4 * Copyright(c) 2016 Intel Corporation. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * * Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * * Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
17 * * Neither the name of Intel Corporation nor the names of its
18 * contributors may be used to endorse or promote products derived
19 * from this software without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37 #include <sys/types.h>
38 #include <netinet/in.h>
39 #include <netinet/ip.h>
47 #define MAX_ACL_RULE_NUM 1024
50 * Rule and trace formats definitions.
62 * That effectively defines order of IPV4 classifications:
66 * - PORTS (SRC and DST)
76 struct rte_acl_field_def ip4_defs
[NUM_FIELDS_IPV4
] = {
78 .type
= RTE_ACL_FIELD_TYPE_BITMASK
,
79 .size
= sizeof(uint8_t),
80 .field_index
= PROTO_FIELD_IPV4
,
81 .input_index
= RTE_ACL_IPV4_PROTO
,
85 .type
= RTE_ACL_FIELD_TYPE_MASK
,
86 .size
= sizeof(uint32_t),
87 .field_index
= SRC_FIELD_IPV4
,
88 .input_index
= RTE_ACL_IPV4_SRC
,
89 .offset
= offsetof(struct ip
, ip_src
) - offsetof(struct ip
, ip_p
)
92 .type
= RTE_ACL_FIELD_TYPE_MASK
,
93 .size
= sizeof(uint32_t),
94 .field_index
= DST_FIELD_IPV4
,
95 .input_index
= RTE_ACL_IPV4_DST
,
96 .offset
= offsetof(struct ip
, ip_dst
) - offsetof(struct ip
, ip_p
)
99 .type
= RTE_ACL_FIELD_TYPE_RANGE
,
100 .size
= sizeof(uint16_t),
101 .field_index
= SRCP_FIELD_IPV4
,
102 .input_index
= RTE_ACL_IPV4_PORTS
,
103 .offset
= sizeof(struct ip
) - offsetof(struct ip
, ip_p
)
106 .type
= RTE_ACL_FIELD_TYPE_RANGE
,
107 .size
= sizeof(uint16_t),
108 .field_index
= DSTP_FIELD_IPV4
,
109 .input_index
= RTE_ACL_IPV4_PORTS
,
110 .offset
= sizeof(struct ip
) - offsetof(struct ip
, ip_p
) +
115 RTE_ACL_RULE_DEF(acl4_rules
, RTE_DIM(ip4_defs
));
117 struct acl4_rules acl4_rules_out
[MAX_ACL_RULE_NUM
];
118 uint32_t nb_acl4_rules_out
;
120 struct acl4_rules acl4_rules_in
[MAX_ACL_RULE_NUM
];
121 uint32_t nb_acl4_rules_in
;
124 parse_sp4_tokens(char **tokens
, uint32_t n_tokens
,
125 struct parse_status
*status
)
127 struct acl4_rules
*rule_ipv4
= NULL
;
129 uint32_t *ri
= NULL
; /* rule index */
130 uint32_t ti
= 0; /* token index */
133 uint32_t protect_p
= 0;
134 uint32_t bypass_p
= 0;
135 uint32_t discard_p
= 0;
139 uint32_t proto_p
= 0;
140 uint32_t sport_p
= 0;
141 uint32_t dport_p
= 0;
143 if (strcmp(tokens
[1], "in") == 0) {
144 ri
= &nb_acl4_rules_in
;
146 APP_CHECK(*ri
<= MAX_ACL_RULE_NUM
- 1, status
,
147 "too many sp rules, abort insertion\n");
148 if (status
->status
< 0)
151 rule_ipv4
= &acl4_rules_in
[*ri
];
153 } else if (strcmp(tokens
[1], "out") == 0) {
154 ri
= &nb_acl4_rules_out
;
156 APP_CHECK(*ri
<= MAX_ACL_RULE_NUM
- 1, status
,
157 "too many sp rules, abort insertion\n");
158 if (status
->status
< 0)
161 rule_ipv4
= &acl4_rules_out
[*ri
];
163 APP_CHECK(0, status
