* limitations under the License.
*/
-option version = "2.2.0";
+option version = "2.3.0";
import "vnet/ip/ip_types.api";
u64 total_ip4_fragments;
u64 total_security_check[2];
};
+
+
+/** \brief Set MAP fragmentation parameters
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param inner - 1=frag inner packet, 0=frag tunnel packets
+ @param ignore_df - 1=IP4 fragment despite DF bit, 0=honor DF
+*/
+autoreply define map_param_set_fragmentation
+{
+ u32 client_index;
+ u32 context;
+ bool inner;
+ bool ignore_df;
+};
+
+
+/** \brief Set MAP ICMP parameters
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param icmp4_err_relay_src - IPv4 ICMP err relay src address
+*/
+autoreply define map_param_set_icmp
+{
+ u32 client_index;
+ u32 context;
+ vl_api_ip4_address_t ip4_err_relay_src;
+};
+
+
+/** \brief Set MAP ICMP6 parameters
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param enable_unreachable - 1 = send ICMP unreachable err msgs
+*/
+autoreply define map_param_set_icmp6
+{
+ u32 client_index;
+ u32 context;
+ bool enable_unreachable;
+};
+
+
+/** \brief Add/delete MAP pre-resolve IP addresses parameters
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param is_add - 1 = Add non-zero IP addresses, 0 = delete
+ @param ip4_nh_address - direct IP4 next-hop address
+ @param ip6_nh_address - direct IP6 next-hop address
+*/
+autoreply define map_param_add_del_pre_resolve
+{
+ u32 client_index;
+ u32 context;
+ bool is_add;
+ vl_api_ip4_address_t ip4_nh_address;
+ vl_api_ip6_address_t ip6_nh_address;
+};
+
+
+/** \brief Set MAP reassembly parameters
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param is_ip6 - 1 = params apply to IPv6, 0 = params apply to IPv4
+ @param lifetime_ms - reassembly valid lifetime, or ~0
+ @param pool_size - max number of reassemblies, or ~0
+ @param buffers - max number of reassembly buffers, or ~0
+ @param ht_ratio - hash-table size factor, or ~0
+*/
+autoreply define map_param_set_reassembly
+{
+ u32 client_index;
+ u32 context;
+ bool is_ip6;
+ u16 lifetime_ms;
+ u16 pool_size;
+ u32 buffers;
+ f64 ht_ratio;
+};
+
+
+/** \brief Set MAP security-check parameters
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param enable - 1=enable security check on first inbound packet
+ @param fragments - 1=enable check on (subsequent) fragments too
+*/
+autoreply define map_param_set_security_check
+{
+ u32 client_index;
+ u32 context;
+ bool enable;
+ bool fragments;
+};
+
+
+/** \brief Set MAP traffic class parameters
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+ @param copy - 1 = copy packet class/TOS field, 0 = use class instead
+ @param class - class field value when copy == 0
+*/
+autoreply define map_param_set_traffic_class
+{
+ u32 client_index;
+ u32 context;
+ bool copy;
+ u8 class;
+};
+
+
+/** \brief Request for a single block of MAP parameters
+ @param client_index - opaque cookie to identify the sender
+ @param context - sender context, to match reply w/ request
+*/
+define map_param_get
+{
+ u32 client_index;
+ u32 context;
+};
+
+
+/** \brief Reply for map_param_get request
+ @param context - sender context, to match reply w/ request
+ @param retval - return code for request
+ @param inner - 1=frag inner packet, 0=frag tunnel packets, ~0=untouched
+ @param ignore_df - 1=IP4 fragm despite DF bit, 0=honor DF, ~0=untouched
+ @param icmp_ip4_err_relay_src - IPv4 ICMP err relay src address
+ @param icmp6_enable_unreachable - 1 = send ICMP unreachable err msgs
+ @param ip4_nh_address - direct IP4 next-hop address
+ @param ip6_nh_address - direct IP6 next-hop address
+ @param ip4_lifetime_ms - reassembly valid lifetime, or ~0
