4 * Copyright(c) 2016 Intel Corporation. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * * Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
17 * * Neither the name of Intel Corporation nor the names of its
18 * contributors may be used to endorse or promote products derived
19 * from this software without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37 #include <sys/types.h>
38 #include <netinet/in.h>
39 #include <netinet/ip6.h>
46 #define MAX_ACL_RULE_NUM 1000
63 #define IP6_ADDR_SIZE 16
65 struct rte_acl_field_def ip6_defs[IP6_NUM] = {
67 .type = RTE_ACL_FIELD_TYPE_BITMASK,
68 .size = sizeof(uint8_t),
69 .field_index = IP6_PROTO,
70 .input_index = IP6_PROTO,
74 .type = RTE_ACL_FIELD_TYPE_MASK,
76 .field_index = IP6_SRC0,
77 .input_index = IP6_SRC0,
81 .type = RTE_ACL_FIELD_TYPE_MASK,
83 .field_index = IP6_SRC1,
84 .input_index = IP6_SRC1,
88 .type = RTE_ACL_FIELD_TYPE_MASK,
90 .field_index = IP6_SRC2,
91 .input_index = IP6_SRC2,
95 .type = RTE_ACL_FIELD_TYPE_MASK,
97 .field_index = IP6_SRC3,
98 .input_index = IP6_SRC3,
102 .type = RTE_ACL_FIELD_TYPE_MASK,
104 .field_index = IP6_DST0,
105 .input_index = IP6_DST0,
109 .type = RTE_ACL_FIELD_TYPE_MASK,
111 .field_index = IP6_DST1,
112 .input_index = IP6_DST1,
116 .type = RTE_ACL_FIELD_TYPE_MASK,
118 .field_index = IP6_DST2,
119 .input_index = IP6_DST2,
123 .type = RTE_ACL_FIELD_TYPE_MASK,
125 .field_index = IP6_DST3,
126 .input_index = IP6_DST3,
130 .type = RTE_ACL_FIELD_TYPE_RANGE,
131 .size = sizeof(uint16_t),
132 .field_index = IP6_SRCP,
133 .input_index = IP6_SRCP,
137 .type = RTE_ACL_FIELD_TYPE_RANGE,
138 .size = sizeof(uint16_t),
139 .field_index = IP6_DSTP,
140 .input_index = IP6_SRCP,
145 RTE_ACL_RULE_DEF(acl6_rules, RTE_DIM(ip6_defs));
147 const struct acl6_rules acl6_rules_out[] = {
149 .data = {.userdata = PROTECT(5), .category_mask = 1, .priority = 1},
150 /* destination IPv6 */
151 .field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
152 .field[6] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
153 .field[7] = {.value.u32 = 0x55555555, .mask_range.u32 = 32,},
154 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
156 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
157 /* destination port */
158 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
161 .data = {.userdata = PROTECT(6), .category_mask = 1, .priority = 1},
162 /* destination IPv6 */
163 .field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
164 .field[6] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
165 .field[7] = {.value.u32 = 0x66666666, .mask_range.u32 = 32,},
166 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
168 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
169 /* destination port */
170 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
173 .data = {.userdata = PROTECT(10), .category_mask = 1, .priority = 1},
174 /* destination IPv6 */
175 .field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
176 .field[6] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},
177 .field[7] = {.value.u32 = 0x00000000, .mask_range.u32 = 32,},
178 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
180 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
181 /* destination port */
182 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
185 .data = {.userdata = PROTECT(11), .category_mask = 1, .priority = 1},
186 /* destination IPv6 */
187 .field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
188 .field[6] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},
189 .field[7] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},
190 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
192 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
193 /* destination port */
194 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
197 .data = {.userdata = PROTECT(25), .category_mask = 1, .priority = 1},
198 /* destination IPv6 */
199 .field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
200 .field[6] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