, "unrecognized input \"%s\", expect"
164 " \"in\" or \"out\"\n", tokens
[ti
]);
168 rule_ipv4
->data
.category_mask
= 1;
170 for (ti
= 2; ti
< n_tokens
; ti
++) {
171 if (strcmp(tokens
[ti
], "esp") == 0) {
172 /* currently do nothing */
173 APP_CHECK_PRESENCE(esp_p
, tokens
[ti
], status
);
174 if (status
->status
< 0)
180 if (strcmp(tokens
[ti
], "protect") == 0) {
181 APP_CHECK_PRESENCE(protect_p
, tokens
[ti
], status
);
182 if (status
->status
< 0)
184 APP_CHECK(bypass_p
== 0, status
, "conflict item "
185 "between \"%s\" and \"%s\"", tokens
[ti
],
187 if (status
->status
< 0)
189 APP_CHECK(discard_p
== 0, status
, "conflict item "
190 "between \"%s\" and \"%s\"", tokens
[ti
],
192 if (status
->status
< 0)
194 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
195 if (status
->status
< 0)
197 APP_CHECK_TOKEN_IS_NUM(tokens
, ti
, status
);
198 if (status
->status
< 0)
201 rule_ipv4
->data
.userdata
=
202 PROTECT(atoi(tokens
[ti
]));
208 if (strcmp(tokens
[ti
], "bypass") == 0) {
209 APP_CHECK_PRESENCE(bypass_p
, tokens
[ti
], status
);
210 if (status
->status
< 0)
212 APP_CHECK(protect_p
== 0, status
, "conflict item "
213 "between \"%s\" and \"%s\"", tokens
[ti
],
215 if (status
->status
< 0)
217 APP_CHECK(discard_p
== 0, status
, "conflict item "
218 "between \"%s\" and \"%s\"", tokens
[ti
],
220 if (status
->status
< 0)
223 rule_ipv4
->data
.userdata
= BYPASS
;
229 if (strcmp(tokens
[ti
], "discard") == 0) {
230 APP_CHECK_PRESENCE(discard_p
, tokens
[ti
], status
);
231 if (status
->status
< 0)
233 APP_CHECK(protect_p
== 0, status
, "conflict item "
234 "between \"%s\" and \"%s\"", tokens
[ti
],
236 if (status
->status
< 0)
238 APP_CHECK(bypass_p
== 0, status
, "conflict item "
239 "between \"%s\" and \"%s\"", tokens
[ti
],
241 if (status
->status
< 0)
244 rule_ipv4
->data
.userdata
= DISCARD
;
250 if (strcmp(tokens
[ti
], "pri") == 0) {
251 APP_CHECK_PRESENCE(pri_p
, tokens
[ti
], status
);
252 if (status
->status
< 0)
254 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
255 if (status
->status
< 0)
257 APP_CHECK_TOKEN_IS_NUM(tokens
, ti
, status
);
258 if (status
->status
< 0)
261 rule_ipv4
->data
.priority
= atoi(tokens
[ti
]);
267 if (strcmp(tokens
[ti
], "src") == 0) {
271 APP_CHECK_PRESENCE(src_p
, tokens
[ti
], status
);
272 if (status
->status
< 0)
274 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
275 if (status
->status
< 0)
278 APP_CHECK(parse_ipv4_addr(tokens
[ti
], &ip
,
279 &depth
) == 0, status
, "unrecognized "
280 "input \"%s\", expect valid ipv4 addr",
282 if (status
->status
< 0)
285 rule_ipv4
->field
[1].value
.u32
=
286 rte_bswap32(ip
.s_addr
);
287 rule_ipv4
->field
[1].mask_range
.u32
=
294 if (strcmp(tokens
[ti
], "dst") == 0) {
298 APP_CHECK_PRESENCE(dst_p
, tokens
[ti
], status
);
299 if (status
->status
< 0)
