| /* |
| * Copyright (c) 2015 Cisco and/or its affiliates. |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at: |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| #include <vnet/ip/ip.h> |
| #include <vnet/classify/vnet_classify.h> |
| #include <vnet/classify/input_acl.h> |
| |
| input_acl_main_t input_acl_main; |
| |
| static int |
| vnet_inacl_ip_feature_enable (vlib_main_t * vnm, |
| input_acl_main_t *am, |
| u32 sw_if_index, |
| input_acl_table_id_t tid, |
| int feature_enable) |
| { |
| |
| if (tid == INPUT_ACL_TABLE_L2) |
| { |
| l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_ACL, |
| feature_enable); |
| } |
| else |
| { /* IP[46] */ |
| vnet_feature_config_main_t *fcm; |
| u8 arc; |
| |
| if (tid == INPUT_ACL_TABLE_IP4) |
| { |
| vnet_feature_enable_disable ("ip4-unicast", "ip4-inacl", |
| sw_if_index, feature_enable, 0, 0); |
| arc = vnet_get_feature_arc_index ("ip4-unicast"); |
| } |
| else |
| { |
| vnet_feature_enable_disable ("ip6-unicast", "ip6-inacl", |
| sw_if_index, feature_enable, 0, 0); |
| arc = vnet_get_feature_arc_index ("ip6-unicast"); |
| } |
| |
| fcm = vnet_get_feature_arc_config_main (arc); |
| am->vnet_config_main[tid] = &fcm->config_main; |
| } |
| |
| return 0; |
| } |
| |
| int vnet_set_input_acl_intfc (vlib_main_t * vm, u32 sw_if_index, |
| u32 ip4_table_index, |
| u32 ip6_table_index, |
| u32 l2_table_index, u32 is_add) |
| { |
| input_acl_main_t * am = &input_acl_main; |
| vnet_classify_main_t * vcm = am->vnet_classify_main; |
| u32 acl[INPUT_ACL_N_TABLES] = {ip4_table_index, ip6_table_index, |
| l2_table_index}; |
| u32 ti; |
| |
| /* Assume that we've validated sw_if_index in the API layer */ |
| |
| for (ti = 0; ti < INPUT_ACL_N_TABLES; ti++) |
| { |
| if (acl[ti] == ~0) |
| continue; |
| |
| if (pool_is_free_index (vcm->tables, acl[ti])) |
| return VNET_API_ERROR_NO_SUCH_TABLE; |
| |
| vec_validate_init_empty |
| (am->classify_table_index_by_sw_if_index[ti], sw_if_index, ~0); |
| |
| /* Reject any DEL operation with wrong sw_if_index */ |
| if (!is_add && |
| (acl[ti] != am->classify_table_index_by_sw_if_index[ti][sw_if_index])) |
| { |
| clib_warning ("Non-existent intf_idx=%d with table_index=%d for delete", |
| sw_if_index, acl[ti]); |
| return VNET_API_ERROR_NO_SUCH_TABLE; |
| } |
| |
| /* Return ok on ADD operaton if feature is already enabled */ |
| if (is_add && |
| am->classify_table_index_by_sw_if_index[ti][sw_if_index] != ~0) |
| return 0; |
| |
| vnet_inacl_ip_feature_enable (vm, am, sw_if_index, ti, is_add); |
| |
| if (is_add) |
| am->classify_table_index_by_sw_if_index[ti][sw_if_index] = acl[ti]; |
| else |
| am->classify_table_index_by_sw_if_index[ti][sw_if_index] = ~0; |
| } |
| |
| return 0; |
| } |
| |
| static clib_error_t * |
| set_input_acl_command_fn (vlib_main_t * vm, |
| unformat_input_t * input, |
| vlib_cli_command_t * cmd) |
| { |
| vnet_main_t * vnm = vnet_get_main(); |
| u32 sw_if_index = ~0; |
| u32 ip4_table_index = ~0; |
| u32 ip6_table_index = ~0; |
| u32 l2_table_index = ~0; |
| u32 is_add = 1; |
| u32 idx_cnt = 0; |
| int rv; |
| |
| while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| { |
| if (unformat (input, "intfc %U", unformat_vnet_sw_interface, |
| vnm, &sw_if_index)) |
| ; |
| else if (unformat (input, "ip4-table %d", &ip4_table_index)) |
| idx_cnt++; |
| else if (unformat (input, "ip6-table %d", &ip6_table_index)) |
| idx_cnt++; |
| else if (unformat (input, "l2-table %d", &l2_table_index)) |
| idx_cnt++; |
| else if (unformat (input, "del")) |
| is_add = 0; |
| else |
| break; |
| } |
| |
| if (sw_if_index == ~0) |
| return clib_error_return (0, "Interface must be specified."); |
| |
| if (!idx_cnt) |
| return clib_error_return (0, "Table index should be specified."); |
