DPDK ACL API 封装

2023-08-30 10:48:39 | Linux 葵花宝典网络

match.c

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <inttypes.h>
#include <sys/types.h>
#include <string.h>
#include <sys/queue.h>
#include <stdarg.h>
#include <errno.h>

#include <rte_common.h>
#include <rte_byteorder.h>
#include <rte_log.h>
#include <rte_memory.h>
#include <rte_memcpy.h>
#include <rte_eal.h>
#include <rte_launch.h>
#include <rte_atomic.h>
#include <rte_cycles.h>
#include <rte_prefetch.h>
#include <rte_lcore.h>
#include <rte_per_lcore.h>
#include <rte_branch_prediction.h>
#include <rte_interrupts.h>
#include <rte_random.h>
#include <rte_debug.h>
#include <rte_ether.h>
#include <rte_ethdev.h>
#include <rte_mempool.h>
#include <rte_mbuf.h>
#include <rte_ether.h>
#include <rte_ip.h>
#include <rte_tcp.h>
#include <rte_udp.h>
#include <rte_string_fns.h>
#include <rte_acl.h>

#include "acl_match.h"

const char cb_port_delim[] = ":";
#define MAX_ACL_RULE_NUM        10000
#define DEFAULT_MAX_CATEGORIES  16
#define IPV6_ADDR_LEN   16
#define IPV6_ADDR_U16   (IPV6_ADDR_LEN / sizeof(uint16_t))
#define IPV6_ADDR_U32   (IPV6_ADDR_LEN / sizeof(uint32_t))
#define ACL_PRIORITY_DEBIG  9000


//文本规则 -- 序列定义(空格分隔形式)
//src_ip/masklen dst_ip/masklen src_begin : src_end    dst_bdegin : dst_end  proto/mask ruleid
//2.2.2.3/24     2.2.2.7/24     32 : 32    0 : 65535 6/0xff 0
//9.9.9.3/24     9.9.9.7/24     32 : 32    0 : 65535 6/0xff 1
enum {
    CB_FLD_SRC_ADDR,
    CB_FLD_DST_ADDR,
    CB_FLD_SRC_PORT_LOW,
    CB_FLD_SRC_PORT_DLM,
    CB_FLD_SRC_PORT_HIGH,
    CB_FLD_DST_PORT_LOW,
    CB_FLD_DST_PORT_DLM,
    CB_FLD_DST_PORT_HIGH,
    CB_FLD_PROTO,
    CB_FLD_USERDATA,
//    CB_FLD_CATEGORY_MASK,
//    CB_FLD_PRIORITY,
    CB_FLD_NUM,
};

// IPv4 规则的定义
enum {
    PROTO_FIELD_IPV4,
    SRC_FIELD_IPV4,
    DST_FIELD_IPV4,
    SRCP_FIELD_IPV4,
    DSTP_FIELD_IPV4,
    NUM_FIELDS_IPV4
};

// IPv6 规则的定义
enum {
    PROTO_FIELD_IPV6,
    SRC1_FIELD_IPV6,
    SRC2_FIELD_IPV6,
    SRC3_FIELD_IPV6,
    SRC4_FIELD_IPV6,
    DST1_FIELD_IPV6,
    DST2_FIELD_IPV6,
    DST3_FIELD_IPV6,
    DST4_FIELD_IPV6,
    SRCP_FIELD_IPV6,
    DSTP_FIELD_IPV6,
    NUM_FIELDS_IPV6
};

#define GET_CB_FIELD(in, fd, base, lim, dlm)    do {        \
    unsigned long val;                                      \
    char *end;                                              \
    errno = 0;                                              \
    val = strtoul((in), &end, (base));                      \
    if (errno != 0 || end[0] != (dlm) || val > (lim))       \
        return -EINVAL;                                     \
    (fd) = (typeof(fd))val;                                 \
    (in) = end + 1;                                         \
} while (0)

#define uint32_t_to_char(ip, a, b, c, d) do { \
        *a = (unsigned char)(ip >> 24 & 0xff);\
        *b = (unsigned char)(ip >> 16 & 0xff);\
        *c = (unsigned char)(ip >> 8 & 0xff); \
        *d = (unsigned char)(ip & 0xff);      \
    } while (0)

struct acl_context_t
{
    struct rte_acl_ctx *acl_ctx_v4;
    struct rte_acl_ctx *acl_ctx_v6;
};

//IPV4规则的定义 -- 参考 IPV4+TCP 结构
struct rte_acl_field_def ipv4_defs[NUM_FIELDS_IPV4] = {
    {
        .type = RTE_ACL_FIELD_TYPE_BITMASK,
        .size = sizeof(uint8_t),
        .field_index = PROTO_FIELD_IPV4,
        .input_index = PROTO_FIELD_IPV4,//本4字节空间无其他共享字段
        .offset = 0,
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = SRC_FIELD_IPV4,
        .input_index = SRC_FIELD_IPV4,
        .offset = offsetof(struct ipv4_hdr, src_addr) - offsetof(struct ipv4_hdr, next_proto_id),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = DST_FIELD_IPV4,
        .input_index = DST_FIELD_IPV4,
        .offset = offsetof(struct ipv4_hdr, dst_addr) - offsetof(struct ipv4_hdr, next_proto_id),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_RANGE,
        .size = sizeof(uint16_t),
        .field_index = SRCP_FIELD_IPV4,
        .input_index = SRCP_FIELD_IPV4,
        .offset = sizeof(struct ipv4_hdr) - offsetof(struct ipv4_hdr, next_proto_id),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_RANGE,
        .size = sizeof(uint16_t),
        .field_index = DSTP_FIELD_IPV4,
        .input_index = SRCP_FIELD_IPV4, //与 SRCPOST 字段共享4字节空间
        .offset = sizeof(struct ipv4_hdr) - offsetof(struct ipv4_hdr, next_proto_id) + sizeof(uint16_t),
    },
};

