224 lines
9.5 KiB
INI
224 lines
9.5 KiB
INI
|
; BSD LICENSE
|
||
|
|
;
|
||
|
|
; Copyright(c) 2016 Intel Corporation. All rights reserved.
|
||
|
|
; All rights reserved.
|
||
|
|
;
|
||
|
|
; Redistribution and use in source and binary forms, with or without
|
||
|
|
; modification, are permitted provided that the following conditions
|
||
|
|
; are met:
|
||
|
|
;
|
||
|
|
; * Redistributions of source code must retain the above copyright
|
||
|
|
; notice, this list of conditions and the following disclaimer.
|
||
|
|
; * Redistributions in binary form must reproduce the above copyright
|
||
|
|
; notice, this list of conditions and the following disclaimer in
|
||
|
|
; the documentation and/or other materials provided with the
|
||
|
|
; distribution.
|
||
|
|
; * Neither the name of Intel Corporation nor the names of its
|
||
|
|
; contributors may be used to endorse or promote products derived
|
||
|
|
; from this software without specific prior written permission.
|
||
|
|
;
|
||
|
|
; THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||
|
|
; "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||
|
|
; LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||
|
|
; A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||
|
|
; OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||
|
|
; SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||
|
|
; LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||
|
|
; DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||
|
|
; THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||
|
|
; (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||
|
|
; OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||
|
|
|
||
|
|
; The diagram below shows how additional protocol components can be plugged into
|
||
|
|
; the IP layer implemented by the ip_pipeline application. Pick your favorite
|
||
|
|
; open source components for dynamic ARP, ICMP, UDP or TCP termination, etc and
|
||
|
|
; connect them through SWQs to the IP infrastructure.
|
||
|
|
;
|
||
|
|
; The input packets with local destination are sent to the UDP/TCP applications
|
||
|
|
; while the input packets with remote destination are routed back to the
|
||
|
|
; network. Additional features can easily be added to this setup:
|
||
|
|
; * IP Reassembly: add SWQs with IP reassembly enabled (typically required for
|
||
|
|
; the input traffic with local destination);
|
||
|
|
; * IP Fragmentation: add SWQs with IP fragmentation enabled (typically
|
||
|
|
; required to enforce the MTU for the routed output traffic);
|
||
|
|
; * Traffic Metering: add Flow Action pipeline instances (e.g. for metering the
|
||
|
|
; TCP connections or ICMP input traffic);
|
||
|
|
; * Traffic Management: add TMs for the required output LINKs;
|
||
|
|
; * Protocol encapsulations (QinQ, MPLS) for the output packets: part of the
|
||
|
|
; routing pipeline configuration.
|
||
|
|
;
|
||
|
|
; _________ _________
|
||
|
|
; | | | |
|
||
|
|
; | UDP | | TCP |
|
||
|
|
; | App | | App |
|
||
|
|
; |_________| |_________|
|
||
|
|
; ^ | ^ |
|
||
|
|
; __|___V__ __|___V__
|
||
|
|
; | | SWQ0 (UDP TX) | | SWQ1 (TCP TX)
|
||
|
|
; | UDP |-------+ | TCP |------------+
|
||
|
|
; | | | | | |
|
||
|
|
; |_________| | |_________| |
|
||
|
|
; ^ | ^ |
|
||
|
|
; | SWQ2 | | SWQ3 |
|
||
|
|
; | (UDP RX) | | (TCP RX) |
|
||
|
|
; ____|____ | ____|____ |
|
||
|
|
; | | | | | |
|
||
|
|
; RXQ<0..3>.1 ------>|Firewall +--->| | +------>| Flow +--->| |
|
||
|
|
; (UDP local dest) | (P2) | SINK0 | | | (P3) | SINK1 |
|
||
|
|
; |_________| (Deny)| | |_________| (RST) |
|
||
|
|
; RXQ<0..3>.2 -------------------------|-----+ |
|
||
|
|
; (TCP local dest) | |
|
||
|
|
; | +------------------------------+
|
||
|
|
; | |
|
||
|
|
; _V_____V_
|
||
|
|
; | |
|
||
|
|
; | Routing | TXQ<0..3>.0
|
||
|
|
; RXQ<0..3>.0 ---------------------->| & ARP +----------------------------->
|
||
|
|
; (IP remote dest) | (P1) |
|
||
|
|
; |_________|
|
||
|
|
; | ^ |
|
||
|
|
; SWQ4 +-------------+ | | SWQ5 (ARP miss)
|
||
|
|
; (Route miss) | | +------------+
|
||
|
|
; | +-------------+ |
|
||
|
|
; ___V__|__ SWQ6 ____V____
|
||
|
|
; | | (ICMP TX) | | TXQ<0..3>.1
|
||
|
|
; RXQ<0..3>.3 ------>| ICMP | +------>| Dyn ARP +------------->
|
||
|
|
; (IP local dest) | | | | |
|
||
|
|
; |_________| | |_________|
|
||
|
|
; RXQ<0..3>.4 -------------------------------+
|
||
|
|
; (ARP)
|
||
|
|
;
|
||
|
|
; This configuration file implements the diagram presented below, where the
|
||
|
|
; dynamic ARP, ICMP, UDP and TCP components have been stubbed out and replaced
|
||
|
|
; with loop-back and packet drop devices.
