2 * Copyright (c) 2017 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <vnet/session/mma_16.h>
17 #include <vnet/session/mma_template.c>
18 #include <vnet/session/mma_40.h>
19 #include <vnet/session/mma_template.c>
20 #include <vnet/session/session_rules_table.h>
21 #include <vnet/session/transport.h>
24 session_rule_tag_key_index (u32 ri, u8 is_ip4)
26 return ((ri << 1) | is_ip4);
30 session_rule_tag_key_index_parse (u32 rti_key, u32 * ri, u8 * is_ip4)
32 *is_ip4 = rti_key & 1;
37 session_rules_table_rule_tag (session_rules_table_t * srt, u32 ri, u8 is_ip4)
40 session_rule_tag_t *rt;
43 hash_get (srt->tags_by_rules, session_rule_tag_key_index (ri, is_ip4));
46 rt = pool_elt_at_index (srt->rule_tags, *tip);
53 session_rules_table_del_tag (session_rules_table_t * srt, u8 * tag, u8 is_ip4)
56 session_rule_tag_t *rt;
61 rip = hash_get_mem (srt->rules_by_tag, tag);
64 clib_warning ("tag has no rule associated");
67 rti_key = session_rule_tag_key_index (*rip, is_ip4);
68 rtip = hash_get (srt->tags_by_rules, rti_key);
71 clib_warning ("rule has no tag associated");
74 rt = pool_elt_at_index (srt->rule_tags, *rtip);
76 hash_unset_mem (srt->rules_by_tag, tag);
77 hash_unset (srt->tags_by_rules, rti_key);
78 pool_put (srt->rule_tags, rt);
82 session_rules_table_add_tag (session_rules_table_t * srt, u8 * tag,
83 u32 rule_index, u8 is_ip4)
86 session_rule_tag_t *rt;
91 rip = hash_get_mem (srt->rules_by_tag, tag);
93 session_rules_table_del_tag (srt, tag, is_ip4);
94 pool_get (srt->rule_tags, rt);
95 rt->tag = vec_dup (tag);
96 hash_set_mem (srt->rules_by_tag, rt->tag, rule_index);
97 rti_key = session_rule_tag_key_index (rule_index, is_ip4);
98 hash_set (srt->tags_by_rules, rti_key, rt - srt->rule_tags);
102 session_rules_table_rule_for_tag (session_rules_table_t * srt, u8 * tag)
106 return SESSION_RULES_TABLE_INVALID_INDEX;
107 rp = hash_get_mem (srt->rules_by_tag, tag);
108 return (rp == 0 ? SESSION_RULES_TABLE_INVALID_INDEX : *rp);
112 fib_pref_normalize (fib_prefix_t * pref)
114 if (pref->fp_proto == FIB_PROTOCOL_IP4)
115 ip4_address_normalize (&pref->fp_addr.ip4, pref->fp_len);
117 ip6_address_normalize (&pref->fp_addr.ip6, pref->fp_len);
121 format_session_rule4 (u8 * s, va_list * args)
123 session_rules_table_t *srt = va_arg (*args, session_rules_table_t *);
124 mma_rule_16_t *sr = va_arg (*args, mma_rule_16_t *);
125 session_mask_or_match_4_t *mask, *match;
126 mma_rules_table_16_t *srt4;
127 u8 *tag = 0, *null_tag = format (0, "none");
131 srt4 = &srt->session_rules_tables_16;
132 ri = mma_rules_table_rule_index_16 (srt4, sr);
133 tag = session_rules_table_rule_tag (srt, ri, 1);
134 match = (session_mask_or_match_4_t *) & sr->match;
135 mask = (session_mask_or_match_4_t *) & sr->mask;
137 s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri,
138 format_ip4_address, &match->lcl_ip,
139 ip4_mask_to_preflen (&mask->lcl_ip),
140 clib_net_to_host_u16 (match->lcl_port), format_ip4_address,
141 &match->rmt_ip, ip4_mask_to_preflen (&mask->rmt_ip),
142 clib_net_to_host_u16 (match->rmt_port), sr->action_index,
143 tag ? tag : null_tag);
144 if (vec_len (sr->next_indices))
146 s = format (s, "\n children: ");
147 for (i = 0; i < vec_len (sr->next_indices); i++)
148 s = format (s, "%d ", sr->next_indices[i]);
155 format_session_rule6 (u8 * s, va_list * args)