//IPV6规则的定义 -- 参考 IPV4+TCP 结构
struct rte_acl_field_def ipv6_defs[NUM_FIELDS_IPV6] = {
    {
        .type = RTE_ACL_FIELD_TYPE_BITMASK,
        .size = sizeof(uint8_t),//本4字节空间无其他共享字段
        .field_index = PROTO_FIELD_IPV6,
        .input_index = PROTO_FIELD_IPV6,
        .offset = 0,
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = SRC1_FIELD_IPV6,
        .input_index = SRC1_FIELD_IPV6,
        .offset = offsetof(struct ipv6_hdr, src_addr) - offsetof(struct ipv6_hdr, proto),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = SRC2_FIELD_IPV6,
        .input_index = SRC2_FIELD_IPV6,
        .offset = offsetof(struct ipv6_hdr, src_addr) - offsetof(struct ipv6_hdr, proto) + sizeof(uint32_t),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = SRC3_FIELD_IPV6,
        .input_index = SRC3_FIELD_IPV6,
        .offset = offsetof(struct ipv6_hdr, src_addr) - offsetof(struct ipv6_hdr, proto) + 2 * sizeof(uint32_t),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = SRC4_FIELD_IPV6,
        .input_index = SRC4_FIELD_IPV6,
        .offset = offsetof(struct ipv6_hdr, src_addr) - offsetof(struct ipv6_hdr, proto) + 3 * sizeof(uint32_t),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = DST1_FIELD_IPV6,
        .input_index = DST1_FIELD_IPV6,
        .offset = offsetof(struct ipv6_hdr, dst_addr) - offsetof(struct ipv6_hdr, proto),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = DST2_FIELD_IPV6,
        .input_index = DST2_FIELD_IPV6,
        .offset = offsetof(struct ipv6_hdr, dst_addr) - offsetof(struct ipv6_hdr, proto) + sizeof(uint32_t),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = DST3_FIELD_IPV6,
        .input_index = DST3_FIELD_IPV6,
        .offset = offsetof(struct ipv6_hdr, dst_addr) - offsetof(struct ipv6_hdr, proto) + 2 * sizeof(uint32_t),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_MASK,
        .size = sizeof(uint32_t),
        .field_index = DST4_FIELD_IPV6,
        .input_index = DST4_FIELD_IPV6,
        .offset = offsetof(struct ipv6_hdr, dst_addr) - offsetof(struct ipv6_hdr, proto) + 3 * sizeof(uint32_t),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_RANGE,
        .size = sizeof(uint16_t),
        .field_index = SRCP_FIELD_IPV6,
        .input_index = SRCP_FIELD_IPV6,
        .offset = sizeof(struct ipv6_hdr) - offsetof(struct ipv6_hdr, proto),
    },
    {
        .type = RTE_ACL_FIELD_TYPE_RANGE,
        .size = sizeof(uint16_t),
        .field_index = DSTP_FIELD_IPV6,
        .input_index = SRCP_FIELD_IPV6, //与 SRCPOST 字段共享4字节空间
        .offset = sizeof(struct ipv6_hdr) - offsetof(struct ipv6_hdr, proto) + sizeof(uint16_t),
    },
};

//定义ACL_IPV4的结构体(包含了userdata,category_mask,priority)
RTE_ACL_RULE_DEF(acl4_rule, RTE_DIM(ipv4_defs));
RTE_ACL_RULE_DEF(acl6_rule, RTE_DIM(ipv6_defs));

//规则的编译
static struct rte_acl_ctx*
setup_acl(struct rte_acl_rule *acl_base, unsigned int acl_num, int is_ipv6)
{
    int socketid = 0;
    char name[PATH_MAX];
    struct rte_acl_param acl_param;
    struct rte_acl_config acl_build_param;
    struct rte_acl_ctx *context;
    int dim = is_ipv6 ? RTE_DIM(ipv6_defs) : RTE_DIM(ipv4_defs);

    if(0 == acl_num)
    {
        return NULL;
    }

    /* Create ACL contexts */
    snprintf(name, sizeof(name), "%s_%d",
            is_ipv6 ? "CHUNLI_ACL_IPV6" : "CHUNLI_ACL_IPV4",
            socketid);

    acl_param.name = name;
    acl_param.socket_id = socketid;
    acl_param.rule_size = RTE_ACL_RULE_SZ(dim);
    acl_param.max_rule_num = MAX_ACL_RULE_NUM;

    if ((context = rte_acl_create(&acl_param)) == NULL)
        rte_exit(EXIT_FAILURE, "Failed to create ACL context\n");

    if (rte_acl_set_ctx_classify(context, RTE_ACL_CLASSIFY_SCALAR) != 0)
        rte_exit(EXIT_FAILURE, "Failed to setup classify method for ACL context\n");

    if (rte_acl_add_rules(context, acl_base, acl_num) < 0)
        rte_exit(EXIT_FAILURE, "add rules failed\n");

    /* Perform builds */
    memset(&acl_build_param, 0, sizeof(acl_build_param));

    acl_build_param.num_categories = DEFAULT_MAX_CATEGORIES;
    acl_build_param.num_fields = dim;
    void *psrc = is_ipv6 ? ipv6_defs : ipv4_defs;
    int   copy = is_ipv6 ? sizeof(ipv6_defs) : sizeof(ipv4_defs);
    memcpy(&acl_build_param.defs, psrc, copy);

    if (rte_acl_build(context, &acl_build_param) != 0)
    {
        rte_exit(EXIT_FAILURE, "Failed to build ACL trie\n");
    }

    return context;
}

//IPv4 规则打印到终端
static inline void
print_one_ipv4_rule(struct acl4_rule *rule)
{
    unsigned char a, b, c, d;

