forward.h File Reference

Interface forwarding plane (DETWS_ENABLE_FORWARD) - the v5 bridge / router. More...

#include "ServerConfig.h"

Go to the source code of this file.

Detailed Description

Interface forwarding plane (DETWS_ENABLE_FORWARD) - the v5 bridge / router.

A forwarding plane over the ingest pipeline. You register interfaces (Wi-Fi STA / AP, Ethernet, a peripheral bus, a radio), each with an egress send callback, then add per-pair rules (src -> dst, allow or deny, with an optional rate cap). When a frame arrives on an interface you call det_forward_ingress(); the plane evaluates the rules and forwards the bytes to every allowed destination by calling that destination's send callback - so the device bridges / routes between its interfaces instead of only terminating traffic.

The canonical wiring is DMA-driven: an inbound DMA-complete event (services/dma) is posted onto the FORWARD lane (services/preempt_queue), whose task calls det_forward_ingress(), and each destination's send callback hands the bytes to that interface's egress DMA. The plane itself is decoupled from both - it only knows interfaces, rules, and the send callbacks - so it is pure and host-testable.

Default-deny: a (src, dst) pair is forwarded only when an ALLOW rule matches and no DENY rule does (a DENY always wins). A frame is never reflected to its source interface. Fail-closed: an exceeded rate cap or a send callback returning false drops the frame for that destination and is counted - it never blocks. Storage is static (zero heap): DETWS_FWD_MAX_IFACES interfaces, DETWS_FWD_MAX_RULES rules.

Policy routing (route-by-tag): a policy route (det_forward_route_add) matches a frame by the same byte-pattern primitive as the ACL - so it keys on any field at a known offset (EtherType, IP protocol, a port, an address prefix) - and binds the match to a single egress interface. A matched frame is forwarded only to that interface, taking precedence over the src->dst fan-out (first matching route wins); if no policy route matches, the normal rules apply. This is policy-based routing layered on the plane: tagged traffic leaves a chosen NIC / radio. The ingress ACL still runs first, and the same rate-cap / never-reflect / fail-closed guarantees apply to the chosen egress.

Inspection hook (DETWS_FWD_INSPECT, off by default for cost + privacy): when built in, an app can register an inspector (det_forward_set_inspector) that runs on every ingress frame after the ACL and before routing - to observe / parse / meter, and optionally drop it. It is a flexible app callback (arbitrary logic), complementing the fast fixed-offset ACL.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file forward.h.