From patchwork Sun Mar 19 16:11:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shyam Shrivastav X-Patchwork-Id: 21984 Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [IPv6:::1]) by dpdk.org (Postfix) with ESMTP id 46403CF7A; Sun, 19 Mar 2017 17:11:16 +0100 (CET) Received: from mail-qt0-f176.google.com (mail-qt0-f176.google.com [209.85.216.176]) by dpdk.org (Postfix) with ESMTP id C8BAECF62 for ; Sun, 19 Mar 2017 17:11:13 +0100 (CET) Received: by mail-qt0-f176.google.com with SMTP id i34so92339689qtc.0 for ; Sun, 19 Mar 2017 09:11:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=bEDixFe5aAtfCYMORKu2EC2zb0GgkNx7dSbaH5FHxQw=; b=bdIyWDZAFsQYxiLoU1QaA2r3+/SyP8CKJuet0ZSkBguMd0HhMkDbbplNWi4a3zX9eR iLXFEzcwFmFl5lAEB8tX5qWxB9NzYrBOlU+vOngXC750Jym4h42P6oD9Wxf5rI82AHhJ XabJlmxex83mndiGX85Bq+yktKCEmGCHIhjir8MDq7tF0AprOCQjN22gQgmPLRHdhend U1139ztQbHEPiX9brzQwcsdFbtWZW2mMAMkoITBAgxfpEbF9HZ5hdIoaZe/XnsmWs0RK 4GxoWhjNa0gJQvCYAbVY7vwxoF+wf+N2KcLJj6AhxQmthFAOBGKaUvhxfbJb0N/eU6RD ZBIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=bEDixFe5aAtfCYMORKu2EC2zb0GgkNx7dSbaH5FHxQw=; b=S2xH9C/MQi/fqohwT0TpH7mLQbh18TjwTivkecIwAlnjZ9dhBXK5OIbhXPhpTxral3 EgfIkMx3NpkQlfbSy1kMClmWBBseXlqoy0qZdA+pDlFLkhoG0rVlsPH7ppNWF+pXRHVo GsWTuJlIa389IyC9cIc/8hkEpxWs3YWOkvhld1DGgLsGX26YEzysxpyzkwW9cVXFz/Op m3czpTm49QpGCwfxv6349s4/kYV4CYqJGfB1GLnDs1N6p+FHr43/rkxz7GQY+iwKy2lJ Il3rxW0yehXq4N6WnH9dhf6pT3Y52f83hEV5vjyAuUJfNVtvxZUXieo2WpO5cgPZeR7I P1Pw== X-Gm-Message-State: AFeK/H2paBQ7c4ujnMC4aUniS++kDANRT2fnS/P7f3PWA/jmJqd5laTt0AXEoasGtmbO+fFU1My9y/N+tJq9yw== X-Received: by 10.237.36.212 with SMTP id u20mr21912662qtc.290.1489939872818; Sun, 19 Mar 2017 09:11:12 -0700 (PDT) MIME-Version: 1.0 Received: by 10.12.139.71 with HTTP; Sun, 19 Mar 2017 09:11:12 -0700 (PDT) From: Shyam Shrivastav Date: Sun, 19 Mar 2017 21:41:12 +0530 Message-ID: To: dev@dpdk.org Cc: Shyam Shrivastav X-Content-Filtered-By: Mailman/MimeDel 2.1.15 Subject: [dpdk-dev] Fixed : ip_pipeline firewall port range filtering X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Found the issue,was debugging acl library while issue was with firewall acl definition/registration, simple fix makes udp/tcp src/dest based port filtering work with ip_pipeline firewall. Below is git diff, will submit patch if members suggest . I am very new here .. Also I was going through low level acl compilation/classify code, taking time to understand,if some dev/code doc is there please pass it on. [root@localhost pipeline]# git diff pipeline_firewall_be.c On Sat, Mar 18, 2017 at 9:58 PM, Shyam Shrivastav < shrivastav.shyam@gmail.com> wrote: > I took older versions dpdk-stable-16.07.2 & dpdk-16.04(almost one year > old), went through code changes in relevant libraries librte_table(acl > part only) and librte_acl, looks like no changes to acl compilation and > matching part since then. Has anyone got specific port filtering working > with ACLs? Looks like I have to go through ACL compilation/clasify code > which looks quite difficult :( > > > On Fri, Mar 17, 2017 at 12:31 PM, Shyam Shrivastav < > shrivastav.shyam@gmail.com> wrote: > >> Hi >> >> I am trying to just allow tcp dest port 80 packets using ip_pipeline >> firewall, configured as under >> ------------------------------------------------------------ >> ------------------------------------------------------------------------ >> pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 80 >> 80 6 0xF port 0 >> pipeline> p 1 firewall ls >> Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 80-80, >> Proto = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08) >> Default rule: DROP >> ------------------------------------------------------------ >> ----------------------------------------------------------------------- >> >> but it is not working and all tcp packets are getting dropped. If I >> configure dest port range to be wildcard(0-65535) then tcp packets are >> allowed >> >> ------------------------------------------------------------ >> ----------------------------------------------------------------------- >> pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 0 >> 65535 6 0xF port 0 >> Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 0-65535, >> Proto = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08) >> pipeline> p 1 firewall ls >> Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 0-65535, >> Proto = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08) >> Default rule: DROP >> >> ------------------------------------------------------------ >> ------------------------------------------------------------ >> -------------- >> >> Anyone here got specific port filtering work with ip_pipeline firewall? >> I am debugging this, meanwhile any help/guidance would be greatly >> appreciated. >> >> Thanks and rgds >> > > diff --git a/examples/ip_pipeline/pipeline/pipeline_firewall_be.c b/examples/ip_pipeline/pipeline/pipeline_firewall_be.c index b61f303..2980492 100644 --- a/examples/ip_pipeline/pipeline/pipeline_firewall_be.c +++ b/examples/ip_pipeline/pipeline/pipeline_firewall_be.c @@ -161,7 +161,7 @@ struct firewall_table_entry { .type = RTE_ACL_FIELD_TYPE_RANGE, .size = sizeof(uint16_t), .field_index = 4, - .input_index = 4, + .input_index = 3, .offset = sizeof(struct ether_hdr) + sizeof(struct ipv4_hdr) + offsetof(struct tcp_hdr, dst_port), @@ -221,7 +221,7 @@ struct firewall_table_entry { .type = RTE_ACL_FIELD_TYPE_RANGE, .size = sizeof(uint16_t), .field_index = 4, - .input_index = 4, + .input_index = 3, .offset = sizeof(struct ether_hdr) + SIZEOF_VLAN_HDR + sizeof(struct ipv4_hdr) + @@ -282,7 +282,7 @@ struct firewall_table_entry { .type = RTE_ACL_FIELD_TYPE_RANGE, .size = sizeof(uint16_t), .field_index = 4, - .input_index = 4, + .input_index = 3, .offset = sizeof(struct ether_hdr) + SIZEOF_QINQ_HEADER + sizeof(struct ipv4_hdr) +