X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fsession%2Fsession_rules_table.c;h=fa8a056fbf03bdbff46c3e1a319fca1c87912989;hb=c97a7398fc465c480a3ac66cf4b0f91a034ed564;hp=685871d46edcb34149f86cfda2a6a07bde57a287;hpb=a3d933c87f146df801aa3947c25b6f1b2538f847;p=vpp.git diff --git a/src/vnet/session/session_rules_table.c b/src/vnet/session/session_rules_table.c index 685871d46ed..fa8a056fbf0 100644 --- a/src/vnet/session/session_rules_table.c +++ b/src/vnet/session/session_rules_table.c @@ -20,6 +20,86 @@ #include #include +u32 +session_rule_tag_key_index (u32 ri, u8 is_ip4) +{ + return ((ri << 1) | is_ip4); +} + +void +session_rule_tag_key_index_parse (u32 rti_key, u32 * ri, u8 * is_ip4) +{ + *is_ip4 = rti_key & 1; + *ri = rti_key >> 1; +} + +u8 * +session_rules_table_rule_tag (session_rules_table_t * srt, u32 ri, u8 is_ip4) +{ + uword *tip; + session_rule_tag_t *rt; + + tip = + hash_get (srt->tags_by_rules, session_rule_tag_key_index (ri, is_ip4)); + if (tip) + { + rt = pool_elt_at_index (srt->rule_tags, *tip); + return rt->tag; + } + return 0; +} + +void +session_rules_table_add_del_tag (session_rules_table_t * srt, u8 * tag, + u32 rule_index, u8 is_ip4, u8 is_add) +{ + uword *rip, *rtip; + session_rule_tag_t *rt; + u32 rti_key; + + if (tag == 0) + return; + if (is_add) + { + pool_get (srt->rule_tags, rt); + rt->tag = vec_dup (tag); + hash_set_mem (srt->rules_by_tag, rt->tag, rule_index); + rti_key = session_rule_tag_key_index (rule_index, is_ip4); + hash_set (srt->tags_by_rules, rti_key, rt - srt->rule_tags); + } + else + { + rip = hash_get_mem (srt->rules_by_tag, tag); + if (!rip) + { + clib_warning ("tag has no rule associated"); + return; + } + rti_key = session_rule_tag_key_index (*rip, is_ip4); + rtip = hash_get (srt->tags_by_rules, rti_key); + if (!rtip) + { + clib_warning ("rule has no tag associated"); + return; + } + rt = pool_elt_at_index (srt->rule_tags, *rtip); + ASSERT (rt); + hash_unset_mem (srt->rules_by_tag, tag); + hash_unset (srt->tags_by_rules, rti_key); + pool_put (srt->rule_tags, rt); + } +} + +u32 +session_rules_table_rule_for_tag (session_rules_table_t * srt, u8 * tag) +{ + uword *rp; + if (tag == 0) + return SESSION_RULES_TABLE_INVALID_INDEX; + rp = hash_get_mem (srt->rules_by_tag, tag); + return (rp == 0 ? SESSION_RULES_TABLE_INVALID_INDEX : *rp); +} + static void fib_pref_normalize (fib_prefix_t * pref) { @@ -32,64 +112,76 @@ fib_pref_normalize (fib_prefix_t * pref) u8 * format_session_rule4 (u8 * s, va_list * args) { - mma_rules_table_16_t *srt = va_arg (*args, mma_rules_table_16_t *); + session_rules_table_t *srt = va_arg (*args, session_rules_table_t *); mma_rule_16_t *sr = va_arg (*args, mma_rule_16_t *); session_mask_or_match_4_t *mask, *match; + mma_rules_table_16_t *srt4; + u8 *tag = 0, *null_tag = format (0, "none"); + u32 ri; int i; + srt4 = &srt->session_rules_tables_16; + ri = mma_rules_table_rule_index_16 (srt4, sr); + tag = session_rules_table_rule_tag (srt, ri, 1); match = (session_mask_or_match_4_t *) & sr->match; mask = (session_mask_or_match_4_t *) & sr->mask; - s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d", - mma_rules_table_rule_index_16 (srt, sr), format_ip4_address, - &match->lcl_ip, - ip4_mask_to_preflen (&mask->lcl_ip), - match->lcl_port, format_ip4_address, &match->rmt_ip, - ip4_mask_to_preflen (&mask->rmt_ip), - match->rmt_port, sr->action_index); + s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri, + format_ip4_address, &match->lcl_ip, + ip4_mask_to_preflen (&mask->lcl_ip), match->lcl_port, + format_ip4_address, &match->rmt_ip, + ip4_mask_to_preflen (&mask->rmt_ip), match->rmt_port, + sr->action_index, tag ? tag : null_tag); if (vec_len (sr->next_indices)) { s = format (s, "\n children: "); for (i = 0; i < vec_len (sr->next_indices); i++) s = format (s, "%d ", sr->next_indices[i]); } + vec_free (null_tag); return s; } u8 * format_session_rule6 (u8 * s, va_list * args) { - mma_rules_table_40_t *srt = va_arg (*args, mma_rules_table_40_t *); + session_rules_table_t *srt = va_arg (*args, session_rules_table_t *); mma_rule_40_t *sr = va_arg (*args, mma_rule_40_t *); session_mask_or_match_6_t *mask, *match; + mma_rules_table_40_t *srt6; + u8 *tag = 0, *null_tag = format (0, "none"); + u32 ri; int i; + srt6 = &srt->session_rules_tables_40; + ri = mma_rules_table_rule_index_40 (srt6, sr); + tag = session_rules_table_rule_tag (srt, ri, 0); match = (session_mask_or_match_6_t *) & sr->match; mask = (session_mask_or_match_6_t *) & sr->mask; - s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d", - mma_rules_table_rule_index_40 (srt, sr), format_ip6_address, - &match->lcl_ip, ip6_mask_to_preflen (&mask->lcl_ip), - match->lcl_port, format_ip6_address, &match->rmt_ip, + s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri, + format_ip6_address, &match->lcl_ip, + ip6_mask_to_preflen (&mask->lcl_ip), match->lcl_port, + format_ip6_address, &match->rmt_ip, ip6_mask_to_preflen (&mask->rmt_ip), match->rmt_port, - sr->action_index); + sr->action_index, tag ? tag : null_tag); if (vec_len (sr->next_indices)) { s = format (s, "\n children: "); for (i = 0; i < vec_len (sr->next_indices); i++) s = format (s, "%d ", sr->next_indices[i]); } + vec_free (null_tag); return s; } void * -session_rules_table_get (session_rules_table_t * srt, u8 transport_proto, - u8 fib_proto) +session_rules_table_get (session_rules_table_t * srt, u8 fib_proto) { if (fib_proto == FIB_PROTOCOL_IP4) - return &srt->session_rules_tables_16[transport_proto]; + return &srt->session_rules_tables_16; else if (fib_proto == FIB_PROTOCOL_IP6) - return &srt->session_rules_tables_40[transport_proto]; + return &srt->session_rules_tables_40; return 0; } @@ -208,61 +300,105 @@ session_rules_table_alloc_rule_40 (mma_rules_table_40_t * srt, return rule; } +/** + * Add/delete session rule + * + * @param srt table where rule should be added + * @param args rule arguments + * + * @return 0 if success, clib_error_t error otherwise + */ clib_error_t * session_rules_table_add_del (session_rules_table_t * srt, session_rule_table_add_del_args_t * args) { u8 fib_proto = args->rmt.fp_proto; + u32 ri_from_tag, ri; + int rv; - if (args->transport_proto != TRANSPORT_PROTO_TCP - && args->transport_proto != TRANSPORT_PROTO_UDP) + ri_from_tag = session_rules_table_rule_for_tag (srt, args->tag); + if (args->is_add && ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX) return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0, - "invalid transport proto"); + "tag exists"); if (fib_proto == FIB_PROTOCOL_IP4) { mma_rules_table_16_t *srt4; - srt4 = &srt->session_rules_tables_16[args->transport_proto]; + srt4 = &srt->session_rules_tables_16; if (args->is_add) { - mma_rule_16_t *rule; - rule = session_rules_table_alloc_rule_16 (srt4, &args->lcl, - args->lcl_port, - &args->rmt, - args->rmt_port); - rule->action_index = args->action_index; - mma_rules_table_add_rule_16 (srt4, rule); + mma_rule_16_t *rule4; + rule4 = session_rules_table_alloc_rule_16 (srt4, &args->lcl, + args->lcl_port, + &args->rmt, + args->rmt_port); + rule4->action_index = args->action_index; + rv = mma_rules_table_add_rule_16 (srt4, rule4); + if (!rv) + { + ri = mma_rules_table_rule_index_16 (srt4, rule4); + session_rules_table_add_del_tag (srt, args->tag, ri, 1, 1); + } } else { - mma_rule_16_t rule; - memset (&rule, 0, sizeof (rule)); - session_rules_table_init_rule_16 (&rule, &args->lcl, args->lcl_port, - &args->rmt, args->rmt_port); - mma_rules_table_del_rule_16 (srt4, &rule, srt4->root_index); + mma_rule_16_t *rule; + if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX) + { + rule = mma_rules_table_get_rule_16 (srt4, ri_from_tag); + mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index); + session_rules_table_add_del_tag (srt, args->tag, 0, 1, 0); + } + else + { + mma_rule_16_t _rule; + rule = &_rule; + memset (rule, 0, sizeof (*rule)); + session_rules_table_init_rule_16 (rule, &args->lcl, + args->lcl_port, &args->rmt, + args->rmt_port); + mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index); + } } } else if (fib_proto == FIB_PROTOCOL_IP6) { mma_rules_table_40_t *srt6; - mma_rule_40_t *rule; - srt6 = &srt->session_rules_tables_40[args->transport_proto]; + mma_rule_40_t *rule6; + srt6 = &srt->session_rules_tables_40; if (args->is_add) { - rule = session_rules_table_alloc_rule_40 (srt6, &args->lcl, - args->lcl_port, - &args->rmt, - args->rmt_port); - rule->action_index = args->action_index; - mma_rules_table_add_rule_40 (srt6, rule); + rule6 = session_rules_table_alloc_rule_40 (srt6, &args->lcl, + args->lcl_port, + &args->rmt, + args->rmt_port); + rule6->action_index = args->action_index; + rv = mma_rules_table_add_rule_40 (srt6, rule6); + if (!rv) + { + ri = mma_rules_table_rule_index_40 (srt6, rule6); + session_rules_table_add_del_tag (srt, args->tag, ri, 0, 1); + } } else { - mma_rule_40_t rule; - memset (&rule, 0, sizeof (rule)); - session_rules_table_init_rule_40 (&rule, &args->lcl, args->lcl_port, - &args->rmt, args->rmt_port); - mma_rules_table_del_rule_40 (srt6, &rule, srt6->root_index); + mma_rule_40_t *rule; + if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX) + { + rule = mma_rules_table_get_rule_40 (srt6, ri_from_tag); + mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index); + session_rules_table_add_del_tag (srt, args->tag, 0, 0, 0); + } + else + { + mma_rule_40_t _rule; + rule = &_rule; + memset (rule, 0, sizeof (*rule)); + session_rules_table_init_rule_40 (rule, &args->lcl, + args->lcl_port, &args->rmt, + args->rmt_port); + mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index); + } } } else @@ -272,36 +408,34 @@ session_rules_table_add_del (session_rules_table_t * srt, } u32 -session_rules_table_lookup4 (session_rules_table_t * srt, u8 transport_proto, +session_rules_table_lookup4 (session_rules_table_t * srt, ip4_address_t * lcl_ip, ip4_address_t * rmt_ip, u16 lcl_port, u16 rmt_port) { - mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16[transport_proto]; + mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16; session_mask_or_match_4_t key = { .lcl_ip.as_u32 = lcl_ip->as_u32, .rmt_ip.as_u32 = rmt_ip->as_u32, .lcl_port = lcl_port, .rmt_port = rmt_port, }; - return mma_rules_table_lookup_16 (srt4, - (mma_mask_or_match_16_t *) & key, + return mma_rules_table_lookup_16 (srt4, (mma_mask_or_match_16_t *) & key, srt4->root_index); } u32 -session_rules_table_lookup6 (session_rules_table_t * srt, u8 transport_proto, +session_rules_table_lookup6 (session_rules_table_t * srt, ip6_address_t * lcl_ip, ip6_address_t * rmt_ip, u16 lcl_port, u16 rmt_port) { - mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40[transport_proto]; + mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40; session_mask_or_match_6_t key = { .lcl_port = lcl_port, .rmt_port = rmt_port, }; clib_memcpy (&key.lcl_ip, lcl_ip, sizeof (*lcl_ip)); clib_memcpy (&key.rmt_ip, rmt_ip, sizeof (*rmt_ip)); - return mma_rules_table_lookup_40 (srt6, - (mma_mask_or_match_40_t *) & key, + return mma_rules_table_lookup_40 (srt6, (mma_mask_or_match_40_t *) & key, srt6->root_index); } @@ -313,36 +447,32 @@ session_rules_table_init (session_rules_table_t * srt) mma_rule_16_t *rule4; mma_rule_40_t *rule6; fib_prefix_t null_prefix; - int i; memset (&null_prefix, 0, sizeof (null_prefix)); - for (i = 0; i < TRANSPORT_N_PROTO; i++) - { - srt4 = &srt->session_rules_tables_16[i]; - rule4 = session_rules_table_alloc_rule_16 (srt4, &null_prefix, 0, - &null_prefix, 0); - rule4->action_index = SESSION_RULES_TABLE_INVALID_INDEX; - srt4->root_index = mma_rules_table_rule_index_16 (srt4, rule4); - srt4->rule_cmp_fn = rule_cmp_16; - } - - for (i = 0; i < TRANSPORT_N_PROTO; i++) - { - srt6 = &srt->session_rules_tables_40[i];; - rule6 = session_rules_table_alloc_rule_40 (srt6, &null_prefix, 0, - &null_prefix, 0); - rule6->action_index = SESSION_RULES_TABLE_INVALID_INDEX; - srt6->root_index = mma_rules_table_rule_index_40 (srt6, rule6); - srt6->rule_cmp_fn = rule_cmp_40; - } + srt4 = &srt->session_rules_tables_16; + rule4 = session_rules_table_alloc_rule_16 (srt4, &null_prefix, 0, + &null_prefix, 0); + rule4->action_index = SESSION_RULES_TABLE_INVALID_INDEX; + srt4->root_index = mma_rules_table_rule_index_16 (srt4, rule4); + srt4->rule_cmp_fn = rule_cmp_16; + + srt6 = &srt->session_rules_tables_40; + rule6 = session_rules_table_alloc_rule_40 (srt6, &null_prefix, 0, + &null_prefix, 0); + rule6->action_index = SESSION_RULES_TABLE_INVALID_INDEX; + srt6->root_index = mma_rules_table_rule_index_40 (srt6, rule6); + srt6->rule_cmp_fn = rule_cmp_40; + + srt->rules_by_tag = hash_create_vec (0, sizeof (u8), sizeof (uword)); + srt->tags_by_rules = hash_create (0, sizeof (uword)); } void session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt, - u8 transport_proto, ip46_address_t * lcl_ip, - u16 lcl_port, ip46_address_t * rmt_ip, - u16 rmt_port, u8 is_ip4) + ip46_address_t * lcl_ip, u16 lcl_port, + ip46_address_t * rmt_ip, u16 rmt_port, + u8 is_ip4) { mma_rules_table_16_t *srt4; mma_rules_table_40_t *srt6; @@ -352,7 +482,7 @@ session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt, if (is_ip4) { - srt4 = session_rules_table_get (srt, transport_proto, FIB_PROTOCOL_IP4); + srt4 = session_rules_table_get (srt, FIB_PROTOCOL_IP4); session_mask_or_match_4_t key = { .lcl_ip.as_u32 = lcl_ip->ip4.as_u32, .rmt_ip.as_u32 = rmt_ip->ip4.as_u32, @@ -364,41 +494,39 @@ session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt, (mma_mask_or_match_16_t *) & key, srt4->root_index); sr4 = mma_rules_table_get_rule_16 (srt4, ri); - vlib_cli_output (vm, "%U", format_session_rule4, srt4, sr4); + vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4); } else { - srt6 = session_rules_table_get (srt, transport_proto, FIB_PROTOCOL_IP6); + srt6 = session_rules_table_get (srt, FIB_PROTOCOL_IP6); session_mask_or_match_6_t key = { .lcl_port = lcl_port, .rmt_port = rmt_port, }; clib_memcpy (&key.lcl_ip, &lcl_ip->ip6, sizeof (lcl_ip->ip6)); clib_memcpy (&key.rmt_ip, &rmt_ip->ip6, sizeof (rmt_ip->ip6)); - ri = - mma_rules_table_lookup_rule_40 (srt6, - (mma_mask_or_match_40_t *) & - key, srt6->root_index); + ri = mma_rules_table_lookup_rule_40 (srt6, + (mma_mask_or_match_40_t *) & key, + srt6->root_index); sr6 = mma_rules_table_get_rule_40 (srt6, ri); - vlib_cli_output (vm, "%U", format_session_rule6, srt6, sr6); + vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6); } } void session_rules_table_cli_dump (vlib_main_t * vm, session_rules_table_t * srt, - u8 fib_proto, u8 transport_proto) + u8 fib_proto) { if (fib_proto == FIB_PROTOCOL_IP4) { mma_rules_table_16_t *srt4; mma_rule_16_t *sr4; - srt4 = &srt->session_rules_tables_16[transport_proto]; - vlib_cli_output (vm, "%U IP4 rules table", format_transport_proto, - transport_proto); + srt4 = &srt->session_rules_tables_16; + vlib_cli_output (vm, "IP4 rules"); /* *INDENT-OFF* */ pool_foreach(sr4, srt4->rules, ({ - vlib_cli_output (vm, "%U", format_session_rule4, srt4, sr4); + vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4); })); /* *INDENT-ON* */ @@ -407,13 +535,12 @@ session_rules_table_cli_dump (vlib_main_t * vm, session_rules_table_t * srt, { mma_rules_table_40_t *srt6; mma_rule_40_t *sr6; - srt6 = &srt->session_rules_tables_40[transport_proto]; - vlib_cli_output (vm, "\n%U IP6 rules table", format_transport_proto, - transport_proto); + srt6 = &srt->session_rules_tables_40; + vlib_cli_output (vm, "IP6 rules"); /* *INDENT-OFF* */ pool_foreach(sr6, srt6->rules, ({ - vlib_cli_output (vm, "%U", format_session_rule6, srt6, sr6); + vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6); })); /* *INDENT-ON* */