acl.h (12726B)
1 /* 2 * 3 * This license is set out in https://raw.githubusercontent.com/Broadcom-Network-Switching-Software/OpenBCM/master/Legal/LICENSE file. 4 * 5 * Copyright 2007-2019 Broadcom Inc. All rights reserved. 6 * 7 * File: acl.h 8 * 9 * Purpose: 10 * Access Control Lists (ACL) Macros, type definitions, 11 * and API prototypes. 12 */ 13 14 #ifndef _ACL_H_ 15 #define _ACL_H_ 16 17 #if defined(INCLUDE_ACL) 18 19 #include <bcm/types.h> 20 #include <bcmx/lport.h> 21 #include <bcmx/lplist.h> 22 23 /* 24 * Macros: BCMA_ACL_ACTION_xxx 25 * 26 * Purpose: 27 * Action flags to be performed in response to matches. These flags are 28 * part of bcma_acl_action_t. 29 * 30 * Actions: 31 * PERMIT - Allow packet to be switched 32 * DENY - Drop matching packet 33 * REDIR - Redirect packet to an alternative port 34 * MIRROR - Copy packet to mirror port 35 * LOG - Send copy of packet to CPU 36 */ 37 #define BCMA_ACL_ACTION_PERMIT (1 << 0) 38 #define BCMA_ACL_ACTION_DENY (1 << 1) 39 #define BCMA_ACL_ACTION_REDIR (1 << 2) 40 #define BCMA_ACL_ACTION_MIRROR (1 << 3) 41 #define BCMA_ACL_ACTION_LOG (1 << 4) 42 43 typedef int bcma_acl_list_id_t; 44 typedef int bcma_acl_rule_id_t; 45 46 /* 47 * Typedef: bcma_acl_action_t 48 * 49 * Purpose: 50 * Actions to be performed on when packet meets matching criteria. 51 */ 52 53 typedef struct bcma_acl_action_s { 54 uint16 flags; /* BCMA_ACL_ACTION_XXX */ 55 56 /* Module/port parameters for redirection and mirroring */ 57 bcmx_lport_t redir_port; 58 bcmx_lport_t mirror_port; 59 60 } bcma_acl_action_t; 61 62 typedef uint8 bcma_acl_ip_protocol_t; 63 64 /* Values for bcma_acl_ip_protocol_t from RFC 1700. */ 65 #define BCMA_ACL_IPPROTO_HOPBYHOP 0 /* IPv6 Hop-by-Hop option */ 66 #define BCMA_ACL_IPPROTO_ICMP 1 /* Internet Control Message*/ 67 #define BCMA_ACL_IPPROTO_IGMP 2 /* Internet Group Management*/ 68 #define BCMA_ACL_IPPROTO_GGP 3 /* Gateway-to-Gateway */ 69 #define BCMA_ACL_IPPROTO_IP 4 /* IP in IP (encasulation) */ 70 #define BCMA_ACL_IPPROTO_ST 5 /* Stream */ 71 #define BCMA_ACL_IPPROTO_TCP 6 /* Transmission Control */ 72 #define BCMA_ACL_IPPROTO_UCL 7 /* UCL */ 73 #define BCMA_ACL_IPPROTO_EGP 8 /* Exterior Gateway Protocol */ 74 #define BCMA_ACL_IPPROTO_IGP 9 /* any private interior gateway */ 75 #define BCMA_ACL_IPPROTO_BBN_RCC_MON 10 /* BBN RCC Monitoring */ 76 #define BCMA_ACL_IPPROTO_NVP_II 11 /* Network Voice Protocol */ 77 #define BCMA_ACL_IPPROTO_PUP 12 /* PUP */ 78 #define BCMA_ACL_IPPROTO_ARGUS 13 /* ARGUS */ 79 #define BCMA_ACL_IPPROTO_EMCON 14 /* EMCON */ 80 #define BCMA_ACL_IPPROTO_XNET 15 /* Cross Net Debugger */ 81 #define BCMA_ACL_IPPROTO_CHAOS 16 /* Chaos */ 82 #define BCMA_ACL_IPPROTO_UDP 17 /* User Datagram */ 83 #define BCMA_ACL_IPPROTO_MUX 18 /* Multiplexing */ 84 #define BCMA_ACL_IPPROTO_DCN_MEAS 19 /* DCN Measurement Subsystems */ 85 #define BCMA_ACL_IPPROTO_HMP 20 /* Host Monitoring */ 86 #define BCMA_ACL_IPPROTO_PRM 21 /* Packet Radio Measurement */ 87 #define BCMA_ACL_IPPROTO_XNS_IDP 22 /* XEROX NS IDP */ 88 #define