FD.io VPP  v19.01.2-3-gf61a1a8
Vector Packet Processing
gbp_policy.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <plugins/gbp/gbp.h>
18 
20 
21 /**
22  * Grouping of global data for the GBP source EPG classification feature
23  */
24 typedef struct gbp_policy_main_t_
25 {
26  /**
27  * Next nodes for L2 output features
28  */
31 
33 
34 #define foreach_gbp_policy \
35  _(DENY, "deny")
36 
37 typedef enum
38 {
39 #define _(sym,str) GBP_ERROR_##sym,
41 #undef _
44 
45 static char *gbp_policy_error_strings[] = {
46 #define _(sym,string) string,
48 #undef _
49 };
50 
51 typedef enum
52 {
53 #define _(sym,str) GBP_POLICY_NEXT_##sym,
55 #undef _
58 
59 /**
60  * per-packet trace data
61  */
62 typedef struct gbp_policy_trace_t_
63 {
64  /* per-pkt trace data */
70 
73 {
74  etype = clib_net_to_host_u16 (etype);
75 
76  switch (etype)
77  {
78  case ETHERNET_TYPE_IP4:
79  return (DPO_PROTO_IP4);
80  case ETHERNET_TYPE_IP6:
81  return (DPO_PROTO_IP6);
82  }
83 
84  return (DPO_PROTO_NONE);
85 }
86 
89 {
90  const ethernet_header_t *eth0;
91  const dpo_id_t *dpo;
92  dpo_proto_t dproto;
93 
94  eth0 = vlib_buffer_get_current (b0);
95  /* pop the ethernet header to prepare for L3 rewrite */
96  vlib_buffer_advance (b0, vnet_buffer (b0)->l2.l2_len);
97 
98  dproto = ethertype_to_dpo_proto (eth0->type);
99  dpo = &gu->gu_dpo[GBP_POLICY_NODE_L2][dproto];
100 
101  /* save the LB index for the next node and reset the IP flow hash
102  * so it's recalculated */
103  vnet_buffer (b0)->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
104  vnet_buffer (b0)->ip.flow_hash = 0;
105 
106  return (dpo->dpoi_next_node);
107 }
108 
111 {
112  u16 *et;
113 
115  {
116  if (*et == ethertype)
117  return (1);
118  }
119  return (0);
120 }
121 
122 static uword
124  vlib_node_runtime_t * node,
125  vlib_frame_t * frame, u8 is_port_based)
126 {
127  gbp_main_t *gm = &gbp_main;
129  u32 n_left_from, *from, *to_next;
130  u32 next_index;
131 
132  next_index = 0;
133  n_left_from = frame->n_vectors;
134  from = vlib_frame_vector_args (frame);
135 
136  while (n_left_from > 0)
137  {
138  u32 n_left_to_next;
139 
140  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
141 
142  while (n_left_from > 0 && n_left_to_next > 0)
143  {
144  const ethernet_header_t *h0;
145  const gbp_endpoint_t *ge0;
146  const gbp_contract_t *gc0;
147  gbp_policy_next_t next0;
148  gbp_contract_key_t key0;
149  u32 bi0, sw_if_index0;
150  vlib_buffer_t *b0;
151  index_t gci0;
152 
153  gc0 = NULL;
154  next0 = GBP_POLICY_NEXT_DENY;
155  bi0 = from[0];
156  to_next[0] = bi0;
157  from += 1;
158  to_next += 1;
159  n_left_from -= 1;
160  n_left_to_next -= 1;
161 
162  b0 = vlib_get_buffer (vm, bi0);
163  h0 = vlib_buffer_get_current (b0);
164  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX];
165 
166  /*
167  * If the A0bit is set then policy has already been applied
168  * and we skip enforcement here.
169  */
170  if (vnet_buffer2 (b0)->gbp.flags & VXLAN_GBP_GPFLAGS_A)
171  {
172  next0 = vnet_l2_feature_next (b0,
174  [is_port_based],
175  (is_port_based ?
