aboutsummaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec/ipsec_spd_policy.c
diff options
context:
space:
mode:
authorNeale Ranns <nranns@cisco.com>2019-07-12 09:15:26 +0000
committerDave Barach <openvpp@barachs.net>2019-07-12 12:24:55 +0000
commit495d7ffbc82823edccabab960fc81a909f80075d (patch)
treed4244f743b7406bbdc4235e6accdfc4899a88b83 /src/vnet/ipsec/ipsec_spd_policy.c
parentdef35a2352c9a54f748d301ffa47a446d25a83e0 (diff)
ipsec: Reference count the SAs
- this remove the need to iterate through all state when deleting an SA - and ensures that if the SA is deleted by the client is remains for use in any state until that state is also removed. Type: feature Change-Id: I438cb67588cb65c701e49a7a9518f88641925419 Signed-off-by: Neale Ranns <nranns@cisco.com>
Diffstat (limited to 'src/vnet/ipsec/ipsec_spd_policy.c')
-rw-r--r--src/vnet/ipsec/ipsec_spd_policy.c20
1 files changed, 12 insertions, 8 deletions
diff --git a/src/vnet/ipsec/ipsec_spd_policy.c b/src/vnet/ipsec/ipsec_spd_policy.c
index 34b7dc2efca..6424210b4e3 100644
--- a/src/vnet/ipsec/ipsec_spd_policy.c
+++ b/src/vnet/ipsec/ipsec_spd_policy.c
@@ -142,14 +142,6 @@ ipsec_add_del_policy (vlib_main_t * vm,
u32 spd_index;
uword *p;
- if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
- {
- p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
- if (!p)
- return VNET_API_ERROR_SYSCALL_ERROR_1;
- policy->sa_index = p[0];
- }
-
p = hash_get (im->spd_index_by_spd_id, policy->id);
if (!p)
@@ -164,6 +156,17 @@ ipsec_add_del_policy (vlib_main_t * vm,
{
u32 policy_index;
+ if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
+ {
+ index_t sa_index = ipsec_sa_find_and_lock (policy->sa_id);
+
+ if (INDEX_INVALID == sa_index)
+ return VNET_API_ERROR_SYSCALL_ERROR_1;
+ policy->sa_index = sa_index;
+ }
+ else
+ policy->sa_index = INDEX_INVALID;
+
pool_get (im->policies, vp);
clib_memcpy (vp, policy, sizeof (*vp));
policy_index = vp - im->policies;
@@ -188,6 +191,7 @@ ipsec_add_del_policy (vlib_main_t * vm,
if (ipsec_policy_is_equal (vp, policy))
{
vec_del1 (spd->policies[policy->type], ii);
+ ipsec_sa_unlock (vp->sa_index);
pool_put (im->policies, vp);
break;
}