    uint32_t_to_char(rule->field[SRC_FIELD_IPV4].value.u32,
            &a, &b, &c, &d);
    printf("%hhu.%hhu.%hhu.%hhu/%u ", a, b, c, d,
            rule->field[SRC_FIELD_IPV4].mask_range.u32);
    uint32_t_to_char(rule->field[DST_FIELD_IPV4].value.u32,
            &a, &b, &c, &d);
    printf("%hhu.%hhu.%hhu.%hhu/%u ", a, b, c, d,
            rule->field[DST_FIELD_IPV4].mask_range.u32);
    printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
        rule->field[SRCP_FIELD_IPV4].value.u16,
        rule->field[SRCP_FIELD_IPV4].mask_range.u16,
        rule->field[DSTP_FIELD_IPV4].value.u16,
        rule->field[DSTP_FIELD_IPV4].mask_range.u16,
        rule->field[PROTO_FIELD_IPV4].value.u8,
        rule->field[PROTO_FIELD_IPV4].mask_range.u8);
    printf("userdata:%u ", rule->data.userdata);
    printf("priority:%u ", rule->data.priority);
    printf("category_mask:%u ", rule->data.category_mask);
}

static inline void
dump_ipv4_rules(struct acl4_rule *rule, int num)
{
    int i;
    for (i = 0; i < num; i++) {
        printf("%d:", i + 1);
        print_one_ipv4_rule(rule + i);
        printf("\n");
    }
}

//IPv6 规则打印到终端
static inline void
print_one_ipv6_rule(struct acl6_rule *rule)
{
    unsigned char a, b, c, d;

    uint32_t_to_char(rule->field[SRC1_FIELD_IPV6].value.u32,
        &a, &b, &c, &d);
    printf("%.2x%.2x:%.2x%.2x", a, b, c, d);
    uint32_t_to_char(rule->field[SRC2_FIELD_IPV6].value.u32,
        &a, &b, &c, &d);
    printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
    uint32_t_to_char(rule->field[SRC3_FIELD_IPV6].value.u32,
        &a, &b, &c, &d);
    printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
    uint32_t_to_char(rule->field[SRC4_FIELD_IPV6].value.u32,
        &a, &b, &c, &d);
    printf(":%.2x%.2x:%.2x%.2x/%u ", a, b, c, d,
            rule->field[SRC1_FIELD_IPV6].mask_range.u32
            + rule->field[SRC2_FIELD_IPV6].mask_range.u32
            + rule->field[SRC3_FIELD_IPV6].mask_range.u32
            + rule->field[SRC4_FIELD_IPV6].mask_range.u32);

    uint32_t_to_char(rule->field[DST1_FIELD_IPV6].value.u32,
        &a, &b, &c, &d);
    printf("%.2x%.2x:%.2x%.2x", a, b, c, d);
    uint32_t_to_char(rule->field[DST2_FIELD_IPV6].value.u32,
        &a, &b, &c, &d);
    printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
    uint32_t_to_char(rule->field[DST3_FIELD_IPV6].value.u32,
        &a, &b, &c, &d);
    printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
    uint32_t_to_char(rule->field[DST4_FIELD_IPV6].value.u32,
        &a, &b, &c, &d);

    printf(":%.2x%.2x:%.2x%.2x/%u ", a, b, c, d,
            rule->field[DST1_FIELD_IPV6].mask_range.u32
            + rule->field[DST2_FIELD_IPV6].mask_range.u32
            + rule->field[DST3_FIELD_IPV6].mask_range.u32
            + rule->field[DST4_FIELD_IPV6].mask_range.u32);

    printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
        rule->field[SRCP_FIELD_IPV6].value.u16,
        rule->field[SRCP_FIELD_IPV6].mask_range.u16,
        rule->field[DSTP_FIELD_IPV6].value.u16,
        rule->field[DSTP_FIELD_IPV6].mask_range.u16,
        rule->field[PROTO_FIELD_IPV6].value.u8,
        rule->field[PROTO_FIELD_IPV6].mask_range.u8);

    printf("userdata:%u ", rule->data.userdata);
    printf("priority:%u ", rule->data.priority);
    printf("category_mask:%u ", rule->data.category_mask);
}

static inline void
dump_ipv6_rules(struct acl6_rule *rule, int num)
{
    int i;
    for (i = 0; i < num; i++) {
        printf("%d:", i + 1);
        print_one_ipv6_rule(rule + i);
        printf("\n");
    }
}

//创建ACL对象
struct acl_context_t *acl_match_create()
{
    struct acl_context_t *p = malloc(sizeof(struct acl_context_t));
    memset(p, 0, sizeof(struct acl_context_t));
    return p;
}

////////// 内部 通统一 API --START ////////////
static int
acl_load_ipv4(struct acl_context_t *ctx, struct rte_acl_rule *rule_ipv4, int num)
{
    dump_ipv4_rules((struct acl4_rule*)rule_ipv4, num);
    struct rte_acl_ctx *acl_ctx_v4 = setup_acl(rule_ipv4, num, 0);
    if(NULL == ctx)
    {
        printf("ERROR: setup_acl in acl_load_ipv4\n");
        return -1;
    }
    ctx->acl_ctx_v4 = acl_ctx_v4;
    return 0;
}

//ACL对象添加 规则
static int
acl_load_ipv6(struct acl_context_t *ctx, struct rte_acl_rule *rule_ipv6, int num)
{
    dump_ipv6_rules((struct acl6_rule*)rule_ipv6, num);
    struct rte_acl_ctx *acl_ctx_v6 = setup_acl(rule_ipv6, num, 1);
    if(NULL == ctx)
    {
        printf("ERROR: setup_acl in acl_load_ipv6\n");
        return -1;
    }
    ctx->acl_ctx_v6 = acl_ctx_v6;
    return 0;
}
////////// 内部 通统一 API --END ////////////

////////////////////// IPV4 文本规则解析 API --START //////////////////////////////////
static int
parse_ipv4_net(const char *in, uint32_t *addr, uint32_t *mask_len)
{
    uint8_t a, b, c, d, m;

