1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(c) 2016 Intel Corporation
9 #include <netinet/in.h>
10 #include <netinet/ip.h>
18 #define MAX_ACL_RULE_NUM 1024
21 * Rule and trace formats definitions.
33 * That effectively defines order of IPV4 classifications:
37 * - PORTS (SRC and DST)
47 static struct rte_acl_field_def ip4_defs
[NUM_FIELDS_IPV4
] = {
49 .type
= RTE_ACL_FIELD_TYPE_BITMASK
,
50 .size
= sizeof(uint8_t),
51 .field_index
= PROTO_FIELD_IPV4
,
52 .input_index
= RTE_ACL_IPV4_PROTO
,
56 .type
= RTE_ACL_FIELD_TYPE_MASK
,
57 .size
= sizeof(uint32_t),
58 .field_index
= SRC_FIELD_IPV4
,
59 .input_index
= RTE_ACL_IPV4_SRC
,
60 .offset
= offsetof(struct ip
, ip_src
) - offsetof(struct ip
, ip_p
)
63 .type
= RTE_ACL_FIELD_TYPE_MASK
,
64 .size
= sizeof(uint32_t),
65 .field_index
= DST_FIELD_IPV4
,
66 .input_index
= RTE_ACL_IPV4_DST
,
67 .offset
= offsetof(struct ip
, ip_dst
) - offsetof(struct ip
, ip_p
)
70 .type
= RTE_ACL_FIELD_TYPE_RANGE
,
71 .size
= sizeof(uint16_t),
72 .field_index
= SRCP_FIELD_IPV4
,
73 .input_index
= RTE_ACL_IPV4_PORTS
,
74 .offset
= sizeof(struct ip
) - offsetof(struct ip
, ip_p
)
77 .type
= RTE_ACL_FIELD_TYPE_RANGE
,
78 .size
= sizeof(uint16_t),
79 .field_index
= DSTP_FIELD_IPV4
,
80 .input_index
= RTE_ACL_IPV4_PORTS
,
81 .offset
= sizeof(struct ip
) - offsetof(struct ip
, ip_p
) +
86 RTE_ACL_RULE_DEF(acl4_rules
, RTE_DIM(ip4_defs
));
88 static struct acl4_rules acl4_rules_out
[MAX_ACL_RULE_NUM
];
89 static uint32_t nb_acl4_rules_out
;
91 static struct acl4_rules acl4_rules_in
[MAX_ACL_RULE_NUM
];
92 static uint32_t nb_acl4_rules_in
;
95 parse_sp4_tokens(char **tokens
, uint32_t n_tokens
,
96 struct parse_status
*status
)
98 struct acl4_rules
*rule_ipv4
= NULL
;
100 uint32_t *ri
= NULL
; /* rule index */
101 uint32_t ti
= 0; /* token index */
105 uint32_t protect_p
= 0;
106 uint32_t bypass_p
= 0;
107 uint32_t discard_p
= 0;
111 uint32_t proto_p
= 0;
112 uint32_t sport_p
= 0;
113 uint32_t dport_p
= 0;
115 if (strcmp(tokens
[1], "in") == 0) {
116 ri
= &nb_acl4_rules_in
;
118 APP_CHECK(*ri
<= MAX_ACL_RULE_NUM
- 1, status
,
119 "too many sp rules, abort insertion\n");
120 if (status
->status
< 0)
123 rule_ipv4
= &acl4_rules_in
[*ri
];
125 } else if (strcmp(tokens
[1], "out") == 0) {
126 ri
= &nb_acl4_rules_out
;
128 APP_CHECK(*ri
<= MAX_ACL_RULE_NUM
- 1, status
,
129 "too many sp rules, abort insertion\n");
130 if (status
->status
< 0)
133 rule_ipv4
= &acl4_rules_out
[*ri
];
135 APP_CHECK(0, status
, "unrecognized input \"%s\", expect"
136 " \"in\" or \"out\"\n", tokens
[ti
]);
140 rule_ipv4
->data
.category_mask
= 1;
142 for (ti
= 2; ti
< n_tokens
; ti
++) {
143 if (strcmp(tokens
[ti
], "esp") == 0) {
144 /* currently do nothing */
145 APP_CHECK_PRESENCE(esp_p
, tokens
[ti
], status
);
146 if (status
->status
< 0)
152 if (strcmp(tokens
[ti
], "protect") == 0) {
153 APP_CHECK_PRESENCE(protect_p
, tokens
[ti
], status
);
154 if (status
->status
< 0)
156 APP_CHECK(bypass_p
== 0, status
, "conflict item "
157 "between \"%s\" and \"%s\"", tokens
