test(acl): differential property + Headers/metadata projection demos

Pure test broadening; no src changes.  Adds the single-rule v4/v6
differential against the reference oracle and three Headers /
metadata projection demos that exercise classify / classify_opt
against real net::HeadersView packets.

tests/property_predicate.rs is the differential.  For a random
5-tuple rule + random hit/miss byte seeds drawn via match-action's
FieldHit / FieldMiss generators, both the reference oracle and the
DPDK backend must accept every hits() draw and reject every misses()
draw.  Parameterised over the address width via a sealed IpAddress
trait so a single body covers v4 (Ipv4Addr) and v6 (Ipv6Addr) -- the
DPDK wide-field split (one 16-byte address -> four 4-byte
sub-fields) is exercised end-to-end by the v6 invocation.  Single
rule only; multi-rule differential is deferred (positional
precedence vs numeric Priority).

tests/eal_classify_via_projection.rs is the end-to-end projection
demo: a real packet -> HeadersView -> Projection<FiveTuple> -> DPDK
Lookup<FiveTuple, _> -> action.  Shows Lookup::classify runs the
projection and the lookup as a single call -- the call site reads
table.classify(\&headers) and doesn't see the intermediate key
construction.

tests/metadata_projection.rs is the partial-projection demo.  Header
fields live in Headers; VRF / VNI live in PacketMeta.  A projection
source bundles &HeadersView with &PacketMeta and projects to
Option<K>: the header part is total (shape proves presence), the
metadata part narrows from its Option with ?.  Missing metadata
projects to None and Lookup::classify_opt turns that into a table
miss with no explicit branch in user code.

tests/net_field_types.rs uses net wire newtypes (TcpPort, UdpPort,
Vni, UnicastIpv4Addr) directly as MatchKey fields with no acl-side
AclWord impl, leaning on net's FixedSize impls (PR 2a) and the DPDK
backend's blanket AclWord-over-FixedSize impl.

acl/Cargo.toml grows the net[test_buffer, builder] dev-dep these
projection demos need.

just fmt; cargo check --workspace --all-targets and
cargo clippy -p dataplane-acl --features dpdk -- -D warnings pass.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>

Author: daniel-noland

acl/Cargo.toml

@@ -25,11 +25,13 @@ net = { workspace = true, features = [] }
 thiserror = { workspace = true }
 
 [dev-dependencies]
-# Property-test draws for the shape-fuzz oracle.
+# Differential oracle harness: random rulesets + packets compared
+# between the reference and DPDK backends.
 bolero = { workspace = true, features = ["std"] }
 # Override the regular `dpdk` dep to enable its `test` feature
 # (exposes `dpdk::test_support::start_eal` and `dpdk::with_eal`).
 dpdk = { workspace = true, features = ["test"] }
 # Override match-action to also enable `bolero` for property-test
 # generators (`FieldHit` / `FieldMiss`).
 match-action = { workspace = true, features = ["derive", "bolero"] }
+net = { workspace = true, features = ["test_buffer", "builder"] }

