X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Facl%2Facl.h;h=c540bf8fbca4034cb8e2569615be9173094a7e39;hb=88caf28354133160d2446e939f1e54adb71cc144;hp=f63771f4dacf489c919e854042a3b228684a4f9b;hpb=22f9fb1286d2469819cfcef68ffdc258f4d52c24;p=vpp.git diff --git a/src/plugins/acl/acl.h b/src/plugins/acl/acl.h index f63771f4dac..c540bf8fbca 100644 --- a/src/plugins/acl/acl.h +++ b/src/plugins/acl/acl.h @@ -27,13 +27,15 @@ #include #include #include +#include +#include "types.h" #include "fa_node.h" #include "hash_lookup_types.h" #include "lookup_context.h" #define ACL_PLUGIN_VERSION_MAJOR 1 -#define ACL_PLUGIN_VERSION_MINOR 3 +#define ACL_PLUGIN_VERSION_MINOR 4 #define UDP_SESSION_IDLE_TIMEOUT_SEC 600 #define TCP_SESSION_IDLE_TIMEOUT_SEC (3600*24) @@ -41,7 +43,6 @@ #define SESSION_PURGATORY_TIMEOUT_USEC 10 -#define ACL_PLUGIN_HASH_LOOKUP_HEAP_SIZE (2 << 25) #define ACL_PLUGIN_HASH_LOOKUP_HASH_BUCKETS 65536 #define ACL_PLUGIN_HASH_LOOKUP_HASH_MEMORY (2 << 25) @@ -61,37 +62,6 @@ enum acl_timeout_e { ACL_N_TIMEOUTS }; - -enum address_e { IP4, IP6 }; -typedef struct -{ - enum address_e type; - union { - ip6_address_t ip6; - ip4_address_t ip4; - } addr; -} address_t; - -/* - * ACL rules - */ -typedef struct -{ - u8 is_permit; - u8 is_ipv6; - ip46_address_t src; - u8 src_prefixlen; - ip46_address_t dst; - u8 dst_prefixlen; - u8 proto; - u16 src_port_or_type_first; - u16 src_port_or_type_last; - u16 dst_port_or_code_first; - u16 dst_port_or_code_last; - u8 tcp_flags_value; - u8 tcp_flags_mask; -} acl_rule_t; - typedef struct { u8 is_permit; @@ -110,7 +80,6 @@ typedef struct /** Required for pool_get_aligned */ CLIB_CACHE_LINE_ALIGN_MARK(cacheline0); u8 tag[64]; - u32 count; acl_rule_t *rules; } acl_list_t; @@ -141,13 +110,10 @@ typedef struct CLIB_CACHE_LINE_ALIGN_MARK(cacheline0); fa_5tuple_t mask; u32 refcount; + u8 from_tm; } ace_mask_type_entry_t; typedef struct { - /* mheap to hold all the ACL module related allocations, other than hash */ - void *acl_mheap; - uword acl_mheap_size; - /* API message ID base */ u16 msg_id_base; @@ -160,11 +126,8 @@ typedef struct { hash_acl_info_t *hash_acl_infos; /* corresponding hash matching housekeeping info */ clib_bihash_48_8_t acl_lookup_hash; /* ACL lookup hash table. */ u32 hash_lookup_hash_buckets; - u32 hash_lookup_hash_memory; + uword hash_lookup_hash_memory; - /* mheap to hold all the miscellaneous allocations related to hash-based lookups */ - void *hash_lookup_mheap; - uword hash_lookup_mheap_size; int acl_lookup_hash_initialized; /* applied_hash_ace_entry_t **input_hash_entry_vec_by_sw_if_index; @@ -213,9 +176,19 @@ typedef struct { /* Do we use hash-based ACL matching or linear */ int use_hash_acl_matching; + /* Do we use the TupleMerge for hash ACLs or not */ + int use_tuple_merge; + + /* Max collision vector length before splitting the tuple */ +#define TM_SPLIT_THRESHOLD 39 + int tuple_merge_split_threshold; + /* a pool of all mask types present in all ACEs */ ace_mask_type_entry_t *ace_mask_type_pool; + /* vec of vectors of all info of all mask types present in ACEs contained in each lc_index */ + hash_applied_mask_info_t **hash_applied_mask_info_vec_by_lc_index; + /* * Classify tables used to grab the packets for the ACL check, * and serving as the 5-tuple session tables at the same time @@ -249,7 +222,7 @@ typedef struct { int fa_sessions_hash_is_initialized; clib_bihash_40_8_t fa_ip6_sessions_hash; clib_bihash_16_8_t fa_ip4_sessions_hash; - /* The process node which orcherstrates the cleanup */ + /* The process node which orchestrates the cleanup */ u32 fa_cleaner_node_index; /* FA session timeouts, in seconds */ u32 session_timeout_sec[ACL_N_TIMEOUTS]; @@ -259,19 +232,6 @@ typedef struct { /* how many sessions went into purgatory */ u64 fa_session_total_deactivations; - /* L2 datapath glue */ - - /* next indices within L2 classifiers for ip4/ip6 fa L2 nodes */ - u32 l2_input_classify_next_acl_ip4; - u32 l2_input_classify_next_acl_ip6; - u32 l2_output_classify_next_acl_ip4; - u32 l2_output_classify_next_acl_ip6; - /* next node indices for L2 dispatch */ - u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32]; - u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32]; - u32 fa_acl_out_ip4_l2_node_feat_next_node_index[32]; - u32 fa_acl_out_ip6_l2_node_feat_next_node_index[32]; - /* EH values that we can skip over */ uword *fa_ipv6_known_eh_bitmap; @@ -336,6 +296,11 @@ typedef struct { vnet_main_t * vnet_main; /* logging */ vlib_log_class_t log_default; + /* acl counters exposed via stats segment */ + volatile u32 *acl_counter_lock; + vlib_combined_counter_main_t *combined_acl_counters; + /* enable/disable ACL counters for interface processing */ + u32 interface_acl_counters_enabled; } acl_main_t; #define acl_log_err(...) \ @@ -348,6 +313,21 @@ typedef struct { vlib_log(VLIB_LOG_LEVEL_INFO, acl_main.log_default, __VA_ARGS__) +static inline void +acl_plugin_counter_lock (acl_main_t * am) +{ + if (am->acl_counter_lock) + while (clib_atomic_test_and_set (am->acl_counter_lock)) + /* zzzz */ ; +} + +static inline void +acl_plugin_counter_unlock (acl_main_t * am) +{ + if (am->acl_counter_lock) + clib_atomic_release (am->acl_counter_lock); +} + #define foreach_acl_eh \ _(HOPBYHOP , 0 , "IPv6ExtHdrHopByHop") \ @@ -391,6 +371,12 @@ AH has a special treatment of its length, it is in 32-bit words, not 64-bit word extern acl_main_t acl_main; -void *acl_plugin_set_heap(); +typedef enum { + ACL_FA_REQ_SESS_RESCHEDULE = 0, + ACL_FA_N_REQ, +} acl_fa_sess_req_t; + +void aclp_post_session_change_request(acl_main_t *am, u32 target_thread, u32 target_session, acl_fa_sess_req_t request_type); +void aclp_swap_wip_and_pending_session_change_requests(acl_main_t *am, u32 target_thread); #endif