[ti
],
159 if (status
->status
< 0)
161 APP_CHECK(discard_p
== 0, status
, "conflict item "
162 "between \"%s\" and \"%s\"", tokens
[ti
],
164 if (status
->status
< 0)
166 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
167 if (status
->status
< 0)
169 APP_CHECK_TOKEN_IS_NUM(tokens
, ti
, status
);
170 if (status
->status
< 0)
173 tv
= atoi(tokens
[ti
]);
174 APP_CHECK(tv
!= DISCARD
&& tv
!= BYPASS
, status
,
175 "invalid SPI: %s", tokens
[ti
]);
176 if (status
->status
< 0)
178 rule_ipv4
->data
.userdata
= tv
;
184 if (strcmp(tokens
[ti
], "bypass") == 0) {
185 APP_CHECK_PRESENCE(bypass_p
, tokens
[ti
], status
);
186 if (status
->status
< 0)
188 APP_CHECK(protect_p
== 0, status
, "conflict item "
189 "between \"%s\" and \"%s\"", tokens
[ti
],
191 if (status
->status
< 0)
193 APP_CHECK(discard_p
== 0, status
, "conflict item "
194 "between \"%s\" and \"%s\"", tokens
[ti
],
196 if (status
->status
< 0)
199 rule_ipv4
->data
.userdata
= BYPASS
;
205 if (strcmp(tokens
[ti
], "discard") == 0) {
206 APP_CHECK_PRESENCE(discard_p
, tokens
[ti
], status
);
207 if (status
->status
< 0)
209 APP_CHECK(protect_p
== 0, status
, "conflict item "
210 "between \"%s\" and \"%s\"", tokens
[ti
],
212 if (status
->status
< 0)
214 APP_CHECK(bypass_p
== 0, status
, "conflict item "
215 "between \"%s\" and \"%s\"", tokens
[ti
],
217 if (status
->status
< 0)
220 rule_ipv4
->data
.userdata
= DISCARD
;
226 if (strcmp(tokens
[ti
], "pri") == 0) {
227 APP_CHECK_PRESENCE(pri_p
, tokens
[ti
], status
);
228 if (status
->status
< 0)
230 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
231 if (status
->status
< 0)
233 APP_CHECK_TOKEN_IS_NUM(tokens
, ti
, status
);
234 if (status
->status
< 0)
237 rule_ipv4
->data
.priority
= atoi(tokens
[ti
]);
243 if (strcmp(tokens
[ti
], "src") == 0) {
247 APP_CHECK_PRESENCE(src_p
, tokens
[ti
], status
);
248 if (status
->status
< 0)
250 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
251 if (status
->status
< 0)
254 APP_CHECK(parse_ipv4_addr(tokens
[ti
], &ip
,
255 &depth
) == 0, status
, "unrecognized "
256 "input \"%s\", expect valid ipv4 addr",
258 if (status
->status
< 0)
261 rule_ipv4
->field
[1].value
.u32
=
262 rte_bswap32(ip
.s_addr
);
263 rule_ipv4
->field
[1].mask_range
.u32
=
270 if (strcmp(tokens
[ti
], "dst") == 0) {
274 APP_CHECK_PRESENCE(dst_p
, tokens
[ti
], status
);
275 if (status
->status
< 0)
277 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
278 if (status
->status
< 0)
280 APP_CHECK(parse_ipv4_addr(tokens
[ti
], &ip
,
281 &depth
) == 0, status
, "unrecognized "
282 "input \"%s\", expect valid ipv4 addr",
284 if (status
->status
< 0)
287 rule_ipv4
->field
[2].value
.u32
=
288 rte_bswap32(ip
.s_addr
);
289 rule_ipv4
->field
[2].mask_range
.u32
=
296 if (strcmp(tokens
[ti
], "proto") == 0) {
299 APP_CHECK_PRESENCE(proto_p
, tokens
[ti
], status
);
300 if (status
->status
< 0)
302 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
303 if (status
->status
< 0)
306 APP_CHECK(parse_range(tokens
