flow_drop_sample.c

Go to the documentation of this file.

/*
 * Copyright (c) 2022-2025 NVIDIA CORPORATION AND AFFILIATES.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without modification, are permitted
 * provided that the following conditions are met:
 *     * Redistributions of source code must retain the above copyright notice, this list of
 *       conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above copyright notice, this list of
 *       conditions and the following disclaimer in the documentation and/or other materials
 *       provided with the distribution.
 *     * Neither the name of the NVIDIA CORPORATION nor the names of its contributors may be used
 *       to endorse or promote products derived from this software without specific prior written
 *       permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
 * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NVIDIA CORPORATION BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TOR (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */
 
#include <string.h>
#include <unistd.h>
 
#include <rte_byteorder.h>
 
#include <doca_log.h>
#include <doca_flow.h>
 
#include "flow_common.h"
 
typedef enum {
    CLASSIFIER_PIPE_ENTRY = 0,
    DROP_PIPE_ENTRY = 1,
    HAIRPIN_PIPE_ENTRY = 2,
} pipe_entry_index;
 
DOCA_LOG_REGISTER(FLOW_DROP);
 
/*
 * Create DOCA Flow pipe that forwards all the traffic to the other port
 *
 * @port [in]: port of the pipe
 * @port_id [in]: port ID of the pipe
 * @pipe [out]: created pipe pointer
 * @return: DOCA_SUCCESS on success and DOCA_ERROR otherwise.
 */
static doca_error_t create_hairpin_pipe(struct doca_flow_port *port, int port_id, struct doca_flow_pipe **pipe)
{
    struct doca_flow_match match;
    struct doca_flow_monitor monitor;
    struct doca_flow_actions actions, *actions_arr[NB_ACTIONS_ARR];
    struct doca_flow_fwd fwd;
    struct doca_flow_pipe_cfg *pipe_cfg;
    doca_error_t result;
 
    memset(&match, 0, sizeof(match));
    memset(&monitor, 0, sizeof(monitor));
    memset(&actions, 0, sizeof(actions));
    memset(&fwd, 0, sizeof(fwd));
 
    monitor.counter_type = DOCA_FLOW_RESOURCE_TYPE_NON_SHARED;
 
    actions_arr[0] = &actions;
 
    result = doca_flow_pipe_cfg_create(&pipe_cfg, port);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to create doca_flow_pipe_cfg: %s", doca_error_get_descr(result));
        return result;
    }
 
    result = set_flow_pipe_cfg(pipe_cfg, "HAIRPIN_PIPE", DOCA_FLOW_PIPE_BASIC, false);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_match(pipe_cfg, &match, NULL);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg match: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_actions(pipe_cfg, actions_arr, NULL, NULL, NB_ACTIONS_ARR);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg actions: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_monitor(pipe_cfg, &monitor);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg monitor: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
 
    /* forwarding traffic to other port */
    fwd.type = DOCA_FLOW_FWD_PORT;
    fwd.port_id = port_id ^ 1;
 
    result = doca_flow_pipe_create(pipe_cfg, &fwd, NULL, pipe);
destroy_pipe_cfg:
    doca_flow_pipe_cfg_destroy(pipe_cfg);
    return result;
}
 
/*
 * Create DOCA Flow pipe with match on header types to fwd to drop pipe with it's own match logic.
 * On miss, drop the packet.
 *
 * @port [in]: port of the pipe
 * @drop_pipe [in]: pipe to forward the traffic that didn't hit the pipe rules
 * @pipe [out]: created pipe pointer
 * @return: DOCA_SUCCESS on success and DOCA_ERROR otherwise.
 */
static doca_error_t create_classifier_pipe(struct doca_flow_port *port,
                       struct doca_flow_pipe *drop_pipe,
                       struct doca_flow_pipe **pipe)
{
    struct doca_flow_match match;
    struct doca_flow_actions actions, *actions_arr[NB_ACTIONS_ARR];
    struct doca_flow_monitor monitor;
    struct doca_flow_fwd fwd;
    struct doca_flow_fwd fwd_miss;
    struct doca_flow_pipe_cfg *pipe_cfg;
    doca_error_t result;
 
    memset(&match, 0, sizeof(match));
    memset(&actions, 0, sizeof(actions));
    memset(&monitor, 0, sizeof(monitor));
    memset(&fwd, 0, sizeof(fwd));
    memset(&fwd_miss, 0, sizeof(fwd_miss));
 
