2 * Copyright (c) 2017-2019 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <vnet/session/mma_16.h>
17 #include <vnet/session/mma_template.c>
18 #include <vnet/session/mma_40.h>
19 #include <vnet/session/mma_template.c>
20 #include <vnet/session/session_rules_table.h>
21 #include <vnet/session/transport.h>
24 session_rule_tag_key_index (u32 ri, u8 is_ip4)
26 return ((ri << 1) | is_ip4);
30 session_rule_tag_key_index_parse (u32 rti_key, u32 * ri, u8 * is_ip4)
32 *is_ip4 = rti_key & 1;
37 session_rules_table_rule_tag (session_rules_table_t * srt, u32 ri, u8 is_ip4)
40 session_rule_tag_t *rt;
43 hash_get (srt->tags_by_rules, session_rule_tag_key_index (ri, is_ip4));
46 rt = pool_elt_at_index (srt->rule_tags, *tip);
53 session_rules_table_del_tag (session_rules_table_t * srt, u8 * tag, u8 is_ip4)
56 session_rule_tag_t *rt;
61 rip = hash_get_mem (srt->rules_by_tag, tag);
64 clib_warning ("tag has no rule associated");
67 rti_key = session_rule_tag_key_index (*rip, is_ip4);
68 rtip = hash_get (srt->tags_by_rules, rti_key);
71 clib_warning ("rule has no tag associated");
74 rt = pool_elt_at_index (srt->rule_tags, *rtip);
76 hash_unset_mem (srt->rules_by_tag, tag);
77 hash_unset (srt->tags_by_rules, rti_key);
78 pool_put (srt->rule_tags, rt);
82 session_rules_table_add_tag (session_rules_table_t * srt, u8 * tag,
83 u32 rule_index, u8 is_ip4)
86 session_rule_tag_t *rt;
91 rip = hash_get_mem (srt->rules_by_tag, tag);
93 session_rules_table_del_tag (srt, tag, is_ip4);
94 pool_get (srt->rule_tags, rt);
95 rt->tag = vec_dup (tag);
96 hash_set_mem (srt->rules_by_tag, rt->tag, rule_index);
97 rti_key = session_rule_tag_key_index (rule_index, is_ip4);
98 hash_set (srt->tags_by_rules, rti_key, rt - srt->rule_tags);
102 session_rules_table_rule_for_tag (session_rules_table_t * srt, u8 * tag)
106 return SESSION_RULES_TABLE_INVALID_INDEX;
107 rp = hash_get_mem (srt->rules_by_tag, tag);
108 return (rp == 0 ? SESSION_RULES_TABLE_INVALID_INDEX : *rp);
112 fib_pref_normalize (fib_prefix_t * pref)
114 if (pref->fp_proto == FIB_PROTOCOL_IP4)
115 ip4_address_normalize (&pref->fp_addr.ip4, pref->fp_len);
117 ip6_address_normalize (&pref->fp_addr.ip6, pref->fp_len);
121 format_session_rule4 (u8 * s, va_list * args)
123 session_rules_table_t *srt = va_arg (*args, session_rules_table_t *);
124 mma_rule_16_t *sr = va_arg (*args, mma_rule_16_t *);
125 session_mask_or_match_4_t *mask, *match;
126 mma_rules_table_16_t *srt4;
127 u8 *tag = 0, *null_tag = format (0, "none");
131 srt4 = &srt->session_rules_tables_16;
132 ri = mma_rules_table_rule_index_16 (srt4, sr);
133 tag = session_rules_table_rule_tag (srt, ri, 1);
134 match = (session_mask_or_match_4_t *) & sr->match;
135 mask = (session_mask_or_match_4_t *) & sr->mask;
137 s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri,
138 format_ip4_address, &match->lcl_ip,
139 ip4_mask_to_preflen (&mask->lcl_ip),
140 clib_net_to_host_u16 (match->lcl_port), format_ip4_address,
141 &match->rmt_ip, ip4_mask_to_preflen (&mask->rmt_ip),
142 clib_net_to_host_u16 (match->rmt_port), sr->action_index,
143 tag ? tag : null_tag);
144 if (vec_len (sr->next_indices))
146 s = format (s, "\n children: ");
147 for (i = 0; i < vec_len (sr->next_indices); i++)
148 s = format (s, "%d ", sr->next_indices[i]);
