src/plugins/acl/dataplane_node.c

   1 /*
   2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #include <stddef.h>
  16 #include <netinet/in.h>
  17
  18 #include <vlib/vlib.h>
  19 #include <vnet/vnet.h>
  20 #include <vppinfra/error.h>
  21
  22
  23 #include <acl/acl.h>
  24 #include <vnet/ip/icmp46_packet.h>
  25
  26 #include <plugins/acl/fa_node.h>
  27 #include <plugins/acl/acl.h>
  28 #include <plugins/acl/lookup_context.h>
  29 #include <plugins/acl/public_inlines.h>
  30 #include <plugins/acl/session_inlines.h>
  31
  32 #include <vppinfra/bihash_40_8.h>
  33 #include <vppinfra/bihash_template.h>
  34
  35 typedef struct
  36 {
  37   u32 next_index;
  38   u32 sw_if_index;
  39   u32 lc_index;
  40   u32 match_acl_in_index;
  41   u32 match_rule_index;
  42   u64 packet_info[6];
  43   u32 trace_bitmap;
  44   u8 action;
  45 } acl_fa_trace_t;
  46
  47 /* *INDENT-OFF* */
  48 #define foreach_acl_fa_error \
  49 _(ACL_DROP, "ACL deny packets")  \
  50 _(ACL_PERMIT, "ACL permit packets")  \
  51 _(ACL_NEW_SESSION, "new sessions added") \
  52 _(ACL_EXIST_SESSION, "existing session packets") \
  53 _(ACL_CHECK, "checked packets") \
  54 _(ACL_RESTART_SESSION_TIMER, "restart session timer") \
  55 _(ACL_TOO_MANY_SESSIONS, "too many sessions to add new") \
  56 /* end  of errors */
  57
  58 typedef enum
  59 {
  60 #define _(sym,str) ACL_FA_ERROR_##sym,
  61   foreach_acl_fa_error
  62 #undef _
  63     ACL_FA_N_ERROR,
  64 } acl_fa_error_t;
  65
  66 /* *INDENT-ON* */
  67
  68 always_inline u16
  69 get_current_policy_epoch (acl_main_t * am, int is_input, u32 sw_if_index0)
  70 {
  71   u32 **p_epoch_vec =
  72     is_input ? &am->input_policy_epoch_by_sw_if_index :
  73     &am->output_policy_epoch_by_sw_if_index;
  74   u16 current_policy_epoch =
  75     sw_if_index0 < vec_len (*p_epoch_vec) ? vec_elt (*p_epoch_vec,
  76                                                      sw_if_index0)
  77     : (is_input * FA_POLICY_EPOCH_IS_INPUT);
  78   return current_policy_epoch;
  79 }
  80
  81 always_inline void
  82 maybe_trace_buffer (vlib_main_t * vm, vlib_node_runtime_t * node,
  83                     vlib_buffer_t * b, u32 sw_if_index0, u32 lc_index0,
  84                     u16 next0, int match_acl_in_index, int match_rule_index,
  85                     fa_5tuple_t * fa_5tuple, u8 action, u32 trace_bitmap)
  86 {
  87   if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
  88     {
  89       acl_fa_trace_t *t = vlib_add_trace (vm, node, b, sizeof (*t));
  90       t->sw_if_index = sw_if_index0;
  91       t->lc_index = lc_index0;
  92       t->next_index = next0;
  93       t->match_acl_in_index = match_acl_in_index;
  94       t->match_rule_index = match_rule_index;
  95       t->packet_info[0] = fa_5tuple->kv_40_8.key[0];
  96       t->packet_info[1] = fa_5tuple->kv_40_8.key[1];
  97       t->packet_info[2] = fa_5tuple->kv_40_8.key[2];
  98       t->packet_info[3] = fa_5tuple->kv_40_8.key[3];
  99       t->packet_info[4] = fa_5tuple->kv_40_8.key[4];
 100       t->packet_info[5] = fa_5tuple->kv_40_8.value;
 101       t->action = action;
 102       t->trace_bitmap = trace_bitmap;
 103     }
 104 }
 105
 106
 107 always_inline int
 108 stale_session_deleted (acl_main_t * am, int is_input,
 109                        acl_fa_per_worker_data_t * pw, u64 now,
 110                        u32 sw_if_index0, fa_full_session_id_t f_sess_id)
 111 {
 112   u16 current_policy_epoch =
 113     get_current_policy_epoch (am, is_input, sw_if_index0);
 114
 115   /* if the MSB of policy epoch matches but not the LSB means it is a stale session */
 116   if ((0 ==
 117        ((current_policy_epoch ^
 118          f_sess_id.intf_policy_epoch) &
 119         FA_POLICY_EPOCH_IS_INPUT))
 120       && (current_policy_epoch != f_sess_id.intf_policy_epoch))
 121     {
 122       /* delete session and increment the counter */
 123       vec_validate (pw->fa_session_epoch_change_by_sw_if_index, sw_if_index0);
