| /* |
| * Copyright (c) 2012, 2017, The Linux Foundation. All rights reserved. |
| * Permission to use, copy, modify, and/or distribute this software for |
| * any purpose with or without fee is hereby granted, provided that the |
| * above copyright notice and this permission notice appear in all copies. |
| * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT |
| * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| */ |
| |
| |
| #ifdef KVER32 |
| #include <linux/kconfig.h> |
| #include <generated/autoconf.h> |
| #else |
| #include <linux/autoconf.h> |
| #endif |
| #include <linux/if_arp.h> |
| #include <linux/netdevice.h> |
| |
| #include "napt_acl.h" |
| #include "nat_helper.h" |
| #include "lib/nat_helper_hsl.h" |
| #include "hsl_shared_api.h" |
| |
| static uint32_t aclrulemask = 0; |
| extern int nat_chip_ver; |
| |
| uint32_t |
| get_aclrulemask(void) |
| { |
| uint32_t ret; |
| unsigned long flags; |
| |
| local_irq_save(flags); |
| ret = aclrulemask; |
| local_irq_restore(flags); |
| |
| return ret; |
| } |
| |
| void |
| set_aclrulemask(uint32_t acl_list) |
| { |
| unsigned long flags; |
| |
| local_irq_save(flags); |
| aclrulemask |= 1<<acl_list; |
| local_irq_restore(flags); |
| |
| return; |
| } |
| |
| void |
| unset_aclrulemask(uint32_t acl_list) |
| { |
| unsigned long flags; |
| |
| local_irq_save(flags); |
| aclrulemask &= ~(1<<acl_list); |
| local_irq_restore(flags); |
| |
| return; |
| } |
| |
| /* |
| * set the IPv4 default route (to the next hop) |
| */ |
| void |
| droute_add_acl_rules(uint32_t local_ip, uint32_t local_ip_mask, uint32_t gw_entry_id) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| int i; |
| |
| if (get_aclrulemask() & (1 << S17_ACL_LIST_DROUTE)) |
| return; |
| |
| aos_printk("Adding ACL rules %d - Default Route \n", S17_ACL_LIST_DROUTE); |
| |
| printk("%s %d: 0x%08x\n", __FUNCTION__, __LINE__, ntohl(local_ip)); |
| |
| memset(&myacl, 0, sizeof(fal_acl_rule_t)); |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| myacl.dest_ip4_val = ntohl(local_ip); |
| myacl.dest_ip4_mask = ntohl(local_ip_mask); |
| /* |
| IPv4 rule, with DIP field |
| if DIP != Lan IP, force the ARP index redirect to the next hop |
| enable packet forwarding & forward only. i.e. no FORCE_L3_MODE |
| ARP_INDEX_EN, to the next hop ARP index, bind on LAN ports |
| */ |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_INVERSE_ALL ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP4_DIP ); |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_ARP_EN ); |
| |
| myacl.arp_ptr = gw_entry_id; |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_DROUTE, S17_ACL_LIST_PRIO_HIGH); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk("ACL_LIST_CREATE ERROR...\n" ); |
| aos_printk("already created!? \n"); |
| return ; |
| } |
| |
| rtnval = ACL_RULE_ADD (0, S17_ACL_LIST_DROUTE, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "ACL_RULE_ADD ERROR...\n" ); |
| return ; |
| } |
| |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND (0, S17_ACL_LIST_DROUTE, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| /* check for the ACL enable bit */ |
| if (ACL_STATUS_GET(0, &val) == SW_OK) |
| { |
| if (val != A_TRUE) |
| { |
| aos_printk("ACL is not yet enabled. Enabling... \n"); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| |
| set_aclrulemask(S17_ACL_LIST_DROUTE); |
| } |
| void |
| droute_del_acl_rules(void) |
| { |
| int i; |
| |
| if (!(get_aclrulemask() & (1 << S17_ACL_LIST_DROUTE))) |
| return; |
| |
| HNAT_PRINTK("IPv4 default route del rule #%d\n", S17_ACL_LIST_DROUTE); |
| |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_DROUTE, |
| FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| ACL_RULE_DEL(0, S17_ACL_LIST_DROUTE, 0, 1); |
| |
| |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_DROUTE); |
| |
| unset_aclrulemask(S17_ACL_LIST_DROUTE); |
| } |
| |
| /* |
| * set the IPv6 default route (to the next hop) |
| */ |
| void |
| ipv6_droute_add_acl_rules(struct in6_addr *local_ip, uint32_t gw_entry_id) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| int i; |
| |
| if (get_aclrulemask() & (1 << S17_ACL_LIST_IPV6DROUTE)) |
| return; |
| |
| printk("Adding ACL rules %d - IPv6 Default Route \n", S17_ACL_LIST_IPV6DROUTE); |
| |
| memset(&myacl, 0, sizeof(fal_acl_rule_t)); |
| myacl.rule_type = FAL_ACL_RULE_IP6; |
| |
| myacl.dest_ip6_val.ul[0] = local_ip->s6_addr32[0]; /* FF02::1:FF00:0000/104 */ |
| myacl.dest_ip6_val.ul[1] = local_ip->s6_addr32[1]; |
| myacl.dest_ip6_val.ul[2] = local_ip->s6_addr32[2]; |
| myacl.dest_ip6_val.ul[3] = local_ip->s6_addr32[3]; |
| myacl.dest_ip6_mask.ul[0] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[1] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[2] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[3] = 0xff000000; |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_INVERSE_ALL ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_ARP_EN ); |
| |
| myacl.arp_ptr = gw_entry_id; |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_IPV6DROUTE, S17_ACL_LIST_PRIO_HIGH); |
| if ( rtnval != SW_OK ) |
| { |
| printk("qcaswitch_acl_list_creat ERROR...\n" ); |
| printk("already created!? \n"); |
| return ; |
| } |
| |
| rtnval = ACL_RULE_ADD (0, S17_ACL_LIST_IPV6DROUTE, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| printk ( "qcaswitch_acl_rule_add ERROR...\n" ); |
| return ; |
| } |
| |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND (0, S17_ACL_LIST_IPV6DROUTE, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| /* check for the ACL enable bit */ |
| if (ACL_STATUS_GET(0, &val) == SW_OK) |
| { |
| if (val != A_TRUE) |
| { |
| printk("ACL is not yet enabled. Enabling... \n"); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| |
| set_aclrulemask(S17_ACL_LIST_IPV6DROUTE); |
| } |
| |
| /* |
| * Del Default Route ACL rules |
| */ |
| void ipv6_droute_del_acl_rules(void) |
| { |
| int i; |
| |
| HNAT_PRINTK("IPv6 default route del rule #%d\n", S17_ACL_LIST_IPV6DROUTE); |