+ @param ip4_pool_size - max number of reassemblies, or ~0
+ @param ip4_buffers - max number of reassembly buffers, or ~0
+ @param ip4_ht_ratio - reassembly valid lifetime, or ~0
+ @param ip6_lifetime_ms - max number of reassemblies, or ~0
+ @param ip6_pool_size - max number of reassemblies, or ~0
+ @param ip6_buffers - max number of reassembly buffers, or ~0
+ @param ip6_ht_ratio - hash-table size factor, or ~0
+ @param sec_check_enable - 1=enable security check on first inbound packet
+ @param sec_check_fragments - 1=enable check on (subsequent) fragments too
+ @param tc_copy - 1 = copy packet class/TOS field, 0 = use class instead
+ @param tc_class - class field value when copy == 0
+*/
+define map_param_get_reply
+{
+ u32 context;
+ i32 retval;
+ u8 frag_inner;
+ u8 frag_ignore_df;
+ vl_api_ip4_address_t icmp_ip4_err_relay_src;
+ bool icmp6_enable_unreachable;
+ vl_api_ip4_address_t ip4_nh_address;
+ vl_api_ip6_address_t ip6_nh_address;
+ u16 ip4_lifetime_ms;
+ u16 ip4_pool_size;
+ u32 ip4_buffers;
+ f64 ip4_ht_ratio;
+ u16 ip6_lifetime_ms;
+ u16 ip6_pool_size;
+ u32 ip6_buffers;
+ f64 ip6_ht_ratio;
+ bool sec_check_enable;
+ bool sec_check_fragments;
+ bool tc_copy;
+ u8 tc_class;
+};
pr->sibling = FIB_NODE_INDEX_INVALID;
}
-static void
+void
map_pre_resolve (ip4_address_t * ip4, ip6_address_t * ip6, int is_del)
{
if (ip6 && (ip6->as_u64[0] != 0 || ip6->as_u64[1] != 0))
vlib_cli_command_t * cmd)
{
unformat_input_t _line_input, *line_input = &_line_input;
- map_main_t *mm = &map_main;
clib_error_t *error = NULL;
+ bool enable = false;
+ bool check_frag = false;
+ bool saw_enable = false;
+ bool saw_frag = false;
/* Get a line of input. */
if (!unformat_user (input, unformat_line_input, line_input))
while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
{
- if (unformat (line_input, "off"))
- mm->sec_check = false;
- else if (unformat (line_input, "on"))
- mm->sec_check = true;
+ if (unformat (line_input, "enable"))
+ {
+ enable = false;
+ saw_enable = true;
+ }
+ else if (unformat (line_input, "disable"))
+ {
+ enable = true;
+ saw_enable = true;
+ }
+ else if (unformat (line_input, "fragments on"))
+ {
+ check_frag = true;
+ saw_frag = true;
+ }
+ else if (unformat (line_input, "fragments off"))
+ {
+ check_frag = false;
+ saw_frag = true;
+ }
else
{
error = clib_error_return (0, "unknown input `%U'",
}
}
-done:
- unformat_free (line_input);
-
- return error;
-}
-
-static clib_error_t *
-map_security_check_frag_command_fn (vlib_main_t * vm,
- unformat_input_t * input,
- vlib_cli_command_t * cmd)
-{
- unformat_input_t _line_input, *line_input = &_line_input;
- map_main_t *mm = &map_main;
- clib_error_t *error = NULL;
-
- /* Get a line of input. */
- if (!unformat_user (input, unformat_line_input, line_input))
- return 0;
+ if (!saw_enable)
+ {
+ error = clib_error_return (0,
+ "Must specify enable 'enable' or 'disable'");
+ goto done;
+ }
- while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ if (!saw_frag)
{
- if (unformat (line_input, "off"))
- mm->sec_check_frag = false;
- else if (unformat (line_input, "on"))
- mm->sec_check_frag = true;
- else
- {
- error = clib_error_return (0, "unknown input `%U'",
- format_unformat_error, line_input);
- goto done;
- }
+ error = clib_error_return (0, "Must specify fragments 'on' or 'off'");
+ goto done;
}
+ map_param_set_security_check (enable, check_frag);
+
done:
unformat_free (line_input);
return error;
}
+
static clib_error_t *
map_add_domain_command_fn (vlib_main_t * vm,
unformat_input_t * input, vlib_cli_command_t * cmd)
{
unformat_input_t _line_input, *line_input = &_line_input;
ip4_address_t icmp_src_address;
