feat(dataplane,mgmt): Add new flow-filter implementation to dataplane

Swap the flow-filter stage for its new, ACL-based implementation, but do
not delete the legacy implementation (and setup) just yet.

Signed-off-by: Quentin Monnet <qmo@qmon.net>

Author: qmonnet

Cargo.lock

@@ -20,6 +20,7 @@ axum-server = { workspace = true }
 concurrency = { workspace = true }
 config = { workspace = true }
 dyn-iter = { workspace = true }
+flofi = { workspace = true }
 flow-entry = { workspace = true }
 flow-filter = { workspace = true }
 futures = { workspace = true }

dataplane/Cargo.toml

@@ -12,6 +12,7 @@ use super::packet_processor::ipforward::IpForwarder;
 
 use concurrency::sync::Arc;
 
+use flofi::{Flofi, FlofiContextWriter};
 use flow_entry::flow_table::{FlowLookup, FlowTable};
 use flow_filter::{FlowFilter, FlowFilterTableWriter};
 
@@ -42,6 +43,7 @@ where
     pub nattablesw: NatTablesWriter,
     pub natallocatorw: NatAllocatorWriter,
     pub flowfiltertablesw: FlowFilterTableWriter,
+    pub flofi_writer: FlofiContextWriter,
     pub stats: StatsCollector,
     pub vpc_stats_store: Arc<VpcStatsStore>,
     pub portfw_w: PortFwTableWriter,
@@ -66,6 +68,8 @@ pub(crate) fn start_router<Buf: PacketBufferMut>(
     let flow_table = Arc::new(FlowTable::default());
     let flowfiltertablesw = FlowFilterTableWriter::new();
     let flowfiltertablesr_factory = flowfiltertablesw.get_reader_factory();
+    let flofi_writer = FlofiContextWriter::new();
+    let flofi_reader_factory = flofi_writer.get_reader_factory();
     let nattablesw = NatTablesWriter::new();
     let natallocatorw = NatAllocatorWriter::new();
     let nattabler_factory = nattablesw.get_reader_factory();
@@ -109,7 +113,9 @@ pub(crate) fn start_router<Buf: PacketBufferMut>(
         );
         let pktdump = PacketDumper::new("pipeline-end", true, None);
         let stats_stage = Stats::new("stats", stats_w.clone());
-        let flow_filter = FlowFilter::new("flow-filter", flowfiltertablesr_factory.handle());
+        let _flow_filter = FlowFilter::new("flow-filter", flowfiltertablesr_factory.handle());
+        let flofi = Flofi::new("flofi", flofi_reader_factory.handle());
+
         let icmp_error_handler = IcmpErrorHandler::new(flow_table_clone.clone());
         let flow_lookup = FlowLookup::new("flow-lookup", flow_table_clone.clone());
         let portfw = PortForwarder::new(
@@ -127,7 +133,7 @@ pub(crate) fn start_router<Buf: PacketBufferMut>(
             .add_stage(iprouter1)
             .add_stage(icmp_error_handler)
             .add_stage(flow_lookup)
-            .add_stage(flow_filter)
+            .add_stage(flofi)
             .add_stage(static_nat)
             .add_stage(portfw)
             .add_stage(masquerade)
@@ -146,6 +152,7 @@ pub(crate) fn start_router<Buf: PacketBufferMut>(
         nattablesw,
         natallocatorw,
         flowfiltertablesw,
+        flofi_writer,
         stats,
         vpc_stats_store,
         portfw_w,

dataplane/src/packet_processor/mod.rs

@@ -243,6 +243,7 @@ pub fn main() {
                     nattablesw: setup.nattablesw,
                     natallocatorw: setup.natallocatorw,
                     flowfilterw: setup.flowfiltertablesw,
+                    flofi_writer: setup.flofi_writer,
                     portfw_w: setup.portfw_w,
                     vpc_stats_store: setup.vpc_stats_store,
                     dp_status_r: dp_status.clone(),

dataplane/src/runtime.rs

@@ -20,6 +20,7 @@ bolero = ["dep:bolero", "interface-manager/bolero", "id/bolero", "net/bolero", "
 args = { workspace = true }
 config = { workspace = true }
 concurrency = { workspace = true }
+flofi = { workspace = true }
 flow-entry = { workspace = true }
 flow-filter = { workspace = true }
 id = { workspace = true }

mgmt/Cargo.toml

@@ -22,6 +22,7 @@ use config::{DeviceConfig, ExternalConfig, GenId, GwConfig, InternalConfig, Vali
 
 use crate::processor::confbuild::internal::build_internal_config;
 use crate::processor::confbuild::router::generate_router_config;
+use flofi::{FlofiContext, FlofiContextWriter};
 use flow_filter::{FlowFilterTable, FlowFilterTableWriter};
 use nat::masquerade::{MasqueradeConfig, NatAllocatorWriter};
 use nat::portfw::PortFwTableWriter;
@@ -97,6 +98,9 @@ pub struct ConfigProcessorParams {
     // writer for flow filter table
     pub flowfilterw: FlowFilterTableWriter,
 
+    // writer for flofi table
+    pub flofi_writer: FlofiContextWriter,
+
     // writer for port forwarding table
     pub portfw_w: PortFwTableWriter,
 
@@ -527,6 +531,15 @@ fn apply_flow_filtering_config(
     Ok(())
 }
 
+fn apply_flofi_config(
+    overlay: &ValidatedOverlay,
+    flofi_writer: &mut FlofiContextWriter,
+) -> ConfigResult {
+    flofi_writer.store(FlofiContext::try_from(overlay)?);
+    debug!("Successfully updated flofi table");
+    Ok(())
+}
+
 fn apply_port_forwarding_config(
     vpc_table: &ValidatedVpcTable,
     portfw_w: &mut PortFwTableWriter,
@@ -573,6 +586,7 @@ impl ConfigProcessor {
         let nattablesw = &mut self.proc_params.nattablesw;
         let natallocatorw = &mut self.proc_params.natallocatorw;
         let flowfilterw = &mut self.proc_params.flowfilterw;
+        let flofi_writer = &mut self.proc_params.flofi_writer;
         let portfw_w = &mut self.proc_params.portfw_w;
         let flow_table = &self.proc_params.flow_table;
 
@@ -623,6 +637,9 @@ impl ConfigProcessor {
         /* apply flow filtering config */
         apply_flow_filtering_config(config.external().overlay(), flowfilterw)?;
 
+        /* apply flofi config */
+        apply_flofi_config(config.external().overlay(), flofi_writer)?;
+
         /* apply port-forwarding config */
         apply_port_forwarding_config(config.external().overlay().vpc_table(), portfw_w)?;
 

mgmt/src/processor/proc.rs

@@ -9,6 +9,7 @@ pub mod test {
     use config::external::gwgroup::GwGroupMember;
     use config::external::gwgroup::GwGroupTable;
 
+    use flofi::FlofiContextWriter;
     use flow_entry::flow_table::FlowTable;
     use lpm::prefix::Prefix;
     use net::eth::mac::Mac;
@@ -460,6 +461,9 @@ pub mod test {
         /* create FlowFilterTable for flow filtering */
         let flowfilterw = FlowFilterTableWriter::new();
 
+        /* create FlowFilterTable for flow filtering */
+        let flofi_writer = FlofiContextWriter::new();
+
         /* create port forwarding table */
         let portfw_w = PortFwTableWriter::new();
 
@@ -481,6 +485,7 @@ pub mod test {
             nattablesw,
             natallocatorw,
             flowfilterw,
+            flofi_writer,
             portfw_w,
             vpc_stats_store,
             dp_status_r,