    GET_CB_FIELD(in, a, 0, UINT8_MAX, '.');
    GET_CB_FIELD(in, b, 0, UINT8_MAX, '.');
    GET_CB_FIELD(in, c, 0, UINT8_MAX, '.');
    GET_CB_FIELD(in, d, 0, UINT8_MAX, '/');
    GET_CB_FIELD(in, m, 0, sizeof(uint32_t) * CHAR_BIT, 0);

    addr[0] = IPv4(a, b, c, d);
    mask_len[0] = m;

    return 0;
}

static int
parse_ipv4_rule(const char *str, struct rte_acl_rule *v)
{
    int i, rc;
    char *s, *sp, *in[CB_FLD_NUM];
    const char *dlm = " \t\n";
    int dim = CB_FLD_NUM;

    char rule_buff[1024];
    strncpy(rule_buff, str, sizeof(rule_buff));
    s = rule_buff;

    for (i = 0; i != dim; i++, s = NULL) {
        in[i] = strtok_r(s, dlm, &sp);
        if (in[i] == NULL)
        {
            printf("ERROR: near by %s %s\n", s, sp);
            return -EINVAL;
        }
    }

    rc = parse_ipv4_net(in[CB_FLD_SRC_ADDR], &v->field[SRC_FIELD_IPV4].value.u32, &v->field[SRC_FIELD_IPV4].mask_range.u32);
    if (rc != 0) {
        printf("failed to read source address/mask: %s\n",  in[CB_FLD_SRC_ADDR]);
        return rc;
    }

    rc = parse_ipv4_net(in[CB_FLD_DST_ADDR], &v->field[DST_FIELD_IPV4].value.u32, &v->field[DST_FIELD_IPV4].mask_range.u32);
    if (rc != 0) {
        printf("failed to read destination address/mask: %s\n", in[CB_FLD_DST_ADDR]);
        return rc;
    }

    GET_CB_FIELD(in[CB_FLD_SRC_PORT_LOW],v->field[SRCP_FIELD_IPV4].value.u16, 0, UINT16_MAX, 0);
    GET_CB_FIELD(in[CB_FLD_SRC_PORT_HIGH],v->field[SRCP_FIELD_IPV4].mask_range.u16, 0, UINT16_MAX, 0);

    if (strncmp(in[CB_FLD_SRC_PORT_DLM], cb_port_delim, sizeof(cb_port_delim)) != 0)
        return -EINVAL;

    GET_CB_FIELD(in[CB_FLD_DST_PORT_LOW],v->field[DSTP_FIELD_IPV4].value.u16,0, UINT16_MAX, 0);
    GET_CB_FIELD(in[CB_FLD_DST_PORT_HIGH],  v->field[DSTP_FIELD_IPV4].mask_range.u16,   0, UINT16_MAX, 0);

    if (strncmp(in[CB_FLD_DST_PORT_DLM], cb_port_delim, sizeof(cb_port_delim)) != 0)
        return -EINVAL;

    if (v->field[SRCP_FIELD_IPV4].mask_range.u16< v->field[SRCP_FIELD_IPV4].value.u16
            || v->field[DSTP_FIELD_IPV4].mask_range.u16 < v->field[DSTP_FIELD_IPV4].value.u16)
        return -EINVAL;

    GET_CB_FIELD(in[CB_FLD_PROTO], v->field[PROTO_FIELD_IPV4].value.u8, 0, UINT8_MAX, '/');
    GET_CB_FIELD(in[CB_FLD_PROTO], v->field[PROTO_FIELD_IPV4].mask_range.u8, 0, UINT8_MAX, 0);
    GET_CB_FIELD(in[CB_FLD_USERDATA], v->data.userdata, 0, UINT32_MAX, 0);
    //GET_CB_FIELD(in[CB_FLD_CATEGORY_MASK], v->data.category_mask, 0, UINT32_MAX, 0);
    //GET_CB_FIELD(in[CB_FLD_PRIORITY], v->data.priority, 0, UINT32_MAX, 0);
    return 0;
}

static int
add_rules_string_ipv4(const char **rule_list, int rule_num, struct rte_acl_rule **pacl_base, unsigned int *pacl_num)
{
    uint8_t *acl_rules = NULL;
    struct rte_acl_rule *rule = NULL;
    unsigned int acl_cnt = 0;
    int i = 0;

    if(0 == rule_num)
    {
        printf("ipv4 rule 为空\n");
        return -1;
    }

    acl_rules = malloc(rule_num * sizeof(struct acl4_rule));
    memset(acl_rules, 0, rule_num * sizeof(struct acl4_rule));

    //解析
    for(i = 0; i < rule_num; i++)
    {
        char *rule_text = (char*)rule_list[i];
        rule = (struct rte_acl_rule *)(acl_rules +  acl_cnt * sizeof(struct acl4_rule));
        if (parse_ipv4_rule(rule_text, rule) != 0)
            rte_exit(EXIT_FAILURE, "parse ipv4 rules error\n");

        rule->data.priority = ACL_PRIORITY_DEBIG + acl_cnt;
        rule->data.category_mask = 1;   //无需多模
        acl_cnt++;
    };

    //传出参数
    *pacl_base = (struct rte_acl_rule *)acl_rules;
    *pacl_num = acl_cnt;
    return 0;
}

int acl_load_ipv4_str(struct acl_context_t *ctx, const char *rule[], int num)
{
    struct rte_acl_rule *acl_base = NULL;
    unsigned int acl_num = 0;
    int rc = 0;
    rc = add_rules_string_ipv4(rule, num, &acl_base, &acl_num);
    if(rc)
    {
        printf("ipv4 rule 解析错误\n");
        return -1;
    }

    rc = acl_load_ipv4(ctx, acl_base, acl_num);
    if(rc)
    {
        printf("ipv4 rule 编译错误\n");
        return -1;
    }
    free(acl_base);
    return 0;
}
////////////////////// IPV4 文本规则解析 API --END //////////////////////////////////


