New ACL-based flow-filter implementation (with DPDK)

[qmonnet]

This builds up from #1611 and #1636, with the following differences:

• It's been rebased on main
• It received a few minor fixes
• Commits have been re-ordered
• Daniel's changes to the flow-filter to bring DPDK have been squashed into the flow-filter creation commit
• flofi has been renamed as flow-filter, legacy flow-filter is temporarily renamed then removed

[Copilot]

Pull request overview

This PR replaces the legacy flow-filter lookup structure with a new ACL-based implementation backed by DPDK rte_acl, introducing a new FlowFilterContext that is built on config application and used by the dataplane in a burst-batched lookup path.

Changes:

• Reworked flow-filter into an ACL-table-backed FlowFilterContext (DPDK rte_acl) with burst batching and a new writer/reader API.
• Added supporting match-action derive features (#[phantom]) and conversion utilities (prefix/port specs, FixedSize impls) to express flow-filter ACL keys/rules.
• Wired the new context through mgmt/dataplane and introduced EAL initialization requirements for code paths that build rte_acl classifiers.

Reviewed changes

Copilot reviewed 45 out of 46 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
net/src/tcp/port.rs	Adds TcpPort::{MIN,MAX} constants.
net/src/ip/mod.rs	Makes NextHeader::as_u8 a const fn.
net/src/icmp4/mod.rs	Adds #[repr(u8)] to Icmp4Type.
net/src/fixed_size.rs	Implements FixedSize for unicast IP wrapper types via std IP types.
nat/src/test.rs	Updates NAT tests to use FlowFilterContext writer/reader.
nat/src/static_nat/setup/mod.rs	Adjusts static-NAT test data (IPv4 ranges).
nat/src/masquerade/test.rs	Updates masquerade tests to use FlowFilterContext.
nat/Cargo.toml	Updates dev-deps after config/testing changes and flow-filter refactor.
mgmt/src/tests/mgmt.rs	Uses FlowFilterContextWriter and initializes EAL in tests that build rte_acl tables.
mgmt/src/processor/proc.rs	Switches config application to build/store FlowFilterContext.
mgmt/Cargo.toml	Adds dpdk test dependency for EAL in tests.
match-action/tests/derive_roundtrip.rs	Adds tests for phantom-field handling in MatchKey derive.
match-action/src/rule.rs	Adds From conversions for ExactSpec/MaskSpec.
match-action-derive/src/lib.rs	Adds #[phantom] support and narrows FixedSize bounds to match fields only.
lpm/src/prefix/with_ports.rs	Adds port-range conversions and helpers to build RangeSpec<u16> for ACLs.
lpm/src/prefix/ip.rs	Adds conversions from IP prefixes to PrefixSpec.
lpm/Cargo.toml	Adds dependency on match-action.
flow-filter/src/test_utils.rs	Adds shared test utilities for building overlays and headers.
flow-filter/src/tables.rs	Removes legacy nested-table flow-filter implementation.
flow-filter/src/setup.rs	Removes legacy table build logic.
flow-filter/src/lib.rs	Replaces stage implementation with batched ACL lookups and FlowFilterContext usage.
flow-filter/src/filter_rw.rs	Removes left-right table RW in favor of slot-based context swap.
flow-filter/src/display.rs	Removes legacy table display logic.
flow-filter/src/context/tests.rs	Adds semantic + differential tests (reference vs dpdk backend).
flow-filter/src/context/tables.rs	Implements ACL key/rule lowering and batched two-stage lookup.
flow-filter/src/context/mod.rs	Defines FlowFilterContext and slot-based writer/reader handles.
flow-filter/src/context/display.rs	Adds production/test rendering for context tables.
flow-filter/README.md	Adds documentation for the new flow-filter design and pipeline role.
flow-filter/Cargo.toml	Updates dependencies for ACL/DPDK backend and test-only reference backend.
dataplane/src/runtime.rs	Initializes a minimal EAL early so config application can build rte_acl contexts.
dataplane/src/packet_processor/mod.rs	Wires FlowFilterContextWriter into router setup and CLI sources.
dataplane/Cargo.toml	Adds dpdk dependency for EAL init.
config/src/utils/overlap.rs	Fixes L4 protocol intersection call with updated return type.
config/src/external/overlay/vpcpeering.rs	Adds can_init_connection / can_receive_connection; changes nat_proto() to return by value.
config/src/external/overlay/vpc.rs	Adds validation forbidding peerings with mismatched IP-version manifests; removes unsafe test-only fakes.
config/src/external/overlay/mod.rs	Removes unsafe test-only fake validation helpers.
config/src/external/mod.rs	Removes unsafe test-only fake validation helpers.
config/Cargo.toml	Removes testing feature.
Cargo.lock	Updates lockfile for new/changed dependencies.
acl/src/reference/table.rs	Exposes rules() accessor for reference backend display/testing.
acl/src/reference/mod.rs	Gates reference backend behind a feature (now impacts tests).
acl/src/lib.rs	Gates reference backend behind a feature (now impacts tests/docs).
acl/src/dpdk/lookup.rs	Makes DpdkAclLookup clonable (Arc classifier) and fixes batch result initialization.
acl/src/dpdk/dyn_table.rs	Switches dyn classifier ownership to Arc.
acl/Cargo.toml	Enables dpdk by default; introduces reference feature.