    /* Match on header types */
    match.parser_meta.outer_l3_type = DOCA_FLOW_L3_META_IPV4;
    match.parser_meta.outer_l4_type = DOCA_FLOW_L4_META_TCP;
 
    monitor.counter_type = DOCA_FLOW_RESOURCE_TYPE_NON_SHARED;
 
    actions_arr[0] = &actions;
 
    result = doca_flow_pipe_cfg_create(&pipe_cfg, port);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to create doca_flow_pipe_cfg: %s", doca_error_get_descr(result));
        return result;
    }
 
    result = set_flow_pipe_cfg(pipe_cfg, "CLASSIFIER_PIPE", DOCA_FLOW_PIPE_BASIC, true);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_match(pipe_cfg, &match, NULL);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg match: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_actions(pipe_cfg, actions_arr, NULL, NULL, NB_ACTIONS_ARR);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg actions: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_monitor(pipe_cfg, &monitor);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg monitor: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
 
    fwd.type = DOCA_FLOW_FWD_PIPE;
    fwd.next_pipe = drop_pipe;
 
    fwd_miss.type = DOCA_FLOW_FWD_DROP;
 
    result = doca_flow_pipe_create(pipe_cfg, &fwd, &fwd_miss, pipe);
destroy_pipe_cfg:
    doca_flow_pipe_cfg_destroy(pipe_cfg);
    return result;
}
 
/*
 * Add DOCA Flow pipe entry to the classifier or hairpin pipe
 *
 * @pipe [in]: pipe of the entry
 * @status [in]: user context for adding entry
 * @entry [out]: created entry pointer
 * @return: DOCA_SUCCESS on success and DOCA_ERROR otherwise.
 */
static doca_error_t add_pipe_entry(struct doca_flow_pipe *pipe,
                   struct entries_status *status,
                   struct doca_flow_pipe_entry **entry)
{
    struct doca_flow_match match;
 
    /*
     * All fields are not changeable, thus we need to add only 1 entry, all values will be
     * inherited from the pipe creation
     */
    memset(&match, 0, sizeof(match));
 
    return doca_flow_pipe_add_entry(0, pipe, &match, NULL, NULL, NULL, 0, status, entry);
}
 
/*
 * Create DOCA Flow pipe with match and fwd drop action. miss fwd to hairpin pipe
 *
 * @port [in]: port of the pipe
 * @hairpin_pipe [in]: pipe to forward the traffic that didn't hit the pipe rules
 * @pipe [out]: created pipe pointer
 * @return: DOCA_SUCCESS on success and DOCA_ERROR otherwise.
 */
static doca_error_t create_drop_pipe(struct doca_flow_port *port,
                     struct doca_flow_pipe *hairpin_pipe,
                     struct doca_flow_pipe **pipe)
{
    struct doca_flow_match match;
    struct doca_flow_actions actions, *actions_arr[NB_ACTIONS_ARR];
    struct doca_flow_monitor monitor;
    struct doca_flow_fwd fwd;
    struct doca_flow_fwd fwd_miss;
    struct doca_flow_pipe_cfg *pipe_cfg;
    doca_error_t result;
    const char *label = "Matches IPv4 TCP packets with changeable source and destination IP addresses and ports";
 
    memset(&match, 0, sizeof(match));
    memset(&actions, 0, sizeof(actions));
    memset(&monitor, 0, sizeof(monitor));
    memset(&fwd, 0, sizeof(fwd));
    memset(&fwd_miss, 0, sizeof(fwd_miss));
    /*
     * DOCA_FLOW_L3_TYPE_IP4 is a selector of underlying struct, pipe won't match on L3 header
     * type being IP4. This part is done on previous pipe, a classifier.
     */
    match.outer.l3_type = DOCA_FLOW_L3_TYPE_IP4;
    match.outer.ip4.src_ip = 0xffffffff;
    match.outer.ip4.dst_ip = 0xffffffff;
    /*
     * DOCA_FLOW_L4_TYPE_EXT_TCP is a selector of underlying struct, pipe won't match on
     * L4 header type being TCP. This part is done on previous pipe, a classifier.
     */
    match.outer.l4_type_ext = DOCA_FLOW_L4_TYPE_EXT_TCP;
    match.outer.tcp.l4_port.src_port = 0xffff;
    match.outer.tcp.l4_port.dst_port = 0xffff;
 
