl_fa_make_session_hash (am, is_ip6, sw_if_index[ii], &fa_5tuple[ii]);
394 }
395 
396 always_inline void
398 {
399  fa_session_t *sess = get_session_ptr_no_check (am, f_sess_id.thread_index,
400  f_sess_id.session_index);
401  CLIB_PREFETCH (sess, 2 * CLIB_CACHE_LINE_BYTES, STORE);
402 }
403 
406  u32 counter_node_index, int is_input, u64 now,
407  fa_full_session_id_t f_sess_id,
408  u32 * sw_if_index, fa_5tuple_t * fa_5tuple,
409  u32 pkt_len, int node_trace_on,
410  u32 * trace_bitmap)
411 {
412  u8 action = 0;
413  fa_session_t *sess = get_session_ptr_no_check (am, f_sess_id.thread_index,
414  f_sess_id.session_index);
415 
416  int old_timeout_type = fa_session_get_timeout_type (am, sess);
417  action =
418  acl_fa_track_session (am, is_input, sw_if_index[0], now,
419  sess, &fa_5tuple[0], pkt_len);
420  int new_timeout_type = fa_session_get_timeout_type (am, sess);
421  /* Tracking might have changed the session timeout type, e.g. from transient to established */
422  if (PREDICT_FALSE (old_timeout_type != new_timeout_type))
423  {
424  acl_fa_restart_timer_for_session (am, now, f_sess_id);
425  vlib_node_increment_counter (vm, counter_node_index,
426  ACL_FA_ERROR_ACL_RESTART_SESSION_TIMER, 1);
427  if (node_trace_on)
428  *trace_bitmap |=
429  0x00010000 + ((0xff & old_timeout_type) << 8) +
430  (0xff & new_timeout_type);
431  }
432  /*
433  * I estimate the likelihood to be very low - the VPP needs
434  * to have >64K interfaces to start with and then on
435  * exactly 64K indices apart needs to be exactly the same
436  * 5-tuple... Anyway, since this probability is nonzero -
437  * print an error and drop the unlucky packet.
438  * If this shows up in real world, we would need to bump
439  * the hash key length.
440  */
441  if (PREDICT_FALSE (sess->sw_if_index != sw_if_index[0]))
442  {
444  ("BUG: session LSB16(sw_if_index)=%d and 5-tuple=%d collision!",
445  sess->sw_if_index, sw_if_index[0]);
446  action = 0;
447  }
448  return action;
449 
450 }
451 
452 #define ACL_PLUGIN_VECTOR_SIZE 4
453 #define ACL_PLUGIN_PREFETCH_GAP 3
454 
455 always_inline void
457  vlib_node_runtime_t * node,
458  vlib_frame_t * frame, int is_ip6, int is_input,
459  int is_l2_path, int with_stateful_datapath)
460  /* , int node_trace_on,
461  int reclassify_sessions) */
462 {
463  u32 n_left, *from;
464  acl_main_t *am = &acl_main;
465  uword thread_index = os_get_thread_index ();
466  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
467 
468  vlib_buffer_t **b;
469  u32 *sw_if_index;
470  fa_5tuple_t *fa_5tuple;
471  u64 *hash;
472 
473 
474 
475  from = vlib_frame_vector_args (frame);
476  vlib_get_buffers (vm, from, pw->bufs, frame->n_vectors);
477 
478  /* set the initial values for the current buffer the next pointers */
479  b = pw->bufs;
480  sw_if_index = pw->sw_if_indices;
481  fa_5tuple = pw->fa_5tuples;
482  hash = pw->hashes;
483 
484 
485  /*
486  * fill the sw_if_index, 5tuple and session hash,
487  * First in strides of size ACL_PLUGIN_VECTOR_SIZE,
488  * with buffer prefetch being
489  * ACL_PLUGIN_PREFETCH_GAP * ACL_PLUGIN_VECTOR_SIZE entries
490  * in front. Then with a simple single loop.
