#include <string.h>
#include "pipeline_firewall_be.h"
#include "parser.h"
struct pipeline_firewall {
struct pipeline p;
pipeline_msg_req_handler custom_handlers[PIPELINE_FIREWALL_MSG_REQS];
uint32_t n_rules;
uint32_t n_rule_fields;
uint32_t field_format_size;
static void *
pipeline_firewall_msg_req_custom_handler(struct pipeline *p, void *msg);
static pipeline_msg_req_handler handlers[] = {
[PIPELINE_MSG_REQ_PING] =
pipeline_msg_req_ping_handler,
[PIPELINE_MSG_REQ_STATS_PORT_IN] =
pipeline_msg_req_stats_port_in_handler,
[PIPELINE_MSG_REQ_STATS_PORT_OUT] =
pipeline_msg_req_stats_port_out_handler,
[PIPELINE_MSG_REQ_STATS_TABLE] =
pipeline_msg_req_stats_table_handler,
[PIPELINE_MSG_REQ_PORT_IN_ENABLE] =
pipeline_msg_req_port_in_enable_handler,
[PIPELINE_MSG_REQ_PORT_IN_DISABLE] =
pipeline_msg_req_port_in_disable_handler,
[PIPELINE_MSG_REQ_CUSTOM] =
pipeline_firewall_msg_req_custom_handler,
};
static void *
pipeline_firewall_msg_req_add_handler(struct pipeline *p, void *msg);
static void *
pipeline_firewall_msg_req_del_handler(struct pipeline *p, void *msg);
static void *
pipeline_firewall_msg_req_add_bulk_handler(struct pipeline *p, void *msg);
static void *
pipeline_firewall_msg_req_del_bulk_handler(struct pipeline *p, void *msg);
static void *
pipeline_firewall_msg_req_add_default_handler(struct pipeline *p, void *msg);
static void *
pipeline_firewall_msg_req_del_default_handler(struct pipeline *p, void *msg);
static pipeline_msg_req_handler custom_handlers[] = {
[PIPELINE_FIREWALL_MSG_REQ_ADD] =
pipeline_firewall_msg_req_add_handler,
[PIPELINE_FIREWALL_MSG_REQ_DEL] =
pipeline_firewall_msg_req_del_handler,
[PIPELINE_FIREWALL_MSG_REQ_ADD_BULK] =
pipeline_firewall_msg_req_add_bulk_handler,
[PIPELINE_FIREWALL_MSG_REQ_DEL_BULK] =
pipeline_firewall_msg_req_del_bulk_handler,
[PIPELINE_FIREWALL_MSG_REQ_ADD_DEFAULT] =
pipeline_firewall_msg_req_add_default_handler,
[PIPELINE_FIREWALL_MSG_REQ_DEL_DEFAULT] =
pipeline_firewall_msg_req_del_default_handler,
};
struct firewall_table_entry {
};
[0] = {
.
type = RTE_ACL_FIELD_TYPE_BITMASK,
.size = sizeof(uint8_t),
},
[1] = {
.type = RTE_ACL_FIELD_TYPE_MASK,
.size = sizeof(uint32_t),
},
[2] = {
.type = RTE_ACL_FIELD_TYPE_MASK,
.size = sizeof(uint32_t),
},
[3] = {
.type = RTE_ACL_FIELD_TYPE_RANGE,
.size = sizeof(uint16_t),
},
[4] = {
.type = RTE_ACL_FIELD_TYPE_RANGE,
.size = sizeof(uint16_t),
.field_index = 4,
.input_index = 4,
offsetof(struct
tcp_hdr, dst_port),
},
};
#define SIZEOF_VLAN_HDR 4
[0] = {
.