 124       vec_elt (pw->fa_session_epoch_change_by_sw_if_index, sw_if_index0)++;
 125       if (acl_fa_conn_list_delete_session (am, f_sess_id, now))
 126         {
 127           /* delete the session only if we were able to unlink it */
 128           acl_fa_two_stage_delete_session (am, sw_if_index0, f_sess_id, now);
 129         }
 130       return 1;
 131     }
 132   else
 133     return 0;
 134 }
 135
 136
 137
 138
 139
 140 always_inline void
 141 get_sw_if_index_xN (int vector_sz, int is_input, vlib_buffer_t ** b,
 142                     u32 * out_sw_if_index)
 143 {
 144   int ii;
 145   for (ii = 0; ii < vector_sz; ii++)
 146     if (is_input)
 147       out_sw_if_index[ii] = vnet_buffer (b[ii])->sw_if_index[VLIB_RX];
 148     else
 149       out_sw_if_index[ii] = vnet_buffer (b[ii])->sw_if_index[VLIB_TX];
 150 }
 151
 152 always_inline void
 153 fill_5tuple_xN (int vector_sz, acl_main_t * am, int is_ip6, int is_input,
 154                 int is_l2_path, vlib_buffer_t ** b, u32 * sw_if_index,
 155                 fa_5tuple_t * out_fa_5tuple)
 156 {
 157   int ii;
 158   for (ii = 0; ii < vector_sz; ii++)
 159     acl_fill_5tuple (am, sw_if_index[ii], b[ii], is_ip6,
 160                      is_input, is_l2_path, &out_fa_5tuple[ii]);
 161 }
 162
 163 always_inline void
 164 make_session_hash_xN (int vector_sz, acl_main_t * am, int is_ip6,
 165                       u32 * sw_if_index, fa_5tuple_t * fa_5tuple,
 166                       u64 * out_hash)
 167 {
 168   int ii;
 169   for (ii = 0; ii < vector_sz; ii++)
 170     out_hash[ii] =
 171       acl_fa_make_session_hash (am, is_ip6, sw_if_index[ii], &fa_5tuple[ii]);
 172 }
 173
 174 always_inline void
 175 prefetch_session_entry (acl_main_t * am, fa_full_session_id_t f_sess_id)
 176 {
 177   fa_session_t *sess = get_session_ptr_no_check (am, f_sess_id.thread_index,
 178                                                  f_sess_id.session_index);
 179   CLIB_PREFETCH (sess, 2 * CLIB_CACHE_LINE_BYTES, STORE);
 180 }
 181
 182 always_inline u8
 183 process_established_session (vlib_main_t * vm, acl_main_t * am,
 184                              u32 counter_node_index, int is_input, u64 now,
 185                              fa_full_session_id_t f_sess_id,
 186                              u32 * sw_if_index, fa_5tuple_t * fa_5tuple,
 187                              u32 pkt_len, int node_trace_on,
 188                              u32 * trace_bitmap)
 189 {
 190   u8 action = 0;
 191   fa_session_t *sess = get_session_ptr_no_check (am, f_sess_id.thread_index,
 192                                                  f_sess_id.session_index);
 193
 194   int old_timeout_type = fa_session_get_timeout_type (am, sess);
 195   action =
 196     acl_fa_track_session (am, is_input, sw_if_index[0], now,
 197                           sess, &fa_5tuple[0], pkt_len);
 198   int new_timeout_type = fa_session_get_timeout_type (am, sess);
 199   /* Tracking might have changed the session timeout type, e.g. from transient to established */
 200   if (PREDICT_FALSE (old_timeout_type != new_timeout_type))
 201     {
 202       acl_fa_restart_timer_for_session (am, now, f_sess_id);
 203       vlib_node_increment_counter (vm, counter_node_index,
 204                                    ACL_FA_ERROR_ACL_RESTART_SESSION_TIMER, 1);
 205       if (node_trace_on)
 206         *trace_bitmap |=
 207           0x00010000 + ((0xff & old_timeout_type) << 8) +
 208           (0xff & new_timeout_type);
 209     }
 210   /*
 211    * I estimate the likelihood to be very low - the VPP needs
 212    * to have >64K interfaces to start with and then on
 213    * exactly 64K indices apart needs to be exactly the same
 214    * 5-tuple... Anyway, since this probability is nonzero -
 215    * print an error and drop the unlucky packet.
 216    * If this shows up in real world, we would need to bump
 217    * the hash key length.
