1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(c) 2016 Intel Corporation
9 #include <netinet/in.h>
10 #include <netinet/ip.h>
18 #define MAX_ACL_RULE_NUM 1024
21 * Rule and trace formats definitions.
33 * That effectively defines order of IPV4 classifications:
37 * - PORTS (SRC and DST)
47 static struct rte_acl_field_def ip4_defs[NUM_FIELDS_IPV4] = {
49 .type = RTE_ACL_FIELD_TYPE_BITMASK,
50 .size = sizeof(uint8_t),
51 .field_index = PROTO_FIELD_IPV4,
52 .input_index = RTE_ACL_IPV4_PROTO,
56 .type = RTE_ACL_FIELD_TYPE_MASK,
57 .size = sizeof(uint32_t),
58 .field_index = SRC_FIELD_IPV4,
59 .input_index = RTE_ACL_IPV4_SRC,
60 .offset = offsetof(struct ip, ip_src) - offsetof(struct ip, ip_p)
63 .type = RTE_ACL_FIELD_TYPE_MASK,
64 .size = sizeof(uint32_t),
65 .field_index = DST_FIELD_IPV4,
66 .input_index = RTE_ACL_IPV4_DST,
67 .offset = offsetof(struct ip, ip_dst) - offsetof(struct ip, ip_p)
70 .type = RTE_ACL_FIELD_TYPE_RANGE,
71 .size = sizeof(uint16_t),
72 .field_index = SRCP_FIELD_IPV4,
73 .input_index = RTE_ACL_IPV4_PORTS,
74 .offset = sizeof(struct ip) - offsetof(struct ip, ip_p)
77 .type = RTE_ACL_FIELD_TYPE_RANGE,
78 .size = sizeof(uint16_t),
79 .field_index = DSTP_FIELD_IPV4,
80 .input_index = RTE_ACL_IPV4_PORTS,
81 .offset = sizeof(struct ip) - offsetof(struct ip, ip_p) +
86 RTE_ACL_RULE_DEF(acl4_rules, RTE_DIM(ip4_defs));
88 static struct acl4_rules acl4_rules_out[MAX_ACL_RULE_NUM];
89 static uint32_t nb_acl4_rules_out;
91 static struct acl4_rules acl4_rules_in[MAX_ACL_RULE_NUM];
92 static uint32_t nb_acl4_rules_in;
95 parse_sp4_tokens(char **tokens, uint32_t n_tokens,
96 struct parse_status *status)
98 struct acl4_rules *rule_ipv4 = NULL;
100 uint32_t *ri = NULL; /* rule index */
101 uint32_t ti = 0; /* token index */
105 uint32_t protect_p = 0;
106 uint32_t bypass_p = 0;
107 uint32_t discard_p = 0;
111 uint32_t proto_p = 0;
112 uint32_t sport_p = 0;
113 uint32_t dport_p = 0;
115 if (strcmp(tokens[1], "in") == 0) {
116 ri = &nb_acl4_rules_in;
118 APP_CHECK(*ri <= MAX_ACL_RULE_NUM - 1, status,
119 "too many sp rules, abort insertion\n");
120 if (status->status < 0)
123 rule_ipv4 = &acl4_rules_in[*ri];
125 } else if (strcmp(tokens[1], "out") == 0) {
126 ri = &nb_acl4_rules_out;
128 APP_CHECK(*ri <= MAX_ACL_RULE_NUM - 1, status,
129 "too many sp rules, abort insertion\n");
130 if (status->status < 0)
133 rule_ipv4 = &acl4_rules_out[*ri];
135 APP_CHECK(0, status, "unrecognized input \"%s\", expect"
136 " \"in\" or \"out\"\n", tokens[ti]);
140 rule_ipv4->data.category_mask = 1;
142 for (ti = 2; ti < n_tokens; ti++) {
143 if (strcmp(tokens[ti], "esp") == 0) {
144 /* currently do nothing */
145 APP_CHECK_PRESENCE(esp_p, tokens[ti], status);
146 if (status->status < 0)
152 if (strcmp(tokens[ti], "protect") == 0) {
153 APP_CHECK_PRESENCE(protect_p, tokens[ti], status);
154 if (status->status < 0)
156 APP_CHECK(bypass_p == 0, status, "conflict item "