491  */
492 
493  n_left = frame->n_vectors;
494  while (n_left >= (ACL_PLUGIN_PREFETCH_GAP + 1) * ACL_PLUGIN_VECTOR_SIZE)
495  {
496  const int vec_sz = ACL_PLUGIN_VECTOR_SIZE;
497  {
498  int ii;
499  for (ii = ACL_PLUGIN_PREFETCH_GAP * vec_sz;
500  ii < (ACL_PLUGIN_PREFETCH_GAP + 1) * vec_sz; ii++)
501  {
502  CLIB_PREFETCH (b[ii], CLIB_CACHE_LINE_BYTES, LOAD);
503  CLIB_PREFETCH (b[ii]->data, 2 * CLIB_CACHE_LINE_BYTES, LOAD);
504  }
505  }
506 
507 
508  get_sw_if_index_xN (vec_sz, is_input, b, sw_if_index);
509  fill_5tuple_xN (vec_sz, am, is_ip6, is_input, is_l2_path, &b[0],
510  &sw_if_index[0], &fa_5tuple[0]);
511  if (with_stateful_datapath)
512  make_session_hash_xN (vec_sz, am, is_ip6, &sw_if_index[0],
513  &fa_5tuple[0], &hash[0]);
514 
515  n_left -= vec_sz;
516 
517  fa_5tuple += vec_sz;
518  b += vec_sz;
519  sw_if_index += vec_sz;
520  hash += vec_sz;
521  }
522 
523  while (n_left > 0)
524  {
525  const int vec_sz = 1;
526 
527  get_sw_if_index_xN (vec_sz, is_input, b, sw_if_index);
528  fill_5tuple_xN (vec_sz, am, is_ip6, is_input, is_l2_path, &b[0],
529  &sw_if_index[0], &fa_5tuple[0]);
530  if (with_stateful_datapath)
531  make_session_hash_xN (vec_sz, am, is_ip6, &sw_if_index[0],
532  &fa_5tuple[0], &hash[0]);
533 
534  n_left -= vec_sz;
535 
536  fa_5tuple += vec_sz;
537  b += vec_sz;
538  sw_if_index += vec_sz;
539  hash += vec_sz;
540  }
541 }
542 
543 
546  vlib_node_runtime_t * node, vlib_frame_t * frame,
547  int is_ip6, int is_input, int is_l2_path,
548  int with_stateful_datapath, int node_trace_on,
549  int reclassify_sessions)
550 {
551  u32 n_left, *from;
552  u32 pkts_exist_session = 0;
553  u32 pkts_new_session = 0;
554  u32 pkts_acl_permit = 0;
555  u32 trace_bitmap = 0;
556  acl_main_t *am = &acl_main;
557  vlib_node_runtime_t *error_node;
558  vlib_error_t no_error_existing_session;
559  u64 now = clib_cpu_time_now ();
560  uword thread_index = os_get_thread_index ();
561  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
562 
563  u16 *next;
564  vlib_buffer_t **b;
565  u32 *sw_if_index;
566  fa_5tuple_t *fa_5tuple;
567  u64 *hash;
568  /* for the delayed counters */
569  u32 saved_matched_acl_index = 0;
570  u32 saved_matched_ace_index = 0;
571  u32 saved_packet_count = 0;
572  u32 saved_byte_count = 0;
573 
574  from = vlib_frame_vector_args (frame);
575  error_node = vlib_node_get_runtime (vm, node->node_index);
576  no_error_existing_session =
577  error_node->errors[ACL_FA_ERROR_ACL_EXIST_SESSION];
578 
579  b = pw->bufs;
580  next = pw->nexts;
581  sw_if_index = pw->sw_if_indices;
582  fa_5tuple = pw->fa_5tuples;
583  hash = pw->hashes;
584 
585  /*
586  * Now the "hard" work of session lookups and ACL lookups for new sessions.
587  * Due to the complexity, do it for the time being in single loop with
588  * the pipeline of three prefetches:
589  * 1) bucket for the session bihash
590  * 2) data for the session bihash
591  * 3) worker session record
592  */
593 
594  fa_full_session_id_t f_sess_id_next = {.as_u64 = ~0ULL };
595 
596  /* find the "next" session so we can kickstart the pipeline */
597  if (with_stateful_datapath)
598  acl_fa_find_session_with_hash (am, is_ip6, sw_if_index[0], hash[0],
599  &fa_5tuple[0], &f_sess_id_next.as_u64);
600 
601  n_left = frame->n_vectors;
602  while (n_left > 0)
603  {
604  u8 action = 0;
605  u32 lc_index0 = ~0;
606  int acl_check_needed = 1;
607  u32 match_acl_in_index = ~0;
608  u32 match_acl_pos = ~0;
609  u32 match_rule_index = ~0;
610 
611  next[0] = 0; /* drop by default */
612 
613  /* Try to match an existing session first */
614 
615  if (with_stateful_datapath)
616  {
617  fa_full_session_id_t f_sess_id = f_sess_id_next;
618  switch (n_left)
619  {
620  default:
621  acl_fa_prefetch_session_bucket_for_hash (am, is_ip6, hash[5]);
622  /* fallthrough */
623  case 5:
624  case 4:
625  acl_fa_prefetch_session_data_for_hash (am, is_ip6, hash[3]);
626  /* fallthrough */
627  case 3:
628  case 2:
629  acl_fa_find_session_with_hash (am, is_ip6, sw_if_index[1],
630  hash[1], &fa_5tuple[1],
631  &f_sess_id_next.as_u64);
632  if (f_sess_id_next.as_u64 != ~0ULL)
633  {
634  prefetch_session_entry (am, f_sess_id_next);
635  }
636  /* fallthrough */
637  case 1:
638  if (f_sess_id.as_u64 != ~0ULL)
639  {
640  if (node_trace_on)
641  {
642  trace_bitmap |= 0x80000000;
643  }
644  ASSERT (f_sess_id.thread_index < vec_len (vlib_mains));
645  b[0]->error = no_error_existing_session;
646  acl_check_needed = 0;
647  pkts_exist_session += 1;
648  action =
650  is_input, now, f_sess_id,
651  &sw_if_index[0],
652  &fa_5tuple[0],
653  b[0]->current_length,
654  node_trace_on,
655  &trace_bitmap);
656 
657  /* expose the session id to the tracer */
658  if (node_trace_on)
659  {
660  match_rule_index = f_sess_id.session_index;
661  }
662 
663  if (reclassify_sessions)
664  {
665  if (PREDICT_FALSE
667  (am, is_input, pw, now, sw_if_index[0],
668  f_sess_id)))
669  {
670  acl_check_needed = 1;
671  if (node_trace_on)
672  {
673  trace_bitmap |= 0x40000000;
674  }
675  /*
676  * If we have just deleted the session, and the next
677  * buffer is the same 5-tuple, that session prediction
678  * is wrong, correct it.
