27 #define foreach_ipsec_output_error \ 28 _(RX_PKTS, "IPSec pkts received") \ 29 _(POLICY_DISCARD, "IPSec policy discard") \ 30 _(POLICY_NO_MATCH, "IPSec policy (no match)") \ 31 _(POLICY_PROTECT, "IPSec policy protect") \ 32 _(POLICY_BYPASS, "IPSec policy bypass") \ 33 _(ENCAPS_FAILED, "IPSec encapsulation failed") 37 #define _(sym,str) IPSEC_OUTPUT_ERROR_##sym, 38 foreach_ipsec_output_error
41 } ipsec_output_error_t;
43 static char *ipsec_output_error_strings[] = {
44 #define _(sym,string) string, 45 foreach_ipsec_output_error
53 } ipsec_output_trace_t;
57 format_ipsec_output_trace (
u8 * s, va_list * args)
61 ipsec_output_trace_t *t = va_arg (*args, ipsec_output_trace_t *);
63 s =
format (s,
"spd %u policy %d", t->spd_id, t->policy_id);
85 if (ra < clib_net_to_host_u32 (p->
raddr.
start.ip4.as_u32))
88 if (ra > clib_net_to_host_u32 (p->
raddr.
stop.ip4.as_u32))
91 if (la < clib_net_to_host_u32 (p->
laddr.
start.ip4.as_u32))
94 if (la > clib_net_to_host_u32 (p->
laddr.
stop.ip4.as_u32))
98 ((pr != IP_PROTOCOL_TCP) && (pr != IP_PROTOCOL_UDP)
99 && (pr != IP_PROTOCOL_SCTP)))
102 if (lp < p->lport.start)
108 if (rp < p->rport.start)
123 if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (
u64)) >= 0) &&
124 (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (
u64)) <= 0))
132 ip6_address_t * ra,
u16 lp,
u16 rp,
u8 pr)
154 ((pr != IP_PROTOCOL_TCP) && (pr != IP_PROTOCOL_UDP)
155 && (pr != IP_PROTOCOL_SCTP)))
158 if (lp < p->lport.start)
164 if (rp < p->rport.start)
182 u32 *from, *to_next = 0, thread_index;
183 u32 n_left_from, sw_if_index0, last_sw_if_index = (
u32) ~ 0;
184 u32 next_node_index = (
u32) ~ 0, last_next_node_index = (
u32) ~ 0;
189 u64 nc_protect = 0, nc_bypass = 0, nc_discard = 0, nc_nomatch = 0;
195 while (n_left_from > 0)
217 iph_offset =
vnet_buffer (b0)->ip.save_rewrite_length;
228 last_sw_if_index = sw_if_index0;
239 (
"packet received from %U port %u to %U port %u spd_id %u",
246 p0 = ipsec6_output_policy_match (spd0,
262 clib_net_to_host_u16 (udp0->
dst_port));
263 clib_warning (
"sw_if_index0 %u spd_index0 %u spd_id %u",
264 sw_if_index0, spd_index0, spd0->
id);
267 p0 = ipsec_output_policy_match (spd0, ip0->
protocol,
277 tcp0 = (
void *) udp0;
293 bytes0 = clib_net_to_host_u16 (ip0->
length);
296 if (p0->
policy == IPSEC_POLICY_ACTION_PROTECT)
315 (b0->
flags & VNET_BUFFER_F_OFFLOAD_TCP_CKSUM))
320 b0->
flags &= ~VNET_BUFFER_F_OFFLOAD_TCP_CKSUM;
323 (b0->
flags & VNET_BUFFER_F_OFFLOAD_UDP_CKSUM))
328 b0->
flags &= ~VNET_BUFFER_F_OFFLOAD_UDP_CKSUM;
333 if (b0->
flags & VNET_BUFFER_F_OFFLOAD_IP_CKSUM)
336 b0->
flags &= ~VNET_BUFFER_F_OFFLOAD_IP_CKSUM;
339 (b0->
flags & VNET_BUFFER_F_OFFLOAD_TCP_CKSUM))
343 b0->
flags &= ~VNET_BUFFER_F_OFFLOAD_TCP_CKSUM;
346 (b0->
flags & VNET_BUFFER_F_OFFLOAD_UDP_CKSUM))
350 b0->
flags &= ~VNET_BUFFER_F_OFFLOAD_UDP_CKSUM;
355 else if (p0->
policy == IPSEC_POLICY_ACTION_BYPASS)
378 if (
PREDICT_FALSE ((last_next_node_index != next_node_index) || f == 0))
384 last_next_node_index = next_node_index;
402 ipsec_output_trace_t *tr =
405 tr->spd_id = spd0->
id;
412 IPSEC_OUTPUT_ERROR_POLICY_PROTECT, nc_protect);
414 IPSEC_OUTPUT_ERROR_POLICY_BYPASS, nc_bypass);
416 IPSEC_OUTPUT_ERROR_POLICY_DISCARD, nc_discard);
418 IPSEC_OUTPUT_ERROR_POLICY_NO_MATCH,