 218    */
 219   if (PREDICT_FALSE (sess->sw_if_index != sw_if_index[0]))
 220     {
 221       clib_warning
 222         ("BUG: session LSB16(sw_if_index)=%d and 5-tuple=%d collision!",
 223          sess->sw_if_index, sw_if_index[0]);
 224       action = 0;
 225     }
 226   return action;
 227
 228 }
 229
 230 #define ACL_PLUGIN_VECTOR_SIZE 4
 231 #define ACL_PLUGIN_PREFETCH_GAP 3
 232
 233 always_inline void
 234 acl_fa_node_common_prepare_fn (vlib_main_t * vm,
 235                                vlib_node_runtime_t * node,
 236                                vlib_frame_t * frame, int is_ip6, int is_input,
 237                                int is_l2_path, int with_stateful_datapath)
 238         /* , int node_trace_on,
 239            int reclassify_sessions) */
 240 {
 241   u32 n_left, *from;
 242   acl_main_t *am = &acl_main;
 243   uword thread_index = os_get_thread_index ();
 244   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 245
 246   vlib_buffer_t **b;
 247   u32 *sw_if_index;
 248   fa_5tuple_t *fa_5tuple;
 249   u64 *hash;
 250
 251
 252
 253   from = vlib_frame_vector_args (frame);
 254   vlib_get_buffers (vm, from, pw->bufs, frame->n_vectors);
 255
 256   /* set the initial values for the current buffer the next pointers */
 257   b = pw->bufs;
 258   sw_if_index = pw->sw_if_indices;
 259   fa_5tuple = pw->fa_5tuples;
 260   hash = pw->hashes;
 261
 262
 263   /*
 264    * fill the sw_if_index, 5tuple and session hash,
 265    * First in strides of size ACL_PLUGIN_VECTOR_SIZE,
 266    * with buffer prefetch being
 267    * ACL_PLUGIN_PREFETCH_GAP * ACL_PLUGIN_VECTOR_SIZE entries
 268    * in front. Then with a simple single loop.
 269    */
 270
 271   n_left = frame->n_vectors;
 272   while (n_left >= (ACL_PLUGIN_PREFETCH_GAP + 1) * ACL_PLUGIN_VECTOR_SIZE)
 273     {
 274       const int vec_sz = ACL_PLUGIN_VECTOR_SIZE;
 275       {
 276         int ii;
 277         for (ii = ACL_PLUGIN_PREFETCH_GAP * vec_sz;
 278              ii < (ACL_PLUGIN_PREFETCH_GAP + 1) * vec_sz; ii++)
 279           {
 280             CLIB_PREFETCH (b[ii], CLIB_CACHE_LINE_BYTES, LOAD);
 281             CLIB_PREFETCH (b[ii]->data, 2 * CLIB_CACHE_LINE_BYTES, LOAD);
 282           }
 283       }
 284
 285
 286       get_sw_if_index_xN (vec_sz, is_input, b, sw_if_index);
 287       fill_5tuple_xN (vec_sz, am, is_ip6, is_input, is_l2_path, &b[0],
 288                       &sw_if_index[0], &fa_5tuple[0]);
 289       if (with_stateful_datapath)
 290         make_session_hash_xN (vec_sz, am, is_ip6, &sw_if_index[0],
 291                               &fa_5tuple[0], &hash[0]);
 292
 293       n_left -= vec_sz;
 294
 295       fa_5tuple += vec_sz;
 296       b += vec_sz;
 297       sw_if_index += vec_sz;
 298       hash += vec_sz;
 299     }
 300
 301   while (n_left > 0)
 302     {
 303       const int vec_sz = 1;
 304
 305       get_sw_if_index_xN (vec_sz, is_input, b, sw_if_index);
 306       fill_5tuple_xN (vec_sz, am, is_ip6, is_input, is_l2_path, &b[0],
 307                       &sw_if_index[0], &fa_5tuple[0]);
 308       if (with_stateful_datapath)
 309         make_session_hash_xN (vec_sz, am, is_ip6, &sw_if_index[0],
 310                               &fa_5tuple[0], &hash[0]);
 311
 312       n_left -= vec_sz;
 313
 314       fa_5tuple += vec_sz;
 315       b += vec_sz;
 316       sw_if_index += vec_sz;
 317       hash += vec_sz;
 318     }
 319 }
 320
 321
 322 always_inline uword
 323 acl_fa_inner_node_fn (vlib_main_t * vm,
 324                       vlib_node_runtime_t * node, vlib_frame_t * frame,
 325                       int is_ip6, int is_input, int is_l2_path,
 326                       int with_stateful_datapath, int node_trace_on,
 327                       int reclassify_sessions)
 328 {
 329   u32 n_left, *from;
 330   u32 pkts_exist_session = 0;
 331   u32 pkts_new_session = 0;
 332   u32 pkts_acl_permit = 0;
 333   u32 trace_bitmap = 0;
 334   acl_main_t *am = &acl_main;
 335   vlib_node_runtime_t *error_node;
 336   vlib_error_t no_error_existing_session;
 337   u64 now = clib_cpu_time_now ();
 338   uword thread_index = os_get_thread_index ();
 339   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 340
 341   u16 *next;
 342   vlib_buffer_t **b;
 343   u32 *sw_if_index;
 344   fa_5tuple_t *fa_5tuple;
 345   u64 *hash;
 346   /* for the delayed counters */
 347   u32 saved_matched_acl_index = 0;
 348   u32 saved_matched_ace_index = 0;
 349   u32 saved_packet_count = 0;
 350   u32 saved_byte_count = 0;
 351
 352   from = vlib_frame_vector_args (frame);
 353   error_node = vlib_node_get_runtime (vm, node->node_index);
 354   no_error_existing_session =
 355     error_node->errors[ACL_FA_ERROR_ACL_EXIST_SESSION];
 356
 357   b = pw->bufs;
 358   next = pw->nexts;
 359   sw_if_index = pw->sw_if_indices;
 360   fa_5tuple = pw->fa_5tuples;
 361   hash = pw->hashes;
 362
 363   /*
 364    * Now the "hard" work of session lookups and ACL lookups for new sessions.
