FD.io VPP  v21.06-3-gbb25fbf28
Vector Packet Processing
lookup_context.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <plugins/acl/acl.h>
17 #include <plugins/acl/fa_node.h>
18 #include <vlib/unix/plugin.h>
20 #include "hash_lookup.h"
21 #include "elog_acl_trace.h"
22 
23 /* check if a given ACL exists */
24 static u8
26 {
28 
29  if (pool_is_free_index (am->acls, acl_index))
30  return 0;
31 
32  return 1;
33 }
34 
35 
36 static u32 get_acl_user_id(acl_main_t *am, char *user_module_name, char *val1_label, char *val2_label)
37 {
39 
40  pool_foreach (auser, am->acl_users)
41  {
42  if (0 == strcmp(auser->user_module_name, user_module_name)) {
43  return (auser - am->acl_users);
44  }
45  }
46 
47  pool_get(am->acl_users, auser);
48  auser->user_module_name = user_module_name;
49  auser->val1_label = val1_label;
50  auser->val2_label = val2_label;
51  return (auser - am->acl_users);
52 }
53 
54 static int acl_user_id_valid(acl_main_t *am, u32 acl_user_id)
55 {
56 
57  if (pool_is_free_index (am->acl_users, acl_user_id))
58  return 0;
59 
60  return 1;
61 }
62 
63 static int acl_lc_index_valid(acl_main_t *am, u32 lc_index)
64 {
65 
66  if (pool_is_free_index (am->acl_lookup_contexts, lc_index))
67  return 0;
68 
69  return 1;
70 }
71 
72 /*
73  * If you are using ACL plugin, get this unique ID first,
74  * so you can identify yourself when creating the lookup contexts.
75  */
76 
77 static u32 acl_plugin_register_user_module (char *user_module_name, char *val1_label, char *val2_label)
78 {
80  /*
81  * Because folks like to call this early on,
82  * use the global heap, so as to avoid
83  * initializing the main ACL heap before
84  * they start using ACLs.
85  */
86  u32 user_id = get_acl_user_id(am, user_module_name, val1_label, val2_label);
87  return user_id;
88 }
89 
90 /*
91  * Allocate a new lookup context index.
92  * Supply the id assigned to your module during registration,
93  * and two values of your choice identifying instances
94  * of use within your module. They are useful for debugging.
95  * If >= 0 - context id. If < 0 - error code.
96  */
97 
98 static int acl_plugin_get_lookup_context_index (u32 acl_user_id, u32 val1, u32 val2)
99 {
100  acl_main_t *am = &acl_main;
101  acl_lookup_context_t *acontext;
102 
103  if (!acl_user_id_valid(am, acl_user_id))
104  return VNET_API_ERROR_INVALID_REGISTRATION;
105 
106  /*
107  * The lookup context index allocation is
108  * an operation done within the global heap,
109  * so no heap switching necessary.
110  */
111 
112  pool_get(am->acl_lookup_contexts, acontext);
113  acontext->acl_indices = 0;
114  acontext->context_user_id = acl_user_id;
115  acontext->user_val1 = val1;
116  acontext->user_val2 = val2;
117 
118  u32 new_context_id = acontext - am->acl_lookup_contexts;
119  vec_add1(am->acl_users[acl_user_id].lookup_contexts, new_context_id);
120 
121  return new_context_id;
122 }
123 
124 static void
125 lock_acl(acl_main_t *am, u32 acl, u32 lc_index)
126 {
127  vec_validate(am->lc_index_vec_by_acl, acl);
128  elog_acl_cond_trace_X2(am, (am->trace_acl), "lock acl %d in lc_index %d", "i4i4", acl, lc_index);
129  vec_add1(am->lc_index_vec_by_acl[acl], lc_index);
130 }
131 
132 static void
133 lock_acl_vec(u32 lc_index, u32 *acls)
134 {
135  int i;
136  acl_main_t *am = &acl_main;
137  for(i=0; i<vec_len(acls); i++) {
138  lock_acl(am, acls[i], lc_index);
139  }
140 }
141 
142 static void