////////////////////// IPV6 文本规则解析 API --START //////////////////////////////////
/*
 * Parse IPV6 address, expects the following format:
 * XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX (where X is a hexadecimal digit).
 */
static int
parse_ipv6_addr(const char *in, const char **end, uint32_t v[IPV6_ADDR_U32],
    char dlm)
{
    uint32_t addr[IPV6_ADDR_U16];

    GET_CB_FIELD(in, addr[0], 16, UINT16_MAX, ':');
    GET_CB_FIELD(in, addr[1], 16, UINT16_MAX, ':');
    GET_CB_FIELD(in, addr[2], 16, UINT16_MAX, ':');
    GET_CB_FIELD(in, addr[3], 16, UINT16_MAX, ':');
    GET_CB_FIELD(in, addr[4], 16, UINT16_MAX, ':');
    GET_CB_FIELD(in, addr[5], 16, UINT16_MAX, ':');
    GET_CB_FIELD(in, addr[6], 16, UINT16_MAX, ':');
    GET_CB_FIELD(in, addr[7], 16, UINT16_MAX, dlm);

    *end = in;

    //注意端序
    //DATA序列: 12:34:56:78 (4字节)
    //ADDR地址: HIGH <--> LOW
    v[0] = (addr[0] << 16) + addr[1];
    v[1] = (addr[2] << 16) + addr[3];
    v[2] = (addr[4] << 16) + addr[5];
    v[3] = (addr[6] << 16) + addr[7];

    return 0;
}

static int
parse_ipv6_net(const char *in, struct rte_acl_field field[4])
{
    int32_t rc;
    const char *mp;
    uint32_t i, m, v[4];
    const uint32_t nbu32 = sizeof(uint32_t) * CHAR_BIT;

    /* get address. */
    rc = parse_ipv6_addr(in, &mp, v, '/');
    if (rc != 0)
        return rc;

    /* get mask. */
    GET_CB_FIELD(mp, m, 0, CHAR_BIT * sizeof(v), 0);

    /* put all together. */
    for (i = 0; i != RTE_DIM(v); i++) {
        if (m >= (i + 1) * nbu32)
            field[i].mask_range.u32 = nbu32;
        else
            field[i].mask_range.u32 = m > (i * nbu32) ?
                m - (i * 32) : 0;

        field[i].value.u32 = v[i];
    }

    return 0;
}

static int
parse_ipv6_rule(char *str, struct rte_acl_rule *v)
{
    int i, rc;
    char *s, *sp, *in[CB_FLD_NUM];
    static const char *dlm = " \t\n";
    int dim = CB_FLD_NUM;
    s = str;

    char rule_buff[1024];
    strncpy(rule_buff, str, sizeof(rule_buff));
    s = rule_buff;

    for (i = 0; i != dim; i++, s = NULL) {
        in[i] = strtok_r(s, dlm, &sp);
        if (in[i] == NULL)
            return -EINVAL;
    }

    rc = parse_ipv6_net(in[CB_FLD_SRC_ADDR], v->field + SRC1_FIELD_IPV6);
    if (rc != 0) {
        printf("failed to read source address/mask: %s\n", in[CB_FLD_SRC_ADDR]);
        return rc;
    }

    rc = parse_ipv6_net(in[CB_FLD_DST_ADDR], v->field + DST1_FIELD_IPV6);
    if (rc != 0) {
        printf("failed to read destination address/mask: %s\n",in[CB_FLD_DST_ADDR]);
        return rc;
    }

    /* source port. */
    GET_CB_FIELD(in[CB_FLD_SRC_PORT_LOW],
        v->field[SRCP_FIELD_IPV6].value.u16,
        0, UINT16_MAX, 0);

    GET_CB_FIELD(in[CB_FLD_SRC_PORT_HIGH],
        v->field[SRCP_FIELD_IPV6].mask_range.u16,
        0, UINT16_MAX, 0);

    if (strncmp(in[CB_FLD_SRC_PORT_DLM], cb_port_delim,
            sizeof(cb_port_delim)) != 0)
        return -EINVAL;

    /* destination port. */
    GET_CB_FIELD(in[CB_FLD_DST_PORT_LOW],
        v->field[DSTP_FIELD_IPV6].value.u16,
        0, UINT16_MAX, 0);

    GET_CB_FIELD(in[CB_FLD_DST_PORT_HIGH],
        v->field[DSTP_FIELD_IPV6].mask_range.u16,
        0, UINT16_MAX, 0);

    if (strncmp(in[CB_FLD_DST_PORT_DLM], cb_port_delim,
            sizeof(cb_port_delim)) != 0)
        return -EINVAL;

    if (v->field[SRCP_FIELD_IPV6].mask_range.u16
            < v->field[SRCP_FIELD_IPV6].value.u16
            || v->field[DSTP_FIELD_IPV6].mask_range.u16
            < v->field[DSTP_FIELD_IPV6].value.u16)
        return -EINVAL;

    GET_CB_FIELD(in[CB_FLD_PROTO], v->field[PROTO_FIELD_IPV6].value.u8, 0, UINT8_MAX, '/');
    GET_CB_FIELD(in[CB_FLD_PROTO], v->field[PROTO_FIELD_IPV6].mask_range.u8, 0, UINT8_MAX, 0);
    GET_CB_FIELD(in[CB_FLD_USERDATA], v->data.userdata, 0, UINT32_MAX, 0);
    //GET_CB_FIELD(in[CB_FLD_CATEGORY_MASK], v->data.category_mask, 0, UINT32_MAX, 0);
    //GET_CB_FIELD(in[CB_FLD_PRIORITY], v->data.priority, 0, UINT32_MAX, 0);
    return 0;
}

static int
add_rules_string_ipv6(const char **rule_list, int rule_num, struct rte_acl_rule **pacl_base, unsigned int *pacl_num)
{
    uint8_t *acl_rules = NULL;
    struct rte_acl_rule *rule = NULL;
    unsigned int acl_cnt = 0;
    int i = 0;

    if(0 == rule_num)
    {
        printf("ipv6 rule 为空\n");
        return -1;
    }

    acl_rules = malloc(rule_num * sizeof(struct acl6_rule));
    memset(acl_rules, 0, rule_num * sizeof(struct acl6_rule));