157 session_rules_table_t *srt = va_arg (*args, session_rules_table_t *);
158 mma_rule_40_t *sr = va_arg (*args, mma_rule_40_t *);
159 session_mask_or_match_6_t *mask, *match;
160 mma_rules_table_40_t *srt6;
161 u8 *tag = 0, *null_tag = format (0, "none");
165 srt6 = &srt->session_rules_tables_40;
166 ri = mma_rules_table_rule_index_40 (srt6, sr);
167 tag = session_rules_table_rule_tag (srt, ri, 0);
168 match = (session_mask_or_match_6_t *) & sr->match;
169 mask = (session_mask_or_match_6_t *) & sr->mask;
171 s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri,
172 format_ip6_address, &match->lcl_ip,
173 ip6_mask_to_preflen (&mask->lcl_ip),
174 clib_net_to_host_u16 (match->lcl_port), format_ip6_address,
175 &match->rmt_ip, ip6_mask_to_preflen (&mask->rmt_ip),
176 clib_net_to_host_u16 (match->rmt_port), sr->action_index,
177 tag ? tag : null_tag);
178 if (vec_len (sr->next_indices))
180 s = format (s, "\n children: ");
181 for (i = 0; i < vec_len (sr->next_indices); i++)
182 s = format (s, "%d ", sr->next_indices[i]);
189 session_rules_table_get (session_rules_table_t * srt, u8 fib_proto)
191 if (fib_proto == FIB_PROTOCOL_IP4)
192 return &srt->session_rules_tables_16;
193 else if (fib_proto == FIB_PROTOCOL_IP6)
194 return &srt->session_rules_tables_40;
199 rule_cmp_16 (mma_rule_16_t * rule1, mma_rule_16_t * rule2)
201 session_mask_or_match_4_t *m1, *m2;
203 m1 = (session_mask_or_match_4_t *) & rule1->max_match;
204 m2 = (session_mask_or_match_4_t *) & rule2->max_match;
205 if (m1->rmt_ip.as_u32 != m2->rmt_ip.as_u32)
206 return (m1->rmt_ip.as_u32 < m2->rmt_ip.as_u32 ? -1 : 1);
207 if (m1->lcl_ip.as_u32 != m2->lcl_ip.as_u32)
208 return (m1->lcl_ip.as_u32 < m2->lcl_ip.as_u32 ? -1 : 1);
209 if (m1->rmt_port != m2->rmt_port)
210 return (m1->rmt_port < m2->rmt_port ? -1 : 1);
211 if (m1->lcl_port != m2->lcl_port)
212 return (m1->lcl_port < m2->lcl_port ? -1 : 1);
217 rule_cmp_40 (mma_rule_40_t * rule1, mma_rule_40_t * rule2)
219 session_mask_or_match_6_t *r1, *r2;
220 r1 = (session_mask_or_match_6_t *) & rule1->max_match;
221 r2 = (session_mask_or_match_6_t *) & rule2->max_match;
222 if (r1->rmt_ip.as_u64[0] != r2->rmt_ip.as_u64[0])
223 return (r1->rmt_ip.as_u64[0] < r2->rmt_ip.as_u64[0] ? -1 : 1);
224 if (r1->rmt_ip.as_u64[1] != r2->rmt_ip.as_u64[1])
225 return (r1->rmt_ip.as_u64[1] < r2->rmt_ip.as_u64[1] ? -1 : 1);
226 if (r1->lcl_ip.as_u64[0] != r2->lcl_ip.as_u64[0])
227 return (r1->lcl_ip.as_u64[0] < r2->lcl_ip.as_u64[0] ? -1 : 1);
228 if (r1->lcl_ip.as_u64[1] != r2->lcl_ip.as_u64[1])
229 return (r1->lcl_ip.as_u64[1] < r2->lcl_ip.as_u64[1]) ? -1 : 1;
230 if (r1->rmt_port != r2->rmt_port)
231 return (r1->rmt_port < r2->rmt_port ? -1 : 1);
232 if (r1->lcl_port != r2->lcl_port)
233 return (r1->lcl_port < r2->lcl_port ? -1 : 1);
238 session_rules_table_init_rule_16 (mma_rule_16_t * rule,
239 fib_prefix_t * lcl, u16 lcl_port,
240 fib_prefix_t * rmt, u16 rmt_port)
242 session_mask_or_match_4_t *match, *mask, *max_match;
243 fib_pref_normalize (lcl);
244 fib_pref_normalize (rmt);
245 match = (session_mask_or_match_4_t *) & rule->match;
246 match->lcl_ip.as_u32 = lcl->fp_addr.ip4.as_u32;
247 match->rmt_ip.as_u32 = rmt->fp_addr.ip4.as_u32;
248 match->lcl_port = lcl_port;
249 match->rmt_port = rmt_port;
