2 * Copyright (c) 2017 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <vnet/session/mma_16.h>
17 #include <vnet/session/mma_template.c>
18 #include <vnet/session/mma_40.h>
19 #include <vnet/session/mma_template.c>
20 #include <vnet/session/session_rules_table.h>
21 #include <vnet/session/transport.h>
24 session_rule_tag_key_index (u32 ri, u8 is_ip4)
26 return ((ri << 1) | is_ip4);
30 session_rule_tag_key_index_parse (u32 rti_key, u32 * ri, u8 * is_ip4)
32 *is_ip4 = rti_key & 1;
37 session_rules_table_rule_tag (session_rules_table_t * srt, u32 ri, u8 is_ip4)
40 session_rule_tag_t *rt;
43 hash_get (srt->tags_by_rules, session_rule_tag_key_index (ri, is_ip4));
46 rt = pool_elt_at_index (srt->rule_tags, *tip);
53 session_rules_table_del_tag (session_rules_table_t * srt, u8 * tag, u8 is_ip4)
56 session_rule_tag_t *rt;
61 rip = hash_get_mem (srt->rules_by_tag, tag);
64 clib_warning ("tag has no rule associated");
67 rti_key = session_rule_tag_key_index (*rip, is_ip4);
68 rtip = hash_get (srt->tags_by_rules, rti_key);
71 clib_warning ("rule has no tag associated");
74 rt = pool_elt_at_index (srt->rule_tags, *rtip);
76 hash_unset_mem (srt->rules_by_tag, tag);
77 hash_unset (srt->tags_by_rules, rti_key);
78 pool_put (srt->rule_tags, rt);
82 session_rules_table_add_tag (session_rules_table_t * srt, u8 * tag,
83 u32 rule_index, u8 is_ip4)
86 session_rule_tag_t *rt;
91 rip = hash_get_mem (srt->rules_by_tag, tag);
93 session_rules_table_del_tag (srt, tag, is_ip4);
94 pool_get (srt->rule_tags, rt);
95 rt->tag = vec_dup (tag);
96 hash_set_mem (srt->rules_by_tag, rt->tag, rule_index);
97 rti_key = session_rule_tag_key_index (rule_index, is_ip4);
98 hash_set (srt->tags_by_rules, rti_key, rt - srt->rule_tags);
102 session_rules_table_rule_for_tag (session_rules_table_t * srt, u8 * tag)
106 return SESSION_RULES_TABLE_INVALID_INDEX;
107 rp = hash_get_mem (srt->rules_by_tag, tag);
108 return (rp == 0 ? SESSION_RULES_TABLE_INVALID_INDEX : *rp);
112 fib_pref_normalize (fib_prefix_t * pref)
114 if (pref->fp_proto == FIB_PROTOCOL_IP4)
115 ip4_address_normalize (&pref->fp_addr.ip4, pref->fp_len);
117 ip6_address_normalize (&pref->fp_addr.ip6, pref->fp_len);
121 format_session_rule4 (u8 * s, va_list * args)
123 session_rules_table_t *srt = va_arg (*args, session_rules_table_t *);
124 mma_rule_16_t *sr = va_arg (*args, mma_rule_16_t *);
125 session_mask_or_match_4_t *mask, *match;
126 mma_rules_table_16_t *srt4;
127 u8 *tag = 0, *null_tag = format (0, "none");
131 srt4 = &srt->session_rules_tables_16;
132 ri = mma_rules_table_rule_index_16 (srt4, sr);
133 tag = session_rules_table_rule_tag (srt, ri, 1);
134 match = (session_mask_or_match_4_t *) & sr->match;
135 mask = (session_mask_or_match_4_t *) & sr->mask;
137 s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri,
138 format_ip4_address, &match->lcl_ip,
139 ip4_mask_to_preflen (&mask->lcl_ip),
140 clib_net_to_host_u16 (match->lcl_port), format_ip4_address,
141 &match->rmt_ip, ip4_mask_to_preflen (&mask->rmt_ip),
142 clib_net_to_host_u16 (match->rmt_port), sr->action_index,
143 tag ? tag : null_tag);
144 if (vec_len (sr->next_indices))
146 s = format (s, "\n children: ");
147 for (i = 0; i < vec_len (sr->next_indices); i++)
148 s = format (s, "%d ", sr->next_indices[i]);
