2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
15 #include <vnet/ip/ip.h>
16 #include <vnet/classify/vnet_classify.h>
17 #include <vnet/classify/input_acl.h>
19 input_acl_main_t input_acl_main;
22 vnet_inacl_ip_feature_enable (vlib_main_t * vnm,
25 input_acl_table_id_t tid,
29 if (tid == INPUT_ACL_TABLE_L2)
31 l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_ACL,
36 ip_lookup_main_t * lm;
37 ip_config_main_t * ipcm;
41 if (tid == INPUT_ACL_TABLE_IP4)
43 lm = &ip4_main.lookup_main;
44 ftype = ip4_main.ip4_unicast_rx_feature_check_access;
48 lm = &ip6_main.lookup_main;
49 ftype = ip6_main.ip6_unicast_rx_feature_check_access;
52 ipcm = &lm->feature_config_mains[VNET_IP_RX_UNICAST_FEAT];
54 ci = ipcm->config_index_by_sw_if_index[sw_if_index];
55 ci = ((feature_enable)
56 ? vnet_config_add_feature
57 : vnet_config_del_feature)
58 (vnm, &ipcm->config_main, ci, ftype,
60 /* # bytes of config data */ 0);
62 ipcm->config_index_by_sw_if_index[sw_if_index] = ci;
63 am->vnet_config_main[tid] = &ipcm->config_main;
69 int vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index,
72 u32 l2_table_index, u32 is_add)
74 input_acl_main_t * am = &input_acl_main;
75 vnet_classify_main_t * vcm = am->vnet_classify_main;
76 u32 acl[INPUT_ACL_N_TABLES] = {ip4_table_index, ip6_table_index,
80 /* Assume that we've validated sw_if_index in the API layer */
82 for (ti = 0; ti < INPUT_ACL_N_TABLES; ti++)
87 if (pool_is_free_index (vcm->tables, acl[ti]))
88 return VNET_API_ERROR_NO_SUCH_TABLE;
90 vec_validate_init_empty
91 (am->classify_table_index_by_sw_if_index[ti], sw_if_index, ~0);
93 /* Reject any DEL operation with wrong sw_if_index */
95 (acl[ti] != am->classify_table_index_by_sw_if_index[ti][sw_if_index]))
97 clib_warning ("Non-existent intf_idx=%d with table_index=%d for delete",
98 sw_if_index, acl[ti]);
99 return VNET_API_ERROR_NO_SUCH_TABLE;
102 /* Return ok on ADD operaton if feature is already enabled */
104 am->classify_table_index_by_sw_if_index[ti][sw_if_index] != ~0)
107 vnet_inacl_ip_feature_enable (vm, am, sw_if_index, ti, is_add);
110 am->classify_table_index_by_sw_if_index[ti][sw_if_index] = acl[ti];
112 am->classify_table_index_by_sw_if_index[ti][sw_if_index] = ~0;
118 static clib_error_t *
119 set_input_acl_command_fn (vlib_main_t * vm,
120 unformat_input_t * input,
121 vlib_cli_command_t * cmd)
123 vnet_main_t * vnm = vnet_get_main();
124 u32 sw_if_index = ~0;
125 u32 ip4_table_index = ~0;
126 u32 ip6_table_index = ~0;
127 u32 l2_table_index = ~0;
132 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
134 if (unformat (input, "intfc %U", unformat_vnet_sw_interface,
137 else if (unformat (input, "ip4-table %d", &ip4_table_index))
139 else if (unformat (input, "ip6-table %d", &ip6_table_index))
141 else if (unformat (input, "l2-table %d", &l2_table_index))
143 else if (unformat (input, "del"))
149 if (sw_if_index == ~0)
150 return clib_error_return (0, "Interface must be specified.");
153 return clib_error_return (0, "Table index should be specified.");
156 return clib_error_return (0, "Only one table index per API is allowed.");
158 rv = vnet_set_input_acl_intfc (vm, sw_if_index, ip4_table_index,
159 ip6_table_index, l2_table_index, is_add);
166 case VNET_API_ERROR_NO_MATCHING_INTERFACE:
167 return clib_error_return (0, "No such interface");
169 case VNET_API_ERROR_NO_SUCH_ENTRY:
170 return clib_error_return (0, "No such classifier table");
176 * Configure interface to enable/disble input ACL feature:
177 * intfc - interface name to be configured as input ACL
178 * Ip4-table <index> [del] - enable/disable IP4 input ACL
179 * Ip6-table <index> [del] - enable/disable IP6 input ACL
180 * l2-table <index> [del] - enable/disable Layer2 input ACL
182 * Note: Only one table index per API call is allowed.
185 VLIB_CLI_COMMAND (set_input_acl_command, static) = {
186 .path = "set interface input acl",
188 "set interface input acl intfc <int> [ip4-table <index>]\n"
189 " [ip6-table <index>] [l2-table <index>] [del]",
190 .function = set_input_acl_command_fn,
193 clib_error_t *input_acl_init (vlib_main_t *vm)
195 input_acl_main_t * am = &input_acl_main;
196 clib_error_t * error = 0;
198 if ((error = vlib_call_init_function (vm, ip_inacl_init)))
202 am->vnet_main = vnet_get_main();
203 am->vnet_classify_main = &vnet_classify_main;
208 VLIB_INIT_FUNCTION (input_acl_init);
210 uword unformat_acl_type (unformat_input_t * input, va_list * args)
212 u32 * acl_type = va_arg (*args, u32 *);
213 u32 tid = INPUT_ACL_N_TABLES;
215 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) {
216 if (unformat (input, "ip4"))
217 tid = INPUT_ACL_TABLE_IP4;
218 else if (unformat (input, "ip6"))
219 tid = INPUT_ACL_TABLE_IP6;
220 else if (unformat (input, "l2"))
221 tid = INPUT_ACL_TABLE_L2;
230 u8 * format_vnet_inacl_info (u8 * s, va_list * va)
232 input_acl_main_t * am = va_arg (*va, input_acl_main_t *);
233 int sw_if_idx = va_arg (*va, int);
234 u32 tid = va_arg (*va, u32);
238 s = format (s, "%10s%20s\t\t%s", "Intfc idx", "Classify table",
243 s = format (s, "%10d%20d\t\t%U", sw_if_idx, tid,
244 format_vnet_sw_if_index_name, am->vnet_main, sw_if_idx);
249 static clib_error_t *
250 show_inacl_command_fn (vlib_main_t * vm,
251 unformat_input_t * input,
252 vlib_cli_command_t * cmd)
254 input_acl_main_t * am = &input_acl_main;
255 u32 type = INPUT_ACL_N_TABLES;
259 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
261 if (unformat (input, "type %U", unformat_acl_type, &type))
267 if (type == INPUT_ACL_N_TABLES)
268 return clib_error_return (0, "Invalid input ACL table type.");
270 vec_tbl = am->classify_table_index_by_sw_if_index[type];
272 if (vec_len(vec_tbl))
273 vlib_cli_output (vm, "%U", format_vnet_inacl_info, am, ~0 /* hdr */, ~0);
275 vlib_cli_output (vm, "No input ACL tables configured");
277 for (i = 0; i < vec_len (vec_tbl); i++)
279 if (vec_elt(vec_tbl, i) == ~0)
282 vlib_cli_output (vm, "%U", format_vnet_inacl_info,
283 am, i, vec_elt(vec_tbl, i));
289 VLIB_CLI_COMMAND (show_inacl_command, static) = {
290 .path = "show inacl",
291 .short_help = "show inacl type [ip4|ip6|l2]",
292 .function = show_inacl_command_fn,