X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Facl%2Facl.h;h=c540bf8fbca4034cb8e2569615be9173094a7e39;hb=HEAD;hp=7af5b20155108a9d306469997c898ab7a7ddcef4;hpb=17ddc0fee1bc20d0da84dd70bb579c8844a48ef4;p=vpp.git diff --git a/src/plugins/acl/acl.h b/src/plugins/acl/acl.h index 7af5b201551..c540bf8fbca 100644 --- a/src/plugins/acl/acl.h +++ b/src/plugins/acl/acl.h @@ -26,19 +26,23 @@ #include #include #include +#include +#include +#include "types.h" #include "fa_node.h" #include "hash_lookup_types.h" #include "lookup_context.h" #define ACL_PLUGIN_VERSION_MAJOR 1 -#define ACL_PLUGIN_VERSION_MINOR 3 +#define ACL_PLUGIN_VERSION_MINOR 4 #define UDP_SESSION_IDLE_TIMEOUT_SEC 600 #define TCP_SESSION_IDLE_TIMEOUT_SEC (3600*24) #define TCP_SESSION_TRANSIENT_TIMEOUT_SEC 120 -#define ACL_PLUGIN_HASH_LOOKUP_HEAP_SIZE (2 << 25) +#define SESSION_PURGATORY_TIMEOUT_USEC 10 + #define ACL_PLUGIN_HASH_LOOKUP_HASH_BUCKETS 65536 #define ACL_PLUGIN_HASH_LOOKUP_HASH_MEMORY (2 << 25) @@ -49,43 +53,15 @@ void input_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 void output_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap); enum acl_timeout_e { - ACL_TIMEOUT_UDP_IDLE = 0, + ACL_TIMEOUT_UNUSED = 0, + ACL_TIMEOUT_UDP_IDLE, ACL_TIMEOUT_TCP_IDLE, ACL_TIMEOUT_TCP_TRANSIENT, + ACL_N_USER_TIMEOUTS, + ACL_TIMEOUT_PURGATORY = ACL_N_USER_TIMEOUTS, /* a special-case queue for deletion-in-progress sessions */ ACL_N_TIMEOUTS }; - -enum address_e { IP4, IP6 }; -typedef struct -{ - enum address_e type; - union { - ip6_address_t ip6; - ip4_address_t ip4; - } addr; -} address_t; - -/* - * ACL rules - */ -typedef struct -{ - u8 is_permit; - u8 is_ipv6; - ip46_address_t src; - u8 src_prefixlen; - ip46_address_t dst; - u8 dst_prefixlen; - u8 proto; - u16 src_port_or_type_first; - u16 src_port_or_type_last; - u16 dst_port_or_code_first; - u16 dst_port_or_code_last; - u8 tcp_flags_value; - u8 tcp_flags_mask; -} acl_rule_t; - typedef struct { u8 is_permit; @@ -101,13 +77,16 @@ typedef struct */ typedef struct { + /** Required for pool_get_aligned */ + CLIB_CACHE_LINE_ALIGN_MARK(cacheline0); u8 tag[64]; - u32 count; acl_rule_t *rules; } acl_list_t; typedef struct { + /** Required for pool_get_aligned */ + CLIB_CACHE_LINE_ALIGN_MARK(cacheline0); u8 tag[64]; u32 count; macip_acl_rule_t *rules; @@ -127,15 +106,14 @@ typedef struct */ typedef struct { + /** Required for pool_get_aligned */ + CLIB_CACHE_LINE_ALIGN_MARK(cacheline0); fa_5tuple_t mask; u32 refcount; + u8 from_tm; } ace_mask_type_entry_t; typedef struct { - /* mheap to hold all the ACL module related allocations, other than hash */ - void *acl_mheap; - uword acl_mheap_size; - /* API message ID base */ u16 msg_id_base; @@ -148,11 +126,8 @@ typedef struct { hash_acl_info_t *hash_acl_infos; /* corresponding hash matching housekeeping info */ clib_bihash_48_8_t acl_lookup_hash; /* ACL lookup hash table. */ u32 hash_lookup_hash_buckets; - u32 hash_lookup_hash_memory; + uword hash_lookup_hash_memory; - /* mheap to hold all the miscellaneous allocations related to hash-based lookups */ - void *hash_lookup_mheap; - uword hash_lookup_mheap_size; int acl_lookup_hash_initialized; /* applied_hash_ace_entry_t **input_hash_entry_vec_by_sw_if_index; @@ -201,9 +176,19 @@ typedef struct { /* Do we use hash-based ACL matching or linear */ int use_hash_acl_matching; + /* Do we use the TupleMerge for hash ACLs or not */ + int use_tuple_merge; + + /* Max collision vector