(11) feat(acl): crate scaffolding + software reference backend

Cargo.toml

@@ -1,6 +1,7 @@
 [workspace]
 
 members = [
+    "acl",
     "args",
     "cli",
     "common",
@@ -64,6 +65,7 @@ repository = "https://github.com/githedgehog/dataplane/"
 # justifying why it is workspace-wide.
 
 # Internal
+acl = { path = "./acl", package = "dataplane-acl", features = [] }
 args = { path = "./args", package = "dataplane-args", features = [] }
 cli = { path = "./cli", package = "dataplane-cli", features = [] }
 common = { path = "./common", package = "dataplane-common", features = [] }
@@ -260,6 +262,15 @@ overflow-checks = true
 #        modified to use conditional compilation to work in wasm/miri.
 # miss: packages that are not logically hopeless, or pointless in wasm/miri, but which currently just happen to contain
 #       logic which can and should eventually be factored out or abstracted into something suitable for wasm/miri.
+[workspace.metadata.package.acl]
+package = "dataplane-acl"
+# Default features enable the DPDK `rte_acl` backend, which pulls in
+# `dpdk-sys` (bindgen against the system DPDK headers).  miri can't
+# build that path on the cross target, and the reference backend's
+# unit tests run fine outside the miri profile.
+miri = false # hopeless + pointless
+wasm = false # hopeless + pointless
+
 [workspace.metadata.package.args]
 package = "dataplane-args"
 miri = true

acl/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "dataplane-acl"
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+version.workspace = true
+
+[dependencies]
+arrayvec = { workspace = true, default-features = true }
+concurrency = { workspace = true, features = [] }
+lookup = { workspace = true, features = [] }
+match-action = { workspace = true, features = ["derive"] }
+net = { workspace = true, features = [] }
+thiserror = { workspace = true }

acl/src/lib.rs

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Open Network Fabric Authors
+
+#![deny(
+    unsafe_code,
+    clippy::all,
+    clippy::pedantic,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::panic
+)]
+#![allow(missing_docs)] // shape settling; doc once stable
+
+//! Match-action classifier backends for [`match_action::MatchKey`]
+//! tables, behind the [`lookup::Lookup`] interface.
+//!
+//! - [`reference`](mod@reference): linear-scan software classifier;
+//!   differential oracle and a mutable cascade front.  Always built.
+//!
+//! The production `rte_acl` backend lands behind a follow-up `dpdk`
+//! feature gate.
+//!
+//! [`lookup::Lookup`]: lookup::Lookup
+//! [`match_action::MatchKey`]: match_action::MatchKey
+
+pub mod reference;