4 * Copyright(c) 2016 Intel Corporation. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * * Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
17 * * Neither the name of Intel Corporation nor the names of its
18 * contributors may be used to endorse or promote products derived
19 * from this software without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37 #include <sys/types.h>
38 #include <netinet/in.h>
39 #include <netinet/ip.h>
45 #define MAX_ACL_RULE_NUM 1000
48 * Rule and trace formats definitions.
60 * That effectively defines order of IPV4 classifications:
64 * - PORTS (SRC and DST)
74 struct rte_acl_field_def ipv4_defs[NUM_FIELDS_IPV4] = {
76 .type = RTE_ACL_FIELD_TYPE_BITMASK,
77 .size = sizeof(uint8_t),
78 .field_index = PROTO_FIELD_IPV4,
79 .input_index = RTE_ACL_IPV4_PROTO,
83 .type = RTE_ACL_FIELD_TYPE_MASK,
84 .size = sizeof(uint32_t),
85 .field_index = SRC_FIELD_IPV4,
86 .input_index = RTE_ACL_IPV4_SRC,
87 .offset = offsetof(struct ip, ip_src) - offsetof(struct ip, ip_p)
90 .type = RTE_ACL_FIELD_TYPE_MASK,
91 .size = sizeof(uint32_t),
92 .field_index = DST_FIELD_IPV4,
93 .input_index = RTE_ACL_IPV4_DST,
94 .offset = offsetof(struct ip, ip_dst) - offsetof(struct ip, ip_p)
97 .type = RTE_ACL_FIELD_TYPE_RANGE,
98 .size = sizeof(uint16_t),
99 .field_index = SRCP_FIELD_IPV4,
100 .input_index = RTE_ACL_IPV4_PORTS,
101 .offset = sizeof(struct ip) - offsetof(struct ip, ip_p)
104 .type = RTE_ACL_FIELD_TYPE_RANGE,
105 .size = sizeof(uint16_t),
106 .field_index = DSTP_FIELD_IPV4,
107 .input_index = RTE_ACL_IPV4_PORTS,
108 .offset = sizeof(struct ip) - offsetof(struct ip, ip_p) +
113 RTE_ACL_RULE_DEF(acl4_rules, RTE_DIM(ipv4_defs));
115 const struct acl4_rules acl4_rules_in[] = {
117 .data = {.userdata = PROTECT(5), .category_mask = 1, .priority = 1},
118 /* destination IPv4 */
119 .field[2] = {.value.u32 = IPv4(192, 168, 105, 0),
120 .mask_range.u32 = 24,},
122 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
123 /* destination port */
124 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
127 .data = {.userdata = PROTECT(6), .category_mask = 1, .priority = 2},
128 /* destination IPv4 */
129 .field[2] = {.value.u32 = IPv4(192, 168, 106, 0),
130 .mask_range.u32 = 24,},
132 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
133 /* destination port */
134 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
137 .data = {.userdata = PROTECT(7), .category_mask = 1, .priority = 3},
138 /* destination IPv4 */
139 .field[2] = {.value.u32 = IPv4(192, 168, 107, 0),
140 .mask_range.u32 = 24,},
142 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
143 /* destination port */
144 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
147 .data = {.userdata = PROTECT(8), .category_mask = 1, .priority = 4},
148 /* destination IPv4 */
149 .field[2] = {.value.u32 = IPv4(192, 168, 108, 0),
150 .mask_range.u32 = 24,},
152 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
153 /* destination port */
154 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
157 .data = {.userdata = PROTECT(9), .category_mask = 1, .priority = 5},
158 /* destination IPv4 */
159 .field[2] = {.value.u32 = IPv4(192, 168, 200, 0),
160 .mask_range.u32 = 24,},
162 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
163 /* destination port */
164 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
167 .data = {.userdata = BYPASS, .category_mask = 1, .priority = 6},
168 /* destination IPv4 */
169 .field[2] = {.value.u32 = IPv4(192, 168, 250, 0),
170 .mask_range.u32 = 24,},
172 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
173 /* destination port */
174 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
178 const struct acl4_rules acl4_rules_out[] = {
180 .data = {.userdata = PROTECT(5), .category_mask = 1, .priority = 1},
181 /* destination IPv4 */
182 .field[2] = {.value.u32 = IPv4(192, 168, 115, 0),
183 .mask_range.u32 = 24,},
185 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
186 /* destination port */
187 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
190 .data = {.userdata = PROTECT(6), .category_mask = 1, .priority = 2},
191 /* destination IPv4 */
192 .field[2] = {.value.u32 = IPv4(192, 168, 116, 0),
193 .mask_range.u32 = 24,},
195 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
196 /* destination port */
197 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
200 .data = {.userdata = PROTECT(7), .category_mask = 1, .priority = 3},
201 /* destination IPv4 */
202 .field[2] = {.value.u32 = IPv4(192, 168, 117, 0),
