1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(c) 2010-2014 Intel Corporation
21 * Legacy support for 7-tuple IPv4 and VLAN rule.
22 * This structure and corresponding API is deprecated.
24 struct rte_acl_ipv4vlan_rule {
25 struct rte_acl_rule_data data; /**< Miscellaneous data for the rule. */
26 uint8_t proto; /**< IPv4 protocol ID. */
27 uint8_t proto_mask; /**< IPv4 protocol ID mask. */
28 uint16_t vlan; /**< VLAN ID. */
29 uint16_t vlan_mask; /**< VLAN ID mask. */
30 uint16_t domain; /**< VLAN domain. */
31 uint16_t domain_mask; /**< VLAN domain mask. */
32 uint32_t src_addr; /**< IPv4 source address. */
33 uint32_t src_mask_len; /**< IPv4 source address mask. */
34 uint32_t dst_addr; /**< IPv4 destination address. */
35 uint32_t dst_mask_len; /**< IPv4 destination address mask. */
36 uint16_t src_port_low; /**< L4 source port low. */
37 uint16_t src_port_high; /**< L4 source port high. */
38 uint16_t dst_port_low; /**< L4 destination port low. */
39 uint16_t dst_port_high; /**< L4 destination port high. */
43 * Specifies fields layout inside rte_acl_rule for rte_acl_ipv4vlan_rule.
46 RTE_ACL_IPV4VLAN_PROTO_FIELD,
47 RTE_ACL_IPV4VLAN_VLAN1_FIELD,
48 RTE_ACL_IPV4VLAN_VLAN2_FIELD,
49 RTE_ACL_IPV4VLAN_SRC_FIELD,
50 RTE_ACL_IPV4VLAN_DST_FIELD,
51 RTE_ACL_IPV4VLAN_SRCP_FIELD,
52 RTE_ACL_IPV4VLAN_DSTP_FIELD,
53 RTE_ACL_IPV4VLAN_NUM_FIELDS
57 * Macro to define rule size for rte_acl_ipv4vlan_rule.
59 #define RTE_ACL_IPV4VLAN_RULE_SZ \
60 RTE_ACL_RULE_SZ(RTE_ACL_IPV4VLAN_NUM_FIELDS)
63 * That effectively defines order of IPV4VLAN classifications:
65 * - VLAN (TAG and DOMAIN)
68 * - PORTS (SRC and DST)
71 RTE_ACL_IPV4VLAN_PROTO,
72 RTE_ACL_IPV4VLAN_VLAN,
75 RTE_ACL_IPV4VLAN_PORTS,
79 /* rules for invalid layout test */
80 struct rte_acl_ipv4vlan_rule invalid_layout_rules[] = {
81 /* test src and dst address */
83 .data = {.userdata = 1, .category_mask = 1},
84 .src_addr = IPv4(10,0,0,0),
88 .data = {.userdata = 2, .category_mask = 1},
89 .dst_addr = IPv4(10,0,0,0),
92 /* test src and dst ports */
94 .data = {.userdata = 3, .category_mask = 1},
99 .data = {.userdata = 4, .category_mask = 1},
101 .src_port_high = 100,
105 .data = {.userdata = 5, .category_mask = 1},
110 .data = {.userdata = 6, .category_mask = 1},
112 .dst_port_high = 0xf,
116 /* these might look odd because they don't match up the rules. This is
117 * intentional, as the invalid layout test presumes returning the correct
118 * results using the wrong data layout.