157 "between \"%s\" and \"%s\"", tokens[ti],
159 if (status->status < 0)
161 APP_CHECK(discard_p == 0, status, "conflict item "
162 "between \"%s\" and \"%s\"", tokens[ti],
164 if (status->status < 0)
166 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
167 if (status->status < 0)
169 APP_CHECK_TOKEN_IS_NUM(tokens, ti, status);
170 if (status->status < 0)
173 tv = atoi(tokens[ti]);
174 APP_CHECK(tv != DISCARD && tv != BYPASS, status,
175 "invalid SPI: %s", tokens[ti]);
176 if (status->status < 0)
178 rule_ipv4->data.userdata = tv;
184 if (strcmp(tokens[ti], "bypass") == 0) {
185 APP_CHECK_PRESENCE(bypass_p, tokens[ti], status);
186 if (status->status < 0)
188 APP_CHECK(protect_p == 0, status, "conflict item "
189 "between \"%s\" and \"%s\"", tokens[ti],
191 if (status->status < 0)
193 APP_CHECK(discard_p == 0, status, "conflict item "
194 "between \"%s\" and \"%s\"", tokens[ti],
196 if (status->status < 0)
199 rule_ipv4->data.userdata = BYPASS;
205 if (strcmp(tokens[ti], "discard") == 0) {
206 APP_CHECK_PRESENCE(discard_p, tokens[ti], status);
207 if (status->status < 0)
209 APP_CHECK(protect_p == 0, status, "conflict item "
210 "between \"%s\" and \"%s\"", tokens[ti],
212 if (status->status < 0)
214 APP_CHECK(bypass_p == 0, status, "conflict item "
215 "between \"%s\" and \"%s\"", tokens[ti],
217 if (status->status < 0)
220 rule_ipv4->data.userdata = DISCARD;
226 if (strcmp(tokens[ti], "pri") == 0) {
227 APP_CHECK_PRESENCE(pri_p, tokens[ti], status);
228 if (status->status < 0)
230 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
231 if (status->status < 0)
233 APP_CHECK_TOKEN_IS_NUM(tokens, ti, status);
234 if (status->status < 0)
237 rule_ipv4->data.priority = atoi(tokens[ti]);
243 if (strcmp(tokens[ti], "src") == 0) {
247 APP_CHECK_PRESENCE(src_p, tokens[ti], status);
248 if (status->status < 0)
250 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
251 if (status->status < 0)
254 APP_CHECK(parse_ipv4_addr(tokens[ti], &ip,
255 &depth) == 0, status, "unrecognized "
256 "input \"%s\", expect valid ipv4 addr",
258 if (status->status < 0)
261 rule_ipv4->field[1].value.u32 =
262 rte_bswap32(ip.s_addr);
263 rule_ipv4->field[1].mask_range.u32 =
270 if (strcmp(tokens[ti], "dst") == 0) {
274 APP_CHECK_PRESENCE(dst_p, tokens[ti], status);
275 if (status->status < 0)
277 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
278 if (status->status < 0)
280 APP_CHECK(parse_ipv4_addr(tokens[ti], &ip,
281 &depth) == 0, status, "unrecognized "
282 "input \"%s\", expect valid ipv4 addr",
284 if (status->status < 0)
287 rule_ipv4->field[2].value.u32 =
288 rte_bswap32(ip.s_addr);
289 rule_ipv4->field[2].mask_range.u32 =
296 if (strcmp(tokens[ti], "proto") == 0) {
299 APP_CHECK_PRESENCE(proto_p, tokens[ti], status);
300 if (status->status < 0)
302 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
303 if (status->status < 0)
