FD.io VPP  v19.01.2-3-gf61a1a8
Vector Packet Processing
gbp_policy_dpo.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <vnet/dpo/dvr_dpo.h>
17 #include <vnet/dpo/drop_dpo.h>
19 
20 #include <plugins/gbp/gbp.h>
22 #include <plugins/gbp/gbp_recirc.h>
23 
24 /**
25  * DPO pool
26  */
28 
29 /**
30  * DPO type registered for these GBP FWD
31  */
33 
34 static gbp_policy_dpo_t *
36 {
37  gbp_policy_dpo_t *gpd;
38 
39  pool_get_aligned_zero (gbp_policy_dpo_pool, gpd, CLIB_CACHE_LINE_BYTES);
40 
41  return (gpd);
42 }
43 
44 static inline gbp_policy_dpo_t *
46 {
48 
49  return (gbp_policy_dpo_get (dpo->dpoi_index));
50 }
51 
52 static inline index_t
54 {
55  return (gpd - gbp_policy_dpo_pool);
56 }
57 
58 static void
60 {
61  gbp_policy_dpo_t *gpd;
62 
63  gpd = gbp_policy_dpo_get_from_dpo (dpo);
64  gpd->gpd_locks++;
65 }
66 
67 static void
69 {
70  gbp_policy_dpo_t *gpd;
71 
72  gpd = gbp_policy_dpo_get_from_dpo (dpo);
73  gpd->gpd_locks--;
74 
75  if (0 == gpd->gpd_locks)
76  {
77  dpo_reset (&gpd->gpd_dpo);
78  pool_put (gbp_policy_dpo_pool, gpd);
79  }
80 }
81 
82 static u32
84 {
85  gbp_policy_dpo_t *gpd;
86 
87  gpd = gbp_policy_dpo_get_from_dpo (dpo);
88 
89  return (gpd->gpd_sw_if_index);
90 }
91 
92 void
94  epg_id_t epg, u32 sw_if_index, dpo_id_t * dpo)
95 {
96  gbp_policy_dpo_t *gpd;
97  dpo_id_t parent = DPO_INVALID;
98 
99  gpd = gbp_policy_dpo_alloc ();
100 
101  gpd->gpd_proto = dproto;
103  gpd->gpd_epg = epg;
104 
105  if (~0 != sw_if_index)
106  {
107  /*
108  * stack on the DVR DPO for the output interface
109  */
110  dvr_dpo_add_or_lock (sw_if_index, dproto, &parent);
111  }
112  else
113  {
114  dpo_copy (&parent, drop_dpo_get (dproto));
115  }
116 
117  dpo_stack (gbp_policy_dpo_type, dproto, &gpd->gpd_dpo, &parent);
119 }
120 
121 u8 *
122 format_gbp_policy_dpo (u8 * s, va_list * ap)
123 {
124  index_t index = va_arg (*ap, index_t);
125  u32 indent = va_arg (*ap, u32);
126  gbp_policy_dpo_t *gpd = gbp_policy_dpo_get (index);
127  vnet_main_t *vnm = vnet_get_main ();
128 
129  s = format (s, "gbp-policy-dpo: %U, epg:%d out:%U",
131  gpd->gpd_epg,
133  s = format (s, "\n%U", format_white_space, indent + 2);
134  s = format (s, "%U", format_dpo_id, &gpd->gpd_dpo, indent + 4);
135 
136  return (s);
137 }
138 
139 /**
140  * Interpose a policy DPO
141  */
142 static void
144  const dpo_id_t * parent, dpo_id_t * clone)
145 {
146  gbp_policy_dpo_t *gpd, *gpd_clone;
147 
148  gpd_clone = gbp_policy_dpo_alloc ();
149  gpd = gbp_policy_dpo_get (original->dpoi_index);
150 
151  gpd_clone->gpd_proto = gpd->gpd_proto;
152  gpd_clone->gpd_epg = gpd->gpd_epg;
153  gpd_clone->gpd_sw_if_index = gpd->gpd_sw_if_index;
154 
156  gpd_clone->gpd_proto, &gpd_clone->gpd_dpo, parent);
157 
158  dpo_set (clone,
160  gpd_clone->gpd_proto, gbp_policy_dpo_get_index (gpd_clone));
161 }
162 
163 const static dpo_vft_t gbp_policy_dpo_vft = {
165  .dv_unlock = gbp_policy_dpo_unlock,
166  .dv_format = format_gbp_policy_dpo,
167  .dv_get_urpf = gbp_policy_dpo_get_urpf,
168  .dv_mk_interpose = gbp_policy_dpo_interpose,
169 };
170 
171 /**
172  * @brief The per-protocol VLIB graph nodes that are assigned to a glean
173  * object.
