+ def _build_mac_mask(dst_mac='', src_mac='', ether_type=''):
+ """Build MAC ACL mask data in hexstring format.
+
+ :param dst_mac: Source MAC address <0-ffffffffffff>.
+ :param src_mac: Destination MAC address <0-ffffffffffff>.
+ :param ether_type: Ethernet type <0-ffff>.
+ :type dst_mac: str
+ :type src_mac: str
+ :type ether_type: str
+ :returns MAC ACL mask in hexstring format.
+ :rtype: str
+ """
+ if ether_type:
+ end = 28
+ elif src_mac:
+ end = 24
+ else:
+ end = 12
+
+ return ('{!s:0>12}{!s:0>12}{!s:0>4}'.format(
+ dst_mac.replace(':', ''), src_mac.replace(':', ''),
+ ether_type))[0:end]
+
+ @staticmethod
+ def _build_ip_mask(proto='', src_ip='', dst_ip='', src_port='',
+ dst_port=''):
+ """Build IP ACL mask data in hexstring format.
+
+ :param proto: Protocol number <0-ff>.
+ :param src_ip: Source ip address <0-ffffffff>.
+ :param dst_ip: Destination ip address <0-ffffffff>.
+ :param src_port: Source port number <0-ffff>.
+ :param str dst_port: Destination port number <0-ffff>.
+ :type proto: str
+ :type src_ip: str
+ :type dst_ip: str
+ :type src_port: str
+ :type dst_port:src
+ :returns: IP mask in hexstring format.
+ :rtype: str
+ """
+ if dst_port:
+ end = 48
+ elif src_port:
+ end = 44
+ elif dst_ip:
+ end = 40
+ elif src_ip:
+ end = 32
+ else:
+ end = 20
+
+ return ('{!s:0>20}{!s:0>12}{!s:0>8}{!s:0>4}{!s:0>4}'.format(
+ proto, src_ip, dst_ip, src_port, dst_port))[0:end]
+
+ @staticmethod
+ def _build_ip6_mask(next_hdr='', src_ip='', dst_ip='', src_port='',
+ dst_port=''):
+ """Build IPv6 ACL mask data in hexstring format.
+
+ :param next_hdr: Next header number <0-ff>.
+ :param src_ip: Source ip address <0-ffffffff>.
+ :param dst_ip: Destination ip address <0-ffffffff>.
+ :param src_port: Source port number <0-ffff>.
+ :param dst_port: Destination port number <0-ffff>.
+ :type next_hdr: str
+ :type src_ip: str
+ :type dst_ip: str
+ :type src_port: str
+ :type dst_port: str
+ :returns: IPv6 ACL mask in hexstring format.
+ :rtype: str
+ """
+ if dst_port:
+ end = 88
+ elif src_port:
+ end = 84
+ elif dst_ip:
+ end = 80
+ elif src_ip:
+ end = 48
+ else:
+ end = 14
+
+ return ('{!s:0>14}{!s:0>34}{!s:0>32}{!s:0>4}{!s:0>4}'.format(
+ next_hdr, src_ip, dst_ip, src_port, dst_port))[0:end]
+
+ @staticmethod
+ def _build_mac_match(dst_mac='', src_mac='', ether_type=''):
+ """Build MAC ACL match data in hexstring format.
+
+ :param dst_mac: Source MAC address <x:x:x:x:x:x>.
+ :param src_mac: Destination MAC address <x:x:x:x:x:x>.
+ :param ether_type: Ethernet type <0-ffff>.
+ :type dst_mac: str
+ :type src_mac: str
+ :type ether_type: str
+ :returns: MAC ACL match data in hexstring format.
+ :rtype: str
+ """
+ if ether_type:
+ end = 28
+ elif src_mac:
+ end = 24
+ else:
+ end = 12
+
+ return ('{!s:0>12}{!s:0>12}{!s:0>4}'.format(
+ dst_mac.replace(':', ''), src_mac.replace(':', ''),
+ ether_type))[0:end]
+
+ @staticmethod
+ def _build_ip_match(proto=0, src_ip='', dst_ip='', src_port=0, dst_port=0):
+ """Build IP ACL match data in hexstring format.
+
+ :param proto: Protocol number with valid option "x".
+ :param src_ip: Source ip address with format of "x.x.x.x".
+ :param dst_ip: Destination ip address with format of "x.x.x.x".
+ :param src_port: Source port number "x".
+ :param dst_port: Destination port number "x".
+ :type proto: int
+ :type src_ip: str
+ :type dst_ip: str
+ :type src_port: int
+ :type dst_port: int
+ :returns: IP ACL match data in hexstring format.
+ :rtype: str
+ """
+ if src_ip:
+ src_ip = binascii.hexlify(ip_address(unicode(src_ip)).packed)
+ if dst_ip:
+ dst_ip = binascii.hexlify(ip_address(unicode(dst_ip)).packed)
+ if dst_port:
+ end = 48
+ elif src_port:
+ end = 44
+ elif dst_ip:
+ end = 40
+ elif src_ip:
+ end = 32
+ else:
+ end = 20
+
+ return ('{!s:0>20}{!s:0>12}{!s:0>8}{!s:0>4}{!s:0>4}'.format(
+ hex(proto)[2:], src_ip, dst_ip, hex(src_port)[2:],
+ hex(dst_port)[2:]))[0:end]
+
+ @staticmethod
+ def _build_ip6_match(next_hdr=0, src_ip='', dst_ip='', src_port=0,
+ dst_port=0):
+ """Build IPv6 ACL match data in hexstring format.
