FD.io VPP  v21.06-3-gbb25fbf28
Vector Packet Processing
dataplane_node_nonip.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include <stddef.h>
16 #include <netinet/in.h>
17 
18 #include <vlib/vlib.h>
19 #include <vnet/vnet.h>
20 #include <vnet/pg/pg.h>
21 #include <vppinfra/error.h>
22 
23 
24 #include <acl/acl.h>
25 #include <vnet/ip/icmp46_packet.h>
26 
27 #include <plugins/acl/fa_node.h>
28 #include <plugins/acl/acl.h>
32 
33 #include <vppinfra/bihash_40_8.h>
35 
36 typedef struct
37 {
40  u32 lc_index;
41  u32 match_acl_in_index;
42  u32 match_rule_index;
43  u64 packet_info[6];
44  u32 trace_bitmap;
45  u8 action;
47 
48 /* *INDENT-OFF* */
49 #define foreach_acl_fa_error \
50 _(ACL_DROP, "ACL deny packets") \
51 _(ACL_PERMIT, "ACL permit packets") \
52 _(ACL_NEW_SESSION, "new sessions added") \
53 _(ACL_EXIST_SESSION, "existing session packets") \
54 _(ACL_CHECK, "checked packets") \
55 _(ACL_RESTART_SESSION_TIMER, "restart session timer") \
56 _(ACL_TOO_MANY_SESSIONS, "too many sessions to add new") \
57 /* end of errors */
58 
59 typedef enum
60 {
61 #define _(sym,str) ACL_FA_ERROR_##sym,
63 #undef _
66 
67 /* *INDENT-ON* */
68 
69 typedef struct
70 {
75 
76 /* packet trace format function */
77 static u8 *
78 format_nonip_in_out_trace (u8 * s, u32 is_output, va_list * args)
79 {
80  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
81  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
82  nonip_in_out_trace_t *t = va_arg (*args, nonip_in_out_trace_t *);
83 
84  s = format (s, "%s: sw_if_index %d next_index %x ethertype %x",
85  is_output ? "OUT-ETHER-WHITELIST" : "IN-ETHER-WHITELIST",
86  t->sw_if_index, t->next_index, t->ethertype);
87  return s;
88 }
89 
90 static u8 *
91 format_l2_nonip_in_trace (u8 * s, va_list * args)
92 {
93  return format_nonip_in_out_trace (s, 0, args);
94 }
95 
96 static u8 *
97 format_l2_nonip_out_trace (u8 * s, va_list * args)
98 {
99  return format_nonip_in_out_trace (s, 1, args);
100 }
101 
102 #define foreach_nonip_in_error \
103 _(DROP, "dropped inbound non-whitelisted non-ip packets") \
104 _(PERMIT, "permitted inbound whitelisted non-ip packets") \
105 
106 
107 #define foreach_nonip_out_error \
108 _(DROP, "dropped outbound non-whitelisted non-ip packets") \
109 _(PERMIT, "permitted outbound whitelisted non-ip packets") \
110 
111 
112 /* *INDENT-OFF* */
113 
114 typedef enum
115 {
116 #define _(sym,str) FA_IN_NONIP_ERROR_##sym,
118 #undef _
121 
122 static char *fa_in_nonip_error_strings[] = {
123 #define _(sym,string) string,
125 #undef _
126 };
127 
128 typedef enum
129 {
130 #define _(sym,str) FA_OUT_NONIP_ERROR_##sym,
132 #undef _
135 
136 static char *fa_out_nonip_error_strings[] = {
137 #define _(sym,string) string,
139 #undef _
140 };
141 /* *INDENT-ON* */
142 
143 
144 always_inline int
145 is_permitted_ethertype (acl_main_t * am, int sw_if_index0, int is_output,
146  u16 ethertype)
147 {
148  u16 **v = is_output
149  ? am->output_etype_whitelist_by_sw_if_index
150  : am->input_etype_whitelist_by_sw_if_index;
151  u16 *whitelist = vec_elt (v, sw_if_index0);
152  int i;
153 
154  if (vec_len (whitelist) == 0)