+ ip4_address_t *p_icmp_addr = 0;
map_main_t *mm = &map_main;
clib_error_t *error = NULL;
{
if (unformat
(line_input, "%U", unformat_ip4_address, &icmp_src_address))
- mm->icmp4_src_address = icmp_src_address;
+ {
+ mm->icmp4_src_address = icmp_src_address;
+ p_icmp_addr = &icmp_src_address;
+ }
else
{
error = clib_error_return (0, "unknown input `%U'",
}
}
+ map_param_set_icmp (p_icmp_addr);
+
done:
unformat_free (line_input);
vlib_cli_command_t * cmd)
{
unformat_input_t _line_input, *line_input = &_line_input;
- map_main_t *mm = &map_main;
int num_m_args = 0;
clib_error_t *error = NULL;
+ bool enabled = false;
/* Get a line of input. */
if (!unformat_user (input, unformat_line_input, line_input))
{
num_m_args++;
if (unformat (line_input, "on"))
- mm->icmp6_enabled = true;
+ enabled = true;
else if (unformat (line_input, "off"))
- mm->icmp6_enabled = false;
+ enabled = false;
else
{
error = clib_error_return (0, "unknown input `%U'",
if (num_m_args != 1)
error = clib_error_return (0, "mandatory argument(s) missing");
+
+ map_param_set_icmp6 (enabled);
+
done:
unformat_free (line_input);
return error;
}
+
static clib_error_t *
map_fragment_command_fn (vlib_main_t * vm,
unformat_input_t * input, vlib_cli_command_t * cmd)
{
unformat_input_t _line_input, *line_input = &_line_input;
- map_main_t *mm = &map_main;
clib_error_t *error = NULL;
+ bool frag_inner = false;
+ bool frag_ignore_df = false;
+ bool saw_in_out = false;
+ bool saw_df = false;
/* Get a line of input. */
if (!unformat_user (input, unformat_line_input, line_input))
while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
{
if (unformat (line_input, "inner"))
- mm->frag_inner = true;
+ {
+ frag_inner = true;
+ saw_in_out = true;
+ }
else if (unformat (line_input, "outer"))
- mm->frag_inner = false;
+ {
+ frag_inner = false;
+ saw_in_out = true;
+ }
+ else if (unformat (line_input, "ignore-df"))
+ {
+ frag_ignore_df = true;
+ saw_df = true;
+ }
+ else if (unformat (line_input, "honor-df"))
+ {
+ frag_ignore_df = false;
+ saw_df = true;
+ }
else
{
error = clib_error_return (0, "unknown input `%U'",
}
}
-done:
- unformat_free (line_input);
-
- return error;
-}
-
-static clib_error_t *
-map_fragment_df_command_fn (vlib_main_t * vm,
- unformat_input_t * input,
- vlib_cli_command_t * cmd)
-{
- unformat_input_t _line_input, *line_input = &_line_input;
- map_main_t *mm = &map_main;
- clib_error_t *error = NULL;
-
- /* Get a line of input. */
- if (!unformat_user (input, unformat_line_input, line_input))
- return 0;
+ if (!saw_in_out)
+ {
+ error = clib_error_return (0, "Must specify 'inner' or 'outer'");
+ goto done;
+ }
- while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+ if (!saw_df)
{
- if (unformat (line_input, "on"))
- mm->frag_ignore_df = true;
- else if (unformat (line_input, "off"))
- mm->frag_ignore_df = false;
- else
- {
- error = clib_error_return (0, "unknown input `%U'",
- format_unformat_error, line_input);
- goto done;
- }
+ error = clib_error_return (0, "Must specify 'ignore-df' or 'honor-df'");
+ goto done;
}
+ map_param_set_fragmentation (frag_inner, frag_ignore_df);
+
done:
unformat_free (line_input);
vlib_cli_command_t * cmd)
{
unformat_input_t _line_input, *line_input = &_line_input;
- map_main_t *mm = &map_main;
u32 tc = 0;
clib_error_t *error = NULL;
+ bool tc_copy = false;
- mm->tc_copy = false;
/* Get a line of input. */
if (!unformat_user (input, unformat_line_input, line_input))
while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
{
if (unformat (line_input, "copy"))
- mm->tc_copy = true;
+ tc_copy = true;
else if (unformat (line_input, "%x", &tc))
- mm->tc = tc & 0xff;