acl/tests/eal_classify_via_projection.rs

@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Open Network Fabric Authors
+
+#![cfg(feature = "dpdk")]
+#![allow(clippy::expect_used, clippy::unwrap_used)]
+
+use core::net::Ipv4Addr;
+use core::num::NonZero;
+
+use dataplane_acl::dpdk::install::install_table;
+use dataplane_acl::dpdk::rule::{Dpdk, RuleSpec};
+use dataplane_acl::dpdk_table_alias;
+use dpdk::acl::{CategoryMask, Priority};
+use lookup::{Lookup, Projection};
+use match_action::{ExactSpec, FixedSize, MatchKey, PrefixSpec, RangeSpec};
+use net::eth::Eth;
+use net::headers::builder::HeaderStack;
+use net::headers::{HeadersView, Look};
+use net::ipv4::{Ipv4, UnicastIpv4Addr};
+use net::tcp::{Tcp, TcpPort};
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+struct IpProto(u8);
+
+impl FixedSize for IpProto {
+    const SIZE: usize = 1;
+    fn write_be(&self, out: &mut [u8]) {
+        out[0] = self.0;
+    }
+}
+
+#[derive(MatchKey)]
+#[allow(dead_code)]
+struct FiveTuple {
+    #[exact]
+    proto: IpProto,
+    #[prefix]
+    src_ip: Ipv4Addr,
+    #[prefix]
+    dst_ip: Ipv4Addr,
+    #[range]
+    src_port: u16,
+    #[range]
+    dst_port: u16,
+}
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+#[allow(dead_code)]
+enum Verdict {
+    Allow,
+    Drop,
+}
+
+dpdk_table_alias!(type FiveTupleTable<A> = FiveTuple);
+struct V4TcpSource<'a>(&'a HeadersView<(&'a Eth, &'a Ipv4, &'a Tcp)>);
+
+impl Projection<FiveTuple> for &V4TcpSource<'_> {
+    fn project(self) -> FiveTuple {
+        let (_eth, ipv4, tcp) = self.0.look();
+        FiveTuple {
+            proto: IpProto(6),
+            src_ip: ipv4.source().inner(),
+            dst_ip: ipv4.destination(),
+            src_port: u16::from(tcp.source()),
+            dst_port: u16::from(tcp.destination()),
+        }
+    }
+}
+
+fn build_packet(src: Ipv4Addr, dst: Ipv4Addr, sport: u16, dport: u16) -> net::headers::Headers {
+    HeaderStack::new()
+        .eth(|_| {})
+        .ipv4(|ip| {
+            ip.set_source(UnicastIpv4Addr::new(src).unwrap());
+            ip.set_destination(dst);
+        })
+        .tcp(|tcp| {
+            tcp.set_source(TcpPort::try_from(sport).unwrap());
+            tcp.set_destination(TcpPort::try_from(dport).unwrap());
+        })
+        .build_headers()
+        .unwrap()
+}
+
+#[dpdk::with_eal]
+#[test]
+fn classify_real_packet_via_projection() {
+    let rule = FiveTupleRule {
+        proto: ExactSpec::new(IpProto(6)),
+        src_ip: PrefixSpec::new(Ipv4Addr::new(10, 0, 0, 0), 8),
+        dst_ip: PrefixSpec::new(Ipv4Addr::UNSPECIFIED, 0),
+        src_port: RangeSpec::new(0, u16::MAX),
+        dst_port: RangeSpec::exact(22),
+    };
+    let rule_spec = RuleSpec::<FiveTuple, Verdict>::new(
+        Priority::new(100).expect("priority"),
+        CategoryMask::new(1).expect("category mask"),
+        rule.into_backend_fields::<Dpdk>(),
+        Verdict::Drop,
+    )
+    .expect("RuleSpec");
+
+    let table: FiveTupleTable<Verdict> = install_table(
+        "eal_classify_via_projection",
+        NonZero::new(16).expect("max rules"),
+        vec![rule_spec],
+    )
+    .expect("install_table");
+    let hit = build_packet(
+        Ipv4Addr::new(10, 0, 1, 5),
+        Ipv4Addr::new(192, 168, 1, 1),
+        54321,
+        22,
+    );
+    let view = hit.as_view::<(&Eth, &Ipv4, &Tcp)>().expect("v4 tcp shape");
+    let src = V4TcpSource(view);
+    assert_eq!(table.classify(&src), Some(&Verdict::Drop));
+    let miss = build_packet(
+        Ipv4Addr::new(192, 168, 1, 5),
+        Ipv4Addr::new(192, 168, 1, 1),
+        54321,
+        22,
+    );
+    let miss_view = miss.as_view::<(&Eth, &Ipv4, &Tcp)>().unwrap();
+    assert_eq!(table.classify(&V4TcpSource(miss_view)), None);
+}
+
+#[test]
+fn non_tcp_packet_cannot_be_projected_to_five_tuple() {
+    let udp = HeaderStack::new()
+        .eth(|_| {})
+        .ipv4(|_| {})
+        .udp(|_| {})
+        .build_headers()
+        .unwrap();
+    assert!(udp.as_view::<(&Eth, &Ipv4, &Tcp)>().is_none());
+}

