ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

acl-plugin: VPP-1231: add error checking to acl_plugin_set_acl_vec_for_context

Browse Source 
The users of ACL lookup contexts might not check the data they supply,
so do it on their behalf in this function, and return an error if
an ACL does not exist or if they attempt to apply the same ACL twice.

Change-Id: I89d871e60f267ce643f88574c83baf9cd0a2d7b3
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
This commit is contained in:
Andrew Yourtchenko
2018-04-09 21:46:20 +02:00
committed by Damjan Marion
parent 45d9ba1b32
commit e5cbccf35f
1 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/plugins/acl/lookup_context.c
View File

@ -201,6 +201,9 @@ void acl_plugin_put_lookup_context_index (u32 lc_index)
*/ */
int acl_plugin_set_acl_vec_for_context (u32 lc_index, u32 *acl_list) int acl_plugin_set_acl_vec_for_context (u32 lc_index, u32 *acl_list)
{ {
int rv = 0;
uword *seen_acl_bitmap = 0;
u32 *pacln = 0;
acl_main_t *am = &acl_main; acl_main_t *am = &acl_main;
acl_lookup_context_t *acontext; acl_lookup_context_t *acontext;
if (am->trace_acl) { if (am->trace_acl) {
@ -216,6 +219,25 @@ int acl_plugin_set_acl_vec_for_context (u32 lc_index, u32 *acl_list)
} }
void *oldheap = acl_plugin_set_heap (); void *oldheap = acl_plugin_set_heap ();
vec_foreach (pacln, acl_list)
{
if (pool_is_free_index (am->acls, *pacln))
{
/* ACL is not defined. Can not apply */
clib_warning ("ERROR: ACL %d not defined", *pacln);
rv = VNET_API_ERROR_NO_SUCH_ENTRY;
goto done;
}
if (clib_bitmap_get (seen_acl_bitmap, *pacln))
{
/* ACL being applied twice within the list. error. */
clib_warning ("ERROR: ACL %d being applied twice", *pacln);
rv = VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
goto done;
}
seen_acl_bitmap = clib_bitmap_set (seen_acl_bitmap, *pacln, 1);
}
acontext = pool_elt_at_index(am->acl_lookup_contexts, lc_index); acontext = pool_elt_at_index(am->acl_lookup_contexts, lc_index);
u32 *old_acl_vector = acontext->acl_indices; u32 *old_acl_vector = acontext->acl_indices;
acontext->acl_indices = vec_dup(acl_list); acontext->acl_indices = vec_dup(acl_list);
@ -226,8 +248,11 @@ int acl_plugin_set_acl_vec_for_context (u32 lc_index, u32 *acl_list)
apply_acl_vec(lc_index, acontext->acl_indices); apply_acl_vec(lc_index, acontext->acl_indices);
vec_free(old_acl_vector); vec_free(old_acl_vector);
done:
clib_bitmap_free (seen_acl_bitmap);
clib_mem_set_heap (oldheap); clib_mem_set_heap (oldheap);
return 0; return rv;
} }