+ tc = tc & 0xff;
else
{
error = clib_error_return (0, "unknown input `%U'",
}
}
+ map_param_set_traffic_class (tc_copy, tc);
+
done:
unformat_free (line_input);
MAP_IP6_REASS_CONF_BUFFERS_MAX);
}
- if (ip4)
+ int rv;
+ u32 reass = 0, packets = 0;
+ rv = map_param_set_reassembly (!ip4, lifetime, pool_size, buffers, ht_ratio,
+ &reass, &packets);
+
+ switch (rv)
{
- u32 reass = 0, packets = 0;
- if (pool_size != ~0)
- {
- if (map_ip4_reass_conf_pool_size (pool_size, &reass, &packets))
- {
- vlib_cli_output (vm, "Could not set ip4-reass pool-size");
- }
- else
- {
- vlib_cli_output (vm,
- "Setting ip4-reass pool-size (destroyed-reassembly=%u , dropped-fragments=%u)",
- reass, packets);
- }
- }
- if (ht_ratio != (MAP_IP4_REASS_CONF_HT_RATIO_MAX + 1))
- {
- if (map_ip4_reass_conf_ht_ratio (ht_ratio, &reass, &packets))
- {
- vlib_cli_output (vm, "Could not set ip4-reass ht-log2len");
- }
- else
- {
- vlib_cli_output (vm,
- "Setting ip4-reass ht-log2len (destroyed-reassembly=%u , dropped-fragments=%u)",
- reass, packets);
- }
- }
- if (lifetime != ~0)
- {
- if (map_ip4_reass_conf_lifetime (lifetime))
- vlib_cli_output (vm, "Could not set ip4-reass lifetime");
- else
- vlib_cli_output (vm, "Setting ip4-reass lifetime");
- }
- if (buffers != ~(0ull))
- {
- if (map_ip4_reass_conf_buffers (buffers))
- vlib_cli_output (vm, "Could not set ip4-reass buffers");
- else
- vlib_cli_output (vm, "Setting ip4-reass buffers");
- }
+ case 0:
+ vlib_cli_output (vm,
+ "Note: destroyed-reassembly=%u , dropped-fragments=%u",
+ reass, packets);
+ break;
- if (map_main.ip4_reass_conf_buffers >
- map_main.ip4_reass_conf_pool_size *
- MAP_IP4_REASS_MAX_FRAGMENTS_PER_REASSEMBLY)
- {
- vlib_cli_output (vm,
- "Note: 'ip4-reass buffers' > pool-size * max-fragments-per-reassembly.");
- }
- }
+ case MAP_ERR_BAD_POOL_SIZE:
+ return clib_error_return (0, "Could not set reass pool-size");
- if (ip6)
- {
- u32 reass = 0, packets = 0;
- if (pool_size != ~0)
- {
- if (map_ip6_reass_conf_pool_size (pool_size, &reass, &packets))
- {
- vlib_cli_output (vm, "Could not set ip6-reass pool-size");
- }
- else
- {
- vlib_cli_output (vm,
- "Setting ip6-reass pool-size (destroyed-reassembly=%u , dropped-fragments=%u)",
- reass, packets);
- }
- }
- if (ht_ratio != (MAP_IP4_REASS_CONF_HT_RATIO_MAX + 1))
- {
- if (map_ip6_reass_conf_ht_ratio (ht_ratio, &reass, &packets))
- {
- vlib_cli_output (vm, "Could not set ip6-reass ht-log2len");
- }
- else
- {
- vlib_cli_output (vm,
- "Setting ip6-reass ht-log2len (destroyed-reassembly=%u , dropped-fragments=%u)",
- reass, packets);
- }
- }
- if (lifetime != ~0)
- {
- if (map_ip6_reass_conf_lifetime (lifetime))
- vlib_cli_output (vm, "Could not set ip6-reass lifetime");
- else
- vlib_cli_output (vm, "Setting ip6-reass lifetime");
- }
- if (buffers != ~(0ull))
- {
- if (map_ip6_reass_conf_buffers (buffers))
- vlib_cli_output (vm, "Could not set ip6-reass buffers");
- else
- vlib_cli_output (vm, "Setting ip6-reass buffers");
- }
+ case MAP_ERR_BAD_HT_RATIO:
+ return clib_error_return (0, "Could not set reass ht-log2len");
- if (map_main.ip6_reass_conf_buffers >
- map_main.ip6_reass_conf_pool_size *
- MAP_IP6_REASS_MAX_FRAGMENTS_PER_REASSEMBLY)
- {
- vlib_cli_output (vm,
- "Note: 'ip6-reass buffers' > pool-size * max-fragments-per-reassembly.");
- }
+ case MAP_ERR_BAD_LIFETIME:
+ return clib_error_return (0, "Could not set ip6-reass lifetime");
+
+ case MAP_ERR_BAD_BUFFERS:
+ return clib_error_return (0, "Could not set ip6-reass buffers");
+
+ case MAP_ERR_BAD_BUFFERS_TOO_LARGE:
+ return clib_error_return (0,
+ "Note: 'ip6-reass buffers' > pool-size * max-fragments-per-reassembly.");
}
return 0;
/*?