143 unlock_acl(acl_main_t *am, u32 acl, u32 lc_index)
144 {
145  vec_validate(am->lc_index_vec_by_acl, acl);
146  elog_acl_cond_trace_X2(am, (am->trace_acl), "unlock acl %d in lc_index %d", "i4i4", acl, lc_index);
147  u32 index = vec_search(am->lc_index_vec_by_acl[acl], lc_index);
148  if (index != ~0)
149  vec_del1(am->lc_index_vec_by_acl[acl], index);
150  else
151  clib_warning("BUG: can not unlock acl %d lc_index %d", acl, lc_index);
152 }
153 
154 static void
155 unlock_acl_vec(u32 lc_index, u32 *acls)
156 {
157  int i;
158  acl_main_t *am = &acl_main;
159  for(i=0; i<vec_len(acls); i++)
160  unlock_acl(am, acls[i], lc_index);
161 }
162 
163 
164 static void
165 apply_acl_vec(u32 lc_index, u32 *acls)
166 {
167  int i;
168  acl_main_t *am = &acl_main;
169 
170  for(i=0; i<vec_len(acls); i++)
171  hash_acl_apply(am, lc_index, acls[i], i);
172 }
173 
174 
175 static void
176 unapply_acl_vec(u32 lc_index, u32 *acls)
177 {
178  int i;
179  acl_main_t *am = &acl_main;
180  if (vec_len(acls) == 0)
181  return;
182  for(i=vec_len(acls); i > 0; i--)
183  hash_acl_unapply(am, lc_index, acls[i-1]);
184 }
185 
186 /*
187  * Release the lookup context index and destroy
188  * any associated data structures.
189  */
191 {
192  acl_main_t *am = &acl_main;
193 
194  elog_acl_cond_trace_X1(am, (am->trace_acl), "LOOKUP-CONTEXT: put-context lc_index %d", "i4", lc_index);
195  if (!acl_lc_index_valid(am, lc_index)) {
196  clib_warning("BUG: lc_index %d is not valid", lc_index);
197  return;
198  }
199 
200  acl_lookup_context_t *acontext = pool_elt_at_index(am->acl_lookup_contexts, lc_index);
201 
202  u32 index = vec_search(am->acl_users[acontext->context_user_id].lookup_contexts, lc_index);
203  ASSERT(index != ~0);
204 
205  vec_del1(am->acl_users[acontext->context_user_id].lookup_contexts, index);
206  unapply_acl_vec(lc_index, acontext->acl_indices);
207  unlock_acl_vec(lc_index, acontext->acl_indices);
208  vec_free(acontext->acl_indices);
209  pool_put(am->acl_lookup_contexts, acontext);
210 }
211 
212 /*
213  * Prepare the sequential vector of ACL#s to lookup within a given context.
214  * Any existing list will be overwritten. acl_list is a vector.
215  */
216 static int acl_plugin_set_acl_vec_for_context (u32 lc_index, u32 *acl_list)
217 {
218  int rv = 0;
219  uword *seen_acl_bitmap = 0;
220  u32 *pacln = 0;
221  acl_main_t *am = &acl_main;
222  acl_lookup_context_t *acontext;
223  if (am->trace_acl) {
224  u32 i;
225  elog_acl_cond_trace_X1(am, (1), "LOOKUP-CONTEXT: set-acl-list lc_index %d", "i4", lc_index);
226  for(i=0; i<vec_len(acl_list); i++) {
227  elog_acl_cond_trace_X2(am, (1), " acl-list[%d]: %d", "i4i4", i, acl_list[i]);
228  }
229  }
230  if (!acl_lc_index_valid(am, lc_index)) {
231  clib_warning("BUG: lc_index %d is not valid", lc_index);
232  return -1;
233  }
234  vec_foreach (pacln, acl_list)
235  {
236  if (pool_is_free_index (am->acls, *pacln))
237  {
238  /* ACL is not defined. Can not apply */
239  clib_warning ("ERROR: ACL %d not defined", *pacln);
240  rv = VNET_API_ERROR_NO_SUCH_ENTRY;
241  goto done;
242  }
243  if (clib_bitmap_get (seen_acl_bitmap, *pacln))
244  {
245  /* ACL being applied twice within the list. error. */
246  clib_warning ("ERROR: ACL %d being applied twice", *pacln);
247  rv = VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
248  goto done;
249  }
250  seen_acl_bitmap = clib_bitmap_set (seen_acl_bitmap, *pacln, 1);