 365    * Due to the complexity, do it for the time being in single loop with
 366    * the pipeline of three prefetches:
 367    *    1) bucket for the session bihash
 368    *    2) data for the session bihash
 369    *    3) worker session record
 370    */
 371
 372   fa_full_session_id_t f_sess_id_next = {.as_u64 = ~0ULL };
 373
 374   /* find the "next" session so we can kickstart the pipeline */
 375   if (with_stateful_datapath)
 376     acl_fa_find_session_with_hash (am, is_ip6, sw_if_index[0], hash[0],
 377                                    &fa_5tuple[0], &f_sess_id_next.as_u64);
 378
 379   n_left = frame->n_vectors;
 380   while (n_left > 0)
 381     {
 382       u8 action = 0;
 383       u32 lc_index0 = ~0;
 384       int acl_check_needed = 1;
 385       u32 match_acl_in_index = ~0;
 386       u32 match_acl_pos = ~0;
 387       u32 match_rule_index = ~0;
 388
 389       next[0] = 0;              /* drop by default */
 390
 391       /* Try to match an existing session first */
 392
 393       if (with_stateful_datapath)
 394         {
 395           fa_full_session_id_t f_sess_id = f_sess_id_next;
 396           switch (n_left)
 397             {
 398             default:
 399               acl_fa_prefetch_session_bucket_for_hash (am, is_ip6, hash[5]);
 400               /* fallthrough */
 401             case 5:
 402             case 4:
 403               acl_fa_prefetch_session_data_for_hash (am, is_ip6, hash[3]);
 404               /* fallthrough */
 405             case 3:
 406             case 2:
 407               acl_fa_find_session_with_hash (am, is_ip6, sw_if_index[1],
 408                                              hash[1], &fa_5tuple[1],
 409                                              &f_sess_id_next.as_u64);
 410               if (f_sess_id_next.as_u64 != ~0ULL)
 411                 {
 412                   prefetch_session_entry (am, f_sess_id_next);
 413                 }
 414               /* fallthrough */
 415             case 1:
 416               if (f_sess_id.as_u64 != ~0ULL)
 417                 {
 418                   if (node_trace_on)
 419                     {
 420                       trace_bitmap |= 0x80000000;
 421                     }
 422                   ASSERT (f_sess_id.thread_index < vec_len (vlib_mains));
 423                   b[0]->error = no_error_existing_session;
 424                   acl_check_needed = 0;
 425                   pkts_exist_session += 1;
 426                   action =
 427                     process_established_session (vm, am, node->node_index,
 428                                                  is_input, now, f_sess_id,
 429                                                  &sw_if_index[0],
 430                                                  &fa_5tuple[0],
 431                                                  b[0]->current_length,
 432                                                  node_trace_on,
 433                                                  &trace_bitmap);
 434
 435                   /* expose the session id to the tracer */
 436                   if (node_trace_on)
 437                     {
 438                       match_rule_index = f_sess_id.session_index;
 439                     }
 440
 441                   if (reclassify_sessions)
 442                     {
 443                       if (PREDICT_FALSE
 444                           (stale_session_deleted
 445                            (am, is_input, pw, now, sw_if_index[0],
 446                             f_sess_id)))
 447                         {
 448                           acl_check_needed = 1;
 449                           if (node_trace_on)
 450                             {
 451                               trace_bitmap |= 0x40000000;
 452                             }
 453                           /*
 454                            * If we have just deleted the session, and the next
 455                            * buffer is the same 5-tuple, that session prediction
 456                            * is wrong, correct it.