155 format_session_rule6 (u8 * s, va_list * args)
157 session_rules_table_t *srt = va_arg (*args, session_rules_table_t *);
158 mma_rule_40_t *sr = va_arg (*args, mma_rule_40_t *);
159 session_mask_or_match_6_t *mask, *match;
160 mma_rules_table_40_t *srt6;
161 u8 *tag = 0, *null_tag = format (0, "none");
165 srt6 = &srt->session_rules_tables_40;
166 ri = mma_rules_table_rule_index_40 (srt6, sr);
167 tag = session_rules_table_rule_tag (srt, ri, 0);
168 match = (session_mask_or_match_6_t *) & sr->match;
169 mask = (session_mask_or_match_6_t *) & sr->mask;
171 s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri,
172 format_ip6_address, &match->lcl_ip,
173 ip6_mask_to_preflen (&mask->lcl_ip),
174 clib_net_to_host_u16 (match->lcl_port), format_ip6_address,
175 &match->rmt_ip, ip6_mask_to_preflen (&mask->rmt_ip),
176 clib_net_to_host_u16 (match->rmt_port), sr->action_index,
177 tag ? tag : null_tag);
178 if (vec_len (sr->next_indices))
180 s = format (s, "\n children: ");
181 for (i = 0; i < vec_len (sr->next_indices); i++)
182 s = format (s, "%d ", sr->next_indices[i]);
189 session_rules_table_get (session_rules_table_t * srt, u8 fib_proto)
191 if (fib_proto == FIB_PROTOCOL_IP4)
192 return &srt->session_rules_tables_16;
193 else if (fib_proto == FIB_PROTOCOL_IP6)
194 return &srt->session_rules_tables_40;
199 rule_cmp_16 (mma_rule_16_t * rule1, mma_rule_16_t * rule2)
201 session_mask_or_match_4_t *m1, *m2;
203 m1 = (session_mask_or_match_4_t *) & rule1->max_match;
204 m2 = (session_mask_or_match_4_t *) & rule2->max_match;
205 if (m1->rmt_ip.as_u32 != m2->rmt_ip.as_u32)
206 return (m1->rmt_ip.as_u32 < m2->rmt_ip.as_u32 ? -1 : 1);
207 if (m1->lcl_ip.as_u32 != m2->lcl_ip.as_u32)
208 return (m1->lcl_ip.as_u32 < m2->lcl_ip.as_u32 ? -1 : 1);
209 if (m1->rmt_port != m2->rmt_port)
210 return (m1->rmt_port < m2->rmt_port ? -1 : 1);
211 if (m1->lcl_port != m2->lcl_port)
212 return (m1->lcl_port < m2->lcl_port ? -1 : 1);
217 rule_cmp_40 (mma_rule_40_t * rule1, mma_rule_40_t * rule2)
219 session_mask_or_match_6_t *r1, *r2;
220 r1 = (session_mask_or_match_6_t *) & rule1->max_match;
221 r2 = (session_mask_or_match_6_t *) & rule2->max_match;
222 if (r1->rmt_ip.as_u64[0] != r2->rmt_ip.as_u64[0])
223 return (r1->rmt_ip.as_u64[0] < r2->rmt_ip.as_u64[0] ? -1 : 1);
224 if (r1->rmt_ip.as_u64[1] != r2->rmt_ip.as_u64[1])
225 return (r1->rmt_ip.as_u64[1] < r2->rmt_ip.as_u64[1] ? -1 : 1);
226 if (r1->lcl_ip.as_u64[0] != r2->lcl_ip.as_u64[0])
227 return (r1->lcl_ip.as_u64[0] < r2->lcl_ip.as_u64[0] ? -1 : 1);
228 if (r1->lcl_ip.as_u64[1] != r2->lcl_ip.as_u64[1])
229 return (r1->lcl_ip.as_u64[1] < r2->lcl_ip.as_u64[1]) ? -1 : 1;
230 if (r1->rmt_port != r2->rmt_port)
231 return (r1->rmt_port < r2->rmt_port ? -1 : 1);
232 if (r1->lcl_port != r2->lcl_port)
233 return (r1->lcl_port < r2->lcl_port ? -1 : 1);
238 session_rules_table_init_rule_16 (mma_rule_16_t * rule,
239 fib_prefix_t * lcl, u16 lcl_port,
240 fib_prefix_t * rmt, u16 rmt_port)
242 session_mask_or_match_4_t *match, *mask, *max_match;
243 fib_pref_normalize (lcl);
244 fib_pref_normalize (rmt);
245 match = (session_mask_or_match_4_t *) & rule->match;
246 match->lcl_ip.as_u32 = lcl->fp_addr.ip4.as_u32;
247 match->rmt_ip.as_u32 = rmt->fp_addr.ip4.as_u32;
248 match->lcl_port = lcl_port;
249 match->rmt_port = rmt_port;
