X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fgbp%2Fgbp_classify_node.c;h=a2058a212848d2d0d512714a0e50d5b55b6e5ea2;hb=59f71132e;hp=9d9e29303e63adee1542dd967aa5ef6f93b2e565;hpb=6f0fb0bd82a8a3e0d28faf61d264a9f46b58032e;p=vpp.git diff --git a/src/plugins/gbp/gbp_classify_node.c b/src/plugins/gbp/gbp_classify_node.c index 9d9e29303e6..a2058a21284 100644 --- a/src/plugins/gbp/gbp_classify_node.c +++ b/src/plugins/gbp/gbp_classify_node.c @@ -279,74 +279,6 @@ typedef enum gbp_lpm_classify_next_t_ GPB_LPM_CLASSIFY_DROP, } gbp_lpm_classify_next_t; -always_inline void -gbp_classify_get_src_ip4_address (const ethernet_header_t * eh0, - const ip4_address_t ** ip4) -{ - const ip4_header_t *iph4; - - iph4 = (ip4_header_t *) (eh0 + 1); - *ip4 = &iph4->src_address; -} - -always_inline void -gbp_classify_get_src_ip6_address (const ethernet_header_t * eh0, - const ip6_address_t ** ip6) -{ - const ip6_header_t *iph6; - - iph6 = (ip6_header_t *) (eh0 + 1); - *ip6 = &iph6->src_address; -} - -always_inline void -gbp_classify_get_src_ip_address (const ethernet_header_t * eh0, - const ip4_address_t ** ip4, - const ip6_address_t ** ip6) -{ - u16 etype = clib_net_to_host_u16 (eh0->type); - - switch (etype) - { - case ETHERNET_TYPE_IP4: - gbp_classify_get_src_ip4_address (eh0, ip4); - break; - case ETHERNET_TYPE_IP6: - gbp_classify_get_src_ip6_address (eh0, ip6); - break; - case ETHERNET_TYPE_VLAN: - { - ethernet_vlan_header_t *vh0; - - vh0 = (ethernet_vlan_header_t *) (eh0 + 1); - - switch (clib_net_to_host_u16 (vh0->type)) - { - case ETHERNET_TYPE_IP4: - { - gbp_classify_get_src_ip4_address (eh0, ip4); - break; - case ETHERNET_TYPE_IP6: - gbp_classify_get_src_ip6_address (eh0, ip6); - break; - } - } - break; - } - case ETHERNET_TYPE_ARP: - { - const ethernet_arp_header_t *ea0; - - ea0 = (ethernet_arp_header_t *) (eh0 + 1); - - *ip4 = &ea0->ip4_over_ethernet[0].ip4; - break; - } - default: - break; - } -} - /** * per-packet trace data */ @@ -371,6 +303,13 @@ format_gbp_lpm_classify_trace (u8 * s, va_list * args) return s; } +enum gbp_lpm_type +{ + GBP_LPM_RECIRC, + GBP_LPM_EPG, + GBP_LPM_ANON +}; + /* * Determine the SRC EPG from a LPM */ @@ -378,7 +317,8 @@ always_inline uword gbp_lpm_classify_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame, - dpo_proto_t dproto, u8 is_recirc) + const dpo_proto_t dproto, + const enum gbp_lpm_type type) { gbp_src_classify_main_t *gscm = &gbp_src_classify_main; u32 n_left_from, *from, *to_next; @@ -397,15 +337,13 @@ gbp_lpm_classify_inline (vlib_main_t * vm, while (n_left_from > 0 && n_left_to_next > 0) { u32 bi0, sw_if_index0, fib_index0, lbi0; + const gbp_endpoint_t *ge0, *ge_lpm0; gbp_lpm_classify_next_t next0; const ethernet_header_t *eh0; const gbp_policy_dpo_t *gpd0; const ip4_address_t *ip4_0; const ip6_address_t *ip6_0; - const gbp_endpoint_t *ge0; const gbp_recirc_t *gr0; - const dpo_id_t *dpo0; - load_balance_t *lb0; vlib_buffer_t *b0; sclass_t sclass0; @@ -435,10 +373,11 @@ gbp_lpm_classify_inline (vlib_main_t * vm, else if (DPO_PROTO_ETHERNET == dproto) { eh0 = vlib_buffer_get_current (b0); - gbp_classify_get_src_ip_address (eh0, &ip4_0, &ip6_0); + gbp_classify_get_ip_address (eh0, &ip4_0, &ip6_0, + GBP_CLASSIFY_GET_IP_SRC); } - if (is_recirc) + if (GBP_LPM_RECIRC == type) { gr0 = gbp_recirc_get (sw_if_index0); fib_index0 = gr0->gr_fib_index[dproto]; @@ -455,78 +394,104 @@ gbp_lpm_classify_inline (vlib_main_t * vm, goto trace; } - ge0 = gbp_endpoint_find_mac (eh0->src_address, - vnet_buffer (b0)->l2.bd_index); - - if (NULL == ge0) - { - /* packet must have come from an EP's mac */ - sclass0 = SCLASS_INVALID; - goto trace; - } - - fib_index0 = ge0->ge_fwd.gef_fib_index; - - if (~0 == fib_index0) - { - sclass0 = SCLASS_INVALID; - goto trace; - } - - if (ip4_0) + if (GBP_LPM_ANON == type) { - ge0 = gbp_endpoint_find_ip4 (ip4_0, fib_index0); + /* + * anonymous LPM classification: only honour LPM as no EP + * were programmed + */ + gbp_ext_itf_t *gei = gbp_ext_itf_get (sw_if_index0); + if (ip4_0) + fib_index0 = gei->gx_fib_index[DPO_PROTO_IP4]; + else