type = RTE_ACL_FIELD_TYPE_BITMASK,
.size = sizeof(uint8_t),
SIZEOF_VLAN_HDR +
},
[1] = {
.type = RTE_ACL_FIELD_TYPE_MASK,
.size = sizeof(uint32_t),
SIZEOF_VLAN_HDR +
},
[2] = {
.type = RTE_ACL_FIELD_TYPE_MASK,
.size = sizeof(uint32_t),
SIZEOF_VLAN_HDR +
},
[3] = {
.type = RTE_ACL_FIELD_TYPE_RANGE,
.size = sizeof(uint16_t),
SIZEOF_VLAN_HDR +
offsetof(struct
tcp_hdr, src_port),
},
[4] = {
.type = RTE_ACL_FIELD_TYPE_RANGE,
.size = sizeof(uint16_t),
.field_index = 4,
.input_index = 4,
SIZEOF_VLAN_HDR +
offsetof(struct
tcp_hdr, dst_port),
},
};
#define SIZEOF_QINQ_HEADER 8
[0] = {
.
type = RTE_ACL_FIELD_TYPE_BITMASK,
.size = sizeof(uint8_t),
SIZEOF_QINQ_HEADER +
},
[1] = {
.type = RTE_ACL_FIELD_TYPE_MASK,
.size = sizeof(uint32_t),
SIZEOF_QINQ_HEADER +
},
[2] = {
.type = RTE_ACL_FIELD_TYPE_MASK,
.size = sizeof(uint32_t),
SIZEOF_QINQ_HEADER +
},
[3] = {
.type = RTE_ACL_FIELD_TYPE_RANGE,
.size = sizeof(uint16_t),
SIZEOF_QINQ_HEADER +
offsetof(struct
tcp_hdr, src_port),
},
[4] = {
.type = RTE_ACL_FIELD_TYPE_RANGE,
.size = sizeof(uint16_t),
.field_index = 4,
.input_index = 4,
SIZEOF_QINQ_HEADER +
offsetof(struct
tcp_hdr, dst_port),
},
};
static int
pipeline_firewall_parse_args(struct pipeline_firewall *p,
struct pipeline_params *params)
{
uint32_t n_rules_present = 0;
uint32_t pkt_type_present = 0;
uint32_t i;
p->n_rules = 4 * 1024;
p->n_rule_fields =
RTE_DIM(field_format_ipv4);
p->field_format = field_format_ipv4;
p->field_format_size = sizeof(field_format_ipv4);
for (i = 0; i < params->n_args; i++) {
char *arg_name = params->args_name[i];
char *arg_value = params->args_value[i];
if (strcmp(arg_name, "n_rules") == 0) {
int status;
PIPELINE_PARSE_ERR_DUPLICATE(
n_rules_present == 0, params->name,
arg_name);
n_rules_present = 1;
status = parser_read_uint32(&p->n_rules,
arg_value);
PIPELINE_PARSE_ERR_INV_VAL((status != -EINVAL),
params->name, arg_name, arg_value);
PIPELINE_PARSE_ERR_OUT_RNG((status != -ERANGE),
params->name, arg_name, arg_value);
continue;
}
if (strcmp(arg_name, "pkt_type") == 0) {
PIPELINE_PARSE_ERR_DUPLICATE(
pkt_type_present == 0, params->name,
arg_name);
pkt_type_present = 1;
if (strcmp(arg_value, "ipv4") == 0) {
p->n_rule_fields =
RTE_DIM(field_format_ipv4);
p->field_format = field_format_ipv4;
p->field_format_size =
sizeof(field_format_ipv4);
continue;
}
if (strcmp(arg_value, "vlan_ipv4") == 0) {
p->n_rule_fields =
p->field_format = field_format_vlan_ipv4;
p->field_format_size =
sizeof(field_format_vlan_ipv4);
continue;
}
if (strcmp(arg_value, "qinq_ipv4") == 0) {
p->n_rule_fields =
p->field_format = field_format_qinq_ipv4;
p->field_format_size =
sizeof(field_format_qinq_ipv4);
continue;
}
PIPELINE_PARSE_ERR_INV_VAL(0, params->name,
arg_name, arg_value);
}
PIPELINE_PARSE_ERR_INV_ENT(0, params->name, arg_name);
}
return 0;
}
static void *
pipeline_firewall_init(struct pipeline_params *params,
{
struct pipeline *p;
struct pipeline_firewall *p_fw;
uint32_t size, i;
if ((params == NULL) ||
(params->n_ports_in == 0) ||
(params->n_ports_out == 0))
return NULL;
p_fw = (struct pipeline_firewall *) p;
if (p == NULL)
return NULL;
strcpy(p->name, params->name);
p->log_level = params->log_level;
PLOG(p, HIGH, "Firewall");
if (pipeline_firewall_parse_args(p_fw, params))
return NULL;
{
.socket_id = params->socket_id,
.offset_port_id = 0,
};
if (p->p == NULL) {
return NULL;
}
}
p->n_ports_in = params->n_ports_in;
for (i = 0; i < p->n_ports_in; i++) {
.