    //解析
    for(i = 0; i < rule_num; i++)
    {
        char *rule_text = (char*)rule_list[i];
        rule = (struct rte_acl_rule *)(acl_rules +  acl_cnt * sizeof(struct acl6_rule));
        if (parse_ipv6_rule(rule_text, rule) != 0)
            rte_exit(EXIT_FAILURE, "parse ipv6 rules error\n");

        rule->data.priority = ACL_PRIORITY_DEBIG + acl_cnt;
        rule->data.category_mask = 1;   //无需多模
        acl_cnt++;
    };

    //传出参数
    *pacl_base = (struct rte_acl_rule *)acl_rules;
    *pacl_num = acl_cnt;
    return 0;
}

int acl_load_ipv6_str(struct acl_context_t *ctx, const char *rule[], int num)
{
    struct rte_acl_rule *acl_base = NULL;
    unsigned int acl_num = 0;
    int rc = 0;
    rc = add_rules_string_ipv6(rule, num, &acl_base, &acl_num);
    if(rc)
    {
        printf("ipv6 rule 解析错误\n");
        return -1;
    }

    rc = acl_load_ipv6(ctx, acl_base, acl_num);
    if(rc)
    {
        printf("ipv6 rule 编译错误\n");
        return -1;
    }
    free(acl_base);
    return 0;
}
////////////////////// IPV6 文本规则解析 API --END //////////////////////////////////

////////////////////// IPV4 结构体规则解析 API --START //////////////////////////////////
static int
acl_convert_ipv4_rule(struct acl_rule_t *rule, struct rte_acl_rule *v)
{
    v->field[PROTO_FIELD_IPV4].value.u8         = rule->proto_id;
    v->field[PROTO_FIELD_IPV4].mask_range.u8    = 0xff;

    v->field[SRC_FIELD_IPV4].value.u32          = rule->ipsrc[0];
    v->field[SRC_FIELD_IPV4].mask_range.u32     = rule->ipsrc_prefix;

    v->field[DST_FIELD_IPV4].value.u32          = rule->ipdst[0];
    v->field[DST_FIELD_IPV4].mask_range.u32     = rule->ipdst_prefix;

    v->field[SRCP_FIELD_IPV4].value.u16         = rule->src_port_begin;
    v->field[SRCP_FIELD_IPV4].mask_range.u16    = rule->src_port_end;

    v->field[DSTP_FIELD_IPV4].value.u16         = rule->dst_port_begin;
    v->field[DSTP_FIELD_IPV4].mask_range.u16    = rule->dst_port_end;

    v->data.userdata                            = rule->rule_id;
    return 0;
}

static int
acl_parse_ipv4_rule(struct acl_rule_t *rule_list, int rule_num, struct rte_acl_rule **pacl_base, unsigned int *pacl_num)
{
    uint8_t *acl_rules = NULL;
    struct rte_acl_rule *rule = NULL;
    unsigned int acl_cnt = 0;
    int i = 0;

    if(0 == rule_num)
    {
        printf("ipv4 rule 为空\n");
        return -1;
    }

    acl_rules = malloc(rule_num * sizeof(struct acl4_rule));
    memset(acl_rules, 0, rule_num * sizeof(struct acl4_rule));

    //解析
    for(i = 0; i < rule_num; i++)
    {
        rule = (struct rte_acl_rule *)(acl_rules +  acl_cnt * sizeof(struct acl4_rule));
        if (acl_convert_ipv4_rule(rule_list + i, rule) != 0)
            rte_exit(EXIT_FAILURE, "parse ipv4 rules error\n");

        rule->data.priority = ACL_PRIORITY_DEBIG + acl_cnt;
        rule->data.category_mask = 1;   //无需多模
        acl_cnt++;
    };

    //传出参数
    *pacl_base = (struct rte_acl_rule *)acl_rules;
    *pacl_num = acl_cnt;
    return 0;
}

int acl_load_ipv4_rule(struct acl_context_t *ctx, struct acl_rule_t *rule, int num)
{
    struct rte_acl_rule *acl_base = NULL;
    unsigned int acl_num = 0;
    int rc = 0;
    rc = acl_parse_ipv4_rule(rule, num, &acl_base, &acl_num);
    if(rc)
    {
        printf("ipv4 rule 解析错误\n");
        return -1;
    }

    rc = acl_load_ipv4(ctx, acl_base, acl_num);
    if(rc)
    {
        printf("ipv4 rule 编译错误\n");
        return -1;
    }
    free(acl_base);
    return 0;
}
////////////////////// IPV4 结构体规则解析 API --END //////////////////////////////////

////////////////////// IPV6 结构体规则解析 API --START //////////////////////////////////
static int
parse_ipv6_net_rule(uint32_t *v,  int mask_prefix, struct rte_acl_field field[4])
{
    uint32_t i = 0;
    uint32_t m = mask_prefix;
    const uint32_t nbu32 = sizeof(uint32_t) * CHAR_BIT;