250 mask = (session_mask_or_match_4_t *) & rule->mask;
251 ip4_preflen_to_mask (lcl->fp_len, &mask->lcl_ip);
252 ip4_preflen_to_mask (rmt->fp_len, &mask->rmt_ip);
253 mask->lcl_port = lcl_port == 0 ? 0 : (u16) ~ 0;
254 mask->rmt_port = rmt_port == 0 ? 0 : (u16) ~ 0;
255 max_match = (session_mask_or_match_4_t *) & rule->max_match;
256 ip4_prefix_max_address_host_order (&rmt->fp_addr.ip4, rmt->fp_len,
258 ip4_prefix_max_address_host_order (&lcl->fp_addr.ip4, lcl->fp_len,
260 max_match->lcl_port = lcl_port == 0 ? (u16) ~ 0 : lcl_port;
261 max_match->rmt_port = rmt_port == 0 ? (u16) ~ 0 : rmt_port;
265 session_rules_table_init_rule_40 (mma_rule_40_t * rule,
266 fib_prefix_t * lcl, u16 lcl_port,
267 fib_prefix_t * rmt, u16 rmt_port)
269 session_mask_or_match_6_t *match, *mask, *max_match;
270 fib_pref_normalize (lcl);
271 fib_pref_normalize (rmt);
272 match = (session_mask_or_match_6_t *) & rule->match;
273 clib_memcpy_fast (&match->lcl_ip, &lcl->fp_addr.ip6,
274 sizeof (match->lcl_ip));
275 clib_memcpy_fast (&match->rmt_ip, &rmt->fp_addr.ip6,
276 sizeof (match->rmt_ip));
277 match->lcl_port = lcl_port;
278 match->rmt_port = rmt_port;
279 mask = (session_mask_or_match_6_t *) & rule->mask;
280 ip6_preflen_to_mask (lcl->fp_len, &mask->lcl_ip);
281 ip6_preflen_to_mask (rmt->fp_len, &mask->rmt_ip);
282 mask->lcl_port = lcl_port == 0 ? 0 : (u16) ~ 0;
283 mask->rmt_port = rmt_port == 0 ? 0 : (u16) ~ 0;
284 max_match = (session_mask_or_match_6_t *) & rule->max_match;
285 ip6_prefix_max_address_host_order (&rmt->fp_addr.ip6, rmt->fp_len,
287 ip6_prefix_max_address_host_order (&lcl->fp_addr.ip6, lcl->fp_len,
289 max_match->lcl_port = lcl_port == 0 ? (u16) ~ 0 : lcl_port;
290 max_match->rmt_port = rmt_port == 0 ? (u16) ~ 0 : rmt_port;
294 session_rules_table_alloc_rule_16 (mma_rules_table_16_t * srt,
295 fib_prefix_t * lcl, u16 lcl_port,
296 fib_prefix_t * rmt, u16 rmt_port)
298 mma_rule_16_t *rule = 0;
299 rule = mma_rules_table_rule_alloc_16 (srt);
300 session_rules_table_init_rule_16 (rule, lcl, lcl_port, rmt, rmt_port);
305 session_rules_table_alloc_rule_40 (mma_rules_table_40_t * srt,
306 fib_prefix_t * lcl, u16 lcl_port,
307 fib_prefix_t * rmt, u16 rmt_port)
310 rule = mma_rules_table_rule_alloc_40 (srt);
311 session_rules_table_init_rule_40 (rule, lcl, lcl_port, rmt, rmt_port);
316 session_rules_table_lookup_rule4 (session_rules_table_t * srt,
317 ip4_address_t * lcl_ip,
318 ip4_address_t * rmt_ip, u16 lcl_port,
321 mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16;
322 session_mask_or_match_4_t key = {
323 .lcl_ip.as_u32 = lcl_ip->as_u32,
324 .rmt_ip.as_u32 = rmt_ip->as_u32,
325 .lcl_port = lcl_port,
326 .rmt_port = rmt_port,
328 return mma_rules_table_lookup_rule_16 (srt4,
329 (mma_mask_or_match_16_t *) & key,
334 session_rules_table_lookup4 (session_rules_table_t * srt,
335 ip4_address_t * lcl_ip, ip4_address_t * rmt_ip,
336 u16 lcl_port, u16 rmt_port)
338 mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16;
339 session_mask_or_match_4_t key = {
340 .lcl_ip.as_u32 = lcl_ip->as_u32,
341 .rmt_ip.as_u32 = rmt_ip->as_u32,
342 .lcl_port = lcl_port,
343 .rmt_port = rmt_port,
345 return mma_rules_table_lookup_16 (srt4, (mma_mask_or_match_16_t *) & key,
350 session_rules_table_lookup_rule6 (session_rules_table_t * srt,
351 ip6_address_t * lcl_ip,
