I took older versions dpdk-stable-16.07.2 & dpdk-16.04(almost one year old), went through code changes in relevant libraries librte_table(acl part only) and librte_acl, looks like no changes to acl compilation and matching part since then. Has anyone got specific port filtering working with ACLs? Looks like I have to go through ACL compilation/clasify code which looks quite difficult :(
On Fri, Mar 17, 2017 at 12:31 PM, Shyam Shrivastav < shrivastav.sh...@gmail.com> wrote: > Hi > > I am trying to just allow tcp dest port 80 packets using ip_pipeline > firewall, configured as under > ------------------------------------------------------------ > ------------------------------------------------------------------------ > pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 80 > 80 6 0xF port 0 > pipeline> p 1 firewall ls > Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 80-80, Proto > = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08) > Default rule: DROP > ------------------------------------------------------------ > ----------------------------------------------------------------------- > > but it is not working and all tcp packets are getting dropped. If I > configure dest port range to be wildcard(0-65535) then tcp packets are > allowed > > ------------------------------------------------------------ > ----------------------------------------------------------------------- > pipeline> p 1 firewall add priority 1 ipv4 0.0.0.0 0 0.0.0.0 0 0 65535 0 > 65535 6 0xF port 0 > Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 0-65535, > Proto = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08) > pipeline> p 1 firewall ls > Prio = 1 (SA = 0.0.0.0/0, DA = 0.0.0.0/0, SP = 0-65535, DP = 0-65535, > Proto = 6 / 0xf) => Port = 0 (entry ptr = 0x7fddf9f0ff08) > Default rule: DROP > > ------------------------------------------------------------ > -------------------------------------------------------------------------- > > Anyone here got specific port filtering work with ip_pipeline firewall? > I am debugging this, meanwhile any help/guidance would be greatly > appreciated. > > Thanks and rgds >
