2 * Copyright (c) 2018 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <vnet/dpo/dvr_dpo.h>
17 #include <vnet/dpo/drop_dpo.h>
18 #include <vnet/vxlan-gbp/vxlan_gbp_packet.h>
20 #include <plugins/gbp/gbp.h>
21 #include <plugins/gbp/gbp_policy_dpo.h>
22 #include <plugins/gbp/gbp_recirc.h>
27 gbp_policy_dpo_t *gbp_policy_dpo_pool;
30 * DPO type registered for these GBP FWD
32 dpo_type_t gbp_policy_dpo_type;
34 static gbp_policy_dpo_t *
35 gbp_policy_dpo_alloc (void)
37 gbp_policy_dpo_t *gpd;
39 pool_get_aligned_zero (gbp_policy_dpo_pool, gpd, CLIB_CACHE_LINE_BYTES);
44 static inline gbp_policy_dpo_t *
45 gbp_policy_dpo_get_from_dpo (const dpo_id_t * dpo)
47 ASSERT (gbp_policy_dpo_type == dpo->dpoi_type);
49 return (gbp_policy_dpo_get (dpo->dpoi_index));
53 gbp_policy_dpo_get_index (gbp_policy_dpo_t * gpd)
55 return (gpd - gbp_policy_dpo_pool);
59 gbp_policy_dpo_lock (dpo_id_t * dpo)
61 gbp_policy_dpo_t *gpd;
63 gpd = gbp_policy_dpo_get_from_dpo (dpo);
68 gbp_policy_dpo_unlock (dpo_id_t * dpo)
70 gbp_policy_dpo_t *gpd;
72 gpd = gbp_policy_dpo_get_from_dpo (dpo);
75 if (0 == gpd->gpd_locks)
77 dpo_reset (&gpd->gpd_dpo);
78 pool_put (gbp_policy_dpo_pool, gpd);
83 gbp_policy_dpo_get_urpf (const dpo_id_t * dpo)
85 gbp_policy_dpo_t *gpd;
87 gpd = gbp_policy_dpo_get_from_dpo (dpo);
89 return (gpd->gpd_sw_if_index);
93 gbp_policy_dpo_add_or_lock (dpo_proto_t dproto,
94 epg_id_t epg, u32 sw_if_index, dpo_id_t * dpo)
96 gbp_policy_dpo_t *gpd;
97 dpo_id_t parent = DPO_INVALID;
99 gpd = gbp_policy_dpo_alloc ();
101 gpd->gpd_proto = dproto;
102 gpd->gpd_sw_if_index = sw_if_index;
105 if (~0 != sw_if_index)
108 * stack on the DVR DPO for the output interface
110 dvr_dpo_add_or_lock (sw_if_index, dproto, &parent);
114 dpo_copy (&parent, drop_dpo_get (dproto));
117 dpo_stack (gbp_policy_dpo_type, dproto, &gpd->gpd_dpo, &parent);
118 dpo_set (dpo, gbp_policy_dpo_type, dproto, gbp_policy_dpo_get_index (gpd));
122 format_gbp_policy_dpo (u8 * s, va_list * ap)
124 index_t index = va_arg (*ap, index_t);
125 u32 indent = va_arg (*ap, u32);
126 gbp_policy_dpo_t *gpd = gbp_policy_dpo_get (index);
127 vnet_main_t *vnm = vnet_get_main ();
129 s = format (s, "gbp-policy-dpo: %U, epg:%d out:%U",
130 format_dpo_proto, gpd->gpd_proto,
132 format_vnet_sw_if_index_name, vnm, gpd->gpd_sw_if_index);
133 s = format (s, "\n%U", format_white_space, indent + 2);
134 s = format (s, "%U", format_dpo_id, &gpd->gpd_dpo, indent + 4);
140 * Interpose a policy DPO
143 gbp_policy_dpo_interpose (const dpo_id_t * original,
144 const dpo_id_t * parent, dpo_id_t * clone)
146 gbp_policy_dpo_t *gpd, *gpd_clone;
148 gpd_clone = gbp_policy_dpo_alloc ();
149 gpd = gbp_policy_dpo_get (original->dpoi_index);
151 gpd_clone->gpd_proto = gpd->gpd_proto;
152 gpd_clone->gpd_epg = gpd->gpd_epg;
153 gpd_clone->gpd_sw_if_index = gpd->gpd_sw_if_index;
155 dpo_stack (gbp_policy_dpo_type,
156 gpd_clone->gpd_proto, &gpd_clone->gpd_dpo, parent);
160 gpd_clone->gpd_proto, gbp_policy_dpo_get_index (gpd_clone));
163 const static dpo_vft_t gbp_policy_dpo_vft = {
164 .dv_lock = gbp_policy_dpo_lock,
165 .dv_unlock = gbp_policy_dpo_unlock,
166 .dv_format = format_gbp_policy_dpo,
167 .dv_get_urpf = gbp_policy_dpo_get_urpf,
168 .dv_mk_interpose = gbp_policy_dpo_interpose,
172 * @brief The per-protocol VLIB graph nodes that are assigned to a glean
175 * this means that these graph nodes are ones from which a glean is the
176 * parent object in the DPO-graph.
