FD.io VPP  v18.01-8-g0eacf49
Vector Packet Processing
fa_node.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #include <stddef.h>
16 #include <netinet/in.h>
17 
18 #include <vlib/vlib.h>
19 #include <vnet/vnet.h>
20 #include <vnet/pg/pg.h>
21 #include <vppinfra/error.h>
22 #include <acl/acl.h>
23 #include <vppinfra/bihash_40_8.h>
24 
27 
28 #include "fa_node.h"
29 #include "hash_lookup.h"
30 
31 typedef struct
32 {
37  u64 packet_info[6];
41 
42 static u8 *
43 format_fa_5tuple (u8 * s, va_list * args)
44 {
45  fa_5tuple_t *p5t = va_arg (*args, fa_5tuple_t *);
46 
47  return format(s, "%s sw_if_index %d (lsb16 %d) l3 %s%s %U -> %U"
48  " l4 proto %d l4_valid %d port %d -> %d tcp flags (%s) %02x rsvd %x",
49  p5t->pkt.is_input ? "input" : "output",
50  p5t->pkt.sw_if_index, p5t->l4.lsb_of_sw_if_index, p5t->pkt.is_ip6 ? "ip6" : "ip4",
51  p5t->pkt.is_nonfirst_fragment ? " non-initial fragment" : "",
53  format_ip46_address, &p5t->addr[1], p5t->pkt.is_ip6 ? IP46_TYPE_IP6 : IP46_TYPE_IP4,
54  p5t->l4.proto, p5t->pkt.l4_valid,
55  p5t->l4.port[0], p5t->l4.port[1],
56  p5t->pkt.tcp_flags_valid ? "valid": "invalid",
57  p5t->pkt.tcp_flags,
58  p5t->pkt.flags_reserved);
59 }
60 
61 u8 *
62 format_acl_plugin_5tuple (u8 * s, va_list * args)
63 {
64  return format_fa_5tuple(s, args);
65 }
66 
67 /* packet trace format function */
68 static u8 *
69 format_acl_fa_trace (u8 * s, va_list * args)
70 {
71  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
72  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
73  acl_fa_trace_t *t = va_arg (*args, acl_fa_trace_t *);
74 
75  s =
76  format (s,
77  "acl-plugin: sw_if_index %d, next index %d, action: %d, match: acl %d rule %d trace_bits %08x\n"
78  " pkt info %016llx %016llx %016llx %016llx %016llx %016llx",
81  t->packet_info[0], t->packet_info[1], t->packet_info[2],
82  t->packet_info[3], t->packet_info[4], t->packet_info[5]);
83 
84  /* Now also print out the packet_info in a form usable by humans */
85  s = format (s, "\n %U", format_fa_5tuple, t->packet_info);
86  return s;
87 }
88 
89 /* *INDENT-OFF* */
90 #define foreach_acl_fa_error \
91 _(ACL_DROP, "ACL deny packets") \
92 _(ACL_PERMIT, "ACL permit packets") \
93 _(ACL_NEW_SESSION, "new sessions added") \
94 _(ACL_EXIST_SESSION, "existing session packets") \
95 _(ACL_CHECK, "checked packets") \
96 _(ACL_RESTART_SESSION_TIMER, "restart session timer") \
97 _(ACL_TOO_MANY_SESSIONS, "too many sessions to add new") \
98 /* end of errors */
99 
100 typedef enum
101 {
102 #define _(sym,str) ACL_FA_ERROR_##sym,
104 #undef _
107 
108 static char *acl_fa_error_strings[] = {
109 #define _(sym,string) string,
111 #undef _
112 };
113 /* *INDENT-ON* */
114 
115 static void *
117 {
118  u8 *p = vlib_buffer_get_current (b0) + offset;
119  return p;
120 }
121 
122 
123 static int
124 fa_acl_match_addr (ip46_address_t * addr1, ip46_address_t * addr2,
125  int prefixlen, int is_ip6)
126 {
127  if (prefixlen == 0)
128  {
129  /* match any always succeeds */
130  return 1;
131  }
132  if (is_ip6)
133  {
134  if (memcmp (addr1, addr2, prefixlen / 8))
135  {
136  /* If the starting full bytes do not match, no point in bittwidling the thumbs further */
137  return 0;
138  }
139  if (prefixlen % 8)
140  {
141  u8 b1 = *((u8 *) addr1 + 1 + prefixlen / 8);
142  u8 b2 = *((u8 *) addr2 + 1 + prefixlen / 8);
143  u8 mask0 = (0xff - ((1 << (8 - (prefixlen % 8))) - 1));
144  return (b1 & mask0) == b2;
145  }
146  else
147  {
148  /* The prefix fits into integer number of bytes, so nothing left to do */
149  return 1;
150  }
151  }
152  else
153  {
154  uint32_t a1 = ntohl (addr1->ip4.as_u32);
155  uint32_t a2 = ntohl (addr2->ip4.as_u32);
156  uint32_t mask0 = 0xffffffff - ((1 << (32 - prefixlen)) - 1);
157  return (a1 & mask0) == a2;
158  }
159 }
160 
161 static int
162 fa_acl_match_port (u16 port, u16 port_first, u16 port_last, int is_ip6)
163 {
164  return ((port >= port_first) && (port <= port_last));
165 }
166 
167 int
168 single_acl_match_5tuple (acl_main_t * am, u32 acl_index, fa_5tuple_t * pkt_5tuple,
169  int is_ip6, u8 * r_action, u32 * r_acl_match_p,
170  u32 * r_rule_match_p, u32 * trace_bitmap)
171 {
172  int i;
173  acl_list_t *a;
174  acl_rule_t *r;
175 
176  if (pool_is_free_index (am->acls, acl_index))
177  {
178  if (r_acl_match_p)
179  *r_acl_match_p = acl_index;
180  if (r_rule_match_p)
181  *r_rule_match_p = -1;
182  /* the ACL does not exist but is used for policy. Block traffic. */
183  return 0;
184  }
185  a = am->acls + acl_index;
186  for (i = 0; i < a->count; i++)
187  {
188  r = a->rules + i;
189  if (is_ip6 != r->is_ipv6)
190  {
191  continue;
192  }
193  if (!fa_acl_match_addr
194  (&pkt_5tuple->addr[1], &r->dst, r->dst_prefixlen, is_ip6))
195  continue;
196 
197 #ifdef FA_NODE_VERBOSE_DEBUG
199  ("ACL_FA_NODE_DBG acl %d rule %d pkt dst addr %U match rule addr %U/%d",
200  acl_index, i, format_ip46_address, &pkt_5tuple->addr[1],
202  &r->dst, r->is_ipv6 ? IP46_TYPE_IP6: IP46_TYPE_IP4,
203  r->dst_prefixlen);
204 #endif
205 
206  if (!fa_acl_match_addr
207  (&pkt_5tuple->addr[0], &r->src, r->src_prefixlen, is_ip6))
208  continue;
209 
210 #ifdef FA_NODE_VERBOSE_DEBUG
212  ("ACL_FA_NODE_DBG acl %d rule %d pkt src addr %U match rule addr %U/%d",
213  acl_index, i, format_ip46_address, &pkt_5tuple->addr[0],
214  r->is_ipv6 ? IP46_TYPE_IP6: IP46_TYPE_IP4, format_ip46_address,
215  &r->src, r->is_ipv6 ? IP46_TYPE_IP6: IP46_TYPE_IP4,
216  r->src_prefixlen);
218  ("ACL_FA_NODE_DBG acl %d rule %d trying to match pkt proto %d with rule %d",
219  acl_index, i, pkt_5tuple->l4.proto, r->proto);
220 #endif
221  if (r->proto)
222  {
223  if (pkt_5tuple->l4.proto != r->proto)
224  continue;
225 
226  if (PREDICT_FALSE (pkt_5tuple->pkt.is_nonfirst_fragment &&
228  {
229  /* non-initial fragment with frag match configured - match this rule */
230  *trace_bitmap |= 0x80000000;
231  *r_action = r->is_permit;
232  if (r_acl_match_p)
233  *r_acl_match_p = acl_index;
234  if (r_rule_match_p)
235  *r_rule_match_p = i;
236  return 1;
237  }
238 
239  /* A sanity check just to ensure we are about to match the ports extracted from the packet */
240  if (PREDICT_FALSE (!pkt_5tuple->pkt.l4_valid))
241  continue;
242 
243 #ifdef FA_NODE_VERBOSE_DEBUG
245  ("ACL_FA_NODE_DBG acl %d rule %d pkt proto %d match rule %d",
246  acl_index, i, pkt_5tuple->l4.proto, r->proto);
247 #endif
248 
249  if (!fa_acl_match_port
250  (pkt_5tuple->l4.port[0], r->src_port_or_type_first,
251  r->src_port_or_type_last, is_ip6))
252  continue;
253 
254 #ifdef FA_NODE_VERBOSE_DEBUG
256  ("ACL_FA_NODE_DBG acl %d rule %d pkt sport %d match rule [%d..%d]",
257  acl_index, i, pkt_5tuple->l4.port[0], r->src_port_or_type_first,
259 #endif
260 
261  if (!fa_acl_match_port
262  (pkt_5tuple->l4.port[1], r->dst_port_or_code_first,
263  r->dst_port_or_code_last, is_ip6))
264  continue;
265 
266 #ifdef FA_NODE_VERBOSE_DEBUG
268  ("ACL_FA_NODE_DBG acl %d rule %d pkt dport %d match rule [%d..%d]",
269  acl_index, i, pkt_5tuple->l4.port[1], r->dst_port_or_code_first,
271 #endif
272  if (pkt_5tuple->pkt.tcp_flags_valid
273  && ((pkt_5tuple->pkt.tcp_flags & r->tcp_flags_mask) !=
274  r->tcp_flags_value))
275  continue;
276  }
277  /* everything matches! */
278 #ifdef FA_NODE_VERBOSE_DEBUG
279  clib_warning ("ACL_FA_NODE_DBG acl %d rule %d FULL-MATCH, action %d",
280  acl_index, i, r->is_permit);
281 #endif
282  *r_action = r->is_permit;
283  if (r_acl_match_p)
284  *r_acl_match_p = acl_index;
285  if (r_rule_match_p)
286  *r_rule_match_p = i;
287  return 1;
288  }
289  return 0;
290 }
291 
292 static u8
293 linear_multi_acl_match_5tuple (u32 sw_if_index, fa_5tuple_t * pkt_5tuple, int is_l2,
294  int is_ip6, int is_input, u32 * acl_match_p,
295  u32 * rule_match_p, u32 * trace_bitmap)
296 {
297  acl_main_t *am = &acl_main;
298  int i;
299  u32 *acl_vector;
300  u8 action = 0;
301 
302  if (is_input)
303  {
304  vec_validate (am->input_acl_vec_by_sw_if_index, sw_if_index);
305  acl_vector = am->input_acl_vec_by_sw_if_index[sw_if_index];
306  }
307  else
308  {
309  vec_validate (am->output_acl_vec_by_sw_if_index, sw_if_index);
310  acl_vector = am->output_acl_vec_by_sw_if_index[sw_if_index];
311  }
312  for (i = 0; i < vec_len (acl_vector); i++)
313  {
314 #ifdef FA_NODE_VERBOSE_DEBUG
315  clib_warning ("ACL_FA_NODE_DBG: Trying to match ACL: %d",
316  acl_vector[i]);
317 #endif
319  (am, acl_vector[i], pkt_5tuple, is_ip6, &action,
