28 #define foreach_ipsec_input_error \ 29 _(RX_PKTS, "IPSec pkts received") \ 30 _(RX_POLICY_MATCH, "IPSec policy match") \ 31 _(RX_POLICY_NO_MATCH, "IPSec policy not matched") \ 32 _(RX_POLICY_BYPASS, "IPSec policy bypass") \ 33 _(RX_POLICY_DISCARD, "IPSec policy discard") 37 #define _(sym,str) IPSEC_INPUT_ERROR_##sym, 44 #define _(sym,string) string, 67 s =
format (s,
"%U: sa_id %u spd %u policy %d spi %u (0x%08x) seq %u",
86 if (da < clib_net_to_host_u32 (p->
laddr.
start.ip4.as_u32))
89 if (da > clib_net_to_host_u32 (p->
laddr.
stop.ip4.as_u32))
92 if (sa < clib_net_to_host_u32 (p->
raddr.
start.ip4.as_u32))
95 if (sa > clib_net_to_host_u32 (p->
raddr.
stop.ip4.as_u32))
119 if (ipsec_sa_is_set_IS_TUNNEL (s))
130 if (da < clib_net_to_host_u32 (p->
laddr.
start.ip4.as_u32))
133 if (da > clib_net_to_host_u32 (p->
laddr.
stop.ip4.as_u32))
136 if (sa < clib_net_to_host_u32 (p->
raddr.
start.ip4.as_u32))
139 if (sa > clib_net_to_host_u32 (p->
raddr.
stop.ip4.as_u32))
151 if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (
u64)) >= 0) &&
152 (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (
u64)) <= 0))
160 ip6_address_t * da,
u32 spi)
175 if (ipsec_sa_is_set_IS_TUNNEL (s))
203 u32 n_left_from, *from, thread_index;
205 u64 ipsec_unprocessed = 0, ipsec_matched = 0;
206 u64 ipsec_dropped = 0, ipsec_bypassed = 0;
212 n_left_from =
frame->n_vectors;
218 while (n_left_from > 0)
234 b[0]->
flags |= VNET_BUFFER_F_IS_IP4;
235 b[0]->
flags &= ~VNET_BUFFER_F_IS_IP6;
237 next[0] = (
u16) next32;
244 (ip0->
protocol == IP_PROTOCOL_IPSEC_ESP
245 || ip0->
protocol == IP_PROTOCOL_UDP))
275 thread_index, pi0, 1, clib_net_to_host_u16 (ip0->length));
290 (ip0->src_address.as_u32),
292 (ip0->dst_address.as_u32),
293 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
308 (ip0->src_address.as_u32),
310 (ip0->dst_address.as_u32),
311 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
316 next[0] = IPSEC_INPUT_NEXT_DROP;
331 tr->
proto = ip0->protocol;
333 tr->
spi = has_space0 ? clib_net_to_host_u32 (esp0->
spi) : ~0;
334 tr->
seq = has_space0 ? clib_net_to_host_u32 (esp0->
seq) : ~0;
339 else if (ip0->
protocol == IP_PROTOCOL_IPSEC_AH)
362 thread_index, pi0, 1, clib_net_to_host_u16 (ip0->length));
376 (ip0->src_address.as_u32),
378 (ip0->dst_address.as_u32),
379 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
394 (ip0->src_address.as_u32),
396 (ip0->dst_address.as_u32),
397 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
402 next[0] = IPSEC_INPUT_NEXT_DROP;
417 tr->
proto = ip0->protocol;
419 tr->
spi = has_space0 ? clib_net_to_host_u32 (ah0->
spi) : ~0;
420 tr->
seq = has_space0 ? clib_net_to_host_u32 (ah0->
seq_no) : ~0;
427 ipsec_unprocessed += 1;
437 IPSEC_INPUT_ERROR_RX_PKTS,
frame->n_vectors);
440 IPSEC_INPUT_ERROR_RX_POLICY_MATCH,
444 IPSEC_INPUT_ERROR_RX_POLICY_NO_MATCH,
448 IPSEC_INPUT_ERROR_RX_POLICY_DISCARD,
452 IPSEC_INPUT_ERROR_RX_POLICY_BYPASS,
455 return frame->n_vectors;
461 .name =
"ipsec4-input-feature",
462 .vector_size =
sizeof (
u32),
469 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n, 483 u32 n_left_from, *from, next_index, *to_next, thread_index;
485 u32 ipsec_unprocessed = 0;
486 u32 ipsec_matched = 0;
489 n_left_from = from_frame->n_vectors;
492 next_index =
node->cached_next_index;
494 while (n_left_from > 0)
500 while (n_left_from > 0 && n_left_to_next > 0)
510 u32 header_size =
sizeof (ip0[0]);
512 bi0 = to_next[0] = from[0];
519 b0->
flags |= VNET_BUFFER_F_IS_IP6;
520 b0->
flags &= ~VNET_BUFFER_F_IS_IP4;
533 (
"packet received from %U to %U spi %u size %u spd_id %u",
552 thread_index, pi0, 1,
566 else if (ip0->
protocol == IP_PROTOCOL_IPSEC_AH)
580 thread_index, pi0, 1,
595 ipsec_unprocessed += 1;
608 tr->
spi = clib_net_to_host_u32 (esp0->
spi);
609 tr->
seq = clib_net_to_host_u32 (esp0->
seq);
614 n_left_to_next, bi0, next0);
620 IPSEC_INPUT_ERROR_RX_PKTS,
621 from_frame->n_vectors - ipsec_unprocessed);
624 IPSEC_INPUT_ERROR_RX_POLICY_MATCH,
627 return from_frame->n_vectors;
633 .name =
"ipsec6-input-feature",
634 .vector_size =
sizeof (
u32),
641 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
ip46_address_t tunnel_src_addr
enum ipsec_spd_policy_t_ ipsec_spd_policy_type_t
u32 ah4_decrypt_next_index
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
ip46_address_range_t laddr
A Secruity Policy Database.
#define VLIB_NODE_FN(node)
u32 esp4_decrypt_next_index
vl_api_fib_path_type_t type
enum ip_protocol ip_protocol_t
static_always_inline void * vnet_feature_next_with_data(u32 *next0, vlib_buffer_t *b0, u32 n_data_bytes)
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
vlib_combined_counter_main_t ipsec_spd_policy_counters
Policy packet & bytes counters.
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
ip46_address_t tunnel_dst_addr
#define VLIB_REGISTER_NODE(x,...)
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
sll srl srl sll sra u16x4 i
#define clib_warning(format, args...)
#define vlib_prefetch_buffer_data(b, type)
u32 esp6_decrypt_next_index
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
vlib_main_t vlib_node_runtime_t * node
ipsec_policy_t * policies
u32 * policies[IPSEC_SPD_POLICY_N_TYPES]
vectors for each of the policy types
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
static uword ip6_address_is_equal(const ip6_address_t *a, const ip6_address_t *b)
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
struct _vlib_node_registration vlib_node_registration_t
static u8 vlib_buffer_has_space(vlib_buffer_t *b, word l)
Check if there is enough space in buffer to advance.
u32 ah6_decrypt_next_index
ip46_address_range_t raddr
VLIB buffer representation.
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
u32 id
the User's ID for this policy
#define vec_foreach(var, vec)
Vector iterator.
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
static int ip4_header_bytes(const ip4_header_t *i)
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
#define VLIB_NODE_FLAG_TRACE
#define foreach_ipsec_input_next
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.