251  }
252 
253  acontext = pool_elt_at_index(am->acl_lookup_contexts, lc_index);
254  u32 *old_acl_vector = acontext->acl_indices;
255  acontext->acl_indices = vec_dup(acl_list);
256 
257  unapply_acl_vec(lc_index, old_acl_vector);
258  unlock_acl_vec(lc_index, old_acl_vector);
259  lock_acl_vec(lc_index, acontext->acl_indices);
260  apply_acl_vec(lc_index, acontext->acl_indices);
261 
262  vec_free(old_acl_vector);
263 
264 done:
265  clib_bitmap_free (seen_acl_bitmap);
266  return rv;
267 }
268 
269 
271 {
272  acl_main_t *am = &acl_main;
273  if (acl_plugin_acl_exists(acl_num)) {
274  if (hash_acl_exists(am, acl_num)) {
275  /* this is a modification, clean up the older entries */
276  hash_acl_delete(am, acl_num);
277  }
278  hash_acl_add(am, acl_num);
279  } else {
280  /* this is a deletion notification */
281  hash_acl_delete(am, acl_num);
282  }
283 }
284 
285 
286 /* Fill the 5-tuple from the packet */
287 
288 static void acl_plugin_fill_5tuple (u32 lc_index, vlib_buffer_t * b0, int is_ip6, int is_input,
289  int is_l2_path, fa_5tuple_opaque_t * p5tuple_pkt)
290 {
291  acl_plugin_fill_5tuple_inline(&acl_main, lc_index, b0, is_ip6, is_input, is_l2_path, p5tuple_pkt);
292 }
293 
294 static int acl_plugin_match_5tuple (u32 lc_index,
295  fa_5tuple_opaque_t * pkt_5tuple,
296  int is_ip6, u8 * r_action,
297  u32 * r_acl_pos_p,
298  u32 * r_acl_match_p,
299  u32 * r_rule_match_p,
300  u32 * trace_bitmap)
301 {
302  return acl_plugin_match_5tuple_inline (&acl_main, lc_index, pkt_5tuple, is_ip6, r_action, r_acl_pos_p, r_acl_match_p, r_rule_match_p, trace_bitmap);
303 }
304 
305 
306 void
308 {
309  acl_main_t *am = &acl_main;
310  vlib_main_t *vm = am->vlib_main;
312 
313  pool_foreach (auser, am->acl_users)
314  {
315  u32 curr_user_index = (auser - am->acl_users);
316  if (user_index == ~0 || (curr_user_index == user_index)) {
317  vlib_cli_output (vm, "index %d:%s:%s:%s", curr_user_index, auser->user_module_name, auser->val1_label, auser->val2_label);
318  }
319  }
320 }
321 
322 
323 void
325 {
326  acl_main_t *am = &acl_main;
327  vlib_main_t *vm = am->vlib_main;
328  acl_lookup_context_t *acontext;
329  // clib_warning("LOOKUP-CONTEXT: lc_index %d acl_list [ %U ]", lc_index, format_vec32, acl_list, "%d");
330  if (!am->acl_lookup_contexts)
331  {
332  vlib_cli_output(vm, "ACL lookup contexts are not initialized");
333  return;
334  }
335 
336  pool_foreach (acontext, am->acl_lookup_contexts)
337  {
338  u32 curr_lc_index = (acontext - am->acl_lookup_contexts);
339  if ((lc_index == ~0) || (curr_lc_index == lc_index)) {
340  if (acl_user_id_valid(am, acontext->context_user_id)) {
341  acl_lookup_context_user_t *auser = pool_elt_at_index(am->acl_users, acontext->context_user_id);
342  vlib_cli_output (vm, "index %d:%s %s: %d %s: %d, acl_indices: %U",
343  curr_lc_index, auser->user_module_name, auser->val1_label,
344  acontext->user_val1, auser->val2_label, acontext->user_val2,
345  format_vec32, acontext->acl_indices, "%d");
346  } else {
347  vlib_cli_output (vm, "index %d: user_id: %d user_val1: %d user_val2: %d, acl_indices: %U",
348  curr_lc_index, acontext->context_user_id,
349  acontext->user_val1, acontext->user_val2,
350  format_vec32, acontext->acl_indices, "%d");
351  }
352  }
353  }
354 }
355 
356 void *
358 {
359  return &acl_main;
360 }
361 
362 __clib_export clib_error_t *
364 {
365  m->p_acl_main = &acl_main;
366 #define _(name) m->name = acl_plugin_ ## name;