 457                            */
 458                           if ((f_sess_id_next.as_u64 != ~0ULL)
 459                               && 0 == memcmp (&fa_5tuple[1], &fa_5tuple[0],
 460                                               sizeof (fa_5tuple[1])))
 461                             f_sess_id_next.as_u64 = ~0ULL;
 462                         }
 463                     }
 464                 }
 465             }
 466
 467           if (acl_check_needed)
 468             {
 469               if (is_input)
 470                 lc_index0 = am->input_lc_index_by_sw_if_index[sw_if_index[0]];
 471               else
 472                 lc_index0 =
 473                   am->output_lc_index_by_sw_if_index[sw_if_index[0]];
 474
 475               action = 0;       /* deny by default */
 476               int is_match = acl_plugin_match_5tuple_inline (am, lc_index0,
 477                                                              (fa_5tuple_opaque_t *) & fa_5tuple[0], is_ip6,
 478                                                              &action,
 479                                                              &match_acl_pos,
 480                                                              &match_acl_in_index,
 481                                                              &match_rule_index,
 482                                                              &trace_bitmap);
 483               if (PREDICT_FALSE
 484                   (is_match && am->interface_acl_counters_enabled))
 485                 {
 486                   u32 buf_len = vlib_buffer_length_in_chain (vm, b[0]);
 487                   vlib_increment_combined_counter (am->combined_acl_counters +
 488                                                    saved_matched_acl_index,
 489                                                    thread_index,
 490                                                    saved_matched_ace_index,
 491                                                    saved_packet_count,
 492                                                    saved_byte_count);
 493                   saved_matched_acl_index = match_acl_in_index;
 494                   saved_matched_ace_index = match_rule_index;
 495                   saved_packet_count = 1;
 496                   saved_byte_count = buf_len;
 497                   /* prefetch the counter that we are going to increment */
 498                   vlib_prefetch_combined_counter (am->combined_acl_counters +
 499                                                   saved_matched_acl_index,
 500                                                   thread_index,
 501                                                   saved_matched_ace_index);
 502                 }
 503
 504               b[0]->error = error_node->errors[action];
 505
 506               if (1 == action)
 507                 pkts_acl_permit++;
 508
 509               if (2 == action)
 510                 {
 511                   if (!acl_fa_can_add_session (am, is_input, sw_if_index[0]))
 512                     acl_fa_try_recycle_session (am, is_input,
 513                                                 thread_index,
 514                                                 sw_if_index[0], now);
 515
 516                   if (acl_fa_can_add_session (am, is_input, sw_if_index[0]))
 517                     {
 518                       u16 current_policy_epoch =
 519                         get_current_policy_epoch (am, is_input,
 520                                                   sw_if_index[0]);
 521                       fa_full_session_id_t f_sess_id =
 522                         acl_fa_add_session (am, is_input, is_ip6,
 523                                             sw_if_index[0],
 524                                             now, &fa_5tuple[0],
 525                                             current_policy_epoch);
 526
 527                       /* perform the accounting for the newly added session */
 528                       process_established_session (vm, am,
 529                                                    node->node_index,
 530                                                    is_input, now,
 531                                                    f_sess_id,
 532                                                    &sw_if_index[0],
 533                                                    &fa_5tuple[0],
 534                                                    b[0]->current_length,
 535                                                    node_trace_on,
 536                                                    &trace_bitmap);
 537                       pkts_new_session++;
 538                       /*
 539                        * If the next 5tuple is the same and we just added the session,
 540                        * the f_sess_id_next can not be ~0. Correct it.
 541                        */
 542                       if ((f_sess_id_next.as_u64 == ~0ULL)
 543                           && 0 == memcmp (&fa_5tuple[1], &fa_5tuple[0],
 544                                           sizeof (fa_5tuple[1])))
 545                         f_sess_id_next = f_sess_id;
 546                     }
 547                   else
 548                     {
 549                       action = 0;
 550                       b[0]->error =
 551                         error_node->errors
 552                         [ACL_FA_ERROR_ACL_TOO_MANY_SESSIONS];
 553                     }
 554                 }
 555
 556             }
 557
 558           {
 559             /* speculatively get the next0 */
 560             vnet_feature_next_u16 (&next[0], b[0]);
 561             /* if the action is not deny - then use that next */
 562             next[0] = action ? next[0] : 0;
 563           }
 564
 565           if (node_trace_on)    // PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
 566             {
 567               maybe_trace_buffer (vm, node, b[0], sw_if_index[0], lc_index0,
 568                                   next[0], match_acl_in_index,
 569                                   match_rule_index, &fa_5tuple[0], action,
 570                                   trace_bitmap);
 571             }
 572
 573           next++;
 574           b++;
 575           fa_5tuple++;
 576           sw_if_index++;
 577           hash++;
 578           n_left -= 1;
 579         }
 580     }
 581
 582   vlib_buffer_enqueue_to_next (vm, node, from, pw->nexts, frame->n_vectors);
 583
 584   /*
 585    * if we were had an acl match then we have a counter to increment.
 586    * else it is all zeroes, so this will be harmless.