length before splitting the tuple */ +#define TM_SPLIT_THRESHOLD 39 + int tuple_merge_split_threshold; + /* a pool of all mask types present in all ACEs */ ace_mask_type_entry_t *ace_mask_type_pool; + /* vec of vectors of all info of all mask types present in ACEs contained in each lc_index */ + hash_applied_mask_info_t **hash_applied_mask_info_vec_by_lc_index; + /* * Classify tables used to grab the packets for the ACL check, * and serving as the 5-tuple session tables at the same time @@ -235,27 +220,17 @@ typedef struct { uword *fa_out_acl_on_sw_if_index; /* bihash holding all of the sessions */ int fa_sessions_hash_is_initialized; - clib_bihash_40_8_t fa_sessions_hash; - /* The process node which orcherstrates the cleanup */ + clib_bihash_40_8_t fa_ip6_sessions_hash; + clib_bihash_16_8_t fa_ip4_sessions_hash; + /* The process node which orchestrates the cleanup */ u32 fa_cleaner_node_index; /* FA session timeouts, in seconds */ u32 session_timeout_sec[ACL_N_TIMEOUTS]; /* total session adds/dels */ u64 fa_session_total_adds; u64 fa_session_total_dels; - - /* L2 datapath glue */ - - /* next indices within L2 classifiers for ip4/ip6 fa L2 nodes */ - u32 l2_input_classify_next_acl_ip4; - u32 l2_input_classify_next_acl_ip6; - u32 l2_output_classify_next_acl_ip4; - u32 l2_output_classify_next_acl_ip6; - /* next node indices for L2 dispatch */ - u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32]; - u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32]; - u32 fa_acl_out_ip4_l2_node_feat_next_node_index[32]; - u32 fa_acl_out_ip6_l2_node_feat_next_node_index[32]; + /* how many sessions went into purgatory */ + u64 fa_session_total_deactivations; /* EH values that we can skip over */ uword *fa_ipv6_known_eh_bitmap; @@ -319,8 +294,41 @@ typedef struct { /* convenience */ vlib_main_t * vlib_main; vnet_main_t * vnet_main; + /* logging */ + vlib_log_class_t log_default; + /* acl counters exposed via stats segment */ + volatile u32 *acl_counter_lock; + vlib_combined_counter_main_t *combined_acl_counters; + /* enable/disable ACL counters for interface processing */ + u32 interface_acl_counters_enabled; } acl_main_t; +#define acl_log_err(...) \ + vlib_log(VLIB_LOG_LEVEL_ERR, acl_main.log_default, __VA_ARGS__) +#define acl_log_warn(...) \ + vlib_log(VLIB_LOG_LEVEL_WARNING, acl_main.log_default, __VA_ARGS__) +#define acl_log_notice(...) \ + vlib_log(VLIB_LOG_LEVEL_NOTICE, acl_main.log_default, __VA_ARGS__) +#define acl_log_info(...) \ + vlib_log(VLIB_LOG_LEVEL_INFO, acl_main.log_default, __VA_ARGS__) + + +static inline void +acl_plugin_counter_lock (acl_main_t * am) +{ + if (am->acl_counter_lock) + while (clib_atomic_test_and_set (am->acl_counter_lock)) + /* zzzz */ ; +} + +static inline void +acl_plugin_counter_unlock (acl_main_t * am) +{ + if (am->acl_counter_lock) + clib_atomic_release (am->acl_counter_lock); +} + + #define foreach_acl_eh \ _(HOPBYHOP , 0 , "IPv6ExtHdrHopByHop") \ _(ROUTING , 43 , "IPv6ExtHdrRouting") \ @@ -363,7 +371,12 @@ AH has a special treatment of its length, it is in 32-bit words, not 64-bit word extern acl_main_t acl_main; -void *acl_plugin_set_heap(); +typedef enum { + ACL_FA_REQ_SESS_RESCHEDULE = 0, + ACL_FA_N_REQ, +} acl_fa_sess_req_t; +void aclp_post_session_change_request(acl_main_t *am, u32 target_thread, u32 target_session, acl_fa_sess_req_t request_type); +void aclp_swap_wip_and_pending_session_change_requests(acl_main_t *am, u32 target_thread); #endif