| |
| if (!(get_aclrulemask() & (1 << S17_ACL_LIST_IPV6DROUTE))) |
| return; |
| |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_IPV6DROUTE, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| ACL_RULE_DEL(0, S17_ACL_LIST_IPV6DROUTE, 0, 1); |
| |
| |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_IPV6DROUTE); |
| |
| unset_aclrulemask(S17_ACL_LIST_IPV6DROUTE); |
| } |
| |
| |
| static int isis_pppoe_del_rule0(void) |
| { |
| int rtnval; |
| |
| rtnval = ACL_LIST_UNBIND(0, S17_ACL_LIST_PPPOE, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT); |
| if (rtnval != SW_OK) |
| aos_printk("unbind error... \n"); |
| |
| rtnval = ACL_RULE_DEL(0, S17_ACL_LIST_PPPOE, 0, 1); |
| if (rtnval != SW_OK) |
| aos_printk("delete error... \n"); |
| |
| rtnval = ACL_LIST_DESTROY(0, S17_ACL_LIST_PPPOE); |
| if (rtnval != SW_OK) |
| aos_printk("destroy error... \n"); |
| |
| return rtnval; |
| } |
| |
| |
| /* |
| * PPPoE ACL rules |
| * Force ARP_INDEX_EN to the next hop for CPU port |
| * Force SNAT and ARP_INDEX_EN to the next hop for LAN ports |
| */ |
| void pppoe_add_acl_rules( |
| uint32_t wan_ip, uint32_t local_ip, |
| uint32_t local_ip_mask, uint32_t gw_entry_id) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval, cnt; |
| a_bool_t val; |
| int i; |
| |
| /* do the 1st, 2nd and 3rd rules */ |
| for (cnt = 0; cnt < 3; cnt++) |
| { |
| memset(&myacl, 0, sizeof(fal_acl_rule_t)); |
| |
| switch (cnt) |
| { |
| case 0: |
| if (((nat_chip_ver & 0xffff)>>8) != NAT_CHIP_VER_8327) |
| break; |
| |
| aos_printk("PPPoE adding rule #%d\n", S17_ACL_LIST_PPPOE); |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| myacl.src_ip4_val = wan_ip; |
| myacl.src_ip4_mask = 0xffffffff; |
| aos_printk("WAN IP: %.8x\n", wan_ip); |
| /* |
| IPv4 rule, with SIP field |
| IF SIP == WAN IP, FORCE the ARP_INDEX_EN to the PPPoE ARP INDEX |
| enable packet forwarding & forward only. i.e. no FORCE_L3_MODE |
| ARP_INDEX_EN, to the PPPoE peer ARP index, |
| Change the CVID to WAN_VID (2) |
| Bind to CPU port |
| */ |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_IP4_SIP); |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_MAC_CTAG_VID); |
| |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_ARP_EN); |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_REMARK_CTAG_VID); |
| |
| myacl.arp_ptr = gw_entry_id; |
| /* fixed with CVID = 2 */ |
| myacl.ctag_vid = 2; |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_PPPOE, S17_ACL_LIST_PRIO_HIGH); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_LIST_CREATE ERROR...\n"); |
| aos_printk("PPPoE Session ID changed !? \n"); |
| /* delete the old ACL list */ |
| rtnval = isis_pppoe_del_rule0(); |
| if (rtnval != SW_OK) |
| aos_printk("pppoe_del_rule0: %d \n", rtnval); |
| |
| /* create the ACL list again */ |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_PPPOE, S17_ACL_LIST_PRIO_HIGH); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_LIST_CREATE ERROR...\n"); |
| break; |
| } |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_LIST_PPPOE, 0, 1, &myacl); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_RULE_ADD ERROR...\n"); |
| break; |
| } |
| |
| ACL_LIST_BIND(0, S17_ACL_LIST_PPPOE, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT_W); |
| |
| break; |
| |
| case 1: |
| aos_printk("PPPoE adding rule #%d\n", S17_ACL_LIST_PPPOE+1); |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| myacl.dest_ip4_val = ntohl(local_ip); |
| myacl.dest_ip4_mask = ntohl(local_ip_mask); |
| |
| /* |
| IPv4 rule, with DIP field |
| IF DIP != LAN IP, FORCE the ARP_INDEX_EN to the PPPoE ARP INDEX |
| AND FORCE L3 SNAT |
| ARP_INDEX_EN, to the PPPoE peer ARP index |
| Bind to LAN ports |
| */ |
| |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_INVERSE_ALL); |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_IP4_DIP); |
| |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_POLICY_FORWARD_EN); |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_ARP_EN); |
| |
| myacl.arp_ptr = gw_entry_id; |
| myacl.policy_fwd = FAL_ACL_POLICY_SNAT; |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_PPPOE+1, S17_ACL_LIST_PRIO_HIGH); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_LIST_CREATE ERROR...\n"); |
| break; |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_LIST_PPPOE+1, 0, 1, &myacl); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_RULE_ADD ERROR...\n"); |
| break; |
| } |
| /* bind to LAN ports (1-4) */ |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND(0, S17_ACL_LIST_PPPOE+1, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| break; |
| |
| case 2: |
| /* |
| User defined filter ACL |
| filter out 0x8100000288641100 packets and set the CVID to |
| a predefined VID (100 in this case) |
| ARP_INDEX_EN, to the PPPoE peer ARP index |
| Bind to CPU port |
| */ |
| aos_printk("PPPoE adding rule #%d\n", S17_ACL_LIST_PPPOE+2); |
| myacl.rule_type = FAL_ACL_RULE_UDF; |
| /* set the UDP ACL type as L2, with length 8, offset 12 */ |
| ACL_PORT_UDF_PROFILE_SET(0, S17_CPU_PORT, FAL_ACL_UDF_TYPE_L2, 12, 8); |
| myacl.udf_len = 8; |
| myacl.udf_offset = 12; |
| myacl.udf_type = FAL_ACL_UDF_TYPE_L2; |
| memset(&myacl.udf_val, 0, sizeof(myacl.udf_val)); |
| memset(&myacl.udf_mask, 0, sizeof(myacl.udf_mask)); |
| /* UDF filter to check for 0x8100000288641100 packets */ |
| myacl.udf_val[0] = 0x81; |
| myacl.udf_val[1] = 0x00; |
| myacl.udf_val[2] = 0x00; |
| myacl.udf_val[3] = 0x02; |
| myacl.udf_val[4] = 0x88; |
| myacl.udf_val[5] = 0x64; |
| myacl.udf_val[6] = 0x11; |
| myacl.udf_val[7] = 0x00; |
| |
| myacl.udf_mask[0] = 0xff; |
| myacl.udf_mask[1] = 0xff; |
| myacl.udf_mask[2] = 0xff; |
| myacl.udf_mask[3] = 0xff; |
| myacl.udf_mask[4] = 0xff; |
| myacl.udf_mask[5] = 0xff; |
| myacl.udf_mask[6] = 0xff; |
| myacl.udf_mask[7] = 0xff; |
| |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_UDF); |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_MAC_CTAG_VID); |