| |
| if (idx_cnt > 1) |
| return clib_error_return (0, "Only one table index per API is allowed."); |
| |
| rv = vnet_set_input_acl_intfc (vm, sw_if_index, ip4_table_index, |
| ip6_table_index, l2_table_index, is_add); |
| |
| switch (rv) |
| { |
| case 0: |
| break; |
| |
| case VNET_API_ERROR_NO_MATCHING_INTERFACE: |
| return clib_error_return (0, "No such interface"); |
| |
| case VNET_API_ERROR_NO_SUCH_ENTRY: |
| return clib_error_return (0, "No such classifier table"); |
| } |
| return 0; |
| } |
| |
| /* |
| * Configure interface to enable/disble input ACL feature: |
| * intfc - interface name to be configured as input ACL |
| * Ip4-table <index> [del] - enable/disable IP4 input ACL |
| * Ip6-table <index> [del] - enable/disable IP6 input ACL |
| * l2-table <index> [del] - enable/disable Layer2 input ACL |
| * |
| * Note: Only one table index per API call is allowed. |
| * |
| */ |
| VLIB_CLI_COMMAND (set_input_acl_command, static) = { |
| .path = "set interface input acl", |
| .short_help = |
| "set interface input acl intfc <int> [ip4-table <index>]\n" |
| " [ip6-table <index>] [l2-table <index>] [del]", |
| .function = set_input_acl_command_fn, |
| }; |
| |
| clib_error_t *input_acl_init (vlib_main_t *vm) |
| { |
| input_acl_main_t * am = &input_acl_main; |
| clib_error_t * error = 0; |
| |
| if ((error = vlib_call_init_function (vm, ip_inacl_init))) |
| return error; |
| |
| am->vlib_main = vm; |
| am->vnet_main = vnet_get_main(); |
| am->vnet_classify_main = &vnet_classify_main; |
| |
| return 0; |
| } |
| |
| VLIB_INIT_FUNCTION (input_acl_init); |
| |
| uword unformat_acl_type (unformat_input_t * input, va_list * args) |
| { |
| u32 * acl_type = va_arg (*args, u32 *); |
| u32 tid = INPUT_ACL_N_TABLES; |
| |
| while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) { |
| if (unformat (input, "ip4")) |
| tid = INPUT_ACL_TABLE_IP4; |
| else if (unformat (input, "ip6")) |
| tid = INPUT_ACL_TABLE_IP6; |
| else if (unformat (input, "l2")) |
| tid = INPUT_ACL_TABLE_L2; |
| else |
| break; |
| } |
| |
| *acl_type = tid; |
| return 1; |
| } |
| |
| u8 * format_vnet_inacl_info (u8 * s, va_list * va) |
| { |
| input_acl_main_t * am = va_arg (*va, input_acl_main_t *); |
| int sw_if_idx = va_arg (*va, int); |
| u32 tid = va_arg (*va, u32); |
| |
| if (tid == ~0) |
| { |
| s = format (s, "%10s%20s\t\t%s", "Intfc idx", "Classify table", |
| "Interface name"); |
| return s; |
| } |
| |
| s = format (s, "%10d%20d\t\t%U", sw_if_idx, tid, |
| format_vnet_sw_if_index_name, am->vnet_main, sw_if_idx); |
| |
| return s; |
| } |
| |
| static clib_error_t * |
| show_inacl_command_fn (vlib_main_t * vm, |
| unformat_input_t * input, |
| vlib_cli_command_t * cmd) |
| { |
| input_acl_main_t * am = &input_acl_main; |
| u32 type = INPUT_ACL_N_TABLES; |
| int i; |
| u32 * vec_tbl; |
| |
| while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| { |
| if (unformat (input, "type %U", unformat_acl_type, &type)) |
| ; |
| else |
| break; |
| } |
| |
| if (type == INPUT_ACL_N_TABLES) |
| return clib_error_return (0, "Invalid input ACL table type."); |
| |
| vec_tbl = am->classify_table_index_by_sw_if_index[type]; |
| |
| if (vec_len(vec_tbl)) |
| vlib_cli_output (vm, "%U", format_vnet_inacl_info, am, ~0 /* hdr */, ~0); |
| else |
| vlib_cli_output (vm, "No input ACL tables configured"); |
| |
| for (i = 0; i < vec_len (vec_tbl); i++) |
| { |
| if (vec_elt(vec_tbl, i) == ~0) |
| continue; |
| |
| vlib_cli_output (vm, "%U", format_vnet_inacl_info, |
| am, i, vec_elt(vec_tbl, i)); |
| } |
| |
| return 0; |
| } |
| |
| VLIB_CLI_COMMAND (show_inacl_command, static) = { |
| .path = "show inacl", |
| .short_help = "show inacl type [ip4|ip6|l2]", |
| .function = show_inacl_command_fn, |
| }; |