Hi,
Can L3 ACL work with inner packet of VxLAN? I found it miss at ip4/6-inacl.
Topo: host-lan1 -> BD(vxlan_tunnel0 -> loop0[bvi]) -> host-wan1
Version: 17.10
Issue: When classifier apply to loop0 interface, L3 ACL(ip4/6-inacl) miss if
the packet come from a vxlan_tunnel0 interface. But it hit if packet come from
host-lan1 directly.
CMD:
# For IPv4
sudo vppctl classify table mask l3 ip4 dst buckets 2 miss-next 0 table
4294967295 next-table 4294967295
# For IPv6
sudo vppctl classify table mask l3 ip6 dst buckets 2 miss-next 4294967295 table
4294967295 next-table 4294967295
# For IPv4
sudo vppctl classify session hit-next 4294967295 table-index 0 match l3 ip4 dst
192.168.20.22 action set-ip4-fib-id 200
sudo vppctl classify session hit-next 4294967295 table-index 0 match l3 ip4 dst
192.168.30.22 action set-ip4-fib-id 201
# For IPv6
sudo vppctl classify session hit-next 4294967295 table-index 1 match l3 ip6 dst
2002:1::2 action set-ip6-fib-id 200
sudo vppctl classify session hit-next 4294967295 table-index 1 match l3 ip6 dst
2003:1::2 action set-ip6-fib-id 201
sudo vppctl set interface input acl intfc loop0 ip4-table 0
sudo vppctl set interface input acl intfc loop0 ip6-table 1
Trace:
Packet 1
02:38:25:074644: af-packet-input
af_packet: hw_if_index 1 next-index 4
tpacket2_hdr:
status 0x20000001 len 148 snaplen 148 mac 66 net 80
sec 0x5a40cb35 nsec 0x2b2c3a54 vlan 0 vlan_tpid 0
02:38:25:074682: ethernet-input
IP4: 8a:dd:c1:3b:4a:f4 -> 02:fe:d2:18:c7:99
02:38:25:074725: ip4-input
UDP: 192.168.10.10 -> 192.168.10.9
tos 0x00, ttl 64, length 134, checksum 0xeb3b
fragment id 0xf9c7
UDP: 39785 -> 4789
length 114, checksum 0x0000
02:38:25:074772: ip4-lookup
fib 0 dpo-idx 22 flow hash: 0x00000000
UDP: 192.168.10.10 -> 192.168.10.9
tos 0x00, ttl 64, length 134, checksum 0xeb3b
fragment id 0xf9c7
UDP: 39785 -> 4789
length 114, checksum 0x0000
02:38:25:074804: ip4-local
UDP: 192.168.10.10 -> 192.168.10.9
tos 0x00, ttl 64, length 134, checksum 0xeb3b
fragment id 0xf9c7
UDP: 39785 -> 4789
length 114, checksum 0x0000
02:38:25:074830: ip4-udp-lookup
UDP: src-port 39785 dst-port 4789
02:38:25:074837: vxlan4-input
VXLAN decap from vxlan_tunnel0 vni 101 next 1 error 0
02:38:25:074845: l2-input
l2-input: sw_if_index 7 dst de:ad:00:00:00:00 src b6:0c:fa:57:f9:d2
02:38:25:074880: l2-learn
l2-learn: sw_if_index 7 dst de:ad:00:00:00:00 src b6:0c:fa:57:f9:d2 bd_index 1
02:38:25:074892: l2-fwd
l2-fwd: sw_if_index 7 dst de:ad:00:00:00:00 src b6:0c:fa:57:f9:d2 bd_index 1
02:38:25:074900: ip4-input
ICMP: 192.168.1.2 -> 192.168.20.22
tos 0x00, ttl 64, length 84, checksum 0x6c61
fragment id 0x37df, flags DONT_FRAGMENT
ICMP echo_request checksum 0x3314
02:38:25:074907: ip4-inacl
INACL: sw_if_index 5, next_index 0, table 0, offset -1
02:38:25:074919: error-drop
ip4-input: input ACL table-miss drops
vpp# sh classify table verbose
TableIdx Sessions NextTbl NextNode
0 2 -1 0
Heap: 4 objects, 332 of 2k used, 124 free, 0 reclaimed, 1k overhead, 2044k
capacity
nbuckets 2, skip 1 match 2 flag 0 offset 0
mask 0000000000000000000000000000ffffffff0000000000000000000000000000
linear-search buckets 0
[0]: heap offset 384, elts 2, normal
0: [384]: next_index -1 advance 0 opaque -1 action 1 metadata 2
k: 0000000000000000000000000000c0a81e160000000000000000000000000000
hits 0, last_heard 0.00
[1]: heap offset 192, elts 2, normal
0: [192]: next_index -1 advance 0 opaque -1 action 1 metadata 1
k: 0000000000000000000000000000c0a814160000000000000000000000000000
hits 0, last_heard 0.00
2 active elements
1 free lists
0 linear-search buckets
1 2 -1 -1
Heap: 6 objects, 352 of 2k used, 96 free, 0 reclaimed, 1k overhead, 2044k
capacity
nbuckets 2, skip 2 match 2 flag 0 offset 0
mask 000000000000ffffffffffffffffffffffffffffffff00000000000000000000
linear-search buckets 0
[1]: heap offset 192, elts 2, normal
0: [192]: next_index -1 advance 0 opaque -1 action 2 metadata 1
k: 0000000000002002000100000000000000000000000200000000000000000000
hits 0, last_heard 0.00
1: [256]: next_index -1 advance 0 opaque -1 action 2 metadata 2
k: 0000000000002003000100000000000000000000000200000000000000000000
hits 0, last_heard 0.00
2 active elements
1 free lists
0 linear-search buckets
BR,xliao
_______________________________________________
vpp-dev mailing list
vpp-dev@lists.fd.io
https://lists.fd.io/mailman/listinfo/vpp-dev
