common: Adding common library for sample vnf

JIRA: SAMPLEVNF-3

This patch adds common libraries required as part of the
sample vnf.

This includes the following libraries

 1. ACL library
 2. SIP
 3. FTP
 4. Connection tracker
 5. L2l3 stack
    - Interface Manager
    - ARP & ICMPv4
    - ND & ICMPv6
and other common libraries needed for ip pipeline framework

Change-Id: I117690b6b63fbcd76974cd7274518484e60980ab
Signed-off-by: Vishwesh M Rudramuni <vishwesh.m.rudramuni@intel.com>
[Push patch to gerrit]
Signed-off-by: Deepak S <deepak.s@linux.intel.com>

2 files changed, 1330 insertions, 0 deletions

diff --git a/common/VIL/acl/lib_acl.c b/common/VIL/acl/lib_acl.c
new file mode 100644
index 00000000..279727ef
--- /dev/null
+++ b/common/VIL/acl/lib_acl.c
@@ -0,0 +1,1203 @@
+/*
+// Copyright (c) 2017 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+*/
+#include "lib_acl.h"
+#include "vnf_common.h"
+#include <rte_port.h>
+#define ACL_LIB_DEBUG 0
+static struct rte_acl_field_def field_format_ipv4[] = {
+	/* Protocol */
+	[0] = {
+				 .type = RTE_ACL_FIELD_TYPE_BITMASK,
+				 .size = sizeof(uint8_t),
+				 .field_index = 0,
+				 .input_index = 0,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv4_hdr, next_proto_id),
+				 },
+
+	/* Source IP address (IPv4) */
+	[1] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 1,
+				 .input_index = 1,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv4_hdr, src_addr),
+				 },
+
+	/* Destination IP address (IPv4) */
+	[2] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 2,
+				 .input_index = 2,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv4_hdr, dst_addr),
+				 },
+
+	/* Source Port */
+	[3] = {
+				 .type = RTE_ACL_FIELD_TYPE_RANGE,
+				 .size = sizeof(uint16_t),
+				 .field_index = 3,
+				 .input_index = 3,
+				 .offset = sizeof(struct ether_hdr) +
+				 sizeof(struct ipv4_hdr) + offsetof(struct tcp_hdr, src_port),
+				 },
+
+	/* Destination Port */
+	[4] = {
+				 .type = RTE_ACL_FIELD_TYPE_RANGE,
+				 .size = sizeof(uint16_t),
+				 .field_index = 4,
+				 .input_index = 3,
+				 .offset = sizeof(struct ether_hdr) +
+				 sizeof(struct ipv4_hdr) + offsetof(struct tcp_hdr, dst_port),
+				 },
+};
+
+#define SIZEOF_VLAN_HDR                          4
+
+static struct rte_acl_field_def field_format_vlan_ipv4[] = {
+	/* Protocol */
+	[0] = {
+				 .type = RTE_ACL_FIELD_TYPE_BITMASK,
+				 .size = sizeof(uint8_t),
+				 .field_index = 0,
+				 .input_index = 0,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_VLAN_HDR + offsetof(struct ipv4_hdr, next_proto_id),
+				 },
+
+	/* Source IP address (IPv4) */
+	[1] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 1,
+				 .input_index = 1,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_VLAN_HDR + offsetof(struct ipv4_hdr, src_addr),
+				 },
+
+	/* Destination IP address (IPv4) */
+	[2] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 2,
+				 .input_index = 2,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_VLAN_HDR + offsetof(struct ipv4_hdr, dst_addr),
+				 },
+
+	/* Source Port */
+	[3] = {
+				 .type = RTE_ACL_FIELD_TYPE_RANGE,
+				 .size = sizeof(uint16_t),
+				 .field_index = 3,
+				 .input_index = 3,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_VLAN_HDR +
+				 sizeof(struct ipv4_hdr) + offsetof(struct tcp_hdr, src_port),
+				 },
+
+	/* Destination Port */
+	[4] = {
+				 .type = RTE_ACL_FIELD_TYPE_RANGE,
+				 .size = sizeof(uint16_t),
+				 .field_index = 4,
+				 .input_index = 4,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_VLAN_HDR +
+				 sizeof(struct ipv4_hdr) + offsetof(struct tcp_hdr, dst_port),
+				 },
+};
+
+#define SIZEOF_QINQ_HEADER                       8
+
+static struct rte_acl_field_def field_format_qinq_ipv4[] = {
+	/* Protocol */
+	[0] = {
+				 .type = RTE_ACL_FIELD_TYPE_BITMASK,
+				 .size = sizeof(uint8_t),
+				 .field_index = 0,
+				 .input_index = 0,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_QINQ_HEADER + offsetof(struct ipv4_hdr, next_proto_id),
+				 },
+
+	/* Source IP address (IPv4) */
+	[1] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 1,
+				 .input_index = 1,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_QINQ_HEADER + offsetof(struct ipv4_hdr, src_addr),
+				 },
+
+	/* Destination IP address (IPv4) */
+	[2] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 2,
+				 .input_index = 2,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_QINQ_HEADER + offsetof(struct ipv4_hdr, dst_addr),
+				 },
+
+	/* Source Port */
+	[3] = {
+				 .type = RTE_ACL_FIELD_TYPE_RANGE,
+				 .size = sizeof(uint16_t),
+				 .field_index = 3,
+				 .input_index = 3,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_QINQ_HEADER +
+				 sizeof(struct ipv4_hdr) + offsetof(struct tcp_hdr, src_port),
+				 },
+
+	/* Destination Port */
+	[4] = {
+				 .type = RTE_ACL_FIELD_TYPE_RANGE,
+				 .size = sizeof(uint16_t),
+				 .field_index = 4,
+				 .input_index = 4,
+				 .offset = sizeof(struct ether_hdr) +
+				 SIZEOF_QINQ_HEADER +
+				 sizeof(struct ipv4_hdr) + offsetof(struct tcp_hdr, dst_port),
+				 },
+};
+
+static struct rte_acl_field_def field_format_ipv6[] = {
+	/* Protocol */
+	[0] = {
+				 .type = RTE_ACL_FIELD_TYPE_BITMASK,
+				 .size = sizeof(uint8_t),
+				 .field_index = 0,
+				 .input_index = 0,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, proto),
+				 },
+
+	/* Source IP address (IPv6) */
+	[1] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 1,
+				 .input_index = 1,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, src_addr),