250 mask = (session_mask_or_match_4_t *) & rule->mask;
251 ip4_preflen_to_mask (lcl->fp_len, &mask->lcl_ip);
252 ip4_preflen_to_mask (rmt->fp_len, &mask->rmt_ip);
253 mask->lcl_port = lcl_port == 0 ? 0 : (u16) ~ 0;
254 mask->rmt_port = rmt_port == 0 ? 0 : (u16) ~ 0;
255 max_match = (session_mask_or_match_4_t *) & rule->max_match;
256 ip4_prefix_max_address_host_order (&rmt->fp_addr.ip4, rmt->fp_len,
258 ip4_prefix_max_address_host_order (&lcl->fp_addr.ip4, lcl->fp_len,
260 max_match->lcl_port = lcl_port == 0 ? (u16) ~ 0 : lcl_port;
261 max_match->rmt_port = rmt_port == 0 ? (u16) ~ 0 : rmt_port;
265 session_rules_table_init_rule_40 (mma_rule_40_t * rule,
266 fib_prefix_t * lcl, u16 lcl_port,
267 fib_prefix_t * rmt, u16 rmt_port)
269 session_mask_or_match_6_t *match, *mask, *max_match;
270 fib_pref_normalize (lcl);
271 fib_pref_normalize (rmt);
272 match = (session_mask_or_match_6_t *) & rule->match;
273 clib_memcpy_fast (&match->lcl_ip, &lcl->fp_addr.ip6,
274 sizeof (match->lcl_ip));
275 clib_memcpy_fast (&match->rmt_ip, &rmt->fp_addr.ip6,
276 sizeof (match->rmt_ip));
277 match->lcl_port = lcl_port;
278 match->rmt_port = rmt_port;
279 mask = (session_mask_or_match_6_t *) & rule->mask;
280 ip6_preflen_to_mask (lcl->fp_len, &mask->lcl_ip);
281 ip6_preflen_to_mask (rmt->fp_len, &mask->rmt_ip);
282 mask->lcl_port = lcl_port == 0 ? 0 : (u16) ~ 0;
283 mask->rmt_port = rmt_port == 0 ? 0 : (u16) ~ 0;
284 max_match = (session_mask_or_match_6_t *) & rule->max_match;
285 ip6_prefix_max_address_host_order (&rmt->fp_addr.ip6, rmt->fp_len,
287 ip6_prefix_max_address_host_order (&lcl->fp_addr.ip6, lcl->fp_len,
289 max_match->lcl_port = lcl_port == 0 ? (u16) ~ 0 : lcl_port;
290 max_match->rmt_port = rmt_port == 0 ? (u16) ~ 0 : rmt_port;
294 session_rules_table_alloc_rule_16 (mma_rules_table_16_t * srt,
295 fib_prefix_t * lcl, u16 lcl_port,
296 fib_prefix_t * rmt, u16 rmt_port)
298 mma_rule_16_t *rule = 0;
299 rule = mma_rules_table_rule_alloc_16 (srt);
300 session_rules_table_init_rule_16 (rule, lcl, lcl_port, rmt, rmt_port);
305 session_rules_table_alloc_rule_40 (mma_rules_table_40_t * srt,
306 fib_prefix_t * lcl, u16 lcl_port,
307 fib_prefix_t * rmt, u16 rmt_port)
310 rule = mma_rules_table_rule_alloc_40 (srt);
311 session_rules_table_init_rule_40 (rule, lcl, lcl_port, rmt, rmt_port);
316 session_rules_table_lookup_rule4 (session_rules_table_t * srt,
317 ip4_address_t * lcl_ip,
318 ip4_address_t * rmt_ip, u16 lcl_port,
321 mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16;
322 session_mask_or_match_4_t key = {
323 .lcl_ip.as_u32 = lcl_ip->as_u32,
324 .rmt_ip.as_u32 = rmt_ip->as_u32,
325 .lcl_port = lcl_port,
326 .rmt_port = rmt_port,
328 return mma_rules_table_lookup_rule_16 (srt4,
329 (mma_mask_or_match_16_t *) & key,
334 session_rules_table_lookup4 (session_rules_table_t * srt,
335 ip4_address_t * lcl_ip, ip4_address_t * rmt_ip,
336 u16 lcl_port, u16 rmt_port)
338 mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16;
339 session_mask_or_match_4_t key = {
340 .lcl_ip.as_u32 = lcl_ip->as_u32,
341 .rmt_ip.as_u32 = rmt_ip->as_u32,
342 .lcl_port = lcl_port,
343 .rmt_port = rmt_port,
345 return mma_rules_table_lookup_16 (srt4, (mma_mask_or_match_16_t *) & key,
350 session_rules_table_lookup_rule6 (session_rules_table_t * srt,