176  L2OUTPUT_FEAT_GBP_POLICY_PORT :
177  L2OUTPUT_FEAT_GBP_POLICY_MAC));
178  key0.as_u32 = ~0;
179  goto trace;
180  }
181  /*
182  * determine the src and dst EPG
183  */
184  if (is_port_based)
185  ge0 = gbp_endpoint_find_itf (sw_if_index0);
186  else
188  vnet_buffer (b0)->l2.bd_index);
189 
190  if (NULL != ge0)
191  key0.gck_dst = ge0->ge_fwd.gef_epg_id;
192  else
193  /* If you cannot determine the destination EP then drop */
194  goto trace;
195 
196  key0.gck_src = vnet_buffer2 (b0)->gbp.src_epg;
197 
198  if (EPG_INVALID != key0.gck_src)
199  {
200  if (PREDICT_FALSE (key0.gck_src == key0.gck_dst))
201  {
202  /*
203  * intra-epg allowed
204  */
205  next0 =
208  [is_port_based],
209  (is_port_based ?
210  L2OUTPUT_FEAT_GBP_POLICY_PORT :
211  L2OUTPUT_FEAT_GBP_POLICY_MAC));
212  vnet_buffer2 (b0)->gbp.flags |= VXLAN_GBP_GPFLAGS_A;
213  }
214  else
215  {
216  gci0 = gbp_contract_find (&key0);
217 
218  if (INDEX_INVALID != gci0)
219  {
220  u32 rule_match_p0, trace_bitmap0;
221  fa_5tuple_opaque_t pkt_5tuple0;
222  u32 acl_pos_p0, acl_match_p0;
223  u8 is_ip60, l2_len0, action0;
224  const gbp_rule_t *gu;
225  u16 ether_type0;
226  const u8 *h0;
227 
228  action0 = 0;
229  gc0 = gbp_contract_get (gci0);
230  l2_len0 = vnet_buffer (b0)->l2.l2_len;
231  h0 = vlib_buffer_get_current (b0);
232 
233  ether_type0 = *(u16 *) (h0 + l2_len0 - 2);
234 
235  if (!gbp_policy_is_ethertype_allowed (gc0, ether_type0))
236  {
237  /*
238  * black list model so drop
239  */
240  goto trace;
241  }
242 
243  if ((ether_type0 ==
244  clib_net_to_host_u16 (ETHERNET_TYPE_IP6))
245  || (ether_type0 ==
246  clib_net_to_host_u16 (ETHERNET_TYPE_IP4)))
247  {
248  is_ip60 =
249  (ether_type0 ==
250  clib_net_to_host_u16 (ETHERNET_TYPE_IP6)) ? 1 :
251  0;
252  /*
253  * tests against the ACL
254  */
257  gc0->gc_lc_index, b0,
258  is_ip60,
259  /* is_input */ 0,
260  /* is_l2_path */ 1,
261  &pkt_5tuple0);
264  gc0->gc_lc_index,
265  &pkt_5tuple0,
266  is_ip60, &action0,
267  &acl_pos_p0,
268  &acl_match_p0,
269  &rule_match_p0,
270  &trace_bitmap0);
271 
272  if (action0 > 0)
273  {
274  vnet_buffer2 (b0)->gbp.flags |=
275  VXLAN_GBP_GPFLAGS_A;
276  gu =
277  gbp_rule_get (gc0->gc_rules[rule_match_p0]);
278 
279  switch (gu->gu_action)
280  {
281  case GBP_RULE_PERMIT:
282  next0 = vnet_l2_feature_next
283  (b0,
285  [is_port_based],
286  (is_port_based ?
287  L2OUTPUT_FEAT_GBP_POLICY_PORT :
288  L2OUTPUT_FEAT_GBP_POLICY_MAC));
289  break;
290  case GBP_RULE_DENY:
291  ASSERT (0);
292  next0 = 0;
293  break;
294  case GBP_RULE_REDIRECT:
295  next0 = gbp_rule_l2_redirect (gu, b0);
296  break;
297  }
298  }
299  }
300  }
301  }
302  }
303  else
304  {
305  /*
306  * the src EPG is not set when the packet arrives on an EPG
307  * uplink interface and we do not need to apply policy
308  */
309  next0 =
311  gpm->l2_output_feat_next[is_port_based],
312  (is_port_based ?
