FD.io VPP  v18.07-34-g55fbdb9
Vector Packet Processing
gbp_policy.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <plugins/gbp/gbp.h>
17 
18 /**
19  * Grouping of global data for the GBP source EPG classification feature
20  */
21 typedef struct gbp_policy_main_t_
22 {
23  /**
24  * Next nodes for L2 output features
25  */
28 
30 
31 #define foreach_gbp_policy \
32  _(DENY, "deny")
33 
34 typedef enum
35 {
36 #define _(sym,str) GBP_ERROR_##sym,
38 #undef _
41 
42 static char *gbp_policy_error_strings[] = {
43 #define _(sym,string) string,
45 #undef _
46 };
47 
48 typedef enum
49 {
50 #define _(sym,str) GBP_POLICY_NEXT_##sym,
52 #undef _
55 
56 /**
57  * per-packet trace data
58  */
59 typedef struct gbp_policy_trace_t_
60 {
61  /* per-pkt trace data */
66 
67 static uword
69  vlib_node_runtime_t * node, vlib_frame_t * frame)
70 {
71  gbp_main_t *gm = &gbp_main;
73  u32 n_left_from, *from, *to_next;
74  u32 next_index;
75 
76  next_index = 0;
77  n_left_from = frame->n_vectors;
78  from = vlib_frame_vector_args (frame);
79 
80  while (n_left_from > 0)
81  {
82  u32 n_left_to_next;
83 
84  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
85 
86  while (n_left_from > 0 && n_left_to_next > 0)
87  {
88  gbp_policy_next_t next0;
89  gbp_contract_key_t key0;
90  gbp_contract_value_t value0 = {
91  .as_u64 = ~0,
92  };
93  u32 bi0, sw_if_index0;
94  vlib_buffer_t *b0;
95 
96  next0 = GBP_POLICY_NEXT_DENY;
97  bi0 = from[0];
98  to_next[0] = bi0;
99  from += 1;
100  to_next += 1;
101  n_left_from -= 1;
102  n_left_to_next -= 1;
103 
104  b0 = vlib_get_buffer (vm, bi0);
105 
106  /*
107  * determine the src and dst EPG
108  */
109  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX];
110  key0.gck_dst = gbp_port_to_epg (sw_if_index0);
111  key0.gck_src = vnet_buffer2 (b0)->gbp.src_epg;
112 
113  if (~0 != key0.gck_src)
114  {
115  if (PREDICT_FALSE (key0.gck_src == key0.gck_dst))
116  {
117  /*
118  * intra-epg allowed
119  */
120  next0 = vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
121  L2OUTPUT_FEAT_GBP_POLICY);
122  }
123  else
124  {
125  value0.as_u64 = gbp_acl_lookup (&key0);
126 
127  if (~0 != value0.gc_lc_index)
128  {
129  fa_5tuple_opaque_t pkt_5tuple0;
130  u8 action0 = 0;
131  u32 acl_pos_p0, acl_match_p0;
132  u32 rule_match_p0, trace_bitmap0;
133  u8 *h0, l2_len0;
134  u16 ether_type0;
135  u8 is_ip60 = 0;
136 
137  l2_len0 = vnet_buffer (b0)->l2.l2_len;
138  h0 = vlib_buffer_get_current (b0);
139 
140  ether_type0 =
141  clib_net_to_host_u16 (*(u16 *) (h0 + l2_len0 - 2));
142 
143  is_ip60 = (ether_type0 == ETHERNET_TYPE_IP6) ? 1 : 0;
144  /*
145  * tests against the ACL
146  */
149  value0.gc_lc_index, b0,
150  is_ip60,
151  /* is_input */ 0,
152  /* is_l2_path */ 1,
153  &pkt_5tuple0);
156  value0.gc_lc_index,
157  &pkt_5tuple0, is_ip60,
158  &action0, &acl_pos_p0,
159  &acl_match_p0,
160  &rule_match_p0,
161  &trace_bitmap0);
162 
163  if (action0 > 0)
164  next0 =
166  L2OUTPUT_FEAT_GBP_POLICY);
167  }
168  }
169  }
170  else
171  {
172  /*
173  * the src EPG is not set when the packet arrives on an EPG
174  * uplink interface and we do not need to apply policy
175  */
176  next0 = vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
177  L2OUTPUT_FEAT_GBP_POLICY);
178  }
179 
180  if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED)))
181  {
182  gbp_policy_trace_t *t =
183  vlib_add_trace (vm, node, b0, sizeof (*t));
184  t->src_epg = key0.gck_src;
185  t->dst_epg = key0.gck_dst;
186  t->acl_index = value0.gc_acl_index;
187  }
188 
189  /* verify speculative enqueue, maybe switch current next frame */
190  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
191  to_next, n_left_to_next,
192  bi0, next0);
193  }
194 
195  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
196  }
197 
198  return frame->n_vectors;
199 }
200 
201 /* packet trace format function */
202 static u8 *
203 format_gbp_policy_trace (u8 * s, va_list * args)
204 {
205  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
206  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
207  gbp_policy_trace_t *t = va_arg (*args, gbp_policy_trace_t *);
208 
209  s =
210  format (s, "src:%d, dst:%d, acl:%d", t->src_epg, t->dst_epg,
211  t->acl_index);
212 
213  return s;
214 }
215 
216 /* *INDENT-OFF* */
