Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2016 Cisco and/or its affiliates. |
| 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
| 15 | #include <vnet/cop/cop.h> |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 16 | #include <vnet/fib/ip6_fib.h> |
| 17 | #include <vnet/dpo/load_balance.h> |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 18 | |
| 19 | typedef struct { |
| 20 | u32 next_index; |
| 21 | u32 sw_if_index; |
| 22 | } ip6_cop_whitelist_trace_t; |
| 23 | |
| 24 | /* packet trace format function */ |
| 25 | static u8 * format_ip6_cop_whitelist_trace (u8 * s, va_list * args) |
| 26 | { |
| 27 | CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); |
| 28 | CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); |
| 29 | ip6_cop_whitelist_trace_t * t = va_arg (*args, ip6_cop_whitelist_trace_t *); |
| 30 | |
| 31 | s = format (s, "IP6_COP_WHITELIST: sw_if_index %d, next index %d", |
| 32 | t->sw_if_index, t->next_index); |
| 33 | return s; |
| 34 | } |
| 35 | |
| 36 | vlib_node_registration_t ip6_cop_whitelist_node; |
| 37 | |
| 38 | #define foreach_ip6_cop_whitelist_error \ |
| 39 | _(DROPPED, "ip6 cop whitelist packets dropped") |
| 40 | |
| 41 | typedef enum { |
| 42 | #define _(sym,str) IP6_COP_WHITELIST_ERROR_##sym, |
| 43 | foreach_ip6_cop_whitelist_error |
| 44 | #undef _ |
| 45 | IP6_COP_WHITELIST_N_ERROR, |
| 46 | } ip6_cop_whitelist_error_t; |
| 47 | |
| 48 | static char * ip6_cop_whitelist_error_strings[] = { |
| 49 | #define _(sym,string) string, |
| 50 | foreach_ip6_cop_whitelist_error |
| 51 | #undef _ |
| 52 | }; |
| 53 | |
| 54 | static uword |
| 55 | ip6_cop_whitelist_node_fn (vlib_main_t * vm, |
| 56 | vlib_node_runtime_t * node, |
| 57 | vlib_frame_t * frame) |
| 58 | { |
| 59 | u32 n_left_from, * from, * to_next; |
| 60 | cop_feature_type_t next_index; |
| 61 | cop_main_t *cm = &cop_main; |
| 62 | ip6_main_t * im6 = &ip6_main; |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 63 | vlib_combined_counter_main_t * vcm = &load_balance_main.lbm_via_counters; |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 64 | u32 cpu_index = vm->cpu_index; |
| 65 | |
| 66 | from = vlib_frame_vector_args (frame); |
| 67 | n_left_from = frame->n_vectors; |
| 68 | next_index = node->cached_next_index; |
| 69 | |
| 70 | while (n_left_from > 0) |
| 71 | { |
| 72 | u32 n_left_to_next; |
| 73 | |
| 74 | vlib_get_next_frame (vm, node, next_index, |
| 75 | to_next, n_left_to_next); |
| 76 | |
| 77 | while (n_left_from >= 4 && n_left_to_next >= 2) |
| 78 | { |
| 79 | u32 bi0, bi1; |
| 80 | vlib_buffer_t * b0, * b1; |
| 81 | u32 next0, next1; |
| 82 | u32 sw_if_index0, sw_if_index1; |
| 83 | ip6_header_t * ip0, * ip1; |
| 84 | cop_config_main_t * ccm0, * ccm1; |
| 85 | cop_config_data_t * c0, * c1; |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 86 | u32 lb_index0, lb_index1; |
| 87 | const load_balance_t * lb0, *lb1; |
| 88 | const dpo_id_t *dpo0, *dpo1; |
| 89 | |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 90 | /* Prefetch next iteration. */ |
| 91 | { |
| 92 | vlib_buffer_t * p2, * p3; |
| 93 | |
| 94 | p2 = vlib_get_buffer (vm, from[2]); |
| 95 | p3 = vlib_get_buffer (vm, from[3]); |
| 96 | |
| 97 | vlib_prefetch_buffer_header (p2, LOAD); |
| 98 | vlib_prefetch_buffer_header (p3, LOAD); |
| 99 | |
| 100 | CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, STORE); |
| 101 | CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, STORE); |
| 102 | } |
| 103 | |
| 104 | /* speculatively enqueue b0 and b1 to the current next frame */ |
| 105 | to_next[0] = bi0 = from[0]; |
| 106 | to_next[1] = bi1 = from[1]; |
| 107 | from += 2; |
| 108 | to_next += 2; |
| 109 | n_left_from -= 2; |
| 110 | n_left_to_next -= 2; |
| 111 | |
| 112 | b0 = vlib_get_buffer (vm, bi0); |