if (ip6_0) + fib_index0 = gei->gx_fib_index[DPO_PROTO_IP6]; + else + { + /* not IP so no LPM classify possible */ + sclass0 = SCLASS_INVALID; + next0 = GPB_LPM_CLASSIFY_DROP; + goto trace; + } + next0 = vnet_l2_feature_next + (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM_ANON], + L2INPUT_FEAT_GBP_LPM_ANON_CLASSIFY); } - else if (ip6_0) + else { - ge0 = gbp_endpoint_find_ip6 (ip6_0, fib_index0); - } + /* + * not an anonymous LPM classification: check it comes from + * an EP, and use EP RD info + */ + ge0 = gbp_endpoint_find_mac (eh0->src_address, + vnet_buffer (b0)->l2.bd_index); - next0 = vnet_l2_feature_next - (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM], - L2INPUT_FEAT_GBP_LPM_CLASSIFY); + if (NULL == ge0) + { + /* packet must have come from an EP's mac */ + sclass0 = SCLASS_INVALID; + goto trace; + } + + fib_index0 = ge0->ge_fwd.gef_fib_index; + + if (~0 == fib_index0) + { + sclass0 = SCLASS_INVALID; + goto trace; + } + + if (ip4_0) + { + ge_lpm0 = gbp_endpoint_find_ip4 (ip4_0, fib_index0); + } + else if (ip6_0) + { + ge_lpm0 = gbp_endpoint_find_ip6 (ip6_0, fib_index0); + } + else + { + ge_lpm0 = NULL; + } + + next0 = vnet_l2_feature_next + (b0, gscm->l2_input_feat_next[GBP_SRC_CLASSIFY_LPM], + L2INPUT_FEAT_GBP_LPM_CLASSIFY); - /* - * if we found the EP by IP lookup, it must be from the EP - * not a network behind it - */ - if (NULL != ge0) - { - sclass0 = ge0->ge_fwd.gef_sclass; - goto trace; + /* + * if we found the EP by IP lookup, it must be from the EP + * not a network behind it + */ + if (NULL != ge_lpm0) + { + if (PREDICT_FALSE (ge0 != ge_lpm0)) + { + /* an EP spoofing another EP */ + sclass0 = SCLASS_INVALID; + next0 = GPB_LPM_CLASSIFY_DROP; + } + else + { + sclass0 = ge0->ge_fwd.gef_sclass; + } + goto trace; + } } } - if (ip4_0) - { - lbi0 = ip4_fib_forwarding_lookup (fib_index0, ip4_0); - } - else if (ip6_0) + gpd0 = gbp_classify_get_gpd (ip4_0, ip6_0, fib_index0); + if (0 == gpd0) { - lbi0 = - ip6_fib_table_fwding_lookup (&ip6_main, fib_index0, ip6_0); - } - else - { - /* not IP so no LPM classify possible */ + /* could not classify => drop */ sclass0 = SCLASS_INVALID; next0 = GPB_LPM_CLASSIFY_DROP; goto trace; } - lb0 = load_balance_get (lbi0); - dpo0 = load_balance_get_bucket_i (lb0, 0); - if (gbp_policy_dpo_type == dpo0->dpoi_type) - { - gpd0 = gbp_policy_dpo_get (dpo0->dpoi_index); - sclass0 = gpd0->gpd_sclass; - } - else - { - /* could not classify => drop */ - sclass0 = SCLASS_INVALID; - goto trace; - } + sclass0 = gpd0->gpd_sclass; + + /* all packets from an external network should not be learned by the + * reciever. so set the Do-not-learn bit here */ + vnet_buffer2 (b0)->gbp.flags = VXLAN_GBP_GPFLAGS_D; trace: vnet_buffer2 (b0)->gbp.sclass = sclass0; @@ -558,21 +523,32 @@ VLIB_NODE_FN (gbp_ip4_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_IP4, 1)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_IP4, GBP_LPM_RECIRC)); } VLIB_NODE_FN (gbp_ip6_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_IP6, 1)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_IP6, GBP_LPM_RECIRC)); } VLIB_NODE_FN (gbp_l2_lpm_classify_node) (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame) { - return (gbp_lpm_classify_inline (vm, node, frame, DPO_PROTO_ETHERNET, 0)); + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_ETHERNET, GBP_LPM_EPG)); +} + +VLIB_NODE_FN (gbp_l2_lpm_anon_classify_node) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) +{ + return (gbp_lpm_classify_inline + (vm, node, frame, DPO_PROTO_ETHERNET, GBP_LPM_ANON)); } /* *INDENT-OFF* */ @@ -615,6 +591,19 @@ VLIB_REGISTER_NODE (gbp_l2_lpm_classify_node) = { }, }; +VLIB_REGISTER_NODE (gbp_l2_lpm_anon_classify_node) = { + .name = "l2-gbp-lpm-anon-classify", + .vector_size = sizeof (u32), + .format_trace = format_gbp_lpm_classify_trace, + .type = VLIB_NODE_TYPE_INTERNAL, + + .n_errors = 0, + .n_next_nodes = 1, + .next_nodes = { + [GPB_LPM_CLASSIFY_DROP] = "error-drop" + }, +}; + VNET_FEATURE_INIT (gbp_ip4_lpm_classify_feat_node, static) = { .arc_name = "ip4-unicast",