218  .function = gbp_policy,
219  .name = "gbp-policy",
220  .vector_size = sizeof (u32),
221  .format_trace = format_gbp_policy_trace,
222  .type = VLIB_NODE_TYPE_INTERNAL,
223 
224  .n_errors = ARRAY_LEN(gbp_policy_error_strings),
225  .error_strings = gbp_policy_error_strings,
226 
227  .n_next_nodes = GBP_POLICY_N_NEXT,
228 
229  .next_nodes = {
230  [GBP_POLICY_NEXT_DENY] = "error-drop",
231  },
232 };
233 
235 
236 /* *INDENT-ON* */
237 
238 static clib_error_t *
240 {
242  clib_error_t *error = 0;
243 
244  /* Initialize the feature next-node indexes */
246  gbp_policy_node.index,
249  gpm->l2_output_feat_next);
250 
251  return error;
252 }
253 
255 
256 /*
257  * fd.io coding-style-patch-verification: ON
258  *
259  * Local Variables:
260  * eval: (c-set-style "gnu")
261  * End:
262  */
#define CLIB_UNUSED(x)
Definition: clib.h:79
gbp_policy_next_t
Definition: gbp_policy.c:48
char ** l2output_get_feat_names(void)
Definition: l2_output.c:39
#define vnet_buffer2(b)
Definition: buffer.h:403
The key for an Contract.
Definition: gbp_contract.h:24
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
unsigned char u8
Definition: types.h:56
static u32 vnet_l2_feature_next(vlib_buffer_t *b, u32 *next_nodes, u32 feat_bit)
Return the graph node index for the feature corresponding to the next set bit after clearing the curr...
Definition: feat_bitmap.h:94
static acl_plugin_methods_t acl_plugin
static uword gbp_policy(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: gbp_policy.c:68
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:156
static char * gbp_policy_error_strings[]
Definition: gbp_policy.c:42
per-packet trace data
Definition: gbp_policy.c:59
u32 epg_id_t
Definition: gbp_types.h:21
unsigned int u32
Definition: types.h:88
vlib_node_registration_t gbp_policy_node
(constructor) VLIB_REGISTER_NODE (gbp_policy_node)
Definition: gbp_policy.c:217
#define foreach_gbp_policy
Definition: gbp_policy.c:31
static void acl_plugin_fill_5tuple_inline(void *p_acl_main, u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
struct gbp_policy_trace_t_ gbp_policy_trace_t
per-packet trace data
unsigned short u16
Definition: types.h:57
u32 gc_lc_index
lookup context and acl index
Definition: gbp_contract.h:52
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:202
The value for an Contract.
Definition: gbp_contract.h:43
#define PREDICT_FALSE(x)
Definition: clib.h:105
static u32 gbp_port_to_epg(u32 sw_if_index)
Get the source EPG for a port/interface.
Definition: gbp_endpoint.h:98
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:364
static clib_error_t * gbp_policy_init(vlib_main_t *vm)
Definition: gbp_policy.c:239
u32 l2_output_feat_next[32]
Next nodes for L2 output features.
Definition: gbp_policy.c:26
static u64 gbp_acl_lookup(gbp_contract_key_t *key)
Definition: gbp_contract.h:101
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:153
u16 n_vectors
Definition: node.h:380
vlib_main_t * vm
Definition: buffer.c:294
static void feat_bitmap_init_next_nodes(vlib_main_t *vm, u32 node_index, u32 num_features, char **feat_names, u32 *next_nodes)
Initialize the feature next-node indexes of a graph node.
Definition: feat_bitmap.h:43
#define ARRAY_LEN(x)
Definition: clib.h:59
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:454
epg_id_t gck_src
source and destination EPGs for which the ACL applies
Definition: gbp_contract.h:33
VLIB_NODE_FUNCTION_MULTIARCH(gbp_policy_node, gbp_policy)
gbp_main_t gbp_main
Definition: gbp_api.c:66
static gbp_policy_main_t gbp_policy_main
Definition: gbp_policy.c:29
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
static u8 * format_gbp_policy_trace(u8 *s, va_list *args)
Definition: gbp_policy.c:203
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
Definition: defs.h:47
struct gbp_policy_main_t_ gbp_policy_main_t
Grouping of global data for the GBP source EPG classification feature.
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:267
Group Base Policy (GBP) defines:
Definition: gbp.h:43
#define vnet_buffer(b)
Definition: buffer.h:360
gbp_policy_error_t
Definition: gbp_policy.c:34
Grouping of global data for the GBP source EPG classification feature.
Definition: gbp_policy.c:21
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:111
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:57