Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 13 additions & 14 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,26 +5,25 @@ send us an email (p4-dev@lists.p4.org).

## Apache CLA

Developers must use DCO ([Developer Certificate of
Origin](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin))
to sign every commit that they wish to merge into this repository.
See [this
announcement](https://lists.p4.org/g/p4-announce/topic/github_contributor_license/107784276)
Developers must use DCO
([Developer Certificate of Origin](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin))
to sign every commit that they wish to merge into this repository. See
[this announcement](https://lists.p4.org/g/p4-announce/topic/github_contributor_license/107784276)
for more details.

## SPDX License Identifier

To enable the use of some automated tools for tracking software
licenses, both in this project and in any future projects that might
copy source files from it, all source files must have a comment
containing an SPDX License Identifier.
To enable the use of some automated tools for tracking software licenses, both
in this project and in any future projects that might copy source files from it,
all source files must have a comment containing an SPDX License Identifier.

TODO: Add a link to a central p4lang repository document about this,
when one is created. Probably that will be
TODO: Add a link to a central p4lang repository document about this, when one is
created. Probably that will be
https://github.com/p4lang/p4c/blob/main/docs/licenses.md

## Coding guidelines

Any contribution to the C++ core code must respect the coding guidelines.
We follow the [Google C++ Style Guide](https://google.github.io/styleguide/cppguide.html).
We provide a [script](format.sh) to automatically format all code correctly.
Any contribution to the C++ core code must respect the coding guidelines. We
follow the
[Google C++ Style Guide](https://google.github.io/styleguide/cppguide.html). We
provide a [script](format.sh) to automatically format all code correctly.
107 changes: 64 additions & 43 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,18 +10,20 @@ These constraints can be enforced at runtime using the p4-constraints library.
The project currently provides two main artifacts:

1. A [C++ library](p4_constraints/) for parsing and checking constraints.
2. A [command line interface (CLI)](p4_constraints/cli) that takes as input a P4
1. A [command line interface (CLI)](p4_constraints/cli) that takes as input a P4
program with constraints and a set of table entries, and reports if the table
entries satisfy the constraints placed on their respective tables or not.
(Note that the CLI is intended for testing and experimentation, not for
production use.)

**_Check out [these slides](docs/2020-08-17_LDWG.pdf) for a tour of p4-constraints (up to date as of May 2020)._**

**_Check out [these slides](docs/2020-08-17_LDWG.pdf) for a tour of
p4-constraints (up to date as of May 2020)._**

## Example - Entry Restrictions

An *entry restriction* is a constraint specifying what entries are allowed to be
placed in a P4 table. Here is an example:

```p4
@entry_restriction("
// Only match on IPv4 addresses of IPv4 packets.
Expand Down Expand Up @@ -49,23 +51,25 @@ table acl_table {
actions = { ... }
}
```
The `@entry_restriction` says that a valid ACL table entry must meet
three requirements:

The `@entry_restriction` says that a valid ACL table entry must meet three
requirements:

1. It can only match on the IPv4 destination address of IPv4 packets.
2. It can only match on the IPv6 destination address of IPv6 packets.
3. It can only perform a wildcard or an exact match on the IPv4 address.
1. It can only match on the IPv6 destination address of IPv6 packets.
1. It can only perform a wildcard or an exact match on the IPv4 address.

The first two requirements are to rule out undefined behavior. The third
requirement captures the intent of the P4 programmer that the ACL table
should not require general ternary matches on the destination address; the
constraint documents this intent and let's us catch accidental ternary matches
installed by the control plane at runtime.
requirement captures the intent of the P4 programmer that the ACL table should
not require general ternary matches on the destination address; the constraint
documents this intent and let's us catch accidental ternary matches installed by
the control plane at runtime.

## Example - Action Restrictions

An *action restriction* is similar to an entry restriction, but is placed on a
P4 action:

```p4
// Disallow multicast group ID 0, since it indicates "no multicast" in
// `v1model.p4`.
Expand All @@ -77,8 +81,9 @@ action multicast(bit<16> multicast_group_id) {

## API

At a high level, p4-constraint's API consists of only two functions:
one function for parsing constraints and one function for checking them.
At a high level, p4-constraint's API consists of only two functions: one
function for parsing constraints and one function for checking them.

