src/plugins/acl/dataplane_node.c

   1 /*
   2  * Copyright (c) 2016-2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #include <stddef.h>
  16 #include <netinet/in.h>
  17
  18 #include <vlib/vlib.h>
  19 #include <vnet/vnet.h>
  20 #include <vppinfra/error.h>
  21
  22
  23 #include <acl/acl.h>
  24 #include <vnet/ip/icmp46_packet.h>
  25
  26 #include <plugins/acl/fa_node.h>
  27 #include <plugins/acl/acl.h>
  28 #include <plugins/acl/lookup_context.h>
  29 #include <plugins/acl/public_inlines.h>
  30 #include <plugins/acl/session_inlines.h>
  31
  32 #include <vppinfra/bihash_40_8.h>
  33 #include <vppinfra/bihash_template.h>
  34
  35 typedef struct
  36 {
  37   u32 next_index;
  38   u32 sw_if_index;
  39   u32 lc_index;
  40   u32 match_acl_in_index;
  41   u32 match_rule_index;
  42   u64 packet_info[6];
  43   u32 trace_bitmap;
  44   u8 action;
  45 } acl_fa_trace_t;
  46
  47 #define foreach_acl_fa_error \
  48 _(ACL_DROP, "ACL deny packets")  \
  49 _(ACL_PERMIT, "ACL permit packets")  \
  50 _(ACL_NEW_SESSION, "new sessions added") \
  51 _(ACL_EXIST_SESSION, "existing session packets") \
  52 _(ACL_CHECK, "checked packets") \
  53 _(ACL_RESTART_SESSION_TIMER, "restart session timer") \
  54 _(ACL_TOO_MANY_SESSIONS, "too many sessions to add new") \
  55 /* end  of errors */
  56
  57 typedef enum
  58 {
  59 #define _(sym,str) ACL_FA_ERROR_##sym,
  60   foreach_acl_fa_error
  61 #undef _
  62     ACL_FA_N_ERROR,
  63 } acl_fa_error_t;
  64
  65
  66 always_inline u16
  67 get_current_policy_epoch (acl_main_t * am, int is_input, u32 sw_if_index0)
  68 {
  69   u32 **p_epoch_vec =
  70     is_input ? &am->input_policy_epoch_by_sw_if_index :
  71     &am->output_policy_epoch_by_sw_if_index;
  72   u16 current_policy_epoch =
  73     sw_if_index0 < vec_len (*p_epoch_vec) ? vec_elt (*p_epoch_vec,
  74                                                      sw_if_index0)
  75     : (is_input * FA_POLICY_EPOCH_IS_INPUT);
  76   return current_policy_epoch;
  77 }
  78
  79 always_inline void
  80 maybe_trace_buffer (vlib_main_t * vm, vlib_node_runtime_t * node,
  81                     vlib_buffer_t * b, u32 sw_if_index0, u32 lc_index0,
  82                     u16 next0, int match_acl_in_index, int match_rule_index,
  83                     fa_5tuple_t * fa_5tuple, u8 action, u32 trace_bitmap)
  84 {
  85   if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
  86     {
  87       acl_fa_trace_t *t = vlib_add_trace (vm, node, b, sizeof (*t));
  88       t->sw_if_index = sw_if_index0;
  89       t->lc_index = lc_index0;
  90       t->next_index = next0;
  91       t->match_acl_in_index = match_acl_in_index;
  92       t->match_rule_index = match_rule_index;
  93       t->packet_info[0] = fa_5tuple->kv_40_8.key[0];
  94       t->packet_info[1] = fa_5tuple->kv_40_8.key[1];
  95       t->packet_info[2] = fa_5tuple->kv_40_8.key[2];
  96       t->packet_info[3] = fa_5tuple->kv_40_8.key[3];
  97       t->packet_info[4] = fa_5tuple->kv_40_8.key[4];
  98       t->packet_info[5] = fa_5tuple->kv_40_8.value;
  99       t->action = action;
 100       t->trace_bitmap = trace_bitmap;
 101     }
 102 }
 103
 104
 105 always_inline int
 106 stale_session_deleted (acl_main_t * am, int is_input,
 107                        acl_fa_per_worker_data_t * pw, u64 now,
 108                        u32 sw_if_index0, fa_full_session_id_t f_sess_id)
 109 {
 110   u16 current_policy_epoch =
 111     get_current_policy_epoch (am, is_input, sw_if_index0);
 112
 113   /* if the MSB of policy epoch matches but not the LSB means it is a stale session */
 114   if ((0 ==
 115        ((current_policy_epoch ^
 116          f_sess_id.intf_policy_epoch) &
 117         FA_POLICY_EPOCH_IS_INPUT))
 118       && (current_policy_epoch != f_sess_id.intf_policy_epoch))
 119     {
 120       /* delete session and increment the counter */
 121       vec_validate (pw->fa_session_epoch_change_by_sw_if_index, sw_if_index0);
