2 * Copyright (c) 2016 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
15 #ifndef included_acl_h
16 #define included_acl_h
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/l2/l2_output.h>
23 #include <vppinfra/hash.h>
24 #include <vppinfra/error.h>
25 #include <vppinfra/elog.h>
27 #define ACL_PLUGIN_VERSION_MAJOR 1
28 #define ACL_PLUGIN_VERSION_MINOR 1
30 extern vlib_node_registration_t acl_in_node;
31 extern vlib_node_registration_t acl_out_node;
33 void input_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap);
34 void output_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap);
36 enum address_e { IP4, IP6 };
58 u16 src_port_or_type_first;
59 u16 src_port_or_type_last;
60 u16 dst_port_or_code_first;
61 u16 dst_port_or_code_last;
72 ip46_address_t src_ip_addr;
90 macip_acl_rule_t *rules;
91 /* References to the classifier tables that will enforce the rules */
98 /* API message ID base */
101 acl_list_t *acls; /* Pool of ACLs */
102 macip_acl_list_t *macip_acls; /* Pool of MAC-IP ACLs */
104 /* ACLs associated with interfaces */
105 u32 **input_acl_vec_by_sw_if_index;
106 u32 **output_acl_vec_by_sw_if_index;
109 * Classify tables used to grab the packets for the ACL check,
110 * and serving as the 5-tuple session tables at the same time
112 u32 *acl_ip4_input_classify_table_by_sw_if_index;
113 u32 *acl_ip6_input_classify_table_by_sw_if_index;
114 u32 *acl_ip4_output_classify_table_by_sw_if_index;
115 u32 *acl_ip6_output_classify_table_by_sw_if_index;
117 /* MACIP (input) ACLs associated with the interfaces */
118 u32 *macip_acl_by_sw_if_index;
120 /* next indices for our nodes in the l2-classify tables */
121 u32 l2_input_classify_next_acl;
122 u32 l2_output_classify_next_acl;
124 /* next node indices for feature bitmap */
125 u32 acl_in_node_input_next_node_index[32];
126 /* the respective thing for the output feature */
127 l2_output_next_nodes_st acl_out_output_next_nodes;
129 /* ACL match actions (must be coherent across in/out ACLs to next indices (can differ) */
131 u32 acl_in_ip4_match_next[256];
132 u32 acl_in_ip6_match_next[256];
133 u32 acl_out_ip4_match_next[256];
134 u32 acl_out_ip6_match_next[256];
139 vlib_main_t * vlib_main;
140 vnet_main_t * vnet_main;
143 extern acl_main_t acl_main;