427 return ipsec_output_inline (vm, node,
frame, 0);
432 .name =
"ipsec4-output-feature",
433 .vector_size =
sizeof (
u32),
434 .format_trace = format_ipsec_output_trace,
437 .n_errors =
ARRAY_LEN(ipsec_output_error_strings),
438 .error_strings = ipsec_output_error_strings,
442 #define _(s,n) [IPSEC_OUTPUT_NEXT_##s] = n, 453 return ipsec_output_inline (vm, node,
frame, 1);
458 .name =
"ipsec6-output-feature",
459 .vector_size =
sizeof (
u32),
460 .format_trace = format_ipsec_output_trace,
463 .n_errors =
ARRAY_LEN(ipsec_output_error_strings),
464 .error_strings = ipsec_output_error_strings,
468 #define _(s,n) [IPSEC_OUTPUT_NEXT_##s] = n, 488 .vector_size =
sizeof (
u32),
490 .
name =
"ipsec4-output-feature",
494 .vector_size =
sizeof (
u32),
496 .
name =
"ipsec6-output-feature",
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
ip46_address_range_t laddr
A Secruity Policy Database.
#define VLIB_NODE_FN(node)
struct _tcp_header tcp_header_t
uword * spd_index_by_sw_if_index
u32 esp6_encrypt_node_index
vlib_frame_t * vlib_get_frame_to_node(vlib_main_t *vm, u32 to_node_index)
#define ALWAYS_ASSERT(truth)
vl_api_fib_path_type_t type
u32 error_drop_node_index
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
vlib_combined_counter_main_t ipsec_spd_policy_counters
Policy packet & bytes counters.
u32 esp4_encrypt_node_index
void vlib_put_frame_to_node(vlib_main_t *vm, u32 to_node_index, vlib_frame_t *f)
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
static void vlib_prefetch_combined_counter(const vlib_combined_counter_main_t *cm, u32 thread_index, u32 index)
Pre-fetch a per-thread combined counter for the given object index.
u32 node_index
Node index.
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
#define VLIB_REGISTER_NODE(x,...)
#define CLIB_PREFETCH(addr, size, type)
sll srl srl sll sra u16x4 i
ipsec_policy_action_t policy
#define clib_warning(format, args...)
#define vlib_prefetch_buffer_data(b, type)
static_always_inline u32 get_next_output_feature_node_index(vlib_buffer_t *b, vlib_node_runtime_t *nr)
vlib_main_t vlib_node_runtime_t * node
static void * ip6_next_header(ip6_header_t *i)
u16 ip6_tcp_udp_icmp_compute_checksum(vlib_main_t *vm, vlib_buffer_t *p0, ip6_header_t *ip0, int *bogus_lengthp)
u32 ah4_encrypt_node_index
ipsec_policy_t * policies
u16 ip4_tcp_udp_compute_checksum(vlib_main_t *vm, vlib_buffer_t *p0, ip4_header_t *ip0)
u32 * policies[IPSEC_SPD_POLICY_N_TYPES]
vectors for each of the policy types
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
ipsec_protocol_t protocol
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
u32 ah6_encrypt_node_index
ip46_address_range_t raddr
VLIB buffer representation.
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
static uword ipsec_output_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
u32 id
the User's ID for this policy
#define vec_foreach(var, vec)
Vector iterator.
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
u16 flags
Copy of main node flags.
static int ip4_header_bytes(const ip4_header_t *i)
#define VLIB_NODE_FLAG_TRACE
#define CLIB_CACHE_LINE_BYTES
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
static u16 ip4_header_checksum(ip4_header_t *i)
#define foreach_ipsec_output_next