| |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_ARP_EN); |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_REMARK_CTAG_VID); |
| |
| myacl.arp_ptr = gw_entry_id; |
| /* fixed with CVID = 100 */ |
| myacl.ctag_vid = 100; |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_PPPOE + 2, S17_ACL_LIST_PRIO_HIGH); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_LIST_CREATE ERROR...\n"); |
| break; |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_LIST_PPPOE + 2, 0, 1, &myacl); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_RULE_ADD ERROR...\n"); |
| break; |
| } |
| |
| ACL_LIST_BIND(0, S17_ACL_LIST_PPPOE + 2, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT); |
| break; |
| } |
| } |
| |
| if (ACL_STATUS_GET(0, &val) == SW_OK) |
| { |
| if (val != A_TRUE) |
| { |
| aos_printk("ACL is not yet enabled. Enabling... \n"); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| } |
| |
| static void pppoe_del_acl_rule1(void) |
| { |
| int i; |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_PPPOE+1, |
| FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| ACL_RULE_DEL(0, S17_ACL_LIST_PPPOE+1, 0, 1); |
| |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_PPPOE+1); |
| } |
| |
| static void pppoe_del_acl_rule2(void) |
| { |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_PPPOE+2, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT); |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_PPPOE+2, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_LAN_PORT1); |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_PPPOE+2, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_LAN_PORT2); |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_PPPOE+2, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_LAN_PORT3); |
| |
| ACL_RULE_DEL(0, S17_ACL_LIST_PPPOE+2, 0, 1); |
| |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_PPPOE+2); |
| } |
| void pppoe_del_acl_rules(void) |
| { |
| if (((nat_chip_ver & 0xffff)>>8) == NAT_CHIP_VER_8327) |
| isis_pppoe_del_rule0(); |
| pppoe_del_acl_rule1(); |
| pppoe_del_acl_rule2(); |
| } |
| /* |
| * When LAN & WAN IPs are too close, apply this ACL |
| * ex: WAN 192.168.1.x, LAN 192.168.0.x |
| */ |
| void |
| ip_conflict_add_acl_rules(uint32_t wan_ip, uint32_t lan_ip, uint32_t gw_entry_id) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval, cnt; |
| a_bool_t val; |
| int i; |
| |
| if (get_aclrulemask() & (1 << S17_ACL_LIST_IPCONF)) return; |
| |
| for (cnt = 0; cnt < 2; cnt++) |
| { |
| memset(&myacl, 0, sizeof(fal_acl_rule_t)); |
| |
| aos_printk("IP conflict adding rule #%d\n", cnt); |
| |
| switch (cnt) |
| { |
| case 0: |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| myacl.dest_ip4_val = lan_ip; |
| myacl.dest_ip4_mask = 0xffffff00; |
| myacl.src_ip4_val = lan_ip; |
| myacl.src_ip4_mask = 0xffffff00; |
| |
| /* |
| IPv4 rule, with DIP & SIP field |
| for DIP and SIP = LAN IP, do the next step |
| */ |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_IP4_DIP); |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_IP4_SIP); |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_IPCONF, S17_ACL_LIST_PRIO_HIGH); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_LIST_CREATE ERROR...\n"); |
| break; |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_LIST_IPCONF, 0, 1, &myacl); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_RULE_ADD ERROR...\n"); |
| break; |
| } |
| |
| /* bind to LAN ports */ |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND(0, S17_ACL_LIST_IPCONF, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| aclrulemask |= (1 << S17_ACL_LIST_IPCONF); |
| set_aclrulemask(S17_ACL_LIST_IPCONF); |
| |
| break; |
| |
| case 1: |
| aos_printk("ARP index entry_id: %d\n", gw_entry_id); |
| |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| myacl.src_ip4_val = lan_ip; |
| myacl.src_ip4_mask = 0xffffff00; |
| |
| /* |
| IPv4 rule, with SIP field |
| enable packet forwarding & forward only. i.e. no FORCE_L3_MODE |
| ARP_INDEX_EN, to the PPPoE peer ARP index |
| */ |
| |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_IP4_SIP); |
| |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_POLICY_FORWARD_EN); |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_ARP_EN); |
| |
| myacl.arp_ptr = gw_entry_id; |
| myacl.policy_fwd = FAL_ACL_POLICY_SNAT; |
| |
| /* rule no. 4 */ |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_IPCONF+1, S17_ACL_LIST_PRIO_HIGH); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_LIST_CREATE ERROR...\n"); |
| break; |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_LIST_IPCONF+1, 0, 1, &myacl); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("ACL_RULE_ADD ERROR...\n"); |
| break; |
| } |
| /* bind to LAN ports (1-4) */ |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND(0, S17_ACL_LIST_IPCONF+1, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| break; |
| |
| default: |
| break; |
| } |
| } |
| |
| if (ACL_STATUS_GET(0, &val) == SW_OK) |
| { |
| if (val != A_TRUE) |
| { |
| aos_printk("ACL is not yet enabled. Enabling... \n"); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| } |
| |
| void ip_conflict_del_acl_rules(void) |
| { |
| int i; |
| |
| if (!(get_aclrulemask() & (1 << S17_ACL_LIST_IPCONF))) |
| return; |
| |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) { |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_IPCONF, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| ACL_LIST_UNBIND(0, S17_ACL_LIST_IPCONF+1, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| } |
| |
| ACL_RULE_DEL(0, S17_ACL_LIST_IPCONF, 0, 1); |
| |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_IPCONF); |
| |
| ACL_RULE_DEL(0, S17_ACL_LIST_IPCONF+1, 0, 1); |
| |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_IPCONF+1); |
| |
| unset_aclrulemask(S17_ACL_LIST_IPCONF); |
| } |
| |
| |
| /* |
| solicted_node address |
| FF02::1:FF00:0000/104 => Solicited-Node Address |
| */ |
| void |