+				 },
+
+	[2] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 2,
+				 .input_index = 2,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, src_addr) + sizeof(uint32_t),
+				 },
+
+	[3] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 3,
+				 .input_index = 3,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, src_addr) + 2 * sizeof(uint32_t),
+				 },
+
+	[4] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 4,
+				 .input_index = 4,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, src_addr) + 3 * sizeof(uint32_t),
+				 },
+
+	/* Destination IP address (IPv6) */
+	[5] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 5,
+				 .input_index = 5,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, dst_addr),
+				 },
+
+	[6] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 6,
+				 .input_index = 6,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, dst_addr) + sizeof(uint32_t),
+				 },
+
+	[7] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 7,
+				 .input_index = 7,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, dst_addr) + 2 * sizeof(uint32_t),
+				 },
+
+	[8] = {
+				 .type = RTE_ACL_FIELD_TYPE_MASK,
+				 .size = sizeof(uint32_t),
+				 .field_index = 8,
+				 .input_index = 8,
+				 .offset = sizeof(struct ether_hdr) +
+				 offsetof(struct ipv6_hdr, dst_addr) + 3 * sizeof(uint32_t),
+				 },
+
+	/* Source Port */
+	[9] = {
+				 .type = RTE_ACL_FIELD_TYPE_RANGE,
+				 .size = sizeof(uint16_t),
+				 .field_index = 9,
+				 .input_index = 9,
+				 .offset = sizeof(struct ether_hdr) +
+				 sizeof(struct ipv6_hdr) + offsetof(struct tcp_hdr, src_port),
+				 },
+
+	/* Destination Port */
+	[10] = {
+		.type = RTE_ACL_FIELD_TYPE_RANGE,
+		.size = sizeof(uint16_t),
+		.field_index = 10,
+		.input_index = 9,
+		.offset = sizeof(struct ether_hdr) +
+		sizeof(struct ipv6_hdr) + offsetof(struct tcp_hdr, dst_port),
+		},
+};
+
+void *lib_acl_create_active_standby_table_ipv4(uint8_t table_num,
+		uint32_t *libacl_n_rules)
+{
+	printf("Create LIBACL active IPV4 Tables rte_socket_id(): %i\n",
+			rte_socket_id());
+
+	/* Create IPV4 LIBACL Rule Tables */
+	struct rte_table_acl_params common_ipv4_table_libacl_params = {
+		.name = "LIBACLIPV4A",
+		.n_rules = *libacl_n_rules,
+		.n_rule_fields = RTE_DIM(field_format_ipv4),
+	};
+
+	memcpy(common_ipv4_table_libacl_params.field_format,
+			field_format_ipv4, sizeof(field_format_ipv4));
+
+	uint32_t ipv4_entry_size = sizeof(struct lib_acl_table_entry);
+	/* Create second IPV4 Table */
+	if (table_num == 2)
+		common_ipv4_table_libacl_params.name = "LIBACLIPV4B";
+	return	rte_table_acl_ops.f_create(&common_ipv4_table_libacl_params,
+			rte_socket_id(),
+			ipv4_entry_size);
+
+
+}
+
+void *lib_acl_create_active_standby_table_ipv6(uint8_t table_num,
+		uint32_t *libacl_n_rules)
+{
+	printf("Create LIBACL active IPV6 Tables rte_socket_id(): %i\n",
+			rte_socket_id());
+	/* Create IPV6 LIBACL Rule Tables */
+	struct rte_table_acl_params common_ipv6_table_libacl_params = {
+		.name = "LIBACLIPV6A",
+		.n_rules = *libacl_n_rules,
+		.n_rule_fields = RTE_DIM(field_format_ipv6),
+	};
+
+	memcpy(common_ipv6_table_libacl_params.field_format,
+			field_format_ipv6, sizeof(field_format_ipv6));
+
+	uint32_t ipv6_entry_size = sizeof(struct lib_acl_table_entry);
+	/* Create second IPV6 table */
+	if (table_num == 2)
+		common_ipv6_table_libacl_params.name = "LIBACLIPV6B";
+	return	rte_table_acl_ops.f_create(&common_ipv6_table_libacl_params,
+			rte_socket_id(),
+			ipv6_entry_size);
+
+
+}
+int lib_acl_parse_config(struct lib_acl *plib_acl,
+		char *arg_name, char *arg_value,
+		uint32_t *libacl_n_rules)
+{
+	uint32_t n_rules_present = 0;
+	uint32_t pkt_type_present = 0;
+	/* defaults */
+	plib_acl->n_rules = DEFULT_NUM_RULE;
+	*libacl_n_rules = DEFULT_NUM_RULE;
+	plib_acl->n_rule_fields = RTE_DIM(field_format_ipv4);
+	plib_acl->field_format = field_format_ipv4;
+	plib_acl->field_format_size = sizeof(field_format_ipv4);
+	if (strcmp(arg_name, "n_rules") == 0) {
+		if (n_rules_present) {
+			printf("n_rules_present");
+			return -1;
+		}
+		n_rules_present = 1;
+
+		plib_acl->n_rules = atoi(arg_value);
+		*libacl_n_rules = atoi(arg_value);
+		return 0;
+	}
+	if (strcmp(arg_name, "pkt_type") == 0) {
+		if (pkt_type_present) {
+			printf("pkt_type");
+			return -1;
+		}
+		pkt_type_present = 1;
+
+		/* ipv4 */
+		if (strcmp(arg_value, "ipv4") == 0) {
+			plib_acl->n_rule_fields =
+				RTE_DIM(field_format_ipv4);
+			plib_acl->field_format = field_format_ipv4;
+			plib_acl->field_format_size =
+				sizeof(field_format_ipv4);
+			return 0;
+		}
+
+		/* vlan_ipv4 */
+		if (strcmp(arg_value, "vlan_ipv4") == 0) {
+			plib_acl->n_rule_fields =
+				RTE_DIM(field_format_vlan_ipv4);
+			plib_acl->field_format =
+				field_format_vlan_ipv4;
+			plib_acl->field_format_size =
+				sizeof(field_format_vlan_ipv4);
+			return 0;
+		}
+
+		/* qinq_ipv4 */
+		if (strcmp(arg_value, "qinq_ipv4") == 0) {
+			plib_acl->n_rule_fields =
+				RTE_DIM(field_format_qinq_ipv4);
+			plib_acl->field_format =
+				field_format_qinq_ipv4;
+			plib_acl->field_format_size =
+				sizeof(field_format_qinq_ipv4);
+			return 0;
+		}
+
+		/* ipv6 */
+		if (strcmp(arg_value, "ipv6") == 0) {
+			plib_acl->n_rule_fields =
+				RTE_DIM(field_format_ipv6);
+			plib_acl->field_format = field_format_ipv6;
+			plib_acl->field_format_size =
+				sizeof(field_format_ipv6);
+			return 0;
+		}
+		/* other */
+		printf("other");
+		return -1;
+	}
+	/* Parameter not processed in this parse function */
+	return 1;
+}
+/**
+ * Main packet processing function.