acl/tests/metadata_projection.rs

@@ -0,0 +1,196 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Open Network Fabric Authors
+
+#![cfg(feature = "dpdk")]
+#![allow(clippy::expect_used, clippy::unwrap_used)]
+
+use core::net::Ipv4Addr;
+use core::num::NonZero;
+
+use dataplane_acl::dpdk::install::install_table;
+use dataplane_acl::dpdk::rule::{Dpdk, RuleSpec};
+use dataplane_acl::dpdk_table_alias;
+use dataplane_acl::reference::{Erased, RefRule, ReferenceTable};
+use dpdk::acl::{CategoryMask, Priority};
+use lookup::{Lookup, Projection};
+use match_action::{ExactSpec, MatchKey, PrefixSpec, RangeSpec};
+use net::eth::Eth;
+use net::headers::builder::HeaderStack;
+use net::headers::{HeadersView, Look};
+use net::ipv4::{Ipv4, UnicastIpv4Addr};
+use net::packet::{PacketMeta, VpcDiscriminant, VrfId};
+use net::tcp::{Tcp, TcpPort};
+use net::vxlan::Vni;
+#[derive(MatchKey, Debug, Clone, Copy)]
+struct OverlayFlowKey {
+    #[exact]
+    proto: u8,
+    #[prefix]
+    src: Ipv4Addr,
+    #[range]
+    dport: u16,
+    #[exact]
+    vrf: VrfId,
+    #[exact]
+    vni: Vni,
+}
+
+dpdk_table_alias!(type OverlayFlowTable<A> = OverlayFlowKey);
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+enum Verdict {
+    Drop,
+}
+struct PacketSource<'a> {
+    view: &'a HeadersView<(&'a Eth, &'a Ipv4, &'a Tcp)>,
+    meta: &'a PacketMeta,
+}
+
+impl Projection<Option<OverlayFlowKey>> for &PacketSource<'_> {
+    fn project(self) -> Option<OverlayFlowKey> {
+        let (_eth, ipv4, tcp) = self.view.look();
+        Some(OverlayFlowKey {
+            proto: 6,
+            src: ipv4.source().inner(),
+            dport: tcp.destination().as_u16(),
+            vrf: self.meta.vrf?,
+            vni: Vni::try_from(self.meta.src_vpcd?).ok()?,
+        })
+    }
+}
+
+fn rule() -> OverlayFlowKeyRule {
+    OverlayFlowKeyRule {
+        proto: ExactSpec::new(6),
+        src: PrefixSpec::new(Ipv4Addr::new(10, 0, 0, 0), 8),
+        dport: RangeSpec::exact(443),
+        vrf: ExactSpec::new(42),
+        vni: ExactSpec::new(Vni::new_checked(1000).unwrap()),
+    }
+}
+
+fn packet(src: Ipv4Addr, dport: u16) -> net::headers::Headers {
+    HeaderStack::new()
+        .eth(|_| {})
+        .ipv4(|ip| {
+            ip.set_source(UnicastIpv4Addr::new(src).unwrap());
+            ip.set_destination(Ipv4Addr::new(192, 0, 2, 1));
+        })
+        .tcp(|tcp| {
+            tcp.set_source(TcpPort::try_from(40000u16).unwrap());
+            tcp.set_destination(TcpPort::try_from(dport).unwrap());
+        })
+        .build_headers()
+        .unwrap()
+}
+#[allow(clippy::field_reassign_with_default)]
+fn meta_with(vrf: Option<VrfId>, vni: Option<Vni>) -> PacketMeta {
+    let mut meta = PacketMeta::default();
+    meta.vrf = vrf;
+    meta.src_vpcd = vni.map(VpcDiscriminant::from);
+    meta
+}
+
+#[test]
+#[dpdk::with_eal]
+fn classify_on_headers_plus_metadata() {
+    let dpdk: OverlayFlowTable<Verdict> = install_table(
+        "metadata_projection",
+        NonZero::new(8).unwrap(),
+        vec![