| ipv6_snooping_solicted_node_add_acl_rules ( void ) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| int i; |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| |
| aos_printk("Adding ACL rules %d - %s\n", S17_ACL_LIST_IPV6_SOLICITED_NODE, __func__); |
| myacl.rule_type = FAL_ACL_RULE_IP6; |
| myacl.dest_ip6_val.ul[0] = 0xff020000; /* FF02::1:FF00:0000/104 */ |
| myacl.dest_ip6_val.ul[1] = 0x00000000; |
| myacl.dest_ip6_val.ul[2] = 0x00000001; |
| myacl.dest_ip6_val.ul[3] = 0xff000000; |
| |
| myacl.dest_ip6_mask.ul[0] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[1] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[2] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[3] = 0xff000000; |
| |
| #ifdef CONFIG_ATH_8327_ACL_IPV6_PASSTHROUGH |
| /* ACL action destination port, WAN, LAN and CPU ports */ |
| myacl.ports = (1 << S17_WAN_PORT) | (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| #else |
| /* ACL action destination port, LAN and CPU ports */ |
| myacl.ports = (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| myacl.vid_val = 0x1; |
| myacl.vid_mask = 0xfff; |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_VID ); |
| #endif |
| |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE ( 0, S17_ACL_LIST_IPV6_SOLICITED_NODE, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| if(rtnval == SW_ALREADY_EXIST) |
| { |
| //aos_printk ( "ipv6_snooping_solicted rules acl list already exists.\n"); |
| |
| } else { |
| aos_printk ( "%s: ACL_LIST_CREATE ERROR (%d)...\n", __func__, rtnval ); |
| } |
| return; |
| } |
| |
| rtnval = ACL_RULE_ADD ( 0, S17_ACL_LIST_IPV6_SOLICITED_NODE, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "%s: ACL_RULE_ADD ERROR...(%d)\n", __func__, rtnval ); |
| return; |
| } |
| |
| // ACL pattern source port |
| #ifdef CONFIG_ATH_8327_ACL_IPV6_PASSTHROUGH |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_SOLICITED_NODE, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_WAN_PORT ); |
| #endif |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_SOLICITED_NODE, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT ); |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_SOLICITED_NODE, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| if ( ACL_STATUS_GET ( 0, &val ) == SW_OK ) |
| { |
| if ( val != A_TRUE ) |
| { |
| aos_printk ( "ACL is not yet enabled. Enabling... \n" ); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| } |
| |
| |
| /* |
| Node Information Queries (RFC 4620 is experimental) |
| FF02:0:0:0:0:2:FF00::/104 => Node Information Queries |
| */ |
| void |
| ipv6_snooping_nodeinfo_query_add_acl_rules ( void ) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| int i; |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| |
| aos_printk("Adding ACL rules %d - %s\n", S17_ACL_LIST_IPV6_NODEINFO_QUERY, __func__); |
| myacl.rule_type = FAL_ACL_RULE_IP6; |
| myacl.dest_ip6_val.ul[0] = 0xff020000; /* FF02:0:0:0:0:2:FF00::/104 */ |
| myacl.dest_ip6_val.ul[1] = 0x00000000; |
| myacl.dest_ip6_val.ul[2] = 0x00000002; |
| myacl.dest_ip6_val.ul[3] = 0xff000000; |
| |
| myacl.dest_ip6_mask.ul[0] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[1] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[2] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[3] = 0xff000000; |
| |
| #ifdef CONFIG_ATH_8327_ACL_IPV6_PASSTHROUGH |
| /* ACL action destination port, WAN, LAN and CPU ports */ |
| myacl.ports = (1 << S17_WAN_PORT) | (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| #else |
| /* ACL action destination port, LAN and CPU ports */ |
| myacl.ports = (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| myacl.vid_val = 0x1; |
| myacl.vid_mask = 0xfff; |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_VID ); |
| #endif |
| |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE ( 0, S17_ACL_LIST_IPV6_NODEINFO_QUERY, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "%s: ACL_LIST_CREATE ERROR (%d)...\n", __func__, rtnval ); |
| return; |
| } |
| |
| rtnval = ACL_RULE_ADD ( 0, S17_ACL_LIST_IPV6_NODEINFO_QUERY, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "%s: ACL_RULE_ADD ERROR...(%d)\n", __func__, rtnval ); |
| return; |
| } |
| |
| // ACL pattern source port |
| #ifdef CONFIG_ATH_8327_ACL_IPV6_PASSTHROUGH |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_NODEINFO_QUERY, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_WAN_PORT ); |
| #endif |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_NODEINFO_QUERY, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT ); |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_NODEINFO_QUERY, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| if ( ACL_STATUS_GET ( 0, &val ) == SW_OK ) |
| { |
| if ( val != A_TRUE ) |
| { |
| aos_printk ( "ACL is not yet enabled. Enabling... \n" ); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| } |
| |
| |
| /* |
| sextuple0_group_acl_rules contains following addresses: |
| FF02:0:0:0:0:0:0:1 => All Nodes Address |
| FF02:0:0:0:0:0:0:2 => All Routers Address |
| FF02:0:0:0:0:0:0:9 => RIP Routers |
| FF02:0:0:0:0:0:0:C => SSDP |
| FF02:0:0:0:0:0:0:16 => All MLDv2-capable routers |
| FF02:0:0:0:0:0:0:FB => mDNSv6 |
| */ |
| void |
| ipv6_snooping_sextuple0_group_add_acl_rules ( void ) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| int i; |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| |
| aos_printk("Adding ACL rules %d - %s\n", S17_ACL_LIST_IPV6_SEXTUPLE0_GROUP, __func__); |
| myacl.rule_type = FAL_ACL_RULE_IP6; |
| myacl.dest_ip6_val.ul[0] = 0xff020000; /* FF02::/120 */ |
| myacl.dest_ip6_val.ul[1] = 0x00000000; |
| myacl.dest_ip6_val.ul[2] = 0x00000000; |
| myacl.dest_ip6_val.ul[3] = 0x00000000; |
| |
| myacl.dest_ip6_mask.ul[0] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[1] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[2] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[3] = 0xffffff00; |
| |
| #ifdef CONFIG_ATH_8327_ACL_IPV6_PASSTHROUGH |