 587    */
 588   vlib_increment_combined_counter (am->combined_acl_counters +
 589                                    saved_matched_acl_index,
 590                                    thread_index,
 591                                    saved_matched_ace_index,
 592                                    saved_packet_count, saved_byte_count);
 593
 594   vlib_node_increment_counter (vm, node->node_index,
 595                                ACL_FA_ERROR_ACL_CHECK, frame->n_vectors);
 596   vlib_node_increment_counter (vm, node->node_index,
 597                                ACL_FA_ERROR_ACL_EXIST_SESSION,
 598                                pkts_exist_session);
 599   vlib_node_increment_counter (vm, node->node_index,
 600                                ACL_FA_ERROR_ACL_NEW_SESSION,
 601                                pkts_new_session);
 602   vlib_node_increment_counter (vm, node->node_index,
 603                                ACL_FA_ERROR_ACL_PERMIT, pkts_acl_permit);
 604   return frame->n_vectors;
 605 }
 606
 607 always_inline uword
 608 acl_fa_outer_node_fn (vlib_main_t * vm,
 609                       vlib_node_runtime_t * node, vlib_frame_t * frame,
 610                       int is_ip6, int is_input, int is_l2_path,
 611                       int do_stateful_datapath)
 612 {
 613   acl_main_t *am = &acl_main;
 614
 615   acl_fa_node_common_prepare_fn (vm, node, frame, is_ip6, is_input,
 616                                  is_l2_path, do_stateful_datapath);
 617
 618   if (am->reclassify_sessions)
 619     {
 620       if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
 621         return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
 622                                      is_l2_path, do_stateful_datapath,
 623                                      1 /* trace */ ,
 624                                      1 /* reclassify */ );
 625       else
 626         return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
 627                                      is_l2_path, do_stateful_datapath, 0,
 628                                      1 /* reclassify */ );
 629     }
 630   else
 631     {
 632       if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
 633         return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
 634                                      is_l2_path, do_stateful_datapath,
 635                                      1 /* trace */ ,
 636                                      0);
 637       else
 638         return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
 639                                      is_l2_path, do_stateful_datapath, 0, 0);
 640     }
 641 }
 642
 643 always_inline uword
 644 acl_fa_node_fn (vlib_main_t * vm,
 645                 vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip6,
 646                 int is_input, int is_l2_path)
 647 {
 648   /* select the reclassify/no-reclassify version of the datapath */
 649   acl_main_t *am = &acl_main;
 650
 651   if (am->fa_sessions_hash_is_initialized)
 652     return acl_fa_outer_node_fn (vm, node, frame, is_ip6, is_input,
 653                                  is_l2_path, 1);
 654   else
 655     return acl_fa_outer_node_fn (vm, node, frame, is_ip6, is_input,
 656                                  is_l2_path, 0);
 657 }
 658
 659
 660 static u8 *
 661 format_fa_5tuple (u8 * s, va_list * args)
 662 {
 663   fa_5tuple_t *p5t = va_arg (*args, fa_5tuple_t *);
 664   void *paddr0;
 665   void *paddr1;
 666   void *format_address_func;
 667   void *ip_af;
 668   void *ip_frag_txt =
 669     p5t->pkt.is_nonfirst_fragment ? " non-initial fragment" : "";
 670
 671   if (p5t->pkt.is_ip6)
 672     {
 673       ip_af = "ip6";
 674       format_address_func = format_ip6_address;
 675       paddr0 = &p5t->ip6_addr[0];
 676       paddr1 = &p5t->ip6_addr[1];
 677     }
 678   else
 679     {
 680       ip_af = "ip4";
 681       format_address_func = format_ip4_address;
 682       paddr0 = &p5t->ip4_addr[0];
 683       paddr1 = &p5t->ip4_addr[1];
 684     }
 685
 686   s =
 687     format (s, "lc_index %d l3 %s%s ", p5t->pkt.lc_index, ip_af, ip_frag_txt);
 688   s =
 689     format (s, "%U -> %U ", format_address_func, paddr0, format_address_func,
 690             paddr1);
 691   s = format (s, "%U ", format_fa_session_l4_key, &p5t->l4);
 692   s = format (s, "tcp flags (%s) %02x rsvd %x",
 693               p5t->pkt.tcp_flags_valid ? "valid" : "invalid",
 694               p5t->pkt.tcp_flags, p5t->pkt.flags_reserved);
 695   return s;
 696 }
 697
 698 #ifndef CLIB_MARCH_VARIANT
 699 u8 *