679  */
680  if ((f_sess_id_next.as_u64 != ~0ULL)
681  && 0 == memcmp (&fa_5tuple[1], &fa_5tuple[0],
682  sizeof (fa_5tuple[1])))
683  f_sess_id_next.as_u64 = ~0ULL;
684  }
685  }
686  }
687  }
688 
689  if (acl_check_needed)
690  {
691  if (is_input)
692  lc_index0 = am->input_lc_index_by_sw_if_index[sw_if_index[0]];
693  else
694  lc_index0 =
695  am->output_lc_index_by_sw_if_index[sw_if_index[0]];
696 
697  action = 0; /* deny by default */
698  int is_match = acl_plugin_match_5tuple_inline (am, lc_index0,
699  (fa_5tuple_opaque_t *) & fa_5tuple[0], is_ip6,
700  &action,
701  &match_acl_pos,
702  &match_acl_in_index,
703  &match_rule_index,
704  &trace_bitmap);
705  if (PREDICT_FALSE
706  (is_match && am->interface_acl_counters_enabled))
707  {
708  u32 buf_len = vlib_buffer_length_in_chain (vm, b[0]);
710  saved_matched_acl_index,
711  thread_index,
712  saved_matched_ace_index,
713  saved_packet_count,
714  saved_byte_count);
715  saved_matched_acl_index = match_acl_in_index;
716  saved_matched_ace_index = match_rule_index;
717  saved_packet_count = 1;
718  saved_byte_count = buf_len;
719  /* prefetch the counter that we are going to increment */
721  saved_matched_acl_index,
722  thread_index,
723  saved_matched_ace_index);
724  }
725 
726  b[0]->error = error_node->errors[action];
727 
728  if (1 == action)
729  pkts_acl_permit++;
730 
731  if (2 == action)
732  {
733  if (!acl_fa_can_add_session (am, is_input, sw_if_index[0]))
734  acl_fa_try_recycle_session (am, is_input,
735  thread_index,
736  sw_if_index[0], now);
737 
738  if (acl_fa_can_add_session (am, is_input, sw_if_index[0]))
739  {
740  u16 current_policy_epoch =
741  get_current_policy_epoch (am, is_input,
742  sw_if_index[0]);
743  fa_full_session_id_t f_sess_id =
744  acl_fa_add_session (am, is_input, is_ip6,
745  sw_if_index[0],
746  now, &fa_5tuple[0],
747  current_policy_epoch);
748 
749  /* perform the accounting for the newly added session */
751  node->node_index,
752  is_input, now,
753  f_sess_id,
754  &sw_if_index[0],
755  &fa_5tuple[0],
756  b[0]->current_length,
757  node_trace_on,
758  &trace_bitmap);
759  pkts_new_session++;
760  /*
761  * If the next 5tuple is the same and we just added the session,
762  * the f_sess_id_next can not be ~0. Correct it.
763  */
764  if ((f_sess_id_next.as_u64 == ~0ULL)
765  && 0 == memcmp (&fa_5tuple[1], &fa_5tuple[0],
766  sizeof (fa_5tuple[1])))
767  f_sess_id_next = f_sess_id;
768  }
769  else
770  {
771  action = 0;
772  b[0]->error =
773  error_node->errors
774  [ACL_FA_ERROR_ACL_TOO_MANY_SESSIONS];
775  }
776  }
777 
778  }
779 
780  {
781  u32 next0;
782  /* speculatively get the next0 */
783  vnet_feature_next (&next0, b[0]);
784  /* if the action is not deny - then use that next */
785  next[0] = action ? next0 : 0;
786  }
787 
788  if (node_trace_on) // PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
789  {
790  maybe_trace_buffer (vm, node, b[0], sw_if_index[0], lc_index0,
791  next[0], match_acl_in_index,
792  match_rule_index, &fa_5tuple[0], action,
793  trace_bitmap);
794  }
795 
796  next++;
797  b++;
798  fa_5tuple++;
799  sw_if_index++;
800  hash++;
801  n_left -= 1;
802  }
803  }
804 
805  vlib_buffer_enqueue_to_next (vm, node, from, pw->nexts, frame->n_vectors);
806 
807  /*
808  * if we were had an acl match then we have a counter to increment.
