<div dir="ltr"><div dir="ltr">Hello Dmitry,I followed your suggestions, and this is what I came up with:<div style="color:rgb(204,204,204);background-color:rgb(31,31,31);font-family:"Droid Sans Mono","monospace",monospace;font-weight:normal;font-size:14px;line-height:19px;white-space:pre-wrap"><div>#include "../include/flow.h"</div><div>#include <stdio.h></div><div>#include <string.h></div> <div>int flow_filtering(uint16_t port_id, uint32_t ip_addr, uint16_t udp_port) {</div><div> struct rte_flow_error error;</div><div> struct rte_flow_attr attr = { .ingress = 1, .priority = 0 };</div><div> struct rte_flow_item pattern[4];</div><div> struct rte_flow_action action[2];</div><div> struct rte_flow *flow;</div> <div> // Définir le motif Ethernet</div><div> memset(pattern, 0, sizeof(pattern));</div><div> pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH;</div> <div> // Définir le motif IPv4</div><div> struct rte_flow_item_ipv4 ipv4_spec = { .hdr.dst_addr = RTE_BE32(ip_addr) };</div><div> struct rte_flow_item_ipv4 ipv4_mask = { .hdr.dst_addr = RTE_BE32(0xFFFFFFFF) };</div><div> pattern[1].type = RTE_FLOW_ITEM_TYPE_IPV4;</div><div> pattern[1].spec = &ipv4_spec;</div><div> pattern[1].mask = &ipv4_mask;</div> <div> // Définir le motif UDP</div><div> struct rte_flow_item_udp udp_spec = { .hdr.dst_port = RTE_BE16(udp_port) };</div><div> struct rte_flow_item_udp udp_mask = { .hdr.dst_port = RTE_BE16(0xFFFF) };</div><div> pattern[2].type = RTE_FLOW_ITEM_TYPE_UDP;</div><div> pattern[2].spec = &udp_spec;</div><div> pattern[2].mask = &udp_mask;</div> <div> // Terminer le motif</div><div> pattern[3].type = RTE_FLOW_ITEM_TYPE_END;</div> <div> // Définir l'action</div><div> action[0].type = RTE_FLOW_ACTION_TYPE_QUEUE;</div><div> struct rte_flow_action_queue queue_action = { .index = 0 };</div><div> action[0].conf = &queue_action;</div><div> action[1].type = RTE_FLOW_ACTION_TYPE_END;</div> <div> // Créer la règle de flux</div><div> flow = rte_flow_create(port_id, &attr, pattern, action, &error);</div><div> if (!flow) {</div><div> printf("Erreur lors de la création de la règle de flux : %s\n", error.message);</div><div> return -1;</div><div> }</div> <div> // rte_flow_isolate(port_id, 1, &error);</div><div> </div> <div> printf("Règle de flux créée avec succès pour IP %u.%u.%u.%u et port UDP %u\n",</div><div> (ip_addr >> 24) & 0xFF, (ip_addr >> 16) & 0xFF,</div><div> (ip_addr >> 8) & 0xFF, ip_addr & 0xFF, udp_port);</div> <div> return 0;</div><div>}</div> <div>int create_drop_all_rule(uint16_t port_id) {</div><div> struct rte_flow_attr attr = { .ingress = 1, .priority = 1};</div><div> struct rte_flow_item pattern[2];</div><div> struct rte_flow_action actions[2];</div><div> struct rte_flow *flow;</div><div> struct rte_flow_error error;</div> <div> pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH;</div><div> pattern[1].type = RTE_FLOW_ITEM_TYPE_END;</div> <div> actions[0].type = RTE_FLOW_ACTION_TYPE_DROP;</div><div> actions[1].type = RTE_FLOW_ACTION_TYPE_END;</div> <div> if (!rte_flow_validate(port_id, &attr, pattern, actions, &error)){</div><div> flow = rte_flow_create(port_id, &attr, pattern, actions, &error);</div><div> }</div> <div> if(flow != 0){</div><div> printf("Filed to create drop flow filter \n");</div><div> return -1;</div><div> }</div> <div> printf("Default drop rule created successfully.\n");</div><div> return 0;</div><div>}</div><div> </div><div><div style="color:rgb(204,204,204);background-color:rgb(31,31,31);font-family:"Droid Sans Mono","monospace",monospace;font-weight:normal;font-size:14px;line-height:19px;white-space:pre-wrap"><div>#include "../include/port.h"</div><div>#include "../include/flow.h"</div><div>#include <rte_eal.h></div><div>#include <rte_mbuf.h></div><div>#include <rte_ethdev.h></div><div>#include <rte_ether.h></div><div>#include <rte_ip.h></div><div>#include <arpa/inet.h></div> <div>#define MAX_PKT_BURST 32</div> <div>int main(int argc, char **argv) {</div><div> struct rte_mempool *mbuf_pool;</div><div> int ret;</div> <div> // Initialiser l'EAL</div><div> ret = rte_eal_init(argc, argv);</div><div> if (ret < 0) {</div><div> rte_exit(EXIT_FAILURE, "Erreur lors de l'initialisation de l'EAL\n");</div><div> }</div> <div> // Créer le pool de mbufs</div><div> mbuf_pool = rte_pktmbuf_pool_create("MBUF_POOL", NUM_MBUFS, MBUF_CACHE_SIZE, 0,</div><div> RTE_MBUF_DEFAULT_BUF_SIZE, rte_socket_id());</div><div> if (!mbuf_pool) {</div><div> rte_exit(EXIT_FAILURE, "Impossible de créer le pool de mbufs\n");</div><div> }</div> <div> if (port_init(PORT_ID, mbuf_pool) != 0) {</div><div> rte_exit(EXIT_FAILURE, "Erreur initialisation port\n");</div><div> }</div> <div> // Créer la règle principale</div><div> uint32_t ip_addr = RTE_IPV4(10, 81, 16, 111);</div><div> uint16_t udp_port = 1234;</div> <div> if (flow_filtering(PORT_ID, ip_addr, udp_port) != 0) {</div><div> rte_exit(EXIT_FAILURE, "Erreur création règle principale\n");</div><div> }</div> <div> // Créer la règle drop-all</div><div> if (create_drop_all_rule(PORT_ID) != 0) {</div><div> rte_exit(EXIT_FAILURE, "Erreur création règle drop-all\n");</div><div> }</div> <div> printf("Traitement des paquets...