The initial assumption was that the MACIP ACL classifier tables would be applied
after the classification of the traffic based on the ethertype, it turned out
to be untrue, but the fix in the code did not happen.
Add the ethertype to the mask, and the logic to create the ACL classifier tables
permitting the ARP ethertype with the correct payload.
Change-Id: I70236a8a723970c662ddaef6bc9fce93d2e630c1
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
1. vnet_set_input_acl_intfc expects currently applied table ids to
remove them properly, fixed that.
2. check if the interface has MACIP ACL applied before unapplying it
3. if applying MACIP ACL to interface that has one already applied,
unapply that first.
These changes required also swapping the order of the add/del functions.
Change-Id: I179490371507b07e9dd8852000954156c318d98c
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
The is_ip6 flag was incorrectly set during classifier
table creation phase, which intermittently caused the mismatch
between the mask value and the match values, resulting
in dropped packets. Fix that.
Also get rid of the magic numbers in that part of the code.
Change-Id: I0606561e6b07e70a1aa733746b56ed0e91752c94
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
The macros used to verify the validity of sw_if_index passed in
the API calls have puzzled coverity.
Even though the issues are false positives, the checks are rather
simple, so edited them to avoid using the preprocessor macros,
it makes the code easier to follow.
Added the null check for 157336.
Change-Id: I24651346851215b236e53e682261e1f91219b381
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
This is the commit from the accumulated work in the github ACL branch,
to move it to gerrit.
Change-Id: I85a6b0df0d3dd3c3c7588e92a1e22c553e4b6ef7
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