 122       vec_elt (pw->fa_session_epoch_change_by_sw_if_index, sw_if_index0)++;
 123       if (acl_fa_conn_list_delete_session (am, f_sess_id, now))
 124         {
 125           /* delete the session only if we were able to unlink it */
 126           acl_fa_two_stage_delete_session (am, sw_if_index0, f_sess_id, now);
 127         }
 128       return 1;
 129     }
 130   else
 131     return 0;
 132 }
 133
 134
 135
 136
 137
 138 always_inline void
 139 get_sw_if_index_xN (int vector_sz, int is_input, vlib_buffer_t ** b,
 140                     u32 * out_sw_if_index)
 141 {
 142   int ii;
 143   for (ii = 0; ii < vector_sz; ii++)
 144     if (is_input)
 145       out_sw_if_index[ii] = vnet_buffer (b[ii])->sw_if_index[VLIB_RX];
 146     else
 147       out_sw_if_index[ii] = vnet_buffer (b[ii])->sw_if_index[VLIB_TX];
 148 }
 149
 150 always_inline void
 151 fill_5tuple_xN (int vector_sz, acl_main_t * am, int is_ip6, int is_input,
 152                 int is_l2_path, vlib_buffer_t ** b, u32 * sw_if_index,
 153                 fa_5tuple_t * out_fa_5tuple)
 154 {
 155   int ii;
 156   for (ii = 0; ii < vector_sz; ii++)
 157     acl_fill_5tuple (am, sw_if_index[ii], b[ii], is_ip6,
 158                      is_input, is_l2_path, &out_fa_5tuple[ii]);
 159 }
 160
 161 always_inline void
 162 make_session_hash_xN (int vector_sz, acl_main_t * am, int is_ip6,
 163                       u32 * sw_if_index, fa_5tuple_t * fa_5tuple,
 164                       u64 * out_hash)
 165 {
 166   int ii;
 167   for (ii = 0; ii < vector_sz; ii++)
 168     out_hash[ii] =
 169       acl_fa_make_session_hash (am, is_ip6, sw_if_index[ii], &fa_5tuple[ii]);
 170 }
 171
 172 always_inline void
 173 prefetch_session_entry (acl_main_t * am, fa_full_session_id_t f_sess_id)
 174 {
 175   fa_session_t *sess = get_session_ptr_no_check (am, f_sess_id.thread_index,
 176                                                  f_sess_id.session_index);
 177   CLIB_PREFETCH (sess, sizeof (*sess), STORE);
 178 }
 179
 180 always_inline u8
 181 process_established_session (vlib_main_t * vm, acl_main_t * am,
 182                              u32 counter_node_index, int is_input, u64 now,
 183                              fa_full_session_id_t f_sess_id,
 184                              u32 * sw_if_index, fa_5tuple_t * fa_5tuple,
 185                              u32 pkt_len, int node_trace_on,
 186                              u32 * trace_bitmap)
 187 {
 188   u8 action = 0;
 189   fa_session_t *sess = get_session_ptr_no_check (am, f_sess_id.thread_index,
 190                                                  f_sess_id.session_index);
 191
 192   int old_timeout_type = fa_session_get_timeout_type (am, sess);
 193   action =
 194     acl_fa_track_session (am, is_input, sw_if_index[0], now,
 195                           sess, &fa_5tuple[0], pkt_len);
 196   int new_timeout_type = fa_session_get_timeout_type (am, sess);
 197   /* Tracking might have changed the session timeout type, e.g. from transient to established */
 198   if (PREDICT_FALSE (old_timeout_type != new_timeout_type))
 199     {
 200       acl_fa_restart_timer_for_session (am, now, f_sess_id);
 201       vlib_node_increment_counter (vm, counter_node_index,
 202                                    ACL_FA_ERROR_ACL_RESTART_SESSION_TIMER, 1);
 203       if (node_trace_on)
 204         *trace_bitmap |=
 205           0x00010000 + ((0xff & old_timeout_type) << 8) +
 206           (0xff & new_timeout_type);
 207     }
 208   /*
 209    * I estimate the likelihood to be very low - the VPP needs
 210    * to have >64K interfaces to start with and then on
 211    * exactly 64K indices apart needs to be exactly the same
 212    * 5-tuple... Anyway, since this probability is nonzero -
 213    * print an error and drop the unlucky packet.
 214    * If this shows up in real world, we would need to bump
 215    * the hash key length.