+ * 64 packet bit mask are used to identify which packets to forward.
+ * Performs the following:
+ *  - Burst lookup packets in the IPv4 ACL Rule Table.
+ *  - Burst lookup packets in the IPv6 ACL Rule Table.
+ *  - Lookup Action Table, perform actions.
+ *  - Burst lookup Connection Tracking, if enabled.
+ *  - Lookup MAC address.
+ *  - Set bit mask.
+ *  - Packets with bit mask set are forwarded
+ *
+ * @param p
+ *  A pointer to the pipeline.
+ * @param pkts
+ *  A pointer to a burst of packets.
+ * @param n_pkts
+ *  Number of packets to process.
+ * @param arg
+ *  A pointer to pipeline specific data.
+ *
+ * @return
+ *  0 on success, negative on error.
+ */
+	uint64_t
+lib_acl_pkt_work_key(struct lib_acl *plib_acl,
+	struct rte_mbuf **pkts, uint64_t pkts_mask,
+	uint64_t *pkts_drop_without_rule,
+	void *plib_acl_rule_table_ipv4_active,
+	void *plib_acl_rule_table_ipv6_active,
+	struct pipeline_action_key *action_array_active,
+	struct action_counter_block (*p_action_counter_table)[action_array_max],
+	uint64_t *conntrack_mask,
+	uint64_t *connexist_mask,
+	int lib_acl_ipv4_enabled, int lib_acl_ipv6_enabled)
+{
+
+	uint64_t lookup_hit_mask = 0;
+	uint64_t lookup_hit_mask_ipv4 = 0;
+	uint64_t lookup_hit_mask_ipv6 = 0;
+	uint64_t lookup_miss_mask = 0;
+	int status;
+
+
+	if (lib_acl_ipv4_enabled) {
+		if (ACL_LIB_DEBUG)
+			printf("ACL IPV4 Lookup Mask Before = 0x%"PRIx64"\n",
+					pkts_mask);
+		status = rte_table_acl_ops.f_lookup(
+				plib_acl_rule_table_ipv4_active,
+				pkts, pkts_mask, &lookup_hit_mask_ipv4,
+				(void **) plib_acl->plib_acl_entries_ipv4);
+		if (status < 0)
+			printf("Lookup failed\n");
+		if (ACL_LIB_DEBUG)
+			printf("ACL IPV4 Lookup Mask After = 0x%"PRIx64"\n",
+					lookup_hit_mask_ipv4);
+	}
+
+	if (lib_acl_ipv6_enabled) {
+		if (ACL_LIB_DEBUG)
+			printf("ACL IPV6 Lookup Mask Before = 0x%"PRIx64"\n",
+					pkts_mask);
+		status = rte_table_acl_ops.f_lookup(
+				plib_acl_rule_table_ipv6_active,
+				pkts, pkts_mask, &lookup_hit_mask_ipv6,
+				(void **) plib_acl->plib_acl_entries_ipv6);
+		if (status < 0)
+			printf("Lookup Failed\n");
+		if (ACL_LIB_DEBUG)
+			printf("ACL IPV6 Lookup Mask After = 0x%"PRIx64"\n",
+					lookup_hit_mask_ipv6);
+	}
+
+	/* Merge lookup results since we process both IPv4 and IPv6 below */
+	lookup_hit_mask = lookup_hit_mask_ipv4 | lookup_hit_mask_ipv6;
+	if (ACL_LIB_DEBUG)
+		printf("ACL Lookup Mask After = 0x%"PRIx64"\n",
+				lookup_hit_mask);
+
+	lookup_miss_mask = pkts_mask & (~lookup_hit_mask);
+	pkts_mask = lookup_hit_mask;
+	*pkts_drop_without_rule += __builtin_popcountll(lookup_miss_mask);
+	if (ACL_LIB_DEBUG)
+		printf("pkt_work_acl_key pkts_drop: %" PRIu64 " n_pkts: %u\n",
+				*pkts_drop_without_rule,
+				__builtin_popcountll(lookup_miss_mask));
+	/* bitmap of packets left to process for ARP */
+	uint64_t pkts_to_process = lookup_hit_mask;
+
+	for (; pkts_to_process;) {
+		uint8_t pos = (uint8_t)__builtin_ctzll(pkts_to_process);
+		/* bitmask representing only this packet */
+		uint64_t pkt_mask = 1LLU << pos;
+		/* remove this packet from remaining list */
+		pkts_to_process &= ~pkt_mask;
+		struct rte_mbuf *pkt = pkts[pos];
+
+		uint8_t hdr_chk = RTE_MBUF_METADATA_UINT8(pkt, IP_START);
+
+		hdr_chk = hdr_chk >> IP_VERSION_CHECK;
+
+		if (hdr_chk == IPv4_HDR_VERSION) {
+
+			struct lib_acl_table_entry *entry =
+				(struct lib_acl_table_entry *)
+				plib_acl->plib_acl_entries_ipv4[pos];
+			uint16_t phy_port = entry->head.port_id;
+			uint32_t action_id = entry->action_id;
+
+			if (ACL_LIB_DEBUG)
+				printf("action_id = %u\n", action_id);
+
+			uint32_t dscp_offset = IP_START + IP_HDR_DSCP_OFST;
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_count) {
+				p_action_counter_table
+					[plib_acl->action_counter_index]
+					[action_id].packetCount++;
+				p_action_counter_table
+					[plib_acl->action_counter_index]
+					[action_id].byteCount +=
+					rte_pktmbuf_pkt_len(pkt);
+				if (ACL_LIB_DEBUG)
+					printf("Action Count   Packet Count: %"
+						PRIu64 "  Byte Count: %"
+						PRIu64 "\n"
+						, p_action_counter_table
+						[plib_acl->action_counter_index]
