summaryrefslogtreecommitdiffstats
path: root/plugins/acl-plugin/acl
AgeCommit message (Collapse)AuthorFilesLines
2017-01-03VPP-574: fix the MACIP ACLs blocking ARP trafficAndrew Yourtchenko1-0/+47
The initial assumption was that the MACIP ACL classifier tables would be applied after the classification of the traffic based on the ethertype, it turned out to be untrue, but the fix in the code did not happen. Add the ethertype to the mask, and the logic to create the ACL classifier tables permitting the ARP ethertype with the correct payload. Change-Id: I70236a8a723970c662ddaef6bc9fce93d2e630c1 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
2016-12-16Coverity fixes, VPP-486Dave Barach1-2/+2
Change-Id: I8906bb983128e8f6e2664e367d2015325c1125fb Signed-off-by: Dave Barach <dave@barachs.net>
2016-12-08acl: make MACIP ACL apply/unapply/delete logic more robustAndrew Yourtchenko1-11/+26
1. vnet_set_input_acl_intfc expects currently applied table ids to remove them properly, fixed that. 2. check if the interface has MACIP ACL applied before unapplying it 3. if applying MACIP ACL to interface that has one already applied, unapply that first. These changes required also swapping the order of the add/del functions. Change-Id: I179490371507b07e9dd8852000954156c318d98c Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
2016-12-08Fix incorrect creation of classifier entries for macip ACLAndrew Yourtchenko1-9/+31
The is_ip6 flag was incorrectly set during classifier table creation phase, which intermittently caused the mismatch between the mask value and the match values, resulting in dropped packets. Fix that. Also get rid of the magic numbers in that part of the code. Change-Id: I0606561e6b07e70a1aa733746b56ed0e91752c94 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
2016-12-07Acl JVpp api generation (HONEYCOMB-305)Jan Srnicek7-0/+615
Includes simple test cases for acl management. Change-Id: Ifff4f4baf9bfe84d73ebc46b591ecc46c85c94ad Signed-off-by: Jan Srnicek <jsrnicek@cisco.com> Signed-off-by: Marek Gradzki <mgradzki@cisco.com>
2016-12-07Fix coverity CIDs 157344, 157343, 157341, 157340, 157339, 157336Andrew Yourtchenko2-46/+30
The macros used to verify the validity of sw_if_index passed in the API calls have puzzled coverity. Even though the issues are false positives, the checks are rather simple, so edited them to avoid using the preprocessor macros, it makes the code easier to follow. Added the null check for 157336. Change-Id: I24651346851215b236e53e682261e1f91219b381 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
2016-12-07Make table chain deletion optional in classifier API (VPP-206)Juraj Sloboda1-2/+4
Change-Id: If30c0f6d5de34943bc399b3412c2d10847538c3c Signed-off-by: Juraj Sloboda <jsloboda@cisco.com>
2016-12-06acl: The ACL plugin.Andrew Yourtchenko13-0/+5419
This is the commit from the accumulated work in the github ACL branch, to move it to gerrit. Change-Id: I85a6b0df0d3dd3c3c7588e92a1e22c553e4b6ef7 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>