809  * else it is all zeroes, so this will be harmless.
810  */
812  saved_matched_acl_index,
813  thread_index,
814  saved_matched_ace_index,
815  saved_packet_count, saved_byte_count);
816 
818  ACL_FA_ERROR_ACL_CHECK, frame->n_vectors);
820  ACL_FA_ERROR_ACL_EXIST_SESSION,
821  pkts_exist_session);
823  ACL_FA_ERROR_ACL_NEW_SESSION,
824  pkts_new_session);
826  ACL_FA_ERROR_ACL_PERMIT, pkts_acl_permit);
827  return frame->n_vectors;
828 }
829 
832  vlib_node_runtime_t * node, vlib_frame_t * frame,
833  int is_ip6, int is_input, int is_l2_path,
834  int do_stateful_datapath)
835 {
836  acl_main_t *am = &acl_main;
837 
838  acl_fa_node_common_prepare_fn (vm, node, frame, is_ip6, is_input,
839  is_l2_path, do_stateful_datapath);
840 
841  if (am->reclassify_sessions)
842  {
844  return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
845  is_l2_path, do_stateful_datapath,
846  1 /* trace */ ,
847  1 /* reclassify */ );
848  else
849  return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
850  is_l2_path, do_stateful_datapath, 0,
851  1 /* reclassify */ );
852  }
853  else
854  {
856  return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
857  is_l2_path, do_stateful_datapath,
858  1 /* trace */ ,
859  0);
860  else
861  return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
862  is_l2_path, do_stateful_datapath, 0, 0);
863  }
864 }
865 
868  vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip6,
869  int is_input, int is_l2_path)
870 {
871  /* select the reclassify/no-reclassify version of the datapath */
872  acl_main_t *am = &acl_main;
873 
875  return acl_fa_outer_node_fn (vm, node, frame, is_ip6, is_input,
876  is_l2_path, 1);
877  else
878  return acl_fa_outer_node_fn (vm, node, frame, is_ip6, is_input,
879  is_l2_path, 0);
880 }
881 
882 
883 static u8 *
884 format_fa_5tuple (u8 * s, va_list * args)
885 {
886  fa_5tuple_t *p5t = va_arg (*args, fa_5tuple_t *);
887  void *paddr0;
888  void *paddr1;
889  void *format_address_func;
890  void *ip_af;
891  void *ip_frag_txt =
892  p5t->pkt.is_nonfirst_fragment ? " non-initial fragment" : "";
893 
894  if (p5t->pkt.is_ip6)
895  {
896  ip_af = "ip6";
897  format_address_func = format_ip6_address;
898  paddr0 = &p5t->ip6_addr[0];
899  paddr1 = &p5t->ip6_addr[1];
900  }
901  else
902  {
903  ip_af = "ip4";
904  format_address_func = format_ip4_address;
905  paddr0 = &p5t->ip4_addr[0];
906  paddr1 = &p5t->ip4_addr[1];
907  }
908 
909  s =
910  format (s, "lc_index %d l3 %s%s ", p5t->pkt.lc_index, ip_af, ip_frag_txt);
911  s =
912  format (s, "%U -> %U ", format_address_func, paddr0, format_address_func,
913  paddr1);
914  s = format (s, "%U ", format_fa_session_l4_key, &p5t->l4);
915  s = format (s, "tcp flags (%s) %02x rsvd %x",
916  p5t->pkt.tcp_flags_valid ? "valid" : "invalid",
917  p5t->pkt.tcp_flags, p5t->pkt.flags_reserved);
918  return s;
919 }
920 
921 #ifndef CLIB_MARCH_VARIANT
922 u8 *
923 format_acl_plugin_5tuple (u8 * s, va_list * args)
924 {
925  return format_fa_5tuple (s, args);
926 }
927 #endif
928 
929 /* packet trace format function */
930 static u8 *
931 format_acl_plugin_trace (u8 * s, va_list * args)
932 {
933  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
934  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
935  acl_fa_trace_t *t = va_arg (*args, acl_fa_trace_t *);
936 
937  s =
938  format (s,
939  "acl-plugin: lc_index: %d, sw_if_index %d, next index %d, action: %d, match: acl %d rule %d trace_bits %08x\n"
940  " pkt info %016llx %016llx %016llx %016llx %016llx %016llx",
941  t->lc_index, t->sw_if_index, t->next_index, t->action,
943  t->packet_info[0], t->packet_info[1], t->packet_info[2],
944  t->packet_info[3], t->packet_info[4], t->packet_info[5]);
945 
946  /* Now also print out the packet_info in a form usable by humans */
947  s = format (s, "\n %U", format_fa_5tuple, t->packet_info);
948  return s;
949 }
950 
951 /* *INDENT-OFF* */
