2 * Copyright (c) 2016 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
17 * The data-path object representing dropping the packet
20 #include <vnet/dpo/ip_null_dpo.h>
21 #include <vnet/ip/ip.h>
24 * @brief A representation of the IP_NULL DPO
26 typedef struct ip_null_dpo_t_
29 * @brief The action to take on a packet
31 ip_null_dpo_action_t ind_action;
33 * @brief The next VLIB node
42 * @brief the IP_NULL dpos are shared by all routes, hence they are global.
43 * As the neame implies this is only for IP, hence 2.
45 static ip_null_dpo_t ip_null_dpos[2 * IP_NULL_DPO_ACTION_NUM] = {
47 /* proto ip4, no action */
48 .ind_action = IP_NULL_ACTION_NONE,
51 /* proto ip4, action send unreach */
52 .ind_action = IP_NULL_ACTION_SEND_ICMP_UNREACH,
55 /* proto ip4, action send unreach */
56 .ind_action = IP_NULL_ACTION_SEND_ICMP_PROHIBIT,
59 /* proto ip6, no action */
60 .ind_action = IP_NULL_ACTION_NONE,
63 /* proto ip6, action send unreach */
64 .ind_action = IP_NULL_ACTION_SEND_ICMP_UNREACH,
67 /* proto ip6, action send unreach */
68 .ind_action = IP_NULL_ACTION_SEND_ICMP_PROHIBIT,
73 * @brief Action strings
75 const char *ip_null_action_strings[] = IP_NULL_ACTIONS;
78 ip_null_dpo_add_and_lock (dpo_proto_t proto,
79 ip_null_dpo_action_t action,
84 ASSERT((proto == DPO_PROTO_IP4) ||
85 (proto == DPO_PROTO_IP6));
86 ASSERT(action < IP_NULL_DPO_ACTION_NUM);
88 i = (proto == DPO_PROTO_IP4 ? 0 : 1);
90 dpo_set(dpo, DPO_IP_NULL, proto, (i*IP_NULL_DPO_ACTION_NUM) + action);
93 always_inline const ip_null_dpo_t*
94 ip_null_dpo_get (index_t indi)
96 return (&ip_null_dpos[indi]);
100 ip_null_dpo_get_action (index_t indi)
102 return (ip_null_dpos[indi].ind_action);
106 ip_null_dpo_lock (dpo_id_t *dpo)
109 * not maintaining a lock count on the ip_null, they are const global and
114 ip_null_dpo_unlock (dpo_id_t *dpo)
119 format_ip_null_dpo (u8 *s, va_list *ap)
121 index_t index = va_arg(*ap, index_t);
122 CLIB_UNUSED(u32 indent) = va_arg(*ap, u32);
123 const ip_null_dpo_t *ind;
126 ind = ip_null_dpo_get(index);
127 proto = (index < IP_NULL_DPO_ACTION_NUM ? DPO_PROTO_IP4 : DPO_PROTO_IP6);
129 return (format(s, "%U-null action:%s",
130 format_dpo_proto, proto,
131 ip_null_action_strings[ind->ind_action]));
134 const static dpo_vft_t ip_null_vft = {
135 .dv_lock = ip_null_dpo_lock,
136 .dv_unlock = ip_null_dpo_unlock,
137 .dv_format = format_ip_null_dpo,
141 * @brief The per-protocol VLIB graph nodes that are assigned to a ip_null
144 * this means that these graph nodes are ones from which a ip_null is the
145 * parent object in the DPO-graph.
147 const static char* const ip4_null_nodes[] =
152 const static char* const ip6_null_nodes[] =
158 const static char* const * const ip_null_nodes[DPO_PROTO_NUM] =
160 [DPO_PROTO_IP4] = ip4_null_nodes,
161 [DPO_PROTO_IP6] = ip6_null_nodes,
164 typedef struct ip_null_dpo_trace_t_
167 } ip_null_dpo_trace_t;
170 * @brief Exit nodes from a IP_NULL
172 typedef enum ip_null_next_t_
180 ip_null_dpo_switch (vlib_main_t * vm,
181 vlib_node_runtime_t * node,
182 vlib_frame_t * frame,
185 u32 n_left_from, next_index, *from, *to_next;
186 static f64 time_last_seed_change = -1e100;
187 static u32 hash_seeds[3];
188 static uword hash_bitmap[256 / BITS (uword)];
191 from = vlib_frame_vector_args (frame);
192 n_left_from = frame->n_vectors;
194 time_now = vlib_time_now (vm);
195 if (time_now - time_last_seed_change > 1e-1)
198 u32 * r = clib_random_buffer_get_data (&vm->random_buffer,
199 sizeof (hash_seeds));
200 for (i = 0; i < ARRAY_LEN (hash_seeds); i++)
201 hash_seeds[i] = r[i];
203 /* Mark all hash keys as been not-seen before. */
204 for (i = 0; i < ARRAY_LEN (hash_bitmap); i++)
207 time_last_seed_change = time_now;
210 next_index = node->cached_next_index;
212 while (n_left_from > 0)
216 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
218 while (n_left_from > 0 && n_left_to_next > 0)
220 u32 a0, b0, c0, m0, drop0;
222 u32 bi0, indi0, next0;
223 const ip_null_dpo_t *ind0;
233 p0 = vlib_get_buffer (vm, bi0);
235 /* lookup dst + src mac */
236 indi0 = vnet_buffer (p0)->ip.adj_index[VLIB_TX];
237 ind0 = ip_null_dpo_get(indi0);
238 next0 = IP_NULL_NEXT_DROP;
241 * rate limit - don't DoS the sender.