320  acl_match_p, rule_match_p, trace_bitmap))
321  {
322  return action;
323  }
324  }
325  if (vec_len (acl_vector) > 0)
326  {
327  /* If there are ACLs and none matched, deny by default */
328  return 0;
329  }
330 #ifdef FA_NODE_VERBOSE_DEBUG
331  clib_warning ("ACL_FA_NODE_DBG: No ACL on sw_if_index %d", sw_if_index);
332 #endif
333  /* Deny by default. If there are no ACLs defined we should not be here. */
334  return 0;
335 }
336 
337 static u8
338 multi_acl_match_5tuple (u32 sw_if_index, fa_5tuple_t * pkt_5tuple, int is_l2,
339  int is_ip6, int is_input, u32 * acl_match_p,
340  u32 * rule_match_p, u32 * trace_bitmap)
341 {
342  acl_main_t *am = &acl_main;
343  if (am->use_hash_acl_matching) {
344  return hash_multi_acl_match_5tuple(sw_if_index, pkt_5tuple, is_l2, is_ip6,
345  is_input, acl_match_p, rule_match_p, trace_bitmap);
346  } else {
347  return linear_multi_acl_match_5tuple(sw_if_index, pkt_5tuple, is_l2, is_ip6,
348  is_input, acl_match_p, rule_match_p, trace_bitmap);
349  }
350 }
351 
352 static int
354 {
355  /* For the purposes of this code, "within" means we have at least 8 bytes after it */
356  return (offset <= (b0->current_length - 8));
357 }
358 
359 static void
360 acl_fill_5tuple (acl_main_t * am, vlib_buffer_t * b0, int is_ip6,
361  int is_input, int is_l2_path, fa_5tuple_t * p5tuple_pkt)
362 {
363  int l3_offset;
364  int l4_offset;
365  u16 ports[2];
366  u16 proto;
367 
368  /* IP4 and IP6 protocol numbers of ICMP */
369  static u8 icmp_protos[] = { IP_PROTOCOL_ICMP, IP_PROTOCOL_ICMP6 };
370 
371  if (is_l2_path)
372  {
373  l3_offset = ethernet_buffer_header_size(b0);
374  }
375  else
376  {
377  if (is_input)
378  l3_offset = 0;
379  else
380  l3_offset = vnet_buffer(b0)->ip.save_rewrite_length;
381  }
382 
383  /* key[0..3] contains src/dst address and is cleared/set below */
384  /* Remainder of the key and per-packet non-key data */
385  p5tuple_pkt->kv.key[4] = 0;
386  p5tuple_pkt->kv.value = 0;
387 
388  if (is_ip6)
389  {
390  clib_memcpy (&p5tuple_pkt->addr,
391  get_ptr_to_offset (b0,
392  offsetof (ip6_header_t,
393  src_address) + l3_offset),
394  sizeof (p5tuple_pkt->addr));
395  proto =
396  *(u8 *) get_ptr_to_offset (b0,
397  offsetof (ip6_header_t,
398  protocol) + l3_offset);
399  l4_offset = l3_offset + sizeof (ip6_header_t);
400 #ifdef FA_NODE_VERBOSE_DEBUG
401  clib_warning ("ACL_FA_NODE_DBG: proto: %d, l4_offset: %d", proto,
402  l4_offset);
403 #endif
404  /* IP6 EH handling is here, increment l4_offset if needs to, update the proto */
405  int need_skip_eh = clib_bitmap_get (am->fa_ipv6_known_eh_bitmap, proto);
406  if (PREDICT_FALSE (need_skip_eh))
407  {
408  while (need_skip_eh && offset_within_packet (b0, l4_offset))
409  {
410  /* Fragment header needs special handling */
411  if (PREDICT_FALSE(ACL_EH_FRAGMENT == proto))
412  {
413  proto = *(u8 *) get_ptr_to_offset (b0, l4_offset);
414  u16 frag_offset;
415  clib_memcpy (&frag_offset, get_ptr_to_offset (b0, 2 + l4_offset), sizeof(frag_offset));
416  frag_offset = ntohs(frag_offset) >> 3;
417  if (frag_offset)
418  {
419  p5tuple_pkt->pkt.is_nonfirst_fragment = 1;
420  /* invalidate L4 offset so we don't try to find L4 info */
421  l4_offset += b0->current_length;
422  }
423  else
424  {
425  /* First fragment: skip the frag header and move on. */
426  l4_offset += 8;
427  }
428  }
429  else
430  {
431  u8 nwords = *(u8 *) get_ptr_to_offset (b0, 1 + l4_offset);
432  proto = *(u8 *) get_ptr_to_offset (b0, l4_offset);
433  l4_offset += 8 * (1 + (u16) nwords);
434  }
435 #ifdef FA_NODE_VERBOSE_DEBUG
436  clib_warning ("ACL_FA_NODE_DBG: new proto: %d, new offset: %d",
437  proto, l4_offset);
438 #endif
439  need_skip_eh =
441  }
442  }
443  }
444  else
445  {
446  p5tuple_pkt->kv.key[0] = 0;
447  p5tuple_pkt->kv.key[1] = 0;
448  p5tuple_pkt->kv.key[2] = 0;
449  p5tuple_pkt->kv.key[3] = 0;
450  clib_memcpy (&p5tuple_pkt->addr[0].ip4,
451  get_ptr_to_offset (b0,
452  offsetof (ip4_header_t,
453  src_address) + l3_offset),
454  sizeof (p5tuple_pkt->addr[0].ip4));
455  clib_memcpy (&p5tuple_pkt->addr[1].ip4,
456  get_ptr_to_offset (b0,
457  offsetof (ip4_header_t,
458  dst_address) + l3_offset),
459  sizeof (p5tuple_pkt->addr[1].ip4));
460  proto =
461  *(u8 *) get_ptr_to_offset (b0,
462  offsetof (ip4_header_t,
463  protocol) + l3_offset);
464  l4_offset = l3_offset + sizeof (ip4_header_t);
465  u16 flags_and_fragment_offset;
466  clib_memcpy (&flags_and_fragment_offset,
467  get_ptr_to_offset (b0,
468  offsetof (ip4_header_t,
469  flags_and_fragment_offset)) + l3_offset,
470  sizeof(flags_and_fragment_offset));
471  flags_and_fragment_offset = ntohs (flags_and_fragment_offset);
472 
473  /* non-initial fragments have non-zero offset */
474  if ((PREDICT_FALSE(0xfff & flags_and_fragment_offset)))
475  {
476  p5tuple_pkt->pkt.is_nonfirst_fragment = 1;
477  /* invalidate L4 offset so we don't try to find L4 info */
478  l4_offset += b0->current_length;
479  }
480 
481  }
482  p5tuple_pkt->l4.proto = proto;
483  if (PREDICT_TRUE (offset_within_packet (b0, l4_offset)))
484  {
485  p5tuple_pkt->pkt.l4_valid = 1;
486  if (icmp_protos[is_ip6] == proto)
487  {
488  /* type */
489  p5tuple_pkt->l4.port[0] =
490  *(u8 *) get_ptr_to_offset (b0,
491  l4_offset + offsetof (icmp46_header_t,
492  type));
493  /* code */
494  p5tuple_pkt->l4.port[1] =
495  *(u8 *) get_ptr_to_offset (b0,
496  l4_offset + offsetof (icmp46_header_t,
497  code));
498  }
499  else if ((IPPROTO_TCP == proto) || (IPPROTO_UDP == proto))
500  {
501  clib_memcpy (&ports,
502  get_ptr_to_offset (b0,
503  l4_offset + offsetof (tcp_header_t,
504  src_port)),
505  sizeof (ports));
506  p5tuple_pkt->l4.port[0] = ntohs (ports[0]);
507  p5tuple_pkt->l4.port[1] = ntohs (ports[1]);
508 
509  p5tuple_pkt->pkt.tcp_flags =
510  *(u8 *) get_ptr_to_offset (b0,
511  l4_offset + offsetof (tcp_header_t,
512  flags));
513  p5tuple_pkt->pkt.tcp_flags_valid = (proto == IPPROTO_TCP);
514  }
515  /*
516  * FIXME: rather than the above conditional, here could
517  * be a nice generic mechanism to extract two L4 values:
518  *
519  * have a per-protocol array of 4 elements like this:
520  * u8 offset; to take the byte from, off L4 header
521  * u8 mask; to mask it with, before storing
522  *
523  * this way we can describe UDP, TCP and ICMP[46] semantics,
524  * and add a sort of FPM-type behavior for other protocols.
525  *
526  * Of course, is it faster ? and is it needed ?
527  *
528  */
529  }
530 }
531 
532 
533 /* Session keys match the packets received, and mirror the packets sent */
534 static void
535 acl_make_5tuple_session_key (int is_input, fa_5tuple_t * p5tuple_pkt,
536  fa_5tuple_t * p5tuple_sess)
537 {
538  int src_index = is_input ? 0 : 1;
539  int dst_index = is_input ? 1 : 0;
540  p5tuple_sess->addr[src_index] = p5tuple_pkt->addr[0];
541  p5tuple_sess->addr[dst_index] = p5tuple_pkt->addr[1];
542  p5tuple_sess->l4.as_u64 = p5tuple_pkt->l4.as_u64;
543  p5tuple_sess->l4.port[src_index] = p5tuple_pkt->l4.port[0];
544  p5tuple_sess->l4.port[dst_index] = p5tuple_pkt->l4.port[1];
545 }
546 
547 
548 static int
549 acl_fa_ifc_has_sessions (acl_main_t * am, int sw_if_index0)
550 {
552 }
553 
554 static int
555 acl_fa_ifc_has_in_acl (acl_main_t * am, int sw_if_index0)
556 {
557  int it_has = clib_bitmap_get (am->fa_in_acl_on_sw_if_index, sw_if_index0);
558  return it_has;
559 }
560 
561 static int
562 acl_fa_ifc_has_out_acl (acl_main_t * am, int sw_if_index0)
563 {
564  int it_has = clib_bitmap_get (am->fa_out_acl_on_sw_if_index, sw_if_index0);
565  return it_has;
566 }
567 
568 
569 static int
571 {
572  /* seen both SYNs and ACKs but not FINs means we are in establshed state */
573  u16 masked_flags =
576  switch (sess->info.l4.proto)
577  {
578  case IPPROTO_TCP:
579  if (((TCP_FLAGS_ACKSYN << 8) + TCP_FLAGS_ACKSYN) == masked_flags)
580  {
581  return ACL_TIMEOUT_TCP_IDLE;
582  }
583  else
584  {
586  }
587  break;
588  case IPPROTO_UDP:
589  return ACL_TIMEOUT_UDP_IDLE;
590  break;
591  default:
592  return ACL_TIMEOUT_UDP_IDLE;
593  }
594 }
595 
596 
597 static u64
599 {
600  int timeout_type;
601  u64 timeout = ~0LL;
602  for(timeout_type = 0; timeout_type < ACL_N_TIMEOUTS; timeout_type++) {
603  if (timeout > am->session_timeout_sec[timeout_type]) {
604  timeout = am->session_timeout_sec[timeout_type];
605  }
606  }
607  return timeout;
608 }
609 
610 /*
611  * Get the timeout of the session in a list since its enqueue time.