952 
953 static char *acl_fa_error_strings[] = {
954 #define _(sym,string) string,
956 #undef _
957 };
958 
960  vlib_node_runtime_t * node,
961  vlib_frame_t * frame)
962 {
963  return acl_fa_node_fn (vm, node, frame, 1, 1, 1);
964 }
965 
967  vlib_node_runtime_t * node,
968  vlib_frame_t * frame)
969 {
970  return acl_fa_node_fn (vm, node, frame, 0, 1, 1);
971 }
972 
974  vlib_node_runtime_t * node,
975  vlib_frame_t * frame)
976 {
977  return acl_fa_node_fn (vm, node, frame, 1, 0, 1);
978 }
979 
981  vlib_node_runtime_t * node,
982  vlib_frame_t * frame)
983 {
984  return acl_fa_node_fn (vm, node, frame, 0, 0, 1);
985 }
986 
987 /**** L3 processing path nodes ****/
988 
990  vlib_node_runtime_t * node,
991  vlib_frame_t * frame)
992 {
993  return acl_fa_node_fn (vm, node, frame, 1, 1, 0);
994 }
995 
997  vlib_node_runtime_t * node,
998  vlib_frame_t * frame)
999 {
1000  return acl_fa_node_fn (vm, node, frame, 0, 1, 0);
1001 }
1002 
1004  vlib_node_runtime_t * node,
1005  vlib_frame_t * frame)
1006 {
1007  return acl_fa_node_fn (vm, node, frame, 1, 0, 0);
1008 }
1009 
1011  vlib_node_runtime_t * node,
1012  vlib_frame_t * frame)
1013 {
1014  return acl_fa_node_fn (vm, node, frame, 0, 0, 0);
1015 }
1016 
1018 {
1019  .name = "acl-plugin-in-ip6-l2",
1020  .vector_size = sizeof (u32),
1021  .format_trace = format_acl_plugin_trace,
1023  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1024  .error_strings = acl_fa_error_strings,
1025  .n_next_nodes = ACL_FA_N_NEXT,
1026  .next_nodes =
1027  {
1028  [ACL_FA_ERROR_DROP] = "error-drop",
1029  }
1030 };
1031 
1032 VNET_FEATURE_INIT (acl_in_l2_ip6_fa_feature, static) =
1033 {
1034  .arc_name = "l2-input-ip6",
1035  .node_name = "acl-plugin-in-ip6-l2",
1036  .runs_before = VNET_FEATURES ("l2-input-feat-arc-end"),
1037 };
1038 
1040 {
1041  .name = "acl-plugin-in-ip4-l2",
1042  .vector_size = sizeof (u32),
1043  .format_trace = format_acl_plugin_trace,
1045  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1046  .error_strings = acl_fa_error_strings,
1047  .n_next_nodes = ACL_FA_N_NEXT,
1048  .next_nodes =
1049  {
1050  [ACL_FA_ERROR_DROP] = "error-drop",
1051  }
1052 };
1053 
1054 VNET_FEATURE_INIT (acl_in_l2_ip4_fa_feature, static) =
1055 {
1056  .arc_name = "l2-input-ip4",
1057  .node_name = "acl-plugin-in-ip4-l2",
1058  .runs_before = VNET_FEATURES ("l2-input-feat-arc-end"),
1059 };
1060 
1061 
1063 {
1064  .name = "acl-plugin-out-ip6-l2",
1065  .vector_size = sizeof (u32),
1066  .format_trace = format_acl_plugin_trace,
1068  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1069  .error_strings = acl_fa_error_strings,
1070  .n_next_nodes = ACL_FA_N_NEXT,
1071  .next_nodes =
1072  {
1073  [ACL_FA_ERROR_DROP] = "error-drop",
1074  }
1075 };
1076 
1077 VNET_FEATURE_INIT (acl_out_l2_ip6_fa_feature, static) =
1078 {
1079  .arc_name = "l2-output-ip6",
1080  .node_name = "acl-plugin-out-ip6-l2",
1081  .runs_before = VNET_FEATURES ("l2-output-feat-arc-end"),
1082 };
1083 
1084 
1086 {
1087  .name = "acl-plugin-out-ip4-l2",
1088  .vector_size = sizeof (u32),
1089  .format_trace = format_acl_plugin_trace,
1091  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1092  .error_strings = acl_fa_error_strings,
1093  .n_next_nodes = ACL_FA_N_NEXT,
1094  .next_nodes =
1095  {
1096  [ACL_FA_ERROR_DROP] = "error-drop",
1097  }
1098 };
1099 
1100 VNET_FEATURE_INIT (acl_out_l2_ip4_fa_feature, static) =
1101 {
1102  .arc_name = "l2-output-ip4",
1103  .node_name = "acl-plugin-out-ip4-l2",
1104  .runs_before = VNET_FEATURES ("l2-output-feat-arc-end"),
1105 };
1106 
1107 
1109 {
1110  .name = "acl-plugin-in-ip6-fa",
1111  .vector_size = sizeof (u32),
1112  .format_trace = format_acl_plugin_trace,
1114  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1115  .error_strings = acl_fa_error_strings,
1116  .n_next_nodes = ACL_FA_N_NEXT,
1117  .next_nodes =
1118  {
1119  [ACL_FA_ERROR_DROP] = "error-drop",