155 format_session_rule6 (u8 * s, va_list * args)
157 session_rules_table_t *srt = va_arg (*args, session_rules_table_t *);
158 mma_rule_40_t *sr = va_arg (*args, mma_rule_40_t *);
159 session_mask_or_match_6_t *mask, *match;
160 mma_rules_table_40_t *srt6;
161 u8 *tag = 0, *null_tag = format (0, "none");
165 srt6 = &srt->session_rules_tables_40;
166 ri = mma_rules_table_rule_index_40 (srt6, sr);
167 tag = session_rules_table_rule_tag (srt, ri, 0);
168 match = (session_mask_or_match_6_t *) & sr->match;
169 mask = (session_mask_or_match_6_t *) & sr->mask;
171 s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri,
172 format_ip6_address, &match->lcl_ip,
173 ip6_mask_to_preflen (&mask->lcl_ip),
174 clib_net_to_host_u16 (match->lcl_port), format_ip6_address,
175 &match->rmt_ip, ip6_mask_to_preflen (&mask->rmt_ip),
176 clib_net_to_host_u16 (match->rmt_port), sr->action_index,
177 tag ? tag : null_tag);
178 if (vec_len (sr->next_indices))
180 s = format (s, "\n children: ");
181 for (i = 0; i < vec_len (sr->next_indices); i++)
182 s = format (s, "%d ", sr->next_indices[i]);
189 session_rules_table_get (session_rules_table_t * srt, u8 fib_proto)
191 if (fib_proto == FIB_PROTOCOL_IP4)
192 return &srt->session_rules_tables_16;
193 else if (fib_proto == FIB_PROTOCOL_IP6)
194 return &srt->session_rules_tables_40;
199 rule_cmp_16 (mma_rule_16_t * rule1, mma_rule_16_t * rule2)
201 session_mask_or_match_4_t *m1, *m2;
203 m1 = (session_mask_or_match_4_t *) & rule1->max_match;
204 m2 = (session_mask_or_match_4_t *) & rule2->max_match;
205 if (m1->rmt_ip.as_u32 != m2->rmt_ip.as_u32)
206 return (m1->rmt_ip.as_u32 < m2->rmt_ip.as_u32 ? -1 : 1);
207 if (m1->lcl_ip.as_u32 != m2->lcl_ip.as_u32)
208 return (m1->lcl_ip.as_u32 < m2->lcl_ip.as_u32 ? -1 : 1);
209 if (m1->rmt_port != m2->rmt_port)
210 return (m1->rmt_port < m2->rmt_port ? -1 : 1);
211 if (m1->lcl_port != m2->lcl_port)
212 return (m1->lcl_port < m2->lcl_port ? -1 : 1);
217 rule_cmp_40 (mma_rule_40_t * rule1, mma_rule_40_t * rule2)
219 session_mask_or_match_6_t *r1, *r2;
220 r1 = (session_mask_or_match_6_t *) & rule1->max_match;
221 r2 = (session_mask_or_match_6_t *) & rule2->max_match;
222 if (r1->rmt_ip.as_u64[0] != r2->rmt_ip.as_u64[0])
223 return (r1->rmt_ip.as_u64[0] < r2->rmt_ip.as_u64[0] ? -1 : 1);
224 if (r1->rmt_ip.as_u64[1] != r2->rmt_ip.as_u64[1])
225 return (r1->rmt_ip.as_u64[1] < r2->rmt_ip.as_u64[1] ? -1 : 1);
226 if (r1->lcl_ip.as_u64[0] != r2->lcl_ip.as_u64[0])
227 return (r1->lcl_ip.as_u64[0] < r2->lcl_ip.as_u64[0] ? -1 : 1);
228 if (r1->lcl_ip.as_u64[1] != r2->lcl_ip.as_u64[1])
229 return (r1->lcl_ip.as_u64[1] < r2->lcl_ip.as_u64[1]) ? -1 : 1;
230 if (r1->rmt_port != r2->rmt_port)
231 return (r1->rmt_port < r2->rmt_port ? -1 : 1);
232 if (r1->lcl_port != r2->lcl_port)
233 return (r1->lcl_port < r2->lcl_port ? -1 : 1);
238 session_rules_table_init_rule_16 (mma_rule_16_t * rule,
239 fib_prefix_t * lcl, u16 lcl_port,
240 fib_prefix_t * rmt, u16 rmt_port)
242 session_mask_or_match_4_t *match, *mask, *max_match;
243 fib_pref_normalize (lcl);
244 fib_pref_normalize (rmt);
245 match = (session_mask_or_match_4_t *) & rule->match;
246 match->lcl_ip.as_u32 = lcl->fp_addr.ip4.as_u32;
247 match->rmt_ip.as_u32 = rmt->fp_addr.ip4.as_u32;
248 match->lcl_port = lcl_port;
249 match->rmt_port = rmt_port;