|
||
|
|
;
|
||
|
|
; _________ _________
|
||
|
|
; | | SWQ0 (UDP TX) | | SWQ1 (TCP TX)
|
||
|
|
; |Loobpack |-------+ |Loopback |------------+
|
||
|
|
; | (P4) | | | (P5) | |
|
||
|
|
; |_________| | |_________| |
|
||
|
|
; ^ | ^ |
|
||
|
|
; | SWQ2 | | SWQ3 |
|
||
|
|
; | (UDP RX) | | (TCP RX) |
|
||
|
|
; ____|____ | ____|____ |
|
||
|
|
; | | | | | |
|
||
|
|
; RXQ<0..3>.1 ------>|Firewall +--->| | +------>| Flow +--->| |
|
||
|
|
; (UDP local dest) | (P2) | SINK0 | | | (P3) | SINK1 |
|
||
|
|
; |_________| (Deny)| | |_________| (RST) |
|
||
|
|
; RXQ<0..3>.2 -------------------------|-----+ |
|
||
|
|
; (TCP local dest) | |
|
||
|
|
; | +------------------------------+
|
||
|
|
; | |
|
||
|
|
; _V_____V_
|
||
|
|
; | |
|
||
|
|
; | Routing | TXQ<0..3>.0
|
||
|
|
; RXQ<0..3>.0 ---------------------->| & ARP +----------------------------->
|
||
|
|
; (IP remote dest) | (P1) |
|
||
|
|
; |_________|
|
||
|
|
; | |
|
||
|
|
; SINK2 |<---+ +--->| SINK3
|
||
|
|
; (Route miss) (ARP miss)
|
||
|
|
;
|
||
|
|
; _________ _________
|
||
|
|
; | | | |
|
||
|
|
; RXQ<0..3>.3 ------>| Drop +--->| SINK<4..7> +------>| Drop +--->| SINK<8..11>
|
||
|
|
; (IP local dest) | (P6) | (IP local dest) | | (P7) | (ARP)
|
||
|
|
; |_________| | |_________|
|
||
|
|
; RXQ<0..3>.4 ------------------------------------+
|
||
|
|
; (ARP)
|
||
|
|
;
|
||
|
|
;
|
||
|
|
; Input packet: Ethernet/IPv4 or Ethernet/ARP
|
||
|
|
; Output packet: Ethernet/IPv4 or Ethernet/ARP
|
||
|
|
;
|
||
|
|
; Packet buffer layout (for input IPv4 packets):
|
||
|
|
; # Field Name Offset (Bytes) Size (Bytes)
|
||
|
|
; 0 Mbuf 0 128
|
||
|
|
; 1 Headroom 128 128
|
||
|
|
; 2 Ethernet header 256 14
|
||
|
|
; 3 IPv4 header 270 20
|
||
|
|
; 4 ICMP/UDP/TCP header 290 8/8/20
|
||
|
|
|
||
|
|
[EAL]
|
||
|
|
log_level = 0
|
||
|
|
|
||
|
|
[LINK0]
|
||
|
|
udp_local_q = 1
|
||
|
|
tcp_local_q = 2
|
||
|
|
ip_local_q = 3
|
||
|
|
arp_q = 4
|
||
|
|
|
||
|
|
[LINK1]
|
||
|
|
udp_local_q = 1
|
||
|
|
tcp_local_q = 2