1120  }
1121 };
1122 
1123 VNET_FEATURE_INIT (acl_in_ip6_fa_feature, static) =
1124 {
1125  .arc_name = "ip6-unicast",
1126  .node_name = "acl-plugin-in-ip6-fa",
1127  .runs_before = VNET_FEATURES ("ip6-flow-classify"),
1128 };
1129 
1131 {
1132  .name = "acl-plugin-in-ip4-fa",
1133  .vector_size = sizeof (u32),
1134  .format_trace = format_acl_plugin_trace,
1136  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1137  .error_strings = acl_fa_error_strings,
1138  .n_next_nodes = ACL_FA_N_NEXT,
1139  .next_nodes =
1140  {
1141  [ACL_FA_ERROR_DROP] = "error-drop",
1142  }
1143 };
1144 
1145 VNET_FEATURE_INIT (acl_in_ip4_fa_feature, static) =
1146 {
1147  .arc_name = "ip4-unicast",
1148  .node_name = "acl-plugin-in-ip4-fa",
1149  .runs_before = VNET_FEATURES ("ip4-flow-classify"),
1150 };
1151 
1152 
1154 {
1155  .name = "acl-plugin-out-ip6-fa",
1156  .vector_size = sizeof (u32),
1157  .format_trace = format_acl_plugin_trace,
1159  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1160  .error_strings = acl_fa_error_strings,
1161  .n_next_nodes = ACL_FA_N_NEXT,
1162  .next_nodes =
1163  {
1164  [ACL_FA_ERROR_DROP] = "error-drop",
1165  }
1166 };
1167 
1168 VNET_FEATURE_INIT (acl_out_ip6_fa_feature, static) =
1169 {
1170  .arc_name = "ip6-output",
1171  .node_name = "acl-plugin-out-ip6-fa",
1172  .runs_before = VNET_FEATURES ("interface-output"),
1173 };
1174 
1176 {
1177  .name = "acl-plugin-out-ip4-fa",
1178  .vector_size = sizeof (u32),
1179  .format_trace = format_acl_plugin_trace,
1181  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1182  .error_strings = acl_fa_error_strings,
1183  .n_next_nodes = ACL_FA_N_NEXT,
1184  /* edit / add dispositions here */
1185  .next_nodes =
1186  {
1187  [ACL_FA_ERROR_DROP] = "error-drop",
1188  }
1189 };
1190 
1191 VNET_FEATURE_INIT (acl_out_ip4_fa_feature, static) =
1192 {
1193  .arc_name = "ip4-output",
1194  .node_name = "acl-plugin-out-ip4-fa",
1195  .runs_before = VNET_FEATURES ("interface-output"),
1196 };
1197 
1198 /* *INDENT-ON* */
1199 
1200 /*
1201  * fd.io coding-style-patch-verification: ON
1202  *
1203  * Local Variables:
1204  * eval: (c-set-style "gnu")
1205  * End:
1206  */
vlib_node_registration_t acl_in_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip4_node)
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
Definition: vec.h:439
u32 * input_policy_epoch_by_sw_if_index
Definition: acl.h:184
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
static void acl_fill_5tuple(acl_main_t *am, u32 sw_if_index0, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_t *p5tuple_pkt)
#define CLIB_UNUSED(x)
Definition: clib.h:83
vlib_combined_counter_main_t * combined_acl_counters
Definition: acl.h:320
static void maybe_trace_buffer(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_buffer_t *b, u32 sw_if_index0, u32 lc_index0, u16 next0, int match_acl_in_index, int match_rule_index, fa_5tuple_t *fa_5tuple, u8 action, u32 trace_bitmap)
static int acl_fa_conn_list_delete_session(acl_main_t *am, fa_full_session_id_t sess_id, u64 now)
vlib_node_registration_t acl_out_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip4_node)
fa_session_l4_key_t l4
Definition: fa_node.h:81
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
Definition: counter.h:220
static char * fa_in_nonip_error_strings[]
fa_packet_info_t pkt
Definition: fa_node.h:83
vlib_node_registration_t acl_in_nonip_node
(constructor) VLIB_REGISTER_NODE (acl_in_nonip_node)
vlib_node_registration_t acl_out_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip6_node)
acl_fa_error_t
vlib_node_registration_t acl_in_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip4_node)
unsigned long u64
Definition: types.h:89
static void make_session_hash_xN(int vector_sz, acl_main_t *am, int is_ip6, u32 *sw_if_index, fa_5tuple_t *fa_5tuple, u64 *out_hash)
u16 current_length
Nbytes between current data and the end of this buffer.