201 .field[7] = {.value.u32 = 0xaaaaaaaa, .mask_range.u32 = 32,},
202 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
204 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
205 /* destination port */
206 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
209 .data = {.userdata = PROTECT(26), .category_mask = 1, .priority = 1},
210 /* destination IPv6 */
211 .field[5] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
212 .field[6] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
213 .field[7] = {.value.u32 = 0xbbbbbbbb, .mask_range.u32 = 32,},
214 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
216 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
217 /* destination port */
218 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
222 const struct acl6_rules acl6_rules_in[] = {
224 .data = {.userdata = PROTECT(15), .category_mask = 1, .priority = 1},
225 /* destination IPv6 */
226 .field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},
227 .field[6] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
228 .field[7] = {.value.u32 = 0x55555555, .mask_range.u32 = 32,},
229 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
231 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
232 /* destination port */
233 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
236 .data = {.userdata = PROTECT(16), .category_mask = 1, .priority = 1},
237 /* destination IPv6 */
238 .field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},
239 .field[6] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
240 .field[7] = {.value.u32 = 0x66666666, .mask_range.u32 = 32,},
241 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
243 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
244 /* destination port */
245 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
248 .data = {.userdata = PROTECT(110), .category_mask = 1, .priority = 1},
249 /* destination IPv6 */
250 .field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},
251 .field[6] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},
252 .field[7] = {.value.u32 = 0x00000000, .mask_range.u32 = 32,},
253 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
255 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
256 /* destination port */
257 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
260 .data = {.userdata = PROTECT(111), .category_mask = 1, .priority = 1},
261 /* destination IPv6 */
262 .field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},
263 .field[6] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},
264 .field[7] = {.value.u32 = 0x11111111, .mask_range.u32 = 32,},
265 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
267 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
268 /* destination port */
269 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
272 .data = {.userdata = PROTECT(125), .category_mask = 1, .priority = 1},
273 /* destination IPv6 */
274 .field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},
275 .field[6] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
276 .field[7] = {.value.u32 = 0xaaaaaaaa, .mask_range.u32 = 32,},
277 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
279 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
280 /* destination port */
281 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
284 .data = {.userdata = PROTECT(126), .category_mask = 1, .priority = 1},
285 /* destination IPv6 */
286 .field[5] = {.value.u32 = 0xffff0000, .mask_range.u32 = 32,},
287 .field[6] = {.value.u32 = 0x0, .mask_range.u32 = 32,},
288 .field[7] = {.value.u32 = 0xbbbbbbbb, .mask_range.u32 = 32,},
289 .field[8] = {.value.u32 = 0x0, .mask_range.u32 = 0,},
291 .field[9] = {.value.u16 = 0, .mask_range.u16 = 0xffff,},
292 /* destination port */
293 .field[10] = {.value.u16 = 0, .mask_range.u16 = 0xffff,}
298 print_one_ip6_rule(const struct acl6_rules *rule, int32_t extra)
302 uint32_t_to_char(rule->field[IP6_SRC0].value.u32,
304 printf("%.2x%.2x:%.2x%.2x", a, b, c, d);