612  */
613 
614 static u64
616 {
617  u64 timeout = am->vlib_main->clib_time.clocks_per_second;
618  /*
619  * we have the shortest possible timeout type in all the lists
620  * (see README-multicore for the rationale)
621  */
622  timeout *= fa_session_get_shortest_timeout(am);
623  return timeout;
624 }
625 
626 /*
627  * Get the idle timeout of a session.
628  */
629 
630 static u64
632 {
633  u64 timeout = am->vlib_main->clib_time.clocks_per_second;
634  int timeout_type = fa_session_get_timeout_type (am, sess);
635  timeout *= am->session_timeout_sec[timeout_type];
636  return timeout;
637 }
638 
639 static void
641 {
643  u16 wk;
644  /* Allocate the per-worker sessions pools */
645  for (wk = 0; wk < vec_len (am->per_worker_data); wk++) {
648  }
649 
650  /* ... and the interface session hash table */
652  "ACL plugin FA session bihash",
656  }
657 }
658 
659 static inline fa_session_t *get_session_ptr(acl_main_t *am, u16 thread_index, u32 session_index)
660 {
661  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
662  fa_session_t *sess = pool_is_free_index (pw->fa_sessions_pool, session_index) ? 0 : pool_elt_at_index(pw->fa_sessions_pool, session_index);
663  return sess;
664 }
665 
666 static inline int is_valid_session_ptr(acl_main_t *am, u16 thread_index, fa_session_t *sess)
667 {
668  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
669  return ((sess != 0) && ((sess - pw->fa_sessions_pool) < pool_len(pw->fa_sessions_pool)));
670 }
671 
672 static void
674 {
675  fa_session_t *sess = get_session_ptr(am, sess_id.thread_index, sess_id.session_index);
676  u8 list_id = fa_session_get_timeout_type(am, sess);
677  uword thread_index = os_get_thread_index ();
678  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
679  /* the retrieved session thread index must be necessarily the same as the one in the key */
680  ASSERT (sess->thread_index == sess_id.thread_index);
681  /* the retrieved session thread index must be the same as current thread */
682  ASSERT (sess->thread_index == thread_index);
683  sess->link_enqueue_time = now;
684  sess->link_list_id = list_id;
685  sess->link_next_idx = ~0;
686  sess->link_prev_idx = pw->fa_conn_list_tail[list_id];
687  if (~0 != pw->fa_conn_list_tail[list_id]) {
688  fa_session_t *prev_sess = get_session_ptr(am, thread_index, pw->fa_conn_list_tail[list_id]);
689  prev_sess->link_next_idx = sess_id.session_index;
690  /* We should never try to link with a session on another thread */
691  ASSERT(prev_sess->thread_index == sess->thread_index);
692  }
693  pw->fa_conn_list_tail[list_id] = sess_id.session_index;
695 
696  if (~0 == pw->fa_conn_list_head[list_id]) {
697  pw->fa_conn_list_head[list_id] = sess_id.session_index;
698  }
699 }
700 
701 static int
703 {
704  uword thread_index = os_get_thread_index ();
705  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
706  if (thread_index != sess_id.thread_index) {
707  /* If another thread attempts to delete the session, fail it. */
708 #ifdef FA_NODE_VERBOSE_DEBUG
709  clib_warning("thread id in key %d != curr thread index, not deleting");
710 #endif
711  return 0;
712  }
713  fa_session_t *sess = get_session_ptr(am, sess_id.thread_index, sess_id.session_index);
714  /* we should never try to delete the session with another thread index */
715  ASSERT(sess->thread_index == thread_index);
716  if (~0 != sess->link_prev_idx) {
717  fa_session_t *prev_sess = get_session_ptr(am, thread_index, sess->link_prev_idx);
718  /* the previous session must be in the same list as this one */
719  ASSERT(prev_sess->link_list_id == sess->link_list_id);
720  prev_sess->link_next_idx = sess->link_next_idx;
721  }
722  if (~0 != sess->link_next_idx) {
723  fa_session_t *next_sess = get_session_ptr(am, thread_index, sess->link_next_idx);
724  /* The next session must be in the same list as the one we are deleting */
725  ASSERT(next_sess->link_list_id == sess->link_list_id);
726  next_sess->link_prev_idx = sess->link_prev_idx;
727  }
728  if (pw->fa_conn_list_head[sess->link_list_id] == sess_id.session_index) {
729  pw->fa_conn_list_head[sess->link_list_id] = sess->link_next_idx;
730  }
731  if (pw->fa_conn_list_tail[sess->link_list_id] == sess_id.session_index) {
732  pw->fa_conn_list_tail[sess->link_list_id] = sess->link_prev_idx;
733  }
734  return 1;
735 }
736 
737 static int
739 {
740  if (acl_fa_conn_list_delete_session(am, sess_id)) {
741  acl_fa_conn_list_add_session(am, sess_id, now);
742  return 1;
743  } else {
744  /*
745  * Our thread does not own this connection, so we can not delete
746  * The session. To avoid the complicated signaling, we simply
747  * pick the list waiting time to be the shortest of the timeouts.
748  * This way we do not have to do anything special, and let
749  * the regular requeue check take care of everything.
750  */
751  return 0;
752  }
753 }
754 
755 
756 static u8
757 acl_fa_track_session (acl_main_t * am, int is_input, u32 sw_if_index, u64 now,
758  fa_session_t * sess, fa_5tuple_t * pkt_5tuple)
759 {
760  sess->last_active_time = now;
761  if (pkt_5tuple->pkt.tcp_flags_valid)
762  {
763  sess->tcp_flags_seen.as_u8[is_input] |= pkt_5tuple->pkt.tcp_flags;
764  }
765  return 3;
766 }
767 
768 
769 static void
771 {
772  void *oldheap = clib_mem_set_heap(am->acl_mheap);
773  fa_session_t *sess = get_session_ptr(am, sess_id.thread_index, sess_id.session_index);
776  &sess->info.kv, 0);
779  /* Deleting from timer structures not needed,
780  as the caller must have dealt with the timers. */
781  vec_validate (pw->fa_session_dels_by_sw_if_index, sw_if_index);
782  clib_mem_set_heap (oldheap);
783  pw->fa_session_dels_by_sw_if_index[sw_if_index]++;
785 }
786 
787 static int
788 acl_fa_can_add_session (acl_main_t * am, int is_input, u32 sw_if_index)
789 {
790  u64 curr_sess_count;
791  curr_sess_count = am->fa_session_total_adds - am->fa_session_total_dels;
792  return (curr_sess_count < am->fa_conn_table_max_entries);
793 }
794 
795 static u64
796 acl_fa_get_list_head_expiry_time(acl_main_t *am, acl_fa_per_worker_data_t *pw, u64 now, u16 thread_index, int timeout_type)
797 {
798  fa_session_t *sess = get_session_ptr(am, thread_index, pw->fa_conn_list_head[timeout_type]);
799  /*
800  * We can not check just the index here because inbetween the worker thread might
801  * dequeue the connection from the head just as we are about to check it.
802  */
803  if (!is_valid_session_ptr(am, thread_index, sess)) {
804  return ~0LL; // infinity.
805  } else {
806  u64 timeout_time =
808  return timeout_time;
809  }
810 }
811 
812 static int
813 acl_fa_conn_time_to_check (acl_main_t *am, acl_fa_per_worker_data_t *pw, u64 now, u16 thread_index, u32 session_index)
814 {
815  fa_session_t *sess = get_session_ptr(am, thread_index, session_index);
816  u64 timeout_time =
818  return (timeout_time < now) || (sess->link_enqueue_time <= pw->swipe_end_time);
819 }
820 
821 /*
822  * see if there are sessions ready to be checked,
823  * do the maintenance (requeue or delete), and
824  * return the total number of sessions reclaimed.
825  */
826 static int
828 {
829  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
831  fsid.thread_index = thread_index;
832  int total_expired = 0;
833 
834  {
835  u8 tt = 0;
836  for(tt = 0; tt < ACL_N_TIMEOUTS; tt++) {
838  && (~0 != pw->fa_conn_list_head[tt])
839  && (acl_fa_conn_time_to_check(am, pw, now, thread_index,
840  pw->fa_conn_list_head[tt]))) {
841  fsid.session_index = pw->fa_conn_list_head[tt];
842  vec_add1(pw->expired, fsid.session_index);
844  }
845  }
846  }
847 
848  u32 *psid = NULL;
849  vec_foreach (psid, pw->expired)
850  {
851  fsid.session_index = *psid;
853  {
854  fa_session_t *sess = get_session_ptr(am, thread_index, fsid.session_index);
855  u32 sw_if_index = sess->sw_if_index;
856  u64 sess_timeout_time =
857  sess->last_active_time + fa_session_get_timeout (am, sess);
858  if ((now < sess_timeout_time) && (0 == clib_bitmap_get(pw->pending_clear_sw_if_index_bitmap, sw_if_index)))
859  {
860 #ifdef FA_NODE_VERBOSE_DEBUG
861  clib_warning ("ACL_FA_NODE_CLEAN: Restarting timer for session %d",
862  (int) session_index);
863 #endif
864  /* There was activity on the session, so the idle timeout
865  has not passed. Enqueue for another time period. */
866 
867  acl_fa_conn_list_add_session(am, fsid, now);
869  }
870  else
871  {
872 #ifdef FA_NODE_VERBOSE_DEBUG
873  clib_warning ("ACL_FA_NODE_CLEAN: Deleting session %d",
874  (int) session_index);
875 #endif
876  acl_fa_delete_session (am, sw_if_index, fsid);
877  pw->cnt_deleted_sessions++;
878  }
879  }
880  else
881  {
883  }
884  }
885  total_expired = vec_len(pw->expired);
886  /* zero out the vector which we have acted on */
887  if (pw->expired)
888  _vec_len (pw->expired) = 0;
889  /* if we were advancing and reached the end
890  * (no more sessions to recycle), reset the fast-forward timestamp */
891 
892  if (pw->swipe_end_time && 0 == total_expired)
893  pw->swipe_end_time = 0;
894  return (total_expired);
895 }
896 
897 always_inline void
898 acl_fa_try_recycle_session (acl_main_t * am, int is_input, u16 thread_index, u32 sw_if_index)
899 {
900  /* try to recycle a TCP transient session */
901  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
902  u8 timeout_type = ACL_TIMEOUT_TCP_TRANSIENT;
903  fa_full_session_id_t sess_id;
904  sess_id.session_index = pw->fa_conn_list_head[timeout_type];
905  if (~0 != sess_id.session_index) {
906  sess_id.thread_index = thread_index;
907  acl_fa_conn_list_delete_session(am, sess_id);
908  acl_fa_delete_session(am, sw_if_index, sess_id);
909  }
910 }
911 
912 static fa_session_t *
913 acl_fa_add_session (acl_main_t * am, int is_input, u32 sw_if_index, u64 now,
914  fa_5tuple_t * p5tuple)
915 {
916  clib_bihash_kv_40_8_t *pkv = &p5tuple->kv;
918  fa_full_session_id_t f_sess_id;
919  uword thread_index = os_get_thread_index();
920  void *oldheap = clib_mem_set_heap(am->acl_mheap);
921  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
922 
923  f_sess_id.thread_index = thread_index;
924  fa_session_t *sess;
925 
927  f_sess_id.session_index = sess - pw->fa_sessions_pool;
928 
929  kv.key[0] = pkv->key[0];
930  kv.key[1] = pkv->key[1];
931  kv.key[2] = pkv->key[2];
