ACL plugin rejects ICMP messages (VPP-624)

[vpp.git] / src / plugins / acl / acl.c

diff --git a/src/plugins/acl/acl.c b/src/plugins/acl/acl.c
index f4db201..b6af738 100644 (file)
--- a/src/plugins/acl/acl.c
+++ b/src/plugins/acl/acl.c
@@ -22,6 +22,7 @@
 
 #include <vnet/l2/l2_classify.h>
 #include <vnet/classify/input_acl.h>
+#include <vpp/app/version.h>
 
 #include <vlibapi/api.h>
 #include <vlibmemory/api.h>
@@ -128,29 +129,11 @@ _(MACIP_ACL_INTERFACE_ADD_DEL, macip_acl_interface_add_del) \
 _(MACIP_ACL_DUMP, macip_acl_dump) \
 _(MACIP_ACL_INTERFACE_GET, macip_acl_interface_get)
 
-/*
- * This routine exists to convince the vlib plugin framework that
- * we haven't accidentally copied a random .dll into the plugin directory.
- *
- * Also collects global variable pointers passed from the vpp engine
- */
-
-clib_error_t *
-vlib_plugin_register (vlib_main_t * vm, vnet_plugin_handoff_t * h,
-                     int from_early_init)
-{
-  acl_main_t *am = &acl_main;
-  clib_error_t *error = 0;
-
-  am->vlib_main = vm;
-  am->vnet_main = h->vnet_main;
-  am->ethernet_main = h->ethernet_main;
-
-  l2sess_vlib_plugin_register(vm, h, from_early_init);
-
-  return error;
-}
-
+/* *INDENT-OFF* */
+VLIB_PLUGIN_REGISTER () = {
+    .version = VPP_BUILD_VER,
+};
+/* *INDENT-ON* */
 
 static void
 vl_api_acl_plugin_get_version_t_handler (vl_api_acl_plugin_get_version_t * mp)
@@ -225,10 +208,10 @@ acl_add_list (u32 count, vl_api_acl_rule_t rules[],
       r->src_prefixlen = rules[i].src_ip_prefix_len;
       r->dst_prefixlen = rules[i].dst_ip_prefix_len;
       r->proto = rules[i].proto;
-      r->src_port_or_type_first = rules[i].srcport_or_icmptype_first;
-      r->src_port_or_type_last = rules[i].srcport_or_icmptype_last;
-      r->dst_port_or_code_first = rules[i].dstport_or_icmpcode_first;
-      r->dst_port_or_code_last = rules[i].dstport_or_icmpcode_last;
+      r->src_port_or_type_first = ntohs ( rules[i].srcport_or_icmptype_first );
+      r->src_port_or_type_last = ntohs ( rules[i].srcport_or_icmptype_last );
+      r->dst_port_or_code_first = ntohs ( rules[i].dstport_or_icmpcode_first );
+      r->dst_port_or_code_last = ntohs ( rules[i].dstport_or_icmpcode_last );
       r->tcp_flags_value = rules[i].tcp_flags_value;
       r->tcp_flags_mask = rules[i].tcp_flags_mask;
     }
@@ -856,8 +839,8 @@ acl_packet_match (acl_main_t * am, u32 acl_index, vlib_buffer_t * b0,
   int is_ip6;
   int is_ip4;
   u8 proto;
-  u16 src_port;
-  u16 dst_port;
+  u16 src_port = 0;
+  u16 dst_port = 0;
   u8 tcp_flags = 0;
   int i;
   acl_list_t *a;
@@ -883,15 +866,13 @@ acl_packet_match (acl_main_t * am, u32 acl_index, vlib_buffer_t * b0,
        {
          *trace_bitmap |= 0x00000001;
          /* type */
-         src_port = *(u8 *) get_ptr_to_offset (b0, 34);
+         src_port = ((u16) (*(u8 *) get_ptr_to_offset (b0, 34)));
          /* code */
-         dst_port = *(u8 *) get_ptr_to_offset (b0, 35);
-       }
-      else
-       {
+         dst_port = ((u16) (*(u8 *) get_ptr_to_offset (b0, 35)));
+       } else {
          /* assume TCP/UDP */
-         src_port = (*(u16 *) get_ptr_to_offset (b0, 34));
-         dst_port = (*(u16 *) get_ptr_to_offset (b0, 36));
+         src_port = ntohs ((u16) (*(u16 *) get_ptr_to_offset (b0, 34)));
+         dst_port = ntohs ((u16) (*(u16 *) get_ptr_to_offset (b0, 36)));
          /* UDP gets ability to check on an oddball data byte as a bonus */
          tcp_flags = *(u8 *) get_ptr_to_offset (b0, 14 + 20 + 13);
        }
@@ -905,15 +886,15 @@ acl_packet_match (acl_main_t * am, u32 acl_index, vlib_buffer_t * b0,
        {
          *trace_bitmap |= 0x00000002;
          /* type */
-         src_port = *(u8 *) get_ptr_to_offset (b0, 54);
+         src_port = (u16) (*(u8 *) get_ptr_to_offset (b0, 54));
          /* code */
-         dst_port = *(u8 *) get_ptr_to_offset (b0, 55);
+         dst_port = (u16) (*(u8 *) get_ptr_to_offset (b0, 55));
        }
       else
        {
          /* assume TCP/UDP */
-         src_port = (*(u16 *) get_ptr_to_offset (b0, 54));
-         dst_port = (*(u16 *) get_ptr_to_offset (b0, 56));
+         src_port = ntohs ((u16) (*(u16 *) get_ptr_to_offset (b0, 54)));
+         dst_port = ntohs ((u16) (*(u16 *) get_ptr_to_offset (b0, 56)));
          tcp_flags = *(u8 *) get_ptr_to_offset (b0, 14 + 40 + 13);
        }
     }
@@ -1502,10 +1483,10 @@ copy_acl_rule_to_api_rule (vl_api_acl_rule_t * api_rule, acl_rule_t * r)
   api_rule->src_ip_prefix_len = r->src_prefixlen;
   api_rule->dst_ip_prefix_len = r->dst_prefixlen;
   api_rule->proto = r->proto;
-  api_rule->srcport_or_icmptype_first = r->src_port_or_type_first;
-  api_rule->srcport_or_icmptype_last = r->src_port_or_type_last;
-  api_rule->dstport_or_icmpcode_first = r->dst_port_or_code_first;
-  api_rule->dstport_or_icmpcode_last = r->dst_port_or_code_last;
+  api_rule->srcport_or_icmptype_first = htons (r->src_port_or_type_first);
+  api_rule->srcport_or_icmptype_last = htons (r->src_port_or_type_last);
+  api_rule->dstport_or_icmpcode_first = htons (r->dst_port_or_code_first);
+  api_rule->dstport_or_icmpcode_last = htons (r->dst_port_or_code_last);
   api_rule->tcp_flags_mask = r->tcp_flags_mask;
   api_rule->tcp_flags_value = r->tcp_flags_value;
 }
@@ -1900,7 +1881,11 @@ acl_setup_nodes (void)
 
   feat_bitmap_init_next_nodes (vm, acl_in_node.index, L2INPUT_N_FEAT,
                               l2input_get_feat_names (),
-                              am->acl_in_node_input_next_node_index);
+                              am->acl_in_node_feat_next_node_index);
+
+  feat_bitmap_init_next_nodes (vm, acl_out_node.index, L2OUTPUT_N_FEAT,
+                              l2output_get_feat_names (),
+                              am->acl_out_node_feat_next_node_index);
 
   memset (&am->acl_in_ip4_match_next[0], 0,
          sizeof (am->acl_in_ip4_match_next));