120 struct ipv4_7tuple invalid_layout_data[] = {
121 {.ip_src = IPv4(10,0,1,0)}, /* should not match */
122 {.ip_src = IPv4(10,0,0,1), .allow = 2}, /* should match 2 */
123 {.port_src = 100, .allow = 4}, /* should match 4 */
124 {.port_dst = 0xf, .allow = 6}, /* should match 6 */
129 #define ACL_ALLOW_MASK 0x1
130 #define ACL_DENY_MASK 0x2
132 /* ruleset for ACL unit test */
133 struct rte_acl_ipv4vlan_rule acl_test_rules[] = {
134 /* destination IP addresses */
135 /* matches all packets traveling to 192.168.0.0/16 */
137 .data = {.userdata = 1, .category_mask = ACL_ALLOW_MASK,
139 .dst_addr = IPv4(192,168,0,0),
142 .src_port_high = 0xffff,
144 .dst_port_high = 0xffff,
146 /* matches all packets traveling to 192.168.1.0/24 */
148 .data = {.userdata = 2, .category_mask = ACL_ALLOW_MASK,
150 .dst_addr = IPv4(192,168,1,0),
153 .src_port_high = 0xffff,
155 .dst_port_high = 0xffff,
157 /* matches all packets traveling to 192.168.1.50 */
159 .data = {.userdata = 3, .category_mask = ACL_DENY_MASK,
161 .dst_addr = IPv4(192,168,1,50),
164 .src_port_high = 0xffff,
166 .dst_port_high = 0xffff,
169 /* source IP addresses */
170 /* matches all packets traveling from 10.0.0.0/8 */
172 .data = {.userdata = 4, .category_mask = ACL_ALLOW_MASK,
174 .src_addr = IPv4(10,0,0,0),
177 .src_port_high = 0xffff,
179 .dst_port_high = 0xffff,
181 /* matches all packets traveling from 10.1.1.0/24 */
183 .data = {.userdata = 5, .category_mask = ACL_ALLOW_MASK,
185 .src_addr = IPv4(10,1,1,0),
188 .src_port_high = 0xffff,
190 .dst_port_high = 0xffff,
192 /* matches all packets traveling from 10.1.1.1 */
194 .data = {.userdata = 6, .category_mask = ACL_DENY_MASK,
196 .src_addr = IPv4(10,1,1,1),
199 .src_port_high = 0xffff,
201 .dst_port_high = 0xffff,
205 /* matches all packets with lower 7 bytes of VLAN tag equal to 0x64 */
207 .data = {.userdata = 7, .category_mask = ACL_ALLOW_MASK,
212 .src_port_high = 0xffff,
214 .dst_port_high = 0xffff,
216 /* matches all packets with VLAN tags that have 0x5 in them */
218 .data = {.userdata = 8, .category_mask = ACL_ALLOW_MASK,
223 .src_port_high = 0xffff,
225 .dst_port_high = 0xffff,
227 /* matches all packets with VLAN tag 5 */
229 .data = {.userdata = 9, .category_mask = ACL_DENY_MASK,
234 .src_port_high = 0xffff,
236 .dst_port_high = 0xffff,
240 /* matches all packets with lower 7 bytes of domain equal to 0x64 */
242 .data = {.userdata = 10, .category_mask = ACL_ALLOW_MASK,
247 .src_port_high = 0xffff,
249 .dst_port_high = 0xffff,
251 /* matches all packets with domains that have 0x5 in them */
253 .data = {.userdata = 11, .category_mask = ACL_ALLOW_MASK,
258 .src_port_high = 0xffff,
260 .dst_port_high = 0xffff,
262 /* matches all packets with domain 5 */
264 .data = {.userdata = 12, .category_mask = ACL_DENY_MASK,
267 .domain_mask = 0xffff,
269 .src_port_high = 0xffff,
271 .dst_port_high = 0xffff,
274 /* destination port */
275 /* matches everything with dst port 80 */
277 .data = {.userdata = 13, .category_mask = ACL_ALLOW_MASK,
282 .src_port_high = 0xffff,
284 /* matches everything with dst port 22-1023 */
286 .data = {.userdata = 14, .category_mask = ACL_ALLOW_MASK,
289 .dst_port_high = 1023,
291 .src_port_high = 0xffff,
293 /* matches everything with dst port 1020 */
295 .data = {.userdata = 15, .category_mask = ACL_DENY_MASK,
297 .dst_port_low = 1020,
298 .dst_port_high = 1020,
300 .src_port_high = 0xffff,
302 /* matches everything with dst portrange 1000-2000 */
304 .data = {.userdata = 16, .category_mask = ACL_DENY_MASK,
306 .dst_port_low = 1000,
307 .dst_port_high = 2000,
