IxEthDBFirewall.c 6.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242
  1. /**
  2. * @file IxEthDBFirewall.c
  3. *
  4. * @brief Implementation of the firewall API
  5. *
  6. * @par
  7. * IXP400 SW Release version 2.0
  8. *
  9. * -- Copyright Notice --
  10. *
  11. * @par
  12. * Copyright 2001-2005, Intel Corporation.
  13. * All rights reserved.
  14. *
  15. * @par
  16. * SPDX-License-Identifier: BSD-3-Clause
  17. * @par
  18. * -- End of Copyright Notice --
  19. */
  20. #include "IxEthDB_p.h"
  21. /**
  22. * @brief updates the NPE firewall operating mode and
  23. * firewall address table
  24. *
  25. * @param portID ID of the port
  26. * @param epDelta initial entry point for binary searches (NPE optimization)
  27. * @param address address of the firewall MAC address table
  28. *
  29. * This function will send a message to the NPE configuring the
  30. * firewall mode (white list or black list), invalid source
  31. * address filtering and downloading a new MAC address database
  32. * to be used for firewall matching.
  33. *
  34. * @return IX_ETH_DB_SUCCESS if the operation completed
  35. * successfully or IX_ETH_DB_FAIL otherwise
  36. *
  37. * @internal
  38. */
  39. IX_ETH_DB_PUBLIC
  40. IxEthDBStatus ixEthDBFirewallUpdate(IxEthDBPortId portID, void *address, UINT32 epDelta)
  41. {
  42. IxNpeMhMessage message;
  43. IX_STATUS result;
  44. UINT32 mode = 0;
  45. PortInfo *portInfo = &ixEthDBPortInfo[portID];
  46. mode = (portInfo->srcAddressFilterEnabled != false) << 1 | (portInfo->firewallMode == IX_ETH_DB_FIREWALL_WHITE_LIST);
  47. FILL_SETFIREWALLMODE_MSG(message,
  48. IX_ETH_DB_PORT_ID_TO_NPE_LOGICAL_ID(portID),
  49. epDelta,
  50. mode,
  51. IX_OSAL_MMU_VIRT_TO_PHYS(address));
  52. IX_ETHDB_SEND_NPE_MSG(IX_ETH_DB_PORT_ID_TO_NPE(portID), message, result);
  53. return result;
  54. }
  55. /**
  56. * @brief configures the firewall white list/black list
  57. * access mode
  58. *
  59. * @param portID ID of the port
  60. * @param mode firewall filtering mode (IX_ETH_DB_FIREWALL_WHITE_LIST
  61. * or IX_ETH_DB_FIREWALL_BLACK_LIST)
  62. *
  63. * Note that this function is documented in the main component
  64. * header file, IxEthDB.h.
  65. *
  66. * @return IX_ETH_DB_SUCCESS if the operation completed
  67. * successfully or an appropriate error message otherwise
  68. */
  69. IX_ETH_DB_PUBLIC
  70. IxEthDBStatus ixEthDBFirewallModeSet(IxEthDBPortId portID, IxEthDBFirewallMode mode)
  71. {
  72. IX_ETH_DB_CHECK_PORT(portID);
  73. IX_ETH_DB_CHECK_SINGLE_NPE(portID);
  74. IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
  75. if (mode != IX_ETH_DB_FIREWALL_WHITE_LIST
  76. && mode != IX_ETH_DB_FIREWALL_BLACK_LIST)
  77. {
  78. return IX_ETH_DB_INVALID_ARG;
  79. }
  80. ixEthDBPortInfo[portID].firewallMode = mode;
  81. return ixEthDBFirewallTableDownload(portID);
  82. }
  83. /**
  84. * @brief enables or disables the invalid source MAC address filter
  85. *
  86. * @param portID ID of the port
  87. * @param enable true to enable invalid source MAC address filtering
  88. * or false to disable it
  89. *
  90. * The invalid source MAC address filter will discard, when enabled,
  91. * frames whose source MAC address is a multicast or the broadcast MAC
  92. * address.
  93. *
  94. * Note that this function is documented in the main component
  95. * header file, IxEthDB.h.