+						[action_id].packetCount,
+						p_action_counter_table
+						[plib_acl->action_counter_index]
+						[action_id].byteCount);
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_packet_drop) {
+
+				/* Drop packet by changing the mask */
+				if (ACL_LIB_DEBUG)
+					printf("ACL before drop pkt_mask %"
+							PRIx64", pkt_num %d\n",
+							pkts_mask, pos);
+				pkts_mask &= ~(1LLU << pos);
+				(*pkts_drop_without_rule)++;
+				if (ACL_LIB_DEBUG)
+					printf("ACL after drop pkt_mask %"PRIx64
+						", pkt_num %d, packet_drop%"
+						PRIu64"\n", pkts_mask, pos,
+						*pkts_drop_without_rule);
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_fwd) {
+				phy_port = action_array_active[action_id].
+					fwd_port;
+				entry->head.port_id = phy_port;
+				if (ACL_LIB_DEBUG)
+					printf("Action FWD  Port ID: %"
+							PRIu16"\n", phy_port);
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_nat) {
+				phy_port = action_array_active[action_id].
+					nat_port;
+				entry->head.port_id = phy_port;
+				if (ACL_LIB_DEBUG)
+					printf("Action NAT  Port ID: %"
+							PRIu16"\n", phy_port);
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_dscp) {
+
+				/* Set DSCP priority */
+				uint8_t *dscp = RTE_MBUF_METADATA_UINT8_PTR(pkt,
+						dscp_offset);
+				*dscp = action_array_active[action_id].
+					dscp_priority << 2;
+				if (ACL_LIB_DEBUG)
+					printf("Action DSCP   DSCP Priority: %"
+							PRIu16 "\n", *dscp);
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_packet_accept) {
+				if (ACL_LIB_DEBUG)
+					printf("Action Accept\n");
+
+				if (action_array_active[action_id].action_bitmap
+						& lib_acl_action_conntrack) {
+
+					/* Set conntrack bit for this pkt */
+					*conntrack_mask |= pkt_mask;
+					if (ACL_LIB_DEBUG)
+						printf("ACL CT enabled: 0x%"
+							PRIx64"  pkt_mask: 0x%"
+							PRIx64"\n",
+							*conntrack_mask,
+							pkt_mask);
+			}
+
+				if (action_array_active[action_id].action_bitmap
+						& lib_acl_action_connexist) {
+
+					/* Set conntrack bit for this pkt */
+					*conntrack_mask |= pkt_mask;
+
+					/* Set connexist bit for this pkt for
+					 * public -> private */
+					/* Private -> public packet will open
+					 * the connection */
+					if (action_array_active[action_id].
+							private_public ==
+							lib_acl_public_private)
+						*connexist_mask |= pkt_mask;
+
+					if (ACL_LIB_DEBUG)
+						printf("Connexist ENB CT:0x%"
+							PRIx64"  connexist: 0x%"
+							PRIx64"  pkt_mask: 0x%"
+							PRIx64"\n",
+							*conntrack_mask,
+							*connexist_mask,
+							pkt_mask);
+				}
+			}
+		}
+
+		if (hdr_chk == IPv6_HDR_VERSION) {
+
+			struct lib_acl_table_entry *entry =
+				(struct lib_acl_table_entry *)
+				plib_acl->plib_acl_entries_ipv6[pos];
+			uint16_t phy_port = entry->head.port_id;
+			uint32_t action_id = entry->action_id;
+
+			if (ACL_LIB_DEBUG)
+				printf("action_id = %u\n", action_id);
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_count) {
+				p_action_counter_table
+					[plib_acl->action_counter_index]
+					[action_id].packetCount++;
+				p_action_counter_table
+					[plib_acl->action_counter_index]
+					[action_id].byteCount +=
+					rte_pktmbuf_pkt_len(pkt);
+				if (ACL_LIB_DEBUG)
+					printf("Action Count   Packet Count: %"
+						PRIu64 "  Byte Count: %"
+						PRIu64 "\n",
+						p_action_counter_table
+						[plib_acl->action_counter_index]
+						[action_id].packetCount,
+						p_action_counter_table
+						[plib_acl->action_counter_index]
+						[action_id].byteCount);
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_packet_drop) {
+				/* Drop packet by changing the mask */
+				if (ACL_LIB_DEBUG)
+					printf("ACL before drop pkt_mask %"
+							PRIx64", pkt_num %d\n",
+							pkts_mask, pos);
+				pkts_mask &= ~(1LLU << pos);
+				(*pkts_drop_without_rule)++;
+				if (ACL_LIB_DEBUG)
+					printf("ACL after drop pkt_mask %"PRIx64
+						", pkt_num %d, packet_drop %"
+						PRIu64 "\n", pkts_mask, pos,
+						*pkts_drop_without_rule);
+
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_fwd) {
+				phy_port = action_array_active[action_id].