[ti
], &low
, &high
)
307 == 0, status
, "unrecognized input \"%s\""
308 ", expect \"from:to\"", tokens
[ti
]);
309 if (status
->status
< 0)
311 APP_CHECK(low
<= 0xff, status
, "proto low "
313 if (status
->status
< 0)
315 APP_CHECK(high
<= 0xff, status
, "proto high "
317 if (status
->status
< 0)
320 rule_ipv4
->field
[0].value
.u8
= (uint8_t)low
;
321 rule_ipv4
->field
[0].mask_range
.u8
= (uint8_t)high
;
327 if (strcmp(tokens
[ti
], "sport") == 0) {
328 uint16_t port_low
, port_high
;
330 APP_CHECK_PRESENCE(sport_p
, tokens
[ti
], status
);
331 if (status
->status
< 0)
333 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
334 if (status
->status
< 0)
337 APP_CHECK(parse_range(tokens
[ti
], &port_low
,
338 &port_high
) == 0, status
, "unrecognized "
339 "input \"%s\", expect \"port_from:"
340 "port_to\"", tokens
[ti
]);
341 if (status
->status
< 0)
344 rule_ipv4
->field
[3].value
.u16
= port_low
;
345 rule_ipv4
->field
[3].mask_range
.u16
= port_high
;
351 if (strcmp(tokens
[ti
], "dport") == 0) {
352 uint16_t port_low
, port_high
;
354 APP_CHECK_PRESENCE(dport_p
, tokens
[ti
], status
);
355 if (status
->status
< 0)
357 INCREMENT_TOKEN_INDEX(ti
, n_tokens
, status
);
358 if (status
->status
< 0)
361 APP_CHECK(parse_range(tokens
[ti
], &port_low
,
362 &port_high
) == 0, status
, "unrecognized "
363 "input \"%s\", expect \"port_from:"
364 "port_to\"", tokens
[ti
]);
365 if (status
->status
< 0)
368 rule_ipv4
->field
[4].value
.u16
= port_low
;
369 rule_ipv4
->field
[4].mask_range
.u16
= port_high
;
375 /* unrecognizeable input */
376 APP_CHECK(0, status
, "unrecognized input \"%s\"",
381 /* check if argument(s) are missing */
382 APP_CHECK(esp_p
== 1, status
, "missing argument \"esp\"");
383 if (status
->status
< 0)
386 APP_CHECK(protect_p
| bypass_p
| discard_p
, status
, "missing "
387 "argument \"protect\", \"bypass\", or \"discard\"");
388 if (status
->status
< 0)
395 print_one_ip4_rule(const struct acl4_rules
*rule
, int32_t extra
)
399 uint32_t_to_char(rule
->field
[SRC_FIELD_IPV4
].value
.u32
,
401 printf("%hhu.%hhu.%hhu.%hhu/%u ", a
, b
, c
, d
,
402 rule
->field
[SRC_FIELD_IPV4
].mask_range
.u32
);
403 uint32_t_to_char(rule
->field
[DST_FIELD_IPV4
].value
.u32
,
405 printf("%hhu.%hhu.%hhu.%hhu/%u ", a
, b
, c
, d
,
406 rule
->field
[DST_FIELD_IPV4
].mask_range
.u32
);
407 printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
408 rule
->field
[SRCP_FIELD_IPV4
].value
.u16
,
409 rule
->field
[SRCP_FIELD_IPV4
].mask_range
.u16
,
410 rule
->field
[DSTP_FIELD_IPV4
].value
.u16
,
411 rule
->field
[DSTP_FIELD_IPV4
].mask_range
.u16
,
412 rule
->field
[PROTO_FIELD_IPV4
].value
.u8
,
413 rule
->field
[PROTO_FIELD_IPV4
].mask_range
.u8
);
415 printf("0x%x-0x%x-0x%x ",
416 rule
->data
.category_mask
,
418 rule
->data
.userdata
);
422 dump_ip4_rules(const struct acl4_rules
*rule
, int32_t num
, int32_t extra
)
426 for (i
= 0; i
< num
; i
++, rule
++) {
427 printf("\t%d:", i
+ 1);
428 print_one_ip4_rule(rule
, extra
);
433 static struct rte_acl_ctx
