<div dir="ltr">Hi!<div>I have a big number of IPv4 5-tuple rules, every rule corresponds to some action. I need to find all matched rules and perform all tied actions.</div><div>The search time greatly affects overall system performance, so I can't just scan all rules. ACL is based on multi-bit tries and provides great performance, so I'm looking for nearly the same performance with the ability to find all matches within a single request. </div></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">ср, 24 нояб. 2021 г. в 18:20, Dmitry Kozlyuk <<a href="mailto:dmitry.kozliuk@gmail.com">dmitry.kozliuk@gmail.com</a>>: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">2021-11-24 11:06 (UTC+0100), Steffen Weise: > > Hi folks! > > > > I'm using DPDK's ACL library to classify incoming packets by IPv4 5 tuple > > match (src address, dst address, src port, dst port, protocol). Right now > > it is possible to find only the best match based on the rule's priority. > > Is there any way (maybe a custom patch for the ACL library exists?) to > > find all matches in a single request? Decreased performance and even some > > false-positive matches are acceptable. > > It could be a big number of matches so using categories is not an option. > > > > Thanks, > > Dmitriy Stepanov > > > > Hi, > > I have the very same question. Such a mechanism would help me in my > applications. Currently I go for lookup on multiple separate tables. > > Cheers, > Steffen Weise Hi, I wonder what is the original problem you're solving. A set of IPv4 5-tuple rules can be viewed as a set of regular expressions: ACL: src <a href="http://1.1.1.0/24" rel="noreferrer" target="_blank">1.1.1.0/24</a> dst <a href="http://2.2.2.2/32" rel="noreferrer" target="_blank">2.2.2.2/32</a> sport any dport 0x0035 proto tcp Regex: ^\x01\x01\x01.\x02\x02\x02\x02..\x00\x35\x06$ Here, "." stands for "any byte". For masks/ranges not aligned on 8 bits regex ranges can be used, e.g.: ACL: sport 100-200 # this one is easy, just one byte varies Regex: \x00[\x64-\xC8] ACL: sport 200-300 # this one is hard, needs an algorithm to transform # 200-300 => 200-255,256-300 => 0xC8-0xFF,0x0100-0x012C Regex: (?:\x00[\xC8-xFF]|\x01[\x00-\x2C]) ACL: src <a href="http://192.0.2.64/26" rel="noreferrer" target="_blank">192.0.2.64/26</a> # this one is easy, there are also hard examples like above Regex: \xC0\x00\x02[\x40-\x7F] IIUC, you need all matching expressions for every packet, which is represented as a 4+4+2+2+1 byte "string". This is exactly what Hyperscan library does, for example: <a href="http://intel.github.io/hyperscan/dev-reference/runtime.html" rel="noreferrer" target="_blank">http://intel.github.io/hyperscan/dev-reference/runtime.html</a> There is now regexdev in DPDK, take a look at it, maybe it will suit your needs and HW. </blockquote></div>