368 #undef _
369  return 0;
370 }
lock_acl
static void lock_acl(acl_main_t *am, u32 acl, u32 lc_index)
Definition: lookup_context.c:125
public_inlines.h
hash_acl_delete
void hash_acl_delete(acl_main_t *am, int acl_index)
Definition: hash_lookup.c:1108
acl_plugin_show_lookup_user
void acl_plugin_show_lookup_user(u32 user_index)
Definition: lookup_context.c:307
acl_plugin_methods_vtable_init
__clib_export clib_error_t * acl_plugin_methods_vtable_init(acl_plugin_methods_t *m)
Definition: lookup_context.c:363
unlock_acl
static void unlock_acl(acl_main_t *am, u32 acl, u32 lc_index)
Definition: lookup_context.c:143
acl_plugin_match_5tuple_inline
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
Definition: public_inlines.h:653
elog_acl_trace.h
hash_lookup.h
pool_elt_at_index
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:553
get_acl_user_id
static u32 get_acl_user_id(acl_main_t *am, char *user_module_name, char *val1_label, char *val2_label)
Definition: lookup_context.c:36
acl_lookup_context_t::user_val2
u32 user_val2
Definition: lookup_context.h:38
acl_plugin_register_user_module
static u32 acl_plugin_register_user_module(char *user_module_name, char *val1_label, char *val2_label)
Definition: lookup_context.c:77
am
app_main_t * am
Definition: application.c:489
pool_put
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:305
vm
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
Definition: nat44_ei.c:3047
hash_acl_exists
int hash_acl_exists(acl_main_t *am, int acl_index)
Definition: hash_lookup.c:1053
acl_lc_index_valid
static int acl_lc_index_valid(acl_main_t *am, u32 lc_index)
Definition: lookup_context.c:63
hash_acl_unapply
void hash_acl_unapply(acl_main_t *am, u32 lc_index, int acl_index)
Definition: hash_lookup.c:841
plugin.h
elog_acl_cond_trace_X2
#define elog_acl_cond_trace_X2(am, trace_cond, acl_elog_trace_format_label, acl_elog_trace_format_args, acl_elog_val1, acl_elog_val2)
Definition: elog_acl_trace.h:47
acl_main
acl_main_t acl_main
Definition: acl.c:44
acl_lookup_context_t
Definition: lookup_context.h:30
acl_plugin_acl_exists
static u8 acl_plugin_acl_exists(u32 acl_index)
Definition: lookup_context.c:25
pool_is_free_index
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
Definition: pool.h:302
pool_foreach
#define pool_foreach(VAR, POOL)
Iterate through pool.
Definition: pool.h:534
fa_5tuple_opaque_t
Definition: exported_types.h:25
vec_len
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
Definition: vec_bootstrap.h:142
clib_bitmap_get
static uword clib_bitmap_get(uword *ai, uword i)
Gets the ith bit value from a bitmap.
Definition: bitmap.h:197
acl.h
vec_add1
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:606
acl_lookup_context_t::context_user_id
u32 context_user_id
Definition: lookup_context.h:34
vec_dup
#define vec_dup(V)
Return copy of vector (no header, no alignment)
Definition: vec.h:444
lock_acl_vec
static void lock_acl_vec(u32 lc_index, u32 *acls)
Definition: lookup_context.c:133
hash_acl_add
void hash_acl_add(acl_main_t *am, int acl_index)
Definition: hash_lookup.c:1062
acl_lookup_context_user_t::val1_label
char * val1_label
Definition: lookup_context.h:23
foreach_acl_plugin_exported_method_name
#define foreach_acl_plugin_exported_method_name
Definition: exported_types.h:78
acl_lookup_context_user_t
Definition: lookup_context.h:19
clib_bitmap_free
#define clib_bitmap_free(v)
Free a bitmap.