|
||
|
|
ip_local_q = 3
|
||
|
|
arp_q = 4
|
||
|
|
|
||
|
|
[LINK2]
|
||
|
|
udp_local_q = 1
|
||
|
|
tcp_local_q = 2
|
||
|
|
ip_local_q = 3
|
||
|
|
arp_q = 4
|
||
|
|
|
||
|
|
[LINK3]
|
||
|
|
udp_local_q = 1
|
||
|
|
tcp_local_q = 2
|
||
|
|
ip_local_q = 3
|
||
|
|
arp_q = 4
|
||
|
|
|
||
|
|
[PIPELINE0]
|
||
|
|
type = MASTER
|
||
|
|
core = 0
|
||
|
|
|
||
|
|
[PIPELINE1]
|
||
|
|
type = ROUTING
|
||
|
|
core = 1
|
||
|
|
pktq_in = RXQ0.0 RXQ1.0 RXQ2.0 RXQ3.0 SWQ0 SWQ1
|
||
|
|
pktq_out = TXQ0.0 TXQ1.0 TXQ2.0 TXQ3.0 SINK2 SINK3
|
||
|
|
port_local_dest = 4 ; SINK2 (Drop)
|
||
|
|
n_arp_entries = 1000
|
||
|
|
ip_hdr_offset = 270
|
||
|
|
arp_key_offset = 128
|
||
|
|
|
||
|
|
[PIPELINE2]
|
||
|
|
type = FIREWALL
|
||
|
|
core = 1
|
||
|
|
pktq_in = RXQ0.1 RXQ1.1 RXQ2.1 RXQ3.1
|
||
|
|
pktq_out = SWQ2 SINK0
|
||
|
|
n_rules = 4096
|
||
|
|
|
||
|
|
[PIPELINE3]
|
||
|
|
type = FLOW_CLASSIFICATION
|
||
|
|
core = 1
|
||
|
|
pktq_in = RXQ0.2 RXQ1.2 RXQ2.2 RXQ3.2
|
||
|
|
pktq_out = SWQ3 SINK1
|
||
|
|
n_flows = 65536
|
||
|
|
key_size = 16 ; IPv4 5-tuple key size
|
||
|
|
key_offset = 278 ; IPv4 5-tuple key offset
|
||
|
|
key_mask = 00FF0000FFFFFFFFFFFFFFFFFFFFFFFF ; IPv4 5-tuple key mask
|
||
|
|
flowid_offset = 128 ; Flow ID effectively acts as TCP socket ID
|
||
|
|
|
||
|
|
[PIPELINE4]
|
||
|
|
type = PASS-THROUGH ; Loop-back (UDP place-holder)
|
||
|
|
core = 1
|
||
|
|
pktq_in = SWQ2
|
||
|
|
pktq_out = SWQ0
|
||
|
|
|
||
|
|
[PIPELINE5]
|
||
|
|
type = PASS-THROUGH ; Loop-back (TCP place-holder)
|
||
|
|
core = 1
|
||
|
|
pktq_in = SWQ3
|
||
|
|
pktq_out = SWQ1
|
||
|
|
|
||
|
|
[PIPELINE6]
|
||
|
|
type = PASS-THROUGH ; Drop (ICMP place-holder)
|
||
|
|
core = 1
|
||
|
|
pktq_in = RXQ0.3 RXQ1.3 RXQ2.3 RXQ3.3
|
||
|
|
pktq_out = SINK4 SINK5 SINK6 SINK7
|
||
|
|
|
||
|
|
[PIPELINE7]
|
||
|
|
type = PASS-THROUGH ; Drop (Dynamic ARP place-holder)
|
||
|
|
core = 1
|
||
|
|
pktq_in = RXQ0.4 RXQ1.4 RXQ2.4 RXQ3.4
|
||
|
|
pktq_out = SINK8 SINK9 SINK10 SINK11
|