+
+ :param next_hdr: Next header number with valid option "x".
+ :param src_ip: Source ip6 address with format of "xxxx:xxxx::xxxx".
+ :param dst_ip: Destination ip6 address with format of
+ "xxxx:xxxx::xxxx".
+ :param src_port: Source port number "x".
+ :param dst_port: Destination port number "x".
+ :type next_hdr: int
+ :type src_ip: str
+ :type dst_ip: str
+ :type src_port: int
+ :type dst_port: int
+ :returns: IPv6 ACL match data in hexstring format.
+ :rtype: str
+ """
+ if src_ip:
+ src_ip = binascii.hexlify(ip_address(unicode(src_ip)).packed)
+ if dst_ip:
+ dst_ip = binascii.hexlify(ip_address(unicode(dst_ip)).packed)
+ if dst_port:
+ end = 88
+ elif src_port:
+ end = 84
+ elif dst_ip:
+ end = 80
+ elif src_ip:
+ end = 48
+ else:
+ end = 14
+
+ return ('{!s:0>14}{!s:0>34}{!s:0>32}{!s:0>4}{!s:0>4}'.format(
+ hex(next_hdr)[2:], src_ip, dst_ip, hex(src_port)[2:],
+ hex(dst_port)[2:]))[0:end]
+
+ @staticmethod
+ def _classify_add_del_table(node, is_add, mask, match_n_vectors=1,
+ table_index=0xFFFFFFFF, nbuckets=2,
+ memory_size=2097152, skip_n_vectors=0,
+ next_table_index=0xFFFFFFFF,
+ miss_next_index=0xFFFFFFFF, current_data_flag=0,
+ current_data_offset=0):
+ """Add or delete a classify table.
+
+ :param node: VPP node to create classify table.
+ :param is_add: If 1 the table is added, if 0 the table is deleted.
+ :param mask: ACL mask in hexstring format.
+ :param match_n_vectors: Number of vectors to match (Default value = 1).
+ :param table_index: Index of the classify table.
+ (Default value = 0xFFFFFFFF)
+ :param nbuckets: Number of buckets when adding a table.
+ (Default value = 2)
+ :param memory_size: Memory size when adding a table.
+ (Default value = 2097152)
+ :param skip_n_vectors: Number of skip vectors (Default value = 0).
+ :param next_table_index: Index of next table.
+ (Default value = 0xFFFFFFFF)
+ :param miss_next_index: Index of miss table.
+ (Default value = 0xFFFFFFFF)
+ :param current_data_flag: Option to use current node's packet payload
+ as the starting point from where packets are classified.
+ This option is only valid for L2/L3 input ACL for now.
+ 0: by default, classify data from the buffer's start location
+ 1: classify packets from VPP node's current data pointer.
+ :param current_data_offset: A signed value to shift the start location
+ of the packet to be classified.
+ For example, if input IP ACL node is used, L2 header's first byte
+ can be accessible by configuring current_data_offset to -14
+ if there is no vlan tag.
+ This is valid only if current_data_flag is set to 1.
+ (Default value = 0)
+ :type node: dict
+ :type is_add: int
+ :type mask: str
+ :type match_n_vectors: int
+ :type table_index: int
+ :type nbuckets: int
+ :type memory_size: int
+ :type skip_n_vectors: int
+ :type next_table_index: int
+ :type miss_next_index: int
+ :type current_data_flag: int
+ :type current_data_offset: int
+ :returns: (table_index, skip_n, match_n)
+ table_index: Classify table index.
+ skip_n: Number of skip vectors.
+ match_n: Number of match vectors.
+ :rtype: tuple(int, int, int)
+ """
+ mask_len = ((len(mask) - 1) / 16 + 1) * 16
+ mask = mask + '\0' * (mask_len - len(mask))
+
+ args = dict(
+ is_add=is_add,
+ table_index=table_index,
+ nbuckets=nbuckets,
+ memory_size=memory_size,
+ skip_n_vectors=skip_n_vectors,
+ match_n_vectors=match_n_vectors,
+ next_table_index=next_table_index,
+ miss_next_index=miss_next_index,
+ current_data_flag=current_data_flag,
+ current_data_offset=current_data_offset,
+ mask_len=mask_len,
+ mask=mask
+ )
+
+ cmd = 'classify_add_del_table'
+ err_msg = "Failed to create a classify table on host {host}".format(
+ host=node['host'])
+
+ with PapiSocketExecutor(node) as papi_exec:
+ reply = papi_exec.add(cmd, **args).get_reply(err_msg)
+
+ return int(reply["new_table_index"]), int(reply["skip_n_vectors"]),\
+ int(reply["match_n_vectors"])
+
+ @staticmethod
+ def _classify_add_del_session(node, is_add, table_index, match,
+ opaque_index=0xFFFFFFFF,
+ hit_next_index=0xFFFFFFFF, advance=0,
+ action=0, metadata=0):
+ """Add or delete a classify session.