313  L2OUTPUT_FEAT_GBP_POLICY_PORT :
314  L2OUTPUT_FEAT_GBP_POLICY_MAC));
315  }
316 
317  trace:
318  if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED)))
319  {
320  gbp_policy_trace_t *t =
321  vlib_add_trace (vm, node, b0, sizeof (*t));
322  t->src_epg = key0.gck_src;
323  t->dst_epg = key0.gck_dst;
324  t->acl_index = (gc0 ? gc0->gc_acl_index : ~0),
325  t->allowed = (next0 != GBP_POLICY_NEXT_DENY);
326  }
327 
328  /* verify speculative enqueue, maybe switch current next frame */
329  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
330  to_next, n_left_to_next,
331  bi0, next0);
332  }
333 
334  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
335  }
336 
337  return frame->n_vectors;
338 }
339 
340 static uword
342  vlib_node_runtime_t * node, vlib_frame_t * frame)
343 {
344  return (gbp_policy_inline (vm, node, frame, 1));
345 }
346 
347 static uword
349  vlib_node_runtime_t * node, vlib_frame_t * frame)
350 {
351  return (gbp_policy_inline (vm, node, frame, 0));
352 }
353 
354 /* packet trace format function */
355 static u8 *
356 format_gbp_policy_trace (u8 * s, va_list * args)
357 {
358  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
359  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
360  gbp_policy_trace_t *t = va_arg (*args, gbp_policy_trace_t *);
361 
362  s =
363  format (s, "src:%d, dst:%d, acl:%d allowed:%d",
364  t->src_epg, t->dst_epg, t->acl_index, t->allowed);
365 
366  return s;
367 }
368 
369 /* *INDENT-OFF* */
371  .function = gbp_policy_port,
372  .name = "gbp-policy-port",
373  .vector_size = sizeof (u32),
374  .format_trace = format_gbp_policy_trace,
375  .type = VLIB_NODE_TYPE_INTERNAL,
376 
377  .n_errors = ARRAY_LEN(gbp_policy_error_strings),
378  .error_strings = gbp_policy_error_strings,
379 
380  .n_next_nodes = GBP_POLICY_N_NEXT,
381 
382  .next_nodes = {
383  [GBP_POLICY_NEXT_DENY] = "error-drop",
384  },
385 };
386 
388 
390  .function = gbp_policy_mac,
391  .name = "gbp-policy-mac",
392  .vector_size = sizeof (u32),
393  .format_trace = format_gbp_policy_trace,
394  .type = VLIB_NODE_TYPE_INTERNAL,
395  .sibling_of = "gbp-policy-port",
396 };
397 
399 
400 /* *INDENT-ON* */
401 
402 static clib_error_t *
404 {
406  clib_error_t *error = 0;
407 
408  /* Initialize the feature next-node indexes */
410  gbp_policy_port_node.index,
413  gpm->l2_output_feat_next[1]);
415  gbp_policy_mac_node.index,
418  gpm->l2_output_feat_next[0]);
419 
420  return error;
421 }
422 
424 
425 /*
426  * fd.io coding-style-patch-verification: ON
427  *
428  * Local Variables:
429  * eval: (c-set-style "gnu")
430  * End:
431  */
u16 * gc_allowed_ethertypes
An ethertype whitelist.
Definition: gbp_contract.h:127
static u8 gbp_policy_is_ethertype_allowed(const gbp_contract_t *gc0, u16 ethertype)
Definition: gbp_policy.c:110
static vlib_cli_command_t trace
(constructor) VLIB_CLI_COMMAND (trace)
Definition: vlib_api_cli.c:862
A Group Based Policy Endpoint.
Definition: gbp_endpoint.h:182
#define CLIB_UNUSED(x)
Definition: clib.h:82
gbp_policy_next_t
Definition: gbp_policy.c:51
char ** l2output_get_feat_names(void)
Definition: l2_output.c:39
static dpo_proto_t ethertype_to_dpo_proto(u16 etype)
Definition: gbp_policy.c:72
vlib_node_registration_t gbp_policy_mac_node
(constructor) VLIB_REGISTER_NODE (gbp_policy_mac_node)
Definition: gbp_policy.c:389
gbp_endpoint_fwd_t ge_fwd
Definition: gbp_endpoint.h:200
#define vnet_buffer2(b)
Definition: buffer.h:413
static u32 gbp_rule_l2_redirect(const gbp_rule_t *gu, vlib_buffer_t *b0)
Definition: gbp_policy.c:88
#define NULL
Definition: clib.h:58
The key for an Contract.
Definition: gbp_contract.h:24
static uword gbp_policy_port(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: gbp_policy.c:341
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
Definition: dpo.h:41
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
static gbp_rule_t * gbp_rule_get(index_t gui)
Definition: gbp_contract.h:187
unsigned char u8
Definition: types.h:56
static u32 vnet_l2_feature_next(vlib_buffer_t *b, u32 *next_nodes, u32 feat_bit)
Return the graph node index for the feature corresponding to the next set bit after clearing the curr...
Definition: feat_bitmap.h:94
static acl_plugin_methods_t acl_plugin
epg_id_t gef_epg_id
Endpoint Group&#39;s ID.