174  *
175  * this means that these graph nodes are ones from which a glean is the
176  * parent object in the DPO-graph.
177  */
178 const static char *const gbp_policy_dpo_ip4_nodes[] = {
179  "ip4-gbp-policy-dpo",
180  NULL,
181 };
182 
183 const static char *const gbp_policy_dpo_ip6_nodes[] = {
184  "ip6-gbp-policy-dpo",
185  NULL,
186 };
187 
188 const static char *const *const gbp_policy_dpo_nodes[DPO_PROTO_NUM] = {
191 };
192 
195 {
196  return (gbp_policy_dpo_type);
197 }
198 
199 static clib_error_t *
201 {
202  gbp_policy_dpo_type = dpo_register_new_type (&gbp_policy_dpo_vft,
204 
205  return (NULL);
206 }
207 
209 
211 {
217 
218 typedef enum
219 {
223 
225 gbp_rule_l3_redirect (const gbp_rule_t * gu, vlib_buffer_t * b0, int is_ip6)
226 {
227  gbp_policy_node_t pnode;
228  const dpo_id_t *dpo;
229  dpo_proto_t dproto;
230 
231  pnode = (is_ip6 ? GBP_POLICY_NODE_IP6 : GBP_POLICY_NODE_IP4);
232  dproto = (is_ip6 ? DPO_PROTO_IP6 : DPO_PROTO_IP4);
233  dpo = &gu->gu_dpo[pnode][dproto];
234 
235  /* The flow hash is still valid as this is a IP packet being switched */
236  vnet_buffer (b0)->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
237 
238  return (dpo->dpoi_next_node);
239 }
240 
243  vlib_node_runtime_t * node,
244  vlib_frame_t * from_frame, u8 is_ip6)
245 {
246  gbp_main_t *gm = &gbp_main;
247  u32 n_left_from, next_index, *from, *to_next;
248  gbp_rule_t *gu;
249 
250  from = vlib_frame_vector_args (from_frame);
251  n_left_from = from_frame->n_vectors;
252 
253  next_index = node->cached_next_index;
254 
255  while (n_left_from > 0)
256  {
257  u32 n_left_to_next;
258 
259  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
260 
261  while (n_left_from > 0 && n_left_to_next > 0)
262  {
263  const gbp_policy_dpo_t *gpd0;
264  u32 bi0, next0;
265  gbp_contract_key_t key0;
266  gbp_contract_t *gc0;
267  vlib_buffer_t *b0;
268  index_t gci0;
269 
270  bi0 = from[0];
271  to_next[0] = bi0;
272  from += 1;
273  to_next += 1;
274  n_left_from -= 1;
275  n_left_to_next -= 1;
276  next0 = GBP_POLICY_DROP;
277 
278  b0 = vlib_get_buffer (vm, bi0);
279 
280  gc0 = NULL;
281  gpd0 = gbp_policy_dpo_get (vnet_buffer (b0)->ip.adj_index[VLIB_TX]);
282  vnet_buffer (b0)->ip.adj_index[VLIB_TX] = gpd0->gpd_dpo.dpoi_index;
283 
284  if (vnet_buffer2 (b0)->gbp.flags & VXLAN_GBP_GPFLAGS_A)
285  {
286  next0 = gpd0->gpd_dpo.dpoi_next_node;
287  key0.as_u32 = ~0;
288  goto trace;
289  }
290 
291  key0.gck_src = vnet_buffer2 (b0)->gbp.src_epg;
292  key0.gck_dst = gpd0->gpd_epg;
293 
294  if (EPG_INVALID != key0.gck_src)
295  {
296  if (PREDICT_FALSE (key0.gck_src == key0.gck_dst))
297  {
298  /*
299  * intra-epg allowed
300  */
301  next0 = gpd0->gpd_dpo.dpoi_next_node;
302  vnet_buffer2 (b0)->gbp.flags |= VXLAN_GBP_GPFLAGS_A;
303  }
304  else
305  {
306  gci0 = gbp_contract_find (&key0);
307 
308  if (INDEX_INVALID != gci0)
309  {
310  fa_5tuple_opaque_t pkt_5tuple0;
311  u8 action0 = 0;
312  u32 acl_pos_p0, acl_match_p0;
313  u32 rule_match_p0, trace_bitmap0;
314  /*
315  * tests against the ACL
316  */
