+++ /dev/null
-/**
- * @file IxEthDBFirewall.c
- *
- * @brief Implementation of the firewall API
- *
- * @par
- * IXP400 SW Release version 2.0
- *
- * -- Copyright Notice --
- *
- * @par
- * Copyright 2001-2005, Intel Corporation.
- * All rights reserved.
- *
- * @par
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the Intel Corporation nor the names of its contributors
- * may be used to endorse or promote products derived from this software
- * without specific prior written permission.
- *
- * @par
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * @par
- * -- End of Copyright Notice --
- */
-
-
-#include "IxEthDB_p.h"
-
-/**
- * @brief updates the NPE firewall operating mode and
- * firewall address table
- *
- * @param portID ID of the port
- * @param epDelta initial entry point for binary searches (NPE optimization)
- * @param address address of the firewall MAC address table
- *
- * This function will send a message to the NPE configuring the
- * firewall mode (white list or black list), invalid source
- * address filtering and downloading a new MAC address database
- * to be used for firewall matching.
- *
- * @return IX_ETH_DB_SUCCESS if the operation completed
- * successfully or IX_ETH_DB_FAIL otherwise
- *
- * @internal
- */
-IX_ETH_DB_PUBLIC
-IxEthDBStatus ixEthDBFirewallUpdate(IxEthDBPortId portID, void *address, UINT32 epDelta)
-{
- IxNpeMhMessage message;
- IX_STATUS result;
-
- UINT32 mode = 0;
- PortInfo *portInfo = &ixEthDBPortInfo[portID];
-
- mode = (portInfo->srcAddressFilterEnabled != FALSE) << 1 | (portInfo->firewallMode == IX_ETH_DB_FIREWALL_WHITE_LIST);
-
- FILL_SETFIREWALLMODE_MSG(message,
- IX_ETH_DB_PORT_ID_TO_NPE_LOGICAL_ID(portID),
- epDelta,
- mode,
- IX_OSAL_MMU_VIRT_TO_PHYS(address));
-
- IX_ETHDB_SEND_NPE_MSG(IX_ETH_DB_PORT_ID_TO_NPE(portID), message, result);
-
- return result;
-}
-
-/**
- * @brief configures the firewall white list/black list
- * access mode
- *
- * @param portID ID of the port
- * @param mode firewall filtering mode (IX_ETH_DB_FIREWALL_WHITE_LIST
- * or IX_ETH_DB_FIREWALL_BLACK_LIST)
- *
- * Note that this function is documented in the main component
- * header file, IxEthDB.h.
- *
- * @return IX_ETH_DB_SUCCESS if the operation completed
- * successfully or an appropriate error message otherwise
- */
-IX_ETH_DB_PUBLIC
-IxEthDBStatus ixEthDBFirewallModeSet(IxEthDBPortId portID, IxEthDBFirewallMode mode)
-{
- IX_ETH_DB_CHECK_PORT(portID);
-
- IX_ETH_DB_CHECK_SINGLE_NPE(portID);
-
- IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
-
- if (mode != IX_ETH_DB_FIREWALL_WHITE_LIST
- && mode != IX_ETH_DB_FIREWALL_BLACK_LIST)
- {
- return IX_ETH_DB_INVALID_ARG;
- }
-
- ixEthDBPortInfo[portID].firewallMode = mode;
-
- return ixEthDBFirewallTableDownload(portID);
-}
-
-/**
- * @brief enables or disables the invalid source MAC address filter
- *
- * @param portID ID of the port
- * @param enable TRUE to enable invalid source MAC address filtering
- * or FALSE to disable it
- *
- * The invalid source MAC address filter will discard, when enabled,
- * frames whose source MAC address is a multicast or the broadcast MAC
- * address.
- *
- * Note that this function is documented in the main component
- * header file, IxEthDB.h.