932  kv.key[3] = pkv->key[3];
933  kv.key[4] = pkv->key[4];
934  kv.value = f_sess_id.as_u64;
935 
936  memcpy (sess, pkv, sizeof (pkv->key));
937  sess->last_active_time = now;
938  sess->sw_if_index = sw_if_index;
939  sess->tcp_flags_seen.as_u16 = 0;
940  sess->thread_index = thread_index;
941  sess->link_list_id = ~0;
942  sess->link_prev_idx = ~0;
943  sess->link_next_idx = ~0;
944 
945 
946 
949  &kv, 1);
950  acl_fa_conn_list_add_session(am, f_sess_id, now);
951 
952  vec_validate (pw->fa_session_adds_by_sw_if_index, sw_if_index);
953  clib_mem_set_heap (oldheap);
954  pw->fa_session_adds_by_sw_if_index[sw_if_index]++;
956  return sess;
957 }
958 
959 static int
960 acl_fa_find_session (acl_main_t * am, u32 sw_if_index0, fa_5tuple_t * p5tuple,
961  clib_bihash_kv_40_8_t * pvalue_sess)
962 {
963  return (BV (clib_bihash_search)
964  (&am->fa_sessions_hash, &p5tuple->kv,
965  pvalue_sess) == 0);
966 }
967 
968 
971  vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip6,
972  int is_input, int is_l2_path, u32 * l2_feat_next_node_index,
973  vlib_node_registration_t * acl_fa_node)
974 {
975  u32 n_left_from, *from, *to_next;
976  acl_fa_next_t next_index;
977  u32 pkts_acl_checked = 0;
978  u32 pkts_new_session = 0;
979  u32 pkts_exist_session = 0;
980  u32 pkts_acl_permit = 0;
981  u32 pkts_restart_session_timer = 0;
982  u32 trace_bitmap = 0;
983  acl_main_t *am = &acl_main;
984  fa_5tuple_t fa_5tuple, kv_sess;
985  clib_bihash_kv_40_8_t value_sess;
986  vlib_node_runtime_t *error_node;
987  u64 now = clib_cpu_time_now ();
988  uword thread_index = os_get_thread_index ();
989 
990  from = vlib_frame_vector_args (frame);
991  n_left_from = frame->n_vectors;
992  next_index = node->cached_next_index;
993 
994  error_node = vlib_node_get_runtime (vm, acl_fa_node->index);
995 
996  while (n_left_from > 0)
997  {
998  u32 n_left_to_next;
999 
1000  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
1001 
1002  while (n_left_from > 0 && n_left_to_next > 0)
1003  {
1004  u32 bi0;
1005  vlib_buffer_t *b0;
1006  u32 next0 = 0;
1007  u8 action = 0;
1008  u32 sw_if_index0;
1009  int acl_check_needed = 1;
1010  u32 match_acl_in_index = ~0;
1011  u32 match_rule_index = ~0;
1012  u8 error0 = 0;
1013 
1014  /* speculatively enqueue b0 to the current next frame */
1015  bi0 = from[0];
1016  to_next[0] = bi0;
1017  from += 1;
1018  to_next += 1;
1019  n_left_from -= 1;
1020  n_left_to_next -= 1;
1021 
1022  b0 = vlib_get_buffer (vm, bi0);
1023 
1024  if (is_input)
1025  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
1026  else
1027  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX];
1028 
1029  /*
1030  * Extract the L3/L4 matching info into a 5-tuple structure,
1031  * then create a session key whose layout is independent on forward or reverse
1032  * direction of the packet.
1033  */
1034 
1035  acl_fill_5tuple (am, b0, is_ip6, is_input, is_l2_path, &fa_5tuple);
1036  fa_5tuple.l4.lsb_of_sw_if_index = sw_if_index0 & 0xffff;
1037  acl_make_5tuple_session_key (is_input, &fa_5tuple, &kv_sess);
1038  fa_5tuple.pkt.sw_if_index = sw_if_index0;
1039  fa_5tuple.pkt.is_ip6 = is_ip6;
1040  fa_5tuple.pkt.is_input = is_input;
1041  fa_5tuple.pkt.mask_type_index_lsb = ~0;
1042 #ifdef FA_NODE_VERBOSE_DEBUG
1043  clib_warning
1044  ("ACL_FA_NODE_DBG: session 5-tuple %016llx %016llx %016llx %016llx %016llx : %016llx",
1045  kv_sess.kv.key[0], kv_sess.kv.key[1], kv_sess.kv.key[2],
1046  kv_sess.kv.key[3], kv_sess.kv.key[4], kv_sess.kv.value);
1047  clib_warning
1048  ("ACL_FA_NODE_DBG: packet 5-tuple %016llx %016llx %016llx %016llx %016llx : %016llx",
1049  fa_5tuple.kv.key[0], fa_5tuple.kv.key[1], fa_5tuple.kv.key[2],
1050  fa_5tuple.kv.key[3], fa_5tuple.kv.key[4], fa_5tuple.kv.value);
1051 #endif
1052 
1053  /* Try to match an existing session first */
1054 
1055  if (acl_fa_ifc_has_sessions (am, sw_if_index0))
1056  {
1058  (am, sw_if_index0, &kv_sess, &value_sess))
1059  {
1060  trace_bitmap |= 0x80000000;
1061  error0 = ACL_FA_ERROR_ACL_EXIST_SESSION;
1062  fa_full_session_id_t f_sess_id;
1063 
1064  f_sess_id.as_u64 = value_sess.value;
1065  ASSERT(f_sess_id.thread_index < vec_len(vlib_mains));
1066 
1067  fa_session_t *sess = get_session_ptr(am, f_sess_id.thread_index, f_sess_id.session_index);
1068  int old_timeout_type =
1069  fa_session_get_timeout_type (am, sess);
1070  action =
1071  acl_fa_track_session (am, is_input, sw_if_index0, now,
1072  sess, &fa_5tuple);
1073  /* expose the session id to the tracer */
1074  match_rule_index = f_sess_id.session_index;
1075  int new_timeout_type =
1076  fa_session_get_timeout_type (am, sess);
1077  acl_check_needed = 0;
1078  pkts_exist_session += 1;
1079  /* Tracking might have changed the session timeout type, e.g. from transient to established */
1080  if (PREDICT_FALSE (old_timeout_type != new_timeout_type))
1081  {
1082  acl_fa_restart_timer_for_session (am, now, f_sess_id);
1083  pkts_restart_session_timer++;
1084  trace_bitmap |=
1085  0x00010000 + ((0xff & old_timeout_type) << 8) +
1086  (0xff & new_timeout_type);
1087  }
1088  /*
1089  * I estimate the likelihood to be very low - the VPP needs
1090  * to have >64K interfaces to start with and then on
1091  * exactly 64K indices apart needs to be exactly the same
1092  * 5-tuple... Anyway, since this probability is nonzero -
1093  * print an error and drop the unlucky packet.
1094  * If this shows up in real world, we would need to bump
1095  * the hash key length.
1096  */
1097  if (PREDICT_FALSE(sess->sw_if_index != sw_if_index0)) {
1098  clib_warning("BUG: session LSB16(sw_if_index) and 5-tuple collision!");
1099  acl_check_needed = 0;
1100  action = 0;
1101  }
1102  }
1103  }
1104 
1105  if (acl_check_needed)
1106  {
1107  action =
1108  multi_acl_match_5tuple (sw_if_index0, &fa_5tuple, is_l2_path,
1109  is_ip6, is_input, &match_acl_in_index,
1110  &match_rule_index, &trace_bitmap);
1111  error0 = action;
1112  if (1 == action)
1113  pkts_acl_permit += 1;
1114  if (2 == action)
1115  {
1116  if (!acl_fa_can_add_session (am, is_input, sw_if_index0))
1117  acl_fa_try_recycle_session (am, is_input, thread_index, sw_if_index0);
1118 
1119  if (acl_fa_can_add_session (am, is_input, sw_if_index0))
1120  {
1121  fa_session_t *sess = acl_fa_add_session (am, is_input, sw_if_index0, now,
1122  &kv_sess);
1123  acl_fa_track_session (am, is_input, sw_if_index0, now,
1124  sess, &fa_5tuple);
1125  pkts_new_session += 1;
1126  }
1127  else
1128  {
1129  action = 0;
1130  error0 = ACL_FA_ERROR_ACL_TOO_MANY_SESSIONS;
1131  }
1132  }
1133  }
1134 
1135 
1136 
1137  if (action > 0)
1138  {
1139  if (is_l2_path)
1140  next0 = vnet_l2_feature_next (b0, l2_feat_next_node_index, 0);
1141  else
1142  vnet_feature_next (sw_if_index0, &next0, b0);
1143  }
1144 
1146  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
1147  {
1148  acl_fa_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t));
1149  t->sw_if_index = sw_if_index0;
1150  t->next_index = next0;
1151  t->match_acl_in_index = match_acl_in_index;
1152  t->match_rule_index = match_rule_index;
1153  t->packet_info[0] = fa_5tuple.kv.key[0];
1154  t->packet_info[1] = fa_5tuple.kv.key[1];
1155  t->packet_info[2] = fa_5tuple.kv.key[2];
1156  t->packet_info[3] = fa_5tuple.kv.key[3];
1157  t->packet_info[4] = fa_5tuple.kv.key[4];
1158  t->packet_info[5] = fa_5tuple.kv.value;
1159  t->action = action;
1160  t->trace_bitmap = trace_bitmap;
1161  }
1162 
1163  next0 = next0 < node->n_next_nodes ? next0 : 0;
1164  if (0 == next0)
1165  b0->error = error_node->errors[error0];
1166 
1167  pkts_acl_checked += 1;
1168 
1169  /* verify speculative enqueue, maybe switch current next frame */
1170  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
1171  to_next, n_left_to_next, bi0,
1172  next0);
1173  }
1174 
1175  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
1176  }
1177 
1178  vlib_node_increment_counter (vm, acl_fa_node->index,
1179  ACL_FA_ERROR_ACL_CHECK, pkts_acl_checked);
1180  vlib_node_increment_counter (vm, acl_fa_node->index,
1181  ACL_FA_ERROR_ACL_PERMIT, pkts_acl_permit);
1182  vlib_node_increment_counter (vm, acl_fa_node->index,
1183  ACL_FA_ERROR_ACL_NEW_SESSION,
1184  pkts_new_session);
1185  vlib_node_increment_counter (vm, acl_fa_node->index,
1186  ACL_FA_ERROR_ACL_EXIST_SESSION,
1187  pkts_exist_session);
1188  vlib_node_increment_counter (vm, acl_fa_node->index,
1189  ACL_FA_ERROR_ACL_RESTART_SESSION_TIMER,
1190  pkts_restart_session_timer);
1191  return frame->n_vectors;
1192 }
1193 
1194 
1196 static uword
1198  vlib_node_runtime_t * node, vlib_frame_t * frame)
1199 {
1200  acl_main_t *am = &acl_main;
1201  return acl_fa_node_fn (vm, node, frame, 1, 1, 1,
1204 }
1205 
1207 static uword
1209  vlib_node_runtime_t * node, vlib_frame_t * frame)
1210 {
1211  acl_main_t *am = &acl_main;
1212  return acl_fa_node_fn (vm, node, frame, 0, 1, 1,
1215 }
1216 
1218 static uword
1220  vlib_node_runtime_t * node, vlib_frame_t * frame)
1221 {
1222  acl_main_t *am = &acl_main;
1223  return acl_fa_node_fn (vm, node, frame, 1, 0, 1,
1226 }
1227 
1229 static uword
1231  vlib_node_runtime_t * node, vlib_frame_t * frame)
1232 {
1233  acl_main_t *am = &acl_main;
1234  return acl_fa_node_fn (vm, node, frame, 0, 0, 1,
1237 }
1238 
1239 
1240 /**** L3 processing path nodes ****/
1241 
1242 
1244 static uword
1246  vlib_node_runtime_t * node, vlib_frame_t * frame)
1247 {
1248  return acl_fa_node_fn (vm, node, frame, 1, 1, 0, 0, &acl_in_fa_ip6_node);
1249 }
1250 
1252 static uword
1254  vlib_node_runtime_t * node, vlib_frame_t * frame)
1255 {
1256  return acl_fa_node_fn (vm, node, frame, 0, 1, 0, 0, &acl_in_fa_ip4_node);
1257 }
1258 
1260 static uword
1262  vlib_node_runtime_t * node, vlib_frame_t * frame)
1263 {
1264  return acl_fa_node_fn (vm, node, frame, 1, 0, 0, 0, &acl_out_fa_ip6_node);
1265 }
1266 
1268 static uword
1270  vlib_node_runtime_t * node, vlib_frame_t * frame)
1271 {
1272  return acl_fa_node_fn (vm, node, frame, 0, 0, 0, 0, &acl_out_fa_ip4_node);
1273 }
1274 
1275 /*
1276  * This process ensures the connection cleanup happens every so often
1277  * even in absence of traffic, as well as provides general orchestration
1278  * for requests like connection deletion on a given sw_if_index.