  96. *
  97. * @return IX_ETH_DB_SUCCESS if the operation completed
  98. * successfully or an appropriate error message otherwise
  99. */
  100. IX_ETH_DB_PUBLIC
  101. IxEthDBStatus ixEthDBFirewallInvalidAddressFilterEnable(IxEthDBPortId portID, BOOL enable)
  102. {
  103. IX_ETH_DB_CHECK_PORT(portID);
  104. IX_ETH_DB_CHECK_SINGLE_NPE(portID);
  105. IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
  106. ixEthDBPortInfo[portID].srcAddressFilterEnabled = enable;
  107. return ixEthDBFirewallTableDownload(portID);
  108. }
  109. /**
  110. * @brief adds a firewall record
  111. *
  112. * @param portID ID of the port
  113. * @param macAddr MAC address of the new record
  114. *
  115. * This function will add a new firewall record
  116. * on the specified port, using the specified
  117. * MAC address. If the record already exists this
  118. * function will silently return IX_ETH_DB_SUCCESS,
  119. * although no duplicate records are added.
  120. *
  121. * Note that this function is documented in the main
  122. * component header file, IxEthDB.h.
  123. *
  124. * @return IX_ETH_DB_SUCCESS if the operation completed
  125. * successfully or an appropriate error message otherwise
  126. */
  127. IX_ETH_DB_PUBLIC
  128. IxEthDBStatus ixEthDBFirewallEntryAdd(IxEthDBPortId portID, IxEthDBMacAddr *macAddr)
  129. {
  130. MacDescriptor recordTemplate;
  131. IX_ETH_DB_CHECK_PORT(portID);
  132. IX_ETH_DB_CHECK_SINGLE_NPE(portID);
  133. IX_ETH_DB_CHECK_REFERENCE(macAddr);
  134. IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
  135. memcpy(recordTemplate.macAddress, macAddr, sizeof (IxEthDBMacAddr));
  136. recordTemplate.type = IX_ETH_DB_FIREWALL_RECORD;
  137. recordTemplate.portID = portID;
  138. return ixEthDBAdd(&recordTemplate, NULL);
  139. }
  140. /**
  141. * @brief removes a firewall record
  142. *
  143. * @param portID ID of the port
  144. * @param macAddr MAC address of the record to remove
  145. *
  146. * This function will attempt to remove a firewall
  147. * record from the given port, using the specified
  148. * MAC address.
  149. *
  150. * Note that this function is documented in the main
  151. * component header file, IxEthDB.h.
  152. *
  153. * @return IX_ETH_DB_SUCCESS if the operation completed
  154. * successfully of an appropriate error message otherwise
  155. */
  156. IX_ETH_DB_PUBLIC
  157. IxEthDBStatus ixEthDBFirewallEntryRemove(IxEthDBPortId portID, IxEthDBMacAddr *macAddr)
  158. {
  159. MacDescriptor recordTemplate;
  160. IX_ETH_DB_CHECK_PORT(portID);
  161. IX_ETH_DB_CHECK_SINGLE_NPE(portID);
  162. IX_ETH_DB_CHECK_REFERENCE(macAddr);
  163. IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
  164. memcpy(recordTemplate.macAddress, macAddr, sizeof (IxEthDBMacAddr));
  165. recordTemplate.type = IX_ETH_DB_FIREWALL_RECORD;
  166. recordTemplate.portID = portID;
  167. return ixEthDBRemove(&recordTemplate, NULL);
  168. }
  169. /**
  170. * @brief downloads the firewall address table to an NPE
  171. *
  172. * @param portID ID of the port
  173. *
  174. * This function will download the firewall address table to
  175. * an NPE port.
  176. *
  177. * Note that this function is documented in the main
  178. * component header file, IxEthDB.h.
  179. *
  180. * @return IX_ETH_DB_SUCCESS if the operation completed
  181. * successfully or IX_ETH_DB_FAIL otherwise
  182. */
  183. IX_ETH_DB_PUBLIC
  184. IxEthDBStatus ixEthDBFirewallTableDownload(IxEthDBPortId portID)
  185. {
  186. IxEthDBPortMap query;
  187. IxEthDBStatus result;
  188. IX_ETH_DB_CHECK_PORT(portID);
  189. IX_ETH_DB_CHECK_SINGLE_NPE(portID);
  190. IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
  191. SET_DEPENDENCY_MAP(query, portID);
  192. ixEthDBUpdateLock();
  193. ixEthDBPortInfo[portID].updateMethod.searchTree = ixEthDBQuery(NULL, query, IX_ETH_DB_FIREWALL_RECORD, MAX_FW_SIZE);
  194. result = ixEthDBNPEUpdateHandler(portID, IX_ETH_DB_FIREWALL_RECORD);
  195. ixEthDBUpdateUnlock();
  196. return result;
  197. }