317  gc0 = gbp_contract_get (gci0);
320  gc0->gc_lc_index, b0,
321  is_ip6,
322  /* is_input */ 1,
323  /* is_l2_path */ 0,
324  &pkt_5tuple0);
327  gc0->gc_lc_index,
328  &pkt_5tuple0, is_ip6,
329  &action0, &acl_pos_p0,
330  &acl_match_p0,
331  &rule_match_p0,
332  &trace_bitmap0);
333 
334  if (action0 > 0)
335  {
336 
337  vnet_buffer2 (b0)->gbp.flags |= VXLAN_GBP_GPFLAGS_A;
338  gu = gbp_rule_get (gc0->gc_rules[rule_match_p0]);
339 
340  switch (gu->gu_action)
341  {
342  case GBP_RULE_PERMIT:
343  next0 = gpd0->gpd_dpo.dpoi_next_node;
344  break;
345  case GBP_RULE_DENY:
346  ASSERT (0);
347  next0 = 0;
348  break;
349  case GBP_RULE_REDIRECT:
350  next0 = gbp_rule_l3_redirect (gu, b0, is_ip6);
351  break;
352  }
353  }
354  }
355  }
356  }
357  else
358  {
359  /*
360  * the src EPG is not set when the packet arrives on an EPG
361  * uplink interface and we do not need to apply policy
362  */
363  next0 = gpd0->gpd_dpo.dpoi_next_node;
364  }
365  trace:
366  if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
367  {
369 
370  tr = vlib_add_trace (vm, node, b0, sizeof (*tr));
371  tr->src_epg = key0.gck_src;
372  tr->dst_epg = key0.gck_dst;
373  tr->acl_index = (gc0 ? gc0->gc_acl_index : ~0);
374  tr->a_bit = vnet_buffer2 (b0)->gbp.flags & VXLAN_GBP_GPFLAGS_A;
375  }
376 
377  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
378  n_left_to_next, bi0, next0);
379  }
380  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
381  }
382  return from_frame->n_vectors;
383 }
384 
385 static u8 *
386 format_gbp_policy_dpo_trace (u8 * s, va_list * args)
387 {
388  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
389  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
390  gbp_policy_dpo_trace_t *t = va_arg (*args, gbp_policy_dpo_trace_t *);
391 
392  s = format (s, " src-epg:%d dst-epg:%d acl-index:%d a-bit:%d",
393  t->src_epg, t->dst_epg, t->acl_index, t->a_bit);
394 
395  return s;
396 }
397 
398 static uword
400  vlib_node_runtime_t * node, vlib_frame_t * from_frame)
401 {
402  return (gbp_policy_dpo_inline (vm, node, from_frame, 0));
403 }
404 
405 static uword
407  vlib_node_runtime_t * node, vlib_frame_t * from_frame)
408 {
409  return (gbp_policy_dpo_inline (vm, node, from_frame, 1));
410 }
411 
412 /* *INDENT-OFF* */
414  .function = ip4_gbp_policy_dpo,
415  .name = "ip4-gbp-policy-dpo",
416  .vector_size = sizeof (u32),
417  .format_trace = format_gbp_policy_dpo_trace,
418  .n_next_nodes = GBP_POLICY_N_NEXT,
419  .next_nodes =
420  {
421  [GBP_POLICY_DROP] = "ip4-drop",
422  }
423 };
425  .function = ip6_gbp_policy_dpo,
426  .name = "ip6-gbp-policy-dpo",
427  .vector_size = sizeof (u32),
428  .format_trace = format_gbp_policy_dpo_trace,
429  .n_next_nodes = GBP_POLICY_N_NEXT,
430  .next_nodes =
431  {
432  [GBP_POLICY_DROP] = "ip6-drop",
433  }
434 };
435 
438 /* *INDENT-ON* */
439 
440 /*
441  * fd.io coding-style-patch-verification: ON
442  *
443  * Local Variables:
444  * eval: (c-set-style "gnu")
445  * End:
446  */
dpo_lock_fn_t dv_lock
A reference counting lock function.
