[dpdk-dev] ip_pipeline firewall port range filtering

[dpdk-dev] ip_pipeline firewall port range filtering

[Shyam Shrivastav]

Hi

I am trying to just allow tcp dest port 80 packets using ip_pipeline
firewall, configured as under
------------------------------------------------------------
------------------------------------------------------------------------
pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 80
80 6 0xF port 0
pipeline> p 1 firewall ls
Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 80-80, Proto =
6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08)
Default rule: DROP
------------------------------------------------------------
-----------------------------------------------------------------------

but it is not working and all tcp packets are getting dropped. If I
configure dest port range to be wildcard(0-65535) then tcp packets are
allowed

------------------------------------------------------------
-----------------------------------------------------------------------
pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 0
65535 6 0xF port 0
Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 0-65535, Proto
= 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08)
pipeline> p 1 firewall ls
Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 0-65535, Proto
= 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08)
Default rule: DROP

------------------------------------------------------------
--------------------------------------------------------------------------

Anyone here got specific port filtering work with ip_pipeline firewall?
I am debugging this, meanwhile any help/guidance would be greatly
appreciated.

Thanks and rgds

Re: [dpdk-dev] ip_pipeline firewall port range filtering

[Shyam Shrivastav]

I took older versions dpdk-stable-16.07.2 & dpdk-16.04(almost one year
old), went  through code changes in relevant libraries librte_table(acl
part only) and librte_acl, looks like no changes to acl compilation and
matching part since then. Has anyone got specific port filtering working
with ACLs? Looks like I have to go through ACL compilation/clasify code
which looks quite difficult :(

On Fri, Mar 17, 2017 at 12:31 PM, Shyam Shrivastav <
shrivastav.shyam@gmail.com> wrote:

> Hi
>
> I am trying to just allow tcp dest port 80 packets using ip_pipeline
> firewall, configured as under
> ------------------------------------------------------------
> ------------------------------------------------------------------------
> pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 80
> 80 6 0xF port 0
> pipeline> p 1 firewall ls
> Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 80-80, Proto
> = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08)
> Default rule: DROP
> ------------------------------------------------------------
> -----------------------------------------------------------------------
>
> but it is not working and all tcp packets are getting dropped. If I
> configure dest port range to be wildcard(0-65535) then tcp packets are
> allowed
>
> ------------------------------------------------------------
> -----------------------------------------------------------------------
> pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 0
> 65535 6 0xF port 0
> Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 0-65535,
> Proto = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08)
> pipeline> p 1 firewall ls
> Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 0-65535,
> Proto = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08)
> Default rule: DROP
>
> ------------------------------------------------------------
> --------------------------------------------------------------------------
>
> Anyone here got specific port filtering work with ip_pipeline firewall?
> I am debugging this, meanwhile any help/guidance would be greatly
> appreciated.
>
> Thanks and rgds
>