Tunnel Termination ACL VPP Plugin

platform/vpp/docker-sonic-vpp/conf/startup.conf.tmpl

@@ -227,6 +227,7 @@ plugins {
 	plugin linux_nl_plugin.so { enable }
 	plugin acl_plugin.so { enable }
         plugin vxlan_plugin.so { enable }
+	plugin tunterm_acl_plugin.so { enable }
 
 	## Enable all plugins by default and then selectively disable specific plugins
 	# plugin dpdk_plugin.so { disable }

platform/vpp/docker-syncd-vpp/conf/startup.conf.tmpl

@@ -227,6 +227,7 @@ plugins {
 	plugin linux_nl_plugin.so { enable }
 	plugin acl_plugin.so { enable }
         plugin vxlan_plugin.so { enable }
+	plugin tunterm_acl_plugin.so { enable }
 
 	## Enable all plugins by default and then selectively disable specific plugins
 	# plugin dpdk_plugin.so { disable }

platform/vpp/vppbld/Makefile

@@ -23,6 +23,7 @@ UID = $(shell id -u)
 GUID = $(shell id -g)
 
 VPP_REPO_DIR = repo
+VPP_CUSTOM_PLUGINS_DIR = plugins
 MAIN_TARGET = $(VPPINFRA)
 DERIVED_TARGETS = $(VPP_MAIN) $(VPP_PLUGIN_CORE) $(VPP_PLUGIN_DPDK) \
 				  $(VPP_PLUGIN_DEV) $(VPP_DEV) $(VPPINFRA_DEV) $(VPPDBG)
@@ -68,11 +69,13 @@ build_vpp:
 repo_clone:
 	rm -rf $(VPP_REPO_DIR)
 	git clone $(VPP_URL) $(VPP_REPO_DIR)
+	cp -r $(VPP_CUSTOM_PLUGINS_DIR)/* $(VPP_REPO_DIR)/src/plugins/
 	pushd $(VPP_REPO_DIR)
 	@VPP_SHA=`git log --until "$(VPP_LAG) days ago" -1 --format="%h"`
 	git checkout $$VPP_SHA
 	# 1. use installed libnl from sonic. 
 	# 2. use libbpf pulled by vpp
+	# 3. export vxlan main
 	git apply ../vpp.patch
 	popd
 

platform/vpp/vppbld/plugins/tunterm_acl/CMakeLists.txt

@@ -0,0 +1,29 @@
+# Copyright (c) 2024 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include_directories(${CMAKE_SOURCE_DIR})
+
+# for generated API headers:
+include_directories(${CMAKE_BINARY_DIR})
+
+add_vpp_plugin(tunterm_acl
+  SOURCES
+  tunterm_acl_api.c
+  tunterm_acl_cli.c
+  tunterm_acl_decap.c
+  tunterm_acl_redirect.c
+  tunterm_acl_node.c
+
+  API_FILES
+  tunterm_acl.api
+)

platform/vpp/vppbld/plugins/tunterm_acl/FEATURE.yaml

@@ -0,0 +1,12 @@
+---
+name: Tunnel Termination ACL
+maintainer: Akeel Ali <[email protected]>
+features:
+  - Applies ACL after Tunnel Decap
+  - Current support is limited to a specific use-case
+    - Tunnel: IPv4 VxLAN Tunnel Termination
+    - Fields: DST IPv4/6 Classification
+    - Action: Redirect (ip4/6-rewrite)
+description: "Tunnel Termination ACL plugin"
+state: experimental
+properties: [CLI, API]

platform/vpp/vppbld/plugins/tunterm_acl/docs/README.rst

@@ -0,0 +1,66 @@
+=======================
+Tunterm ACL Plugin README
+=======================
+
+Overview
+--------
+The Tunterm ACL plugin is a self-contained plugin that applies ACL after Tunnel Decapsulation.
+
+It is currently designed to support a single specific use-case:
+
+IPv4 VxLAN tunnel termination and classification based on inner DST IPv4/6 fields, followed by a redirect action using ip4/6-rewrite.
+
+Plugin API
+----------
+The Tunterm ACL plugin provides an API similar to the acl plugin API:
+
+1. `tunterm_acl_add_replace`: Create or replace an existing tunterm acl in-place.
+
+2. `tunterm_acl_del`: Delete a tunterm acl.
+
+3. `tunterm_acl_interface_add_del`: Add/remove a tunterm acl index to/from an interface.
+
+Plugin Structure
+----------------
+The Tunterm ACL plugin consists of the following main parts:
+
+1. `tunterm_acl.api/tunterm_acl_api.c`: This file contains the tunterm-acl ACL API and handlers to setup and attach the classifier/sessions using an ACL-like API.
+
+2. `tunterm_acl_node.c`: This file contains the tunterm-acl node that performs the classification and redirect logic. Please note that at this point, there are no performance considerations implemented.
+
+3. `tunterm_acl_decap.c`: This file is a copy of the ip4-vxlan-bypass node, but instead of forwarding to vxlan4-input, it forwards to tunterm-acl.
+
+4. `tunterm_acl_redirect.c`: This file is a copy of the ip-session-redirect functions, augmented with additional functionality required for the plugin.
+
+5. `tunterm_acl_cli.c`: This file provides CLI capability, allowing you to see which interfaces have tunterm-acl enabled.
+
+6. `test_tunterm_acl.py`: This file contains unit tests that cover various positive and negative use-cases.
+
+Requirements
+------------
+In order to use the Tunterm ACL plugin, the `vxlan_main` structure from the `vxlan` plugin must be exported:
+
+.. code-block:: c
+
+	__clib_export vxlan_main_t vxlan_main;
+
+Functionality
+-------------
+The plugin introduces the following nodes and functionality:
+
+.. image:: tunterm_acl.png
+	:target: tunterm_acl.png
+
+Enhancements
+-----------------------------
+Following are some enhancements that can be made to the plugin:
+
+1. Add multi-path redirect support
+
+2. Add multi-v4/v6 tunterm ACL support on a single interface
+
+3. Add VPP performance optimizations to tunterm-acl node
+
+4. Add v6 outer vxlan bypass support
+
+5. Expose tunterm-acl stats via API