Definition: buffer.h:113
static u64 clib_cpu_time_now(void)
Definition: time.h:81
l2_in_feat_arc_error_t
u16 vlib_error_t
Definition: error.h:43
static int acl_fa_two_stage_delete_session(acl_main_t *am, u32 sw_if_index, fa_full_session_id_t sess_id, u64 now)
int i
u32 * output_policy_epoch_by_sw_if_index
Definition: acl.h:185
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
u8 data[128]
Definition: ipsec.api:251
#define VLIB_NODE_FN(node)
Definition: node.h:202
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:470
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
Definition: buffer_funcs.h:366
u32 sw_if_indices[VLIB_FRAME_SIZE]
Definition: fa_node.h:230
vlib_main_t ** vlib_mains
Definition: buffer.c:332
static void acl_fa_node_common_prepare_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_input, int is_l2_path, int with_stateful_datapath)
unsigned char u8
Definition: types.h:56
vlib_node_registration_t acl_in_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip6_node)
format_function_t format_ip4_address
Definition: format.h:75
vlib_node_registration_t acl_out_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip6_node)
vl_api_interface_index_t sw_if_index
Definition: gre.api:50
#define always_inline
Definition: clib.h:99
#define foreach_nonip_in_error
fa_5tuple_t fa_5tuples[VLIB_FRAME_SIZE]
Definition: fa_node.h:231
l2_out_feat_arc_error_t
static void get_sw_if_index_xN(int vector_sz, int is_input, vlib_buffer_t **b, u32 *out_sw_if_index)
unsigned int u32
Definition: types.h:88
static char * acl_fa_error_strings[]
#define VLIB_FRAME_SIZE
Definition: node.h:378
static u8 acl_fa_track_session(acl_main_t *am, int is_input, u32 sw_if_index, u64 now, fa_session_t *sess, fa_5tuple_t *pkt_5tuple, u32 pkt_len)
vl_api_fib_path_type_t type
Definition: fib_types.api:123
static u64 acl_fa_make_session_hash(acl_main_t *am, int is_ip6, u32 sw_if_index0, fa_5tuple_t *p5tuple)
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
#define ACL_PLUGIN_VECTOR_SIZE
static uword acl_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_input, int is_l2_path)
static void acl_fa_try_recycle_session(acl_main_t *am, int is_input, u16 thread_index, u32 sw_if_index, u64 now)
unsigned short u16
Definition: types.h:57
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
u64 * fa_session_epoch_change_by_sw_if_index
Definition: fa_node.h:186
u32 * output_lc_index_by_sw_if_index
Definition: acl.h:162
#define PREDICT_FALSE(x)
Definition: clib.h:112
static int acl_fa_find_session_with_hash(acl_main_t *am, int is_ip6, u32 sw_if_index0, u64 hash, fa_5tuple_t *p5tuple, u64 *pvalue_sess)
static void vlib_prefetch_combined_counter(const vlib_combined_counter_main_t *cm, u32 thread_index, u32 index)
Pre-fetch a per-thread combined counter for the given object index.
Definition: counter.h:235
#define get_u16(addr)
static u16 get_current_policy_epoch(acl_main_t *am, int is_input, u32 sw_if_index0)
u32 node_index
Node index.
Definition: node.h:496
u64 hashes[VLIB_FRAME_SIZE]
Definition: fa_node.h:232
u32 interface_acl_counters_enabled
Definition: acl.h:322
#define foreach_nonip_out_error
static uword acl_fa_inner_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_input, int is_l2_path, int with_stateful_datapath, int node_trace_on, int reclassify_sessions)
#define FA_POLICY_EPOCH_IS_INPUT
Definition: fa_node.h:126
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
#define foreach_acl_fa_error
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
u16 n_vectors
Definition: node.h:397
format_function_t format_ip6_address
Definition: format.h:93
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:80
vlib_main_t * vm
Definition: buffer.c:323
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
Definition: buffer_node.h:332
static_always_inline void vnet_feature_next(u32 *next0, vlib_buffer_t *b0)
Definition: feature.h:302
static u8 * format_nonip_in_out_trace(u8 *s, u32 is_output, va_list *args)
clib_bihash_kv_40_8_t kv_40_8
Definition: fa_node.h:85
static fa_full_session_id_t acl_fa_add_session(acl_main_t *am, int is_input, int is_ip6, u32 sw_if_index, u64 now, fa_5tuple_t *p5tuple, u16 current_policy_epoch)
#define clib_warning(format, args...)