155  return 1;
156 
157  for (i = 0; i < vec_len (whitelist); i++)
158  if (whitelist[i] == ethertype)
159  return 1;
160  return 0;
161 }
162 
163 #define get_u16(addr) ( *((u16 *)(addr)) )
164 
168  int is_output)
169 {
170  acl_main_t *am = &acl_main;
171  u32 n_left, *from;
174  vlib_node_runtime_t *error_node;
175 
177  error_node = vlib_node_get_runtime (vm, node->node_index);
178  vlib_get_buffers (vm, from, bufs, frame->n_vectors);
179  /* set the initial values for the current buffer the next pointers */
180  b = bufs;
181  next = nexts;
182 
183  n_left = frame->n_vectors;
184  while (n_left > 0)
185  {
186  u32 next_index = 0;
187  u32 sw_if_index0 =
188  vnet_buffer (b[0])->sw_if_index[is_output ? VLIB_TX : VLIB_RX];
189  u16 ethertype = 0;
190 
191  int error0 = 0;
192 
194  u8 *l3h0 = (u8 *) h0 + vnet_buffer (b[0])->l2.l2_len;
195  ethertype = clib_net_to_host_u16 (get_u16 (l3h0 - 2));
196 
197  if (is_permitted_ethertype (am, sw_if_index0, is_output, ethertype))
199 
200  next[0] = next_index;
201 
202  if (0 == next[0])
203  b[0]->error = error_node->errors[error0];
204 
205  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
206  && (b[0]->flags & VLIB_BUFFER_IS_TRACED)))
207  {
209  vlib_add_trace (vm, node, b[0], sizeof (*t));
210  t->sw_if_index = sw_if_index0;
211  t->ethertype = ethertype;
212  t->next_index = next[0];
213  }
214  next[0] = next[0] < node->n_next_nodes ? next[0] : 0;
215 
216  next++;
217  b++;
218  n_left--;
219  }
221 
222  return frame->n_vectors;
223 }
224 
228 {
229  return nonip_in_out_node_fn (vm, node, frame, 0);
230 }
231 
235 {
236  return nonip_in_out_node_fn (vm, node, frame, 1);
237 }
238 
239 
240 /* *INDENT-OFF* */
241 
243 {
244  .name = "acl-plugin-in-nonip-l2",
245  .vector_size = sizeof (u32),
246  .format_trace = format_l2_nonip_in_trace,
248  .n_errors = ARRAY_LEN (fa_in_nonip_error_strings),
249  .error_strings = fa_in_nonip_error_strings,
250  .n_next_nodes = ACL_FA_N_NEXT,
251  .next_nodes =
252  {
253  [ACL_FA_ERROR_DROP] = "error-drop",
254  }
255 };
256 
257 VNET_FEATURE_INIT (acl_in_l2_nonip_fa_feature, static) =
258 {
259  .arc_name = "l2-input-nonip",
260  .node_name = "acl-plugin-in-nonip-l2",
261  .runs_before = VNET_FEATURES ("l2-input-feat-arc-end"),
262 };
263 
265 {
266  .name = "acl-plugin-out-nonip-l2",
267  .vector_size = sizeof (u32),
268  .format_trace = format_l2_nonip_out_trace,
271  .error_strings = fa_out_nonip_error_strings,
272  .n_next_nodes = ACL_FA_N_NEXT,
273  .next_nodes =
274  {
275  [ACL_FA_ERROR_DROP] = "error-drop",
276  }
277 };
278 
279 VNET_FEATURE_INIT (acl_out_l2_nonip_fa_feature, static) =
280 {
281  .arc_name = "l2-output-nonip",
282  .node_name = "acl-plugin-out-nonip-l2",
283  .runs_before = VNET_FEATURES ("l2-output-feat-arc-end"),
284 };
285 
286 /* *INDENT-ON* */
287 
288 /*
289  * fd.io coding-style-patch-verification: ON
290  *
291  * Local Variables:
292  * eval: (c-set-style "gnu")
293  * End:
294  */
vlib.h
public_inlines.h
bufs
vlib_buffer_t * bufs[VLIB_FRAME_SIZE]
Definition: nat44_ei_out2in.c:717
nonip_in_out_trace_t::sw_if_index
u32 sw_if_index