Definition: dpo.h:404
gbp_policy_next_t
static vlib_cli_command_t trace
(constructor) VLIB_CLI_COMMAND (trace)
Definition: vlib_api_cli.c:862
u16 epg_id_t
Definition: gbp_types.h:21
#define CLIB_UNUSED(x)
Definition: clib.h:82
A virtual function table regisitered for a DPO type.
Definition: dpo.h:399
vnet_main_t * vnet_get_main(void)
Definition: misc.c:47
#define vnet_buffer2(b)
Definition: buffer.h:413
#define NULL
Definition: clib.h:58
static uword ip4_gbp_policy_dpo(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
The key for an Contract.
Definition: gbp_contract.h:24
void dpo_copy(dpo_id_t *dst, const dpo_id_t *src)
atomic copy a data-plane object.
Definition: dpo.c:261
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
Definition: dpo.h:41
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
static gbp_rule_t * gbp_rule_get(index_t gui)
Definition: gbp_contract.h:187
static gbp_policy_dpo_t * gbp_policy_dpo_get_from_dpo(const dpo_id_t *dpo)
format_function_t format_vnet_sw_if_index_name
unsigned char u8
Definition: types.h:56
static acl_plugin_methods_t acl_plugin
static const char *const gbp_policy_dpo_ip4_nodes[]
The per-protocol VLIB graph nodes that are assigned to a glean object.
const dpo_id_t * drop_dpo_get(dpo_proto_t proto)
Definition: drop_dpo.c:25
gbp_policy_dpo_t * gbp_policy_dpo_pool
DPO pool.
enum dpo_type_t_ dpo_type_t
Common types of data-path objects New types can be dynamically added using dpo_register_new_type() ...
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:163
u32 sw_if_index
Definition: vxlan_gbp.api:37
#define always_inline
Definition: clib.h:98
epg_id_t gpd_epg
EPG.
u8 * format_white_space(u8 *s, va_list *va)
Definition: std-formats.c:113
static uword gbp_policy_dpo_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame, u8 is_ip6)
static u8 * format_gbp_policy_dpo_trace(u8 *s, va_list *args)
static gbp_policy_dpo_t * gbp_policy_dpo_alloc(void)
unsigned int u32
Definition: types.h:88
u32 gpd_sw_if_index
output sw_if_index
enum dpo_proto_t_ dpo_proto_t
Data path protocol.
static void acl_plugin_fill_5tuple_inline(void *p_acl_main, u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
dpo_type_t dpo_register_new_type(const dpo_vft_t *vft, const char *const *const *nodes)
Create and register a new DPO type.
Definition: dpo.c:341
static clib_error_t * gbp_policy_dpo_module_init(vlib_main_t *vm)
#define VLIB_NODE_FUNCTION_MULTIARCH(node, fn)
Definition: node.h:223
dpo_type_t gbp_policy_dpo_get_type(void)
The identity of a DPO is a combination of its type and its instance number/index of objects of that t...
Definition: dpo.h:168
u8 * format_gbp_policy_dpo(u8 *s, va_list *ap)
static u32 gbp_policy_dpo_get_urpf(const dpo_id_t *dpo)
The GBP FWD DPO.
static void gbp_policy_dpo_lock(dpo_id_t *dpo)
#define gm
Definition: dlmalloc.c:1217
dpo_type_t dpoi_type
the type
Definition: dpo.h:172
index_t * gc_rules
The ACL to apply for packets from the source to the destination EPG.
Definition: gbp_contract.h:122
static const char *const gbp_policy_dpo_ip6_nodes[]
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:286
gbp_rule_action_t gu_action
Definition: gbp_contract.h:95
#define PREDICT_FALSE(x)
Definition: clib.h:111
static void gbp_policy_dpo_unlock(dpo_id_t *dpo)
#define pool_get_aligned_zero(P, E, A)
Allocate an object E from a pool P with alignment A and zero it.