309 .src_port_high = 0xffff,
313 /* matches everything with src port 80 */
315 .data = {.userdata = 17, .category_mask = ACL_ALLOW_MASK,
320 .dst_port_high = 0xffff,
322 /* matches everything with src port 22-1023 */
324 .data = {.userdata = 18, .category_mask = ACL_ALLOW_MASK,
327 .src_port_high = 1023,
329 .dst_port_high = 0xffff,
331 /* matches everything with src port 1020 */
333 .data = {.userdata = 19, .category_mask = ACL_DENY_MASK,
335 .src_port_low = 1020,
336 .src_port_high = 1020,
338 .dst_port_high = 0xffff,
340 /* matches everything with src portrange 1000-2000 */
342 .data = {.userdata = 20, .category_mask = ACL_DENY_MASK,
344 .src_port_low = 1000,
345 .src_port_high = 2000,
347 .dst_port_high = 0xffff,
350 /* protocol number */
351 /* matches all packets with protocol number either 0x64 or 0xE4 */
353 .data = {.userdata = 21, .category_mask = ACL_ALLOW_MASK,
358 .src_port_high = 0xffff,
360 .dst_port_high = 0xffff,
362 /* matches all packets with protocol that have 0x5 in them */
364 .data = {.userdata = 22, .category_mask = ACL_ALLOW_MASK,
369 .src_port_high = 0xffff,
371 .dst_port_high = 0xffff,
373 /* matches all packets with protocol 5 */
375 .data = {.userdata = 23, .category_mask = ACL_DENY_MASK,
380 .src_port_high = 0xffff,
382 .dst_port_high = 0xffff,
385 /* rules combining various fields */
387 .data = {.userdata = 24, .category_mask = ACL_ALLOW_MASK,
389 /** make sure that unmasked bytes don't fail! */
390 .dst_addr = IPv4(1,2,3,4),
392 .src_addr = IPv4(5,6,7,8),
397 .src_port_high = 0xffff,
399 .dst_port_high = 1024,
403 .domain_mask = 0xffff,
406 .data = {.userdata = 25, .category_mask = ACL_DENY_MASK,
408 .dst_addr = IPv4(5,6,7,8),
410 .src_addr = IPv4(1,2,3,4),
415 .src_port_high = 0xffff,
417 .dst_port_high = 1024,
421 .domain_mask = 0xffff,
424 .data = {.userdata = 26, .category_mask = ACL_ALLOW_MASK,
426 .dst_addr = IPv4(1,2,3,4),
428 .src_addr = IPv4(5,6,7,8),
433 .src_port_high = 0xffff,
435 .dst_port_high = 1024,
440 .data = {.userdata = 27, .category_mask = ACL_DENY_MASK,
442 .dst_addr = IPv4(5,6,7,8),
444 .src_addr = IPv4(1,2,3,4),
449 .src_port_high = 0xffff,
451 .dst_port_high = 1024,
457 /* data for ACL unit test */
458 struct ipv4_7tuple acl_test_data[] = {
459 /* testing single rule aspects */
460 {.ip_src = IPv4(10,0,0,0), .allow = 4}, /* should match 4 */
461 {.ip_src = IPv4(10,1,1,2), .allow = 5}, /* should match 5 */
462 {.ip_src = IPv4(10,1,1,1), .allow = 5,
463 .deny = 6}, /* should match 5, 6 */
464 {.ip_dst = IPv4(10,0,0,0)}, /* should not match */
465 {.ip_dst = IPv4(10,1,1,2)}, /* should not match */
466 {.ip_dst = IPv4(10,1,1,1)}, /* should not match */
468 {.ip_src = IPv4(192,168,2,50)}, /* should not match */
469 {.ip_src = IPv4(192,168,1,2)}, /* should not match */
470 {.ip_src = IPv4(192,168,1,50)}, /* should not match */
471 {.ip_dst = IPv4(192,168,2,50), .allow = 1}, /* should match 1 */
472 {.ip_dst = IPv4(192,168,1,49), .allow = 2}, /* should match 2 */
473 {.ip_dst = IPv4(192,168,1,50), .allow = 2,
474 .deny = 3}, /* should match 2, 3 */
476 {.vlan = 0x64, .allow = 7}, /* should match 7 */
477 {.vlan = 0xfE4, .allow = 7}, /* should match 7 */
478 {.vlan = 0xE2}, /* should not match */
479 {.vlan = 0xD, .allow = 8}, /* should match 8 */
480 {.vlan = 0x6}, /* should not match */
481 {.vlan = 0x5, .allow = 8, .deny = 9}, /* should match 8, 9 */
483 {.domain = 0x64, .allow = 10}, /* should match 10 */
484 {.domain = 0xfE4, .allow = 10}, /* should match 10 */
485 {.domain = 0xE2}, /* should not match */
