IPACM: Add support for IHL based filtering of IPv6 fragement packets
For IPv6 DL fragmented packets, if port and attributes based rules are
matched and the firewall is enabled then route the packets to A7.
Otherwise route the IPv6 fragmented packets to IPA HW.
Change-Id: I0d9c8ef16fb2427389d2456a3c6bf8fd92828308
diff --git a/ipacm/inc/IPACM_Wan.h b/ipacm/inc/IPACM_Wan.h
index 9009136..1aaafaa 100644
--- a/ipacm/inc/IPACM_Wan.h
+++ b/ipacm/inc/IPACM_Wan.h
@@ -324,6 +324,8 @@
/* construct complete STA ethernet header */
int handle_sta_header_add_evt();
+ bool check_dft_firewall_rules_attr_mask(IPACM_firewall_conf_t *firewall_config);
+
int config_dft_firewall_rules(ipa_ip_type iptype);
/* configure the initial firewall filter rules */
diff --git a/ipacm/src/IPACM_Wan.cpp b/ipacm/src/IPACM_Wan.cpp
index 12bfeba..03b5bdc 100644
--- a/ipacm/src/IPACM_Wan.cpp
+++ b/ipacm/src/IPACM_Wan.cpp
@@ -1534,6 +1534,33 @@
return res;
}
+/* For checking attribute mask field in firewall rules for IPv6 only */
+bool IPACM_Wan::check_dft_firewall_rules_attr_mask(IPACM_firewall_conf_t *firewall_config)
+{
+ uint32_t attrib_mask = 0ul;
+ attrib_mask = IPA_FLT_SRC_PORT_RANGE |
+ IPA_FLT_DST_PORT_RANGE |
+ IPA_FLT_TYPE |
+ IPA_FLT_CODE |
+ IPA_FLT_SPI |
+ IPA_FLT_SRC_PORT |
+ IPA_FLT_DST_PORT;
+
+ for (int i = 0; i < firewall_config->num_extd_firewall_entries; i++)
+ {
+ if (firewall_config->extd_firewall_entries[i].ip_vsn == 6)
+ {
+ if (firewall_config->extd_firewall_entries[i].attrib.attrib_mask & attrib_mask)
+ {
+ IPACMDBG_H("IHL based attribute mask is found: install IPv6 frag firewall rule \n");
+ return true;
+ }
+ }
+ }
+ IPACMDBG_H("IHL based attribute mask is not found: no IPv6 frag firewall rule \n");
+ return false;
+}
+
/* for STA mode: add firewall rules */
int IPACM_Wan::config_dft_firewall_rules(ipa_ip_type iptype)
{
@@ -2279,7 +2306,9 @@
}
/* add IPv6 frag rule when firewall is enabled*/
- if(iptype == IPA_IP_v6 && firewall_config.firewall_enable == true)
+ if(iptype == IPA_IP_v6 &&
+ firewall_config.firewall_enable == true &&
+ check_dft_firewall_rules_attr_mask(&firewall_config))
{
memset(&flt_rule_entry, 0, sizeof(struct ipa_flt_rule_add));