351 ip6_address_t * lcl_ip,
352 ip6_address_t * rmt_ip, u16 lcl_port,
355 mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40;
356 session_mask_or_match_6_t key = {
357 .lcl_port = lcl_port,
358 .rmt_port = rmt_port,
360 clib_memcpy_fast (&key.lcl_ip, lcl_ip, sizeof (*lcl_ip));
361 clib_memcpy_fast (&key.rmt_ip, rmt_ip, sizeof (*rmt_ip));
362 return mma_rules_table_lookup_rule_40 (srt6,
363 (mma_mask_or_match_40_t *) & key,
368 session_rules_table_lookup6 (session_rules_table_t * srt,
369 ip6_address_t * lcl_ip, ip6_address_t * rmt_ip,
370 u16 lcl_port, u16 rmt_port)
372 mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40;
373 session_mask_or_match_6_t key = {
374 .lcl_port = lcl_port,
375 .rmt_port = rmt_port,
377 clib_memcpy_fast (&key.lcl_ip, lcl_ip, sizeof (*lcl_ip));
378 clib_memcpy_fast (&key.rmt_ip, rmt_ip, sizeof (*rmt_ip));
379 return mma_rules_table_lookup_40 (srt6, (mma_mask_or_match_40_t *) & key,
384 * Add/delete session rule
386 * @param srt table where rule should be added
387 * @param args rule arguments
389 * @return 0 if success, clib_error_t error otherwise
392 session_rules_table_add_del (session_rules_table_t * srt,
393 session_rule_table_add_del_args_t * args)
395 u8 fib_proto = args->rmt.fp_proto, *rt;
399 ri_from_tag = session_rules_table_rule_for_tag (srt, args->tag);
400 if (args->is_add && ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
401 return VNET_API_ERROR_INVALID_VALUE;
403 if (fib_proto == FIB_PROTOCOL_IP4)
405 mma_rules_table_16_t *srt4;
406 srt4 = &srt->session_rules_tables_16;
409 mma_rule_16_t *rule4;
410 rule4 = session_rules_table_alloc_rule_16 (srt4, &args->lcl,
414 rule4->action_index = args->action_index;
415 rv = mma_rules_table_add_rule_16 (srt4, rule4);
418 ri = mma_rules_table_rule_index_16 (srt4, rule4);
419 session_rules_table_add_tag (srt, args->tag, ri, 1);
423 ri = session_rules_table_lookup_rule4 (srt,
424 &args->lcl.fp_addr.ip4,
425 &args->rmt.fp_addr.ip4,
428 if (ri != SESSION_RULES_TABLE_INVALID_INDEX)
430 rt = session_rules_table_rule_tag (srt, ri, 1);
431 session_rules_table_del_tag (srt, rt, 1);
432 session_rules_table_add_tag (srt, args->tag, ri, 1);
439 if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
441 rule = mma_rules_table_get_rule_16 (srt4, ri_from_tag);
442 mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index);
443 session_rules_table_del_tag (srt, args->tag, 1);
449 clib_memset (rule, 0, sizeof (*rule));
450 session_rules_table_init_rule_16 (rule, &args->lcl,
451 args->lcl_port, &args->rmt,
453 mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index);
457 else if (fib_proto == FIB_PROTOCOL_IP6)
459 mma_rules_table_40_t *srt6;
460 mma_rule_40_t *rule6;
461 srt6 = &srt->session_rules_tables_40;
464 rule6 = session_rules_table_alloc_rule_40 (srt6, &args->lcl,
468 rule6->action_index = args->action_index;
469 rv = mma_rules_table_add_rule_40 (srt6, rule6);
472 ri = mma_rules_table_rule_index_40 (srt6, rule6);
473 session_rules_table_add_tag (srt, args->tag, ri, 0);
477 ri = session_rules_table_lookup_rule6 (srt,
478 &args->lcl.fp_addr.ip6,
479 &args->rmt.fp_addr.ip6,
482 if (ri != SESSION_RULES_TABLE_INVALID_INDEX)
484 rt = session_rules_table_rule_tag (srt, ri, 0);
485 session_rules_table_del_tag (srt, rt, 1);