305 uint32_t_to_char(rule->field[IP6_SRC1].value.u32,
307 printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
308 uint32_t_to_char(rule->field[IP6_SRC2].value.u32,
310 printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
311 uint32_t_to_char(rule->field[IP6_SRC3].value.u32,
313 printf(":%.2x%.2x:%.2x%.2x/%u ", a, b, c, d,
314 rule->field[IP6_SRC0].mask_range.u32
315 + rule->field[IP6_SRC1].mask_range.u32
316 + rule->field[IP6_SRC2].mask_range.u32
317 + rule->field[IP6_SRC3].mask_range.u32);
319 uint32_t_to_char(rule->field[IP6_DST0].value.u32,
321 printf("%.2x%.2x:%.2x%.2x", a, b, c, d);
322 uint32_t_to_char(rule->field[IP6_DST1].value.u32,
324 printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
325 uint32_t_to_char(rule->field[IP6_DST2].value.u32,
327 printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
328 uint32_t_to_char(rule->field[IP6_DST3].value.u32,
330 printf(":%.2x%.2x:%.2x%.2x/%u ", a, b, c, d,
331 rule->field[IP6_DST0].mask_range.u32
332 + rule->field[IP6_DST1].mask_range.u32
333 + rule->field[IP6_DST2].mask_range.u32
334 + rule->field[IP6_DST3].mask_range.u32);
336 printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
337 rule->field[IP6_SRCP].value.u16,
338 rule->field[IP6_SRCP].mask_range.u16,
339 rule->field[IP6_DSTP].value.u16,
340 rule->field[IP6_DSTP].mask_range.u16,
341 rule->field[IP6_PROTO].value.u8,
342 rule->field[IP6_PROTO].mask_range.u8);
344 printf("0x%x-0x%x-0x%x ",
345 rule->data.category_mask,
347 rule->data.userdata);
351 dump_ip6_rules(const struct acl6_rules *rule, int32_t num, int32_t extra)
355 for (i = 0; i < num; i++, rule++) {
356 printf("\t%d:", i + 1);
357 print_one_ip6_rule(rule, extra);
362 static struct rte_acl_ctx *
363 acl6_init(const char *name, int32_t socketid, const struct acl6_rules *rules,
367 struct rte_acl_param acl_param;
368 struct rte_acl_config acl_build_param;
369 struct rte_acl_ctx *ctx;
371 printf("Creating SP context with %u max rules\n", MAX_ACL_RULE_NUM);
373 memset(&acl_param, 0, sizeof(acl_param));
375 /* Create ACL contexts */
376 snprintf(s, sizeof(s), "%s_%d", name, socketid);
378 printf("IPv4 %s entries [%u]:\n", s, rules_nb);
379 dump_ip6_rules(rules, rules_nb, 1);
382 acl_param.socket_id = socketid;
383 acl_param.rule_size = RTE_ACL_RULE_SZ(RTE_DIM(ip6_defs));
384 acl_param.max_rule_num = MAX_ACL_RULE_NUM;
386 ctx = rte_acl_create(&acl_param);
388 rte_exit(EXIT_FAILURE, "Failed to create ACL context\n");
390 if (rte_acl_add_rules(ctx, (const struct rte_acl_rule *)rules,
392 rte_exit(EXIT_FAILURE, "add rules failed\n");
395 memset(&acl_build_param, 0, sizeof(acl_build_param));
397 acl_build_param.num_categories = DEFAULT_MAX_CATEGORIES;
398 acl_build_param.num_fields = RTE_DIM(ip6_defs);
399 memcpy(&acl_build_param.defs, ip6_defs, sizeof(ip6_defs));
401 if (rte_acl_build(ctx, &acl_build_param) != 0)
402 rte_exit(EXIT_FAILURE, "Failed to build ACL trie\n");
410 sp6_init(struct socket_ctx *ctx, int32_t socket_id, uint32_t ep)
413 const struct acl6_rules *rules_out, *rules_in;
414 uint32_t nb_out_rules, nb_in_rules;
417 rte_exit(EXIT_FAILURE, "NULL context.\n");
419 if (ctx->sp_ip6_in != NULL)
420 rte_exit(EXIT_FAILURE, "Inbound IPv6 SP DB for socket %u "
421 "already initialized\n", socket_id);
423 if (ctx->sp_ip6_out != NULL)
424 rte_exit(EXIT_FAILURE, "Outbound IPv6 SP DB for socket %u "
425 "already initialized\n", socket_id);
428 rules_out = acl6_rules_out;
429 nb_out_rules = RTE_DIM(acl6_rules_out);
430 rules_in = acl6_rules_in;
431 nb_in_rules = RTE_DIM(acl6_rules_in);
432 } else if (ep == 1) {
433 rules_out = acl6_rules_in;
434 nb_out_rules = RTE_DIM(acl6_rules_in);
435 rules_in = acl6_rules_out;
436 nb_in_rules = RTE_DIM(acl6_rules_out);
438 rte_exit(EXIT_FAILURE, "Invalid EP value %u. "
439 "Only 0 or 1 supported.\n", ep);
442 ctx->sp_ip6_in = (struct sp_ctx *)acl6_init(name, socket_id,
443 rules_in, nb_in_rules);
446 ctx->sp_ip6_out = (struct sp_ctx *)acl6_init(name, socket_id,
447 rules_out, nb_out_rules);