249 ip4_header_t *ip0 = vlib_buffer_get_current (p0);
251 a0 ^= ip0->dst_address.data_u32;
252 b0 ^= ip0->src_address.data_u32;
254 hash_v3_finalize32 (a0, b0, c0);
258 ip6_header_t *ip0 = vlib_buffer_get_current (p0);
260 a0 ^= ip0->dst_address.as_u32[0];
261 b0 ^= ip0->src_address.as_u32[0];
262 c0 ^= ip0->src_address.as_u32[1];
264 hash_v3_mix32 (a0, b0, c0);
266 a0 ^= ip0->dst_address.as_u32[1];
267 b0 ^= ip0->src_address.as_u32[2];
268 c0 ^= ip0->src_address.as_u32[3];
270 hash_v3_finalize32 (a0, b0, c0);
273 c0 &= BITS (hash_bitmap) - 1;
274 c0 = c0 / BITS (uword);
275 m0 = (uword) 1 << (c0 % BITS (uword));
277 bm0 = hash_bitmap[c0];
278 drop0 = (bm0 & m0) != 0;
280 /* Mark it as seen. */
281 hash_bitmap[c0] = bm0 | m0;
283 if (PREDICT_FALSE(!drop0))
288 * There's a trade-off here. This conditinal statement
289 * versus a graph node per-condition. Given the number
290 * expect number of packets to reach a null route is 0
291 * we favour the run-time cost over the graph complexity
293 if (IP_NULL_ACTION_SEND_ICMP_UNREACH == ind0->ind_action)
295 next0 = IP_NULL_NEXT_ICMP;
296 icmp4_error_set_vnet_buffer(
298 ICMP4_destination_unreachable,
299 ICMP4_destination_unreachable_destination_unreachable_host,
302 else if (IP_NULL_ACTION_SEND_ICMP_PROHIBIT == ind0->ind_action)
304 next0 = IP_NULL_NEXT_ICMP;
305 icmp4_error_set_vnet_buffer(
307 ICMP4_destination_unreachable,
308 ICMP4_destination_unreachable_host_administratively_prohibited,
314 if (IP_NULL_ACTION_SEND_ICMP_UNREACH == ind0->ind_action)
316 next0 = IP_NULL_NEXT_ICMP;
317 icmp6_error_set_vnet_buffer(
319 ICMP6_destination_unreachable,
320 ICMP6_destination_unreachable_no_route_to_destination,
323 else if (IP_NULL_ACTION_SEND_ICMP_PROHIBIT == ind0->ind_action)
325 next0 = IP_NULL_NEXT_ICMP;
326 icmp6_error_set_vnet_buffer(
328 ICMP6_destination_unreachable,
329 ICMP6_destination_unreachable_destination_administratively_prohibited,
335 if (PREDICT_FALSE (p0->flags & VLIB_BUFFER_IS_TRACED))
337 ip_null_dpo_trace_t *tr = vlib_add_trace (vm, node, p0,
339 tr->ind_index = indi0;
341 vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
342 n_left_to_next, bi0, next0);
345 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
348 return frame->n_vectors;
352 format_ip_null_dpo_trace (u8 * s, va_list * args)
354 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
355 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
356 ip_null_dpo_trace_t *t = va_arg (*args, ip_null_dpo_trace_t *);
358 s = format (s, "%U", format_ip_null_dpo, t->ind_index, 0);
363 ip4_null_dpo_switch (vlib_main_t * vm,
364 vlib_node_runtime_t * node,
365 vlib_frame_t * frame)
367 return (ip_null_dpo_switch(vm, node, frame, 1));
373 VLIB_REGISTER_NODE (ip4_null_dpo_node) = {
374 .function = ip4_null_dpo_switch,
376 .vector_size = sizeof (u32),
378 .format_trace = format_ip_null_dpo_trace,
379 .n_next_nodes = IP_NULL_NEXT_NUM,
381 [IP_NULL_NEXT_DROP] = "ip4-drop",
382 [IP_NULL_NEXT_ICMP] = "ip4-icmp-error",
387 ip6_null_dpo_switch (vlib_main_t * vm,
388 vlib_node_runtime_t * node,
389 vlib_frame_t * frame)
391 return (ip_null_dpo_switch(vm, node, frame, 0));
397 VLIB_REGISTER_NODE (ip6_null_dpo_node) = {
398 .function = ip6_null_dpo_switch,
400 .vector_size = sizeof (u32),
402 .format_trace = format_ip_null_dpo_trace,
403 .n_next_nodes = IP_NULL_NEXT_NUM,
405 [IP_NULL_NEXT_DROP] = "ip6-drop",
406 [IP_NULL_NEXT_ICMP] = "ip6-icmp-error",
411 ip_null_dpo_module_init (void)
413 dpo_register(DPO_IP_NULL, &ip_null_vft, ip_null_nodes);