- *
- * @return IX_ETH_DB_SUCCESS if the operation completed
- * successfully or an appropriate error message otherwise
- */
-IX_ETH_DB_PUBLIC
-IxEthDBStatus ixEthDBFirewallInvalidAddressFilterEnable(IxEthDBPortId portID, BOOL enable)
-{
- IX_ETH_DB_CHECK_PORT(portID);
-
- IX_ETH_DB_CHECK_SINGLE_NPE(portID);
-
- IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
-
- ixEthDBPortInfo[portID].srcAddressFilterEnabled = enable;
-
- return ixEthDBFirewallTableDownload(portID);
-}
-
-/**
- * @brief adds a firewall record
- *
- * @param portID ID of the port
- * @param macAddr MAC address of the new record
- *
- * This function will add a new firewall record
- * on the specified port, using the specified
- * MAC address. If the record already exists this
- * function will silently return IX_ETH_DB_SUCCESS,
- * although no duplicate records are added.
- *
- * Note that this function is documented in the main
- * component header file, IxEthDB.h.
- *
- * @return IX_ETH_DB_SUCCESS if the operation completed
- * successfully or an appropriate error message otherwise
- */
-IX_ETH_DB_PUBLIC
-IxEthDBStatus ixEthDBFirewallEntryAdd(IxEthDBPortId portID, IxEthDBMacAddr *macAddr)
-{
- MacDescriptor recordTemplate;
-
- IX_ETH_DB_CHECK_PORT(portID);
-
- IX_ETH_DB_CHECK_SINGLE_NPE(portID);
-
- IX_ETH_DB_CHECK_REFERENCE(macAddr);
-
- IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
-
- memcpy(recordTemplate.macAddress, macAddr, sizeof (IxEthDBMacAddr));
-
- recordTemplate.type = IX_ETH_DB_FIREWALL_RECORD;
- recordTemplate.portID = portID;
-
- return ixEthDBAdd(&recordTemplate, NULL);
-}
-
-/**
- * @brief removes a firewall record
- *
- * @param portID ID of the port
- * @param macAddr MAC address of the record to remove
- *
- * This function will attempt to remove a firewall
- * record from the given port, using the specified
- * MAC address.
- *
- * Note that this function is documented in the main
- * component header file, IxEthDB.h.
- *
- * @return IX_ETH_DB_SUCCESS if the operation completed
- * successfully of an appropriate error message otherwise
- */
-IX_ETH_DB_PUBLIC
-IxEthDBStatus ixEthDBFirewallEntryRemove(IxEthDBPortId portID, IxEthDBMacAddr *macAddr)
-{
- MacDescriptor recordTemplate;
-
- IX_ETH_DB_CHECK_PORT(portID);
-
- IX_ETH_DB_CHECK_SINGLE_NPE(portID);
-
- IX_ETH_DB_CHECK_REFERENCE(macAddr);
-
- IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
-
- memcpy(recordTemplate.macAddress, macAddr, sizeof (IxEthDBMacAddr));
-
- recordTemplate.type = IX_ETH_DB_FIREWALL_RECORD;
- recordTemplate.portID = portID;
-
- return ixEthDBRemove(&recordTemplate, NULL);
-}
-
-/**
- * @brief downloads the firewall address table to an NPE
- *
- * @param portID ID of the port
- *
- * This function will download the firewall address table to
- * an NPE port.
- *
- * Note that this function is documented in the main
- * component header file, IxEthDB.h.
- *
- * @return IX_ETH_DB_SUCCESS if the operation completed
- * successfully or IX_ETH_DB_FAIL otherwise
- */
-IX_ETH_DB_PUBLIC
-IxEthDBStatus ixEthDBFirewallTableDownload(IxEthDBPortId portID)
-{
- IxEthDBPortMap query;
- IxEthDBStatus result;
-
- IX_ETH_DB_CHECK_PORT(portID);
-
- IX_ETH_DB_CHECK_SINGLE_NPE(portID);
-
- IX_ETH_DB_CHECK_FEATURE(portID, IX_ETH_DB_FIREWALL);
-
- SET_DEPENDENCY_MAP(query, portID);
-
- ixEthDBUpdateLock();
-
- ixEthDBPortInfo[portID].updateMethod.searchTree = ixEthDBQuery(NULL, query, IX_ETH_DB_FIREWALL_RECORD, MAX_FW_SIZE);
-
- result = ixEthDBNPEUpdateHandler(portID, IX_ETH_DB_FIREWALL_RECORD);
-
- ixEthDBUpdateUnlock();
-
- return result;
-}
projects / u-boot / blobdiff