| /* ACL action destination port, WAN, LAN and CPU ports */ |
| myacl.ports = (1 << S17_WAN_PORT) | (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| #else |
| /* ACL action destination port, LAN and CPU ports */ |
| myacl.ports = (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| myacl.vid_val = 0x1; |
| myacl.vid_mask = 0xfff; |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_VID ); |
| #endif |
| |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE ( 0, S17_ACL_LIST_IPV6_SEXTUPLE0_GROUP, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| if(rtnval == SW_ALREADY_EXIST) |
| { |
| //aos_printk ( "ipv6_snooping_sextuple0 rules acl list already exists.\n"); |
| } else { |
| aos_printk ( "%s: ACL_LIST_CREATE ERROR (%d)...\n", __func__, rtnval ); |
| } |
| return; |
| } |
| rtnval = ACL_RULE_ADD ( 0, S17_ACL_LIST_IPV6_SEXTUPLE0_GROUP, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "%s: ACL_RULE_ADD ERROR...(%d)\n", __func__, rtnval ); |
| return; |
| } |
| |
| // ACL pattern source port |
| #ifdef CONFIG_ATH_8327_ACL_IPV6_PASSTHROUGH |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_SEXTUPLE0_GROUP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_WAN_PORT ); |
| #endif |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_SEXTUPLE0_GROUP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT ); |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_SEXTUPLE0_GROUP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i ); |
| } |
| |
| if ( ACL_STATUS_GET ( 0, &val ) == SW_OK ) |
| { |
| if ( val != A_TRUE ) |
| { |
| aos_printk ( "ACL is not yet enabled. Enabling... \n" ); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| } |
| |
| |
| /* |
| quintruple0_1_group_acl_rules contains following addresses: |
| FF02:0:0:0:0:0:1:2 => All-dhcp-agents |
| FF02:0:0:0:0:0:1:3 => LLMNR |
| */ |
| void |
| ipv6_snooping_quintruple0_1_group_add_acl_rules ( void ) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| int i; |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| |
| aos_printk("Adding ACL rules %d - %s\n", S17_ACL_LIST_IPV6_QUINTRUPLE0_1_GROUP, __func__); |
| myacl.rule_type = FAL_ACL_RULE_IP6; |
| myacl.dest_ip6_val.ul[0] = 0xff020000; /* FF02:0:0:0:0:0:1::/125 */ |
| myacl.dest_ip6_val.ul[1] = 0x00000000; |
| myacl.dest_ip6_val.ul[2] = 0x00000000; |
| myacl.dest_ip6_val.ul[3] = 0x00010000; |
| |
| myacl.dest_ip6_mask.ul[0] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[1] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[2] = 0xffffffff; |
| myacl.dest_ip6_mask.ul[3] = 0xfffffff8; |
| |
| #ifdef CONFIG_ATH_8327_ACL_IPV6_PASSTHROUGH |
| myacl.ports = (1 << S17_WAN_PORT) | (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| #else |
| /* ACL action destination port, LAN and CPU ports */ |
| myacl.ports = (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| myacl.vid_val = 0x1; |
| myacl.vid_mask = 0xfff; |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP6_DIP ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_VID ); |
| #endif |
| |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE ( 0, S17_ACL_LIST_IPV6_QUINTRUPLE0_1_GROUP, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| if(rtnval == SW_ALREADY_EXIST) |
| { |
| //aos_printk ( "ipv6_snooping_quintruple0 rules acl list already exists.\n"); |
| } else { |
| aos_printk ( "%s: ACL_LIST_CREATE ERROR (%d)...\n", __func__, rtnval ); |
| } |
| return; |
| } |
| rtnval = ACL_RULE_ADD ( 0, S17_ACL_LIST_IPV6_QUINTRUPLE0_1_GROUP, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "%s: ACL_RULE_ADD ERROR...(%d)\n", __func__, rtnval ); |
| return; |
| } |
| |
| /* ACL pattern soruce port */ |
| #ifdef CONFIG_ATH_8327_ACL_IPV6_PASSTHROUGH |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_QUINTRUPLE0_1_GROUP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_WAN_PORT ); |
| #endif |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_QUINTRUPLE0_1_GROUP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT ); |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_IPV6_QUINTRUPLE0_1_GROUP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i ); |
| } |
| |
| if ( ACL_STATUS_GET ( 0, &val ) == SW_OK ) |
| { |
| if ( val != A_TRUE ) |
| { |
| aos_printk ( "ACL is not yet enabled. Enabling... \n" ); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| } |
| |
| /* |
| When HW IGMPSNOOPING Enabled, we need to let UPnP SSDP Multicast packets send to lan |
| */ |
| void upnp_ssdp_add_acl_rules(void) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| int i; |
| |
| aos_printk("Adding ACL rules %d - %s\n", S17_ACL_LIST_UPNP_SSDP, __func__); |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| myacl.dest_ip4_val = 0xeffffffa; // 239.255.255.250 |
| myacl.dest_ip4_mask = 0xffffffff; |
| /* ACL action destination port, LAN and CPU ports */ |
| myacl.ports = (1 << S17_CPU_PORT) | (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_IP4_DIP ); |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE ( 0, S17_ACL_LIST_UPNP_SSDP, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| if(rtnval == SW_ALREADY_EXIST) |
| { |
| //aos_printk ( "upnp_ssdp rules acl list already exists.\n"); |
| } else { |
| aos_printk ( "upnp_ssdp_acl_rules: ACL_LIST_CREATE ERROR (%d)...\n",rtnval ); |
| } |
| return ; |
| } |
| |
| rtnval = ACL_RULE_ADD ( 0, S17_ACL_LIST_UPNP_SSDP, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "upnp_ssdp_acl_rules: ACL_RULE_ADD ERROR...(%d)\n" ,rtnval ); |
| return ; |
| } |
| |
| // Pattern source port |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_UPNP_SSDP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT ); |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_UPNP_SSDP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i ); |
| } |
| |
| if (ACL_STATUS_GET(0, &val) == SW_OK) |
| { |
| if (val != A_TRUE) |
| { |
| aos_printk("ACL is not yet enabled. Enabling... \n"); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| } |
| |