Definition: error.h:59
static vlib_node_runtime_t * vlib_node_get_runtime(vlib_main_t *vm, u32 node_index)
Get node runtime by node index.
Definition: node_funcs.h:89
u32 sw_if_index
Definition: fa_node.h:108
#define ARRAY_LEN(x)
Definition: clib.h:63
VNET_FEATURE_INIT(acl_in_l2_nonip_fa_feature, static)
static int acl_fa_restart_timer_for_session(acl_main_t *am, u64 now, fa_full_session_id_t sess_id)
static_always_inline u8 * format_fa_session_l4_key(u8 *s, va_list *args)
Definition: fa_node.h:93
u16 nexts[VLIB_FRAME_SIZE]
Definition: fa_node.h:233
static int fa_session_get_timeout_type(acl_main_t *am, fa_session_t *sess)
#define ASSERT(truth)
u8 tcp_flags_valid
Definition: fa_node.h:33
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
static int stale_session_deleted(acl_main_t *am, int is_input, acl_fa_per_worker_data_t *pw, u64 now, u32 sw_if_index0, fa_full_session_id_t f_sess_id)
static uword nonip_in_out_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_output)
static uword acl_fa_outer_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_input, int is_l2_path, int do_stateful_datapath)
acl_main_t acl_main
Definition: acl.c:57
static void acl_fa_prefetch_session_bucket_for_hash(acl_main_t *am, int is_ip6, u64 hash)
static int acl_fa_can_add_session(acl_main_t *am, int is_input, u32 sw_if_index)
#define VNET_FEATURES(...)
Definition: feature.h:442
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
#define vec_elt(v, i)
Get vector value at index i.
static void prefetch_session_entry(acl_main_t *am, fa_full_session_id_t f_sess_id)
vlib_node_registration_t acl_out_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip4_node)
static u8 * format_l2_nonip_in_trace(u8 *s, va_list *args)
u8 is_nonfirst_fragment
Definition: fa_node.h:35
Definition: defs.h:47
static fa_session_t * get_session_ptr_no_check(acl_main_t *am, u16 thread_index, u32 session_index)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
static void fill_5tuple_xN(int vector_sz, acl_main_t *am, int is_ip6, int is_input, int is_l2_path, vlib_buffer_t **b, u32 *sw_if_index, fa_5tuple_t *out_fa_5tuple)
vlib_node_registration_t acl_out_nonip_node
(constructor) VLIB_REGISTER_NODE (acl_out_nonip_node)
VLIB buffer representation.
Definition: buffer.h:102
acl_fa_per_worker_data_t * per_worker_data
Definition: acl.h:292
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
static char * fa_out_nonip_error_strings[]
u16 ** output_etype_whitelist_by_sw_if_index
Definition: acl.h:229
static_always_inline uword os_get_thread_index(void)
Definition: os.h:62
static u8 process_established_session(vlib_main_t *vm, acl_main_t *am, u32 counter_node_index, int is_input, u64 now, fa_full_session_id_t f_sess_id, u32 *sw_if_index, fa_5tuple_t *fa_5tuple, u32 pkt_len, int node_trace_on, u32 *trace_bitmap)
#define ACL_PLUGIN_PREFETCH_GAP
static u8 * format_l2_nonip_out_trace(u8 *s, va_list *args)
#define vnet_buffer(b)
Definition: buffer.h:365
static u8 * format_fa_5tuple(u8 *s, va_list *args)
u16 ** input_etype_whitelist_by_sw_if_index
Definition: acl.h:228
u16 flags
Copy of main node flags.
Definition: node.h:509
ip4_address_t ip4_addr[2]
Definition: fa_node.h:77
int reclassify_sessions
Definition: acl.h:188
u8 * format_acl_plugin_5tuple(u8 *s, va_list *args)
u32 * input_lc_index_by_sw_if_index
Definition: acl.h:161
vlib_buffer_t * bufs[VLIB_FRAME_SIZE]
Definition: fa_node.h:229
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
Definition: buffer_funcs.h:244
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:302
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
static int is_permitted_ethertype(acl_main_t *am, int sw_if_index0, int is_output, u16 ethertype)
static u8 * format_acl_plugin_trace(u8 *s, va_list *args)
static void acl_fa_prefetch_session_data_for_hash(acl_main_t *am, int is_ip6, u64 hash)
int fa_sessions_hash_is_initialized
Definition: acl.h:241
Definition: defs.h:46
vlib_node_registration_t acl_in_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip6_node)
ip6_address_t ip6_addr[2]
Definition: fa_node.h:79