ops = pipeline_port_in_params_get_ops(
¶ms->port_in[i]),
.arg_create = pipeline_port_in_params_convert(
¶ms->port_in[i]),
.f_action = NULL,
.arg_ah = NULL,
.burst_size = params->port_in[i].burst_size,
};
&port_params,
&p->port_in_id[i]);
if (status) {
return NULL;
}
}
p->n_ports_out = params->n_ports_out;
for (i = 0; i < p->n_ports_out; i++) {
.
ops = pipeline_port_out_params_get_ops(
¶ms->port_out[i]),
.arg_create = pipeline_port_out_params_convert(
¶ms->port_out[i]),
.f_action = NULL,
.arg_ah = NULL,
};
&port_params,
&p->port_out_id[i]);
if (status) {
return NULL;
}
}
p->n_tables = 1;
{
.n_rules = p_fw->n_rules,
.n_rule_fields = p_fw->n_rule_fields,
};
.arg_create = &table_acl_params,
.f_action_hit = NULL,
.f_action_miss = NULL,
.arg_ah = NULL,
.action_data_size =
sizeof(struct firewall_table_entry) -
};
int status;
p_fw->field_format,
p_fw->field_format_size);
&table_params,
&p->table_id[0]);
if (status) {
return NULL;
}
}
for (i = 0; i < p->n_ports_in; i++) {
p->port_in_id[i],
p->table_id[0]);
if (status) {
return NULL;
}
}
for (i = 0; i < p->n_ports_in; i++) {
p->port_in_id[i]);
if (status) {
return NULL;
}
}
return NULL;
}
p->n_msgq = params->n_msgq;
for (i = 0; i < p->n_msgq; i++)
p->msgq_in[i] = params->msgq_in[i];
for (i = 0; i < p->n_msgq; i++)
p->msgq_out[i] = params->msgq_out[i];
memcpy(p->handlers, handlers, sizeof(p->handlers));
memcpy(p_fw->custom_handlers,
custom_handlers,
sizeof(p_fw->custom_handlers));
return p;
}
static int
pipeline_firewall_free(void *pipeline)
{
struct pipeline *p = (struct pipeline *) pipeline;
if (p == NULL)
return -1;
return 0;
}
static int
pipeline_firewall_track(void *pipeline,
uint32_t *port_out)
{
struct pipeline *p = (struct pipeline *) pipeline;
if ((p == NULL) ||
(port_in >= p->n_ports_in) ||
(port_out == NULL))
return -1;
if (p->n_ports_in == 1) {
*port_out = 0;
return 0;
}
return -1;
}
static int
pipeline_firewall_timer(void *pipeline)
{
struct pipeline *p = (struct pipeline *) pipeline;
pipeline_msg_req_handle(p);
return 0;
}
void *
pipeline_firewall_msg_req_custom_handler(struct pipeline *p,
void *msg)
{
struct pipeline_firewall *p_fw = (struct pipeline_firewall *) p;
struct pipeline_custom_msg_req *req = msg;
pipeline_msg_req_handler f_handle;
f_handle = (req->subtype < PIPELINE_FIREWALL_MSG_REQS) ?