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (2)

acl/src/dpdk/dyn_table.rs (1)

773-877: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover batched lookup for every key shape.

lookup_batch is only exercised on RemoteKey<Ipv4Addr>. Add batch assertions for LocalKey<Ipv4Addr> and both IPv6 tables so their distinct field counts and strides are covered.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@acl/src/dpdk/dyn_table.rs` around lines 773 - 877, Extend the existing
lookup_batch test after the local_v4, remote_v6, and local_v6 table setup to
cover each remaining key shape. For LocalKey<Ipv4Addr>, RemoteKey<Ipv6Addr>, and
LocalKey<Ipv6Addr>, build representative key arrays including matching and
non-matching entries, call lookup_batch, and assert the outputs match the
corresponding single-lookup expectations.

flow-filter/README.md (1)

21-23: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Rewrite this README for the new wide-table, batched architecture.

These sections still describe per-source-VPC reference tables, VpcContext, protocol buckets, process_packet, lookup_route, and per-packet snapshot loads. The implementation now uses four global ACL tables, key fields for VPC/protocol, lookup_route_batch, and one snapshot per burst.

Also applies to: 33-34, 53-180

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@flow-filter/README.md` around lines 21 - 23, Rewrite the flow-filter README
to document the wide-table, batched architecture: four global ACL tables keyed
by VPC and protocol, batch lookups through lookup_route_batch, and a single
snapshot load per packet burst. Remove or replace descriptions of per-source-VPC
tables, VpcContext, protocol buckets, process_packet, lookup_route, and
per-packet snapshot loads while preserving the control-plane/data-plane and
ArcSwap context where applicable.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@flow-filter/src/context/mod.rs`:
- Around line 91-94: Update the reconfiguration flow around
FlowFilterContext::store and pipeline_data.set_genid so the context publication
and generation update occur atomically or under a single synchronized operation.
Ensure packets cannot observe the new ACL tables with the old generation during
the update gap, while preserving the existing context and generation values.

In `@flow-filter/src/lib.rs`:
- Around line 262-273: Update the stale-flow validation logic near the existing
requires_masquerade and requires_port_forwarding comparisons to also compare
flow_summary.requires_static_nat_src and flow_summary.requires_static_nat_dst
against the corresponding meta requirements, invalidating on either direction
change. Add a regression test covering transition from stateful plus static-NAT
routing to stateful-only routing and verify the old flow is invalidated.

In `@match-action-derive/src/lib.rs`:
- Around line 126-143: The generic-bound logic currently scans match-field
tokens and incorrectly constrains inner type parameters such as T in Wrapper<T>.
Replace the collect_idents-based updates in the generics setup with a FixedSize
predicate for each complete match field type, using the field type symbol from
the match-field generation path, and remove the token-scan approach. Preserve
author-defined bounds and ensure wrapper types are accepted based on the
wrapper’s FixedSize implementation.

---

Nitpick comments:
In `@acl/src/dpdk/dyn_table.rs`:
- Around line 773-877: Extend the existing lookup_batch test after the local_v4,
remote_v6, and local_v6 table setup to cover each remaining key shape. For
LocalKey<Ipv4Addr>, RemoteKey<Ipv6Addr>, and LocalKey<Ipv6Addr>, build
representative key arrays including matching and non-matching entries, call
lookup_batch, and assert the outputs match the corresponding single-lookup
expectations.