| void filter_power_cord_acl_rules(void) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| |
| aos_printk("Adding ACL rules %d - %s\n", S17_ACL_LIST_PLC_FILTER, __func__); |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| myacl.rule_type = FAL_ACL_RULE_MAC; |
| |
| myacl.ethtype_val = 0x88e1; |
| myacl.ethtype_mask = 0xffff; |
| |
| /* ACL action destination port PLC port */ |
| myacl.ports = (1 << S17_CPU_PORT) | (1 << 6); |
| |
| /* Set pattern type*/ |
| memset ( &myacl.field_flg, 0, sizeof ( myacl.field_flg ) ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_ETHTYPE ); // set ethtype as pattern |
| |
| /* Set action type*/ |
| memset ( &myacl.action_flg, 0, sizeof ( myacl.action_flg ) ); |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT); // set action as DENY, FAL_ACL_ACTION_DENY |
| |
| /* |
| memcpy ( myacl.dest_mac_val.uc, mac, 6 ); |
| memcpy ( myacl.dest_mac_mask.uc, mac_mask, 6 ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_DA ); |
| */ |
| |
| rtnval = ACL_LIST_CREATE (0, S17_ACL_LIST_PLC_FILTER, S17_ACL_LIST_PRIO_HIGH); |
| if(rtnval != SW_OK) |
| { |
| aos_printk ( "filter_power_cord_acl_rules: ACL_LIST_CREATE ERROR (%d)\n",rtnval ); |
| return; |
| } |
| |
| rtnval = ACL_RULE_ADD ( 0, S17_ACL_LIST_PLC_FILTER, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "filter_power_cord_acl_rules: ACL_RULE_ADD ERROR...(%d)\n", rtnval ); |
| return; |
| } |
| |
| // ACL pattern source port |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_PLC_FILTER, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_CPU_PORT); |
| ACL_LIST_BIND ( 0, S17_ACL_LIST_PLC_FILTER, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, 6); |
| |
| if ( ACL_STATUS_GET ( 0, &val ) == SW_OK ) |
| { |
| if ( val != A_TRUE ) |
| { |
| aos_printk ( "ACL is not yet enabled. Enabling... \n" ); |
| ACL_STATUS_SET ( 0, A_TRUE ); |
| } |
| } |
| } |
| |
| /* enable pppoe_passthrough by default */ |
| static int isis_pppoe_passthrough = 0; |
| |
| unsigned int isis_pppoe_passthrough_process(struct sk_buff *skb, aos_header_t *athr_header) |
| { |
| unsigned char *smac = &skb->data[6]; |
| |
| if ( isis_pppoe_passthrough == 0 ) |
| return -1; |
| |
| if ( ( ( skb->data[20] == 0x88 && ( skb->data[21] == 0x63 ) ) || ( skb->data[16] == 0x88 && ( skb->data[17] == 0x63 ) ) ) |
| && ( athr_header->sport != S17_WAN_PORT ) ) |
| { |
| pppoe_passthrough_acl_rules ( 0, smac ); |
| } |
| |
| return 0; |
| } |
| |
| unsigned int isis_set_pppoe_passthrough ( int enable ) |
| { |
| if ( enable ) |
| isis_pppoe_passthrough = 1; |
| else |
| isis_pppoe_passthrough = 0; |
| |
| printk ( "## isis_set_pppoe_passthrough %s !\n", enable != 0 ? "enabled" : "disabled" ); |
| |
| return 0; |
| } |
| |
| unsigned int isis_enable_pppoe_discovery_acl(void) |
| { |
| #if 0 |
| printk ( "## isis_enable_pppoe_discovery_acl !\n"); |
| |
| athrs17_reg_write ( MOD_ENABLE_OFFSET, athrs17_reg_read ( MOD_ENABLE_OFFSET ) | ( 1 << MOD_ENABLE_ACL_EN_BOFFSET ) ); |
| printk ( "athrs17_reg_write(MOD_ENABLE_OFFSET) = 0x%08x\n", athrs17_reg_read ( MOD_ENABLE_OFFSET ) ); |
| #endif |
| return 0; |
| } |
| |
| |
| int pppoe_passthrough_acl_rules(uint32_t gw_entry_id, unsigned char *mac) |
| { |
| fal_acl_rule_t myacl; |
| uint32_t rtnval; |
| a_bool_t val; |
| uint32_t rule_list_id; |
| unsigned char mac_mask[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; |
| int i; |
| |
| if (isis_pppoe_passthrough > MAX_PPPOE_PASSTHROUGH_NUM) |
| { |
| aos_printk("Support %d PPPoE passthrough hosts only... \n", MAX_PPPOE_PASSTHROUGH_NUM); |
| return -1; |
| } |
| |
| { |
| /* lan -> wan, pppoe discovery */ |
| rule_list_id = S17_ACL_LIST_PPPOE_PASSTHROUGH_LAN_TO_WAN + (isis_pppoe_passthrough - 1) * 2; |
| printk ( "creating ACL list_id: %d \n", rule_list_id ); |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| myacl.rule_type = FAL_ACL_RULE_MAC; |
| memcpy ( myacl.src_mac_val.uc, mac, 6 ); |
| memcpy ( myacl.src_mac_mask.uc, mac_mask, 6 ); |
| myacl.ethtype_val = 0x8863; |
| myacl.ethtype_mask = 0xffff; |
| |
| myacl.ports = (1 << S17_WAN_PORT); |
| |
| memset ( &myacl.field_flg, 0, sizeof ( myacl.field_flg ) ); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_SA ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_ETHTYPE ); |
| |
| memset ( &myacl.action_flg, 0, sizeof ( myacl.action_flg ) ); |
| |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE (0, rule_list_id, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "pppoe_passthrough_acl_rules: ACL_LIST_CREATE ERROR (%d)\n",rtnval ); |
| return -1; |
| } |
| |
| rtnval = ACL_RULE_ADD ( 0, rule_list_id, 0, 1, &myacl ); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "pppoe_passthrough_acl_rules: ACL_RULE_ADD ERROR...(%d)\n", rtnval ); |
| return -1; |
| } |
| |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND ( 0, rule_list_id, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| } |
| |
| { |
| /* lan -> wan, pppoe session */ |
| rule_list_id = S17_ACL_LIST_PPPOE_PASSTHROUGH_LAN_TO_WAN + (isis_pppoe_passthrough - 1) * 2 + 1; |
| |
| printk ( "creating ACL list_id: %d \n", rule_list_id ); |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| myacl.rule_type = FAL_ACL_RULE_MAC; |
| memcpy ( myacl.src_mac_val.uc, mac, 6 ); |
| memcpy ( myacl.src_mac_mask.uc, mac_mask, 6 ); |
| |
| myacl.ethtype_val = 0x8864; |
| myacl.ethtype_mask = 0xffff; |
| |
| myacl.ports = ( 1<<S17_WAN_PORT /* WAN */ ); |
| |
| memset ( &myacl.field_flg, 0, sizeof ( myacl.field_flg ) ); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_SA ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_ETHTYPE ); |
| |
| memset ( &myacl.action_flg, 0, sizeof ( myacl.action_flg ) ); |
| |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE ( 0, rule_list_id, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "pppoe_passthrough_acl_rules: ACL_LIST_CREATE ERROR...(%d)\n",rtnval ); |
| } |
| |
| rtnval = ACL_RULE_ADD ( 0, rule_list_id, 0, 1, &myacl ); |