```C++
/* p4_constraints/backend/constraint_info.h */

Expand All @@ -90,6 +95,7 @@ one function for parsing constraints and one function for checking them.
absl::StatusOr<ConstraintInfo> P4ToConstraintInfo(
const p4::config::v1::P4Info &p4info);
```

```C++
/* p4_constraints/backend/interpreter.h */

Expand All @@ -103,8 +109,9 @@ absl::StatusOr<ConstraintInfo> P4ToConstraintInfo(
absl::StatusOr<std::string> ReasonEntryViolatesConstraint(
const p4::v1::TableEntry& entry, const ConstraintInfo& constraint_info);
```
For those who seek more fine-grained control, the API also offers more
low-level functions that are documented in the various header files.

For those who seek more fine-grained control, the API also offers more low-level
functions that are documented in the various header files.

## Use cases

Expand All @@ -118,36 +125,42 @@ p4-constraints can be used as follows:

## Building

Building p4-constraints requires [Bazel](https://bazel.build/) 7.6 or newer
with Bzlmod enabled and a C++20 compiler.
Building p4-constraints requires [Bazel](https://bazel.build/) 7.6 or newer with
Bzlmod enabled and a C++20 compiler.

We inherit a few additional dependencies
([Bison](https://en.wikipedia.org/wiki/GNU_Bison) and
[Flex](https://en.wikipedia.org/wiki/Flex_\(lexical_analyser_generator\)))
from [p4c](https://github.com/p4lang/p4c); these are required for
[Flex](<https://en.wikipedia.org/wiki/Flex_(lexical_analyser_generator)>)) from
[p4c](https://github.com/p4lang/p4c); these are required for
[golden testing](#golden-tests) only and can be installed on Ubuntu as follows:

```sh
apt-get install bison flex libfl-dev
```

To build, run

```sh
bazel build //p4_constraints/...
```

To run all tests except [golden tests](#golden-tests), run

```sh
bazel test //p4_constraints/...
```

To run all tests including [golden tests](#golden-tests), run

```sh
bazel test //...
```
This may take a while when executed for the first time,
as it will build p4c from source.

This may take a while when executed for the first time, as it will build p4c
from source.

To see the output of a failed test, invoke it using `bazel run` like so:

```sh
bazel run //p4_constraints/frontend:lexer_test
```
Expand All @@ -162,6 +175,7 @@ the system Clang toolchain and sets the macOS deployment target needed by
### Docker

You can also build p4-constraint in a Docker container, for example:

```sh
docker build --tag p4-constraints . # Time to get coffee...
docker run --tty --interactive p4-constraints bash # Open shell in container.
Expand All @@ -171,22 +185,25 @@ bazel test //... # Run tests in container.
## Golden tests

The easiest way to experiment with p4-constraints is to write a
[golden test](https://ro-che.info/articles/2017-12-04-golden-tests).
We provide [Bazel rules](e2e_tests/p4check.bzl) `run_p4check` and `diff_test` to
make this convenient.
See the [e2e_tests/](e2e_tests/) folder -- in particular
[e2e_tests/BUILD.bazel](e2e_tests/BUILD.bazel) -- for examples of how to use them.
[golden test](https://ro-che.info/articles/2017-12-04-golden-tests). We provide
[Bazel rules](e2e_tests/p4check.bzl) `run_p4check` and `diff_test` to make this
convenient. See the [e2e_tests/](e2e_tests/) folder -- in particular
[e2e_tests/BUILD.bazel](e2e_tests/BUILD.bazel) -- for examples of how to use
them.

To run all golden tests, execute

```sh
bazel test //e2e_tests/...
```

[Recall](#building) that this will build p4c and requires
[Bison](https://en.wikipedia.org/wiki/GNU_Bison) and
[Flex](https://en.wikipedia.org/wiki/Flex_\(lexical_analyser_generator\))
to be installed.
[Flex](<https://en.wikipedia.org/wiki/Flex_(lexical_analyser_generator)>) to be
installed.

To see the output of a failed test, invoke it using `bazel run` like so:

```sh
bazel run //e2e_test:invalid_constraints_test
```
Expand All @@ -200,6 +217,7 @@ line. The most convenient way to run `p4check` is using the

To learn how to invoke [p4check](p4_constraints/cli/p4check.cc) manually,
consult [the source file](p4_constraints/cli/p4check.cc) or run

```sh
bazel run p4_constraints/cli:p4check -- --help
```
Expand All @@ -220,24 +238,27 @@ Feedback, suggestions, and contributions in the form of GitHub issues and
Please note that every file containing source code must include the following
copyright header:

Copyright 2020 The P4-Constraints Authors

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

SPDX-License-Identifier: Apache-2.0
```
Copyright 2020 The P4-Constraints Authors

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

SPDX-License-Identifier: Apache-2.0
```

This can be done automatically using
[addlicense](https://github.com/google/addlicense) as follows:

```sh
addlicense -c "The P4-Constraints Authors" -s -l apache ./p4_constraints
```
Loading
Loading