352 ip6_address_t * rmt_ip, u16 lcl_port,
355 mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40;
356 session_mask_or_match_6_t key = {
357 .lcl_port = lcl_port,
358 .rmt_port = rmt_port,
360 clib_memcpy_fast (&key.lcl_ip, lcl_ip, sizeof (*lcl_ip));
361 clib_memcpy_fast (&key.rmt_ip, rmt_ip, sizeof (*rmt_ip));
362 return mma_rules_table_lookup_rule_40 (srt6,
363 (mma_mask_or_match_40_t *) & key,
368 session_rules_table_lookup6 (session_rules_table_t * srt,
369 ip6_address_t * lcl_ip, ip6_address_t * rmt_ip,
370 u16 lcl_port, u16 rmt_port)
372 mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40;
373 session_mask_or_match_6_t key = {
374 .lcl_port = lcl_port,
375 .rmt_port = rmt_port,
377 clib_memcpy_fast (&key.lcl_ip, lcl_ip, sizeof (*lcl_ip));
378 clib_memcpy_fast (&key.rmt_ip, rmt_ip, sizeof (*rmt_ip));
379 return mma_rules_table_lookup_40 (srt6, (mma_mask_or_match_40_t *) & key,
384 * Add/delete session rule
386 * @param srt table where rule should be added
387 * @param args rule arguments
389 * @return 0 if success, clib_error_t error otherwise
392 session_rules_table_add_del (session_rules_table_t * srt,
393 session_rule_table_add_del_args_t * args)
395 u8 fib_proto = args->rmt.fp_proto, *rt;
399 ri_from_tag = session_rules_table_rule_for_tag (srt, args->tag);
400 if (args->is_add && ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
401 return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
404 if (fib_proto == FIB_PROTOCOL_IP4)
406 mma_rules_table_16_t *srt4;
407 srt4 = &srt->session_rules_tables_16;
410 mma_rule_16_t *rule4;
411 rule4 = session_rules_table_alloc_rule_16 (srt4, &args->lcl,
415 rule4->action_index = args->action_index;
416 rv = mma_rules_table_add_rule_16 (srt4, rule4);
419 ri = mma_rules_table_rule_index_16 (srt4, rule4);
420 session_rules_table_add_tag (srt, args->tag, ri, 1);
424 ri = session_rules_table_lookup_rule4 (srt,
425 &args->lcl.fp_addr.ip4,
426 &args->rmt.fp_addr.ip4,
429 if (ri != SESSION_RULES_TABLE_INVALID_INDEX)
431 rt = session_rules_table_rule_tag (srt, ri, 1);
432 session_rules_table_del_tag (srt, rt, 1);
433 session_rules_table_add_tag (srt, args->tag, ri, 1);
440 if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
442 rule = mma_rules_table_get_rule_16 (srt4, ri_from_tag);
443 mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index);
444 session_rules_table_del_tag (srt, args->tag, 1);
450 clib_memset (rule, 0, sizeof (*rule));
451 session_rules_table_init_rule_16 (rule, &args->lcl,
452 args->lcl_port, &args->rmt,
454 mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index);
458 else if (fib_proto == FIB_PROTOCOL_IP6)
460 mma_rules_table_40_t *srt6;
461 mma_rule_40_t *rule6;
462 srt6 = &srt->session_rules_tables_40;
465 rule6 = session_rules_table_alloc_rule_40 (srt6, &args->lcl,
469 rule6->action_index = args->action_index;
470 rv = mma_rules_table_add_rule_40 (srt6, rule6);
473 ri = mma_rules_table_rule_index_40 (srt6, rule6);
474 session_rules_table_add_tag (srt, args->tag, ri, 0);
478 ri = session_rules_table_lookup_rule6 (srt,
479 &args->lcl.fp_addr.ip6,
480 &args->rmt.fp_addr.ip6,
483 if (ri != SESSION_RULES_TABLE_INVALID_INDEX)
485 rt = session_rules_table_rule_tag (srt, ri, 0);
486 session_rules_table_del_tag (srt, rt, 1);
487 session_rules_table_add_tag (srt, args->tag, ri, 0);
