2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
15 #include <vnet/ip/ip.h>
16 #include <vnet/classify/vnet_classify.h>
17 #include <vnet/classify/input_acl.h>
26 /* packet trace format function */
27 static u8 * format_ip_inacl_trace (u8 * s, va_list * args)
29 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
30 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
31 ip_inacl_trace_t * t = va_arg (*args, ip_inacl_trace_t *);
33 s = format (s, "INACL: sw_if_index %d, next_index %d, table %d, offset %d",
34 t->sw_if_index, t->next_index, t->table_index, t->offset);
38 vlib_node_registration_t ip4_inacl_node;
39 vlib_node_registration_t ip6_inacl_node;
41 #define foreach_ip_inacl_error \
42 _(MISS, "input ACL misses") \
43 _(HIT, "input ACL hits") \
44 _(CHAIN_HIT, "input ACL hits after chain walk")
47 #define _(sym,str) IP_INACL_ERROR_##sym,
48 foreach_ip_inacl_error
53 static char * ip_inacl_error_strings[] = {
54 #define _(sym,string) string,
55 foreach_ip_inacl_error
60 ip_inacl_inline (vlib_main_t * vm,
61 vlib_node_runtime_t * node,
62 vlib_frame_t * frame, int is_ip4)
64 u32 n_left_from, * from, * to_next;
65 acl_next_index_t next_index;
66 input_acl_main_t * am = &input_acl_main;
67 vnet_classify_main_t * vcm = am->vnet_classify_main;
68 f64 now = vlib_time_now (vm);
72 input_acl_table_id_t tid;
73 vlib_node_runtime_t * error_node;
77 tid = INPUT_ACL_TABLE_IP4;
78 error_node = vlib_node_get_runtime (vm, ip4_input_node.index);
82 tid = INPUT_ACL_TABLE_IP6;
83 error_node = vlib_node_get_runtime (vm, ip6_input_node.index);
86 from = vlib_frame_vector_args (frame);
87 n_left_from = frame->n_vectors;
89 /* First pass: compute hashes */
91 while (n_left_from > 2)
93 vlib_buffer_t * b0, * b1;
96 u32 sw_if_index0, sw_if_index1;
97 u32 table_index0, table_index1;
98 vnet_classify_table_t * t0, * t1;
100 /* prefetch next iteration */
102 vlib_buffer_t * p1, * p2;
104 p1 = vlib_get_buffer (vm, from[1]);
105 p2 = vlib_get_buffer (vm, from[2]);
107 vlib_prefetch_buffer_header (p1, STORE);
108 CLIB_PREFETCH (p1->data, CLIB_CACHE_LINE_BYTES, STORE);
109 vlib_prefetch_buffer_header (p2, STORE);
110 CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, STORE);
114 b0 = vlib_get_buffer (vm, bi0);
118 b1 = vlib_get_buffer (vm, bi1);
121 sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
122 table_index0 = am->classify_table_index_by_sw_if_index[tid][sw_if_index0];
124 sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
125 table_index1 = am->classify_table_index_by_sw_if_index[tid][sw_if_index1];
127 t0 = pool_elt_at_index (vcm->tables, table_index0);
129 t1 = pool_elt_at_index (vcm->tables, table_index1);
131 vnet_buffer(b0)->l2_classify.hash =
132 vnet_classify_hash_packet (t0, (u8 *) h0);
134 vnet_classify_prefetch_bucket (t0, vnet_buffer(b0)->l2_classify.hash);
136 vnet_buffer(b1)->l2_classify.hash =
137 vnet_classify_hash_packet (t1, (u8 *) h1);
139 vnet_classify_prefetch_bucket (t1, vnet_buffer(b1)->l2_classify.hash);
141 vnet_buffer(b0)->l2_classify.table_index = table_index0;
143 vnet_buffer(b1)->l2_classify.table_index = table_index1;
149 while (n_left_from > 0)
156 vnet_classify_table_t * t0;
159 b0 = vlib_get_buffer (vm, bi0);
162 sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
163 table_index0 = am->classify_table_index_by_sw_if_index[tid][sw_if_index0];
165 t0 = pool_elt_at_index (vcm->tables, table_index0);
166 vnet_buffer(b0)->l2_classify.hash =
167 vnet_classify_hash_packet (t0, (u8 *) h0);
169 vnet_buffer(b0)->l2_classify.table_index = table_index0;
170 vnet_classify_prefetch_bucket (t0, vnet_buffer(b0)->l2_classify.hash);
176 next_index = node->cached_next_index;
177 from = vlib_frame_vector_args (frame);
178 n_left_from = frame->n_vectors;
180 while (n_left_from > 0)
184 vlib_get_next_frame (vm, node, next_index,
185 to_next, n_left_to_next);
187 /* Not enough load/store slots to dual loop... */
188 while (n_left_from > 0 && n_left_to_next > 0)
192 u32 next0 = ACL_NEXT_INDEX_DENY;
194 vnet_classify_table_t * t0;
195 vnet_classify_entry_t * e0;
200 /* Stride 3 seems to work best */
201 if (PREDICT_TRUE (n_left_from > 3))
203 vlib_buffer_t * p1 = vlib_get_buffer(vm, from[3]);
204 vnet_classify_table_t * tp1;
208 table_index1 = vnet_buffer(p1)->l2_classify.table_index;
210 if (PREDICT_TRUE (table_index1 != ~0))
212 tp1 = pool_elt_at_index (vcm->tables, table_index1);
213 phash1 = vnet_buffer(p1)->l2_classify.hash;
214 vnet_classify_prefetch_entry (tp1, phash1);
218 /* speculatively enqueue b0 to the current next frame */
226 b0 = vlib_get_buffer (vm, bi0);
228 table_index0 = vnet_buffer(b0)->l2_classify.table_index;
232 vnet_get_config_data (am->vnet_config_main[tid],
233 &vnet_buffer(b0)->ip.current_config_index,
235 /* # bytes of config data */ 0);
237 if (PREDICT_TRUE(table_index0 != ~0))
239 hash0 = vnet_buffer(b0)->l2_classify.hash;
240 t0 = pool_elt_at_index (vcm->tables, table_index0);
242 e0 = vnet_classify_find_entry (t0, (u8 *) h0, hash0,
246 vlib_buffer_advance (b0, e0->advance);
248 next0 = (e0->next_index < ACL_NEXT_INDEX_N_NEXT)?