+					fwd_port;
+				entry->head.port_id = phy_port;
+				if (ACL_LIB_DEBUG)
+					printf("Action FWD  Port ID: %"
+							PRIu16"\n", phy_port);
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_nat) {
+				phy_port = action_array_active[action_id].
+					nat_port;
+				entry->head.port_id = phy_port;
+				if (ACL_LIB_DEBUG)
+					printf("Action NAT  Port ID: %"
+							PRIu16"\n", phy_port);
+			}
+
+			if (action_array_active[action_id].action_bitmap &
+					lib_acl_action_dscp) {
+
+				/* Set DSCP priority */
+				uint32_t dscp_offset = IP_START +
+					IP_HDR_DSCP_OFST_IPV6;
+				uint16_t *dscp = RTE_MBUF_METADATA_UINT16_PTR(
+						pkt, dscp_offset);
+				uint16_t temp = *dscp;
+				uint16_t dscp_value = (rte_bswap16(temp) &
+						0XF00F);
+				uint8_t dscp_store =
+					action_array_active
+					[action_id].dscp_priority << 2;
+				uint16_t dscp_temp = dscp_store;
+
+				dscp_temp = dscp_temp << 4;
+				*dscp = rte_bswap16(dscp_temp | dscp_value);
+				if (ACL_LIB_DEBUG)
+					printf("Action DSCP   DSCP Priority: %"
+							PRIu16"\n", *dscp);
+			}
+
+			if (action_array_active[action_id].action_bitmap
+					& lib_acl_action_packet_accept) {
+				if (ACL_LIB_DEBUG)
+					printf("Action Accept\n");
+
+				if (action_array_active[action_id].action_bitmap
+						& lib_acl_action_conntrack) {
+
+					/* Set conntrack bit for this pkt */
+					*conntrack_mask |= pkt_mask;
+					if (ACL_LIB_DEBUG)
+						printf("ACL CT enabled: 0x%"
+							PRIx64" pkt_mask: 0x%"
+							PRIx64"\n",
+							*conntrack_mask,
+							pkt_mask);
+				}
+
+				if (action_array_active[action_id].action_bitmap
+						& lib_acl_action_connexist) {
+
+					/* Set conntrack bit for this pkt */
+					*conntrack_mask |= pkt_mask;
+
+					/* Set connexist bit for this pkt for
+					 * public -> private */
+					/* Private -> public packet will open
+					 * the connection */
+					if (action_array_active[action_id].
+							private_public ==
+							lib_acl_public_private)
+						*connexist_mask |= pkt_mask;
+
+					if (ACL_LIB_DEBUG)
+						printf("Connexist ENB CT:0x%"
+							PRIx64"  connexist: 0x%"
+							PRIx64"  pkt_mask: 0x%"
+							PRIx64"\n",
+							*conntrack_mask,
+							*connexist_mask,
+							pkt_mask);
+				}
+			}
+		}
+	}
+	return pkts_mask;
+}
+/**
+ * Main packet processing function.
+ * 64 packet bit mask are used to identify which packets to forward.
+ * Performs the following:
+ *  - Burst lookup packets in the IPv4 ACL Rule Table.
+ *  - Lookup Action Table, perform actions.
+ *  - Burst lookup Connection Tracking, if enabled.
+ *  - Lookup MAC address.
+ *  - Set bit mask.
+ *  - Packets with bit mask set are forwarded
+ *
+ * @param p
+ *  A pointer to the pipeline.
+ * @param pkts
+ *  A pointer to a burst of packets.
+ * @param n_pkts
+ *  Number of packets to process.
+ * @param arg
+ *  A pointer to pipeline specific data.
+ *
+ * @return
+ *  0 on success, negative on error.
+ */
+	uint64_t
+lib_acl_ipv4_pkt_work_key(struct lib_acl *plib_acl,
+	struct rte_mbuf **pkts, uint64_t pkts_mask,
+	uint64_t *pkts_drop_without_rule,
+	void *plib_acl_rule_table_ipv4_active,
+	struct pipeline_action_key *action_array_active,
+	struct action_counter_block (*p_action_counter_table)[action_array_max],
+	uint64_t *conntrack_mask,
+	uint64_t *connexist_mask)
+{
+
+	uint64_t lookup_hit_mask_ipv4 = 0;
+	uint64_t lookup_miss_mask_ipv4 = 0;
+	int status;
+
+	if (ACL_LIB_DEBUG)
+		printf("ACL IPV4 Lookup Mask Before = 0x%"PRIx64"\n",
+				pkts_mask);
+	status = rte_table_acl_ops.f_lookup(
+			plib_acl_rule_table_ipv4_active,
+			pkts, pkts_mask, &lookup_hit_mask_ipv4,
+			(void **) plib_acl->plib_acl_entries_ipv4);
+	if (status < 0)
+		printf("Lookup Failed\n");
+	if (ACL_LIB_DEBUG)
+		printf("ACL IPV4 Lookup Mask After = 0x%"PRIx64"\n",
+				lookup_hit_mask_ipv4);
+	if (ACL_LIB_DEBUG)
+		printf("ACL Lookup Mask After = 0x%"PRIx64"\n",
+				lookup_hit_mask_ipv4);
+
+	lookup_miss_mask_ipv4 = pkts_mask & (~lookup_hit_mask_ipv4);
+	pkts_mask = lookup_hit_mask_ipv4;
+	*pkts_drop_without_rule += __builtin_popcountll(lookup_miss_mask_ipv4);
+	if (ACL_LIB_DEBUG)
+		printf("pkt_work_acl_key pkts_drop: %" PRIu64 " n_pkts: %u\n",
+				*pkts_drop_without_rule,
+				__builtin_popcountll(lookup_miss_mask_ipv4));
+	/* bitmap of packets left to process for ARP */
+	uint64_t pkts_to_process = lookup_hit_mask_ipv4;