1279  */
1280 
1281 
1282 /* *INDENT-OFF* */
1283 #define foreach_acl_fa_cleaner_error \
1284 _(UNKNOWN_EVENT, "unknown event received") \
1285 /* end of errors */
1286 
1287 typedef enum
1288 {
1289 #define _(sym,str) ACL_FA_CLEANER_ERROR_##sym,
1291 #undef _
1294 
1296 #define _(sym,string) string,
1298 #undef _
1299 };
1300 
1301 /* *INDENT-ON* */
1302 
1305 
1306 /*
1307  * Per-worker thread interrupt-driven cleaner thread
1308  * to clean idle connections if there are no packets
1309  */
1310 static uword
1313 {
1314  acl_main_t *am = &acl_main;
1315  u64 now = clib_cpu_time_now ();
1316  u16 thread_index = os_get_thread_index ();
1317  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
1318  int num_expired;
1319 #ifdef FA_NODE_VERBOSE_DEBUG
1320  clib_warning("\nacl_fa_worker_conn_cleaner: thread index %d now %lu\n\n", thread_index, now);
1321 #endif
1322  /* allow another interrupt to be queued */
1323  pw->interrupt_is_pending = 0;
1324  if (pw->clear_in_process) {
1325  if (0 == pw->swipe_end_time) {
1326  /*
1327  * Someone has just set the flag to start clearing.
1328  * we do this by combing through the connections up to a "time T"
1329  * which is now, and requeueing everything except the expired
1330  * connections and those matching the interface(s) being cleared.
1331  */
1332 
1333  /*
1334  * first filter the sw_if_index bitmap that they want from us, by
1335  * a bitmap of sw_if_index for which we actually have connections.
1336  */
1337  if ((pw->pending_clear_sw_if_index_bitmap == 0)
1338  || (pw->serviced_sw_if_index_bitmap == 0)) {
1339 #ifdef FA_NODE_VERBOSE_DEBUG
1340  clib_warning("WORKER-CLEAR: someone tried to call clear, but one of the bitmaps are empty");
1341 #endif
1343  } else {
1344 #ifdef FA_NODE_VERBOSE_DEBUG
1345  clib_warning("WORKER-CLEAR: (before and) swiping sw-if-index bitmap: %U, my serviced bitmap %U",
1348 #endif
1351  }
1352 
1354  /* if the cross-section is a zero vector, no need to do anything. */
1355 #ifdef FA_NODE_VERBOSE_DEBUG
1356  clib_warning("WORKER: clearing done - nothing to do");
1357 #endif
1358  pw->clear_in_process = 0;
1359  } else {
1360 #ifdef FA_NODE_VERBOSE_DEBUG
1361  clib_warning("WORKER-CLEAR: swiping sw-if-index bitmap: %U, my serviced bitmap %U",
1364 #endif
1365  /* swipe through the connection lists until enqueue timestamps become above "now" */
1366  pw->swipe_end_time = now;
1367  }
1368  }
1369  }
1370  num_expired = acl_fa_check_idle_sessions(am, thread_index, now);
1371  // clib_warning("WORKER-CLEAR: checked %d sessions (clear_in_progress: %d)", num_expired, pw->clear_in_process);
1372  if (pw->clear_in_process) {
1373  if (0 == num_expired) {
1374  /* we were clearing but we could not process any more connections. time to stop. */
1376  pw->clear_in_process = 0;
1377 #ifdef FA_NODE_VERBOSE_DEBUG
1378  clib_warning("WORKER: clearing done, all done");
1379 #endif
1380  } else {
1381 #ifdef FA_NODE_VERBOSE_DEBUG
1382  clib_warning("WORKER-CLEAR: more work to do, raising interrupt");
1383 #endif
1384  /* should continue clearing.. So could they please sent an interrupt again? */
1385  pw->interrupt_is_needed = 1;
1386  }
1387  } else {
1388  if (num_expired >= am->fa_max_deleted_sessions_per_interval) {
1389  /* there was too much work, we should get an interrupt ASAP */
1390  pw->interrupt_is_needed = 1;
1391  pw->interrupt_is_unwanted = 0;
1392  } else if (num_expired <= am->fa_min_deleted_sessions_per_interval) {
1393  /* signal that they should trigger us less */
1394  pw->interrupt_is_needed = 0;
1395  pw->interrupt_is_unwanted = 1;
1396  } else {
1397  /* the current rate of interrupts is ok */
1398  pw->interrupt_is_needed = 0;
1399  pw->interrupt_is_unwanted = 0;
1400  }
1401  }
1403  return 0;
1404 }
1405 
1406 static void
1408 {
1409  acl_fa_per_worker_data_t *pw = &am->per_worker_data[thread_index];
1410  if (!pw->interrupt_is_pending) {
1411  pw->interrupt_is_pending = 1;
1414  /* if the interrupt was requested, mark that done. */
1415  /* pw->interrupt_is_needed = 0; */
1416  }
1417 }
1418 
1419 static void
1421 {
1422  int i;
1423  /* Can't use vec_len(am->per_worker_data) since the threads might not have come up yet; */
1424  int n_threads = vec_len(vlib_mains);
1425  for (i = n_threads > 1 ? 1 : 0; i < n_threads; i++) {
1426  send_one_worker_interrupt(vm, am, i);
1427  }
1428 }
1429 
1430 /* centralized process to drive per-worker cleaners */
1431 static uword
1433  vlib_frame_t * f)
1434 {
1435  acl_main_t *am = &acl_main;
1436  u64 now;
1437  f64 cpu_cps = vm->clib_time.clocks_per_second;
1438  u64 next_expire;
1439  /* We should check if there are connections to clean up - at least twice a second */
1440  u64 max_timer_wait_interval = cpu_cps / 2;
1441  uword event_type, *event_data = 0;
1443 
1444  am->fa_current_cleaner_timer_wait_interval = max_timer_wait_interval;
1446  am->fa_interrupt_generation = 1;
1447  while (1)
1448  {
1449  now = clib_cpu_time_now ();
1450  next_expire = now + am->fa_current_cleaner_timer_wait_interval;
1451  int has_pending_conns = 0;
1452  u16 ti;
1453  u8 tt;
1454 
1455  /*
1456  * walk over all per-thread list heads of different timeouts,
1457  * and see if there are any connections pending.
1458  * If there aren't - we do not need to wake up until the
1459  * worker code signals that it has added a connection.
1460  *
1461  * Also, while we are at it, calculate the earliest we need to wake up.