 700 format_acl_plugin_5tuple (u8 * s, va_list * args)
 701 {
 702   return format_fa_5tuple (s, args);
 703 }
 704 #endif
 705
 706 /* packet trace format function */
 707 static u8 *
 708 format_acl_plugin_trace (u8 * s, va_list * args)
 709 {
 710   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
 711   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
 712   acl_fa_trace_t *t = va_arg (*args, acl_fa_trace_t *);
 713
 714   s =
 715     format (s,
 716             "acl-plugin: lc_index: %d, sw_if_index %d, next index %d, action: %d, match: acl %d rule %d trace_bits %08x\n"
 717             "  pkt info %016llx %016llx %016llx %016llx %016llx %016llx",
 718             t->lc_index, t->sw_if_index, t->next_index, t->action,
 719             t->match_acl_in_index, t->match_rule_index, t->trace_bitmap,
 720             t->packet_info[0], t->packet_info[1], t->packet_info[2],
 721             t->packet_info[3], t->packet_info[4], t->packet_info[5]);
 722
 723   /* Now also print out the packet_info in a form usable by humans */
 724   s = format (s, "\n   %U", format_fa_5tuple, t->packet_info);
 725   return s;
 726 }
 727
 728 /* *INDENT-OFF* */
 729
 730 static char *acl_fa_error_strings[] = {
 731 #define _(sym,string) string,
 732   foreach_acl_fa_error
 733 #undef _
 734 };
 735
 736 VLIB_NODE_FN (acl_in_l2_ip6_node) (vlib_main_t * vm,
 737                                    vlib_node_runtime_t * node,
 738                                    vlib_frame_t * frame)
 739 {
 740   return acl_fa_node_fn (vm, node, frame, 1, 1, 1);
 741 }
 742
 743 VLIB_NODE_FN (acl_in_l2_ip4_node) (vlib_main_t * vm,
 744                                    vlib_node_runtime_t * node,
 745                                    vlib_frame_t * frame)
 746 {
 747   return acl_fa_node_fn (vm, node, frame, 0, 1, 1);
 748 }
 749
 750 VLIB_NODE_FN (acl_out_l2_ip6_node) (vlib_main_t * vm,
 751                                     vlib_node_runtime_t * node,
 752                                     vlib_frame_t * frame)
 753 {
 754   return acl_fa_node_fn (vm, node, frame, 1, 0, 1);
 755 }
 756
 757 VLIB_NODE_FN (acl_out_l2_ip4_node) (vlib_main_t * vm,
 758                                     vlib_node_runtime_t * node,
 759                                     vlib_frame_t * frame)
 760 {
 761   return acl_fa_node_fn (vm, node, frame, 0, 0, 1);
 762 }
 763
 764 /**** L3 processing path nodes ****/
 765
 766 VLIB_NODE_FN (acl_in_fa_ip6_node) (vlib_main_t * vm,
 767                                    vlib_node_runtime_t * node,
 768                                    vlib_frame_t * frame)
 769 {
 770   return acl_fa_node_fn (vm, node, frame, 1, 1, 0);
 771 }
 772
 773 VLIB_NODE_FN (acl_in_fa_ip4_node) (vlib_main_t * vm,
 774                                    vlib_node_runtime_t * node,
 775                                    vlib_frame_t * frame)
 776 {
 777   return acl_fa_node_fn (vm, node, frame, 0, 1, 0);
 778 }
 779
 780 VLIB_NODE_FN (acl_out_fa_ip6_node) (vlib_main_t * vm,
 781                                     vlib_node_runtime_t * node,
 782                                     vlib_frame_t * frame)
 783 {
 784   return acl_fa_node_fn (vm, node, frame, 1, 0, 0);
 785 }
 786
 787 VLIB_NODE_FN (acl_out_fa_ip4_node) (vlib_main_t * vm,
 788                                     vlib_node_runtime_t * node,
 789                                     vlib_frame_t * frame)
 790 {
 791   return acl_fa_node_fn (vm, node, frame, 0, 0, 0);
 792 }
 793
 794 VLIB_REGISTER_NODE (acl_in_l2_ip6_node) =
 795 {
 796   .name = "acl-plugin-in-ip6-l2",
 797   .vector_size = sizeof (u32),
 798   .format_trace = format_acl_plugin_trace,
 799   .type = VLIB_NODE_TYPE_INTERNAL,
 800   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 801   .error_strings = acl_fa_error_strings,
 802   .n_next_nodes = ACL_FA_N_NEXT,
 803   .next_nodes =
 804   {
 805     [ACL_FA_ERROR_DROP] = "error-drop",
 806   }
 807 };
 808
 809 VNET_FEATURE_INIT (acl_in_l2_ip6_fa_feature, static) =
 810 {
 811   .arc_name = "l2-input-ip6",
 812   .node_name = "acl-plugin-in-ip6-l2",
 813   .runs_before = VNET_FEATURES ("l2-input-feat-arc-end"),
 814 };
 815
 816 VLIB_REGISTER_NODE (acl_in_l2_ip4_node) =
 817 {
 818   .name = "acl-plugin-in-ip4-l2",
 819   .vector_size = sizeof (u32),
 820   .format_trace = format_acl_plugin_trace,
 821   .type = VLIB_NODE_TYPE_INTERNAL,
 822   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 823   .error_strings = acl_fa_error_strings,
 824   .n_next_nodes = ACL_FA_N_NEXT,
 825   .next_nodes =
 826   {