178 const static char *const gbp_policy_dpo_ip4_nodes[] = {
179 "ip4-gbp-policy-dpo",
183 const static char *const gbp_policy_dpo_ip6_nodes[] = {
184 "ip6-gbp-policy-dpo",
188 const static char *const *const gbp_policy_dpo_nodes[DPO_PROTO_NUM] = {
189 [DPO_PROTO_IP4] = gbp_policy_dpo_ip4_nodes,
190 [DPO_PROTO_IP6] = gbp_policy_dpo_ip6_nodes,
194 gbp_policy_dpo_get_type (void)
196 return (gbp_policy_dpo_type);
199 static clib_error_t *
200 gbp_policy_dpo_module_init (vlib_main_t * vm)
202 gbp_policy_dpo_type = dpo_register_new_type (&gbp_policy_dpo_vft,
203 gbp_policy_dpo_nodes);
208 VLIB_INIT_FUNCTION (gbp_policy_dpo_module_init);
210 typedef struct gbp_policy_dpo_trace_t_
216 } gbp_policy_dpo_trace_t;
225 gbp_rule_l3_redirect (const gbp_rule_t * gu, vlib_buffer_t * b0, int is_ip6)
227 gbp_policy_node_t pnode;
231 pnode = (is_ip6 ? GBP_POLICY_NODE_IP6 : GBP_POLICY_NODE_IP4);
232 dproto = (is_ip6 ? DPO_PROTO_IP6 : DPO_PROTO_IP4);
233 dpo = &gu->gu_dpo[pnode][dproto];
235 /* The flow hash is still valid as this is a IP packet being switched */
236 vnet_buffer (b0)->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
238 return (dpo->dpoi_next_node);
242 gbp_policy_dpo_inline (vlib_main_t * vm,
243 vlib_node_runtime_t * node,
244 vlib_frame_t * from_frame, u8 is_ip6)
246 gbp_main_t *gm = &gbp_main;
247 u32 n_left_from, next_index, *from, *to_next;
250 from = vlib_frame_vector_args (from_frame);
251 n_left_from = from_frame->n_vectors;
253 next_index = node->cached_next_index;
255 while (n_left_from > 0)
259 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
261 while (n_left_from > 0 && n_left_to_next > 0)
263 const gbp_policy_dpo_t *gpd0;
265 gbp_contract_key_t key0;
276 next0 = GBP_POLICY_DROP;
278 b0 = vlib_get_buffer (vm, bi0);
281 gpd0 = gbp_policy_dpo_get (vnet_buffer (b0)->ip.adj_index[VLIB_TX]);
282 vnet_buffer (b0)->ip.adj_index[VLIB_TX] = gpd0->gpd_dpo.dpoi_index;
284 if (vnet_buffer2 (b0)->gbp.flags & VXLAN_GBP_GPFLAGS_A)
286 next0 = gpd0->gpd_dpo.dpoi_next_node;
291 key0.gck_src = vnet_buffer2 (b0)->gbp.src_epg;
292 key0.gck_dst = gpd0->gpd_epg;
294 if (EPG_INVALID != key0.gck_src)
296 if (PREDICT_FALSE (key0.gck_src == key0.gck_dst))
301 next0 = gpd0->gpd_dpo.dpoi_next_node;
302 vnet_buffer2 (b0)->gbp.flags |= VXLAN_GBP_GPFLAGS_A;
306 gci0 = gbp_contract_find (&key0);
308 if (INDEX_INVALID != gci0)
310 fa_5tuple_opaque_t pkt_5tuple0;
312 u32 acl_pos_p0, acl_match_p0;
313 u32 rule_match_p0, trace_bitmap0;
315 * tests against the ACL
317 gc0 = gbp_contract_get (gci0);
318 acl_plugin_fill_5tuple_inline (gm->
319 acl_plugin.p_acl_main,