    monitor.counter_type = DOCA_FLOW_RESOURCE_TYPE_NON_SHARED;
 
    actions_arr[0] = &actions;
 
    result = doca_flow_pipe_cfg_create(&pipe_cfg, port);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to create doca_flow_pipe_cfg: %s", doca_error_get_descr(result));
        return result;
    }
 
    result = set_flow_pipe_cfg(pipe_cfg, "DROP_PIPE", DOCA_FLOW_PIPE_BASIC, false);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_label(pipe_cfg, label);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg label: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_match(pipe_cfg, &match, NULL);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg match: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_actions(pipe_cfg, actions_arr, NULL, NULL, NB_ACTIONS_ARR);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg actions: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
    result = doca_flow_pipe_cfg_set_monitor(pipe_cfg, &monitor);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to set doca_flow_pipe_cfg monitor: %s", doca_error_get_descr(result));
        goto destroy_pipe_cfg;
    }
 
    fwd.type = DOCA_FLOW_FWD_DROP;
 
    fwd_miss.type = DOCA_FLOW_FWD_PIPE;
    fwd_miss.next_pipe = hairpin_pipe;
 
    result = doca_flow_pipe_create(pipe_cfg, &fwd, &fwd_miss, pipe);
destroy_pipe_cfg:
    doca_flow_pipe_cfg_destroy(pipe_cfg);
    return result;
}
 
/*
 * Add DOCA Flow pipe entry to the drop pipe with example 5 tuple to match
 *
 * @pipe [in]: pipe of the entry
 * @status [in]: user context for adding entry
 * @entry [out]: created entry pointer
 * @return: DOCA_SUCCESS on success and DOCA_ERROR otherwise.
 */
static doca_error_t add_drop_pipe_entry(struct doca_flow_pipe *pipe,
                    struct entries_status *status,
                    struct doca_flow_pipe_entry **entry)
{
    struct doca_flow_match match;
    struct doca_flow_actions actions;
    doca_error_t result;
 
    /* example 5-tuple to drop explicitly */
    doca_be32_t dst_ip_addr = BE_IPV4_ADDR(8, 8, 8, 8);
    doca_be32_t src_ip_addr = BE_IPV4_ADDR(1, 2, 3, 4);
    doca_be16_t dst_port = rte_cpu_to_be_16(80);
    doca_be16_t src_port = rte_cpu_to_be_16(1234);
 
    memset(&match, 0, sizeof(match));
    memset(&actions, 0, sizeof(actions));
 
    match.outer.ip4.dst_ip = dst_ip_addr;
    match.outer.ip4.src_ip = src_ip_addr;
    match.outer.tcp.l4_port.dst_port = dst_port;
    match.outer.tcp.l4_port.src_port = src_port;
 
    result = doca_flow_pipe_add_entry(0, pipe, &match, &actions, NULL, NULL, 0, status, entry);
    if (result != DOCA_SUCCESS)
        return result;
 
    return DOCA_SUCCESS;
}
 
/*
 * Run flow_drop sample
 *
 * @nb_queues [in]: number of queues the sample will use
 * @return: DOCA_SUCCESS on success and DOCA_ERROR otherwise.
 */
doca_error_t flow_drop(int nb_queues)
{
    const int nb_ports = 2;
    struct flow_resources resource = {0};
    uint32_t nr_shared_resources[SHARED_RESOURCE_NUM_VALUES] = {0};
    struct doca_flow_port *ports[nb_ports];
    uint32_t actions_mem_size[nb_ports];
    struct doca_dev *dev_arr[nb_ports];
    struct doca_flow_pipe *classifier_pipe;
    struct doca_flow_pipe *drop_pipe;
    struct doca_flow_pipe *hairpin_pipe;
    /*
     * Total numbe of entries - 3.
     * - 1 entry for classifier pipe
     * - 1 entry for drop pipe
     * - 1 entry for hairpin pipe
     */
    const int nb_entries = 3;
    struct doca_flow_pipe_entry *entry[nb_ports][nb_entries];
    struct doca_flow_resource_query query_stats;
    struct entries_status status;
    doca_error_t result;
    int port_id;
    FILE *fd;
    char file_name[128];
 
    resource.nr_counters = nb_ports * nb_entries;
 
    result = init_doca_flow(nb_queues, "vnf,hws", &resource, nr_shared_resources);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to init DOCA Flow: %s", doca_error_get_descr(result));
        return result;
    }
 