Definition: gbp_endpoint.h:169
u32 l2_output_feat_next[2][32]
Next nodes for L2 output features.
Definition: gbp_policy.c:29
VLIB_NODE_FUNCTION_MULTIARCH(gbp_policy_port_node, gbp_policy_port)
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:163
#define always_inline
Definition: clib.h:98
u8 dst_address[6]
Definition: packet.h:55
#define DPO_PROTO_NONE
Definition: dpo.h:71
static char * gbp_policy_error_strings[]
Definition: gbp_policy.c:45
per-packet trace data
Definition: gbp_policy.c:62
static_always_inline gbp_endpoint_t * gbp_endpoint_find_mac(const u8 *mac, u32 bd_index)
Definition: gbp_endpoint.h:272
unsigned int u32
Definition: types.h:88
enum dpo_proto_t_ dpo_proto_t
Data path protocol.
#define foreach_gbp_policy
Definition: gbp_policy.c:34
static void acl_plugin_fill_5tuple_inline(void *p_acl_main, u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
The identity of a DPO is a combination of its type and its instance number/index of objects of that t...
Definition: dpo.h:168
#define gm
Definition: dlmalloc.c:1217
struct gbp_policy_trace_t_ gbp_policy_trace_t
per-packet trace data
index_t * gc_rules
The ACL to apply for packets from the source to the destination EPG.
Definition: gbp_contract.h:122
static uword gbp_policy_mac(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: gbp_policy.c:348
unsigned short u16
Definition: types.h:57
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:214
gbp_rule_action_t gu_action
Definition: gbp_contract.h:95
#define PREDICT_FALSE(x)
Definition: clib.h:111
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:368
static clib_error_t * gbp_policy_init(vlib_main_t *vm)
Definition: gbp_policy.c:403
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
u16 n_vectors
Definition: node.h:420
vlib_main_t * vm
Definition: buffer.c:301
static void feat_bitmap_init_next_nodes(vlib_main_t *vm, u32 node_index, u32 num_features, char **feat_names, u32 *next_nodes)
Initialize the feature next-node indexes of a graph node.
Definition: feat_bitmap.h:43
dpo_id_t gu_dpo[GBP_POLICY_N_NODES][FIB_PROTOCOL_IP_MAX]
DPO of the load-balance object used to redirect.
Definition: gbp_contract.h:102
#define ARRAY_LEN(x)
Definition: clib.h:62
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:459
epg_id_t gck_src
source and destination EPGs for which the ACL applies
Definition: gbp_contract.h:33
#define ASSERT(truth)
gbp_main_t gbp_main
Definition: gbp_api.c:88
static gbp_policy_main_t gbp_policy_main
Definition: gbp_policy.c:32
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
static u8 * format_gbp_policy_trace(u8 *s, va_list *args)
Definition: gbp_policy.c:356
#define EPG_INVALID
Definition: gbp_types.h:22
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:233
vlib_node_registration_t gbp_policy_port_node
(constructor) VLIB_REGISTER_NODE (gbp_policy_port_node)
Definition: gbp_policy.c:370
static gbp_contract_t * gbp_contract_get(index_t gci)
Definition: gbp_contract.h:179
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:57
Definition: defs.h:47
index_t dpoi_index
the index of objects of that type
Definition: dpo.h:184
struct gbp_policy_main_t_ gbp_policy_main_t
Grouping of global data for the GBP source EPG classification feature.
#define INDEX_INVALID
Invalid index - used when no index is known blazoned capitals INVALID speak volumes where ~0 does not...
Definition: dpo.h:47
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:274
Group Base Policy (GBP) defines:
Definition: gbp.h:43
#define vnet_buffer(b)
Definition: buffer.h:368
static_always_inline gbp_endpoint_t * gbp_endpoint_find_itf(u32 sw_if_index)
Definition: gbp_endpoint.h:348
static uword gbp_policy_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, u8 is_port_based)
Definition: gbp_policy.c:123
#define vec_foreach(var, vec)
Vector iterator.
gbp_policy_error_t
Definition: gbp_policy.c:37
u16 dpoi_next_node
The next VLIB node to follow.
Definition: dpo.h:180
Grouping of global data for the GBP source EPG classification feature.
Definition: gbp_policy.c:24
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:117
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:62
static index_t gbp_contract_find(gbp_contract_key_t *key)
Definition: gbp_contract.h:164
A Group Based Policy Contract.
Definition: gbp_contract.h:109