BCMA_ACL_IPPROTO_TRUNK_1 23 /* Trunk-1 */ 89 #define BCMA_ACL_IPPROTO_TRUNK_2 24 /* Trunk-2 */ 90 #define BCMA_ACL_IPPROTO_LEAF_1 25 /* Leaf-1 */ 91 #define BCMA_ACL_IPPROTO_LEAF_2 26 /* Leaf-2 */ 92 #define BCMA_ACL_IPPROTO_RDP 27 /* Reliable Data Protocol */ 93 #define BCMA_ACL_IPPROTO_IRTP 28 /* Internet Reliable Transaction */ 94 #define BCMA_ACL_IPPROTO_ISO_TP4 29 /* ISO Transport Protocol Class 4 */ 95 #define BCMA_ACL_IPPROTO_NETBLT 30 /* Bulk Data Transfer Protocol */ 96 #define BCMA_ACL_IPPROTO_MFE_NSP 31 /* MFE Network Services Protocol */ 97 #define BCMA_ACL_IPPROTO_MERIT_INP 32 /* MERIT Internodal Protocol */ 98 #define BCMA_ACL_IPPROTO_SEP 33 /* Sequential Exchange Protocol */ 99 #define BCMA_ACL_IPPROTO_3PC 34 /* Third Party Connect Protocol */ 100 #define BCMA_ACL_IPPROTO_IDPR 35 /* Inter-Domain Policy Routing Protocol */ 101 #define BCMA_ACL_IPPROTO_XTP 36 /* XTP */ 102 #define BCMA_ACL_IPPROTO_DDP 37 /* Datagram Delivery Protocol */ 103 #define BCMA_ACL_IPPROTO_IDPR_CMTP 38 /* IDPR Control Message Transport Proto */ 104 #define BCMA_ACL_IPPROTO_TP_P_P 39 /* TP++ Transport Protocol */ 105 #define BCMA_ACL_IPPROTO_IL 40 /* IL Transport Protocol */ 106 #define BCMA_ACL_IPPROTO_SIP 41 /* Simple Internet Protocol */ 107 #define BCMA_ACL_IPPROTO_SDRP 42 /* Source Demand Routing Protocol */ 108 #define BCMA_ACL_IPPROTO_SIP_SR 43 /* SIP Source Route */ 109 #define BCMA_ACL_IPPROTO_SIP_FRAG 44 /* SIP Fragment */ 110 #define BCMA_ACL_IPPROTO_IDRP 45 /* Inter-Domain Routing Protocol */ 111 #define BCMA_ACL_IPPROTO_RSVP 46 /* Reservation Protocol */ 112 #define BCMA_ACL_IPPROTO_GRE 47 /* General Routing Encapsulation */ 113 #define BCMA_ACL_IPPROTO_MHRP 48 /* Mobile Host Routing Protocol */ 114 #define BCMA_ACL_IPPROTO_BNA 49 /* BNA */ 115 #define BCMA_ACL_IPPROTO_SIPP_ESP 50 /* SIPP Encap Security Payload */ 116 #define BCMA_ACL_IPPROTO_SIPP_AH 51 /* SIPP Authentication Header */ 117 #define BCMA_ACL_IPPROTO_I_NLSP 52 /* Integrated Net Layer Security TUBA */ 118 #define BCMA_ACL_IPPROTO_SWIPE 53 /* IP with Encryption */ 119 #define BCMA_ACL_IPPROTO_NHRP 54 /* NBMA Next Hop Resolution Protocol */ 120 /* 55-60 Unassigned*/ 121 #define BCMA_ACL_IPPROTO_AHIP 61 /* any host internal protocol */ 122 #define BCMA_ACL_IPPROTO_CFTP 62 /* CFTP */ 123 #define BCMA_ACL_IPPROTO_HI 63 /* Host internal protocol */ 124 #define BCMA_ACL_IPPROTO_SAT_EXPAK 64 /* SATNET and Backroom EXPAK */ 125 #define BCMA_ACL_IPPROTO_KRYPTOLAN 65 /* Kryptolan */ 126 #define BCMA_ACL_IPPROTO_RVD 66 /* MIT Remote Virtual Disk Protocol */ 127 #define BCMA_ACL_IPPROTO_IPPC 67 /* Internet Pluribus Packet Core */ 128 #define BCMA_ACL_IPPROTO_ADFS 68 /* any distributed file system */ 129 #define BCMA_ACL_IPPROTO_SAT_MON 69 /* SATNET Monitoring */ 130 #define BCMA_ACL_IPPROTO_VISA 70 /* VISA Protocol */ 131 #define BCMA_ACL_IPPROTO_IPCV 71 /* Internet Packet Core Utility */ 132 #define BCMA_ACL_IPPROTO_CPNX 72 /* Computer Protocol Network Executive */ 133 #define BCMA_ACL_IPPROTO_CPHB 73 /* Computer Protocol Heart Beat */ 