X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fgbp%2Fgbp_classify_node.c;h=a2058a212848d2d0d512714a0e50d5b55b6e5ea2;hb=59f71132e;hp=43fea769cce99285b713601572409059fbf85b3c;hpb=f90bcee0944064fbe99571b772eef4baba32152e;p=vpp.git diff --git a/src/plugins/gbp/gbp_classify_node.c b/src/plugins/gbp/gbp_classify_node.c index 43fea769cce..a2058a21284 100644 --- a/src/plugins/gbp/gbp_classify_node.c +++ b/src/plugins/gbp/gbp_classify_node.c @@ -26,6 +26,7 @@ #include #include #include +#include /** * per-packet trace data @@ -33,7 +34,7 @@ typedef struct gbp_classify_trace_t_ { /* per-pkt trace data */ - epg_id_t src_epg; + sclass_t sclass; } gbp_classify_trace_t; /* @@ -61,9 +62,10 @@ gbp_classify_inline (vlib_main_t * vm, while (n_left_from > 0 && n_left_to_next > 0) { - u32 next0, bi0, src_epg, sw_if_index0; + u32 next0, bi0, sw_if_index0; const gbp_endpoint_t *ge0; vlib_buffer_t *b0; + sclass_t sclass0; bi0 = from[0]; to_next[0] = bi0; @@ -79,7 +81,7 @@ gbp_classify_inline (vlib_main_t * vm, if (GBP_SRC_CLASSIFY_NULL == type) { - src_epg = EPG_INVALID; + sclass0 = SCLASS_INVALID; next0 = vnet_l2_feature_next (b0, gscm->l2_input_feat_next[type], L2INPUT_FEAT_GBP_NULL_CLASSIFY); @@ -139,18 +141,18 @@ gbp_classify_inline (vlib_main_t * vm, } if (PREDICT_TRUE (NULL != ge0)) - src_epg = ge0->ge_fwd.gef_epg_id; + sclass0 = ge0->ge_fwd.gef_sclass; else - src_epg = EPG_INVALID; + sclass0 = SCLASS_INVALID; } - vnet_buffer2 (b0)->gbp.src_epg = src_epg; + vnet_buffer2 (b0)->gbp.sclass = sclass0; if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED))) { gbp_classify_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); - t->src_epg = src_epg; + t->sclass = sclass0; } vlib_validate_buffer_enqueue_x1 (vm, node, next_index, @@ -205,7 +207,7 @@ format_gbp_classify_trace (u8 * s, va_list * args) CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); gbp_classify_trace_t *t = va_arg (*args, gbp_classify_trace_t *); - s = format (s, "src-epg:%d", t->src_epg); + s = format (s, "sclass:%d", t->sclass); return s; } @@ -277,36 +279,37 @@ typedef enum gbp_lpm_classify_next_t_ GPB_LPM_CLASSIFY_DROP, } gbp_lpm_classify_next_t; -always_inline dpo_proto_t -ethertype_to_dpo_proto (const ethernet_header_t * eh0) +/** + * per-packet trace data + */ +typedef struct gbp_lpm_classify_trace_t_ { - u16 etype = clib_net_to_host_u16 (eh0->type); + sclass_t sclass; + index_t lbi; + ip46_address_t src; +} gbp_lpm_classify_trace_t; - switch (etype) - { - case ETHERNET_TYPE_IP4: - return (DPO_PROTO_IP4); - case ETHERNET_TYPE_IP6: - return (DPO_PROTO_IP6); - case ETHERNET_TYPE_VLAN: - { - ethernet_vlan_header_t *vh0; - - vh0 = (ethernet_vlan_header_t *) (eh0 + 1); - - switch (clib_net_to_host_u16 (vh0->type)) - { - case ETHERNET_TYPE_IP4: - return (DPO_PROTO_IP4); - case ETHERNET_TYPE_IP6: - return (DPO_PROTO_IP6); - } - } - } +/* packet trace format function */ +static u8 * +format_gbp_lpm_classify_trace (u8 * s, va_list * args) +{ + CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); + CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); + gbp_lpm_classify_trace_t *t = va_arg (*args, gbp_lpm_classify_trace_t *); + + s = format (s, "sclass:%d lb:%d src:%U", + t->sclass, t->lbi, format_ip46_address, &t->src, IP46_TYPE_ANY); - return (DPO_PROTO_NONE); + return s; } +enum gbp_lpm_type +{ + GBP_LPM_RECIRC, + GBP_LPM_EPG, + GBP_LPM_ANON +}; + /* * Determine the SRC EPG from a LPM */ @@ -314,7 +317,8 @@ always_inline uword gbp_lpm_classify_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame, - dpo_proto_t dproto, u8 is_recirc) + const dpo_proto_t dproto, + const enum gbp_lpm_type type) { gbp_src_classify_main_t *gscm = &gbp_src_classify_main; u32 n_left_from, *from, *to_next; @@ -333,16 +337,15 @@ gbp_lpm_classify_inline (vlib_main_t * vm, while (n_left_from > 0 && n_left_to_next > 0) { u32 bi0, sw_if_index0, fib_index0, lbi0; + const gbp_endpoint_t *ge0, *ge_lpm0; gbp_lpm_classify_next_t next0; + const ethernet_header_t *eh0; const gbp_policy_dpo_t *gpd0; - const gbp_ext_itf_t *gx0; + const ip4_address_t *ip4_0; + const ip6_address_t *ip6_0; const gbp_recirc_t *gr0; - const dpo_id_t *dpo0; - load_balance_t *lb0; - ip4_header_t *ip4_0; - ip6_header_t *ip6_0; vlib_buffer_t *b0; - epg_id_t src_epg0; + sclass_t sclass0; bi0 = from[0]; to_next[0] = bi0; @@ -354,96 +357,155 @@ gbp_lpm_classify_inline (vlib_main_t * vm, ip6_0 = NULL; next0 = GPB_LPM_CLASSIFY_DROP; + lbi0 = ~0; + eh0 = NULL; b0 = vlib_get_buffer (vm, bi0); sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX]; vnet_buffer2 (b0)->gbp.flags = VXLAN_GBP_GPFLAGS_NONE; if (DPO_PROTO_IP4 == dproto) - ip4_0 = vlib_buffer_get_current (b0); + ip4_0 = + &((ip4_header_t *) vlib_buffer_get_current (b0))->src_address; else if (DPO_PROTO_IP6 == dproto) - ip6_0 = vlib_buffer_get_current (b0); + ip6_0 = + &((ip6_header_t *) vlib_buffer_get_current (b0))->src_address; else if (DPO_PROTO_ETHERNET == dproto) { - const ethernet_header_t *eh0; - eh0 = vlib_buffer_get_current (b0); - - dproto = ethertype_to_dpo_proto (eh0); - - switch (dproto) - { - case DPO_PROTO_IP4: - ip4_0 = (vlib_buffer_get_current (b0) + - vnet_buffer (b0)->l2.l2_len); - break; - case DPO_PROTO_IP6: - ip6_0 = (vlib_buffer_get_current (b0) + - vnet_buffer (b0)->l2.l2_len); - break; - default: - /* not IP so no LPM classify possible */ - src_epg0 = EPG_INVALID; - goto trace; - } + gbp_classify_get_ip_address (eh0, &ip4_0, &ip6_0, + GBP_CLASSIFY_GET_IP_SRC); } - if (is_recirc) + if (GBP_LPM_RECIRC == type) { gr0 = gbp_recirc_get (sw_if_index0); fib_index0 = gr0->gr_fib_index[dproto]; + ge0 = NULL; vnet_feature_next (&next0, b0); } else { - gx0 = gbp_ext_itf_get (sw_if_index0); - fib_index0 = gx0->gx_fib_index[dproto]; + if (NULL == eh0) + { + /* packet should be l2 */ + sclass0 = SCLASS_INVALID; + goto trace; + } - next0 = vnet_l2_feature_next - (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM], - L2INPUT_FEAT_GBP_LPM_CLASSIFY); - } + if (GBP_LPM_ANON == type) + { + /* + * anonymous LPM classification: only honour LPM as no EP + * were programmed + */ + gbp_ext_itf_t *gei = gbp_ext_itf_get (sw_if_index0); + if (ip4_0) + fib_index0 = gei->gx_fib_index[DPO_PROTO_IP4]; + else if (ip6_0) + fib_index0 = gei->gx_fib_index[DPO_PROTO_IP6]; + else + { + /* not IP so no LPM classify possible */ + sclass0 = SCLASS_INVALID; + next0 = GPB_LPM_CLASSIFY_DROP; + goto trace; + } + next0 = vnet_l2_feature_next + (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM_ANON], + L2INPUT_FEAT_GBP_LPM_ANON_CLASSIFY); + } + else + { + /* + * not an anonymous LPM classification: check it comes from + * an EP, and use EP RD info + */ + ge0 = gbp_endpoint_find_mac (eh0->src_address, + vnet_buffer (b0)->l2.bd_index); - if (DPO_PROTO_IP4 == dproto) - { - lbi0 = ip4_fib_forwarding_lookup (fib_index0, - &ip4_0->src_address); - } - else if (DPO_PROTO_IP6 == dproto) - { - lbi0 = ip6_fib_table_fwding_lookup (&ip6_main, fib_index0, - &ip6_0->src_address); - } - else - { - /* not IP so no LPM classify possible */ - src_epg0 = EPG_INVALID; - goto trace; - } - lb0 = load_balance_get (lbi0); - dpo0 = load_balance_get_bucket_i (lb0, 0); + if (NULL == ge0) + { + /* packet must have come from an EP's mac */ + sclass0 = SCLASS_INVALID; + goto trace; + } + + fib_index0 = ge0->ge_fwd.gef_fib_index; + + if (~0 == fib_index0) + { + sclass0 = SCLASS_INVALID; + goto trace; + } + + if (ip4_0) + { + ge_lpm0 = gbp_endpoint_find_ip4 (ip4_0, fib_index0); + } + else if (ip6_0) + { + ge_lpm0 = gbp_endpoint_find_ip6 (ip6_0, fib_index0); + } + else + { + ge_lpm0 = NULL; + } + + next0 = vnet_l2_feature_next + (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM], + L2INPUT_FEAT_GBP_LPM_CLASSIFY); - if (gbp_policy_dpo_type == dpo0->dpoi_type) - { - gpd0 = gbp_policy_dpo_get (dpo0->dpoi_index); - src_epg0 = gpd0->gpd_epg; + /* + * if we found the EP by IP lookup, it must be from the EP + * not a network behind it + */ + if (NULL != ge_lpm0) + { + if (PREDICT_FALSE (ge0 != ge_lpm0)) + { + /* an EP spoofing another EP */ + sclass0 = SCLASS_INVALID; + next0 = GPB_LPM_CLASSIFY_DROP; + } + else + { + sclass0 = ge0->ge_fwd.gef_sclass; + } + goto trace; + } + } } - else + + gpd0 = gbp_classify_get_gpd (ip4_0, ip6_0, fib_index0); + if (0 == gpd0) { /* could not classify => drop */ - src_epg0 = EPG_INVALID; + sclass0 = SCLASS_INVALID; next0 = GPB_LPM_CLASSIFY_DROP; + goto trace; } + sclass0 = gpd0->gpd_sclass; + + /* all packets from an external network should not be learned by the + * reciever. so set the Do-not-learn bit here */ + vnet_buffer2 (b0)->gbp.flags = VXLAN_GBP_GPFLAGS_D; + trace: - vnet_buffer2 (b0)->gbp.src_epg = src_epg0; + vnet_buffer2 (b0)->gbp.sclass = sclass0; if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED))) { - gbp_classify_trace_t *t = + gbp_lpm_classify_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); - t->src_epg = src_epg0; + t->sclass = sclass0; + t->lbi = lbi0; + if (ip4_0) + t->src.ip4 = *ip4_0; + if (ip6_0) + t->src.ip6 = *ip6_0; } vlib_validate_buffer_enqueue_x1 (vm, node, next_index, @@ -461,28 +523,39 @@ VLIB_NODE_FN (gbp_ip4_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_IP4, 1)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_IP4, GBP_LPM_RECIRC)); } VLIB_NODE_FN (gbp_ip6_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_IP6, 1)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_IP6, GBP_LPM_RECIRC)); } VLIB_NODE_FN (gbp_l2_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_ETHERNET, 0)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_ETHERNET, GBP_LPM_EPG)); +} + +VLIB_NODE_FN (gbp_l2_lpm_anon_classify_node) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_ETHERNET, GBP_LPM_ANON)); } /* *INDENT-OFF* */ VLIB_REGISTER_NODE (gbp_ip4_lpm_classify_node) = { .name = "ip4-gbp-lpm-classify", .vector_size = sizeof (u32), - .format_trace = format_gbp_classify_trace, + .format_trace = format_gbp_lpm_classify_trace, .type = VLIB_NODE_TYPE_INTERNAL, .n_errors = 0, @@ -495,7 +568,7 @@ VLIB_REGISTER_NODE (gbp_ip4_lpm_classify_node) = { VLIB_REGISTER_NODE (gbp_ip6_lpm_classify_node) = { .name = "ip6-gbp-lpm-classify", .vector_size = sizeof (u32), - .format_trace = format_gbp_classify_trace, + .format_trace = format_gbp_lpm_classify_trace, .type = VLIB_NODE_TYPE_INTERNAL, .n_errors = 0, @@ -508,7 +581,20 @@ VLIB_REGISTER_NODE (gbp_ip6_lpm_classify_node) = { VLIB_REGISTER_NODE (gbp_l2_lpm_classify_node) = { .name = "l2-gbp-lpm-classify", .vector_size = sizeof (u32), - .format_trace = format_gbp_classify_trace, + .format_trace = format_gbp_lpm_classify_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + + .n_errors = 0, + .n_next_nodes = 1, + .next_nodes = { + [GPB_LPM_CLASSIFY_DROP] = "error-drop" + }, +}; + +VLIB_REGISTER_NODE (gbp_l2_lpm_anon_classify_node) = { + .name = "l2-gbp-lpm-anon-classify", + .vector_size = sizeof (u32), + .format_trace = format_gbp_lpm_classify_trace, .type = VLIB_NODE_TYPE_INTERNAL, .n_errors = 0,