From mboxrd@z Thu Jan 1 00:00:00 1970 From: Shyam Shrivastav Subject: ip_pipeline firewall customization Date: Wed, 8 Mar 2017 21:24:38 +0530 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: Shyam Shrivastav To: dev@dpdk.org Return-path: Received: from mail-qk0-f176.google.com (mail-qk0-f176.google.com [209.85.220.176]) by dpdk.org (Postfix) with ESMTP id 8F89C3DC for ; Wed, 8 Mar 2017 16:54:39 +0100 (CET) Received: by mail-qk0-f176.google.com with SMTP id y76so72641625qkb.0 for ; Wed, 08 Mar 2017 07:54:39 -0800 (PST) List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi All I am using ip_pipeline firewall as base for our project, need comments/suggestions/corrections regarding following 1) We can not configure firewall rule to drop packets, as portid is mandatory in command. I am planning to allow this for our requirement with following code changes a) Allow "port" as optional parameter (pipeline_firewall.c), pass -1 as port id if "port" is not specified to app_pipeline_firewall_add_rule and change that parameter to int32_t. b) Make required changes in pipeline_firewall_msg_req_add_handler if portid is -1, that is table entry action to be .action = RTE_PIPELINE_ACTION_DROP. 2) I am registering a f_action_hit function for firewall table to perform certain translations if action is pass (RTE_PIPELINE_ACTION_PORT). Configured a rule like following pipeline>p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 0 65535 0 0 port 0 which should be hit only by ipv4 packets. However even ARP packets are hit by this ACL and my routine is called. If I configure a specific src or dst ip then everything works fine and arp packets are not hit , for example following rule hits only ipv4 icmp packets pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 45.35.70.12 32 0 65535 0 65535 1 0xf port 0 Is this a bug or am I missing something ? Thanks Shyam