p_fw->custom_handlers[req->subtype] :
pipeline_msg_req_invalid_handler;
if (f_handle == NULL)
f_handle = pipeline_msg_req_invalid_handler;
return f_handle(p, req);
}
void *
pipeline_firewall_msg_req_add_handler(struct pipeline *p, void *msg)
{
struct pipeline_firewall_add_msg_req *req = msg;
struct pipeline_firewall_add_msg_rsp *rsp = msg;
struct firewall_table_entry entry = {
.head = {
{.port_id = p->port_out_id[req->port_id]},
},
};
memset(¶ms, 0, sizeof(params));
switch (req->key.type) {
case PIPELINE_FIREWALL_IPV4_5TUPLE:
params.priority = req->priority;
params.field_value[0].value.u8 =
req->key.key.ipv4_5tuple.proto;
params.field_value[0].mask_range.u8 =
req->key.key.ipv4_5tuple.proto_mask;
params.field_value[1].value.u32 =
req->key.key.ipv4_5tuple.src_ip;
params.field_value[1].mask_range.u32 =
req->key.key.ipv4_5tuple.src_ip_mask;
params.field_value[2].value.u32 =
req->key.key.ipv4_5tuple.dst_ip;
params.field_value[2].mask_range.u32 =
req->key.key.ipv4_5tuple.dst_ip_mask;
params.field_value[3].value.u16 =
req->key.key.ipv4_5tuple.src_port_from;
params.field_value[3].mask_range.u16 =
req->key.key.ipv4_5tuple.src_port_to;
params.field_value[4].value.u16 =
req->key.key.ipv4_5tuple.dst_port_from;
params.field_value[4].mask_range.u16 =
req->key.key.ipv4_5tuple.dst_port_to;
break;
default:
rsp->status = -1;
return rsp;
}
p->table_id[0],
¶ms,
&rsp->key_found,
return rsp;
}
void *
pipeline_firewall_msg_req_del_handler(struct pipeline *p, void *msg)
{
struct pipeline_firewall_del_msg_req *req = msg;
struct pipeline_firewall_del_msg_rsp *rsp = msg;
memset(¶ms, 0, sizeof(params));
switch (req->key.type) {
case PIPELINE_FIREWALL_IPV4_5TUPLE:
params.field_value[0].value.u8 =
req->key.key.ipv4_5tuple.proto;
params.field_value[0].mask_range.u8 =
req->key.key.ipv4_5tuple.proto_mask;
params.field_value[1].value.u32 =
req->key.key.ipv4_5tuple.src_ip;
params.field_value[1].mask_range.u32 =
req->key.key.ipv4_5tuple.src_ip_mask;
params.field_value[2].value.u32 =
req->key.key.ipv4_5tuple.dst_ip;
params.field_value[2].mask_range.u32 =
req->key.key.ipv4_5tuple.dst_ip_mask;
params.field_value[3].value.u16 =
req->key.key.ipv4_5tuple.src_port_from;
params.field_value[3].mask_range.u16 =
req->key.key.ipv4_5tuple.src_port_to;
params.field_value[4].value.u16 =
req->key.key.ipv4_5tuple.dst_port_from;
params.field_value[4].mask_range.u16 =
req->key.key.ipv4_5tuple.dst_port_to;
break;
default:
rsp->status = -1;
return rsp;
}
p->table_id[0],
¶ms,
&rsp->key_found,
NULL);
return rsp;
}
static void *
pipeline_firewall_msg_req_add_bulk_handler(struct pipeline *p, void *msg)
{
struct pipeline_firewall_add_bulk_msg_req *req = msg;
struct pipeline_firewall_add_bulk_msg_rsp *rsp = msg;
struct firewall_table_entry *entries[req->n_keys];