 216    */
 217   if (PREDICT_FALSE (sess->sw_if_index != sw_if_index[0]))
 218     {
 219       clib_warning
 220         ("BUG: session LSB16(sw_if_index)=%d and 5-tuple=%d collision!",
 221          sess->sw_if_index, sw_if_index[0]);
 222       action = 0;
 223     }
 224   return action;
 225
 226 }
 227
 228 #define ACL_PLUGIN_VECTOR_SIZE 4
 229 #define ACL_PLUGIN_PREFETCH_GAP 3
 230
 231 always_inline void
 232 acl_fa_node_common_prepare_fn (vlib_main_t * vm,
 233                                vlib_node_runtime_t * node,
 234                                vlib_frame_t * frame, int is_ip6, int is_input,
 235                                int is_l2_path, int with_stateful_datapath)
 236         /* , int node_trace_on,
 237            int reclassify_sessions) */
 238 {
 239   u32 n_left, *from;
 240   acl_main_t *am = &acl_main;
 241   uword thread_index = os_get_thread_index ();
 242   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 243
 244   vlib_buffer_t **b;
 245   u32 *sw_if_index;
 246   fa_5tuple_t *fa_5tuple;
 247   u64 *hash;
 248
 249
 250
 251   from = vlib_frame_vector_args (frame);
 252   vlib_get_buffers (vm, from, pw->bufs, frame->n_vectors);
 253
 254   /* set the initial values for the current buffer the next pointers */
 255   b = pw->bufs;
 256   sw_if_index = pw->sw_if_indices;
 257   fa_5tuple = pw->fa_5tuples;
 258   hash = pw->hashes;
 259
 260
 261   /*
 262    * fill the sw_if_index, 5tuple and session hash,
 263    * First in strides of size ACL_PLUGIN_VECTOR_SIZE,
 264    * with buffer prefetch being
 265    * ACL_PLUGIN_PREFETCH_GAP * ACL_PLUGIN_VECTOR_SIZE entries
 266    * in front. Then with a simple single loop.
 267    */
 268
 269   n_left = frame->n_vectors;
 270   while (n_left >= (ACL_PLUGIN_PREFETCH_GAP + 1) * ACL_PLUGIN_VECTOR_SIZE)
 271     {
 272       const int vec_sz = ACL_PLUGIN_VECTOR_SIZE;
 273       {
 274         int ii;
 275         for (ii = ACL_PLUGIN_PREFETCH_GAP * vec_sz;
 276              ii < (ACL_PLUGIN_PREFETCH_GAP + 1) * vec_sz; ii++)
 277           {
 278             clib_prefetch_load (b[ii]);
 279             CLIB_PREFETCH (b[ii]->data, 2 * CLIB_CACHE_LINE_BYTES, LOAD);
 280           }
 281       }
 282
 283
 284       get_sw_if_index_xN (vec_sz, is_input, b, sw_if_index);
 285       fill_5tuple_xN (vec_sz, am, is_ip6, is_input, is_l2_path, &b[0],
 286                       &sw_if_index[0], &fa_5tuple[0]);
 287       if (with_stateful_datapath)
 288         make_session_hash_xN (vec_sz, am, is_ip6, &sw_if_index[0],
 289                               &fa_5tuple[0], &hash[0]);
 290
 291       n_left -= vec_sz;
 292
 293       fa_5tuple += vec_sz;
 294       b += vec_sz;
 295       sw_if_index += vec_sz;
 296       hash += vec_sz;
 297     }
 298
 299   while (n_left > 0)
 300     {
 301       const int vec_sz = 1;
 302
 303       get_sw_if_index_xN (vec_sz, is_input, b, sw_if_index);
 304       fill_5tuple_xN (vec_sz, am, is_ip6, is_input, is_l2_path, &b[0],
 305                       &sw_if_index[0], &fa_5tuple[0]);
 306       if (with_stateful_datapath)
 307         make_session_hash_xN (vec_sz, am, is_ip6, &sw_if_index[0],
 308                               &fa_5tuple[0], &hash[0]);
 309
 310       n_left -= vec_sz;
 311
 312       fa_5tuple += vec_sz;
 313       b += vec_sz;
 314       sw_if_index += vec_sz;
 315       hash += vec_sz;
 316     }
 317 }
 318
 319
 320 always_inline uword
 321 acl_fa_inner_node_fn (vlib_main_t * vm,
 322                       vlib_node_runtime_t * node, vlib_frame_t * frame,
 323                       int is_ip6, int is_input, int is_l2_path,
 324                       int with_stateful_datapath, int node_trace_on,
 325                       int reclassify_sessions)
 326 {
 327   u32 n_left;
 328   u32 pkts_exist_session = 0;
 329   u32 pkts_new_session = 0;
 330   u32 pkts_acl_permit = 0;
 331   u32 trace_bitmap = 0;
 332   acl_main_t *am = &acl_main;
 333   vlib_node_runtime_t *error_node;
 334   vlib_error_t no_error_existing_session;
 335   u64 now = clib_cpu_time_now ();
 336   uword thread_index = os_get_thread_index ();
 337   acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
 338
 339   u16 *next;
 340   vlib_buffer_t **b;
 341   u32 *sw_if_index;
 342   fa_5tuple_t *fa_5tuple;
 343   u64 *hash;
 344   /* for the delayed counters */
 345   u32 saved_matched_acl_index = 0;
 346   u32 saved_matched_ace_index = 0;
 347   u32 saved_packet_count = 0;
 348   u32 saved_byte_count = 0;
 349
 350   error_node = vlib_node_get_runtime (vm, node->node_index);
 351   no_error_existing_session =
 352     error_node->errors[ACL_FA_ERROR_ACL_EXIST_SESSION];
 353
 354   b = pw->bufs;
 355   next = pw->nexts;
 356   sw_if_index = pw->sw_if_indices;
 357   fa_5tuple = pw->fa_5tuples;
 358   hash = pw->hashes;
 359
 360   /*
 361    * Now the "hard" work of session lookups and ACL lookups for new sessions.
