X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;ds=sidebyside;f=src%2Fplugins%2Fgbp%2Fgbp_classify_node.c;h=a2058a212848d2d0d512714a0e50d5b55b6e5ea2;hb=34de6fea134051ff2f3488ccbddf5c055d3602f1;hp=1b2cb0a2bc7ae9ebdfc74f906109efef8bd958f7;hpb=4ba67723d716660c56326ce498b99a060a9471b1;p=vpp.git diff --git a/src/plugins/gbp/gbp_classify_node.c b/src/plugins/gbp/gbp_classify_node.c index 1b2cb0a2bc7..a2058a21284 100644 --- a/src/plugins/gbp/gbp_classify_node.c +++ b/src/plugins/gbp/gbp_classify_node.c @@ -26,6 +26,7 @@ #include #include #include +#include /** * per-packet trace data @@ -278,36 +279,37 @@ typedef enum gbp_lpm_classify_next_t_ GPB_LPM_CLASSIFY_DROP, } gbp_lpm_classify_next_t; -always_inline dpo_proto_t -ethertype_to_dpo_proto (const ethernet_header_t * eh0) +/** + * per-packet trace data + */ +typedef struct gbp_lpm_classify_trace_t_ { - u16 etype = clib_net_to_host_u16 (eh0->type); + sclass_t sclass; + index_t lbi; + ip46_address_t src; +} gbp_lpm_classify_trace_t; - switch (etype) - { - case ETHERNET_TYPE_IP4: - return (DPO_PROTO_IP4); - case ETHERNET_TYPE_IP6: - return (DPO_PROTO_IP6); - case ETHERNET_TYPE_VLAN: - { - ethernet_vlan_header_t *vh0; - - vh0 = (ethernet_vlan_header_t *) (eh0 + 1); - - switch (clib_net_to_host_u16 (vh0->type)) - { - case ETHERNET_TYPE_IP4: - return (DPO_PROTO_IP4); - case ETHERNET_TYPE_IP6: - return (DPO_PROTO_IP6); - } - } - } +/* packet trace format function */ +static u8 * +format_gbp_lpm_classify_trace (u8 * s, va_list * args) +{ + CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); + CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); + gbp_lpm_classify_trace_t *t = va_arg (*args, gbp_lpm_classify_trace_t *); + + s = format (s, "sclass:%d lb:%d src:%U", + t->sclass, t->lbi, format_ip46_address, &t->src, IP46_TYPE_ANY); - return (DPO_PROTO_NONE); + return s; } +enum gbp_lpm_type +{ + GBP_LPM_RECIRC, + GBP_LPM_EPG, + GBP_LPM_ANON +}; + /* * Determine the SRC EPG from a LPM */ @@ -315,7 +317,8 @@ always_inline uword gbp_lpm_classify_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame, - dpo_proto_t dproto, u8 is_recirc) + const dpo_proto_t dproto, + const enum gbp_lpm_type type) { gbp_src_classify_main_t *gscm = &gbp_src_classify_main; u32 n_left_from, *from, *to_next; @@ -334,14 +337,13 @@ gbp_lpm_classify_inline (vlib_main_t * vm, while (n_left_from > 0 && n_left_to_next > 0) { u32 bi0, sw_if_index0, fib_index0, lbi0; + const gbp_endpoint_t *ge0, *ge_lpm0; gbp_lpm_classify_next_t next0; + const ethernet_header_t *eh0; const gbp_policy_dpo_t *gpd0; - const gbp_ext_itf_t *gx0; + const ip4_address_t *ip4_0; + const ip6_address_t *ip6_0; const gbp_recirc_t *gr0; - const dpo_id_t *dpo0; - load_balance_t *lb0; - ip4_header_t *ip4_0; - ip6_header_t *ip6_0; vlib_buffer_t *b0; sclass_t sclass0; @@ -355,96 +357,155 @@ gbp_lpm_classify_inline (vlib_main_t * vm, ip6_0 = NULL; next0 = GPB_LPM_CLASSIFY_DROP; + lbi0 = ~0; + eh0 = NULL; b0 = vlib_get_buffer (vm, bi0); sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX]; vnet_buffer2 (b0)->gbp.flags = VXLAN_GBP_GPFLAGS_NONE; if (DPO_PROTO_IP4 == dproto) - ip4_0 = vlib_buffer_get_current (b0); + ip4_0 = + &((ip4_header_t *) vlib_buffer_get_current (b0))->src_address; else if (DPO_PROTO_IP6 == dproto) - ip6_0 = vlib_buffer_get_current (b0); + ip6_0 = + &((ip6_header_t *) vlib_buffer_get_current (b0))->src_address; else if (DPO_PROTO_ETHERNET == dproto) { - const ethernet_header_t *eh0; - eh0 = vlib_buffer_get_current (b0); - - dproto = ethertype_to_dpo_proto (eh0); - - switch (dproto) - { - case DPO_PROTO_IP4: - ip4_0 = (vlib_buffer_get_current (b0) + - vnet_buffer (b0)->l2.l2_len); - break; - case DPO_PROTO_IP6: - ip6_0 = (vlib_buffer_get_current (b0) + - vnet_buffer (b0)->l2.l2_len); - break; - default: - /* not IP so no LPM classify possible */ - sclass0 = SCLASS_INVALID; - goto trace; - } + gbp_classify_get_ip_address (eh0, &ip4_0, &ip6_0, + GBP_CLASSIFY_GET_IP_SRC); } - if (is_recirc) + if (GBP_LPM_RECIRC == type) { gr0 = gbp_recirc_get (sw_if_index0); fib_index0 = gr0->gr_fib_index[dproto]; + ge0 = NULL; vnet_feature_next (&next0, b0); } else { - gx0 = gbp_ext_itf_get (sw_if_index0); - fib_index0 = gx0->gx_fib_index[dproto]; + if (NULL == eh0) + { + /* packet should be l2 */ + sclass0 = SCLASS_INVALID; + goto trace; + } - next0 = vnet_l2_feature_next - (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM], - L2INPUT_FEAT_GBP_LPM_CLASSIFY); - } + if (GBP_LPM_ANON == type) + { + /* + * anonymous LPM classification: only honour LPM as no EP + * were programmed + */ + gbp_ext_itf_t *gei = gbp_ext_itf_get (sw_if_index0); + if (ip4_0) + fib_index0 = gei->gx_fib_index[DPO_PROTO_IP4]; + else if (ip6_0) + fib_index0 = gei->gx_fib_index[DPO_PROTO_IP6]; + else + { + /* not IP so no LPM classify possible */ + sclass0 = SCLASS_INVALID; + next0 = GPB_LPM_CLASSIFY_DROP; + goto trace; + } + next0 = vnet_l2_feature_next + (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM_ANON], + L2INPUT_FEAT_GBP_LPM_ANON_CLASSIFY); + } + else + { + /* + * not an anonymous LPM classification: check it comes from + * an EP, and use EP RD info + */ + ge0 = gbp_endpoint_find_mac (eh0->src_address, + vnet_buffer (b0)->l2.bd_index); - if (DPO_PROTO_IP4 == dproto) - { - lbi0 = ip4_fib_forwarding_lookup (fib_index0, - &ip4_0->src_address); - } - else if (DPO_PROTO_IP6 == dproto) - { - lbi0 = ip6_fib_table_fwding_lookup (&ip6_main, fib_index0, - &ip6_0->src_address); - } - else - { - /* not IP so no LPM classify possible */ - sclass0 = SCLASS_INVALID; - goto trace; - } - lb0 = load_balance_get (lbi0); - dpo0 = load_balance_get_bucket_i (lb0, 0); + if (NULL == ge0) + { + /* packet must have come from an EP's mac */ + sclass0 = SCLASS_INVALID; + goto trace; + } + + fib_index0 = ge0->ge_fwd.gef_fib_index; + + if (~0 == fib_index0) + { + sclass0 = SCLASS_INVALID; + goto trace; + } + + if (ip4_0) + { + ge_lpm0 = gbp_endpoint_find_ip4 (ip4_0, fib_index0); + } + else if (ip6_0) + { + ge_lpm0 = gbp_endpoint_find_ip6 (ip6_0, fib_index0); + } + else + { + ge_lpm0 = NULL; + } + + next0 = vnet_l2_feature_next + (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM], + L2INPUT_FEAT_GBP_LPM_CLASSIFY); - if (gbp_policy_dpo_type == dpo0->dpoi_type) - { - gpd0 = gbp_policy_dpo_get (dpo0->dpoi_index); - sclass0 = gpd0->gpd_sclass; + /* + * if we found the EP by IP lookup, it must be from the EP + * not a network behind it + */ + if (NULL != ge_lpm0) + { + if (PREDICT_FALSE (ge0 != ge_lpm0)) + { + /* an EP spoofing another EP */ + sclass0 = SCLASS_INVALID; + next0 = GPB_LPM_CLASSIFY_DROP; + } + else + { + sclass0 = ge0->ge_fwd.gef_sclass; + } + goto trace; + } + } } - else + + gpd0 = gbp_classify_get_gpd (ip4_0, ip6_0, fib_index0); + if (0 == gpd0) { /* could not classify => drop */ sclass0 = SCLASS_INVALID; next0 = GPB_LPM_CLASSIFY_DROP; + goto trace; } + sclass0 = gpd0->gpd_sclass; + + /* all packets from an external network should not be learned by the + * reciever. so set the Do-not-learn bit here */ + vnet_buffer2 (b0)->gbp.flags = VXLAN_GBP_GPFLAGS_D; + trace: vnet_buffer2 (b0)->gbp.sclass = sclass0; if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED))) { - gbp_classify_trace_t *t = + gbp_lpm_classify_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); t->sclass = sclass0; + t->lbi = lbi0; + if (ip4_0) + t->src.ip4 = *ip4_0; + if (ip6_0) + t->src.ip6 = *ip6_0; } vlib_validate_buffer_enqueue_x1 (vm, node, next_index, @@ -462,28 +523,39 @@ VLIB_NODE_FN (gbp_ip4_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_IP4, 1)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_IP4, GBP_LPM_RECIRC)); } VLIB_NODE_FN (gbp_ip6_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_IP6, 1)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_IP6, GBP_LPM_RECIRC)); } VLIB_NODE_FN (gbp_l2_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_ETHERNET, 0)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_ETHERNET, GBP_LPM_EPG)); +} + +VLIB_NODE_FN (gbp_l2_lpm_anon_classify_node) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_ETHERNET, GBP_LPM_ANON)); } /* *INDENT-OFF* */ VLIB_REGISTER_NODE (gbp_ip4_lpm_classify_node) = { .name = "ip4-gbp-lpm-classify", .vector_size = sizeof (u32), - .format_trace = format_gbp_classify_trace, + .format_trace = format_gbp_lpm_classify_trace, .type = VLIB_NODE_TYPE_INTERNAL, .n_errors = 0, @@ -496,7 +568,7 @@ VLIB_REGISTER_NODE (gbp_ip4_lpm_classify_node) = { VLIB_REGISTER_NODE (gbp_ip6_lpm_classify_node) = { .name = "ip6-gbp-lpm-classify", .vector_size = sizeof (u32), - .format_trace = format_gbp_classify_trace, + .format_trace = format_gbp_lpm_classify_trace, .type = VLIB_NODE_TYPE_INTERNAL, .n_errors = 0, @@ -509,7 +581,20 @@ VLIB_REGISTER_NODE (gbp_ip6_lpm_classify_node) = { VLIB_REGISTER_NODE (gbp_l2_lpm_classify_node) = { .name = "l2-gbp-lpm-classify", .vector_size = sizeof (u32), - .format_trace = format_gbp_classify_trace, + .format_trace = format_gbp_lpm_classify_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + + .n_errors = 0, + .n_next_nodes = 1, + .next_nodes = { + [GPB_LPM_CLASSIFY_DROP] = "error-drop" + }, +}; + +VLIB_REGISTER_NODE (gbp_l2_lpm_anon_classify_node) = { + .name = "l2-gbp-lpm-anon-classify", + .vector_size = sizeof (u32), + .format_trace = format_gbp_lpm_classify_trace, .type = VLIB_NODE_TYPE_INTERNAL, .n_errors = 0,