Definition: bitmap.h:92
uword
u64 uword
Definition: types.h:112
acl_plugin_match_5tuple
static int acl_plugin_match_5tuple(u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
Definition: lookup_context.c:294
i
sll srl srl sll sra u16x4 i
Definition: vector_sse42.h:261
acl_lookup_context_user_t::val2_label
char * val2_label
Definition: lookup_context.h:25
pool_get
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:255
vec_validate
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment)
Definition: vec.h:523
acl_plugin_set_acl_vec_for_context
static int acl_plugin_set_acl_vec_for_context(u32 lc_index, u32 *acl_list)
Definition: lookup_context.c:216
acl_plugin_methods_t
Definition: exported_types.h:88
hash_acl_apply
void hash_acl_apply(acl_main_t *am, u32 lc_index, int acl_index, u32 acl_position)
Definition: hash_lookup.c:624
acl_plugin_put_lookup_context_index
static void acl_plugin_put_lookup_context_index(u32 lc_index)
Definition: lookup_context.c:190
acl_plugin_get_lookup_context_index
static int acl_plugin_get_lookup_context_index(u32 acl_user_id, u32 val1, u32 val2)
Definition: lookup_context.c:98
acl_index
u32 acl_index
Definition: abf.api:60
clib_bitmap_set
static uword * clib_bitmap_set(uword *ai, uword i, uword value)
Sets the ith bit of a bitmap to new_value Removes trailing zeros from the bitmap.
Definition: bitmap.h:167
vlib_cli_output
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
Definition: cli.c:716
vec_search
#define vec_search(v, E)
Search a vector for the index of the entry that matches.
Definition: vec.h:1054
acl_lookup_context_user_t::user_module_name
char * user_module_name
Definition: lookup_context.h:21
unlock_acl_vec
static void unlock_acl_vec(u32 lc_index, u32 *acls)
Definition: lookup_context.c:155
is_ip6
bool is_ip6
Definition: ip.api:43
vec_free
#define vec_free(V)
Free vector's memory (no header).
Definition: vec.h:395
acl_lookup_context_t::acl_indices
u32 * acl_indices
Definition: lookup_context.h:32
index
u32 index
Definition: flow_types.api:221
ASSERT
#define ASSERT(truth)
Definition: error_bootstrap.h:69
unapply_acl_vec
static void unapply_acl_vec(u32 lc_index, u32 *acls)
Definition: lookup_context.c:176
acl_plugin_fill_5tuple_inline
static void acl_plugin_fill_5tuple_inline(void *p_acl_main, u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
Definition: public_inlines.h:231
u32
unsigned int u32
Definition: types.h:88
acl_main_t
Definition: acl.h:116
vec_foreach
#define vec_foreach(var, vec)
Vector iterator.
Definition: vec_bootstrap.h:213
apply_acl_vec
static void apply_acl_vec(u32 lc_index, u32 *acls)
Definition: lookup_context.c:165
acl_plugin_show_lookup_context
void acl_plugin_show_lookup_context(u32 lc_index)
Definition: lookup_context.c:324
acl_lookup_context_t::user_val1
u32 user_val1
Definition: lookup_context.h:36
acl_plugin_get_p_acl_main
void * acl_plugin_get_p_acl_main(void)
Definition: lookup_context.c:357
vlib_main_t
Definition: main.h:102
format_vec32
u8 * format_vec32(u8 *s, va_list *va)
Definition: std-formats.c:43
u8
unsigned char u8
Definition: types.h:56
clib_error_t
Definition: clib_error.h:21
fa_node.h
acl_plugin_lookup_context_notify_acl_change
void acl_plugin_lookup_context_notify_acl_change(u32 acl_num)
Definition: lookup_context.c:270
clib_warning
#define clib_warning(format, args...)
Definition: error.h:59
rv
int __clib_unused rv
Definition: application.c:491
elog_acl_cond_trace_X1
#define elog_acl_cond_trace_X1(am, trace_cond, acl_elog_trace_format_label, acl_elog_trace_format_args, acl_elog_val1)
Definition: elog_acl_trace.h:22
acl_plugin_fill_5tuple
static void acl_plugin_fill_5tuple(u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
Definition: lookup_context.c:288
acl_plugin_methods_t::p_acl_main
void * p_acl_main
Definition: exported_types.h:89
vec_del1
#define vec_del1(v, i)
Delete the element at index I.
Definition: vec.h:896
acl_user_id_valid
static int acl_user_id_valid(acl_main_t *am, u32 acl_user_id)
Definition: lookup_context.c:54
vlib_buffer_t
VLIB buffer representation.
Definition: buffer.h:111