27 #define foreach_ipsec_input_error \ 28 _(RX_PKTS, "IPSEC pkts received") \ 29 _(DECRYPTION_FAILED, "IPSEC decryption failed") 33 #define _(sym,str) IPSEC_INPUT_ERROR_##sym, 40 #define _(sym,string) string, 60 if (t->
spi == 0 && t->
seq == 0)
62 s =
format (s,
"esp: no esp packet");
72 s =
format (s,
"esp: no sa spi %u seq %u", t->
spi, t->
seq);
104 if (da < clib_net_to_host_u32 (p->
laddr.
start.ip4.as_u32))
107 if (da > clib_net_to_host_u32 (p->
laddr.
stop.ip4.as_u32))
110 if (sa < clib_net_to_host_u32 (p->
raddr.
start.ip4.as_u32))
113 if (sa > clib_net_to_host_u32 (p->
raddr.
stop.ip4.as_u32))
178 u32 n_left_from, *from, next_index, *to_next;
186 while (n_left_from > 0)
192 while (n_left_from > 0 && n_left_to_next > 0)
203 bi0 = to_next[0] = from[0];
223 (
"packet received from %U to %U spi %u size %u spd_id %u",
226 clib_net_to_host_u32 (esp0->
spi),
227 clib_net_to_host_u16 (ip0->
length), spd0->
id);
258 if (ip0->
protocol == IP_PROTOCOL_IPSEC_ESP)
262 tr->
spi = clib_host_to_net_u32 (esp0->
spi);
263 tr->
seq = clib_host_to_net_u32 (esp0->
seq);
298 if (ip0->
protocol == IP_PROTOCOL_IPSEC_ESP)
302 tr->
spi = clib_host_to_net_u32 (ah0->
spi);
303 tr->
seq = clib_host_to_net_u32 (ah0->
seq_no);
309 to_next, n_left_to_next, bi0,
315 IPSEC_INPUT_ERROR_RX_PKTS,
325 .name =
"ipsec-input-ip4",
326 .vector_size =
sizeof (
u32),
335 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n, 350 u32 n_left_from, *from, next_index, *to_next;
354 n_left_from = from_frame->n_vectors;
356 next_index = node->cached_next_index;
358 while (n_left_from > 0)
364 while (n_left_from > 0 && n_left_to_next > 0)
373 u32 header_size =
sizeof (ip0[0]);
375 bi0 = to_next[0] = from[0];
396 (
"packet received from %U to %U spi %u size %u spd_id %u",
427 if (ip0->
protocol == IP_PROTOCOL_IPSEC_ESP)
431 tr->
spi = clib_host_to_net_u32 (esp0->
spi);
432 tr->
seq = clib_host_to_net_u32 (esp0->
seq);
437 n_left_to_next, bi0, next0);
442 IPSEC_INPUT_ERROR_RX_PKTS,
443 from_frame->n_vectors);
445 return from_frame->n_vectors;
452 .name =
"ipsec-input-ip6",
453 .vector_size =
sizeof (
u32),
460 .sibling_of =
"ipsec-input-ip4",
u32 * ipv6_inbound_protect_policy_indices
u32 ah_decrypt_next_index
u32 * ipv4_inbound_protect_policy_indices
sll srl srl sll sra u16x4 i
ip46_address_t tunnel_src_addr
static int ip4_header_bytes(ip4_header_t *i)
struct _vlib_node_registration vlib_node_registration_t
static uword ip6_address_is_equal(ip6_address_t *a, ip6_address_t *b)
#define foreach_ipsec_input_next
ipsec_policy_t * policies
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
counter_t packets
packet counter
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
ip46_address_range_t laddr
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
ip46_address_t tunnel_dst_addr
u32 esp_decrypt_next_index
#define clib_warning(format, args...)
#define VLIB_BUFFER_IS_TRACED
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
ip46_address_range_t raddr
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
counter_t bytes
byte counter
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
static_always_inline void * vnet_feature_next_with_data(u32 sw_if_index, u32 *next0, vlib_buffer_t *b0, u32 n_data_bytes)
#define VLIB_NODE_FUNCTION_MULTIARCH(node, fn)
#define VLIB_REGISTER_NODE(x,...)
#define vec_foreach(var, vec)
Vector iterator.
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.