 362    * Due to the complexity, do it for the time being in single loop with
 363    * the pipeline of three prefetches:
 364    *    1) bucket for the session bihash
 365    *    2) data for the session bihash
 366    *    3) worker session record
 367    */
 368
 369   fa_full_session_id_t f_sess_id_next = {.as_u64 = ~0ULL };
 370
 371   /* find the "next" session so we can kickstart the pipeline */
 372   if (with_stateful_datapath)
 373     acl_fa_find_session_with_hash (am, is_ip6, sw_if_index[0], hash[0],
 374                                    &fa_5tuple[0], &f_sess_id_next.as_u64);
 375
 376   n_left = frame->n_vectors;
 377   while (n_left > 0)
 378     {
 379       u8 action = 0;
 380       u32 lc_index0 = ~0;
 381       int acl_check_needed = 1;
 382       u32 match_acl_in_index = ~0;
 383       u32 match_acl_pos = ~0;
 384       u32 match_rule_index = ~0;
 385
 386       next[0] = 0;              /* drop by default */
 387
 388       /* Try to match an existing session first */
 389
 390       if (with_stateful_datapath)
 391         {
 392           fa_full_session_id_t f_sess_id = f_sess_id_next;
 393           switch (n_left)
 394             {
 395             default:
 396               acl_fa_prefetch_session_bucket_for_hash (am, is_ip6, hash[5]);
 397               /* fallthrough */
 398             case 5:
 399             case 4:
 400               acl_fa_prefetch_session_data_for_hash (am, is_ip6, hash[3]);
 401               /* fallthrough */
 402             case 3:
 403             case 2:
 404               acl_fa_find_session_with_hash (am, is_ip6, sw_if_index[1],
 405                                              hash[1], &fa_5tuple[1],
 406                                              &f_sess_id_next.as_u64);
 407               if (f_sess_id_next.as_u64 != ~0ULL)
 408                 {
 409                   prefetch_session_entry (am, f_sess_id_next);
 410                 }
 411               /* fallthrough */
 412             case 1:
 413               if (f_sess_id.as_u64 != ~0ULL)
 414                 {
 415                   if (node_trace_on)
 416                     {
 417                       trace_bitmap |= 0x80000000;
 418                     }
 419                   ASSERT (f_sess_id.thread_index < vlib_get_n_threads ());
 420                   b[0]->error = no_error_existing_session;
 421                   acl_check_needed = 0;
 422                   pkts_exist_session += 1;
 423                   action =
 424                     process_established_session (vm, am, node->node_index,
 425                                                  is_input, now, f_sess_id,
 426                                                  &sw_if_index[0],
 427                                                  &fa_5tuple[0],
 428                                                  b[0]->current_length,
 429                                                  node_trace_on,
 430                                                  &trace_bitmap);
 431
 432                   /* expose the session id to the tracer */
 433                   if (node_trace_on)
 434                     {
 435                       match_rule_index = f_sess_id.session_index;
 436                     }
 437
 438                   if (reclassify_sessions)
 439                     {
 440                       if (PREDICT_FALSE
 441                           (stale_session_deleted
 442                            (am, is_input, pw, now, sw_if_index[0],
 443                             f_sess_id)))
 444                         {
 445                           acl_check_needed = 1;
 446                           if (node_trace_on)
 447                             {
 448                               trace_bitmap |= 0x40000000;
 449                             }
 450                           /*
 451                            * If we have just deleted the session, and the next
 452                            * buffer is the same 5-tuple, that session prediction
 453                            * is wrong, correct it.