1462  */
1463  for(ti = 0; ti < vec_len(vlib_mains); ti++) {
1464  if (ti >= vec_len(am->per_worker_data)) {
1465  continue;
1466  }
1468  for(tt = 0; tt < vec_len(pw->fa_conn_list_head); tt++) {
1469  u64 head_expiry = acl_fa_get_list_head_expiry_time(am, pw, now, ti, tt);
1470  if ((head_expiry < next_expire) && !pw->interrupt_is_pending) {
1471 #ifdef FA_NODE_VERBOSE_DEBUG
1472  clib_warning("Head expiry: %lu, now: %lu, next_expire: %lu (worker: %d, tt: %d)", head_expiry, now, next_expire, ti, tt);
1473 #endif
1474  next_expire = head_expiry;
1475  }
1476  if (~0 != pw->fa_conn_list_head[tt]) {
1477  has_pending_conns = 1;
1478  }
1479  }
1480  }
1481 
1482  /* If no pending connections and no ACL applied then no point in timing out */
1483  if (!has_pending_conns && (0 == am->fa_total_enabled_count))
1484  {
1485  am->fa_cleaner_cnt_wait_without_timeout++;
1486  (void) vlib_process_wait_for_event (vm);
1487  event_type = vlib_process_get_events (vm, &event_data);
1488  }
1489  else
1490  {
1491  f64 timeout = ((i64) next_expire - (i64) now) / cpu_cps;
1492  if (timeout <= 0)
1493  {
1494  /* skip waiting altogether */
1495  event_type = ~0;
1496  }
1497  else
1498  {
1499  am->fa_cleaner_cnt_wait_with_timeout++;
1500  (void) vlib_process_wait_for_event_or_clock (vm, timeout);
1501  event_type = vlib_process_get_events (vm, &event_data);
1502  }
1503  }
1504 
1505  switch (event_type)
1506  {
1507  case ~0:
1508  /* nothing to do */
1509  break;
1511  /* Nothing to do. */
1512  break;
1514  {
1515  uword *clear_sw_if_index_bitmap = 0;
1516  uword *sw_if_index0;
1517  int clear_all = 0;
1518 #ifdef FA_NODE_VERBOSE_DEBUG
1519  clib_warning("ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX received");
1520 #endif
1521  vec_foreach (sw_if_index0, event_data)
1522  {
1523  am->fa_cleaner_cnt_delete_by_sw_index++;
1524 #ifdef FA_NODE_VERBOSE_DEBUG
1525  clib_warning
1526  ("ACL_FA_NODE_CLEAN: ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX: %d",
1527  *sw_if_index0);
1528 #endif
1529  if (*sw_if_index0 == ~0)
1530  {
1531  clear_all = 1;
1532  }
1533  else
1534  {
1535  if (!pool_is_free_index (am->vnet_main->interface_main.sw_interfaces, *sw_if_index0))
1536  {
1537  clear_sw_if_index_bitmap = clib_bitmap_set(clear_sw_if_index_bitmap, *sw_if_index0, 1);
1538  }
1539  }
1540  }
1541 #ifdef FA_NODE_VERBOSE_DEBUG
1542  clib_warning("ACL_FA_CLEANER_DELETE_BY_SW_IF_INDEX bitmap: %U", format_bitmap_hex, clear_sw_if_index_bitmap);
1543 #endif
1544  vec_foreach(pw0, am->per_worker_data) {
1546  while (pw0->clear_in_process) {
1548 #ifdef FA_NODE_VERBOSE_DEBUG
1549  clib_warning("ACL_FA_NODE_CLEAN: waiting previous cleaning cycle to finish on %d...", pw0 - am->per_worker_data);
1550 #endif
1551  vlib_process_suspend(vm, 0.0001);
1552  if (pw0->interrupt_is_needed) {
1553  send_one_worker_interrupt(vm, am, (pw0 - am->per_worker_data));
1554  }
1555  }
1556  if (pw0->clear_in_process) {
1557  clib_warning("ERROR-BUG! Could not initiate cleaning on worker because another cleanup in progress");
1558  } else {
1559  if (clear_all)
1560  {
1561  /* if we need to clear all, then just clear the interfaces that we are servicing */
1563  }
1564  else
1565  {
1566  pw0->pending_clear_sw_if_index_bitmap = clib_bitmap_dup(clear_sw_if_index_bitmap);
1567  }
1568  pw0->clear_in_process = 1;
1569  }
1570  }
1571  /* send some interrupts so they can start working */
1573 
1574  /* now wait till they all complete */
1575 #ifdef FA_NODE_VERBOSE_DEBUG
1576  clib_warning("CLEANER mains len: %d per-worker len: %d", vec_len(vlib_mains), vec_len(am->per_worker_data));
1577 #endif
1578  vec_foreach(pw0, am->per_worker_data) {
1580  while (pw0->clear_in_process) {
1582 #ifdef FA_NODE_VERBOSE_DEBUG
1583  clib_warning("ACL_FA_NODE_CLEAN: waiting for my cleaning cycle to finish on %d...", pw0 - am->per_worker_data);
1584 #endif
1585  vlib_process_suspend(vm, 0.0001);
1586  if (pw0->interrupt_is_needed) {
1587  send_one_worker_interrupt(vm, am, (pw0 - am->per_worker_data));
1588  }
1589  }
1590  }
1591 #ifdef FA_NODE_VERBOSE_DEBUG
1592  clib_warning("ACL_FA_NODE_CLEAN: cleaning done");
1593 #endif
1594  clib_bitmap_free(clear_sw_if_index_bitmap);
1595  }
1596  break;
1597  default:
1598 #ifdef FA_NODE_VERBOSE_DEBUG
1599  clib_warning ("ACL plugin connection cleaner: unknown event %u",
1600  event_type);
1601 #endif
1604  index,
1605  ACL_FA_CLEANER_ERROR_UNKNOWN_EVENT, 1);
1606  am->fa_cleaner_cnt_unknown_event++;
1607  break;
1608  }
1609 
1611 
1612  if (event_data)
1613  _vec_len (event_data) = 0;
1614 
1615  /*
1616  * If the interrupts were not processed yet, ensure we wait a bit,
1617  * but up to a point.
1618  */
1619  int need_more_wait = 0;
1620  int max_wait_cycles = 100;
1621  do {
1622  need_more_wait = 0;
1623  vec_foreach(pw0, am->per_worker_data) {
1625  need_more_wait = 1;
1626  }
1627  }
1628  if (need_more_wait) {
1629  vlib_process_suspend(vm, 0.0001);
1630  }
1631  } while (need_more_wait && (--max_wait_cycles > 0));
1632 
1633  int interrupts_needed = 0;
1634  int interrupts_unwanted = 0;
1635 
1636  vec_foreach(pw0, am->per_worker_data) {
1637  if (pw0->interrupt_is_needed) {
1638  interrupts_needed++;
1639  /* the per-worker value is reset when sending the interrupt */
1640  }
1641  if (pw0->interrupt_is_unwanted) {
1642  interrupts_unwanted++;
1643  pw0->interrupt_is_unwanted = 0;
1644  }
1645  }
1646  if (interrupts_needed) {
1647  /* they need more interrupts, do less waiting around next time */
1649  /* never go into zero-wait either though - we need to give the space to others */
1651  } else if (interrupts_unwanted) {
1652  /* slowly increase the amount of sleep up to a limit */
1653  if (am->fa_current_cleaner_timer_wait_interval < max_timer_wait_interval)
1655  }
1656  am->fa_cleaner_cnt_event_cycles++;
1658  }
1659  /* NOT REACHED */
1660  return 0;
1661 }
1662 
1663 
1664 void
1665 acl_fa_enable_disable (u32 sw_if_index, int is_input, int enable_disable)
1666 {
1667  acl_main_t *am = &acl_main;
1668  if (enable_disable) {
1670  am->fa_total_enabled_count++;
1671  void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
1674  clib_mem_set_heap (oldheap);
1675  } else {
1676  am->fa_total_enabled_count--;
1677  }
1678 
1679  if (is_input)
1680  {
1681  ASSERT(clib_bitmap_get(am->fa_in_acl_on_sw_if_index, sw_if_index) != enable_disable);
1682  void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
1683  vnet_feature_enable_disable ("ip4-unicast", "acl-plugin-in-ip4-fa",
1684  sw_if_index, enable_disable, 0, 0);
1685  vnet_feature_enable_disable ("ip6-unicast", "acl-plugin-in-ip6-fa",
1686  sw_if_index, enable_disable, 0, 0);
1687  clib_mem_set_heap (oldheap);
1689  clib_bitmap_set (am->fa_in_acl_on_sw_if_index, sw_if_index,
1690  enable_disable);
1691  }
1692  else
1693  {
1694  ASSERT(clib_bitmap_get(am->fa_out_acl_on_sw_if_index, sw_if_index) != enable_disable);
1695  void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
1696  vnet_feature_enable_disable ("ip4-output", "acl-plugin-out-ip4-fa",
1697  sw_if_index, enable_disable, 0, 0);
1698  vnet_feature_enable_disable ("ip6-output", "acl-plugin-out-ip6-fa",
1699  sw_if_index, enable_disable, 0, 0);
1700  clib_mem_set_heap (oldheap);
1702  clib_bitmap_set (am->fa_out_acl_on_sw_if_index, sw_if_index,
1703  enable_disable);
1704  }
1705  if ((!enable_disable) && (!acl_fa_ifc_has_in_acl (am, sw_if_index))
1706  && (!acl_fa_ifc_has_out_acl (am, sw_if_index)))
1707  {
1708 #ifdef FA_NODE_VERBOSE_DEBUG
1709  clib_warning("ENABLE-DISABLE: clean the connections on interface %d", sw_if_index);
1710 #endif
1711  void *oldheap = clib_mem_set_heap (am->vlib_main->heap_base);
1714  sw_if_index);
1715  clib_mem_set_heap (oldheap);
1716  }
1717 }
1718 
1719 void
1721 {
1722  acl_main_t *am = &acl_main;
1724  vlib_cli_output(vm, "\nSession lookup hash table:\n%U\n\n",
1725  BV (format_bihash), &am->fa_sessions_hash, verbose);
1726  } else {
1727  vlib_cli_output(vm, "\nSession lookup hash table is not allocated.\n\n");
1728  }
1729 }
1730 
1731 
1732 /* *INDENT-OFF* */
1733 
1736  .name = "acl-plugin-fa-worker-cleaner-process",
1737  .type = VLIB_NODE_TYPE_INPUT,
1738  .state = VLIB_NODE_STATE_INTERRUPT,
1739 };
1740 
1742  .function = acl_fa_session_cleaner_process,
1743  .type = VLIB_NODE_TYPE_PROCESS,
1744  .name = "acl-plugin-fa-cleaner-process",
1746  .error_strings = acl_fa_cleaner_error_strings,
1747  .n_next_nodes = 0,
1748  .next_nodes = {},
1749 };
1750 
1751 
1753 {
1754  .function = acl_in_ip6_l2_node_fn,
1755  .name = "acl-plugin-in-ip6-l2",
1756  .vector_size = sizeof (u32),
1757  .format_trace = format_acl_fa_trace,
1758  .type = VLIB_NODE_TYPE_INTERNAL,
1759  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1760  .error_strings = acl_fa_error_strings,
1761  .n_next_nodes = ACL_FA_N_NEXT,
1762  .next_nodes =
1763  {
1764  [ACL_FA_ERROR_DROP] = "error-drop",
1765  }
1766 };
1767 
1769 {
1770  .function = acl_in_ip4_l2_node_fn,
1771  .name = "acl-plugin-in-ip4-l2",
1772  .vector_size = sizeof (u32),
1773  .format_trace = format_acl_fa_trace,
1774  .type = VLIB_NODE_TYPE_INTERNAL,
1775  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1776  .error_strings = acl_fa_error_strings,
1777  .n_next_nodes = ACL_FA_N_NEXT,
1778  .next_nodes =
1779  {
1780  [ACL_FA_ERROR_DROP] = "error-drop",
1781  }
1782 };
1783 
1785 {
1786  .function = acl_out_ip6_l2_node_fn,
1787  .name = "acl-plugin-out-ip6-l2",
1788  .vector_size = sizeof (u32),
1789  .format_trace = format_acl_fa_trace,
1790  .type = VLIB_NODE_TYPE_INTERNAL,
1791  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1792  .error_strings = acl_fa_error_strings,
1793  .n_next_nodes = ACL_FA_N_NEXT,
1794  .next_nodes =
1795  {
1796  [ACL_FA_ERROR_DROP] = "error-drop",
1797  }
1798 };
1799 
1801 {
1802  .function = acl_out_ip4_l2_node_fn,
1803  .name = "acl-plugin-out-ip4-l2",
1804  .vector_size = sizeof (u32),
1805  .format_trace = format_acl_fa_trace,
1806  .type = VLIB_NODE_TYPE_INTERNAL,
1807  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1808  .error_strings = acl_fa_error_strings,
1809  .n_next_nodes = ACL_FA_N_NEXT,
1810  .next_nodes =
1811  {
1812  [ACL_FA_ERROR_DROP] = "error-drop",
1813  }
1814 };
1815 
1816 
1818 {
1819  .function = acl_in_ip6_fa_node_fn,
1820  .name = "acl-plugin-in-ip6-fa",
1821  .vector_size = sizeof (u32),
1822  .format_trace = format_acl_fa_trace,
1823  .type = VLIB_NODE_TYPE_INTERNAL,
1824  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1825  .error_strings = acl_fa_error_strings,
1826  .n_next_nodes = ACL_FA_N_NEXT,