250 mask = (session_mask_or_match_4_t *) & rule->mask;
251 ip4_preflen_to_mask (lcl->fp_len, &mask->lcl_ip);
252 ip4_preflen_to_mask (rmt->fp_len, &mask->rmt_ip);
253 mask->lcl_port = lcl_port == 0 ? 0 : (u16) ~ 0;
254 mask->rmt_port = rmt_port == 0 ? 0 : (u16) ~ 0;
255 max_match = (session_mask_or_match_4_t *) & rule->max_match;
256 ip4_prefix_max_address_host_order (&rmt->fp_addr.ip4, rmt->fp_len,
258 ip4_prefix_max_address_host_order (&lcl->fp_addr.ip4, lcl->fp_len,
260 max_match->lcl_port = lcl_port == 0 ? (u16) ~ 0 : lcl_port;
261 max_match->rmt_port = rmt_port == 0 ? (u16) ~ 0 : rmt_port;
265 session_rules_table_init_rule_40 (mma_rule_40_t * rule,
266 fib_prefix_t * lcl, u16 lcl_port,
267 fib_prefix_t * rmt, u16 rmt_port)
269 session_mask_or_match_6_t *match, *mask, *max_match;
270 fib_pref_normalize (lcl);
271 fib_pref_normalize (rmt);
272 match = (session_mask_or_match_6_t *) & rule->match;
273 clib_memcpy (&match->lcl_ip, &lcl->fp_addr.ip6, sizeof (match->lcl_ip));
274 clib_memcpy (&match->rmt_ip, &rmt->fp_addr.ip6, sizeof (match->rmt_ip));
275 match->lcl_port = lcl_port;
276 match->rmt_port = rmt_port;
277 mask = (session_mask_or_match_6_t *) & rule->mask;
278 ip6_preflen_to_mask (lcl->fp_len, &mask->lcl_ip);
279 ip6_preflen_to_mask (rmt->fp_len, &mask->rmt_ip);
280 mask->lcl_port = lcl_port == 0 ? 0 : (u16) ~ 0;
281 mask->rmt_port = rmt_port == 0 ? 0 : (u16) ~ 0;
282 max_match = (session_mask_or_match_6_t *) & rule->max_match;
283 ip6_prefix_max_address_host_order (&rmt->fp_addr.ip6, rmt->fp_len,
285 ip6_prefix_max_address_host_order (&lcl->fp_addr.ip6, lcl->fp_len,
287 max_match->lcl_port = lcl_port == 0 ? (u16) ~ 0 : lcl_port;
288 max_match->rmt_port = rmt_port == 0 ? (u16) ~ 0 : rmt_port;
292 session_rules_table_alloc_rule_16 (mma_rules_table_16_t * srt,
293 fib_prefix_t * lcl, u16 lcl_port,
294 fib_prefix_t * rmt, u16 rmt_port)
296 mma_rule_16_t *rule = 0;
297 rule = mma_rules_table_rule_alloc_16 (srt);
298 session_rules_table_init_rule_16 (rule, lcl, lcl_port, rmt, rmt_port);
303 session_rules_table_alloc_rule_40 (mma_rules_table_40_t * srt,
304 fib_prefix_t * lcl, u16 lcl_port,
305 fib_prefix_t * rmt, u16 rmt_port)
308 rule = mma_rules_table_rule_alloc_40 (srt);
309 session_rules_table_init_rule_40 (rule, lcl, lcl_port, rmt, rmt_port);
314 session_rules_table_lookup_rule4 (session_rules_table_t * srt,
315 ip4_address_t * lcl_ip,
316 ip4_address_t * rmt_ip, u16 lcl_port,
319 mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16;
320 session_mask_or_match_4_t key = {
321 .lcl_ip.as_u32 = lcl_ip->as_u32,
322 .rmt_ip.as_u32 = rmt_ip->as_u32,
323 .lcl_port = lcl_port,
324 .rmt_port = rmt_port,
326 return mma_rules_table_lookup_rule_16 (srt4,
327 (mma_mask_or_match_16_t *) & key,
332 session_rules_table_lookup4 (session_rules_table_t * srt,
333 ip4_address_t * lcl_ip, ip4_address_t * rmt_ip,
334 u16 lcl_port, u16 rmt_port)
336 mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16;
337 session_mask_or_match_4_t key = {
338 .lcl_ip.as_u32 = lcl_ip->as_u32,
339 .rmt_ip.as_u32 = rmt_ip->as_u32,
340 .lcl_port = lcl_port,
341 .rmt_port = rmt_port,
343 return mma_rules_table_lookup_16 (srt4, (mma_mask_or_match_16_t *) & key,
348 session_rules_table_lookup_rule6 (session_rules_table_t * srt,
349 ip6_address_t * lcl_ip,