494 if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
496 rule = mma_rules_table_get_rule_40 (srt6, ri_from_tag);
497 mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index);
498 session_rules_table_del_tag (srt, args->tag, 0);
504 clib_memset (rule, 0, sizeof (*rule));
505 session_rules_table_init_rule_40 (rule, &args->lcl,
506 args->lcl_port, &args->rmt,
508 mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index);
513 return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE_2, 0,
514 "invalid fib proto");
519 session_rules_table_init (session_rules_table_t * srt)
521 mma_rules_table_16_t *srt4;
522 mma_rules_table_40_t *srt6;
523 mma_rule_16_t *rule4;
524 mma_rule_40_t *rule6;
525 fib_prefix_t null_prefix;
527 clib_memset (&null_prefix, 0, sizeof (null_prefix));
529 srt4 = &srt->session_rules_tables_16;
530 rule4 = session_rules_table_alloc_rule_16 (srt4, &null_prefix, 0,
532 rule4->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
533 srt4->root_index = mma_rules_table_rule_index_16 (srt4, rule4);
534 srt4->rule_cmp_fn = rule_cmp_16;
536 srt6 = &srt->session_rules_tables_40;
537 rule6 = session_rules_table_alloc_rule_40 (srt6, &null_prefix, 0,
539 rule6->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
540 srt6->root_index = mma_rules_table_rule_index_40 (srt6, rule6);
541 srt6->rule_cmp_fn = rule_cmp_40;
543 srt->rules_by_tag = hash_create_vec (0, sizeof (u8), sizeof (uword));
544 srt->tags_by_rules = hash_create (0, sizeof (uword));
548 session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt,
549 ip46_address_t * lcl_ip, u16 lcl_port,
550 ip46_address_t * rmt_ip, u16 rmt_port,
553 mma_rules_table_16_t *srt4;
554 mma_rules_table_40_t *srt6;
561 srt4 = session_rules_table_get (srt, FIB_PROTOCOL_IP4);
562 session_mask_or_match_4_t key = {
563 .lcl_ip.as_u32 = lcl_ip->ip4.as_u32,
564 .rmt_ip.as_u32 = rmt_ip->ip4.as_u32,
565 .lcl_port = lcl_port,
566 .rmt_port = rmt_port,
569 mma_rules_table_lookup_rule_16 (srt4,
570 (mma_mask_or_match_16_t *) & key,
572 sr4 = mma_rules_table_get_rule_16 (srt4, ri);
573 vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4);
577 srt6 = session_rules_table_get (srt, FIB_PROTOCOL_IP6);
578 session_mask_or_match_6_t key = {
579 .lcl_port = lcl_port,
580 .rmt_port = rmt_port,
582 clib_memcpy_fast (&key.lcl_ip, &lcl_ip->ip6, sizeof (lcl_ip->ip6));
583 clib_memcpy_fast (&key.rmt_ip, &rmt_ip->ip6, sizeof (rmt_ip->ip6));
584 ri = mma_rules_table_lookup_rule_40 (srt6,
585 (mma_mask_or_match_40_t *) & key,
587 sr6 = mma_rules_table_get_rule_40 (srt6, ri);
588 vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6);
593 session_rules_table_cli_dump (vlib_main_t * vm, session_rules_table_t * srt,
596 if (fib_proto == FIB_PROTOCOL_IP4)
598 mma_rules_table_16_t *srt4;
600 srt4 = &srt->session_rules_tables_16;
601 vlib_cli_output (vm, "IP4 rules");
604 pool_foreach(sr4, srt4->rules, ({
605 vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4);
610 else if (fib_proto == FIB_PROTOCOL_IP6)
612 mma_rules_table_40_t *srt6;
614 srt6 = &srt->session_rules_tables_40;
615 vlib_cli_output (vm, "IP6 rules");
618 pool_foreach(sr6, srt6->rules, ({
619 vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6);
627 * fd.io coding-style-patch-verification: ON
630 * eval: (c-set-style "gnu")