Hi! I have a big number of IPv4 5-tuple rules, every rule corresponds to some action. I need to find all matched rules and perform all tied actions. The search time greatly affects overall system performance, so I can't just scan all rules. ACL is based on multi-bit tries and provides great performance, so I'm looking for nearly the same performance with the ability to find all matches within a single request.
ср, 24 нояб. 2021 г. в 18:20, Dmitry Kozlyuk <dmitry.kozl...@gmail.com>: > 2021-11-24 11:06 (UTC+0100), Steffen Weise: > > > Hi folks! > > > > > > I'm using DPDK's ACL library to classify incoming packets by IPv4 5 > tuple > > > match (src address, dst address, src port, dst port, protocol). Right > now > > > it is possible to find only the best match based on the rule's > priority. > > > Is there any way (maybe a custom patch for the ACL library exists?) to > > > find all matches in a single request? Decreased performance and even > some > > > false-positive matches are acceptable. > > > It could be a big number of matches so using categories is not an > option. > > > > > > Thanks, > > > Dmitriy Stepanov > > > > > > > Hi, > > > > I have the very same question. Such a mechanism would help me in my > > applications. Currently I go for lookup on multiple separate tables. > > > > Cheers, > > Steffen Weise > > Hi, > > I wonder what is the original problem you're solving. > > A set of IPv4 5-tuple rules can be viewed as a set of regular expressions: > > ACL: src 1.1.1.0/24 dst 2.2.2.2/32 sport any dport 0x0035 proto tcp > Regex: ^\x01\x01\x01.\x02\x02\x02\x02..\x00\x35\x06$ > > Here, "." stands for "any byte". > For masks/ranges not aligned on 8 bits regex ranges can be used, e.g.: > > ACL: sport 100-200 > # this one is easy, just one byte varies > Regex: \x00[\x64-\xC8] > > ACL: sport 200-300 > # this one is hard, needs an algorithm to transform > # 200-300 => 200-255,256-300 => 0xC8-0xFF,0x0100-0x012C > Regex: (?:\x00[\xC8-xFF]|\x01[\x00-\x2C]) > > ACL: src 192.0.2.64/26 > # this one is easy, there are also hard examples like above > Regex: \xC0\x00\x02[\x40-\x7F] > > IIUC, you need all matching expressions for every packet, > which is represented as a 4+4+2+2+1 byte "string". > This is exactly what Hyperscan library does, for example: > http://intel.github.io/hyperscan/dev-reference/runtime.html > > There is now regexdev in DPDK, > take a look at it, maybe it will suit your needs and HW. >
