X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Facl%2Facl.h;h=eb074a7b6a2ad3854ead8d0af392fceb560c0df6;hb=24beb840400adcdd0fbcd85727ab1a2fa7040dca;hp=47523636d48f9c3288ac1c9547d1addf37bd8489;hpb=d2a59bed1e6b368a46608fd8ff631b770af8805f;p=vpp.git

diff --git a/src/plugins/acl/acl.h b/src/plugins/acl/acl.h
index 47523636d48..eb074a7b6a2 100644
--- a/src/plugins/acl/acl.h
+++ b/src/plugins/acl/acl.h
@@ -30,6 +30,10 @@
 #define  ACL_PLUGIN_VERSION_MAJOR 1
 #define  ACL_PLUGIN_VERSION_MINOR 2
 
+#define UDP_SESSION_IDLE_TIMEOUT_SEC 600
+#define TCP_SESSION_IDLE_TIMEOUT_SEC (3600*24)
+#define TCP_SESSION_TRANSIENT_TIMEOUT_SEC 120
+
 extern vlib_node_registration_t acl_in_node;
 extern vlib_node_registration_t acl_out_node;
 
@@ -128,22 +132,6 @@ typedef struct {
   /* MACIP (input) ACLs associated with the interfaces */
   u32 *macip_acl_by_sw_if_index;
 
-  /* next indices for our nodes in the l2-classify tables */
-  u32 l2_input_classify_next_acl_old;
-  u32 l2_output_classify_next_acl_old;
-
-  /* next node indices for feature bitmap */
-  u32 acl_in_node_feat_next_node_index[32];
-  u32 acl_out_node_feat_next_node_index[32];
-
-  /* ACL match actions (must be coherent across in/out ACLs to next indices (can differ) */
-
-  u32 acl_in_ip4_match_next[256];
-  u32 acl_in_ip6_match_next[256];
-  u32 acl_out_ip4_match_next[256];
-  u32 acl_out_ip6_match_next[256];
-  u32 n_match_actions;
-
   /* bitmaps when set the processing is enabled on the interface */
   uword *fa_in_acl_on_sw_if_index;
   uword *fa_out_acl_on_sw_if_index;
@@ -162,16 +150,11 @@ typedef struct {
 
   /* L2 datapath glue */
 
-  /* active next indices within L2 classifiers - switch old/new path */
+  /* next indices within L2 classifiers for ip4/ip6 fa L2 nodes */
   u32 l2_input_classify_next_acl_ip4;
   u32 l2_input_classify_next_acl_ip6;
   u32 l2_output_classify_next_acl_ip4;
   u32 l2_output_classify_next_acl_ip6;
-  /* saved next indices within L2 classifiers for ip4/ip6 fa L2 nodes */
-  u32 fa_l2_input_classify_next_acl_ip4;
-  u32 fa_l2_input_classify_next_acl_ip6;
-  u32 fa_l2_output_classify_next_acl_ip4;
-  u32 fa_l2_output_classify_next_acl_ip6;
   /* next node indices for L2 dispatch */
   u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32];
   u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32];
@@ -181,6 +164,9 @@ typedef struct {
   /* EH values that we can skip over */
   uword *fa_ipv6_known_eh_bitmap;
 
+  /* whether to match L4 ACEs with ports on the non-initial fragment */
+  int l4_match_nonfirst_fragment;
+
   /* conn table per-interface conn table parameters */
   u32 fa_conn_table_hash_num_buckets;
   uword fa_conn_table_hash_memory_size;
@@ -209,6 +195,26 @@ typedef struct {
   u32 fa_conn_list_head[ACL_N_TIMEOUTS];
   u32 fa_conn_list_tail[ACL_N_TIMEOUTS];
 
+  /* Configured session timeout */
+  u64 session_timeout[ACL_N_TIMEOUTS];
+
+
+  /* Counters for the cleaner thread */
+
+#define foreach_fa_cleaner_counter                                         \
+  _(fa_cleaner_cnt_delete_by_sw_index, "delete_by_sw_index events")        \
+  _(fa_cleaner_cnt_delete_by_sw_index_ok, "delete_by_sw_index handled ok") \
+  _(fa_cleaner_cnt_unknown_event, "unknown events received")               \
+  _(fa_cleaner_cnt_deleted_sessions, "sessions deleted")                   \
+  _(fa_cleaner_cnt_timer_restarted, "session idle timers restarted")       \
+  _(fa_cleaner_cnt_wait_with_timeout, "event wait with timeout called")    \
+  _(fa_cleaner_cnt_wait_without_timeout, "event wait w/o timeout called")  \
+  _(fa_cleaner_cnt_event_cycles, "total event cycles")                     \
+  _(fa_cleaner_cnt_already_deleted, "try to delete already deleted conn")  \
+/* end of counters */
+#define _(id, desc) u32 id;
+  foreach_fa_cleaner_counter
+#undef _
 
   /* convenience */
   vlib_main_t * vlib_main;
@@ -219,6 +225,7 @@ typedef struct {
    _(HOPBYHOP , 0  , "IPv6ExtHdrHopByHop")                      \
    _(ROUTING  , 43 , "IPv6ExtHdrRouting")                       \
    _(DESTOPT  , 60 , "IPv6ExtHdrDestOpt")                       \
+   _(FRAGMENT , 44 , "IPv6ExtHdrFragment")                      \
    _(MOBILITY , 135, "Mobility Header")                         \
    _(HIP      , 139, "Experimental use Host Identity Protocol") \
    _(SHIM6    , 140, "Shim6 Protocol")                          \
@@ -231,7 +238,6 @@ typedef struct {
  Also, Fragment header needs special processing.
 
    _(NONEXT   , 59 , "NoNextHdr")                               \
-   _(FRAGMENT , 44 , "IPv6ExtHdrFragment")                      \
 
 
 ESP is hiding its internal format, so no point in trying to go past it.