+
+	for (; pkts_to_process;) {
+		uint8_t pos = (uint8_t)__builtin_ctzll(pkts_to_process);
+		/* bitmask representing only this packet */
+		uint64_t pkt_mask = 1LLU << pos;
+		/* remove this packet from remaining list */
+		pkts_to_process &= ~pkt_mask;
+		struct rte_mbuf *pkt = pkts[pos];
+
+
+
+		struct lib_acl_table_entry *entry =
+			(struct lib_acl_table_entry *)
+			plib_acl->plib_acl_entries_ipv4[pos];
+		uint16_t phy_port = entry->head.port_id;
+		uint32_t action_id = entry->action_id;
+
+		if (ACL_LIB_DEBUG)
+			printf("action_id = %u\n", action_id);
+
+		uint32_t dscp_offset = IP_START + IP_HDR_DSCP_OFST;
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_count) {
+			p_action_counter_table
+				[plib_acl->action_counter_index]
+				[action_id].packetCount++;
+			p_action_counter_table
+				[plib_acl->action_counter_index]
+				[action_id].byteCount +=
+				rte_pktmbuf_pkt_len(pkt);
+			if (ACL_LIB_DEBUG)
+				printf("Action Count   Packet Count: %"
+						PRIu64 "  Byte Count: %"
+						PRIu64 "\n"
+						, p_action_counter_table
+						[plib_acl->action_counter_index]
+						[action_id].packetCount,
+						p_action_counter_table
+						[plib_acl->action_counter_index]
+						[action_id].byteCount);
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_packet_drop) {
+
+			/* Drop packet by changing the mask */
+			if (ACL_LIB_DEBUG)
+				printf("ACL before drop pkt_mask %"
+						PRIx64", pkt_num %d\n",
+						pkts_mask, pos);
+			pkts_mask &= ~(1LLU << pos);
+			(*pkts_drop_without_rule)++;
+			if (ACL_LIB_DEBUG)
+				printf("ACL after drop pkt_mask %" PRIx64
+					", pkt_num %d, action_packet_drop %"
+					PRIu64 "\n", pkts_mask, pos,
+					*pkts_drop_without_rule);
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_fwd) {
+			phy_port = action_array_active[action_id].
+				fwd_port;
+			entry->head.port_id = phy_port;
+			if (ACL_LIB_DEBUG)
+				printf("Action FWD  Port ID: %"
+						PRIu16"\n", phy_port);
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_nat) {
+			phy_port = action_array_active[action_id].
+				nat_port;
+			entry->head.port_id = phy_port;
+			if (ACL_LIB_DEBUG)
+				printf("Action NAT  Port ID: %"
+						PRIu16"\n", phy_port);
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_dscp) {
+
+			/* Set DSCP priority */
+			uint8_t *dscp = RTE_MBUF_METADATA_UINT8_PTR(pkt,
+					dscp_offset);
+			*dscp = action_array_active[action_id].
+				dscp_priority << 2;
+			if (ACL_LIB_DEBUG)
+				printf("Action DSCP   DSCP Priority: %"
+						PRIu16 "\n", *dscp);
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_packet_accept) {
+			if (ACL_LIB_DEBUG)
+				printf("Action Accept\n");
+
+			if (action_array_active[action_id].action_bitmap
+					& lib_acl_action_conntrack) {
+
+				/* Set conntrack bit for this pkt */
+				*conntrack_mask |= pkt_mask;
+				if (ACL_LIB_DEBUG)
+					printf("ACL CT enabled: 0x%"
+							PRIx64"  pkt_mask: 0x%"
+							PRIx64"\n",
+							*conntrack_mask,
+							pkt_mask);
+			}
+
+			if (action_array_active[action_id].action_bitmap
+					& lib_acl_action_connexist) {
+
+				/* Set conntrack bit for this pkt */
+				*conntrack_mask |= pkt_mask;
+
+				/* Set connexist bit for this pkt for
+				 * public -> private */
+				/* Private -> public packet will open
+				 * the connection */
+				if (action_array_active[action_id].
+						private_public ==
+						lib_acl_public_private)
+					*connexist_mask |= pkt_mask;
+
+				if (ACL_LIB_DEBUG)
+					printf("ACL Connexist ENB CT:0x%"
+							PRIx64"  connexist: 0x%"
+							PRIx64"  pkt_mask: 0x%"
+							PRIx64"\n",
+							*conntrack_mask,
+							*connexist_mask,
+							pkt_mask);
+			}
+		}
+
+	}
+	return pkts_mask;
+}
+/**
+ * Main packet processing function.
+ * 64 packet bit mask are used to identify which packets to forward.
+ * Performs the following:
+ *  - Burst lookup packets in the IPv6 ACL Rule Table.
+ *  - Lookup Action Table, perform actions.
+ *  - Burst lookup Connection Tracking, if enabled.
+ *  - Lookup MAC address.
+ *  - Set bit mask.
+ *  - Packets with bit mask set are forwarded
+ *
+ * @param p
+ *  A pointer to the pipeline.
+ * @param pkts
+ *  A pointer to a burst of packets.
+ * @param n_pkts
+ *  Number of packets to process.
+ * @param arg
+ *  A pointer to pipeline specific data.
+ *
+ * @return
+ *  0 on success, negative on error.
