16 #ifndef __GBP_CONTRACT_H__ 17 #define __GBP_CONTRACT_H__ 22 #define foreach_gbp_contract_error \ 23 _(ALLOW_NO_SCLASS, "allow-no-sclass") \ 24 _(ALLOW_INTRA, "allow-intra-sclass") \ 25 _(ALLOW_A_BIT, "allow-a-bit-set") \ 26 _(ALLOW_SCLASS_1, "allow-sclass-1") \ 27 _(ALLOW_CONTRACT, "allow-contract") \ 28 _(DROP_CONTRACT, "drop-contract") \ 29 _(DROP_ETHER_TYPE, "drop-ether-type") \ 30 _(DROP_NO_CONTRACT, "drop-no-contract") \ 31 _(DROP_NO_DCLASS, "drop-no-dclass") 35 #define _(sym,str) GBP_CONTRACT_ERROR_##sym, 39 #define GBP_CONTRACT_N_ERROR GBP_CONTRACT_N_ERROR 77 #define foreach_gbp_hash_mode \ 80 _(SYMMETRIC, "symmetric") 84 #define _(v,s) GBP_HASH_MODE_##v, 89 #define foreach_gbp_rule_action \ 92 _(REDIRECT, "redirect") 96 #define _(v,s) GBP_RULE_##v, 101 #define foreach_gbp_policy_node \ 108 #define _(v,s) GBP_POLICY_NODE_##v, 112 #define GBP_POLICY_N_NODES (GBP_POLICY_NODE_IP6+1) 114 #define FOR_EACH_GBP_POLICY_NODE(pnode) \ 115 for (pnode = GBP_POLICY_NODE_L2; pnode < GBP_POLICY_N_NODES; pnode++) 249 *err = GBP_CONTRACT_ERROR_ALLOW_INTRA;
250 return GBP_RULE_PERMIT;
257 *err = GBP_CONTRACT_ERROR_ALLOW_SCLASS_1;
258 return GBP_RULE_PERMIT;
265 *err = GBP_CONTRACT_ERROR_DROP_NO_CONTRACT;
266 return GBP_RULE_DENY;
271 *err = GBP_CONTRACT_ERROR_DROP_CONTRACT;
290 *err = GBP_CONTRACT_ERROR_DROP_ETHER_TYPE;
294 switch (clib_net_to_host_u16 (etype))
296 case ETHERNET_TYPE_IP4:
299 case ETHERNET_TYPE_IP6:
318 &action, &acl_pos, &acl_match, &rule_match,
324 switch ((*rule)->gu_action)
326 case GBP_RULE_PERMIT:
327 case GBP_RULE_REDIRECT:
328 *err = GBP_CONTRACT_ERROR_ALLOW_CONTRACT;
332 return (*rule)->gu_action;
341 return GBP_RULE_DENY;
u16 * gc_allowed_ethertypes
An ethertype whitelist.
#define GBP_CONTRACT_N_ERROR
gbp_contract_key_t gc_key
source and destination EPGs
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
struct gbp_next_hop_t_ gbp_next_hop_t
struct gbp_rule_t_ gbp_rule_t
struct gbp_contract_key_t_ gbp_contract_key_t
The key for an Contract.
#define FIB_PROTOCOL_IP_MAX
Definition outside of enum so it does not need to be included in non-defaulted switch statements...
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
EPG src,dst pair to ACL mapping table, aka contract DB.
static gbp_rule_t * gbp_rule_get(index_t gui)
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
#define static_always_inline
vlib_combined_counter_main_t gbp_contract_drop_counters
vlib_combined_counter_main_t gbp_contract_permit_counters
struct gbp_contract_db_t_ gbp_contract_db_t
EPG src,dst pair to ACL mapping table, aka contract DB.
void gbp_contract_walk(gbp_contract_cb_t bgpe, void *ctx)
#define vec_search(v, E)
Search a vector for the index of the entry that matches.
gbp_contract_db_t gbp_contract_db
DP functions and databases.
static void acl_plugin_fill_5tuple_inline(void *p_acl_main, u32 lc_index, vlib_buffer_t *b0, int is_ip6, int is_input, int is_l2_path, fa_5tuple_opaque_t *p5tuple_pkt)
uword * gc_hash
We can form a u64 key from the pair, so use a simple hash table.
gbp_contract_apply_type_t
vl_api_fib_path_type_t type
int gbp_contract_delete(gbp_scope_t scope, sclass_t sclass, sclass_t dclass)
The identity of a DPO is a combination of its type and its instance number/index of objects of that t...
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
gbp_rule_t * gbp_rule_pool
#define foreach_gbp_policy_node
index_t * gc_rules
The ACL to apply for packets from the source to the destination EPG.
sclass_t gck_src
source and destination EPGs for which the ACL applies
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
gbp_rule_action_t gu_action
#define GBP_POLICY_N_NODES
vl_api_gbp_next_hop_t nhs[8]
An node in the FIB graph.
u8 * format_gbp_contract(u8 *s, va_list *args)
static_always_inline gbp_rule_action_t gbp_contract_apply(vlib_main_t *vm, gbp_main_t *gm, gbp_contract_key_t *key, vlib_buffer_t *b, gbp_rule_t **rule, u32 *intra, u32 *sclass1, gbp_contract_error_t *err, gbp_contract_apply_type_t type)
enum gbp_hash_mode_t_ gbp_hash_mode_t
index_t gbp_next_hop_alloc(const ip46_address_t *ip, index_t grd, const mac_address_t *mac, index_t gbd)
vlib_parse_match_function_t rule_match
int gbp_contract_update(gbp_scope_t scope, sclass_t sclass, sclass_t dclass, u32 acl_index, index_t *rules, u16 *allowed_ethertypes, u32 *stats_index)
char * gbp_contract_error_strings[GBP_CONTRACT_N_ERROR]
vl_api_gbp_rule_t rules[n_rules]
static int acl_plugin_match_5tuple_inline(void *p_acl_main, u32 lc_index, fa_5tuple_opaque_t *pkt_5tuple, int is_ip6, u8 *r_action, u32 *r_acl_pos_p, u32 *r_acl_match_p, u32 *r_rule_match_p, u32 *trace_bitmap)
struct gbp_contract_t_ gbp_contract_t
A Group Based Policy Contract.
static gbp_contract_t * gbp_contract_get(index_t gci)
index_t gbp_rule_alloc(gbp_rule_action_t action, gbp_hash_mode_t hash_mode, index_t *nhs)
enum gbp_rule_action_t_ gbp_rule_action_t
#define foreach_gbp_contract_error
acl_plugin_methods_t acl_plugin
#define INDEX_INVALID
Invalid index - used when no index is known blazoned capitals INVALID speak volumes where ~0 does not...
VLIB buffer representation.
#define foreach_gbp_rule_action
#define foreach_gbp_hash_mode
A collection of combined counters.
Group Base Policy (GBP) defines:
enum gbp_policy_node_t_ gbp_policy_node_t
gbp_hash_mode_t gu_hash_mode
u16 allowed_ethertypes[16]
gbp_contract_t * gbp_contract_pool
static index_t gbp_contract_find(gbp_contract_key_t *key)
A Group Based Policy Contract.
int(* gbp_contract_cb_t)(gbp_contract_t *gbpe, void *ctx)