 827     [ACL_FA_ERROR_DROP] = "error-drop",
 828   }
 829 };
 830
 831 VNET_FEATURE_INIT (acl_in_l2_ip4_fa_feature, static) =
 832 {
 833   .arc_name = "l2-input-ip4",
 834   .node_name = "acl-plugin-in-ip4-l2",
 835   .runs_before = VNET_FEATURES ("l2-input-feat-arc-end"),
 836 };
 837
 838
 839 VLIB_REGISTER_NODE (acl_out_l2_ip6_node) =
 840 {
 841   .name = "acl-plugin-out-ip6-l2",
 842   .vector_size = sizeof (u32),
 843   .format_trace = format_acl_plugin_trace,
 844   .type = VLIB_NODE_TYPE_INTERNAL,
 845   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 846   .error_strings = acl_fa_error_strings,
 847   .n_next_nodes = ACL_FA_N_NEXT,
 848   .next_nodes =
 849   {
 850     [ACL_FA_ERROR_DROP] = "error-drop",
 851   }
 852 };
 853
 854 VNET_FEATURE_INIT (acl_out_l2_ip6_fa_feature, static) =
 855 {
 856   .arc_name = "l2-output-ip6",
 857   .node_name = "acl-plugin-out-ip6-l2",
 858   .runs_before = VNET_FEATURES ("l2-output-feat-arc-end"),
 859 };
 860
 861
 862 VLIB_REGISTER_NODE (acl_out_l2_ip4_node) =
 863 {
 864   .name = "acl-plugin-out-ip4-l2",
 865   .vector_size = sizeof (u32),
 866   .format_trace = format_acl_plugin_trace,
 867   .type = VLIB_NODE_TYPE_INTERNAL,
 868   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 869   .error_strings = acl_fa_error_strings,
 870   .n_next_nodes = ACL_FA_N_NEXT,
 871   .next_nodes =
 872   {
 873     [ACL_FA_ERROR_DROP] = "error-drop",
 874   }
 875 };
 876
 877 VNET_FEATURE_INIT (acl_out_l2_ip4_fa_feature, static) =
 878 {
 879   .arc_name = "l2-output-ip4",
 880   .node_name = "acl-plugin-out-ip4-l2",
 881   .runs_before = VNET_FEATURES ("l2-output-feat-arc-end"),
 882 };
 883
 884
 885 VLIB_REGISTER_NODE (acl_in_fa_ip6_node) =
 886 {
 887   .name = "acl-plugin-in-ip6-fa",
 888   .vector_size = sizeof (u32),
 889   .format_trace = format_acl_plugin_trace,
 890   .type = VLIB_NODE_TYPE_INTERNAL,
 891   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 892   .error_strings = acl_fa_error_strings,
 893   .n_next_nodes = ACL_FA_N_NEXT,
 894   .next_nodes =
 895   {
 896     [ACL_FA_ERROR_DROP] = "error-drop",
 897   }
 898 };
 899
 900 VNET_FEATURE_INIT (acl_in_ip6_fa_feature, static) =
 901 {
 902   .arc_name = "ip6-unicast",
 903   .node_name = "acl-plugin-in-ip6-fa",
 904   .runs_before = VNET_FEATURES ("ip6-flow-classify"),
 905 };
 906
 907 VLIB_REGISTER_NODE (acl_in_fa_ip4_node) =
 908 {
 909   .name = "acl-plugin-in-ip4-fa",
 910   .vector_size = sizeof (u32),
 911   .format_trace = format_acl_plugin_trace,
 912   .type = VLIB_NODE_TYPE_INTERNAL,
 913   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 914   .error_strings = acl_fa_error_strings,
 915   .n_next_nodes = ACL_FA_N_NEXT,
 916   .next_nodes =
 917   {
 918     [ACL_FA_ERROR_DROP] = "error-drop",
 919   }
 920 };
 921
 922 VNET_FEATURE_INIT (acl_in_ip4_fa_feature, static) =
 923 {
 924   .arc_name = "ip4-unicast",
 925   .node_name = "acl-plugin-in-ip4-fa",
 926   .runs_before = VNET_FEATURES ("ip4-flow-classify"),
 927 };
 928
 929
 930 VLIB_REGISTER_NODE (acl_out_fa_ip6_node) =
 931 {
 932   .name = "acl-plugin-out-ip6-fa",
 933   .vector_size = sizeof (u32),
 934   .format_trace = format_acl_plugin_trace,
 935   .type = VLIB_NODE_TYPE_INTERNAL,
 936   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 937   .error_strings = acl_fa_error_strings,
 938   .n_next_nodes = ACL_FA_N_NEXT,
 939   .next_nodes =
 940   {
 941     [ACL_FA_ERROR_DROP] = "error-drop",
 942   }
 943 };
 944
 945 VNET_FEATURE_INIT (acl_out_ip6_fa_feature, static) =
 946 {
 947   .arc_name = "ip6-output",
 948   .node_name = "acl-plugin-out-ip6-fa",
 949   .runs_before = VNET_FEATURES ("interface-output"),
 950 };
 951
 952 VLIB_REGISTER_NODE (acl_out_fa_ip4_node) =
 953 {
 954   .name = "acl-plugin-out-ip4-fa",
 955   .vector_size = sizeof (u32),
 956   .format_trace = format_acl_plugin_trace,
 957   .type = VLIB_NODE_TYPE_INTERNAL,
 958   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 959   .error_strings = acl_fa_error_strings,
 960   .n_next_nodes = ACL_FA_N_NEXT,
 961     /* edit / add dispositions here */
 962   .next_nodes =
 963   {
 964     [ACL_FA_ERROR_DROP] = "error-drop",
 965   }
 966 };
 967
 968 VNET_FEATURE_INIT (acl_out_ip4_fa_feature, static) =
 969 {
 970   .arc_name = "ip4-output",
 971   .node_name = "acl-plugin-out-ip4-fa",
 972   .runs_before = VNET_FEATURES ("interface-output"),
 973 };
 974
 975 /* *INDENT-ON* */
 976
 977 /*
 978  * fd.io coding-style-patch-verification: ON
 979  *
 980  * Local Variables:
 981  * eval: (c-set-style "gnu")
 982  * End:
 983  */