486 {.domain = 0xD, .allow = 11}, /* should match 11 */
487 {.domain = 0x6}, /* should not match */
488 {.domain = 0x5, .allow = 11, .deny = 12}, /* should match 11, 12 */
490 {.port_dst = 80, .allow = 13}, /* should match 13 */
491 {.port_dst = 79, .allow = 14}, /* should match 14 */
492 {.port_dst = 81, .allow = 14}, /* should match 14 */
493 {.port_dst = 21}, /* should not match */
494 {.port_dst = 1024, .deny = 16}, /* should match 16 */
495 {.port_dst = 1020, .allow = 14, .deny = 15}, /* should match 14, 15 */
497 {.port_src = 80, .allow = 17}, /* should match 17 */
498 {.port_src = 79, .allow = 18}, /* should match 18 */
499 {.port_src = 81, .allow = 18}, /* should match 18 */
500 {.port_src = 21}, /* should not match */
501 {.port_src = 1024, .deny = 20}, /* should match 20 */
502 {.port_src = 1020, .allow = 18, .deny = 19}, /* should match 18, 19 */
504 {.proto = 0x64, .allow = 21}, /* should match 21 */
505 {.proto = 0xE4, .allow = 21}, /* should match 21 */
506 {.proto = 0xE2}, /* should not match */
507 {.proto = 0xD, .allow = 22}, /* should match 22 */
508 {.proto = 0x6}, /* should not match */
509 {.proto = 0x5, .allow = 22, .deny = 23}, /* should match 22, 23 */
511 /* testing matching multiple rules at once */
512 {.vlan = 0x5, .ip_src = IPv4(10,1,1,1),
513 .allow = 5, .deny = 9}, /* should match 5, 9 */
514 {.vlan = 0x5, .ip_src = IPv4(192,168,2,50),
515 .allow = 8, .deny = 9}, /* should match 8, 9 */
516 {.vlan = 0x55, .ip_src = IPv4(192,168,1,49),
517 .allow = 8}, /* should match 8 */
518 {.port_dst = 80, .port_src = 1024,
519 .allow = 13, .deny = 20}, /* should match 13,20 */
520 {.port_dst = 79, .port_src = 1024,
521 .allow = 14, .deny = 20}, /* should match 14,20 */
522 {.proto = 0x5, .ip_dst = IPv4(192,168,2,50),
523 .allow = 1, .deny = 23}, /* should match 1, 23 */
525 {.proto = 0x5, .ip_dst = IPv4(192,168,1,50),
526 .allow = 2, .deny = 23}, /* should match 2, 23 */
527 {.vlan = 0x64, .domain = 0x5,
528 .allow = 11, .deny = 12}, /* should match 11, 12 */
529 {.proto = 0x5, .port_src = 80,
530 .allow = 17, .deny = 23}, /* should match 17, 23 */
531 {.proto = 0x5, .port_dst = 80,
532 .allow = 13, .deny = 23}, /* should match 13, 23 */
533 {.proto = 0x51, .port_src = 5000}, /* should not match */
534 {.ip_src = IPv4(192,168,1,50),
535 .ip_dst = IPv4(10,0,0,0),
538 .port_dst = 5000}, /* should not match */
540 /* test full packet rules */
542 .ip_dst = IPv4(1,2,100,200),
543 .ip_src = IPv4(5,6,7,254),
551 }, /* should match 23, 24 */
553 .ip_dst = IPv4(5,6,7,254),
554 .ip_src = IPv4(1,2,100,200),
562 }, /* should match 13, 25 */
564 .ip_dst = IPv4(1,10,20,30),
565 .ip_src = IPv4(5,6,7,8),
572 }, /* should match 23, 26 */
574 .ip_dst = IPv4(5,6,7,8),
575 .ip_src = IPv4(1,10,20,30),
582 }, /* should match 13, 27 */
584 .ip_dst = IPv4(2,2,3,4),
585 .ip_src = IPv4(4,6,7,8),
592 }, /* should match 13, 23 */
594 .ip_dst = IPv4(1,2,3,4),
595 .ip_src = IPv4(4,6,7,8),
602 }, /* should match 13, 23 */
605 /* visual separator! */
607 .ip_dst = IPv4(1,2,100,200),
608 .ip_src = IPv4(5,6,7,254),
615 }, /* should match 10 */
617 .ip_dst = IPv4(5,6,7,254),
618 .ip_src = IPv4(1,2,100,200),
625 }, /* should match 10 */
627 .ip_dst = IPv4(1,10,20,30),
628 .ip_src = IPv4(5,6,7,8),
634 }, /* should match 7 */
636 .ip_dst = IPv4(5,6,7,8),
637 .ip_src = IPv4(1,10,20,30),
643 }, /* should match 7 */
645 .ip_dst = IPv4(2,2,3,4),
646 .ip_src = IPv4(4,6,7,8),
652 }, /* should match 7 */
654 .ip_dst = IPv4(1,2,3,4),
655 .ip_src = IPv4(4,6,7,8),
660 }, /* should not match */
663 #endif /* TEST_ACL_H_ */