User ACLs logic implementation

Cargo.toml

@@ -2,6 +2,7 @@
 
 members = [
     "acl",
+    "acl-filter",
     "args",
     "cli",
     "common",
@@ -66,6 +67,7 @@ repository = "https://github.com/githedgehog/dataplane/"
 
 # Internal
 acl = { path = "./acl", package = "dataplane-acl", features = [] }
+acl-filter = { path = "./acl-filter", package = "dataplane-acl-filter", features = [] }
 args = { path = "./args", package = "dataplane-args", features = [] }
 cli = { path = "./cli", package = "dataplane-cli", features = [] }
 common = { path = "./common", package = "dataplane-common", features = [] }
@@ -273,6 +275,11 @@ package = "dataplane-acl"
 miri = false # hopeless + pointless
 wasm = false # hopeless + pointless
 
+[workspace.metadata.package.acl-filter]
+package = "dataplane-acl-filter"
+miri = false # hopeless + pointless
+wasm = false # hopeless + pointless
+
 [workspace.metadata.package.args]
 package = "dataplane-args"
 miri = true

acl-filter/Cargo.toml

@@ -0,0 +1,37 @@
+[package]
+name = "dataplane-acl-filter"
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+version.workspace = true
+
+[dependencies]
+acl = { workspace = true }
+common = { workspace = true }
+concurrency = { workspace = true }
+config = { workspace = true }
+dpdk = { workspace = true }
+indenter = { workspace = true }
+linkme = { workspace = true }
+lookup = { workspace = true }
+lpm = { workspace = true }
+match-action = { workspace = true, features = ["derive"] }
+net = { workspace = true }
+pipeline = { workspace = true }
+tracectl = { workspace = true }
+tracing = { workspace = true }
+
+[dev-dependencies]
+# The reference (linear-scan) ACL backend is the differential-test oracle and drives the fast,
+# EAL-free semantic suite. It is `cfg(test)`-gated in the source, so it is never part of a
+# production build; this dev-dep just makes `acl::reference` available to test builds.
+acl = { workspace = true, features = ["reference"] }
+config = { workspace = true, features = ["testing"] }
+dpdk = { workspace = true, features = ["test"] }
+flow-entry = { workspace = true }
+flow-filter = { workspace = true }
+lpm = { workspace = true, features = ["testing"] }
+nat = { workspace = true }
+net = { workspace = true, features = ["builder"] }
+tokio = { workspace = true, features = ["macros", "rt", "time"] }
+tracing-test = { workspace = true, features = [] }

acl-filter/src/access.rs

@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Open Network Fabric Authors
+
+//! Read and write handles for the ACL filter context.
+
+use crate::context::{AclTables, PRODUCTION_BACKEND};
+use concurrency::slot::Slot;
+use concurrency::sync::Arc;
+use config::ConfigError;
+use config::external::overlay::ValidatedOverlay;
+
+#[derive(Debug, Default)]
+pub struct AclFilterContext {
+    pub(super) acls: AclTables,
+}
+
+impl TryFrom<&ValidatedOverlay> for AclFilterContext {
+    type Error = ConfigError;
+
+    fn try_from(overlay: &ValidatedOverlay) -> Result<Self, Self::Error> {
+        let acls = AclTables::build(overlay, PRODUCTION_BACKEND)?;
+        Ok(Self { acls })
+    }
+}
+
+#[cfg(test)]
+impl AclFilterContext {
+    /// Build a context using the reference backend, for tests that want the fast, EAL-free oracle.
+    /// Production goes through [`TryFrom`], which uses the rte_acl backend.
+    pub(crate) fn for_test(overlay: &ValidatedOverlay) -> Self {
+        use crate::context::Backend;
+        let acls = AclTables::build(overlay, Backend::Reference)
+            .expect("reference backend build is infallible");
+        Self { acls }
+    }
+
+    /// Build a context using the rte_acl backend, for the differential test that exercises the
+    /// production classifier. Requires the EAL to be initialized (`#[dpdk::with_eal]`).
+    pub(crate) fn for_test_dpdk(overlay: &ValidatedOverlay) -> Result<Self, ConfigError> {
+        use crate::context::Backend;
+        let acls = AclTables::build(overlay, Backend::Dpdk)?;
+        Ok(Self { acls })
+    }
+}
+
+/// Control-plane handle used to hot-swap the context.
+#[derive(Debug, Clone)]
+pub struct AclFilterContextWriter(Arc<Slot<AclFilterContext>>);
+
+impl Default for AclFilterContextWriter {
+    fn default() -> Self {
+        Self(Arc::new(Slot::from_pointee(AclFilterContext::default())))
+    }
+}
+
+impl AclFilterContextWriter {
+    /// Create a new handle with a default context.
+    #[must_use]
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Atomically publish a new context on reconfiguration.
+    pub fn store(&self, context: AclFilterContext) {
+        self.0.store(Arc::new(context));
+    }
+
+    /// Obtain a reader for the context.
+    #[must_use]
+    pub fn get_reader(&self) -> AclFilterContextReader {
+        AclFilterContextReader(Arc::clone(&self.0))
+    }
+
+    /// Obtain a reader factory for the context.
+    #[must_use]
+    pub fn get_reader_factory(&self) -> AclFilterContextReaderFactory {
+        AclFilterContextReaderFactory(self.get_reader())
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct AclFilterContextReader(Arc<Slot<AclFilterContext>>);
+
+impl AclFilterContextReader {
+    /// Load the current context for read-only access.
+    #[must_use]
+    pub fn load(&self) -> Arc<AclFilterContext> {
+        // FIXME: We'd like to use self.0.load() instead of .load_full() (saves the cost of the
+        // atomic counter update, although x86_64 shouldn't be affected), but if we do, then the
+        // loom and shuttle back-ends expect a different return type for the method
+        // (arc_swap::Guard<Arc<AclFilterContext>>). We need to create a wrapper around that type in
+        // the concurrency crate.
+        self.0.load_full()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct AclFilterContextReaderFactory(AclFilterContextReader);
+
+impl AclFilterContextReaderFactory {
+    /// Obtain a reader from the factory.
+    #[must_use]
+    pub fn handle(&self) -> AclFilterContextReader {
+        self.0.clone()
+    }
+}