134 #define BCMA_ACL_IPPROTO_WSN 74 /* Wang Span Network */ 135 #define BCMA_ACL_IPPROTO_PVP 75 /* Packet Video Protocol */ 136 #define BCMA_ACL_IPPROTO_BR_SAT_MON 76 /* Backroom SATNET Monitoring */ 137 #define BCMA_ACL_IPPROTO_SUN_ND 77 /* SUN ND PROTOCOL-Temporary */ 138 #define BCMA_ACL_IPPROTO_WB_MON 78 /* WIDEBAND Monitoring */ 139 #define BCMA_ACL_IPPROTO_WB_EXPAK 79 /* WIDEBAND EXPAK */ 140 #define BCMA_ACL_IPPROTO_ISO_IP 80 /* ISO Internet Protocol */ 141 #define BCMA_ACL_IPPROTO_VMTP 81 /* VMTP */ 142 #define BCMA_ACL_IPPROTO_SECURE_VMTP 82 /* SECURE-VMTP */ 143 #define BCMA_ACL_IPPROTO_VINES 83 /* VINES */ 144 #define BCMA_ACL_IPPROTO_TTP 84 /* TTP */ 145 #define BCMA_ACL_IPPROTO_NSFNET_IGP 85 /* NSFNET-IGP */ 146 #define BCMA_ACL_IPPROTO_DGP 86 /* Dissimilar Gateway Protocol */ 147 #define BCMA_ACL_IPPROTO_TCF 87 /* TCF */ 148 #define BCMA_ACL_IPPROTO_IGRP 88 /* IGRP */ 149 #define BCMA_ACL_IPPROTO_OSPFIGP 89 /* OSPFIGP */ 150 #define BCMA_ACL_IPPROTO_SPRITE_RPC 90 /* Sprite RPC Protocol */ 151 #define BCMA_ACL_IPPROTO_LARP 91 /* Locus Address Resolution Protocol */ 152 #define BCMA_ACL_IPPROTO_MTP 92 /* Multicast Transport Protocol */ 153 #define BCMA_ACL_IPPROTO_AX_25 93 /* AX.25 Frames */ 154 #define BCMA_ACL_IPPROTO_IPIP 94 /* IP-in-IP Encapsulation Protocol */ 155 #define BCMA_ACL_IPPROTO_MICP 95 /* Mobile Internetworking Control Pro. */ 156 #define BCMA_ACL_IPPROTO_SCC_SP 96 /* Semaphore Communications Sec. Pro. */ 157 #define BCMA_ACL_IPPROTO_ETHERIP 97 /* Ethernet-within-IP Encapsulation */ 158 #define BCMA_ACL_IPPROTO_ENCAP 98 /* Encapsulation Header */ 159 #define BCMA_ACL_IPPROTO_APES 99 /* any private encryption scheme */ 160 #define BCMA_ACL_IPPROTO_GMTP 100 /* GMTP */ 161 /* 101-254 Unassigned */ 162 #define BCMA_ACL_IPPROTO_ANY 255 /* Reserved */ 163 164 165 166 #define BCMA_ACL_RULE_L4_SRC_PORT (1 << 0) 167 #define BCMA_ACL_RULE_L4_DST_PORT (1 << 1) 168 #define BCMA_ACL_RULE_SRC_MAC (1 << 2) 169 #define BCMA_ACL_RULE_DST_MAC (1 << 3) 170 #define BCMA_ACL_RULE_SRC_IP4 (1 << 4) 171 #define BCMA_ACL_RULE_DST_IP4 (1 << 5) 172 #define BCMA_ACL_RULE_SRC_IP6 (1 << 6) 173 #define BCMA_ACL_RULE_DST_IP6 (1 << 7) 174 #define BCMA_ACL_RULE_VLAN (1 << 8) 175 #define BCMA_ACL_RULE_IPPROTOCOL (1 << 9) 176 #define BCMA_ACL_RULE_ETHERTYPE (1 <<10) 177 178 /* 179 * Typedef: bcma_acl_rule_t 180 * 181 * Purpose: 182 * Set of packet matching criteria and the actions to be performed in the 183 * event of a match. 184 * 185 * Fields: 186 * bcma_acl_rule_id_t rule_id - Handle to this rule 187 * uint16 flags - see BCMA_ACL_RULE_XXX 188 * bcm_l4_port src_port_min - Minimum Layer 4 (i.e. TCP,UDP) source port 189 * bcm_l4_port src_port_min - Maximum Layer 4 (i.e. TCP,UDP) source port 190 * bcm_l4_port dst_port_min - Minimum Layer 4 (i.e. TCP,UDP) destination 191 * port 192 * bcm_l4_port dst_port_min - Maximum Layer 4 (i.e. TCP,UDP) destination 193 * port 194 * bcm_mac_t src_mac - Source MAC address 195 * bcm_mac_t dst_mac - Destination MAC address 196 * bcm_ip_t src_ip - IPv4 