1827  .next_nodes =
1828  {
1829  [ACL_FA_ERROR_DROP] = "error-drop",
1830  }
1831 };
1832 
1833 VNET_FEATURE_INIT (acl_in_ip6_fa_feature, static) =
1834 {
1835  .arc_name = "ip6-unicast",
1836  .node_name = "acl-plugin-in-ip6-fa",
1837  .runs_before = VNET_FEATURES ("ip6-flow-classify"),
1838 };
1839 
1841 {
1842  .function = acl_in_ip4_fa_node_fn,
1843  .name = "acl-plugin-in-ip4-fa",
1844  .vector_size = sizeof (u32),
1845  .format_trace = format_acl_fa_trace,
1846  .type = VLIB_NODE_TYPE_INTERNAL,
1847  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1848  .error_strings = acl_fa_error_strings,
1849  .n_next_nodes = ACL_FA_N_NEXT,
1850  .next_nodes =
1851  {
1852  [ACL_FA_ERROR_DROP] = "error-drop",
1853  }
1854 };
1855 
1856 VNET_FEATURE_INIT (acl_in_ip4_fa_feature, static) =
1857 {
1858  .arc_name = "ip4-unicast",
1859  .node_name = "acl-plugin-in-ip4-fa",
1860  .runs_before = VNET_FEATURES ("ip4-flow-classify"),
1861 };
1862 
1863 
1865 {
1866  .function = acl_out_ip6_fa_node_fn,
1867  .name = "acl-plugin-out-ip6-fa",
1868  .vector_size = sizeof (u32),
1869  .format_trace = format_acl_fa_trace,
1870  .type = VLIB_NODE_TYPE_INTERNAL,
1871  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1872  .error_strings = acl_fa_error_strings,
1873  .n_next_nodes = ACL_FA_N_NEXT,
1874  .next_nodes =
1875  {
1876  [ACL_FA_ERROR_DROP] = "error-drop",
1877  }
1878 };
1879 
1880 VNET_FEATURE_INIT (acl_out_ip6_fa_feature, static) =
1881 {
1882  .arc_name = "ip6-output",
1883  .node_name = "acl-plugin-out-ip6-fa",
1884  .runs_before = VNET_FEATURES ("interface-output"),
1885 };
1886 
1888 {
1889  .function = acl_out_ip4_fa_node_fn,
1890  .name = "acl-plugin-out-ip4-fa",
1891  .vector_size = sizeof (u32),
1892  .format_trace = format_acl_fa_trace,
1893  .type = VLIB_NODE_TYPE_INTERNAL,
1894  .n_errors = ARRAY_LEN (acl_fa_error_strings),
1895  .error_strings = acl_fa_error_strings,
1896  .n_next_nodes = ACL_FA_N_NEXT,
1897  /* edit / add dispositions here */
1898  .next_nodes =
1899  {
1900  [ACL_FA_ERROR_DROP] = "error-drop",
1901  }
1902 };
1903 
1904 VNET_FEATURE_INIT (acl_out_ip4_fa_feature, static) =
1905 {
1906  .arc_name = "ip4-output",
1907  .node_name = "acl-plugin-out-ip4-fa",
1908  .runs_before = VNET_FEATURES ("interface-output"),
1909 };
1910 
1911 
1912 /* *INDENT-ON* */
static uword acl_in_ip4_l2_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: fa_node.c:1208
acl_rule_t * rules
Definition: acl.h:107
static int acl_fa_restart_timer_for_session(acl_main_t *am, u64 now, fa_full_session_id_t sess_id)
Definition: fa_node.c:738
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
Definition: vec.h:432
static int acl_fa_ifc_has_in_acl(acl_main_t *am, int sw_if_index0)
Definition: fa_node.c:555
#define TCP_FLAGS_ACKSYN
Definition: fa_node.h:16
u32 fa_cleaner_node_index
Definition: acl.h:197
static void acl_fa_conn_list_add_session(acl_main_t *am, fa_full_session_id_t sess_id, u64 now)
Definition: fa_node.c:673
u32 session_timeout_sec[ACL_N_TIMEOUTS]
Definition: acl.h:199
static u8 * format_bitmap_hex(u8 *s, va_list *args)
Format a bitmap as a string of hex bytes.
Definition: bitmap.h:744
u32 fa_acl_in_ip4_l2_node_feat_next_node_index[32]
Definition: acl.h:212
static int acl_fa_can_add_session(acl_main_t *am, int is_input, u32 sw_if_index)
Definition: fa_node.c:788
static int is_valid_session_ptr(acl_main_t *am, u16 thread_index, fa_session_t *sess)
Definition: fa_node.c:666
static char * acl_fa_cleaner_error_strings[]
Definition: fa_node.c:1295
sll srl srl sll sra u16x4 i
Definition: vector_sse2.h:337
void show_fa_sessions_hash(vlib_main_t *vm, u32 verbose)
Definition: fa_node.c:1720
uword * fa_out_acl_on_sw_if_index
Definition: acl.h:192
#define CLIB_UNUSED(x)
Definition: clib.h:79
u8 is_ipv6
Definition: acl.h:76
uword * pending_clear_sw_if_index_bitmap
Definition: fa_node.h:134
static f64 vlib_process_wait_for_event_or_clock(vlib_main_t *vm, f64 dt)
Suspend a cooperative multi-tasking thread Waits for an event, or for the indicated number of seconds...
Definition: node_funcs.h:699
a
Definition: bitmap.h:516
u64 fa_current_cleaner_timer_wait_interval
Definition: acl.h:247
fa_session_l4_key_t l4
Definition: fa_node.h:49
static uword * vlib_process_wait_for_event(vlib_main_t *vm)
Definition: node_funcs.h:619
fa_packet_info_t pkt
Definition: fa_node.h:51
u32 ** input_acl_vec_by_sw_if_index
Definition: acl.h:157
vnet_interface_main_t interface_main
Definition: vnet.h:56
#define PREDICT_TRUE(x)
Definition: clib.h:106
union fa_session_t::@311 tcp_flags_seen
uword * fa_in_acl_on_sw_if_index
Definition: acl.h:191
static uword acl_fa_worker_conn_cleaner_process(vlib_main_t *vm, vlib_node_runtime_t *rt, vlib_frame_t *f)
Definition: fa_node.c:1311
int l4_match_nonfirst_fragment
Definition: acl.h:221
vlib_node_registration_t acl_out_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip6_node)
Definition: fa_node.c:1259
static void vlib_node_set_interrupt_pending(vlib_main_t *vm, u32 node_index)
Definition: node_funcs.h:196
static void send_interrupts_to_workers(vlib_main_t *vm, acl_main_t *am)
Definition: fa_node.c:1420
#define NULL
Definition: clib.h:55
static int fa_acl_match_port(u16 port, u16 port_first, u16 port_last, int is_ip6)
Definition: fa_node.c:162
static void acl_fa_verify_init_sessions(acl_main_t *am)
Definition: fa_node.c:640
f64 clocks_per_second
Definition: time.h:53
u8 dst_prefixlen
Definition: acl.h:80
vlib_node_registration_t acl_out_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip4_node)
Definition: fa_node.c:1228
#define ethernet_buffer_header_size(b)
Determine the size of the Ethernet headers of the current frame in the buffer.
Definition: ethernet.h:396
#define TCP_FLAGS_RSTFINACKSYN
Definition: fa_node.h:15
fa_5tuple_t info
Definition: fa_node.h:58
u32 count
Definition: acl.h:106
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:518
static u64 clib_cpu_time_now(void)
Definition: time.h:73
struct _vlib_node_registration vlib_node_registration_t
static int acl_fa_find_session(acl_main_t *am, u32 sw_if_index0, fa_5tuple_t *p5tuple, clib_bihash_kv_40_8_t *pvalue_sess)
Definition: fa_node.c:960
static uword acl_out_ip4_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: fa_node.c:1269
acl_main_t acl_main
Definition: jvpp_acl.h:39
static uword * clib_bitmap_set(uword *ai, uword i, uword value)
Sets the ith bit of a bitmap to new_value Removes trailing zeros from the bitmap. ...
Definition: bitmap.h:167
format_function_t format_ip46_address
Definition: format.h:61
fa_session_t * fa_sessions_pool
Definition: fa_node.h:108
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
#define foreach_acl_fa_error
Definition: fa_node.c:90
clib_time_t clib_time
Definition: main.h:62
u8 link_list_id
Definition: fa_node.h:69
static void acl_fa_try_recycle_session(acl_main_t *am, int is_input, u16 thread_index, u32 sw_if_index)
Definition: fa_node.c:898
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:415
int single_acl_match_5tuple(acl_main_t *am, u32 acl_index, fa_5tuple_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
Definition: fa_node.c:168
struct _tcp_header tcp_header_t
u32 next_index
Definition: fa_node.c:33
vlib_main_t ** vlib_mains
Definition: buffer.c:292
static u8 * format_acl_fa_trace(u8 *s, va_list *args)
Definition: fa_node.c:69
#define pool_len(p)
Number of elements in pool vector.
Definition: pool.h:140
static u32 vnet_l2_feature_next(vlib_buffer_t *b, u32 *next_nodes, u32 feat_bit)
Return the graph node index for the feature corresponding to the next set bit after clearing the curr...
Definition: feat_bitmap.h:94
static uword acl_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_input, int is_l2_path, u32 *l2_feat_next_node_index, vlib_node_registration_t *acl_fa_node)
Definition: fa_node.c:970
#define clib_bitmap_zero(v)
Clear a bitmap.
Definition: bitmap.h:102
#define clib_bitmap_dup(v)
Duplicate a bitmap.
Definition: bitmap.h:87
u32 fa_acl_out_ip4_l2_node_feat_next_node_index[32]
Definition: acl.h:214
f64 fa_cleaner_wait_time_increment
Definition: acl.h:245
static uword vlib_process_suspend(vlib_main_t *vm, f64 dt)
Suspend a vlib cooperative multi-tasking thread for a period of time.
Definition: node_funcs.h:448
static int acl_fa_check_idle_sessions(acl_main_t *am, u16 thread_index, u64 now)
Definition: fa_node.c:827
u16 lsb_of_sw_if_index
Definition: fa_node.h:42
uword fa_conn_table_hash_memory_size
Definition: acl.h:225
u16 dst_port_or_code_last
Definition: acl.h:85
u8 src_prefixlen
Definition: acl.h:78
#define clib_smp_atomic_add(addr, increment)
Definition: smp.h:46
u32 link_prev_idx
Definition: fa_node.h:67
vlib_node_registration_t acl_in_fa_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip6_node)
Definition: fa_node.c:1243
int clib_bihash_add_del(clib_bihash *h, clib_bihash_kv *add_v, int is_add)
Add or delete a (key,value) pair from a bi-hash table.
ip46_address_t addr[2]
Definition: fa_node.h:48
#define pool_alloc_aligned(P, N, A)
Allocate N more free elements to pool (general version).
Definition: pool.h:301
static uword vlib_process_get_events(vlib_main_t *vm, uword **data_vector)
Return the first event type which has occurred and a vector of per-event data of that type...
Definition: node_funcs.h:542
#define always_inline
Definition: clib.h:92
u32 trace_bitmap
Definition: fa_node.c:38
u64 fa_conn_table_max_entries
Definition: acl.h:226
static uword clib_bitmap_is_zero(uword *ai)
predicate function; is an entire bitmap empty?
Definition: bitmap.h:57
u32 sw_if_index
Definition: fa_node.c:34
vnet_main_t * vnet_main
Definition: acl.h:275
ip46_address_t src
Definition: acl.h:77
#define foreach_acl_fa_cleaner_error
Definition: fa_node.c:1283
static uword acl_in_ip6_l2_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: fa_node.c:1197
u8 is_permit
Definition: acl.h:75
unsigned long u64
Definition: types.h:89
static int acl_fa_conn_list_delete_session(acl_main_t *am, fa_full_session_id_t sess_id)
Definition: fa_node.c:702
static fa_session_t * get_session_ptr(acl_main_t *am, u16 thread_index, u32 session_index)
Definition: fa_node.c:659
clib_bihash_40_8_t fa_sessions_hash
Definition: acl.h:195
u32 fa_acl_out_ip6_l2_node_feat_next_node_index[32]
Definition: acl.h:215
ip46_address_t dst
Definition: acl.h:79
static fa_session_t * acl_fa_add_session(acl_main_t *am, int is_input, u32 sw_if_index, u64 now, fa_5tuple_t *p5tuple)
Definition: fa_node.c:913
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:459
u16 current_length
Nbytes between current data and the end of this buffer.
