On Fri, Dec 8, 2017 at 12:55 PM, Jon Loeliger <j...@netgate.com> wrote: > > > >> We need to iterate the am->macip_acl_by_sw_if_index and for interfaces >> which have the acl in question applied, reapply these new tables to these >> interfaces so the already active macip acl remained active. >> > > Ah, I see.... >
I'm not convinced this is the issue. I added that loop, and it doesn't change things. Specifically, a->ip4_table_index is 0, not 3 after the creation of the classify tables. So, here is sort of a trace through some key places of the classify table construction. It follows the API sequence I outlined in an earlier message (create MACIP with one permit rule, then bind to interface, then modify that MACIP's rule to deny and update it using macip_acl_add_replace). I'll annotate this some. Here is the initial creation of the classify tables: macip_acl_add_list: looks like a create macip_create_classify_tables: top a->count 1 macip_create_classify_tables: last_table before 4294967295 Now we create the rules in reverse order: macip_create_classify_tables: ARP looop top macip_create_classify_tables: ARP loop last_table 0 macip_create_classify_tables: IP[46] loop top macip_create_classify_tables: IP[46] loop last_table 1 macip_create_classify_tables: IP[46] loop last_table 2 macip_create_classify_tables: IP[46] loop last_table 3 macip_create_classify_tables: ip4_t_i 3 macip_create_classify_tables: ip6_t_i 3 macip_create_classify_tables: l2_t_i 3 That leaves last_table at 3, the most recently created rule, with a chain from 0 through 3: vpp# show classify tables TableIdx Sessions NextTbl NextNode 0 1 1 -1 Heap: 3 objects, 204 of 2k used, 76 free, 0 reclaimed, 1k overhead, 8188k capacity nbuckets 32, skip 0 match 2 flag 0 offset 0 mask 000000000000000000000000ffff000000000000000000000000000000000000 linear-search buckets 0 1 1 2 -1 Heap: 3 objects, 204 of 2k used, 76 free, 0 reclaimed, 1k overhead, 8188k capacity nbuckets 32, skip 0 match 2 flag 0 offset 0 mask 000000000000000000000000ffff0000ffff0000000000000000000000000000 linear-search buckets 0 2 1 3 -1 Heap: 3 objects, 236 of 2k used, 76 free, 0 reclaimed, 1k overhead, 8188k capacity nbuckets 32, skip 0 match 3 flag 0 offset 0 mask 00000000: 000000000000000000000000ffff0000ffff0000ffff00000000000000000000 00000020: 00000000000000000000000000000000 linear-search buckets 0 3 1 -1 0 Heap: 3 objects, 204 of 2k used, 76 free, 0 reclaimed, 1k overhead, 8188k capacity nbuckets 32, skip 0 match 2 flag 0 offset 0 mask 000000000000000000000000ffff000000000000000000000000000000000000 Now I bind that MACIP to the interface, and get: vpp# show acl-plugin macip interface sw_if_index 0: -1 sw_if_index 1: 0 vpp# show acl-plugin macip acl MACIP acl_index: 0, count: 1 (true len 1) tag {bob} is free pool slot: 0 ip4_table_index 3, ip6_table_index 3, l2_table_index 3 rule 0: ipv4 action 1 ip 0.0.0.0/0 mac 00:00:00:00:00:00 mask 00:00:00:00:00:00 Now I update the MACIP rule, changing "permit" to "deny". And I call macip_acl_add_replace(): macip_acl_add_list: replacing ACLs now, acl_list_index is 0 macip_acl_interface_add_acl: macip_acl_index 0 macip_acl_add_list: looks like a replace macip_create_classify_tables: top a->count 1 macip_create_classify_tables: last_table before 4294967295 That's just like before. Good. And now we count down the existing matching rules: macip_create_classify_tables: ARP looop top macip_create_classify_tables: ARP loop last_table 3 macip_create_classify_tables: IP[46] loop top macip_create_classify_tables: IP[46] loop last_table 2 macip_create_classify_tables: IP[46] loop last_table 1 macip_create_classify_tables: IP[46] loop last_table 0 And leave last_table at 0. Which we then store in the {ip4,ip6,l2}_table_index variables: macip_create_classify_tables: ip4_t_i 0 macip_create_classify_tables: ip6_t_i 0 macip_create_classify_tables: l2_t_i 0 This is my loop added to the bottom of macip_acl_add_list(): for (i = 0; i < vec_len (am->macip_acl_by_sw_if_index); i++) { vlib_cli_output (vm, "%s: check swif %d\n", __func__, i); if (am->macip_acl_by_sw_if_index[i] == *acl_list_index) { vlib_cli_output (vm, "%s: re-add acl_list_index %d\n", __func__, *acl\ _list_index); macip_acl_interface_add_acl (am, i, *acl_list_index); } } macip_acl_add_list: replacing ACLs now, acl_list_index is 0 macip_acl_add_list: check swif 0 macip_acl_add_list: check swif 1 macip_acl_add_list: re-add acl_list_index 0 macip_acl_interface_add_acl: macip_acl_index 0 So the MACIP ACL is applied to the SW IF, I believe, but the MACIP ACL itself appears to be pointing to the wrong end of the classify table chain in either the "create" case, or in the "replace" case. But I think they should be the same. HTH, jdl
_______________________________________________ vpp-dev mailing list vpp-dev@lists.fd.io https://lists.fd.io/mailman/listinfo/vpp-dev