source IP address 197 * bcm_ip_t src_ip_mask - IPv4 source IP address mask 198 * bcm_ip_t dst_ip - IPv4 destination IP address 199 * bcm_ip_t dst_ip_mask - IPv4 destination IP address mask 200 * bcm_ip6_t src_ip - IPv6 source IP address 201 * bcm_ip6_t src_ip_mask - IPv6 source IP address mask 202 * bcm_ip6_t dst_ip - IPv6 destination IP address 203 * bcm_ip6_t dst_ip_mask - IPv6 destination IP address mask 204 * bcm_vlan_t vlan_min - Minimum VLAN to match 205 * bcm_vlan_t vlan_max - Maximum VLAN to match 206 * bcma_acl_ip_protocol ip_protocol - IP protocol (TCP, UDP, etc.) 207 * bcma_acl_action_t actions - Actions to take in response to matches 208 */ 209 typedef struct bcma_acl_rule_s { 210 bcma_acl_rule_id_t rule_id; 211 uint16 flags; 212 213 /* Pattern Matching Fields */ 214 bcm_mac_t src_mac; 215 bcm_mac_t dst_mac; 216 bcm_ip_t src_ip, src_ip_mask; 217 bcm_ip_t dst_ip, dst_ip_mask; 218 bcm_ip6_t src_ip6, src_ip6_mask; 219 bcm_ip6_t dst_ip6, dst_ip6_mask; 220 221 /* Range of VLANs */ 222 bcm_vlan_t vlan_min; 223 bcm_vlan_t vlan_max; 224 225 /* Layer 4: i.e. TCP, UDP ranges */ 226 bcm_l4_port_t src_port_min; 227 bcm_l4_port_t src_port_max; 228 bcm_l4_port_t dst_port_min; 229 bcm_l4_port_t dst_port_max; 230 231 uint16 ether_type; 232 bcma_acl_ip_protocol_t ip_protocol; 233 bcma_acl_action_t actions; 234 } bcma_acl_rule_t; 235 236 /* 237 * Typedef: bcma_acl_t 238 * 239 * Purpose: 240 * Data about an access control list. The List ID is used when adding 241 * rules to the list. 242 * 243 * Fields: 244 * bcma_acl_list_id_t lid - Handle to this ACL 245 * bcmx_lplist_t lplist - Logical port list where ACL applies 246 */ 247 typedef struct bcma_acl_s { 248 bcma_acl_list_id_t list_id; /* Unique handle to this list */ 249 bcmx_lplist_t lplist; /* Ports where list applies */ 250 int prio; /* Relative priority of list. */ 251 } bcma_acl_t; 252 253 /* Constructor and destructor for ACL module */ 254 extern int bcma_acl_init(void); 255 extern int bcma_acl_detach(void); 256 257 /* List Management functions */ 258 extern int bcma_acl_add(bcma_acl_t *list_id); 259 extern int bcma_acl_remove(bcma_acl_list_id_t list_id); 260 extern int bcma_acl_get(bcma_acl_list_id_t list_id, bcma_acl_t *list); 261 262 extern int bcma_acl_rule_add(bcma_acl_list_id_t list_id, 263 bcma_acl_rule_t *rule); 264 extern int bcma_acl_rule_remove(bcma_acl_list_id_t list_id, 265 bcma_acl_rule_id_t rule_id); 266 extern int bcma_acl_rule_get(bcma_acl_rule_id_t rule_id, 267 bcma_acl_rule_t **rule); 268 269 /* Validation and Installation functions */ 270 extern int bcma_acl_install(void); 271 extern int bcma_acl_uninstall(void); 272 273 #ifdef BROADCOM_DEBUG 274 extern int bcma_acl_show(void); 275 extern int bcma_acl_list_show(bcma_acl_list_id_t list_id); 276 extern int bcma_acl_rule_show_id(bcma_acl_rule_id_t rule_id); 277 extern int bcma_acl_rule_show(bcma_acl_rule_t *rule); 278 extern int bcma_acl_action_show(bcma_acl_action_t *action); 279 #endif /* BROADCOM_DEBUG */ 280 281 #endif /* INCLUDE_ACL */ 282 #endif /* _ACL_H_ */