2 * Copyright (c) 2016 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
15 #ifndef included_acl_h
16 #define included_acl_h
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/ethernet/ethernet.h>
21 #include <vnet/l2/l2_output.h>
24 #include <vppinfra/hash.h>
25 #include <vppinfra/error.h>
26 #include <vppinfra/elog.h>
28 #define ACL_PLUGIN_VERSION_MAJOR 1
29 #define ACL_PLUGIN_VERSION_MINOR 1
31 extern vlib_node_registration_t acl_in_node;
32 extern vlib_node_registration_t acl_out_node;
34 void input_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap);
35 void output_acl_packet_match(u32 sw_if_index, vlib_buffer_t * b0, u32 *nextp, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap);
37 enum address_e { IP4, IP6 };
59 u16 src_port_or_type_first;
60 u16 src_port_or_type_last;
61 u16 dst_port_or_code_first;
62 u16 dst_port_or_code_last;
73 ip46_address_t src_ip_addr;
91 macip_acl_rule_t *rules;
92 /* References to the classifier tables that will enforce the rules */
99 /* API message ID base */
102 acl_list_t *acls; /* Pool of ACLs */
103 macip_acl_list_t *macip_acls; /* Pool of MAC-IP ACLs */
105 /* ACLs associated with interfaces */
106 u32 **input_acl_vec_by_sw_if_index;
107 u32 **output_acl_vec_by_sw_if_index;
110 * Classify tables used to grab the packets for the ACL check,
111 * and serving as the 5-tuple session tables at the same time
113 u32 *acl_ip4_input_classify_table_by_sw_if_index;
114 u32 *acl_ip6_input_classify_table_by_sw_if_index;
115 u32 *acl_ip4_output_classify_table_by_sw_if_index;
116 u32 *acl_ip6_output_classify_table_by_sw_if_index;
118 /* MACIP (input) ACLs associated with the interfaces */
119 u32 *macip_acl_by_sw_if_index;
121 /* next indices for our nodes in the l2-classify tables */
122 u32 l2_input_classify_next_acl;
123 u32 l2_output_classify_next_acl;
125 /* next node indices for feature bitmap */
126 u32 acl_in_node_input_next_node_index[32];
127 /* the respective thing for the output feature */
128 l2_output_next_nodes_st acl_out_output_next_nodes;
130 /* ACL match actions (must be coherent across in/out ACLs to next indices (can differ) */
132 u32 acl_in_ip4_match_next[256];
133 u32 acl_in_ip6_match_next[256];
134 u32 acl_out_ip4_match_next[256];
135 u32 acl_out_ip6_match_next[256];
140 vlib_main_t * vlib_main;
141 vnet_main_t * vnet_main;
142 ethernet_main_t * ethernet_main;
145 extern acl_main_t acl_main;