486 session_rules_table_add_tag (srt, args->tag, ri, 0);
493 if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
495 rule = mma_rules_table_get_rule_40 (srt6, ri_from_tag);
496 mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index);
497 session_rules_table_del_tag (srt, args->tag, 0);
503 clib_memset (rule, 0, sizeof (*rule));
504 session_rules_table_init_rule_40 (rule, &args->lcl,
505 args->lcl_port, &args->rmt,
507 mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index);
512 return VNET_API_ERROR_INVALID_VALUE_2;
517 session_rules_table_init (session_rules_table_t * srt)
519 mma_rules_table_16_t *srt4;
520 mma_rules_table_40_t *srt6;
521 mma_rule_16_t *rule4;
522 mma_rule_40_t *rule6;
523 fib_prefix_t null_prefix;
525 clib_memset (&null_prefix, 0, sizeof (null_prefix));
527 srt4 = &srt->session_rules_tables_16;
528 rule4 = session_rules_table_alloc_rule_16 (srt4, &null_prefix, 0,
530 rule4->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
531 srt4->root_index = mma_rules_table_rule_index_16 (srt4, rule4);
532 srt4->rule_cmp_fn = rule_cmp_16;
534 srt6 = &srt->session_rules_tables_40;
535 rule6 = session_rules_table_alloc_rule_40 (srt6, &null_prefix, 0,
537 rule6->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
538 srt6->root_index = mma_rules_table_rule_index_40 (srt6, rule6);
539 srt6->rule_cmp_fn = rule_cmp_40;
541 srt->rules_by_tag = hash_create_vec (0, sizeof (u8), sizeof (uword));
542 srt->tags_by_rules = hash_create (0, sizeof (uword));
546 session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt,
547 ip46_address_t * lcl_ip, u16 lcl_port,
548 ip46_address_t * rmt_ip, u16 rmt_port,
551 mma_rules_table_16_t *srt4;
552 mma_rules_table_40_t *srt6;
559 srt4 = session_rules_table_get (srt, FIB_PROTOCOL_IP4);
560 session_mask_or_match_4_t key = {
561 .lcl_ip.as_u32 = lcl_ip->ip4.as_u32,
562 .rmt_ip.as_u32 = rmt_ip->ip4.as_u32,
563 .lcl_port = lcl_port,
564 .rmt_port = rmt_port,
567 mma_rules_table_lookup_rule_16 (srt4,
568 (mma_mask_or_match_16_t *) & key,
570 sr4 = mma_rules_table_get_rule_16 (srt4, ri);
571 vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4);
575 srt6 = session_rules_table_get (srt, FIB_PROTOCOL_IP6);
576 session_mask_or_match_6_t key = {
577 .lcl_port = lcl_port,
578 .rmt_port = rmt_port,
580 clib_memcpy_fast (&key.lcl_ip, &lcl_ip->ip6, sizeof (lcl_ip->ip6));
581 clib_memcpy_fast (&key.rmt_ip, &rmt_ip->ip6, sizeof (rmt_ip->ip6));
582 ri = mma_rules_table_lookup_rule_40 (srt6,
583 (mma_mask_or_match_40_t *) & key,
585 sr6 = mma_rules_table_get_rule_40 (srt6, ri);
586 vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6);
591 session_rules_table_cli_dump (vlib_main_t * vm, session_rules_table_t * srt,
594 if (fib_proto == FIB_PROTOCOL_IP4)
596 mma_rules_table_16_t *srt4;
598 srt4 = &srt->session_rules_tables_16;
599 vlib_cli_output (vm, "IP4 rules");
602 pool_foreach(sr4, srt4->rules, ({
603 vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4);
608 else if (fib_proto == FIB_PROTOCOL_IP6)
610 mma_rules_table_40_t *srt6;
612 srt6 = &srt->session_rules_tables_40;
613 vlib_cli_output (vm, "IP6 rules");
616 pool_foreach(sr6, srt6->rules, ({
617 vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6);
625 * fd.io coding-style-patch-verification: ON
628 * eval: (c-set-style "gnu")