* Enable or disable the MAP-E inbound security check
+ * Specifiy if the inbound security check should be done on fragments
*
* @cliexpar
* @cliexstart{map params security-check}
* By default, a decapsulated packet's IPv4 source address will be
* verified against the outer header's IPv6 source address. Disabling
* this feature will allow IPv4 source address spoofing.
+ *
+ * Typically the inbound on-decapsulation security check is only done
+ * on the first packet. The packet that contains the L4
+ * information. While a security check on every fragment is possible,
+ * it has a cost. State must be created on the first fragment.
* @cliexend
?*/
VLIB_CLI_COMMAND(map_security_check_command, static) = {
.path = "map params security-check",
- .short_help = "map params security-check on|off",
+ .short_help = "map params security-check enable|disable fragments on|off",
.function = map_security_check_command_fn,
};
+
/*?
* Specifiy the IPv4 source address used for relayed ICMP error messages
*
*
* @cliexpar
* @cliexstart{map params fragment}
- * @cliexend
- ?*/
-VLIB_CLI_COMMAND(map_fragment_command, static) = {
- .path = "map params fragment",
- .short_help = "map params fragment inner|outer",
- .function = map_fragment_command_fn,
-};
-
-/*?
- * Ignore the IPv4 Don't fragment bit
- *
- * @cliexpar
- * @cliexstart{map params fragment ignore-df}
*
* Allows fragmentation of the IPv4 packet even if the DF bit is
* set. The choice between inner or outer fragmentation of tunnel
* endpoint.
* @cliexend
?*/
-VLIB_CLI_COMMAND(map_fragment_df_command, static) = {
- .path = "map params fragment ignore-df",
- .short_help = "map params fragment ignore-df on|off",
- .function = map_fragment_df_command_fn,
+VLIB_CLI_COMMAND(map_fragment_command, static) = {
+ .path = "map params fragment",
+ .short_help = "map params fragment inner|outer ignore-df|honor-df",
+ .function = map_fragment_command_fn,
};
-/*?
- * Specifiy if the inbound security check should be done on fragments
- *
- * @cliexpar
- * @cliexstart{map params security-check fragments}
- *
- * Typically the inbound on-decapsulation security check is only done
- * on the first packet. The packet that contains the L4
- * information. While a security check on every fragment is possible,
- * it has a cost. State must be created on the first fragment.
- * @cliexend
- ?*/
-VLIB_CLI_COMMAND(map_security_check_frag_command, static) = {
- .path = "map params security-check fragments",
- .short_help = "map params security-check fragments on|off",
- .function = map_security_check_frag_command_fn,
-};
/*?
* Add MAP domain
#define MAP_SKIP_IP6_LOOKUP 1
+#define MAP_ERR_GOOD 0
+#define MAP_ERR_BAD_POOL_SIZE -1
+#define MAP_ERR_BAD_HT_RATIO -2
+#define MAP_ERR_BAD_LIFETIME -3
+#define MAP_ERR_BAD_BUFFERS -4
+#define MAP_ERR_BAD_BUFFERS_TOO_LARGE -5
+
int map_create_domain (ip4_address_t * ip4_prefix, u8 ip4_prefix_len,