301 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
302 if (status
->status
< 0)
304 APP_CHECK(parse_ipv4_addr(tokens
[ti
], &ip
,
305 &depth
) == 0, status
, "unrecognized "
306 "input \"%s\", expect valid ipv4 addr",
308 if (status
->status
< 0)
311 rule_ipv4
->field
[2].value
.u32
=
312 rte_bswap32(ip
.s_addr
);
313 rule_ipv4
->field
[2].mask_range
.u32
=
320 if (strcmp(tokens
[ti
], "proto") == 0) {
323 APP_CHECK_PRESENCE(proto_p
, tokens
[ti
], status
);
324 if (status
->status
< 0)
326 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
327 if (status
->status
< 0)
330 APP_CHECK(parse_range(tokens
[ti
], &low
, &high
)
331 == 0, status
, "unrecognized input \"%s\""
332 ", expect \"from:to\"", tokens
[ti
]);
333 if (status
->status
< 0)
335 APP_CHECK(low
<= 0xff, status
, "proto low "
337 if (status
->status
< 0)
339 APP_CHECK(high
<= 0xff, status
, "proto high "
341 if (status
->status
< 0)
344 rule_ipv4
->field
[0].value
.u8
= (uint8_t)low
;
345 rule_ipv4
->field
[0].mask_range
.u8
= (uint8_t)high
;
351 if (strcmp(tokens
[ti
], "sport") == 0) {
352 uint16_t port_low
, port_high
;
354 APP_CHECK_PRESENCE(sport_p
, tokens
[ti
], status
);
355 if (status
->status
< 0)
357 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
358 if (status
->status
< 0)
361 APP_CHECK(parse_range(tokens
[ti
], &port_low
,
362 &port_high
) == 0, status
, "unrecognized "
363 "input \"%s\", expect \"port_from:"
364 "port_to\"", tokens
[ti
]);
365 if (status
->status
< 0)
368 rule_ipv4
->field
[3].value
.u16
= port_low
;
369 rule_ipv4
->field
[3].mask_range
.u16
= port_high
;
375 if (strcmp(tokens
[ti
], "dport") == 0) {
376 uint16_t port_low
, port_high
;
378 APP_CHECK_PRESENCE(dport_p
, tokens
[ti
], status
);
379 if (status
->status
< 0)
381 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
382 if (status
->status
< 0)
385 APP_CHECK(parse_range(tokens
[ti
], &port_low
,
386 &port_high
) == 0, status
, "unrecognized "
387 "input \"%s\", expect \"port_from:"
388 "port_to\"", tokens
[ti
]);
389 if (status
->status
< 0)
392 rule_ipv4
->field
[4].value
.u16
= port_low
;
393 rule_ipv4
->field
[4].mask_range
.u16
= port_high
;
399 /* unrecognizeable input */
400 APP_CHECK(0, status
, "unrecognized input \"%s\"",
405 /* check if argument(s) are missing */
406 APP_CHECK(esp_p
== 1, status
, "missing argument \"esp\"");
407 if (status
->status
< 0)
410 APP_CHECK(protect_p
| bypass_p
| discard_p
, status
, "missing "
411 "argument \"protect\", \"bypass\", or \"discard\"");
412 if (status
->status
< 0)
419 print_one_ip4_rule(const struct acl4_rules
*rule
, int32_t extra
)
423 uint32_t_to_char(rule
->field
[SRC_FIELD_IPV4
].value
.u32
,
425 printf("%hhu.%hhu.%hhu.%hhu/%u ", a
, b
, c
, d
,
426 rule
->field
[SRC_FIELD_IPV4
].mask_range
.u32
);
427 uint32_t_to_char(rule
->field
[DST_FIELD_IPV4