Definition: dataplane_node_nonip.c:72
l2_out_feat_arc_error_t
l2_out_feat_arc_error_t
Definition: dataplane_node_nonip.c:128
frame
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
Definition: nat44_ei.c:3048
next_index
nat44_ei_hairpin_src_next_t next_index
Definition: nat44_ei_hairpinning.c:412
pg.h
bihash_template.h
acl_fa_trace_t
Definition: dataplane_node.c:35
vlib_get_buffers
vlib_get_buffers(vm, from, b, n_left_from)
next
u16 * next
Definition: nat44_ei_out2in.c:718
VLIB_NODE_TYPE_INTERNAL
@ VLIB_NODE_TYPE_INTERNAL
Definition: node.h:72
VLIB_FRAME_SIZE
#define VLIB_FRAME_SIZE
Definition: node.h:368
node
vlib_main_t vlib_node_runtime_t * node
Definition: nat44_ei.c:3047
u16
unsigned short u16
Definition: types.h:57
am
app_main_t * am
Definition: application.c:489
vm
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
Definition: nat44_ei.c:3047
format_l2_nonip_in_trace
static u8 * format_l2_nonip_in_trace(u8 *s, va_list *args)
Definition: dataplane_node_nonip.c:91
nonip_in_out_trace_t::ethertype
u16 ethertype
Definition: dataplane_node_nonip.c:73
VLIB_RX
@ VLIB_RX
Definition: defs.h:46
foreach_nonip_out_error
#define foreach_nonip_out_error
Definition: dataplane_node_nonip.c:107
vlib_buffer_enqueue_to_next
vlib_buffer_enqueue_to_next(vm, node, from,(u16 *) nexts, frame->n_vectors)
vlib_frame_t
Definition: node.h:372
ACL_FA_N_NEXT
@ ACL_FA_N_NEXT
Definition: fa_node.h:240
nonip_in_out_node_fn
static uword nonip_in_out_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_output)
Definition: dataplane_node_nonip.c:166
acl_main
acl_main_t acl_main
Definition: acl.c:44
vec_elt
#define vec_elt(v, i)
Get vector value at index i.
Definition: vec_bootstrap.h:210
VNET_FEATURE_INIT
VNET_FEATURE_INIT(acl_in_l2_nonip_fa_feature, static)
foreach_nonip_in_error
#define foreach_nonip_in_error
Definition: dataplane_node_nonip.c:102
nonip_in_out_trace_t::next_index
u32 next_index
Definition: dataplane_node_nonip.c:71
session_inlines.h
vlib_node_runtime_t::errors
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:460
vec_len
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
Definition: vec_bootstrap.h:142
vlib_buffer_t::error
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:145
nonip_in_out_trace_t
Definition: dataplane_node_nonip.c:69
error.h
VLIB_NODE_FN
#define VLIB_NODE_FN(node)
Definition: node.h:202
acl.h
CLIB_UNUSED
#define CLIB_UNUSED(x)
Definition: clib.h:90
vnet_buffer
#define vnet_buffer(b)
Definition: buffer.h:437
VLIB_NODE_FLAG_TRACE
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:291
PREDICT_FALSE
#define PREDICT_FALSE(x)
Definition: clib.h:124
vnet_feature_next
static_always_inline void vnet_feature_next(u32 *next0, vlib_buffer_t *b0)
Definition: feature.h:322
ARRAY_LEN
#define ARRAY_LEN(x)
Definition: clib.h:70
acl_in_nonip_node
vlib_node_registration_t acl_in_nonip_node
(constructor) VLIB_REGISTER_NODE (acl_in_nonip_node)
Definition: dataplane_node_nonip.c:242
vlib_frame_vector_args
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:301
uword
u64 uword
Definition: types.h:112
ethernet_header_t
Definition: packet.h:52
i
sll srl srl sll sra u16x4 i