ip6_address_t * ip6_prefix, u8 ip6_prefix_len,
ip6_address_t * ip6_src, u8 ip6_src_len,
u8 is_add);
u8 *format_map_trace (u8 * s, va_list * args);
+int map_param_set_fragmentation (bool inner, bool ignore_df);
+int map_param_set_icmp (ip4_address_t * ip4_err_relay_src);
+int map_param_set_icmp6 (u8 enable_unreachable);
+void map_pre_resolve (ip4_address_t * ip4, ip6_address_t * ip6, int is_del);
+int map_param_set_reassembly (bool is_ipv6, u16 lifetime_ms,
+ u16 pool_size, u32 buffers, f64 ht_ratio,
+ u32 * reass, u32 * packets);
+int map_param_set_security_check (bool enable, bool fragments);
+int map_param_set_traffic_class (bool copy, u8 tc);
+
+
typedef enum
{
MAP_DOMAIN_PREFIX = 1 << 0,
vl_api_send_msg (reg, (u8 *) rmp);
}
+
+int
+map_param_set_fragmentation (bool inner, bool ignore_df)
+{
+ map_main_t *mm = &map_main;
+
+ mm->frag_inner = ! !inner;
+ mm->frag_ignore_df = ! !ignore_df;
+
+ return 0;
+}
+
+static void
+ vl_api_map_param_set_fragmentation_t_handler
+ (vl_api_map_param_set_fragmentation_t * mp)
+{
+ map_main_t *mm = &map_main;
+ vl_api_map_param_set_fragmentation_reply_t *rmp;
+ int rv = 0;
+
+ rv = map_param_set_fragmentation (mp->inner, mp->ignore_df);
+
+ REPLY_MACRO (VL_API_MAP_PARAM_SET_FRAGMENTATION_REPLY);
+}
+
+
+int
+map_param_set_icmp (ip4_address_t * icmp_src_address)
+{
+ map_main_t *mm = &map_main;
+
+ if (icmp_src_address == 0)
+ return -1;
+
+ mm->icmp4_src_address = *icmp_src_address;
+
+ return 0;
+}
+
+
+static void
+vl_api_map_param_set_icmp_t_handler (vl_api_map_param_set_icmp_t * mp)
+{
+ map_main_t *mm = &map_main;
+ vl_api_map_param_set_icmp_reply_t *rmp;
+ int rv;
+
+ rv = map_param_set_icmp ((ip4_address_t *) & mp->ip4_err_relay_src);
+
+ REPLY_MACRO (VL_API_MAP_PARAM_SET_ICMP_REPLY);
+}
+
+
+int
+map_param_set_icmp6 (u8 enable_unreachable)
+{
+ map_main_t *mm = &map_main;
+
+ mm->icmp6_enabled = ! !enable_unreachable;
+
+ return 0;
+}
+
+static void
+vl_api_map_param_set_icmp6_t_handler (vl_api_map_param_set_icmp6_t * mp)
+{
+ map_main_t *mm = &map_main;
+ vl_api_map_param_set_icmp6_reply_t *rmp;
+ int rv;
+
+ rv = map_param_set_icmp6 (mp->enable_unreachable);
+
+ REPLY_MACRO (VL_API_MAP_PARAM_SET_ICMP6_REPLY);
+}
+
+
+static void
+ vl_api_map_param_add_del_pre_resolve_t_handler
+ (vl_api_map_param_add_del_pre_resolve_t * mp)
+{
+ map_main_t *mm = &map_main;
+ vl_api_map_param_add_del_pre_resolve_reply_t *rmp;
+ int rv = 0;
+
+ map_pre_resolve ((ip4_address_t *) & mp->ip4_nh_address,
+ (ip6_address_t *) & mp->ip6_nh_address, mp->is_add);
+
+ REPLY_MACRO (VL_API_MAP_PARAM_ADD_DEL_PRE_RESOLVE_REPLY);
+}
+
+
+int
+map_param_set_reassembly (bool is_ipv6,
+ u16 lifetime_ms,
+ u16 pool_size,
+ u32 buffers,
+ f64 ht_ratio, u32 * reass, u32 * packets)
+{
+ u32 ps_reass = 0, ps_packets = 0;
+ u32 ht_reass = 0, ht_packets = 0;
+
+ if (is_ipv6)
+ {