    /* put all together. */
    for (i = 0; i != 4; i++) //ipv6 is 4*4 byte
    {
        if (m >= (i + 1) * nbu32)
            field[i].mask_range.u32 = nbu32;
        else
            field[i].mask_range.u32 = m > (i * nbu32) ? m - (i * 32) : 0;

        field[i].value.u32 = ntohl(v[i]); //遵循官方示例 端序翻转
    }
    return 0;
}

static int
acl_convert_ipv6_rule(struct acl_rule_t *rule, struct rte_acl_rule *v)
{
    v->field[PROTO_FIELD_IPV6].value.u8         = rule->proto_id;
    v->field[PROTO_FIELD_IPV6].mask_range.u8    = 0xff;

    parse_ipv6_net_rule(rule->ipsrc, rule->ipsrc_prefix, v->field + SRC1_FIELD_IPV6);
    parse_ipv6_net_rule(rule->ipdst, rule->ipdst_prefix, v->field + DST1_FIELD_IPV6);

    v->field[SRCP_FIELD_IPV6].value.u16         = rule->src_port_begin;
    v->field[SRCP_FIELD_IPV6].mask_range.u16    = rule->src_port_end;

    v->field[DSTP_FIELD_IPV6].value.u16         = rule->dst_port_begin;
    v->field[DSTP_FIELD_IPV6].mask_range.u16    = rule->dst_port_end;

    v->data.userdata                            = rule->rule_id;
    return 0;
}

static int
acl_parse_ipv6_rule(struct acl_rule_t *rule_list, int rule_num, struct rte_acl_rule **pacl_base, unsigned int *pacl_num)
{
    uint8_t *acl_rules = NULL;
    struct rte_acl_rule *rule = NULL;
    unsigned int acl_cnt = 0;
    int i = 0;

    if(0 == rule_num)
    {
        printf("ipv6 rule 为空\n");
        return -1;
    }

    acl_rules = malloc(rule_num * sizeof(struct acl6_rule));
    memset(acl_rules, 0, rule_num * sizeof(struct acl6_rule));

    //解析
    for(i = 0; i < rule_num; i++)
    {
        rule = (struct rte_acl_rule *)(acl_rules +  acl_cnt * sizeof(struct acl6_rule));
        if (acl_convert_ipv6_rule(rule_list + i, rule) != 0)
            rte_exit(EXIT_FAILURE, "parse ipv6 rules error\n");

        rule->data.priority = ACL_PRIORITY_DEBIG + acl_cnt;
        rule->data.category_mask = 1;   //无需多模
        acl_cnt++;
    };

    //传出参数
    *pacl_base = (struct rte_acl_rule *)acl_rules;
    *pacl_num = acl_cnt;
    return 0;
}

int acl_load_ipv6_rule(struct acl_context_t *ctx, struct acl_rule_t *rule, int num)
{
    struct rte_acl_rule *acl_base = NULL;
    unsigned int acl_num = 0;
    int rc = 0;
    rc = acl_parse_ipv6_rule(rule, num, &acl_base, &acl_num);
    if(rc)
    {
        printf("ipv6 rule 解析错误\n");
        return -1;
    }

    rc = acl_load_ipv6(ctx, acl_base, acl_num);
    if(rc)
    {
        printf("ipv6 rule 编译错误\n");
        return -1;
    }
    free(acl_base);
    return 0;
}
////////////////////// IPV6 结构体规则解析 API --END //////////////////////////////////


//ACL对象匹配 规则
int acl_match_ipv4(struct acl_context_t *ctx, const char *data)
{
    //没有命中
    if(NULL ctx || NULL == ctx->acl_ctx_v4)
    {
        return 0;
    }

    int result = 0;
    int ret = rte_acl_classify(ctx->acl_ctx_v4, (const uint8_t **)&data, (uint32_t *)&result, 1, DEFAULT_MAX_CATEGORIES);
    if (ret)
        rte_exit(EXIT_FAILURE, "ERROR rte_acl_classify in acl_match_ipv4\n");
    return result;
}

//ACL对象匹配 规则
int acl_match_ipv6(struct acl_context_t *ctx, const char *data)
{
    //没有命中
    if(NULL ctx || NULL == ctx->acl_ctx_v6)
    {
        return 0;
    }

    int result = 0;
    int ret = rte_acl_classify(ctx->acl_ctx_v6, (const uint8_t **)&data, (uint32_t *)&result, 1, DEFAULT_MAX_CATEGORIES);
    if (ret)
        rte_exit(EXIT_FAILURE, "ERROR rte_acl_classify in acl_match_ipv6\n");
    return result;
}

//ACL对象析构
void acl_destroy(struct acl_context_t *ctx)
{
    rte_acl_free(ctx->acl_ctx_v4);
    rte_acl_free(ctx->acl_ctx_v6);
    free(ctx);
}

match.h

#ifndef _ACL_MATCH_H_
#define _ACL_MATCH_H_

#ifdef __cplusplus
extern "C"
{
#endif

struct acl_context_t;
struct acl_rule_t
{
    uint8_t  proto_id;
    uint8_t  af;             //AF_INET or AF_INET6
    uint32_t ipsrc[4];
    uint8_t  ipsrc_prefix;
    uint32_t ipdst[4];
    uint8_t  ipdst_prefix;
    uint16_t src_port_begin; //小端
    uint16_t src_port_end;   //小端
    uint16_t dst_port_begin; //小端
    uint16_t dst_port_end;   //小端
    int      rule_id;
};

//创建ACL对象
struct acl_context_t *acl_match_create();

//ACL对象添加 规则 (结构体形式)
int acl_load_ipv4_rule(struct acl_context_t *ctx, struct acl_rule_t *rule, int num);
int acl_load_ipv6_rule(struct acl_context_t *ctx, struct acl_rule_t *rule, int num);

//ACL对象添加 规则 (文本形式)
int acl_load_ipv4_str(struct acl_context_t *ctx, const char *rule[], int num);
int acl_load_ipv6_str(struct acl_context_t *ctx, const char *rule[], int num);

//ACL对象匹配 规则
int acl_match_ipv4(struct acl_context_t *ctx, const char *ip4_hdr);
int acl_match_ipv6(struct acl_context_t *ctx, const char *ip6_hdr);

//ACL对象析构
void acl_destroy(struct acl_context_t *ctx);