Definition: buffer.h:72
static void vlib_process_signal_event(vlib_main_t *vm, uword node_index, uword type_opaque, uword data)
Definition: node_funcs.h:950
u16 dst_port_or_code_first
Definition: acl.h:84
static void acl_fill_5tuple(acl_main_t *am, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_t *p5tuple_pkt)
Definition: fa_node.c:360
static uword acl_out_ip6_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: fa_node.c:1261
uword * fa_ipv6_known_eh_bitmap
Definition: acl.h:218
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:195
static u64 fa_session_get_list_timeout(acl_main_t *am, fa_session_t *sess)
Definition: fa_node.c:615
static uword acl_out_ip6_l2_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: fa_node.c:1219
clib_bihash_kv_40_8_t kv
Definition: fa_node.h:53
static int fa_session_get_timeout_type(acl_main_t *am, fa_session_t *sess)
Definition: fa_node.c:570
#define PREDICT_FALSE(x)
Definition: clib.h:105
static int acl_fa_ifc_has_out_acl(acl_main_t *am, int sw_if_index0)
Definition: fa_node.c:562
static_always_inline void vnet_feature_next(u32 sw_if_index, u32 *next0, vlib_buffer_t *b0)
Definition: feature.h:221
u64 last_active_time
Definition: fa_node.h:59
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:364
u32 fa_total_enabled_count
Definition: acl.h:165
u8 proto
Definition: acl.h:81
long i64
Definition: types.h:82
void clib_bihash_init(clib_bihash *h, char *name, u32 nbuckets, uword memory_size)
initialize a bounded index extensible hash table
u8 hash_multi_acl_match_5tuple(u32 sw_if_index, fa_5tuple_t *pkt_5tuple, int is_l2, int is_ip6, int is_input, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
Definition: hash_lookup.c:870
u64 * fa_session_adds_by_sw_if_index
Definition: fa_node.h:114
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:113
u16 src_port_or_type_first
Definition: acl.h:82
u64 * fa_session_dels_by_sw_if_index
Definition: fa_node.h:113
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1158
#define pool_get_aligned(P, E, A)
Allocate an object E from a pool P (general version).
Definition: pool.h:188
static uword acl_in_ip6_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: fa_node.c:1245
u32 match_rule_index
Definition: fa_node.c:36
u16 n_vectors
Definition: node.h:344
vlib_main_t * vm
Definition: buffer.c:283
static int offset_within_packet(vlib_buffer_t *b0, int offset)
Definition: fa_node.c:353
u64 fa_session_total_adds
Definition: acl.h:201
void * heap_base
Definition: main.h:103
u64 packet_info[6]
Definition: fa_node.c:37
u8 * format_acl_plugin_5tuple(u8 *s, va_list *args)
Definition: fa_node.c:62
static void * clib_mem_set_heap(void *heap)
Definition: mem.h:226
static int acl_fa_conn_time_to_check(acl_main_t *am, acl_fa_per_worker_data_t *pw, u64 now, u16 thread_index, u32 session_index)
Definition: fa_node.c:813
#define clib_warning(format, args...)
Definition: error.h:59
#define VLIB_BUFFER_IS_TRACED
Definition: buffer.h:93
static vlib_node_runtime_t * vlib_node_get_runtime(vlib_main_t *vm, u32 node_index)
Get node runtime by node index.
Definition: node_funcs.h:89
acl_fa_next_t
Definition: fa_node.h:157
Definition: acl.h:73
#define clib_memcpy(a, b, c)
Definition: string.h:75
u32 sw_if_index
Definition: fa_node.h:60
int use_hash_acl_matching
Definition: acl.h:168
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
Definition: pool.h:268
#define ARRAY_LEN(x)
Definition: clib.h:59
static u8 multi_acl_match_5tuple(u32 sw_if_index, fa_5tuple_t *pkt_5tuple, int is_l2, int is_ip6, int is_input, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
Definition: fa_node.c:338
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:454
static uword clib_bitmap_get(uword *ai, uword i)
Gets the ith bit value from a bitmap.
Definition: bitmap.h:197
void acl_fa_enable_disable(u32 sw_if_index, int is_input, int enable_disable)
Definition: fa_node.c:1665
static vlib_node_registration_t acl_fa_session_cleaner_process_node
(constructor) VLIB_REGISTER_NODE (acl_fa_session_cleaner_process_node)
Definition: fa_node.c:1303
acl_fa_error_t
Definition: fa_node.c:100
VNET_FEATURE_INIT(acl_in_ip6_fa_feature, static)
u8 as_u8[2]
Definition: fa_node.h:62
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
Definition: node.h:456
#define pool_put_index(p, i)
Free pool element with given index.
Definition: pool.h:294
#define ASSERT(truth)
acl_fa_cleaner_error_t
Definition: fa_node.c:1287
static uword acl_out_ip4_l2_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: fa_node.c:1230
unsigned int u32
Definition: types.h:88
static u64 fa_session_get_timeout(acl_main_t *am, fa_session_t *sess)
Definition: fa_node.c:631
static u64 acl_fa_get_list_head_expiry_time(acl_main_t *am, acl_fa_per_worker_data_t *pw, u64 now, u16 thread_index, int timeout_type)
Definition: fa_node.c:796
int clib_bihash_search(clib_bihash *h, clib_bihash_kv *search_v, clib_bihash_kv *return_v)
Search a bi-hash table.
u8 tcp_flags_valid
Definition: fa_node.h:28
static int acl_fa_ifc_has_sessions(acl_main_t *am, int sw_if_index0)
Definition: fa_node.c:549
u16 src_port_or_type_last
Definition: acl.h:83
static u8 acl_fa_track_session(acl_main_t *am, int is_input, u32 sw_if_index, u64 now, fa_session_t *sess, fa_5tuple_t *pkt_5tuple)
Definition: fa_node.c:757
static void * get_ptr_to_offset(vlib_buffer_t *b0, int offset)
Definition: fa_node.c:116
static uword acl_in_ip4_fa_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: fa_node.c:1253
static uword acl_fa_session_cleaner_process(vlib_main_t *vm, vlib_node_runtime_t *rt, vlib_frame_t *f)
Definition: fa_node.c:1432
#define clib_bitmap_free(v)
Free a bitmap.
Definition: bitmap.h:92
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:259
vlib_node_registration_t acl_in_l2_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip4_node)
Definition: fa_node.c:1206
uword * serviced_sw_if_index_bitmap
Definition: fa_node.h:132
vlib_node_registration_t acl_in_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_in_l2_ip6_node)
Definition: fa_node.c:1195
#define VNET_FEATURES(...)
Definition: feature.h:368
u32 fa_acl_in_ip6_l2_node_feat_next_node_index[32]
Definition: acl.h:213
u32 link_next_idx
Definition: fa_node.h:68
u64 uword
Definition: types.h:112
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
template key/value backing page structure
Definition: bihash_doc.h:44
u16 as_u16
Definition: fa_node.h:63
u8 is_nonfirst_fragment
Definition: fa_node.h:31
Definition: defs.h:47
unsigned short u16
Definition: types.h:57
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
double f64
Definition: types.h:142
unsigned char u8
Definition: types.h:56
u8 tcp_flags_mask
Definition: acl.h:87
acl_fa_per_worker_data_t * per_worker_data
Definition: acl.h:252
vnet_sw_interface_t * sw_interfaces
Definition: interface.h:663
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:267
int fa_interrupt_generation
Definition: acl.h:249
static_always_inline uword os_get_thread_index(void)
Definition: os.h:62
u64 fa_max_deleted_sessions_per_interval
Definition: acl.h:234
void * acl_mheap
Definition: acl.h:133
static void acl_make_5tuple_session_key(int is_input, fa_5tuple_t *p5tuple_pkt, fa_5tuple_t *p5tuple_sess)
Definition: fa_node.c:535
u16 thread_index
Definition: fa_node.h:64
struct clib_bihash_value offset
template key/value backing page structure
vlib_node_registration_t acl_out_l2_ip6_node
(constructor) VLIB_REGISTER_NODE (acl_out_l2_ip6_node)
Definition: fa_node.c:1217
static char * acl_fa_error_strings[]
Definition: fa_node.c:108
#define vnet_buffer(b)
Definition: buffer.h:326
u8 tcp_flags_value
Definition: acl.h:86
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:143
vlib_node_registration_t acl_out_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_out_fa_ip4_node)
Definition: fa_node.c:1267
#define vec_foreach(var, vec)
Vector iterator.
u16 flags
Copy of main node flags.
Definition: node.h:450
#define CLIB_MEMORY_BARRIER()
Definition: clib.h:109
u16 mask_type_index_lsb
Definition: fa_node.h:26
static int fa_acl_match_addr(ip46_address_t *addr1, ip46_address_t *addr2, int prefixlen, int is_ip6)
Definition: fa_node.c:124
u32 flags
Definition: vhost-user.h:77
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:67
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:75
u32 match_acl_in_index
Definition: fa_node.c:35
static u8 * format_fa_5tuple(u8 *s, va_list *args)
Definition: fa_node.c:43
static u64 fa_session_get_shortest_timeout(acl_main_t *am)
Definition: fa_node.c:598
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
Definition: cli.c:680
int fa_sessions_hash_is_initialized
Definition: acl.h:194
static vlib_node_registration_t acl_fa_worker_session_cleaner_process_node
(constructor) VLIB_REGISTER_NODE (acl_fa_worker_session_cleaner_process_node)
Definition: fa_node.c:1304
static uword * clib_bitmap_and(uword *ai, uword *bi)
Logical operator across two bitmaps.
acl_list_t * acls
Definition: acl.h:139
static u8 linear_multi_acl_match_5tuple(u32 sw_if_index, fa_5tuple_t *pkt_5tuple, int is_l2, int is_ip6, int is_input, u32 *acl_match_p, u32 *rule_match_p, u32 *trace_bitmap)
Definition: fa_node.c:293
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:57
u32 ** output_acl_vec_by_sw_if_index
Definition: acl.h:158
static void send_one_worker_interrupt(vlib_main_t *vm, acl_main_t *am, int thread_index)
Definition: fa_node.c:1407
vlib_node_registration_t acl_in_fa_ip4_node
(constructor) VLIB_REGISTER_NODE (acl_in_fa_ip4_node)
Definition: fa_node.c:1251
u64 link_enqueue_time
Definition: fa_node.h:66
Definition: defs.h:46
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
Definition: feature.c:229
u32 fa_conn_table_hash_num_buckets
Definition: acl.h:224
u64 fa_session_total_dels
Definition: acl.h:202
static void acl_fa_delete_session(acl_main_t *am, u32 sw_if_index, fa_full_session_id_t sess_id)
Definition: fa_node.c:770
foreach_fa_cleaner_counter vlib_main_t * vlib_main
Definition: acl.h:274