350 ip6_address_t * rmt_ip, u16 lcl_port,
353 mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40;
354 session_mask_or_match_6_t key = {
355 .lcl_port = lcl_port,
356 .rmt_port = rmt_port,
358 clib_memcpy (&key.lcl_ip, lcl_ip, sizeof (*lcl_ip));
359 clib_memcpy (&key.rmt_ip, rmt_ip, sizeof (*rmt_ip));
360 return mma_rules_table_lookup_rule_40 (srt6,
361 (mma_mask_or_match_40_t *) & key,
366 session_rules_table_lookup6 (session_rules_table_t * srt,
367 ip6_address_t * lcl_ip, ip6_address_t * rmt_ip,
368 u16 lcl_port, u16 rmt_port)
370 mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40;
371 session_mask_or_match_6_t key = {
372 .lcl_port = lcl_port,
373 .rmt_port = rmt_port,
375 clib_memcpy (&key.lcl_ip, lcl_ip, sizeof (*lcl_ip));
376 clib_memcpy (&key.rmt_ip, rmt_ip, sizeof (*rmt_ip));
377 return mma_rules_table_lookup_40 (srt6, (mma_mask_or_match_40_t *) & key,
382 * Add/delete session rule
384 * @param srt table where rule should be added
385 * @param args rule arguments
387 * @return 0 if success, clib_error_t error otherwise
390 session_rules_table_add_del (session_rules_table_t * srt,
391 session_rule_table_add_del_args_t * args)
393 u8 fib_proto = args->rmt.fp_proto, *rt;
397 ri_from_tag = session_rules_table_rule_for_tag (srt, args->tag);
398 if (args->is_add && ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
399 return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
402 if (fib_proto == FIB_PROTOCOL_IP4)
404 mma_rules_table_16_t *srt4;
405 srt4 = &srt->session_rules_tables_16;
408 mma_rule_16_t *rule4;
409 rule4 = session_rules_table_alloc_rule_16 (srt4, &args->lcl,
413 rule4->action_index = args->action_index;
414 rv = mma_rules_table_add_rule_16 (srt4, rule4);
417 ri = mma_rules_table_rule_index_16 (srt4, rule4);
418 session_rules_table_add_tag (srt, args->tag, ri, 1);
422 ri = session_rules_table_lookup_rule4 (srt,
423 &args->lcl.fp_addr.ip4,
424 &args->rmt.fp_addr.ip4,
427 if (ri != SESSION_RULES_TABLE_INVALID_INDEX)
429 rt = session_rules_table_rule_tag (srt, ri, 1);
430 session_rules_table_del_tag (srt, rt, 1);
431 session_rules_table_add_tag (srt, args->tag, ri, 1);
438 if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
440 rule = mma_rules_table_get_rule_16 (srt4, ri_from_tag);
441 mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index);
442 session_rules_table_del_tag (srt, args->tag, 1);
448 memset (rule, 0, sizeof (*rule));
449 session_rules_table_init_rule_16 (rule, &args->lcl,
450 args->lcl_port, &args->rmt,
452 mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index);
456 else if (fib_proto == FIB_PROTOCOL_IP6)
458 mma_rules_table_40_t *srt6;
459 mma_rule_40_t *rule6;
460 srt6 = &srt->session_rules_tables_40;
463 rule6 = session_rules_table_alloc_rule_40 (srt6, &args->lcl,
467 rule6->action_index = args->action_index;
468 rv = mma_rules_table_add_rule_40 (srt6, rule6);
471 ri = mma_rules_table_rule_index_40 (srt6, rule6);
472 session_rules_table_add_tag (srt, args->tag, ri, 0);
476 ri = session_rules_table_lookup_rule6 (srt,
477 &args->lcl.fp_addr.ip6,
478 &args->rmt.fp_addr.ip6,
481 if (ri != SESSION_RULES_TABLE_INVALID_INDEX)
483 rt = session_rules_table_rule_tag (srt, ri, 0);
484 session_rules_table_del_tag (srt, rt, 1);
485 session_rules_table_add_tag (srt, args->tag, ri, 0);