306 APP_CHECK(parse_range(tokens[ti], &low, &high)
307 == 0, status, "unrecognized input \"%s\""
308 ", expect \"from:to\"", tokens[ti]);
309 if (status->status < 0)
311 APP_CHECK(low <= 0xff, status, "proto low "
313 if (status->status < 0)
315 APP_CHECK(high <= 0xff, status, "proto high "
317 if (status->status < 0)
320 rule_ipv4->field[0].value.u8 = (uint8_t)low;
321 rule_ipv4->field[0].mask_range.u8 = (uint8_t)high;
327 if (strcmp(tokens[ti], "sport") == 0) {
328 uint16_t port_low, port_high;
330 APP_CHECK_PRESENCE(sport_p, tokens[ti], status);
331 if (status->status < 0)
333 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
334 if (status->status < 0)
337 APP_CHECK(parse_range(tokens[ti], &port_low,
338 &port_high) == 0, status, "unrecognized "
339 "input \"%s\", expect \"port_from:"
340 "port_to\"", tokens[ti]);
341 if (status->status < 0)
344 rule_ipv4->field[3].value.u16 = port_low;
345 rule_ipv4->field[3].mask_range.u16 = port_high;
351 if (strcmp(tokens[ti], "dport") == 0) {
352 uint16_t port_low, port_high;
354 APP_CHECK_PRESENCE(dport_p, tokens[ti], status);
355 if (status->status < 0)
357 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
358 if (status->status < 0)
361 APP_CHECK(parse_range(tokens[ti], &port_low,
362 &port_high) == 0, status, "unrecognized "
363 "input \"%s\", expect \"port_from:"
364 "port_to\"", tokens[ti]);
365 if (status->status < 0)
368 rule_ipv4->field[4].value.u16 = port_low;
369 rule_ipv4->field[4].mask_range.u16 = port_high;
375 /* unrecognizeable input */
376 APP_CHECK(0, status, "unrecognized input \"%s\"",
381 /* check if argument(s) are missing */
382 APP_CHECK(esp_p == 1, status, "missing argument \"esp\"");
383 if (status->status < 0)
386 APP_CHECK(protect_p | bypass_p | discard_p, status, "missing "
387 "argument \"protect\", \"bypass\", or \"discard\"");
388 if (status->status < 0)
395 print_one_ip4_rule(const struct acl4_rules *rule, int32_t extra)
399 uint32_t_to_char(rule->field[SRC_FIELD_IPV4].value.u32,
401 printf("%hhu.%hhu.%hhu.%hhu/%u ", a, b, c, d,
402 rule->field[SRC_FIELD_IPV4].mask_range.u32);
403 uint32_t_to_char(rule->field[DST_FIELD_IPV4].value.u32,
405 printf("%hhu.%hhu.%hhu.%hhu/%u ", a, b, c, d,
406 rule->field[DST_FIELD_IPV4].mask_range.u32);
407 printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
408 rule->field[SRCP_FIELD_IPV4].value.u16,
409 rule->field[SRCP_FIELD_IPV4].mask_range.u16,
410 rule->field[DSTP_FIELD_IPV4].value.u16,
411 rule->field[DSTP_FIELD_IPV4].mask_range.u16,
412 rule->field[PROTO_FIELD_IPV4].value.u8,
413 rule->field[PROTO_FIELD_IPV4].mask_range.u8);
415 printf("0x%x-0x%x-0x%x ",
416 rule->data.category_mask,
418 rule->data.userdata);
422 dump_ip4_rules(const struct acl4_rules *rule, int32_t num, int32_t extra)
426 for (i = 0; i < num; i++, rule++) {
427 printf("\t%d:", i + 1);
428 print_one_ip4_rule(rule, extra);
433 static struct rte_acl_ctx *