uint32_t i, n_keys;
n_keys = req->n_keys;
for (i = 0; i < n_keys; i++) {
sizeof(struct firewall_table_entry),
RTE_CACHE_LINE_SIZE);
if (entries[i] == NULL) {
rsp->status = -1;
return rsp;
}
RTE_CACHE_LINE_SIZE);
if (params[i] == NULL) {
rsp->status = -1;
return rsp;
}
entries[i]->head.port_id = p->port_out_id[req->port_ids[i]];
switch (req->keys[i].type) {
case PIPELINE_FIREWALL_IPV4_5TUPLE:
params[i]->
priority = req->priorities[i];
req->keys[i].key.ipv4_5tuple.proto;
req->keys[i].key.ipv4_5tuple.proto_mask;
req->keys[i].key.ipv4_5tuple.src_ip;
req->keys[i].key.ipv4_5tuple.src_ip_mask;
req->keys[i].key.ipv4_5tuple.dst_ip;
req->keys[i].key.ipv4_5tuple.dst_ip_mask;
req->keys[i].key.ipv4_5tuple.src_port_from;
req->keys[i].key.ipv4_5tuple.src_port_to;
req->keys[i].key.ipv4_5tuple.dst_port_from;
req->keys[i].key.ipv4_5tuple.dst_port_to;
break;
default:
rsp->status = -1;
for (i = 0; i < n_keys; i++) {
}
return rsp;
}
}
n_keys, req->keys_found,
for (i = 0; i < n_keys; i++) {
}
return rsp;
}
static void *
pipeline_firewall_msg_req_del_bulk_handler(struct pipeline *p, void *msg)
{
struct pipeline_firewall_del_bulk_msg_req *req = msg;
struct pipeline_firewall_del_bulk_msg_rsp *rsp = msg;
uint32_t i, n_keys;
n_keys = req->n_keys;
for (i = 0; i < n_keys; i++) {
RTE_CACHE_LINE_SIZE);
if (params[i] == NULL) {
rsp->status = -1;
return rsp;
}
switch (req->keys[i].type) {
case PIPELINE_FIREWALL_IPV4_5TUPLE:
req->keys[i].key.ipv4_5tuple.proto;
req->keys[i].key.ipv4_5tuple.proto_mask;
req->keys[i].key.ipv4_5tuple.src_ip;
req->keys[i].key.ipv4_5tuple.src_ip_mask;
req->keys[i].key.ipv4_5tuple.dst_ip;
req->keys[i].key.ipv4_5tuple.dst_ip_mask;
req->keys[i].key.ipv4_5tuple.src_port_from;
req->keys[i].key.ipv4_5tuple.src_port_to;
req->keys[i].key.ipv4_5tuple.dst_port_from;
req->keys[i].key.ipv4_5tuple.dst_port_to;
break;
default:
rsp->status = -1;
for (i = 0; i < n_keys; i++)
return rsp;
}
}
(void **)¶ms, n_keys, req->keys_found, NULL);
for (i = 0; i < n_keys; i++)
return rsp;
}
void *
pipeline_firewall_msg_req_add_default_handler(struct pipeline *p, void *msg)
{
struct pipeline_firewall_add_default_msg_req *req = msg;
struct pipeline_firewall_add_default_msg_rsp *rsp = msg;
struct firewall_table_entry default_entry = {
.head = {
{.port_id = p->port_out_id[req->port_id]},
},
};
p->table_id[0],
return rsp;
}
void *
pipeline_firewall_msg_req_del_default_handler(struct pipeline *p, void *msg)
{
struct pipeline_firewall_del_default_msg_rsp *rsp = msg;
p->table_id[0],
NULL);
return rsp;
}
struct pipeline_be_ops pipeline_firewall_be_ops = {
.f_init = pipeline_firewall_init,
.f_free = pipeline_firewall_free,
.f_run = NULL,
.f_timer = pipeline_firewall_timer,
.f_track = pipeline_firewall_track,
};