+ */
+	uint64_t
+lib_acl_ipv6_pkt_work_key(struct lib_acl *plib_acl,
+	struct rte_mbuf **pkts, uint64_t pkts_mask,
+	uint64_t *pkts_drop_without_rule,
+	void *plib_acl_rule_table_ipv6_active,
+	struct pipeline_action_key *action_array_active,
+	struct action_counter_block (*p_action_counter_table)[action_array_max],
+	uint64_t *conntrack_mask,
+	uint64_t *connexist_mask)
+{
+
+	uint64_t lookup_hit_mask_ipv6 = 0;
+	uint64_t lookup_miss_mask_ipv6 = 0;
+	int status;
+
+
+	if (ACL_LIB_DEBUG)
+		printf("ACL IPV6 Lookup Mask Before = 0x%"PRIx64"\n",
+				pkts_mask);
+	status = rte_table_acl_ops.f_lookup(
+			plib_acl_rule_table_ipv6_active,
+			pkts, pkts_mask, &lookup_hit_mask_ipv6,
+			(void **) plib_acl->plib_acl_entries_ipv6);
+	if (status < 0)
+		printf("Lookup Failed\n");
+	if (ACL_LIB_DEBUG)
+		printf("ACL IPV6 Lookup Mask After = 0x%"PRIx64"\n",
+				lookup_hit_mask_ipv6);
+
+	if (ACL_LIB_DEBUG)
+		printf("ACL Lookup Mask After = 0x%"PRIx64"\n",
+				lookup_hit_mask_ipv6);
+
+	lookup_miss_mask_ipv6 = pkts_mask & (~lookup_hit_mask_ipv6);
+	pkts_mask = lookup_hit_mask_ipv6;
+	*pkts_drop_without_rule += __builtin_popcountll(lookup_miss_mask_ipv6);
+	if (ACL_LIB_DEBUG)
+		printf("pkt_work_acl_key pkts_drop: %" PRIu64 " n_pkts: %u\n",
+				*pkts_drop_without_rule,
+				__builtin_popcountll(lookup_miss_mask_ipv6));
+	/* bitmap of packets left to process for ARP */
+	uint64_t pkts_to_process = lookup_hit_mask_ipv6;
+
+	for (; pkts_to_process;) {
+		uint8_t pos = (uint8_t)__builtin_ctzll(pkts_to_process);
+		/* bitmask representing only this packet */
+		uint64_t pkt_mask = 1LLU << pos;
+		/* remove this packet from remaining list */
+		pkts_to_process &= ~pkt_mask;
+		struct rte_mbuf *pkt = pkts[pos];
+
+
+		struct lib_acl_table_entry *entry =
+			(struct lib_acl_table_entry *)
+			plib_acl->plib_acl_entries_ipv6[pos];
+		uint16_t phy_port = entry->head.port_id;
+		uint32_t action_id = entry->action_id;
+
+		if (ACL_LIB_DEBUG)
+			printf("action_id = %u\n", action_id);
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_count) {
+			p_action_counter_table
+				[plib_acl->action_counter_index]
+				[action_id].packetCount++;
+			p_action_counter_table
+				[plib_acl->action_counter_index]
+				[action_id].byteCount +=
+				rte_pktmbuf_pkt_len(pkt);
+			if (ACL_LIB_DEBUG)
+				printf("Action Count   Packet Count: %"
+						PRIu64 "  Byte Count: %"
+						PRIu64 "\n",
+						p_action_counter_table
+						[plib_acl->action_counter_index]
+						[action_id].packetCount,
+						p_action_counter_table
+						[plib_acl->action_counter_index]
+						[action_id].byteCount);
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_packet_drop) {
+			/* Drop packet by changing the mask */
+			if (ACL_LIB_DEBUG)
+				printf("ACL before drop pkt_mask %"
+						PRIx64", pkt_num %d\n",
+						pkts_mask, pos);
+			pkts_mask &= ~(1LLU << pos);
+			(*pkts_drop_without_rule)++;
+			if (ACL_LIB_DEBUG)
+				printf("ACL after drop pkt_mask %" PRIx64
+					", pkt_num %d, action_packet_drop %"
+					PRIu64 "\n", pkts_mask, pos,
+					*pkts_drop_without_rule);
+
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_fwd) {
+			phy_port = action_array_active[action_id].
+				fwd_port;
+			entry->head.port_id = phy_port;
+			if (ACL_LIB_DEBUG)
+				printf("Action FWD  Port ID: %"
+						PRIu16"\n", phy_port);
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_nat) {
+			phy_port = action_array_active[action_id].
+				nat_port;
+			entry->head.port_id = phy_port;
+			if (ACL_LIB_DEBUG)
+				printf("Action NAT  Port ID: %"
+						PRIu16"\n", phy_port);
+		}
+
+		if (action_array_active[action_id].action_bitmap &
+				lib_acl_action_dscp) {
+
+			/* Set DSCP priority */
+			uint32_t dscp_offset = IP_START +
+				IP_HDR_DSCP_OFST_IPV6;
+			uint16_t *dscp = RTE_MBUF_METADATA_UINT16_PTR(
+					pkt, dscp_offset);
+			uint16_t temp = *dscp;
+			uint16_t dscp_value = (rte_bswap16(temp) &
+					0XF00F);
+			uint8_t dscp_store =
+				action_array_active
+				[action_id].dscp_priority << 2;
+			uint16_t dscp_temp = dscp_store;
+
+			dscp_temp = dscp_temp << 4;
+			*dscp = rte_bswap16(dscp_temp | dscp_value);
+			if (ACL_LIB_DEBUG)
+				printf("Action DSCP   DSCP Priority: %"
+						PRIu16"\n", *dscp);
+		}
+
+		if (action_array_active[action_id].action_bitmap
+				& lib_acl_action_packet_accept) {
+			if (ACL_LIB_DEBUG)
+				printf("Action Accept\n");
+
+			if (action_array_active[action_id].action_bitmap
+					& lib_acl_action_conntrack) {
+
+				/* Set conntrack bit for this pkt */
+				*conntrack_mask |= pkt_mask;
+				if (ACL_LIB_DEBUG)
+					printf("ACL CT enabled: 0x%"
+							PRIx64" pkt_mask: 0x%"
+							PRIx64"\n",
+							*conntrack_mask,
+							pkt_mask);
+			}
+
+			if (action_array_active[action_id].action_bitmap
+					& lib_acl_action_connexist) {
+
+				/* Set conntrack bit for this pkt */
+				*conntrack_mask |= pkt_mask;
+
+				/* Set connexist bit for this pkt for
+				 * public -> private */
+				/* Private -> public packet will open
+				 * the connection */
+				if (action_array_active[action_id].