Definition: pool.h:233
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:368
void dvr_dpo_add_or_lock(u32 sw_if_index, dpo_proto_t dproto, dpo_id_t *dpo)
Definition: dvr_dpo.c:87
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
u16 n_vectors
Definition: node.h:420
vlib_main_t * vm
Definition: buffer.c:301
void gbp_policy_dpo_add_or_lock(dpo_proto_t dproto, epg_id_t epg, u32 sw_if_index, dpo_id_t *dpo)
struct gbp_policy_dpo_trace_t_ gbp_policy_dpo_trace_t
dpo_id_t gu_dpo[GBP_POLICY_N_NODES][FIB_PROTOCOL_IP_MAX]
DPO of the load-balance object used to redirect.
Definition: gbp_contract.h:102
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:459
void dpo_set(dpo_id_t *dpo, dpo_type_t type, dpo_proto_t proto, index_t index)
Set/create a DPO ID The DPO will be locked.
Definition: dpo.c:185
epg_id_t gck_src
source and destination EPGs for which the ACL applies
Definition: gbp_contract.h:33
static void gbp_policy_dpo_interpose(const dpo_id_t *original, const dpo_id_t *parent, dpo_id_t *clone)
Interpose a policy DPO.
static const char *const *const gbp_policy_dpo_nodes[DPO_PROTO_NUM]
static gbp_policy_dpo_t * gbp_policy_dpo_get(index_t index)
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
Definition: node.h:538
#define ASSERT(truth)
gbp_main_t gbp_main
Definition: gbp_api.c:88
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
u16 gpd_locks
number of locks.
dpo_type_t gbp_policy_dpo_type
DPO type registered for these GBP FWD.
vlib_node_registration_t ip4_gbp_policy_dpo_node
(constructor) VLIB_REGISTER_NODE (ip4_gbp_policy_dpo_node)
#define EPG_INVALID
Definition: gbp_types.h:22
static gbp_contract_t * gbp_contract_get(index_t gci)
Definition: gbp_contract.h:179
u8 * format_dpo_id(u8 *s, va_list *args)
Format a DPO_id_t oject
Definition: dpo.c:147
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:57
Definition: defs.h:47
#define DPO_PROTO_NUM
Definition: dpo.h:70
index_t dpoi_index
the index of objects of that type
Definition: dpo.h:184
static u32 gbp_rule_l3_redirect(const gbp_rule_t *gu, vlib_buffer_t *b0, int is_ip6)
#define INDEX_INVALID
Invalid index - used when no index is known blazoned capitals INVALID speak volumes where ~0 does not...
Definition: dpo.h:47
u64 uword
Definition: types.h:112
dpo_id_t gpd_dpo
Stacked DPO on DVR/ADJ of output interface.
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:274
static index_t gbp_policy_dpo_get_index(gbp_policy_dpo_t *gpd)
#define DPO_INVALID
An initialiser for DPOs declared on the stack.
Definition: dpo.h:195
u8 * format_dpo_proto(u8 *s, va_list *args)
format a DPO protocol
Definition: dpo.c:177
Group Base Policy (GBP) defines:
Definition: gbp.h:43
dpo_proto_t gpd_proto
The protocol of packets using this DPO.
#define vnet_buffer(b)
Definition: buffer.h:368
static uword ip6_gbp_policy_dpo(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
enum gbp_policy_node_t_ gbp_policy_node_t
void dpo_reset(dpo_id_t *dpo)
reset a DPO ID The DPO will be unlocked.
Definition: dpo.c:231
u16 dpoi_next_node
The next VLIB node to follow.
Definition: dpo.h:180
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:117
vlib_node_registration_t ip6_gbp_policy_dpo_node
(constructor) VLIB_REGISTER_NODE (ip6_gbp_policy_dpo_node)
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:62
static index_t gbp_contract_find(gbp_contract_key_t *key)
Definition: gbp_contract.h:164
A Group Based Policy Contract.
Definition: gbp_contract.h:109
void dpo_stack(dpo_type_t child_type, dpo_proto_t child_proto, dpo_id_t *dpo, const dpo_id_t *parent)
Stack one DPO object on another, and thus establish a child-parent relationship.
Definition: dpo.c:515