+            RuleSpec::<OverlayFlowKey, Verdict>::new(
+                Priority::new(1).unwrap(),
+                CategoryMask::new(1).unwrap(),
+                rule().into_backend_fields::<Dpdk>(),
+                Verdict::Drop,
+            )
+            .unwrap(),
+        ],
+    )
+    .expect("install_table");
+    let reference = ReferenceTable::<OverlayFlowKey, Verdict>::new(vec![RefRule::new(
+        rule().into_backend_fields::<Erased>(),
+        Verdict::Drop,
+    )]);
+
+    let headers = packet(Ipv4Addr::new(10, 9, 9, 9), 443);
+    let view = headers
+        .as_view::<(&Eth, &Ipv4, &Tcp)>()
+        .expect("v4 tcp shape");
+    let vni = Vni::new_checked(1000).unwrap();
+    let full = meta_with(Some(42), Some(vni));
+    let src = PacketSource { view, meta: &full };
+    assert_eq!(dpdk.classify_opt(&src), Some(&Verdict::Drop));
+    assert_eq!(
+        reference.classify_opt(&PacketSource { view, meta: &full }),
+        Some(&Verdict::Drop)
+    );
+    let no_vrf = meta_with(None, Some(vni));
+    assert_eq!(
+        dpdk.classify_opt(&PacketSource {
+            view,
+            meta: &no_vrf
+        }),
+        None
+    );
+    assert_eq!(
+        reference.classify_opt(&PacketSource {
+            view,
+            meta: &no_vrf
+        }),
+        None
+    );
+    let wrong_vni = meta_with(Some(42), Some(Vni::new_checked(2000).unwrap()));
+    assert_eq!(
+        dpdk.classify_opt(&PacketSource {
+            view,
+            meta: &wrong_vni
+        }),
+        None
+    );
+    assert_eq!(
+        reference.classify_opt(&PacketSource {
+            view,
+            meta: &wrong_vni
+        }),
+        None
+    );
+}
+#[test]
+#[dpdk::with_eal]
+fn classify_opt_accepts_an_inline_key() {
+    let dpdk: OverlayFlowTable<Verdict> = install_table(
+        "metadata_projection_by",
+        NonZero::new(8).unwrap(),
+        vec![
+            RuleSpec::<OverlayFlowKey, Verdict>::new(
+                Priority::new(1).unwrap(),
+                CategoryMask::new(1).unwrap(),
+                rule().into_backend_fields::<Dpdk>(),
+                Verdict::Drop,
+            )
+            .unwrap(),
+        ],
+    )
+    .expect("install_table");
+
+    let headers = packet(Ipv4Addr::new(10, 9, 9, 9), 443);
+    let view = headers
+        .as_view::<(&Eth, &Ipv4, &Tcp)>()
+        .expect("v4 tcp shape");
+    let key_for = |meta: &PacketMeta| -> Option<OverlayFlowKey> {
+        let (_eth, ipv4, tcp) = view.look();
+        Some(OverlayFlowKey {
+            proto: 6,
+            src: ipv4.source().inner(),
+            dport: tcp.destination().as_u16(),
+            vrf: meta.vrf?,
+            vni: Vni::try_from(meta.src_vpcd?).ok()?,
+        })
+    };
+
+    let full = meta_with(Some(42), Some(Vni::new_checked(1000).unwrap()));
+    assert_eq!(dpdk.classify_opt(key_for(&full)), Some(&Verdict::Drop));
+    let no_vrf = meta_with(None, Some(Vni::new_checked(1000).unwrap()));
+    assert_eq!(dpdk.classify_opt(key_for(&no_vrf)), None);
+}