*
434 acl4_init(const char *name
, int32_t socketid
, const struct acl4_rules
*rules
,
438 struct rte_acl_param acl_param
;
439 struct rte_acl_config acl_build_param
;
440 struct rte_acl_ctx
*ctx
;
442 printf("Creating SP context with %u max rules\n", MAX_ACL_RULE_NUM
);
444 memset(&acl_param
, 0, sizeof(acl_param
));
446 /* Create ACL contexts */
447 snprintf(s
, sizeof(s
), "%s_%d", name
, socketid
);
449 printf("IPv4 %s entries [%u]:\n", s
, rules_nb
);
450 dump_ip4_rules(rules
, rules_nb
, 1);
453 acl_param
.socket_id
= socketid
;
454 acl_param
.rule_size
= RTE_ACL_RULE_SZ(RTE_DIM(ip4_defs
));
455 acl_param
.max_rule_num
= MAX_ACL_RULE_NUM
;
457 ctx
= rte_acl_create(&acl_param
);
459 rte_exit(EXIT_FAILURE
, "Failed to create ACL context\n");
461 if (rte_acl_add_rules(ctx
, (const struct rte_acl_rule
*)rules
,
463 rte_exit(EXIT_FAILURE
, "add rules failed\n");
466 memset(&acl_build_param
, 0, sizeof(acl_build_param
));
468 acl_build_param
.num_categories
= DEFAULT_MAX_CATEGORIES
;
469 acl_build_param
.num_fields
= RTE_DIM(ip4_defs
);
470 memcpy(&acl_build_param
.defs
, ip4_defs
, sizeof(ip4_defs
));
472 if (rte_acl_build(ctx
, &acl_build_param
) != 0)
473 rte_exit(EXIT_FAILURE
, "Failed to build ACL trie\n");
481 * check that for each rule it's SPI has a correspondent entry in SAD
484 check_spi_value(int inbound
)
486 uint32_t i
, num
, spi
;
487 const struct acl4_rules
*acr
;
491 num
= nb_acl4_rules_in
;
493 acr
= acl4_rules_out
;
494 num
= nb_acl4_rules_out
;
497 for (i
= 0; i
!= num
; i
++) {
498 spi
= acr
[i
].data
.userdata
;
499 if (spi
!= DISCARD
&& spi
!= BYPASS
&&
500 sa_spi_present(spi
, inbound
) < 0) {
501 RTE_LOG(ERR
, IPSEC
, "SPI %u is not present in SAD\n",
511 sp4_init(struct socket_ctx
*ctx
, int32_t socket_id
)
516 rte_exit(EXIT_FAILURE
, "NULL context.\n");
518 if (ctx
->sp_ip4_in
!= NULL
)
519 rte_exit(EXIT_FAILURE
, "Inbound SP DB for socket %u already "
520 "initialized\n", socket_id
);
522 if (ctx
->sp_ip4_out
!= NULL
)
523 rte_exit(EXIT_FAILURE
, "Outbound SP DB for socket %u already "
524 "initialized\n", socket_id
);
526 if (check_spi_value(1) < 0)
527 rte_exit(EXIT_FAILURE
,
528 "Inbound IPv4 SP DB has unmatched in SAD SPIs\n");
530 if (check_spi_value(0) < 0)
531 rte_exit(EXIT_FAILURE
,
532 "Outbound IPv4 SP DB has unmatched in SAD SPIs\n");
534 if (nb_acl4_rules_in
> 0) {
536 ctx
->sp_ip4_in
= (struct sp_ctx
*)acl4_init(name
,
537 socket_id
, acl4_rules_in
, nb_acl4_rules_in
);
539 RTE_LOG(WARNING
, IPSEC
, "No IPv4 SP Inbound rule "
542 if (nb_acl4_rules_out
> 0) {
544 ctx
->sp_ip4_out
= (struct sp_ctx
*)acl4_init(name
,
545 socket_id
, acl4_rules_out
, nb_acl4_rules_out
);
547 RTE_LOG(WARNING
, IPSEC
, "No IPv4 SP Outbound rule "
552 * Search though SP rules for given SPI.
555 sp4_spi_present(uint32_t spi
, int inbound
)
558 const struct acl4_rules
*acr
;
562 num
= nb_acl4_rules_in
;
564 acr
= acl4_rules_out
;
565 num
= nb_acl4_rules_out
;
568 for (i
= 0; i
!= num
; i
++) {
569 if (acr
[i
].data
.userdata
== spi
)