    memset(dev_arr, 0, sizeof(struct doca_dev *) * nb_ports);
    ARRAY_INIT(actions_mem_size, ACTIONS_MEM_SIZE(nb_queues, nb_entries));
    result = init_doca_flow_ports(nb_ports, ports, true, dev_arr, actions_mem_size);
    if (result != DOCA_SUCCESS) {
        DOCA_LOG_ERR("Failed to init DOCA ports: %s", doca_error_get_descr(result));
        doca_flow_destroy();
        return result;
    }
 
    for (port_id = 0; port_id < nb_ports; port_id++) {
        memset(&status, 0, sizeof(status));
 
        result = create_hairpin_pipe(ports[port_id], port_id, &hairpin_pipe);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to add hairpin pipe: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
 
        result = add_pipe_entry(hairpin_pipe, &status, &entry[port_id][HAIRPIN_PIPE_ENTRY]);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to add hairpin entry: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
 
        result = create_drop_pipe(ports[port_id], hairpin_pipe, &drop_pipe);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to create drop pipe: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
 
        result = add_drop_pipe_entry(drop_pipe, &status, &entry[port_id][DROP_PIPE_ENTRY]);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to add entry to drop pipe: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
 
        result = create_classifier_pipe(ports[port_id], drop_pipe, &classifier_pipe);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to create classifier pipe: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
 
        result = add_pipe_entry(classifier_pipe, &status, &entry[port_id][CLASSIFIER_PIPE_ENTRY]);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to add entry to classifier: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
 
        result = doca_flow_entries_process(ports[port_id], 0, DEFAULT_TIMEOUT_US, nb_entries);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to process entries: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
 
        if (status.nb_processed != nb_entries || status.failure) {
            DOCA_LOG_ERR("Failed to process entries");
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return DOCA_ERROR_BAD_STATE;
        }
    }
 
    /* wait few seconds for packets to arrive so query will not return zero */
    DOCA_LOG_INFO("Wait few seconds for packets to arrive");
    sleep(5);
    DOCA_LOG_INFO("===================================================");
 
    for (port_id = 0; port_id < nb_ports; port_id++) {
        snprintf(file_name, sizeof(file_name) - 1, "port_%d_info.txt", port_id);
 
        fd = fopen(file_name, "w");
        if (fd == NULL) {
            DOCA_LOG_ERR("Failed to open the file %s", file_name);
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return DOCA_ERROR_IO_FAILED;
        }
 
        /* dump port info to a file */
        doca_flow_port_pipes_dump(ports[port_id], fd);
        fclose(fd);
 
        result = doca_flow_resource_query_entry(entry[port_id][CLASSIFIER_PIPE_ENTRY], &query_stats);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to query entry: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
        DOCA_LOG_INFO("Port %d:", port_id);
        DOCA_LOG_INFO("Classifier pipe:");
        DOCA_LOG_INFO("\tTotal bytes: %ld", query_stats.counter.total_bytes);
        DOCA_LOG_INFO("\tTotal packets: %ld", query_stats.counter.total_pkts);
        DOCA_LOG_INFO("--------------");
 
        result = doca_flow_resource_query_entry(entry[port_id][DROP_PIPE_ENTRY], &query_stats);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to query entry: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
        DOCA_LOG_INFO("Drop pipe:");
        DOCA_LOG_INFO("\tTotal bytes: %ld", query_stats.counter.total_bytes);
        DOCA_LOG_INFO("\tTotal packets: %ld", query_stats.counter.total_pkts);
        DOCA_LOG_INFO("--------------");
 
        result = doca_flow_resource_query_entry(entry[port_id][HAIRPIN_PIPE_ENTRY], &query_stats);
        if (result != DOCA_SUCCESS) {
            DOCA_LOG_ERR("Failed to query entry: %s", doca_error_get_descr(result));
            stop_doca_flow_ports(nb_ports, ports);
            doca_flow_destroy();
            return result;
        }
        DOCA_LOG_INFO("Hairpin pipe:");
        DOCA_LOG_INFO("\tTotal bytes: %ld", query_stats.counter.total_bytes);
        DOCA_LOG_INFO("\tTotal packets: %ld", query_stats.counter.total_pkts);
        DOCA_LOG_INFO("===================================================");
    }
 
    result = stop_doca_flow_ports(nb_ports, ports);
    doca_flow_destroy();
    return result;
}