diff options
Diffstat (limited to 'src/vnet/ipsec/ipsec_spd_policy.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec_spd_policy.c | 27 |
1 files changed, 26 insertions, 1 deletions
diff --git a/src/vnet/ipsec/ipsec_spd_policy.c b/src/vnet/ipsec/ipsec_spd_policy.c index 36405bd6d9b..72da408c161 100644 --- a/src/vnet/ipsec/ipsec_spd_policy.c +++ b/src/vnet/ipsec/ipsec_spd_policy.c @@ -156,7 +156,7 @@ ipsec_add_del_policy (vlib_main_t * vm, if (!spd) return VNET_API_ERROR_SYSCALL_ERROR_1; - if (im->flow_cache_flag && !policy->is_ipv6 && + if (im->output_flow_cache_flag && !policy->is_ipv6 && policy->type == IPSEC_SPD_POLICY_IP4_OUTBOUND) { /* @@ -179,6 +179,31 @@ ipsec_add_del_policy (vlib_main_t * vm, clib_atomic_store_relax_n (&im->ipsec4_out_spd_flow_cache_entries, 0); } + if ((policy->type == IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT || + policy->type == IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS || + policy->type == IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD) && + im->input_flow_cache_flag && !policy->is_ipv6) + { + /* + * Flow cache entry is valid only when input_epoch_count value in control + * plane and data plane match. Otherwise, flow cache entry is considered + * stale. To avoid the race condition of using old input_epoch_count + * value in data plane after the roll over of input_epoch_count in + * control plane, entire flow cache is reset. + */ + if (im->input_epoch_count == 0xFFFFFFFF) + { + /* Reset all the entries in flow cache */ + clib_memset_u8 (im->ipsec4_in_spd_hash_tbl, 0, + im->ipsec4_in_spd_hash_num_buckets * + (sizeof (*(im->ipsec4_in_spd_hash_tbl)))); + } + /* Increment epoch counter by 1 */ + clib_atomic_fetch_add_relax (&im->input_epoch_count, 1); + /* Reset spd flow cache counter since all old entries are stale */ + im->ipsec4_in_spd_flow_cache_entries = 0; + } + if (is_add) { u32 policy_index; |