249 e0->next_index:next0;
254 error0 = (next0 == ACL_NEXT_INDEX_DENY)?
255 IP4_ERROR_INACL_SESSION_DENY:IP4_ERROR_NONE;
257 error0 = (next0 == ACL_NEXT_INDEX_DENY)?
258 IP6_ERROR_INACL_SESSION_DENY:IP6_ERROR_NONE;
259 b0->error = error_node->errors[error0];
265 if (PREDICT_TRUE(t0->next_table_index != ~0))
266 t0 = pool_elt_at_index (vcm->tables,
267 t0->next_table_index);
270 next0 = (t0->miss_next_index < ACL_NEXT_INDEX_N_NEXT)?
271 t0->miss_next_index:next0;
276 error0 = (next0 == ACL_NEXT_INDEX_DENY)?
277 IP4_ERROR_INACL_TABLE_MISS:IP4_ERROR_NONE;
279 error0 = (next0 == ACL_NEXT_INDEX_DENY)?
280 IP6_ERROR_INACL_TABLE_MISS:IP6_ERROR_NONE;
281 b0->error = error_node->errors[error0];
285 hash0 = vnet_classify_hash_packet (t0, (u8 *) h0);
286 e0 = vnet_classify_find_entry
287 (t0, (u8 *) h0, hash0, now);
290 vlib_buffer_advance (b0, e0->advance);
291 next0 = (e0->next_index < ACL_NEXT_INDEX_N_NEXT)?
292 e0->next_index:next0;
297 error0 = (next0 == ACL_NEXT_INDEX_DENY)?
298 IP4_ERROR_INACL_SESSION_DENY:IP4_ERROR_NONE;
300 error0 = (next0 == ACL_NEXT_INDEX_DENY)?
301 IP6_ERROR_INACL_SESSION_DENY:IP6_ERROR_NONE;
302 b0->error = error_node->errors[error0];
309 if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE)
310 && (b0->flags & VLIB_BUFFER_IS_TRACED)))
312 ip_inacl_trace_t *t =
313 vlib_add_trace (vm, node, b0, sizeof (*t));
314 t->sw_if_index = vnet_buffer(b0)->sw_if_index[VLIB_RX];
315 t->next_index = next0;
316 t->table_index = t0 ? t0 - vcm->tables : ~0;
317 t->offset = e0 ? vnet_classify_get_offset (t0, e0): ~0;
320 /* verify speculative enqueue, maybe switch current next frame */
321 vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
322 to_next, n_left_to_next,
326 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
329 vlib_node_increment_counter (vm, node->node_index,
332 vlib_node_increment_counter (vm, node->node_index,
335 vlib_node_increment_counter (vm, node->node_index,
336 IP_INACL_ERROR_CHAIN_HIT,
338 return frame->n_vectors;
342 ip4_inacl (vlib_main_t * vm,
343 vlib_node_runtime_t * node,
344 vlib_frame_t * frame)
346 return ip_inacl_inline (vm, node, frame, 1 /* is_ip4 */);
350 VLIB_REGISTER_NODE (ip4_inacl_node) = {
351 .function = ip4_inacl,
353 .vector_size = sizeof (u32),
354 .format_trace = format_ip_inacl_trace,
355 .n_errors = ARRAY_LEN(ip_inacl_error_strings),
356 .error_strings = ip_inacl_error_strings,
358 .n_next_nodes = ACL_NEXT_INDEX_N_NEXT,
360 [ACL_NEXT_INDEX_DENY] = "error-drop",
365 ip6_inacl (vlib_main_t * vm,
366 vlib_node_runtime_t * node,
367 vlib_frame_t * frame)
369 return ip_inacl_inline (vm, node, frame, 0 /* is_ip4 */);
373 VLIB_REGISTER_NODE (ip6_inacl_node) = {
374 .function = ip6_inacl,
376 .vector_size = sizeof (u32),
377 .format_trace = format_ip_inacl_trace,
378 .n_errors = ARRAY_LEN(ip_inacl_error_strings),
379 .error_strings = ip_inacl_error_strings,
381 .n_next_nodes = ACL_NEXT_INDEX_N_NEXT,
383 [ACL_NEXT_INDEX_DENY] = "error-drop",
387 static clib_error_t *
388 ip_inacl_init (vlib_main_t * vm)
393 VLIB_INIT_FUNCTION (ip_inacl_init);