 454                            */
 455                           if ((f_sess_id_next.as_u64 != ~0ULL)
 456                               && 0 == memcmp (&fa_5tuple[1], &fa_5tuple[0],
 457                                               sizeof (fa_5tuple[1])))
 458                             f_sess_id_next.as_u64 = ~0ULL;
 459                         }
 460                     }
 461                 }
 462             }
 463
 464           if (acl_check_needed)
 465             {
 466               if (is_input)
 467                 lc_index0 = am->input_lc_index_by_sw_if_index[sw_if_index[0]];
 468               else
 469                 lc_index0 =
 470                   am->output_lc_index_by_sw_if_index[sw_if_index[0]];
 471
 472               action = 0;       /* deny by default */
 473               int is_match = acl_plugin_match_5tuple_inline (am, lc_index0,
 474                                                              (fa_5tuple_opaque_t *) & fa_5tuple[0], is_ip6,
 475                                                              &action,
 476                                                              &match_acl_pos,
 477                                                              &match_acl_in_index,
 478                                                              &match_rule_index,
 479                                                              &trace_bitmap);
 480               if (PREDICT_FALSE
 481                   (is_match && am->interface_acl_counters_enabled))
 482                 {
 483                   u32 buf_len = vlib_buffer_length_in_chain (vm, b[0]);
 484                   vlib_increment_combined_counter (am->combined_acl_counters +
 485                                                    saved_matched_acl_index,
 486                                                    thread_index,
 487                                                    saved_matched_ace_index,
 488                                                    saved_packet_count,
 489                                                    saved_byte_count);
 490                   saved_matched_acl_index = match_acl_in_index;
 491                   saved_matched_ace_index = match_rule_index;
 492                   saved_packet_count = 1;
 493                   saved_byte_count = buf_len;
 494                   /* prefetch the counter that we are going to increment */
 495                   vlib_prefetch_combined_counter (am->combined_acl_counters +
 496                                                   saved_matched_acl_index,
 497                                                   thread_index,
 498                                                   saved_matched_ace_index);
 499                 }
 500
 501               b[0]->error = error_node->errors[action];
 502
 503               if (1 == action)
 504                 pkts_acl_permit++;
 505
 506               if (2 == action)
 507                 {
 508                   if (!acl_fa_can_add_session (am, is_input, sw_if_index[0]))
 509                     acl_fa_try_recycle_session (am, is_input,
 510                                                 thread_index,
 511                                                 sw_if_index[0], now);
 512
 513                   if (acl_fa_can_add_session (am, is_input, sw_if_index[0]))
 514                     {
 515                       u16 current_policy_epoch =
 516                         get_current_policy_epoch (am, is_input,
 517                                                   sw_if_index[0]);
 518                       fa_full_session_id_t f_sess_id =
 519                         acl_fa_add_session (am, is_input, is_ip6,
 520                                             sw_if_index[0],
 521                                             now, &fa_5tuple[0],
 522                                             current_policy_epoch);
 523
 524                       /* perform the accounting for the newly added session */
 525                       process_established_session (vm, am,
 526                                                    node->node_index,
 527                                                    is_input, now,
 528                                                    f_sess_id,
 529                                                    &sw_if_index[0],
 530                                                    &fa_5tuple[0],
 531                                                    b[0]->current_length,
 532                                                    node_trace_on,
 533                                                    &trace_bitmap);
 534                       pkts_new_session++;
 535                       /*
 536                        * If the next 5tuple is the same and we just added the session,
 537                        * the f_sess_id_next can not be ~0. Correct it.
 538                        */
 539                       if ((f_sess_id_next.as_u64 == ~0ULL)
 540                           && 0 == memcmp (&fa_5tuple[1], &fa_5tuple[0],
 541                                           sizeof (fa_5tuple[1])))
 542                         f_sess_id_next = f_sess_id;
 543                     }
 544                   else
 545                     {
 546                       action = 0;
 547                       b[0]->error =
 548                         error_node->errors
 549                         [ACL_FA_ERROR_ACL_TOO_MANY_SESSIONS];
 550                     }
 551                 }
 552
 553             }
 554
 555           {
 556             /* speculatively get the next0 */
 557             vnet_feature_next_u16 (&next[0], b[0]);
 558             /* if the action is not deny - then use that next */
 559             next[0] = action ? next[0] : 0;
 560           }
 561
 562           if (node_trace_on)    // PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
 563             {
 564               maybe_trace_buffer (vm, node, b[0], sw_if_index[0], lc_index0,
 565                                   next[0], match_acl_in_index,
 566                                   match_rule_index, &fa_5tuple[0], action,
 567                                   trace_bitmap);
 568             }
 569
 570           next++;
 571           b++;
 572           fa_5tuple++;
 573           sw_if_index++;
 574           hash++;
 575           n_left -= 1;
 576         }
 577     }
 578
 579   /*
 580    * if we were had an acl match then we have a counter to increment.
 581    * else it is all zeroes, so this will be harmless.