+						private_public ==
+						lib_acl_public_private)
+					*connexist_mask |= pkt_mask;
+
+				if (ACL_LIB_DEBUG)
+					printf("ACL Connexist ENB CT:0x%"
+							PRIx64"  connexist: 0x%"
+							PRIx64"  pkt_mask: 0x%"
+							PRIx64"\n",
+							*conntrack_mask,
+							*connexist_mask,
+							pkt_mask);
+			}
+		}
+	}
+	return pkts_mask;
+}
diff --git a/common/VIL/acl/lib_acl.h b/common/VIL/acl/lib_acl.h
new file mode 100644
index 00000000..6eaaf55f
--- /dev/null
+++ b/common/VIL/acl/lib_acl.h
@@ -0,0 +1,127 @@
+/*
+// Copyright (c) 2017 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+*/
+
+#ifndef __INCLUDE_ACL_LIB_H__
+#define __INCLUDE_ACL_LIB_H__
+
+#include <stdlib.h>
+#include <string.h>
+#include <inttypes.h>
+#include <rte_pipeline.h>
+#include <rte_table_acl.h>
+#include "rte_cnxn_tracking.h"
+#include "rte_ct_tcp.h"
+/* Define VNF actions for bitmap */
+#define lib_acl_action_packet_drop		1
+#define lib_acl_action_packet_accept	2
+#define lib_acl_action_nat				4
+#define lib_acl_action_fwd				8
+#define lib_acl_action_count			16
+#define lib_acl_action_dscp				32
+#define lib_acl_action_conntrack		64
+#define lib_acl_action_connexist		128
+#define action_array_max            10000
+#define lib_acl_private_public			0
+#define lib_acl_public_private			1
+#define IP_HDR_DSCP_OFST 1
+#define IPv4_HDR_VERSION 4
+#define IPv6_HDR_VERSION 6
+#define IP_HDR_DSCP_OFST_IPV6 0
+#define IP_VERSION_CHECK 4
+#define IP_START (MBUF_HDR_ROOM + ETH_HDR_SIZE)
+#define DEFULT_NUM_RULE (4*1024)
+/**
+ * A structure defining the key to store an VNF action.
+ */
+struct pipeline_action_key {
+	uint32_t action_id;
+	uint32_t action_bitmap;
+	uint32_t nat_port;
+	uint32_t fwd_port;
+	uint8_t dscp_priority;
+	uint8_t private_public;
+} __rte_cache_aligned;
+
+/**
+ * A structure defining the Action counters.
+ * One Action Counter Block per VNF thread.
+ */
+struct action_counter_block {
+	uint64_t byteCount;
+	uint64_t packetCount;
+} __rte_cache_aligned;
+
+/**
+ * A structure defining the ACL library table.
+ */
+struct lib_acl_table_entry {
+	struct rte_pipeline_table_entry head;
+	uint32_t action_id;
+};
+
+
+struct lib_acl {
+	uint32_t n_rules;
+	uint32_t n_rule_fields;
+	struct rte_acl_field_def *field_format;
+	uint32_t field_format_size;
+	int action_counter_index;
+	struct lib_acl_table_entry
+	*plib_acl_entries_ipv4[RTE_PORT_IN_BURST_SIZE_MAX];
+	struct lib_acl_table_entry
+	*plib_acl_entries_ipv6[RTE_PORT_IN_BURST_SIZE_MAX];
+} __rte_cache_aligned;
+
+void *lib_acl_create_active_standby_table_ipv4(uint8_t table_num,
+		uint32_t *libacl_n_rules);
+
+void *lib_acl_create_active_standby_table_ipv6(uint8_t table_num,
+		uint32_t *libacl_n_rules);
+int lib_acl_parse_config(struct lib_acl *plib_acl,
+		char *arg_name, char *arg_value,
+		uint32_t *libacl_n_rules);
+uint64_t
+lib_acl_pkt_work_key(struct lib_acl *plib_acl,
+	struct rte_mbuf **pkts, uint64_t pkts_mask,
+	uint64_t *pkts_drop_without_rule,
+	void *plib_acl_rule_table_ipv4_active,
+	void *plib_acl_rule_table_ipv6_active,
+	struct pipeline_action_key *action_array_active,
+	struct action_counter_block (*p_action_counter_table)[action_array_max],
+	uint64_t *conntrack_mask,
+	uint64_t *connexist_mask,
+	int lib_acl_ipv4_enabled, int lib_acl_ipv6_enabled);
+uint64_t
+lib_acl_ipv4_pkt_work_key(struct lib_acl *plib_acl,
+	struct rte_mbuf **pkts, uint64_t pkts_mask,
+	uint64_t *pkts_drop_without_rule,
+	void *plib_acl_rule_table_ipv4_active,
+	struct pipeline_action_key *action_array_active,
+	struct action_counter_block (*p_action_counter_table)[action_array_max],
+	uint64_t *conntrack_mask,
+	uint64_t *connexist_mask);
+uint64_t
+lib_acl_ipv6_pkt_work_key(struct lib_acl *plib_acl,
+	struct rte_mbuf **pkts, uint64_t pkts_mask,
+	uint64_t *pkts_drop_without_rule,
+	void *plib_acl_rule_table_ipv6_active,
+	struct pipeline_action_key *action_array_active,
+	struct action_counter_block (*p_action_counter_table)[action_array_max],
+	uint64_t *conntrack_mask,
+	uint64_t *connexist_mask);
+
+
+#endif