\n");</div><div> struct rte_mbuf *bufs[MAX_PKT_BURST];</div> <div> while (1) {</div><div> // Récupérer un burst de paquets sur la file RX de la queue 0</div><div> const uint16_t nb_rx = rte_eth_rx_burst(PORT_ID, 0, bufs, MAX_PKT_BURST);</div><div> if (nb_rx > 0) {</div><div> printf("Reçu %u paquet(s)\n", nb_rx);</div><div> for (uint16_t i = 0; i < nb_rx; i++) {</div><div> // Afficher la taille du paquet</div><div> printf("Paquet %u : taille = %u octets\n",</div><div> i, rte_pktmbuf_pkt_len(bufs[i]));</div> <div> // Traiter le paquet pour afficher les adresses source et destination</div><div> struct rte_ether_hdr *eth_hdr;</div><div> eth_hdr = rte_pktmbuf_mtod(bufs[i], struct rte_ether_hdr *);</div> <div> // Vérifier que le paquet est de type IPv4</div><div> if (rte_be_to_cpu_16(eth_hdr->ether_type) == RTE_ETHER_TYPE_IPV4) {</div><div> struct rte_ipv4_hdr *ip_hdr;</div><div> ip_hdr = (struct rte_ipv4_hdr *)(eth_hdr + 1);</div> <div> // Récupérer les adresses source et destination (conversion en format hôte)</div><div> uint32_t src_ip = rte_be_to_cpu_32(ip_hdr->src_addr);</div><div> uint32_t dst_ip = rte_be_to_cpu_32(ip_hdr->dst_addr);</div> <div> // Convertir les adresses en chaîne de caractères lisible</div><div> char src_str[INET_ADDRSTRLEN];</div><div> char dst_str[INET_ADDRSTRLEN];</div><div> inet_ntop(AF_INET, &src_ip, src_str, INET_ADDRSTRLEN);</div><div> inet_ntop(AF_INET, &dst_ip, dst_str, INET_ADDRSTRLEN);</div> <div> printf("Adresse source : %s\n", src_str);</div><div> printf("Adresse destination : %s\n", dst_str);</div><div> } else {</div><div> printf("Paquet non IPv4, impossible d'extraire les adresses\n");</div><div> }</div> <div> // Libérer le mbuf une fois le traitement terminé</div><div> rte_pktmbuf_free(bufs[i]);</div><div> }</div><div> }</div><div> // Petite pause pour éviter une utilisation CPU trop intensive</div><div> rte_delay_us_block(100);</div><div> }</div> <div> // Nettoyage</div><div> port_cleanup(PORT_ID);</div><div> return 0;</div><div>}</div></div></div></div> The issue is that when I implement this, I get an error on the drop filter: "Failed to create rule." Do you have any idea why this might be happening?Thank you for your time.Best regards, Ali</div></div> <div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">Le mar. 28 janv. 2025 à 19:46, Dmitry Kozlyuk <<a href="mailto:dmitry.kozliuk@gmail.com">dmitry.kozliuk@gmail.com</a>> a écrit : </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Ali, 2025-01-28 17:54 (UTC+0100), Sid ali cherrati: > I am attempting to use DPDK's rte_flow API to filter incoming packets at > the hardware level. My goal is to drop all packets except those with a > specific IP address and UDP port. > > I have implemented the following flow filtering rule in my code: > [...] > However, despite this configuration, I continue to receive packets with > other IP addresses and ports that do not match the specified filter. Packets that do not match the rule pattern are processed as usual. If without the rule queue RX_ID could receive any packet, it will also receive them after the rule is created. You need another rule with lower priority (BTW, 0 is the highest one) that matches all packets and drops them or steers to other queues. If you want your DPDK app to only process packets matching the rule and to leave all other traffic for the OS to process, flow isolated mode may be what you're looking for: <a href="https://doc.dpdk.org/guides/prog_guide/ethdev/flow_offload.html#flow-isolated-mode" rel="noreferrer" target="_blank">https://doc.dpdk.org/guides/prog_guide/ethdev/flow_offload.html#flow-isolated-mode</a> > Could you provide any insights into why the filtering isn't working as > expected? Any advice on ensuring the rule is properly applied at the > hardware level would be greatly appreciated. The usual way to check that the rule is matched is to all a counter to the rule and check if it increases. I suggest using testpmd for playing with flow rules: <a href="https://doc.dpdk.org/guides/testpmd_app_ug/testpmd_funcs.html#flow-rules-management" rel="noreferrer" target="_blank">https://doc.dpdk.org/guides/testpmd_app_ug/testpmd_funcs.html#flow-rules-management</a> There was also a useful talk abound HW rules debugging on DPDK Summit: <a href="https://dpdksummit2024.sched.com/event/1iAtU/debug-functional-and-performance-issues-in-rteflow-dariusz-sosnowski-nvidia-corp" rel="noreferrer" target="_blank">https://dpdksummit2024.sched.com/event/1iAtU/debug-functional-and-performance-issues-in-rteflow-dariusz-sosnowski-nvidia-corp</a> </blockquote></div>