 582    */
 583   vlib_increment_combined_counter (am->combined_acl_counters +
 584                                    saved_matched_acl_index,
 585                                    thread_index,
 586                                    saved_matched_ace_index,
 587                                    saved_packet_count, saved_byte_count);
 588
 589   vlib_node_increment_counter (vm, node->node_index,
 590                                ACL_FA_ERROR_ACL_CHECK, frame->n_vectors);
 591   vlib_node_increment_counter (vm, node->node_index,
 592                                ACL_FA_ERROR_ACL_EXIST_SESSION,
 593                                pkts_exist_session);
 594   vlib_node_increment_counter (vm, node->node_index,
 595                                ACL_FA_ERROR_ACL_NEW_SESSION,
 596                                pkts_new_session);
 597   vlib_node_increment_counter (vm, node->node_index,
 598                                ACL_FA_ERROR_ACL_PERMIT, pkts_acl_permit);
 599   return frame->n_vectors;
 600 }
 601
 602 always_inline uword
 603 acl_fa_outer_node_fn (vlib_main_t * vm,
 604                       vlib_node_runtime_t * node, vlib_frame_t * frame,
 605                       int is_ip6, int is_input, int is_l2_path,
 606                       int do_stateful_datapath)
 607 {
 608   acl_main_t *am = &acl_main;
 609
 610   acl_fa_node_common_prepare_fn (vm, node, frame, is_ip6, is_input,
 611                                  is_l2_path, do_stateful_datapath);
 612
 613   if (am->reclassify_sessions)
 614     {
 615       if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
 616         return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
 617                                      is_l2_path, do_stateful_datapath,
 618                                      1 /* trace */ ,
 619                                      1 /* reclassify */ );
 620       else
 621         return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
 622                                      is_l2_path, do_stateful_datapath, 0,
 623                                      1 /* reclassify */ );
 624     }
 625   else
 626     {
 627       if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
 628         return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
 629                                      is_l2_path, do_stateful_datapath,
 630                                      1 /* trace */ ,
 631                                      0);
 632       else
 633         return acl_fa_inner_node_fn (vm, node, frame, is_ip6, is_input,
 634                                      is_l2_path, do_stateful_datapath, 0, 0);
 635     }
 636 }
 637
 638 always_inline uword
 639 acl_fa_node_fn (vlib_main_t * vm,
 640                 vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip6,
 641                 int is_input, int is_l2_path)
 642 {
 643   /* select the reclassify/no-reclassify version of the datapath */
 644   acl_main_t *am = &acl_main;
 645   acl_fa_per_worker_data_t *pw = &am->per_worker_data[vm->thread_index];
 646   uword rv;
 647
 648   if (am->fa_sessions_hash_is_initialized)
 649     rv = acl_fa_outer_node_fn (vm, node, frame, is_ip6, is_input,
 650                                is_l2_path, 1);
 651   else
 652     rv = acl_fa_outer_node_fn (vm, node, frame, is_ip6, is_input,
 653                                is_l2_path, 0);
 654
 655   vlib_buffer_enqueue_to_next (vm, node, vlib_frame_vector_args (frame),
 656                                pw->nexts, frame->n_vectors);
 657   return rv;
 658 }
 659
 660
 661 static u8 *
 662 format_fa_5tuple (u8 * s, va_list * args)
 663 {
 664   fa_5tuple_t *p5t = va_arg (*args, fa_5tuple_t *);
 665   void *paddr0;
 666   void *paddr1;
 667   void *format_address_func;
 668   void *ip_af;
 669   void *ip_frag_txt =
 670     p5t->pkt.is_nonfirst_fragment ? " non-initial fragment" : "";
 671
 672   if (p5t->pkt.is_ip6)
 673     {
 674       ip_af = "ip6";
 675       format_address_func = format_ip6_address;
 676       paddr0 = &p5t->ip6_addr[0];
 677       paddr1 = &p5t->ip6_addr[1];
 678     }
 679   else
 680     {
 681       ip_af = "ip4";
 682       format_address_func = format_ip4_address;
 683       paddr0 = &p5t->ip4_addr[0];
 684       paddr1 = &p5t->ip4_addr[1];
 685     }
 686
 687   s =
 688     format (s, "lc_index %d l3 %s%s ", p5t->pkt.lc_index, ip_af, ip_frag_txt);
 689   s =
 690     format (s, "%U -> %U ", format_address_func, paddr0, format_address_func,
 691             paddr1);
 692   s = format (s, "%U ", format_fa_session_l4_key, &p5t->l4);
 693   s = format (s, "tcp flags (%s) %02x rsvd %x",