| |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "pppoe_passthrough_acl_rules: ACL_RULE_ADD ERROR...(%d)\n", rtnval ); |
| } |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND ( 0, rule_list_id, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| } |
| |
| { |
| /* lan <- wan, pppoe discovery */ |
| rule_list_id = S17_ACL_LIST_PPPOE_PASSTHROUGH_WAN_TO_LAN + (isis_pppoe_passthrough - 1) * 2; |
| |
| printk ( "creating ACL list_id: %d \n", rule_list_id ); |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| myacl.rule_type = FAL_ACL_RULE_MAC; |
| memcpy ( myacl.dest_mac_val.uc, mac, 6 ); |
| memcpy ( myacl.dest_mac_mask.uc, mac_mask, 6 ); |
| |
| myacl.ethtype_val = 0x8863; |
| myacl.ethtype_mask = 0xffff; |
| |
| myacl.ports = (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| |
| memset ( &myacl.field_flg, 0, sizeof ( myacl.field_flg ) ); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_DA ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_ETHTYPE ); |
| |
| memset ( &myacl.action_flg, 0, sizeof ( myacl.action_flg ) ); |
| |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE (0, rule_list_id, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "pppoe_passthrough_acl_rules: ACL_LIST_CREATE ERROR (%d)\n",rtnval ); |
| return -1; |
| } |
| |
| rtnval = ACL_RULE_ADD ( 0, rule_list_id, 0, 1, &myacl ); |
| |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "pppoe_passthrough_acl_rules: ACL_RULE_ADD ERROR...(%d)\n", rtnval ); |
| return -1; |
| } |
| |
| ACL_LIST_BIND ( 0, rule_list_id, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_WAN_PORT); |
| } |
| |
| { |
| /* lan <- wan, pppoe session */ |
| rule_list_id = S17_ACL_LIST_PPPOE_PASSTHROUGH_WAN_TO_LAN + (isis_pppoe_passthrough - 1) * 2 + 1; |
| |
| printk ( "creating ACL list_id: %d \n", rule_list_id ); |
| |
| memset ( &myacl, 0, sizeof ( fal_acl_rule_t ) ); |
| myacl.rule_type = FAL_ACL_RULE_MAC; |
| memcpy ( myacl.dest_mac_val.uc, mac, 6 ); |
| memcpy ( myacl.dest_mac_mask.uc, mac_mask, 6 ); |
| |
| myacl.ethtype_val = 0x8864; |
| myacl.ethtype_mask = 0xffff; |
| |
| myacl.ports = (1 << S17_LAN_PORT0) | |
| (1 << S17_LAN_PORT1) | (1 << S17_LAN_PORT2) | (1 << S17_LAN_PORT3); |
| |
| memset ( &myacl.field_flg, 0, sizeof ( myacl.field_flg ) ); |
| |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_DA ); |
| FAL_FIELD_FLG_SET ( myacl.field_flg, FAL_ACL_FIELD_MAC_ETHTYPE ); |
| |
| memset ( &myacl.action_flg, 0, sizeof ( myacl.action_flg ) ); |
| |
| FAL_ACTION_FLG_SET ( myacl.action_flg, FAL_ACL_ACTION_REDPT ); |
| |
| rtnval = ACL_LIST_CREATE ( 0, rule_list_id, S17_ACL_LIST_PRIO_MID); |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "pppoe_passthrough_acl_rules: ACL_LIST_CREATE ERROR...(%d)\n",rtnval ); |
| return -1; |
| } |
| |
| rtnval = ACL_RULE_ADD ( 0, rule_list_id, 0, 1, &myacl ); |
| |
| if ( rtnval != SW_OK ) |
| { |
| aos_printk ( "pppoe_passthrough_acl_rules: ACL_RULE_ADD ERROR...(%d)\n", rtnval ); |
| return -1; |
| } |
| |
| ACL_LIST_BIND ( 0, rule_list_id, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_WAN_PORT); |
| } |
| |
| if ( ACL_STATUS_GET ( 0, &val ) == SW_OK ) |
| { |
| if ( val != A_TRUE ) |
| { |
| aos_printk ( "ACL is not yet enabled. Enabling... \n" ); |
| ACL_STATUS_SET ( 0, A_TRUE ); |
| } |
| } |
| |
| /* add the counter */ |
| isis_pppoe_passthrough++; |
| |
| return 0; |
| } |
| |
| void icmp_from_wan_acl_rule(void) |
| { |
| fal_acl_rule_t myacl; |
| a_uint32_t rtnval; |
| |
| printk("WAN ICMP ACL Rules\n"); |
| memset(&myacl, 0, sizeof(fal_acl_rule_t)); |
| |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| myacl.ip_proto_val = 0x1; /* ICMP */ |
| myacl.ip_proto_mask = 0xff; |
| |
| /* dest port : CPU Port */ |
| myacl.ports = 1 << S17_CPU_PORT; |
| |
| FAL_FIELD_FLG_SET (myacl.field_flg, FAL_ACL_FIELD_IP_PROTO); |
| FAL_ACTION_FLG_SET (myacl.action_flg, FAL_ACL_ACTION_RDTCPU); |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_ICMP_FROM_WAN, S17_ACL_LIST_PRIO_HIGH); |
| |
| if (rtnval != SW_OK) |
| { |
| if(rtnval == SW_ALREADY_EXIST) |
| { |
| aos_printk ( "athrs17_icmp_from_wan_acl_rules: rules acl list already exists !\n"); |
| } |
| else |
| { |
| aos_printk ( "athrs17_icmp_from_wan_acl_rules: ACL_LIST_CREATE ERROR (%d)...\n",rtnval ); |
| } |
| return ; |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_ICMP_FROM_WAN, 0, 1, &myacl); |
| |
| if (rtnval != SW_OK) |
| { |
| ACL_LIST_DESTROY(0, S17_ACL_ICMP_FROM_WAN); |
| aos_printk("athrs17_icmp_from_wan_acl_rules: ACL_RULE_ADD ERROR...(%d)\n" ,rtnval); |
| return ; |
| } |
| |
| /* source port : WAN Port */ |
| ACL_LIST_BIND(0, S17_ACL_ICMP_FROM_WAN, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_WAN_PORT); |
| } |
| |
| /* |
| Once |
| 1. Both lan and wan interface entry have been created |
| 2. Lan size PC's host entry has been created |
| 3. Wan has receive the packet destination IP belong to PC on Lan |
| Force to redirect it to CPU |
| */ |
| void redirect_internal_ip_packets_to_cpu_on_wan_add_acl_rules(uint32_t lan_ip, uint32_t lan_netmask) |
| { |
| fal_acl_rule_t myacl; |
| a_uint32_t rtnval; |
| a_bool_t val; |
| |
| if (get_aclrulemask() & (1 << S17_ACL_LIST_REDIRECT_INTERNAL_IP_TO_CPU_ON_WAN)) return; |
| |
| aos_printk("Adding ACL rules %d - %s\n", S17_ACL_LIST_REDIRECT_INTERNAL_IP_TO_CPU_ON_WAN, __func__); |
| |
| memset(&myacl, 0, sizeof(fal_acl_rule_t)); |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| //myacl.ip_proto_val = 0x1; /* ICMP */ |
| //myacl.ip_proto_mask = 0xff; |
| printk("redirect_internal_ip_packets_to_cpu_on_wan_add_acl_rules, Lan: %u.%u.%u.%u / %u.%u.%u.%u\n" |
| ,((unsigned char *)&lan_ip)[0] ,((unsigned char *)&lan_ip)[1] |
| ,((unsigned char *)&lan_ip)[2] ,((unsigned char *)&lan_ip)[3] |
| ,((unsigned char *)&lan_netmask)[0] ,((unsigned char *)&lan_netmask)[1] |
| ,((unsigned char *)&lan_netmask)[2] ,((unsigned char *)&lan_netmask)[3] |
| ); |
| |
| myacl.dest_ip4_val = lan_ip; |
| myacl.dest_ip4_mask = lan_netmask; |
| |
