diff options
Diffstat (limited to 'src/vnet/ipsec/ipsec_spd_policy.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec_spd_policy.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/src/vnet/ipsec/ipsec_spd_policy.c b/src/vnet/ipsec/ipsec_spd_policy.c index 34b7dc2efca..6424210b4e3 100644 --- a/src/vnet/ipsec/ipsec_spd_policy.c +++ b/src/vnet/ipsec/ipsec_spd_policy.c @@ -142,14 +142,6 @@ ipsec_add_del_policy (vlib_main_t * vm, u32 spd_index; uword *p; - if (policy->policy == IPSEC_POLICY_ACTION_PROTECT) - { - p = hash_get (im->sa_index_by_sa_id, policy->sa_id); - if (!p) - return VNET_API_ERROR_SYSCALL_ERROR_1; - policy->sa_index = p[0]; - } - p = hash_get (im->spd_index_by_spd_id, policy->id); if (!p) @@ -164,6 +156,17 @@ ipsec_add_del_policy (vlib_main_t * vm, { u32 policy_index; + if (policy->policy == IPSEC_POLICY_ACTION_PROTECT) + { + index_t sa_index = ipsec_sa_find_and_lock (policy->sa_id); + + if (INDEX_INVALID == sa_index) + return VNET_API_ERROR_SYSCALL_ERROR_1; + policy->sa_index = sa_index; + } + else + policy->sa_index = INDEX_INVALID; + pool_get (im->policies, vp); clib_memcpy (vp, policy, sizeof (*vp)); policy_index = vp - im->policies; @@ -188,6 +191,7 @@ ipsec_add_del_policy (vlib_main_t * vm, if (ipsec_policy_is_equal (vp, policy)) { vec_del1 (spd->policies[policy->type], ii); + ipsec_sa_unlock (vp->sa_index); pool_put (im->policies, vp); break; } |