 694               p5t->pkt.tcp_flags_valid ? "valid" : "invalid",
 695               p5t->pkt.tcp_flags, p5t->pkt.flags_reserved);
 696   return s;
 697 }
 698
 699 #ifndef CLIB_MARCH_VARIANT
 700 u8 *
 701 format_acl_plugin_5tuple (u8 * s, va_list * args)
 702 {
 703   return format_fa_5tuple (s, args);
 704 }
 705 #endif
 706
 707 /* packet trace format function */
 708 static u8 *
 709 format_acl_plugin_trace (u8 * s, va_list * args)
 710 {
 711   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
 712   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
 713   acl_fa_trace_t *t = va_arg (*args, acl_fa_trace_t *);
 714
 715   s =
 716     format (s,
 717             "acl-plugin: lc_index: %d, sw_if_index %d, next index %d, action: %d, match: acl %d rule %d trace_bits %08x\n"
 718             "  pkt info %016llx %016llx %016llx %016llx %016llx %016llx",
 719             t->lc_index, t->sw_if_index, t->next_index, t->action,
 720             t->match_acl_in_index, t->match_rule_index, t->trace_bitmap,
 721             t->packet_info[0], t->packet_info[1], t->packet_info[2],
 722             t->packet_info[3], t->packet_info[4], t->packet_info[5]);
 723
 724   /* Now also print out the packet_info in a form usable by humans */
 725   s = format (s, "\n   %U", format_fa_5tuple, t->packet_info);
 726   return s;
 727 }
 728
 729
 730 static char *acl_fa_error_strings[] = {
 731 #define _(sym,string) string,
 732   foreach_acl_fa_error
 733 #undef _
 734 };
 735
 736 VLIB_NODE_FN (acl_in_l2_ip6_node) (vlib_main_t * vm,
 737                                    vlib_node_runtime_t * node,
 738                                    vlib_frame_t * frame)
 739 {
 740   return acl_fa_node_fn (vm, node, frame, 1, 1, 1);
 741 }
 742
 743 VLIB_NODE_FN (acl_in_l2_ip4_node) (vlib_main_t * vm,
 744                                    vlib_node_runtime_t * node,
 745                                    vlib_frame_t * frame)
 746 {
 747   return acl_fa_node_fn (vm, node, frame, 0, 1, 1);
 748 }
 749
 750 VLIB_NODE_FN (acl_out_l2_ip6_node) (vlib_main_t * vm,
 751                                     vlib_node_runtime_t * node,
 752                                     vlib_frame_t * frame)
 753 {
 754   return acl_fa_node_fn (vm, node, frame, 1, 0, 1);
 755 }
 756
 757 VLIB_NODE_FN (acl_out_l2_ip4_node) (vlib_main_t * vm,
 758                                     vlib_node_runtime_t * node,
 759                                     vlib_frame_t * frame)
 760 {
 761   return acl_fa_node_fn (vm, node, frame, 0, 0, 1);
 762 }
 763
 764 /**** L3 processing path nodes ****/
 765
 766 VLIB_NODE_FN (acl_in_fa_ip6_node) (vlib_main_t * vm,
 767                                    vlib_node_runtime_t * node,
 768                                    vlib_frame_t * frame)
 769 {
 770   return acl_fa_node_fn (vm, node, frame, 1, 1, 0);
 771 }
 772
 773 VLIB_NODE_FN (acl_in_fa_ip4_node) (vlib_main_t * vm,
 774                                    vlib_node_runtime_t * node,
 775                                    vlib_frame_t * frame)
 776 {
 777   return acl_fa_node_fn (vm, node, frame, 0, 1, 0);
 778 }
 779
 780 VLIB_NODE_FN (acl_out_fa_ip6_node) (vlib_main_t * vm,
 781                                     vlib_node_runtime_t * node,
 782                                     vlib_frame_t * frame)
 783 {
 784   return acl_fa_node_fn (vm, node, frame, 1, 0, 0);
 785 }
 786
 787 VLIB_NODE_FN (acl_out_fa_ip4_node) (vlib_main_t * vm,
 788                                     vlib_node_runtime_t * node,
 789                                     vlib_frame_t * frame)
 790 {
 791   return acl_fa_node_fn (vm, node, frame, 0, 0, 0);
 792 }
 793
 794 VLIB_REGISTER_NODE (acl_in_l2_ip6_node) =
 795 {
 796   .name = "acl-plugin-in-ip6-l2",
 797   .vector_size = sizeof (u32),
 798   .format_trace = format_acl_plugin_trace,
 799   .type = VLIB_NODE_TYPE_INTERNAL,
 800   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 801   .error_strings = acl_fa_error_strings,
 802   .n_next_nodes = ACL_FA_N_NEXT,
 803   .next_nodes =
 804   {
 805     [ACL_FA_ERROR_DROP] = "error-drop",
 806   }
 807 };
 808
 809 VNET_FEATURE_INIT (acl_in_l2_ip6_fa_feature, static) =
 810 {
 811   .arc_name = "l2-input-ip6",
 812   .node_name = "acl-plugin-in-ip6-l2",
 813   .runs_before = VNET_FEATURES ("l2-input-feat-arc-end"),
 814 };
 815
 816 VLIB_REGISTER_NODE (acl_in_l2_ip4_node) =
 817 {
 818   .name = "acl-plugin-in-ip4-l2",
 819   .vector_size = sizeof (u32),
 820   .format_trace = format_acl_plugin_trace,
 821   .type = VLIB_NODE_TYPE_INTERNAL,
 822   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 823   .error_strings = acl_fa_error_strings,