| 113 | sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX]; |
| 114 | |
| 115 | ip0 = vlib_buffer_get_current (b0); |
| 116 | |
| 117 | ccm0 = cm->cop_config_mains + VNET_COP_IP6; |
| 118 | |
| 119 | c0 = vnet_get_config_data |
| 120 | (&ccm0->config_main, |
| 121 | &vnet_buffer (b0)->cop.current_config_index, |
| 122 | &next0, |
| 123 | sizeof (c0[0])); |
| 124 | |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 125 | lb_index0 = ip6_fib_table_fwding_lookup (im6, c0->fib_index, |
| 126 | &ip0->src_address); |
| 127 | lb0 = load_balance_get (lb_index0); |
| 128 | dpo0 = load_balance_get_bucket_i(lb0, 0); |
| 129 | |
| 130 | if (PREDICT_FALSE(dpo0->dpoi_type != DPO_RECEIVE)) |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 131 | { |
| 132 | b0->error = node->errors[IP6_COP_WHITELIST_ERROR_DROPPED]; |
| 133 | next0 = RX_COP_DROP; |
| 134 | } |
| 135 | |
| 136 | b1 = vlib_get_buffer (vm, bi1); |
| 137 | sw_if_index1 = vnet_buffer(b1)->sw_if_index[VLIB_RX]; |
| 138 | |
| 139 | ip1 = vlib_buffer_get_current (b1); |
| 140 | |
| 141 | ccm1 = cm->cop_config_mains + VNET_COP_IP6; |
| 142 | |
| 143 | c1 = vnet_get_config_data |
| 144 | (&ccm1->config_main, |
| 145 | &vnet_buffer (b1)->cop.current_config_index, |
| 146 | &next1, |
| 147 | sizeof (c1[0])); |
| 148 | |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 149 | lb_index1 = ip6_fib_table_fwding_lookup (im6, c1->fib_index, |
| 150 | &ip1->src_address); |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 151 | |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 152 | lb1 = load_balance_get (lb_index1); |
| 153 | dpo1 = load_balance_get_bucket_i(lb1, 0); |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 154 | |
| 155 | vlib_increment_combined_counter |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 156 | (vcm, cpu_index, lb_index0, 1, |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 157 | vlib_buffer_length_in_chain (vm, b0) |
| 158 | + sizeof(ethernet_header_t)); |
| 159 | |
| 160 | vlib_increment_combined_counter |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 161 | (vcm, cpu_index, lb_index1, 1, |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 162 | vlib_buffer_length_in_chain (vm, b1) |
| 163 | + sizeof(ethernet_header_t)); |
| 164 | |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 165 | if (PREDICT_FALSE(dpo1->dpoi_type != DPO_RECEIVE)) |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 166 | { |
| 167 | b1->error = node->errors[IP6_COP_WHITELIST_ERROR_DROPPED]; |
| 168 | next1 = RX_COP_DROP; |
| 169 | } |
| 170 | |
| 171 | if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE) |
| 172 | && (b0->flags & VLIB_BUFFER_IS_TRACED))) |
| 173 | { |
| 174 | ip6_cop_whitelist_trace_t *t = |
| 175 | vlib_add_trace (vm, node, b0, sizeof (*t)); |
| 176 | t->sw_if_index = sw_if_index0; |
| 177 | t->next_index = next0; |
| 178 | } |
| 179 | |
| 180 | if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE) |
| 181 | && (b1->flags & VLIB_BUFFER_IS_TRACED))) |
| 182 | { |
| 183 | ip6_cop_whitelist_trace_t *t = |
| 184 | vlib_add_trace (vm, node, b1, sizeof (*t)); |
| 185 | t->sw_if_index = sw_if_index1; |
| 186 | t->next_index = next1; |
| 187 | } |
| 188 | |
| 189 | /* verify speculative enqueues, maybe switch current next frame */ |
| 190 | vlib_validate_buffer_enqueue_x2 (vm, node, next_index, |
| 191 | to_next, n_left_to_next, |
| 192 | bi0, bi1, next0, next1); |
| 193 | } |
| 194 | |
| 195 | while (n_left_from > 0 && n_left_to_next > 0) |
| 196 | { |
| 197 | u32 bi0; |
| 198 | vlib_buffer_t * b0; |
| 199 | u32 next0; |
| 200 | u32 sw_if_index0; |
| 201 | ip6_header_t * ip0; |
| 202 | cop_config_main_t *ccm0; |
| 203 | cop_config_data_t *c0; |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 204 | u32 lb_index0; |
| 205 | const load_balance_t * lb0; |