434 acl4_init(const char *name, int32_t socketid, const struct acl4_rules *rules,
438 struct rte_acl_param acl_param;
439 struct rte_acl_config acl_build_param;
440 struct rte_acl_ctx *ctx;
442 printf("Creating SP context with %u max rules\n", MAX_ACL_RULE_NUM);
444 memset(&acl_param, 0, sizeof(acl_param));
446 /* Create ACL contexts */
447 snprintf(s, sizeof(s), "%s_%d", name, socketid);
449 printf("IPv4 %s entries [%u]:\n", s, rules_nb);
450 dump_ip4_rules(rules, rules_nb, 1);
453 acl_param.socket_id = socketid;
454 acl_param.rule_size = RTE_ACL_RULE_SZ(RTE_DIM(ip4_defs));
455 acl_param.max_rule_num = MAX_ACL_RULE_NUM;
457 ctx = rte_acl_create(&acl_param);
459 rte_exit(EXIT_FAILURE, "Failed to create ACL context\n");
461 if (rte_acl_add_rules(ctx, (const struct rte_acl_rule *)rules,
463 rte_exit(EXIT_FAILURE, "add rules failed\n");
466 memset(&acl_build_param, 0, sizeof(acl_build_param));
468 acl_build_param.num_categories = DEFAULT_MAX_CATEGORIES;
469 acl_build_param.num_fields = RTE_DIM(ip4_defs);
470 memcpy(&acl_build_param.defs, ip4_defs, sizeof(ip4_defs));
472 if (rte_acl_build(ctx, &acl_build_param) != 0)
473 rte_exit(EXIT_FAILURE, "Failed to build ACL trie\n");
481 * check that for each rule it's SPI has a correspondent entry in SAD
484 check_spi_value(int inbound)
486 uint32_t i, num, spi;
487 const struct acl4_rules *acr;
491 num = nb_acl4_rules_in;
493 acr = acl4_rules_out;
494 num = nb_acl4_rules_out;
497 for (i = 0; i != num; i++) {
498 spi = acr[i].data.userdata;
499 if (spi != DISCARD && spi != BYPASS &&
500 sa_spi_present(spi, inbound) < 0) {
501 RTE_LOG(ERR, IPSEC, "SPI %u is not present in SAD\n",
511 sp4_init(struct socket_ctx *ctx, int32_t socket_id)
516 rte_exit(EXIT_FAILURE, "NULL context.\n");
518 if (ctx->sp_ip4_in != NULL)
519 rte_exit(EXIT_FAILURE, "Inbound SP DB for socket %u already "
520 "initialized\n", socket_id);
522 if (ctx->sp_ip4_out != NULL)
523 rte_exit(EXIT_FAILURE, "Outbound SP DB for socket %u already "
524 "initialized\n", socket_id);
526 if (check_spi_value(1) < 0)
527 rte_exit(EXIT_FAILURE,
528 "Inbound IPv4 SP DB has unmatched in SAD SPIs\n");
530 if (check_spi_value(0) < 0)
531 rte_exit(EXIT_FAILURE,
532 "Outbound IPv4 SP DB has unmatched in SAD SPIs\n");
534 if (nb_acl4_rules_in > 0) {
536 ctx->sp_ip4_in = (struct sp_ctx *)acl4_init(name,
537 socket_id, acl4_rules_in, nb_acl4_rules_in);
539 RTE_LOG(WARNING, IPSEC, "No IPv4 SP Inbound rule "
542 if (nb_acl4_rules_out > 0) {
544 ctx->sp_ip4_out = (struct sp_ctx *)acl4_init(name,
545 socket_id, acl4_rules_out, nb_acl4_rules_out);
547 RTE_LOG(WARNING, IPSEC, "No IPv4 SP Outbound rule "
552 * Search though SP rules for given SPI.
555 sp4_spi_present(uint32_t spi, int inbound)
558 const struct acl4_rules *acr;
562 num = nb_acl4_rules_in;
564 acr = acl4_rules_out;
565 num = nb_acl4_rules_out;
568 for (i = 0; i != num; i++) {
569 if (acr[i].data.userdata == spi)