+
+ :param node: VPP node to create classify session.
+ :param is_add: If 1 the session is added, if 0 the session is deleted.
+ :param table_index: Index of the table to add/del the session.
+ :param match: For add, match value for session, required, needs to
+ include bytes in front with length of skip_n_vectors of target table
+ times sizeof (u32x4) (values of those bytes will be ignored).
+ :param opaque_index: For add, opaque_index of new session.
+ (Default value = 0xFFFFFFFF)
+ :param hit_next_index: For add, hit_next_index of new session.
+ (Default value = 0xFFFFFFFF)
+ :param advance: For add, advance value for session. (Default value = 0)
+ :param action: 0: No action (by default) metadata is not used.
+ 1: Classified IP packets will be looked up from the specified ipv4
+ fib table (configured by metadata as VRF id).
+ Only valid for L3 input ACL node
+ 2: Classified IP packets will be looked up from the specified ipv6
+ fib table (configured by metadata as VRF id).
+ Only valid for L3 input ACL node
+ 3: Classified packet will be steered to source routig policy of
+ given index (in metadata).
+ This is only valid for IPv6 packets redirected to a source
+ routing node.
+ :param metadata: Valid only if action != 0
+ VRF id if action is 1 or 2. SR policy index if action is 3.
+ (Default value = 0)
+ :type node: dict
+ :type is_add: int
+ :type table_index: int
+ :type match: str
+ :type opaque_index: int
+ :type hit_next_index: int
+ :type advance: int
+ :type action: int
+ :type metadata: int
+ """
+
+ match_len = ((len(match) - 1) / 16 + 1) * 16
+ match = match + '\0' * (match_len - len(match))
+ args = dict(
+ is_add=is_add,
+ table_index=table_index,
+ hit_next_index=hit_next_index,
+ opaque_index=opaque_index,
+ advance=advance,
+ action=action,
+ metadata=metadata,
+ match_len=match_len,
+ match=match
+ )
+ cmd = 'classify_add_del_session'
+ err_msg = "Failed to create a classify session on host {host}".format(
+ host=node['host'])
+
+ with PapiSocketExecutor(node) as papi_exec:
+ papi_exec.add(cmd, **args).get_reply(err_msg)
+
+ @staticmethod
+ def _macip_acl_add(node, rules, tag=""):
+ """Add MACIP ACL.
+
+ :param node: VPP node to add MACIP ACL.
+ :param rules: List of rules for given ACL.
+ :param tag: ACL tag.
+ :type node: dict
+ :type rules: list
+ :type tag: str
+ """
+ cmd = "macip_acl_add"
+ args = dict(
+ r=rules,
+ count=len(rules),
+ tag=tag
+ )
+
+ err_msg = "Failed to create a classify session on host {host}".format(
+ host=node['host'])
+
+ with PapiSocketExecutor(node) as papi_exec:
+ papi_exec.add(cmd, **args).get_reply(err_msg)
+
+ @staticmethod
+ def _acl_interface_set_acl_list(node, sw_if_index, acl_type, acls):
+ """Set ACL list for interface.
+
+ :param node: VPP node to set ACL list for interface.
+ :param sw_if_index: sw_if_index of the used interface.
+ :param acl_type: Type of ACL(s) - input or output.
+ :param acls: List of ACLs.
+ :type node: dict
+ :type sw_if_index: int
+ :type acl_type: str
+ :type acls: list
+ """
+ cmd = "acl_interface_set_acl_list"
+ n_input = len(acls) if acl_type == "input" else 0
+ args = dict(
+ sw_if_index=sw_if_index,
+ acls=acls,
+ n_input=n_input,
+ count=len(acls)
+ )
+
+ err_msg = "Failed to set acl list for interface {idx} on host {host}".\
+ format(idx=sw_if_index, host=node['host'])
+
+ with PapiSocketExecutor(node) as papi_exec:
+ papi_exec.add(cmd, **args).get_reply(err_msg)
+
+ @staticmethod
+ def _acl_add_replace(node, acl_idx, rules, tag=""):
+ """ Add/replace ACLs.
+
+ :param node: VPP node to add MACIP ACL.
+ :param acl_idx: ACL index.
+ :param rules: List of rules for given ACL.
+ :param tag: ACL tag.
+ :type node: dict
+ :type acl_idx: int
+ :type rules: list
+ :type tag: str
+ """
+ cmd = "acl_add_replace"
+ args = dict(
+ tag=tag.encode("utf-8"),
+ acl_index=4294967295 if acl_idx is None else acl_idx,
+ count=len(rules),
+ r=rules
+ )
+
+ err_msg = "Failed to add/replace acls on host {host}".format(
+ host=node['host'])
+
+ with PapiSocketExecutor(node) as papi_exec:
+ papi_exec.add(cmd, **args).get_reply(err_msg)
+
+ @staticmethod
+ def vpp_creates_classify_table_l3(node, ip_version, direction, ip_addr):