| /* dest port : CPU Port */ |
| myacl.ports = 1 << S17_CPU_PORT; |
| |
| //FAL_FIELD_FLG_SET (myacl.field_flg, FAL_ACL_FIELD_IP_PROTO); |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_IP4_DIP); |
| FAL_ACTION_FLG_SET (myacl.action_flg, FAL_ACL_ACTION_RDTCPU); |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_REDIRECT_INTERNAL_IP_TO_CPU_ON_WAN, S17_ACL_LIST_PRIO_HIGH); |
| |
| if (rtnval != SW_OK) |
| { |
| if(rtnval == SW_ALREADY_EXIST) |
| { |
| aos_printk ( "redirect_internal_ip_packets_to_cpu_on_wan_add_acl_rules: rules acl list already exists !\n"); |
| } |
| else |
| { |
| aos_printk ( "redirect_internal_ip_packets_to_cpu_on_wan_add_acl_rules: ACL_LIST_CREATE ERROR (%d)...\n",rtnval ); |
| } |
| return ; |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_LIST_REDIRECT_INTERNAL_IP_TO_CPU_ON_WAN, 0, 1, &myacl); |
| |
| if (rtnval != SW_OK) |
| { |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_REDIRECT_INTERNAL_IP_TO_CPU_ON_WAN); |
| aos_printk("redirect_internal_ip_packets_to_cpu_on_wan_add_acl_rules: ACL_RULE_ADD ERROR...(%d)\n" ,rtnval); |
| return ; |
| } |
| |
| /* source port : WAN Port */ |
| ACL_LIST_BIND(0, S17_ACL_LIST_REDIRECT_INTERNAL_IP_TO_CPU_ON_WAN, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, S17_WAN_PORT); |
| |
| /* check for the ACL enable bit */ |
| if (ACL_STATUS_GET(0, &val) == SW_OK) |
| { |
| if (val != A_TRUE) |
| { |
| aos_printk("ACL is not yet enabled. Enabling... \n"); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| set_aclrulemask(S17_ACL_LIST_REDIRECT_INTERNAL_IP_TO_CPU_ON_WAN); |
| } |
| |
| void udp_checksum_zero_acl_rule(uint32_t gw_entry_id) |
| { |
| fal_acl_rule_t myacl; |
| a_uint32_t rtnval; |
| int i; |
| |
| if (get_aclrulemask() & (1 << S17_ACL_LIST_UDP0)) return; |
| |
| memset(&myacl, 0, sizeof(fal_acl_rule_t)); |
| |
| /* |
| User defined filter ACL |
| filter out UDP(0x11) checksum (0x0000) packets |
| and set FORCE_L3_MODE ARP_INDEX_OVER_EN=1 ARP_INDEX=default route |
| Bind to WAN/LAN port |
| */ |
| aos_printk("UDP checksum adding rule #%d\n", S17_ACL_LIST_UDP0); |
| myacl.rule_type = FAL_ACL_RULE_UDF; |
| /* set the UDP ACL type as L3, with length 1, offset 9 */ |
| /* set the UDP ACL type as L4, with length 2, offset 6 */ |
| |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| ACL_PORT_UDF_PROFILE_SET(0, i, FAL_ACL_UDF_TYPE_L3, 9, 1); |
| ACL_PORT_UDF_PROFILE_SET(0, i, FAL_ACL_UDF_TYPE_L4, 6, 2); |
| } |
| |
| myacl.udf_len = 3; |
| myacl.udf_offset = 0; |
| myacl.udf_type = FAL_ACL_UDF_TYPE_L2; |
| memset(&myacl.udf_val, 0, sizeof(myacl.udf_val)); |
| memset(&myacl.udf_mask, 0, sizeof(myacl.udf_mask)); |
| /* UDF filter to check for UDP checksum 0 packets */ |
| myacl.udf_val[0] = 0x11; |
| myacl.udf_val[1] = 0x00; |
| myacl.udf_val[2] = 0x00; |
| myacl.udf_val[3] = 0x00; |
| myacl.udf_val[4] = 0x00; |
| myacl.udf_val[5] = 0x00; |
| myacl.udf_val[6] = 0x00; |
| myacl.udf_val[7] = 0x00; |
| |
| myacl.udf_mask[0] = 0xff; |
| myacl.udf_mask[1] = 0xff; |
| myacl.udf_mask[2] = 0xff; |
| myacl.udf_mask[3] = 0x00; |
| myacl.udf_mask[4] = 0x00; |
| myacl.udf_mask[5] = 0x00; |
| myacl.udf_mask[6] = 0x00; |
| myacl.udf_mask[7] = 0x00; |
| |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_UDF); |
| FAL_ACTION_FLG_SET(myacl.action_flg, FAL_ACL_ACTION_ARP_EN); |
| |
| myacl.arp_ptr = gw_entry_id; |
| myacl.policy_fwd = FAL_ACL_POLICY_ROUTE; |
| |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_UDP0, S17_ACL_LIST_PRIO_HIGH); |
| if (rtnval != SW_OK) |
| { |
| aos_printk("#%d, ACL_LIST_CREATE ERROR...%d\n",S17_ACL_LIST_UDP0,rtnval); |
| return; |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_LIST_UDP0, 0, 1, &myacl); |
| if (rtnval != SW_OK) |
| { |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_UDP0); |
| aos_printk("#%d, ACL_RULE_ADD ERROR...%d\n",S17_ACL_LIST_UDP0,rtnval); |
| return; |
| } |
| |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| ACL_LIST_BIND(0, S17_ACL_LIST_UDP0, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| set_aclrulemask(S17_ACL_LIST_UDP0); |
| } |
| |
| |
| void dscp_remap_acl_rule(uint32_t ori_dscp, uint32_t dscp) |
| { |
| fal_acl_rule_t myacl; |
| a_uint32_t rtnval; |
| uint32_t ori_tos, tos_val; |
| a_bool_t val; |
| int i; |
| |
| ori_tos = ori_dscp << 2; |
| tos_val = dscp << 2; |
| |
| if (get_aclrulemask() & (1 << S17_ACL_LIST_DSCP_REMAP)) |
| return; |
| |
| aos_printk("Adding ACL rules %d - %s\n", S17_ACL_LIST_DSCP_REMAP, __func__); |
| memset(&myacl, 0, sizeof(fal_acl_rule_t)); |
| myacl.rule_type = FAL_ACL_RULE_IP4; |
| |
| aos_printk("Remap DSCP value from %d to %d\n", ori_dscp, dscp); |
| myacl.ip_dscp_val = ori_tos; |
| myacl.ip_dscp_mask = 0xff; |
| |
| FAL_FIELD_FLG_SET(myacl.field_flg, FAL_ACL_FIELD_IP_DSCP); |
| FAL_ACTION_FLG_SET (myacl.action_flg, FAL_ACL_ACTION_REMARK_DSCP); |
| |
| /* Action : new DSCP value */ |
| myacl.dscp = tos_val; |
| |
| rtnval = ACL_LIST_CREATE(0, S17_ACL_LIST_DSCP_REMAP, S17_ACL_LIST_PRIO_HIGH); |
| |
| if (rtnval != SW_OK) |
| { |
| if(rtnval == SW_ALREADY_EXIST) |
| { |
| //aos_printk ( "%s: rules acl list already exists !\n", __FUNCTION__); |
| } else { |
| aos_printk ( "%s: ACL_LIST_CREATE ERROR (%d)...\n", __FUNCTION__, rtnval ); |
| } |
| return ; |
| } |
| |
| rtnval = ACL_RULE_ADD(0, S17_ACL_LIST_DSCP_REMAP, 0, 1, &myacl); |
| |
| if (rtnval != SW_OK) |
| { |
| ACL_LIST_DESTROY(0, S17_ACL_LIST_DSCP_REMAP); |
| aos_printk("%s: ACL_RULE_ADD ERROR...(%d)\n", __FUNCTION__, rtnval); |
| return ; |
| } |
| |
| /* source port : LAN Ports */ |
| for (i = S17_LAN_PORT0; i <= S17_LAN_PORT4; i++) { |
| if (i != S17_WAN_PORT) |
| ACL_LIST_BIND(0, S17_ACL_LIST_DSCP_REMAP, FAL_ACL_DIREC_IN, FAL_ACL_BIND_PORT, i); |
| } |
| |
| /* check for the ACL enable bit */ |
| if (ACL_STATUS_GET(0, &val) == SW_OK) |
| { |
| if (val != A_TRUE) |
| { |
| aos_printk("ACL is not yet enabled. Enabling... \n"); |
| ACL_STATUS_SET(0, A_TRUE); |
| } |
| } |
| set_aclrulemask(S17_ACL_LIST_DSCP_REMAP); |
| } |
| |