].value
.u32
,
429 printf("%hhu.%hhu.%hhu.%hhu/%u ", a
, b
, c
, d
,
430 rule
->field
[DST_FIELD_IPV4
].mask_range
.u32
);
431 printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
432 rule
->field
[SRCP_FIELD_IPV4
].value
.u16
,
433 rule
->field
[SRCP_FIELD_IPV4
].mask_range
.u16
,
434 rule
->field
[DSTP_FIELD_IPV4
].value
.u16
,
435 rule
->field
[DSTP_FIELD_IPV4
].mask_range
.u16
,
436 rule
->field
[PROTO_FIELD_IPV4
].value
.u8
,
437 rule
->field
[PROTO_FIELD_IPV4
].mask_range
.u8
);
439 printf("0x%x-0x%x-0x%x ",
440 rule
->data
.category_mask
,
442 rule
->data
.userdata
);
446 dump_ip4_rules(const struct acl4_rules
*rule
, int32_t num
, int32_t extra
)
450 for (i
= 0; i
< num
; i
++, rule
++) {
451 printf("\t%d:", i
+ 1);
452 print_one_ip4_rule(rule
, extra
);
457 static struct rte_acl_ctx
*
458 acl4_init(const char *name
, int32_t socketid
, const struct acl4_rules
*rules
,
462 struct rte_acl_param acl_param
;
463 struct rte_acl_config acl_build_param
;
464 struct rte_acl_ctx
*ctx
;
466 printf("Creating SP context with %u max rules\n", MAX_ACL_RULE_NUM
);
468 memset(&acl_param
, 0, sizeof(acl_param
));
470 /* Create ACL contexts */
471 snprintf(s
, sizeof(s
), "%s_%d", name
, socketid
);
473 printf("IPv4 %s entries [%u]:\n", s
, rules_nb
);
474 dump_ip4_rules(rules
, rules_nb
, 1);
477 acl_param
.socket_id
= socketid
;
478 acl_param
.rule_size
= RTE_ACL_RULE_SZ(RTE_DIM(ip4_defs
));
479 acl_param
.max_rule_num
= MAX_ACL_RULE_NUM
;
481 ctx
= rte_acl_create(&acl_param
);
483 rte_exit(EXIT_FAILURE
, "Failed to create ACL context\n");
485 if (rte_acl_add_rules(ctx
, (const struct rte_acl_rule
*)rules
,
487 rte_exit(EXIT_FAILURE
, "add rules failed\n");
490 memset(&acl_build_param
, 0, sizeof(acl_build_param
));
492 acl_build_param
.num_categories
= DEFAULT_MAX_CATEGORIES
;
493 acl_build_param
.num_fields
= RTE_DIM(ip4_defs
);
494 memcpy(&acl_build_param
.defs
, ip4_defs
, sizeof(ip4_defs
));
496 if (rte_acl_build(ctx
, &acl_build_param
) != 0)
497 rte_exit(EXIT_FAILURE
, "Failed to build ACL trie\n");
505 sp4_init(struct socket_ctx
*ctx
, int32_t socket_id
)
510 rte_exit(EXIT_FAILURE
, "NULL context.\n");
512 if (ctx
->sp_ip4_in
!= NULL
)
513 rte_exit(EXIT_FAILURE
, "Inbound SP DB for socket %u already "
514 "initialized\n", socket_id
);
516 if (ctx
->sp_ip4_out
!= NULL
)
517 rte_exit(EXIT_FAILURE
, "Outbound SP DB for socket %u already "
518 "initialized\n", socket_id
);
520 if (nb_acl4_rules_in
> 0) {
522 ctx
->sp_ip4_in
= (struct sp_ctx
*)acl4_init(name
,
523 socket_id
, acl4_rules_in
, nb_acl4_rules_in
);
525 RTE_LOG(WARNING
, IPSEC
, "No IPv4 SP Inbound rule "
528 if (nb_acl4_rules_out
> 0) {
530 ctx
->sp_ip4_out
= (struct sp_ctx
*)acl4_init(name
,
531 socket_id
, acl4_rules_out
, nb_acl4_rules_out
);
533 RTE_LOG(WARNING
, IPSEC
, "No IPv4 SP Outbound rule "