+ if (pool_size != (u16) ~ 0)
+ {
+ if (pool_size > MAP_IP6_REASS_CONF_POOL_SIZE_MAX)
+ return MAP_ERR_BAD_POOL_SIZE;
+ if (map_ip6_reass_conf_pool_size
+ (pool_size, &ps_reass, &ps_packets))
+ return MAP_ERR_BAD_POOL_SIZE;
+ }
+
+ if (ht_ratio != (MAP_IP6_REASS_CONF_HT_RATIO_MAX + 1))
+ {
+ if (ht_ratio > MAP_IP6_REASS_CONF_HT_RATIO_MAX)
+ return MAP_ERR_BAD_HT_RATIO;
+ if (map_ip6_reass_conf_ht_ratio (ht_ratio, &ht_reass, &ht_packets))
+ return MAP_ERR_BAD_HT_RATIO;
+ }
+
+ if (lifetime_ms != (u16) ~ 0)
+ {
+ if (lifetime_ms > MAP_IP6_REASS_CONF_LIFETIME_MAX)
+ return MAP_ERR_BAD_LIFETIME;
+ if (map_ip6_reass_conf_lifetime (lifetime_ms))
+ return MAP_ERR_BAD_LIFETIME;
+ }
+
+ if (buffers != ~0)
+ {
+ if (buffers > MAP_IP6_REASS_CONF_BUFFERS_MAX)
+ return MAP_ERR_BAD_BUFFERS;
+ if (map_ip6_reass_conf_buffers (buffers))
+ return MAP_ERR_BAD_BUFFERS;
+ }
+
+ if (map_main.ip6_reass_conf_buffers >
+ map_main.ip6_reass_conf_pool_size *
+ MAP_IP6_REASS_MAX_FRAGMENTS_PER_REASSEMBLY)
+ {
+ return MAP_ERR_BAD_BUFFERS_TOO_LARGE;
+ }
+ }
+ else
+ {
+ if (pool_size != (u16) ~ 0)
+ {
+ if (pool_size > MAP_IP4_REASS_CONF_POOL_SIZE_MAX)
+ return MAP_ERR_BAD_POOL_SIZE;
+ if (map_ip4_reass_conf_pool_size
+ (pool_size, &ps_reass, &ps_packets))
+ return MAP_ERR_BAD_POOL_SIZE;
+ }
+
+ if (ht_ratio != (MAP_IP4_REASS_CONF_HT_RATIO_MAX + 1))
+ {
+ if (ht_ratio > MAP_IP4_REASS_CONF_HT_RATIO_MAX)
+ return MAP_ERR_BAD_HT_RATIO;
+ if (map_ip4_reass_conf_ht_ratio (ht_ratio, &ht_reass, &ht_packets))
+ return MAP_ERR_BAD_HT_RATIO;
+ }
+
+ if (lifetime_ms != (u16) ~ 0)
+ {
+ if (lifetime_ms > MAP_IP4_REASS_CONF_LIFETIME_MAX)
+ return MAP_ERR_BAD_LIFETIME;
+ if (map_ip4_reass_conf_lifetime (lifetime_ms))
+ return MAP_ERR_BAD_LIFETIME;
+ }
+
+ if (buffers != ~0)
+ {
+ if (buffers > MAP_IP4_REASS_CONF_BUFFERS_MAX)
+ return MAP_ERR_BAD_BUFFERS;
+ if (map_ip4_reass_conf_buffers (buffers))
+ return MAP_ERR_BAD_BUFFERS;
+ }
+
+ if (map_main.ip4_reass_conf_buffers >
+ map_main.ip4_reass_conf_pool_size *
+ MAP_IP4_REASS_MAX_FRAGMENTS_PER_REASSEMBLY)
+ {
+ return MAP_ERR_BAD_BUFFERS_TOO_LARGE;
+ }
+ }
+
+ if (reass)
+ *reass = ps_reass + ht_reass;
+
+ if (packets)
+ *packets = ps_packets + ht_packets;
+
+ return 0;
+}
+
+
+static void
+ vl_api_map_param_set_reassembly_t_handler
+ (vl_api_map_param_set_reassembly_t * mp)
+{
+ map_main_t *mm = &map_main;
+ vl_api_map_param_set_reassembly_reply_t *rmp;
+ u32 reass = 0, packets = 0;
+ int rv;
+ f64 ht_ratio;
+
+ ht_ratio = (f64) clib_net_to_host_u64 (mp->ht_ratio);
+ if (ht_ratio == ~0)
+ ht_ratio = MAP_IP6_REASS_CONF_HT_RATIO_MAX + 1;
+
+ rv = map_param_set_reassembly (mp->is_ip6,
+ clib_net_to_host_u16 (mp->lifetime_ms),
+ clib_net_to_host_u16 (mp->pool_size),
+ clib_net_to_host_u32 (mp->buffers),
+ ht_ratio, &reass, &packets);
+
+ /*
+ * FIXME: Should the lost reass and packet counts be returned in the API?