492 if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
494 rule = mma_rules_table_get_rule_40 (srt6, ri_from_tag);
495 mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index);
496 session_rules_table_del_tag (srt, args->tag, 0);
502 memset (rule, 0, sizeof (*rule));
503 session_rules_table_init_rule_40 (rule, &args->lcl,
504 args->lcl_port, &args->rmt,
506 mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index);
511 return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE_2, 0,
512 "invalid fib proto");
517 session_rules_table_init (session_rules_table_t * srt)
519 mma_rules_table_16_t *srt4;
520 mma_rules_table_40_t *srt6;
521 mma_rule_16_t *rule4;
522 mma_rule_40_t *rule6;
523 fib_prefix_t null_prefix;
525 memset (&null_prefix, 0, sizeof (null_prefix));
527 srt4 = &srt->session_rules_tables_16;
528 rule4 = session_rules_table_alloc_rule_16 (srt4, &null_prefix, 0,
530 rule4->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
531 srt4->root_index = mma_rules_table_rule_index_16 (srt4, rule4);
532 srt4->rule_cmp_fn = rule_cmp_16;
534 srt6 = &srt->session_rules_tables_40;
535 rule6 = session_rules_table_alloc_rule_40 (srt6, &null_prefix, 0,
537 rule6->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
538 srt6->root_index = mma_rules_table_rule_index_40 (srt6, rule6);
539 srt6->rule_cmp_fn = rule_cmp_40;
541 srt->rules_by_tag = hash_create_vec (0, sizeof (u8), sizeof (uword));
542 srt->tags_by_rules = hash_create (0, sizeof (uword));
546 session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt,
547 ip46_address_t * lcl_ip, u16 lcl_port,
548 ip46_address_t * rmt_ip, u16 rmt_port,
551 mma_rules_table_16_t *srt4;
552 mma_rules_table_40_t *srt6;
559 srt4 = session_rules_table_get (srt, FIB_PROTOCOL_IP4);
560 session_mask_or_match_4_t key = {
561 .lcl_ip.as_u32 = lcl_ip->ip4.as_u32,
562 .rmt_ip.as_u32 = rmt_ip->ip4.as_u32,
563 .lcl_port = lcl_port,
564 .rmt_port = rmt_port,
567 mma_rules_table_lookup_rule_16 (srt4,
568 (mma_mask_or_match_16_t *) & key,
570 sr4 = mma_rules_table_get_rule_16 (srt4, ri);
571 vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4);
575 srt6 = session_rules_table_get (srt, FIB_PROTOCOL_IP6);
576 session_mask_or_match_6_t key = {
577 .lcl_port = lcl_port,
578 .rmt_port = rmt_port,
580 clib_memcpy (&key.lcl_ip, &lcl_ip->ip6, sizeof (lcl_ip->ip6));
581 clib_memcpy (&key.rmt_ip, &rmt_ip->ip6, sizeof (rmt_ip->ip6));
582 ri = mma_rules_table_lookup_rule_40 (srt6,
583 (mma_mask_or_match_40_t *) & key,
585 sr6 = mma_rules_table_get_rule_40 (srt6, ri);
586 vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6);
591 session_rules_table_cli_dump (vlib_main_t * vm, session_rules_table_t * srt,
594 if (fib_proto == FIB_PROTOCOL_IP4)
596 mma_rules_table_16_t *srt4;
598 srt4 = &srt->session_rules_tables_16;
599 vlib_cli_output (vm, "IP4 rules");
602 pool_foreach(sr4, srt4->rules, ({
603 vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4);
608 else if (fib_proto == FIB_PROTOCOL_IP6)
610 mma_rules_table_40_t *srt6;
612 srt6 = &srt->session_rules_tables_40;
613 vlib_cli_output (vm, "IP6 rules");
616 pool_foreach(sr6, srt6->rules, ({
617 vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6);
625 * fd.io coding-style-patch-verification: ON
628 * eval: (c-set-style "gnu")