 824   .n_next_nodes = ACL_FA_N_NEXT,
 825   .next_nodes =
 826   {
 827     [ACL_FA_ERROR_DROP] = "error-drop",
 828   }
 829 };
 830
 831 VNET_FEATURE_INIT (acl_in_l2_ip4_fa_feature, static) =
 832 {
 833   .arc_name = "l2-input-ip4",
 834   .node_name = "acl-plugin-in-ip4-l2",
 835   .runs_before = VNET_FEATURES ("l2-input-feat-arc-end"),
 836 };
 837
 838
 839 VLIB_REGISTER_NODE (acl_out_l2_ip6_node) =
 840 {
 841   .name = "acl-plugin-out-ip6-l2",
 842   .vector_size = sizeof (u32),
 843   .format_trace = format_acl_plugin_trace,
 844   .type = VLIB_NODE_TYPE_INTERNAL,
 845   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 846   .error_strings = acl_fa_error_strings,
 847   .n_next_nodes = ACL_FA_N_NEXT,
 848   .next_nodes =
 849   {
 850     [ACL_FA_ERROR_DROP] = "error-drop",
 851   }
 852 };
 853
 854 VNET_FEATURE_INIT (acl_out_l2_ip6_fa_feature, static) =
 855 {
 856   .arc_name = "l2-output-ip6",
 857   .node_name = "acl-plugin-out-ip6-l2",
 858   .runs_before = VNET_FEATURES ("l2-output-feat-arc-end"),
 859 };
 860
 861
 862 VLIB_REGISTER_NODE (acl_out_l2_ip4_node) =
 863 {
 864   .name = "acl-plugin-out-ip4-l2",
 865   .vector_size = sizeof (u32),
 866   .format_trace = format_acl_plugin_trace,
 867   .type = VLIB_NODE_TYPE_INTERNAL,
 868   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 869   .error_strings = acl_fa_error_strings,
 870   .n_next_nodes = ACL_FA_N_NEXT,
 871   .next_nodes =
 872   {
 873     [ACL_FA_ERROR_DROP] = "error-drop",
 874   }
 875 };
 876
 877 VNET_FEATURE_INIT (acl_out_l2_ip4_fa_feature, static) =
 878 {
 879   .arc_name = "l2-output-ip4",
 880   .node_name = "acl-plugin-out-ip4-l2",
 881   .runs_before = VNET_FEATURES ("l2-output-feat-arc-end"),
 882 };
 883
 884
 885 VLIB_REGISTER_NODE (acl_in_fa_ip6_node) =
 886 {
 887   .name = "acl-plugin-in-ip6-fa",
 888   .vector_size = sizeof (u32),
 889   .format_trace = format_acl_plugin_trace,
 890   .type = VLIB_NODE_TYPE_INTERNAL,
 891   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 892   .error_strings = acl_fa_error_strings,
 893   .n_next_nodes = ACL_FA_N_NEXT,
 894   .next_nodes =
 895   {
 896     [ACL_FA_ERROR_DROP] = "error-drop",
 897   }
 898 };
 899
 900 VNET_FEATURE_INIT (acl_in_ip6_fa_feature, static) =
 901 {
 902   .arc_name = "ip6-unicast",
 903   .node_name = "acl-plugin-in-ip6-fa",
 904   .runs_before = VNET_FEATURES ("ip6-flow-classify"),
 905 };
 906
 907 VLIB_REGISTER_NODE (acl_in_fa_ip4_node) =
 908 {
 909   .name = "acl-plugin-in-ip4-fa",
 910   .vector_size = sizeof (u32),
 911   .format_trace = format_acl_plugin_trace,
 912   .type = VLIB_NODE_TYPE_INTERNAL,
 913   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 914   .error_strings = acl_fa_error_strings,
 915   .n_next_nodes = ACL_FA_N_NEXT,
 916   .next_nodes =
 917   {
 918     [ACL_FA_ERROR_DROP] = "error-drop",
 919   }
 920 };
 921
 922 VNET_FEATURE_INIT (acl_in_ip4_fa_feature, static) =
 923 {
 924   .arc_name = "ip4-unicast",
 925   .node_name = "acl-plugin-in-ip4-fa",
 926   .runs_before = VNET_FEATURES ("ip4-flow-classify"),
 927 };
 928
 929
 930 VLIB_REGISTER_NODE (acl_out_fa_ip6_node) =
 931 {
 932   .name = "acl-plugin-out-ip6-fa",
 933   .vector_size = sizeof (u32),
 934   .format_trace = format_acl_plugin_trace,
 935   .type = VLIB_NODE_TYPE_INTERNAL,
 936   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 937   .error_strings = acl_fa_error_strings,
 938   .n_next_nodes = ACL_FA_N_NEXT,
 939   .next_nodes =
 940   {
 941     [ACL_FA_ERROR_DROP] = "error-drop",
 942   }
 943 };
 944
 945 VNET_FEATURE_INIT (acl_out_ip6_fa_feature, static) = {
 946   .arc_name = "ip6-output",
 947   .node_name = "acl-plugin-out-ip6-fa",
 948   .runs_before = VNET_FEATURES ("ip6-dvr-reinject", "interface-output"),
 949 };
 950
 951 VLIB_REGISTER_NODE (acl_out_fa_ip4_node) =
 952 {
 953   .name = "acl-plugin-out-ip4-fa",
 954   .vector_size = sizeof (u32),
 955   .format_trace = format_acl_plugin_trace,
 956   .type = VLIB_NODE_TYPE_INTERNAL,
 957   .n_errors = ARRAY_LEN (acl_fa_error_strings),
 958   .error_strings = acl_fa_error_strings,
 959   .n_next_nodes = ACL_FA_N_NEXT,
 960     /* edit / add dispositions here */
 961   .next_nodes =
 962   {
 963     [ACL_FA_ERROR_DROP] = "error-drop",
 964   }
 965 };
 966
 967 VNET_FEATURE_INIT (acl_out_ip4_fa_feature, static) = {
 968   .arc_name = "ip4-output",
 969   .node_name = "acl-plugin-out-ip4-fa",
 970   .runs_before = VNET_FEATURES ("ip4-dvr-reinject", "interface-output"),
 971 };
 972
 973
 974 /*
 975  * fd.io coding-style-patch-verification: ON
 976  *
 977  * Local Variables:
 978  * eval: (c-set-style "gnu")
 979  * End:
 980  */