Definition: vector_sse42.h:261
ACL_FA_ERROR_DROP
@ ACL_FA_ERROR_DROP
Definition: fa_node.h:239
vlib_node_registration_t
struct _vlib_node_registration vlib_node_registration_t
fa_out_nonip_error_strings
static char * fa_out_nonip_error_strings[]
Definition: dataplane_node_nonip.c:136
is_permitted_ethertype
static int is_permitted_ethertype(acl_main_t *am, int sw_if_index0, int is_output, u16 ethertype)
Definition: dataplane_node_nonip.c:145
lookup_context.h
always_inline
#define always_inline
Definition: rdma_mlx5dv.h:23
foreach_acl_fa_error
#define foreach_acl_fa_error
Definition: dataplane_node_nonip.c:49
u64
unsigned long u64
Definition: types.h:89
format
description fragment has unexpected format
Definition: map.api:433
u32
unsigned int u32
Definition: types.h:88
bihash_40_8.h
acl_fa_error_t
acl_fa_error_t
Definition: dataplane_node_nonip.c:59
acl_main_t
Definition: acl.h:116
n_left
u32 n_left
Definition: interface_output.c:1078
l2_in_feat_arc_error_t
l2_in_feat_arc_error_t
Definition: dataplane_node_nonip.c:114
vlib_node_get_runtime
static vlib_node_runtime_t * vlib_node_get_runtime(vlib_main_t *vm, u32 node_index)
Get node runtime by node index.
Definition: node_funcs.h:116
vlib_main_t
Definition: main.h:102
vlib_node_t
Definition: node.h:247
vlib_add_trace
void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace.c:628
b
vlib_buffer_t ** b
Definition: nat44_ei_out2in.c:717
VNET_FEATURES
#define VNET_FEATURES(...)
Definition: feature.h:470
u8
unsigned char u8
Definition: types.h:56
fa_node.h
vlib_buffer_get_current
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:257
icmp46_packet.h
FA_IN_NONIP_N_ERROR
@ FA_IN_NONIP_N_ERROR
Definition: dataplane_node_nonip.c:119
format_l2_nonip_out_trace
static u8 * format_l2_nonip_out_trace(u8 *s, va_list *args)
Definition: dataplane_node_nonip.c:97
nexts
u16 nexts[VLIB_FRAME_SIZE]
Definition: nat44_ei_out2in.c:718
fa_in_nonip_error_strings
static char * fa_in_nonip_error_strings[]
Definition: dataplane_node_nonip.c:122
vnet.h
vlib_node_runtime_t
Definition: node.h:454
FA_OUT_NONIP_N_ERROR
@ FA_OUT_NONIP_N_ERROR
Definition: dataplane_node_nonip.c:133
from
from
Definition: nat44_ei_hairpinning.c:415
action
vl_api_mac_event_action_t action
Definition: l2.api:211
sw_if_index
vl_api_interface_index_t sw_if_index
Definition: wireguard.api:34
get_u16
#define get_u16(addr)
Definition: dataplane_node_nonip.c:163
VLIB_TX
@ VLIB_TX
Definition: defs.h:47
type
vl_api_fib_path_type_t type
Definition: fib_types.api:123
ACL_FA_N_ERROR
@ ACL_FA_N_ERROR
Definition: dataplane_node_nonip.c:64
acl_out_nonip_node
vlib_node_registration_t acl_out_nonip_node
(constructor) VLIB_REGISTER_NODE (acl_out_nonip_node)
Definition: dataplane_node_nonip.c:264
format_nonip_in_out_trace
static u8 * format_nonip_in_out_trace(u8 *s, u32 is_output, va_list *args)
Definition: dataplane_node_nonip.c:78
vlib_buffer_t::flags
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index,...
Definition: buffer.h:133
vlib_buffer_t
VLIB buffer representation.
Definition: buffer.h:111
VLIB_REGISTER_NODE
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169