aboutsummaryrefslogtreecommitdiffstats
path: root/src/vnet/ip/ip_in_out_acl.c
AgeCommit message (Collapse)AuthorFilesLines
2018-10-25ACL: Fix next_table_index classifiers consistancyGregory Thiemonge1-5/+17
Fixed consistancy between the first classifier match and the next_table_index classifier matches: - CLASSIFY_ACTION_SET_METADATA was applied only for the first classifier, but it was not applied for the other classifiers - Actions should be performed only for input ACLs - Payload should point at the IP header for output ACLs Change-Id: Ifbd7791756320ae3198520c41902f5e99e3d40b4 Signed-off-by: Gregory Thiemonge <gregory.thiemonge@enea.com>
2018-02-07classifier-based ACL: refactor + add output ACLAndrew Yourtchenko1-0/+589
For implementation of MACIP ACLs enhancement (VPP-1088), an outbound classifier-based ACL would be needed. There was an existing incomplete code for outbound ACLs, it looked almost exact copy of input ACLs, minus the various enhancements, trying to sync that code seemed error-prone and cumbersome to maintain in the longer run. This change refactors the input+output ACLs processing into a unified routine (thus any changes will have effect on both), and also adds the API to set the output interface ACL, with the same format and semantics as the existing input one (except working on output ACL of course). WARNING: IP outbound ACL in L3 mode clobbers the ip.* fields in the vnet_buffer_opaque_t, since the code is using l2_classify.* The net_buffer (p0)->ip.save_rewrite_length is rescued into l2_classify.pad.l2_len, and used to rewind the header in case of drop, so that ipX_drop prints something sensible. Change-Id: I62f814f1e3650e504474a3a5359edb8a0a8836ed Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>