In `@flow-filter/README.md`:
- Around line 21-23: Rewrite the flow-filter README to document the wide-table,
batched architecture: four global ACL tables keyed by VPC and protocol, batch
lookups through lookup_route_batch, and a single snapshot load per packet burst.
Remove or replace descriptions of per-source-VPC tables, VpcContext, protocol
buckets, process_packet, lookup_route, and per-packet snapshot loads while
preserving the control-plane/data-plane and ArcSwap context where applicable.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3a4dec45-530e-475a-9346-3eaa4f86c8b4

📥 Commits

Reviewing files that changed from the base of the PR and between fcb9dd8 and b184b20.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (49)

• Cargo.toml
• acl/Cargo.toml
• acl/benches/table_build.rs
• acl/src/dpdk/dyn_table.rs
• acl/src/dpdk/lookup.rs
• acl/src/lib.rs
• acl/src/reference/mod.rs
• acl/src/reference/table.rs
• acl/tests/property_dyn_shape.rs
• acl/tests/property_predicate.rs
• config/Cargo.toml
• config/src/external/mod.rs
• config/src/external/overlay/mod.rs
• config/src/external/overlay/vpc.rs
• config/src/external/overlay/vpcpeering.rs
• config/src/utils/overlap.rs
• dataplane/Cargo.toml
• dataplane/src/packet_processor/mod.rs
• dataplane/src/runtime.rs
• flow-filter/Cargo.toml
• flow-filter/README.md
• flow-filter/src/context/display.rs
• flow-filter/src/context/mod.rs
• flow-filter/src/context/tables.rs
• flow-filter/src/context/tests.rs
• flow-filter/src/display.rs
• flow-filter/src/filter_rw.rs
• flow-filter/src/lib.rs
• flow-filter/src/setup.rs
• flow-filter/src/tables.rs
• flow-filter/src/test_utils.rs
• flow-filter/src/tests.rs
• lpm/Cargo.toml
• lpm/src/prefix/ip.rs
• lpm/src/prefix/with_ports.rs
• match-action-derive/src/lib.rs
• match-action/src/rule.rs
• match-action/tests/derive_roundtrip.rs
• mgmt/Cargo.toml
• mgmt/src/processor/proc.rs
• mgmt/src/tests/mgmt.rs
• nat/Cargo.toml
• nat/src/masquerade/test.rs
• nat/src/static_nat/setup/mod.rs
• nat/src/test.rs
• net/src/fixed_size.rs
• net/src/icmp4/mod.rs
• net/src/ip/mod.rs
• net/src/tcp/port.rs

💤 Files with no reviewable changes (7)

• flow-filter/src/setup.rs
• flow-filter/src/filter_rw.rs
• config/Cargo.toml
• flow-filter/src/display.rs
• config/src/external/mod.rs
• config/src/external/overlay/mod.rs
• flow-filter/src/tables.rs

[Copilot]

Pull request overview

Copilot reviewed 41 out of 42 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

flow-filter/README.md:83

confidence: 8
tags: [docs]

This section describes protocol bucketing into separate `tcp`/`udp`/`other` tables, but the new implementation encodes protocol as a (masked) key field in the ACL tables instead. This is misleading for readers trying to map the docs to `context/tables.rs`.

Inside each end, rules are bucketed by L4 protocol so lookups are protocol-aware:

• tcp / udp tables: keyed on prefix + port range (TwoTuple).
• other table: keyed on prefix only (Singleton) -- used for ICMP etc.
• An expose with no protocol restriction (L4Protocol::Any) is fanned out into all three.

**flow-filter/README.md:136**
* ```yaml
confidence: 9
tags: [docs]

The code no longer has a FlowFilter::process_packet method (the data-path is now burst-oriented via process_burst). The heading should be updated so the symbol reference is accurate.

## 4. The per-packet path (`FlowFilter::process_packet`)

[Copilot]

Pull request overview

Copilot reviewed 41 out of 42 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 43 out of 45 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

mgmt/src/tests/mgmt.rs:414

confidence: 7
tags: [docs]

This comment reads awkwardly (“rte_acl-backed for ACL filter …”) and is missing terminal punctuation. Rewording it makes the intent clearer when scanning the test setup.
</details>

[Copilot]

Pull request overview

Copilot reviewed 43 out of 45 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

mgmt/src/processor/proc.rs:511

confidence: 9
tags: [docs]

The log message still says "updated flow-filter table", but this code now builds/stores a `FlowFilterContext` via `FlowFilterContextWriter::store(...)`. Updating the message will keep logs aligned with the new terminology (and with the type being updated).
</details>

[Copilot]

Pull request overview

Copilot reviewed 43 out of 45 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

mgmt/src/processor/proc.rs:511

confidence: 9
tags: [docs]

The log message still says "flow-filter table", but this function now builds and stores a `FlowFilterContext` (terminology mismatch makes reconfig logs harder to interpret).
</details>