320 gc0->gc_lc_index, b0,
325 acl_plugin_match_5tuple_inline (gm->
326 acl_plugin.p_acl_main,
328 &pkt_5tuple0, is_ip6,
329 &action0, &acl_pos_p0,
337 vnet_buffer2 (b0)->gbp.flags |= VXLAN_GBP_GPFLAGS_A;
338 gu = gbp_rule_get (gc0->gc_rules[rule_match_p0]);
340 switch (gu->gu_action)
342 case GBP_RULE_PERMIT:
343 next0 = gpd0->gpd_dpo.dpoi_next_node;
349 case GBP_RULE_REDIRECT:
350 next0 = gbp_rule_l3_redirect (gu, b0, is_ip6);
360 * the src EPG is not set when the packet arrives on an EPG
361 * uplink interface and we do not need to apply policy
363 next0 = gpd0->gpd_dpo.dpoi_next_node;
366 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
368 gbp_policy_dpo_trace_t *tr;
370 tr = vlib_add_trace (vm, node, b0, sizeof (*tr));
371 tr->src_epg = key0.gck_src;
372 tr->dst_epg = key0.gck_dst;
373 tr->acl_index = (gc0 ? gc0->gc_acl_index : ~0);
374 tr->a_bit = vnet_buffer2 (b0)->gbp.flags & VXLAN_GBP_GPFLAGS_A;
377 vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
378 n_left_to_next, bi0, next0);
380 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
382 return from_frame->n_vectors;
386 format_gbp_policy_dpo_trace (u8 * s, va_list * args)
388 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
389 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
390 gbp_policy_dpo_trace_t *t = va_arg (*args, gbp_policy_dpo_trace_t *);
392 s = format (s, " src-epg:%d dst-epg:%d acl-index:%d a-bit:%d",
393 t->src_epg, t->dst_epg, t->acl_index, t->a_bit);
399 ip4_gbp_policy_dpo (vlib_main_t * vm,
400 vlib_node_runtime_t * node, vlib_frame_t * from_frame)
402 return (gbp_policy_dpo_inline (vm, node, from_frame, 0));
406 ip6_gbp_policy_dpo (vlib_main_t * vm,
407 vlib_node_runtime_t * node, vlib_frame_t * from_frame)
409 return (gbp_policy_dpo_inline (vm, node, from_frame, 1));
413 VLIB_REGISTER_NODE (ip4_gbp_policy_dpo_node) = {
414 .function = ip4_gbp_policy_dpo,
415 .name = "ip4-gbp-policy-dpo",
416 .vector_size = sizeof (u32),
417 .format_trace = format_gbp_policy_dpo_trace,
418 .n_next_nodes = GBP_POLICY_N_NEXT,
421 [GBP_POLICY_DROP] = "ip4-drop",
424 VLIB_REGISTER_NODE (ip6_gbp_policy_dpo_node) = {
425 .function = ip6_gbp_policy_dpo,
426 .name = "ip6-gbp-policy-dpo",
427 .vector_size = sizeof (u32),
428 .format_trace = format_gbp_policy_dpo_trace,
429 .n_next_nodes = GBP_POLICY_N_NEXT,
432 [GBP_POLICY_DROP] = "ip6-drop",
436 VLIB_NODE_FUNCTION_MULTIARCH (ip4_gbp_policy_dpo_node, ip4_gbp_policy_dpo)
437 VLIB_NODE_FUNCTION_MULTIARCH (ip6_gbp_policy_dpo_node, ip6_gbp_policy_dpo)
441 * fd.io coding-style-patch-verification: ON
444 * eval: (c-set-style "gnu")