| 206 | const dpo_id_t *dpo0; |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 207 | |
| 208 | /* speculatively enqueue b0 to the current next frame */ |
| 209 | bi0 = from[0]; |
| 210 | to_next[0] = bi0; |
| 211 | from += 1; |
| 212 | to_next += 1; |
| 213 | n_left_from -= 1; |
| 214 | n_left_to_next -= 1; |
| 215 | |
| 216 | b0 = vlib_get_buffer (vm, bi0); |
| 217 | sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX]; |
| 218 | |
| 219 | ip0 = vlib_buffer_get_current (b0); |
| 220 | |
| 221 | ccm0 = cm->cop_config_mains + VNET_COP_IP6; |
| 222 | |
| 223 | c0 = vnet_get_config_data |
| 224 | (&ccm0->config_main, |
| 225 | &vnet_buffer (b0)->cop.current_config_index, |
| 226 | &next0, |
| 227 | sizeof (c0[0])); |
| 228 | |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 229 | lb_index0 = ip6_fib_table_fwding_lookup (im6, c0->fib_index, |
| 230 | &ip0->src_address); |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 231 | |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 232 | lb0 = load_balance_get (lb_index0); |
| 233 | dpo0 = load_balance_get_bucket_i(lb0, 0); |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 234 | |
| 235 | vlib_increment_combined_counter |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 236 | (vcm, cpu_index, lb_index0, 1, |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 237 | vlib_buffer_length_in_chain (vm, b0) |
| 238 | + sizeof(ethernet_header_t)); |
| 239 | |
Neale Ranns | 0bfe5d8 | 2016-08-25 15:29:12 +0100 | [diff] [blame] | 240 | if (PREDICT_FALSE(dpo0->dpoi_type != DPO_RECEIVE)) |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 241 | { |
| 242 | b0->error = node->errors[IP6_COP_WHITELIST_ERROR_DROPPED]; |
| 243 | next0 = RX_COP_DROP; |
| 244 | } |
| 245 | |
| 246 | if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE) |
| 247 | && (b0->flags & VLIB_BUFFER_IS_TRACED))) |
| 248 | { |
| 249 | ip6_cop_whitelist_trace_t *t = |
| 250 | vlib_add_trace (vm, node, b0, sizeof (*t)); |
| 251 | t->sw_if_index = sw_if_index0; |
| 252 | t->next_index = next0; |
| 253 | } |
| 254 | |
| 255 | /* verify speculative enqueue, maybe switch current next frame */ |
| 256 | vlib_validate_buffer_enqueue_x1 (vm, node, next_index, |
| 257 | to_next, n_left_to_next, |
| 258 | bi0, next0); |
| 259 | } |
| 260 | |
| 261 | vlib_put_next_frame (vm, node, next_index, n_left_to_next); |
| 262 | } |
| 263 | return frame->n_vectors; |
| 264 | } |
| 265 | |
| 266 | VLIB_REGISTER_NODE (ip6_cop_whitelist_node) = { |
| 267 | .function = ip6_cop_whitelist_node_fn, |
| 268 | .name = "ip6-cop-whitelist", |
| 269 | .vector_size = sizeof (u32), |
| 270 | .format_trace = format_ip6_cop_whitelist_trace, |
| 271 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 272 | |
| 273 | .n_errors = ARRAY_LEN(ip6_cop_whitelist_error_strings), |
| 274 | .error_strings = ip6_cop_whitelist_error_strings, |
| 275 | |
| 276 | .n_next_nodes = COP_RX_N_FEATURES, |
| 277 | |
| 278 | /* edit / add dispositions here */ |
| 279 | .next_nodes = { |
| 280 | [IP4_RX_COP_WHITELIST] = "ip4-cop-whitelist", |
| 281 | [IP6_RX_COP_WHITELIST] = "ip6-cop-whitelist", |
| 282 | [DEFAULT_RX_COP_WHITELIST] = "default-cop-whitelist", |
| 283 | [IP4_RX_COP_INPUT] = "ip4-input", |
| 284 | [IP6_RX_COP_INPUT] = "ip6-input", |
| 285 | [DEFAULT_RX_COP_INPUT] = "ethernet-input", |
| 286 | [RX_COP_DROP] = "error-drop", |
| 287 | }, |
| 288 | }; |
| 289 | |
Damjan Marion | 1c80e83 | 2016-05-11 23:07:18 +0200 | [diff] [blame] | 290 | VLIB_NODE_FUNCTION_MULTIARCH (ip6_cop_whitelist_node, ip6_cop_whitelist_node_fn) |
| 291 | |
Dave Barach | c07bf5d | 2016-02-17 17:52:26 -0500 | [diff] [blame] | 292 | static clib_error_t * |
| 293 | ip6_whitelist_init (vlib_main_t * vm) |
| 294 | { |
| 295 | return 0; |
| 296 | } |
| 297 | |
| 298 | VLIB_INIT_FUNCTION (ip6_whitelist_init); |