#ifdef __cplusplus
}
#endif

#endif

文本规则

struct acl_context_t *acl_ctx = acl_match_create();
int rc = 0;

const char *rule_example_ipv4[]={
    "47.101.131.102/24     192.168.1.5/24     9000 : 9000    0 : 65535  6/0xff 10001",
    "47.101.131.102/32     192.168.1.5/24     9000 : 9000    0 : 65535  6/0xff 10002",
    "48.101.131.102/32     192.168.1.5/24     9000 : 9000    0 : 65535  6/0xff 10003",
};
rc = acl_load_ipv4_str(acl_ctx, rule_example_ipv4, 3);

const char *rule_example_ipv6[]={
    "2409:8a1e:7bf0:66c0:0000:0000:0000:0002/60 2409:801e:0381:0000:0000:0000:0000:0830/64 46818 : 46818 0 : 65535 6/0xff 2001",
    "2409:8a1e:7bf0:66c0:0000:0000:0000:0002/64 2409:801e:0381:0000:0000:0000:0000:0830/64 46818 : 46818 0 : 65535 6/0xff 2004",
    "2409:8a1e:7bf0:66c0:0000:0000:0000:0002/68 2409:801e:0381:0000:0000:0000:0000:0830/64 46818 : 46818 0 : 65535 6/0xff 2008",
};
rc = acl_load_ipv6_str(acl_ctx, rule_example_ipv6, 3);

结构体规则

#include "acl_match.h"

//存储ACL头 -- 全局变量
static std::vector<XXXRuleHeader_t> acl_blacklist;

//仅在规则编译线程执行 -- 黑名单ACL清除
int
acl_rule_blacklist_clear()
{
    acl_blacklist.clear();
    return 0;
}

//仅在规则编译线程执行 -- 黑名单ACL递增
int
acl_rule_blacklist_add(XXXRuleHeader_t *pHdr)
{
    acl_blacklist.push_back(*pHdr);
    return 0;
}

//仅在规则编译线程执行 -- 结构转换
static int
acl_rule_blacklist_load_ipv6(XXXRuleHeaderCell *src, struct acl_rule_t *rule)
{
    rule->proto_id       =   src->protoID;
    rule->af             =   AF_INET;
    rule->ipsrc_prefix   =   src->ipSrc.ipPrefix;
    rule->ipdst_prefix   =   src->ipDst.ipPrefix;
    rule->src_port_begin =   src->portSrc.portStart;
    rule->src_port_end   =   src->portSrc.portEnd;
    rule->dst_port_begin =   src->portDst.portStart;
    rule->dst_port_end   =   src->portDst.portEnd;
    rule->rule_id        =   src->hash;
    memcpy(rule->ipsrc, src->ipSrc.ip.ipv6, 16);
    memcpy(rule->ipdst, src->ipDst.ip.ipv6, 16);
    return 0;
}

//仅在规则编译线程执行 -- 结构转换
static int
acl_rule_blacklist_load_ipv4(XXXRuleHeaderCell *src, struct acl_rule_t *rule)
{
    rule->proto_id       =   src->protoID;
    rule->af             =   AF_INET;
    rule->ipsrc[0]       =   {src->ipSrc.ip.ipv4};
    rule->ipsrc_prefix   =   src->ipSrc.ipPrefix;
    rule->ipdst[0]       =   {src->ipDst.ip.ipv4};
    rule->ipdst_prefix   =   src->ipDst.ipPrefix;
    rule->src_port_begin =   src->portSrc.portStart;
    rule->src_port_end   =   src->portSrc.portEnd;
    rule->dst_port_begin =   src->portDst.portStart;
    rule->dst_port_end   =   src->portDst.portEnd;
    rule->rule_id        =   src->hash;
    return 0;
}

//仅在规则编译线程执行 -- 载入处理
int
acl_rule_blacklist_load(int (*func)(struct acl_rule_t *v4, int n4, struct acl_rule_t *v6, int n6, void *user), void *user)
{
    struct acl_rule_t rule;
    std::vector<struct acl_rule_t> acl_rule_ipv4;
    std::vector<struct acl_rule_t> acl_rule_ipv6;

    for(int i = 0; i< (int)acl_blacklist.size(); i++)
    {
        XXXRuleHeader_t *pHdr = acl_blacklist.data() + i;
        pHdr->iterator_reset();             //迭代器
        XXXRuleHeaderCell *cell = NULL;
        while((cell = pHdr->iterator_next()))
        {
            if(4 == cell->ipSrc.ipVersion)
            {
                acl_rule_blacklist_load_ipv4(cell, &rule);//转换
                acl_rule_ipv4.push_back(rule);  //收集
            }
            else
            if(6 == cell->ipSrc.ipVersion)
            {
                acl_rule_blacklist_load_ipv6(cell, &rule);//转换
                acl_rule_ipv6.push_back(rule);//收集
            }
        }
    }

    //回调处理 -- 代码隔离(不要让 libXXX看得到DPDK的代码)
    func(acl_rule_ipv4.data(), acl_rule_ipv4.size(), acl_rule_ipv6.data(), acl_rule_ipv6.size(), user);
    return 0;
}

匹配

//黑名单 命中则丢弃
//从报文的 protoid 数据域开始参与匹配
int ruleid_v4 = 0;
if(iph && (ruleid_v4=acl_match_ipv4(g_black_acl_ctx, (const char*)iph + offsetof(struct XXXX_iphdr, protocol))))
{
    printf("命中了在 ipv4 ruleid=%u\n", ruleid_v4);
    return PKT_DROP;
}

int ruleid_v6 = 0;
if(iph6 && (ruleid_v6=acl_match_ipv6(g_black_acl_ctx, (const char*)iph6 + offsetof(struct XXXX_ipv6hdr, ip6_ctlun.ip6_un1.ip6_un1_nxt))))
{
    printf("命中了在 ipv6 ruleid=%u\n", ruleid_v6);
    return PKT_DROP;
}

//放行逻辑...
printf("没有命中\n");