+ */
+
+ REPLY_MACRO (VL_API_MAP_PARAM_SET_REASSEMBLY_REPLY);
+}
+
+
+int
+map_param_set_security_check (bool enable, bool fragments)
+{
+ map_main_t *mm = &map_main;
+
+ mm->sec_check = ! !enable;
+ mm->sec_check_frag = ! !fragments;
+
+ return 0;
+}
+
+static void
+ vl_api_map_param_set_security_check_t_handler
+ (vl_api_map_param_set_security_check_t * mp)
+{
+ map_main_t *mm = &map_main;
+ vl_api_map_param_set_security_check_reply_t *rmp;
+ int rv;
+
+ rv = map_param_set_security_check (mp->enable, mp->fragments);
+
+ REPLY_MACRO (VL_API_MAP_PARAM_SET_SECURITY_CHECK_REPLY);
+}
+
+
+int
+map_param_set_traffic_class (bool copy, u8 tc)
+{
+ map_main_t *mm = &map_main;
+
+ mm->tc_copy = ! !copy;
+ mm->tc = tc;
+
+ return 0;
+}
+
+static void
+ vl_api_map_param_set_traffic_class_t_handler
+ (vl_api_map_param_set_traffic_class_t * mp)
+{
+ map_main_t *mm = &map_main;
+ vl_api_map_param_set_traffic_class_reply_t *rmp;
+ int rv;
+
+ rv = map_param_set_traffic_class (mp->copy, mp->class);
+
+ REPLY_MACRO (VL_API_MAP_PARAM_SET_TRAFFIC_CLASS_REPLY);
+}
+
+
+static void
+vl_api_map_param_get_t_handler (vl_api_map_param_get_t * mp)
+{
+ map_main_t *mm = &map_main;
+ vl_api_map_param_get_reply_t *rmp;
+ vl_api_registration_t *reg;
+
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ rmp = vl_msg_api_alloc (sizeof (*rmp));
+ rmp->_vl_msg_id = htons (VL_API_MAP_PARAM_GET_REPLY + mm->msg_id_base);
+ rmp->context = mp->context;
+ rmp->retval = 0;
+
+ rmp->frag_inner = mm->frag_inner;
+ rmp->frag_ignore_df = mm->frag_ignore_df;
+
+ clib_memcpy (&rmp->icmp_ip4_err_relay_src,
+ &mm->icmp4_src_address, sizeof (rmp->icmp_ip4_err_relay_src));
+
+ rmp->icmp6_enable_unreachable = mm->icmp6_enabled;
+
+ /*
+ * FIXME: How are these addresses re-extracted from the FIB?
+ * Or should a local map_main copy be kept?
+ */
+ clib_memset (&rmp->ip4_nh_address, 0, sizeof (rmp->ip4_nh_address));
+ clib_memset (&rmp->ip6_nh_address, 0, sizeof (rmp->ip6_nh_address));
+
+ rmp->ip4_lifetime_ms =
+ clib_net_to_host_u16 (mm->ip4_reass_conf_lifetime_ms);
+ rmp->ip4_pool_size = clib_net_to_host_u16 (mm->ip4_reass_conf_pool_size);
+ rmp->ip4_buffers = clib_net_to_host_u32 (mm->ip4_reass_conf_buffers);
+ rmp->ip4_ht_ratio =
+ clib_net_to_host_u32 ((u32) mm->ip4_reass_conf_ht_ratio);
+
+ rmp->ip6_lifetime_ms =
+ clib_net_to_host_u16 (mm->ip6_reass_conf_lifetime_ms);
+ rmp->ip6_pool_size = clib_net_to_host_u16 (mm->ip6_reass_conf_pool_size);
+ rmp->ip6_buffers = clib_net_to_host_u32 (mm->ip6_reass_conf_buffers);
+ rmp->ip6_ht_ratio =
+ clib_net_to_host_u32 ((u32) mm->ip6_reass_conf_ht_ratio);
+
+ rmp->sec_check_enable = mm->sec_check;
+ rmp->sec_check_fragments = mm->sec_check_frag;
+
+ rmp->tc_copy = mm->tc_copy;
+ rmp->tc_class = mm->tc;
+
+ vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+
#define foreach_map_plugin_api_msg \
_(MAP_ADD_DOMAIN, map_add_domain) \
_(MAP_DEL_DOMAIN, map_del_domain) \
_(MAP_ADD_DEL_RULE, map_add_del_rule) \
_(MAP_DOMAIN_DUMP, map_domain_dump) \
_(MAP_RULE_DUMP, map_rule_dump) \
-_(MAP_SUMMARY_STATS, map_summary_stats)
+_(MAP_SUMMARY_STATS, map_summary_stats) \
+_(MAP_PARAM_SET_FRAGMENTATION, map_param_set_fragmentation) \
+_(MAP_PARAM_SET_ICMP, map_param_set_icmp) \
+_(MAP_PARAM_SET_ICMP6, map_param_set_icmp6) \
+_(MAP_PARAM_ADD_DEL_PRE_RESOLVE, map_param_add_del_pre_resolve) \
+_(MAP_PARAM_SET_REASSEMBLY, map_param_set_reassembly) \
+_(MAP_PARAM_SET_SECURITY_CHECK, map_param_set_security_check) \
+_(MAP_PARAM_SET_TRAFFIC_CLASS, map_param_set_traffic_class) \
+_(MAP_PARAM_GET, map_param_get)
#define vl_msg_name_crc_list
#include <map/map_all_api_h.h>
Code Review / vpp.git / commitdiff