203 .mask_range.u32 = 24,},
205 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
206 /* destination port */
207 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
210 .data = {.userdata = PROTECT(8), .category_mask = 1, .priority = 4},
211 /* destination IPv4 */
212 .field[2] = {.value.u32 = IPv4(192, 168, 118, 0),
213 .mask_range.u32 = 24,},
215 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
216 /* destination port */
217 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
220 .data = {.userdata = PROTECT(9), .category_mask = 1, .priority = 5},
221 /* destination IPv4 */
222 .field[2] = {.value.u32 = IPv4(192, 168, 210, 0),
223 .mask_range.u32 = 24,},
225 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
226 /* destination port */
227 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
230 .data = {.userdata = BYPASS, .category_mask = 1, .priority = 6},
231 /* destination IPv4 */
232 .field[2] = {.value.u32 = IPv4(192, 168, 240, 0),
233 .mask_range.u32 = 24,},
235 .field[3] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
236 /* destination port */
237 .field[4] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
242 print_one_ipv4_rule(const struct acl4_rules *rule, int extra)
244 unsigned char a, b, c, d;
246 uint32_t_to_char(rule->field[SRC_FIELD_IPV4].value.u32,
248 printf("%hhu.%hhu.%hhu.%hhu/%u ", a, b, c, d,
249 rule->field[SRC_FIELD_IPV4].mask_range.u32);
250 uint32_t_to_char(rule->field[DST_FIELD_IPV4].value.u32,
252 printf("%hhu.%hhu.%hhu.%hhu/%u ", a, b, c, d,
253 rule->field[DST_FIELD_IPV4].mask_range.u32);
254 printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
255 rule->field[SRCP_FIELD_IPV4].value.u16,
256 rule->field[SRCP_FIELD_IPV4].mask_range.u16,
257 rule->field[DSTP_FIELD_IPV4].value.u16,
258 rule->field[DSTP_FIELD_IPV4].mask_range.u16,
259 rule->field[PROTO_FIELD_IPV4].value.u8,
260 rule->field[PROTO_FIELD_IPV4].mask_range.u8);
262 printf("0x%x-0x%x-0x%x ",
263 rule->data.category_mask,
265 rule->data.userdata);
269 dump_ipv4_rules(const struct acl4_rules *rule, int num, int extra)
273 for (i = 0; i < num; i++, rule++) {
274 printf("\t%d:", i + 1);
275 print_one_ipv4_rule(rule, extra);
280 static struct rte_acl_ctx *
281 acl4_init(const char *name, int socketid, const struct acl4_rules *rules,
285 struct rte_acl_param acl_param;
286 struct rte_acl_config acl_build_param;
287 struct rte_acl_ctx *ctx;
289 printf("Creating SP context with %u max rules\n", MAX_ACL_RULE_NUM);
291 memset(&acl_param, 0, sizeof(acl_param));
293 /* Create ACL contexts */
294 snprintf(s, sizeof(s), "%s_%d", name, socketid);
296 printf("IPv4 %s entries [%u]:\n", s, rules_nb);
297 dump_ipv4_rules(rules, rules_nb, 1);
300 acl_param.socket_id = socketid;
301 acl_param.rule_size = RTE_ACL_RULE_SZ(RTE_DIM(ipv4_defs));
302 acl_param.max_rule_num = MAX_ACL_RULE_NUM;
304 ctx = rte_acl_create(&acl_param);
306 rte_exit(EXIT_FAILURE, "Failed to create ACL context\n");
308 if (rte_acl_add_rules(ctx, (const struct rte_acl_rule *)rules,
310 rte_exit(EXIT_FAILURE, "add rules failed\n");
313 memset(&acl_build_param, 0, sizeof(acl_build_param));
315 acl_build_param.num_categories = DEFAULT_MAX_CATEGORIES;
316 acl_build_param.num_fields = RTE_DIM(ipv4_defs);
317 memcpy(&acl_build_param.defs, ipv4_defs, sizeof(ipv4_defs));
319 if (rte_acl_build(ctx, &acl_build_param) != 0)
320 rte_exit(EXIT_FAILURE, "Failed to build ACL trie\n");
328 sp_init(struct socket_ctx *ctx, int socket_id, unsigned ep)
331 const struct acl4_rules *rules_out, *rules_in;
332 unsigned nb_out_rules, nb_in_rules;
335 rte_exit(EXIT_FAILURE, "NULL context.\n");
337 if (ctx->sp_ipv4_in != NULL)
338 rte_exit(EXIT_FAILURE, "Inbound SP DB for socket %u already "
339 "initialized\n", socket_id);
341 if (ctx->sp_ipv4_out != NULL)
342 rte_exit(EXIT_FAILURE, "Outbound SP DB for socket %u already "
343 "initialized\n", socket_id);
346 rules_out = acl4_rules_in;
347 nb_out_rules = RTE_DIM(acl4_rules_in);
348 rules_in = acl4_rules_out;
349 nb_in_rules = RTE_DIM(acl4_rules_out);
350 } else if (ep == 1) {
351 rules_out = acl4_rules_out;
352 nb_out_rules = RTE_DIM(acl4_rules_out);
353 rules_in = acl4_rules_in;
354 nb_in_rules = RTE_DIM(acl4_rules_in);
356 rte_exit(EXIT_FAILURE, "Invalid EP value %u. "
357 "Only 0 or 1 supported.\n", ep);
360 ctx->sp_ipv4_in = (struct sp_ctx *)acl4_init(name, socket_id,
361 rules_in, nb_in_rules);
363 name = "sp_ipv4_out";
364 ctx->sp_ipv4_out = (struct sp_ctx *)acl4_init(name, socket_id,
365 rules_out, nb_out_rules);