2 * decap.c : IPSec tunnel decapsulation
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/feature/feature.h>
22 #include <vnet/ipsec/ipsec_spd_fp_lookup.h>
24 #include <vnet/ipsec/ipsec.h>
25 #include <vnet/ipsec/esp.h>
26 #include <vnet/ipsec/ah.h>
27 #include <vnet/ipsec/ipsec_io.h>
29 #define foreach_ipsec_input_error \
30 _(RX_PKTS, "IPSec pkts received") \
31 _(RX_POLICY_MATCH, "IPSec policy match") \
32 _(RX_POLICY_NO_MATCH, "IPSec policy not matched") \
33 _(RX_POLICY_BYPASS, "IPSec policy bypass") \
34 _(RX_POLICY_DISCARD, "IPSec policy discard")
38 #define _(sym,str) IPSEC_INPUT_ERROR_##sym,
39 foreach_ipsec_input_error
42 } ipsec_input_error_t;
44 static char *ipsec_input_error_strings[] = {
45 #define _(sym,string) string,
46 foreach_ipsec_input_error
59 } ipsec_input_trace_t;
61 /* packet trace format function */
63 format_ipsec_input_trace (u8 * s, va_list * args)
65 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
66 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
67 ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
70 format (s, "%U: sa_id %u type: %u spd %u policy %d spi %u (0x%08x) seq %u",
71 format_ip_protocol, t->proto, t->sa_id, t->policy_type, t->spd,
72 t->policy_index, t->spi, t->spi, t->seq);
78 ipsec4_input_spd_add_flow_cache_entry (ipsec_main_t *im, u32 sa, u32 da,
79 ipsec_spd_policy_type_t policy_type,
83 u8 is_overwrite = 0, is_stale_overwrite = 0;
84 /* Store in network byte order to avoid conversion on lookup */
85 ipsec4_inbound_spd_tuple_t ip4_tuple = {
86 .ip4_src_addr = (ip4_address_t) clib_host_to_net_u32 (sa),
87 .ip4_dest_addr = (ip4_address_t) clib_host_to_net_u32 (da),
88 .policy_type = policy_type
91 ip4_tuple.kv_16_8.value =
92 (((u64) pol_id) << 32) | ((u64) im->input_epoch_count);
94 hash = ipsec4_hash_16_8 (&ip4_tuple.kv_16_8);
95 hash &= (im->ipsec4_in_spd_hash_num_buckets - 1);
97 ipsec_spinlock_lock (&im->ipsec4_in_spd_hash_tbl[hash].bucket_lock);
98 /* Check if we are overwriting an existing entry so we know
99 whether to increment the flow cache counter. Since flow
100 cache counter is reset on any policy add/remove, but
101 hash table values are not, we need to check if the entry
102 we are overwriting is stale or not. If it's a stale entry
103 overwrite, we still want to increment flow cache counter */
104 is_overwrite = (im->ipsec4_in_spd_hash_tbl[hash].value != 0);
105 /* Check if we are overwriting a stale entry by comparing
106 with current epoch count */
107 if (PREDICT_FALSE (is_overwrite))
109 (im->input_epoch_count !=
110 ((u32) (im->ipsec4_in_spd_hash_tbl[hash].value & 0xFFFFFFFF)));
111 clib_memcpy_fast (&im->ipsec4_in_spd_hash_tbl[hash], &ip4_tuple.kv_16_8,
112 sizeof (ip4_tuple.kv_16_8));
113 ipsec_spinlock_unlock (&im->ipsec4_in_spd_hash_tbl[hash].bucket_lock);
115 /* Increment the counter to track active flow cache entries
116 when entering a fresh entry or overwriting a stale one */
117 if (!is_overwrite || is_stale_overwrite)
118 clib_atomic_fetch_add_relax (&im->ipsec4_in_spd_flow_cache_entries, 1);
123 always_inline ipsec_policy_t *
124 ipsec4_input_spd_find_flow_cache_entry (ipsec_main_t *im, u32 sa, u32 da,
125 ipsec_spd_policy_type_t policy_type)
127 ipsec_policy_t *p = NULL;
128 ipsec4_hash_kv_16_8_t kv_result;
130 ipsec4_inbound_spd_tuple_t ip4_tuple = { .ip4_src_addr = (ip4_address_t) sa,
131 .ip4_dest_addr = (ip4_address_t) da,
132 .policy_type = policy_type };
134 hash = ipsec4_hash_16_8 (&ip4_tuple.kv_16_8);
135 hash &= (im->ipsec4_in_spd_hash_num_buckets - 1);
137 ipsec_spinlock_lock (&im->ipsec4_in_spd_hash_tbl[hash].bucket_lock);
138 kv_result = im->ipsec4_in_spd_hash_tbl[hash];
139 ipsec_spinlock_unlock (&im->ipsec4_in_spd_hash_tbl[hash].bucket_lock);
141 if (ipsec4_hash_key_compare_16_8 ((u64 *) &ip4_tuple.kv_16_8,
144 if (im->input_epoch_count == ((u32) (kv_result.value & 0xFFFFFFFF)))
146 /* Get the policy based on the index */
148 pool_elt_at_index (im->policies, ((u32) (kv_result.value >> 32)));
156 ipsec_fp_in_5tuple_from_ip4_range (ipsec_fp_5tuple_t *tuple, u32 sa, u32 da,
159 clib_memset (tuple->l3_zero_pad, 0, sizeof (tuple->l3_zero_pad));
160 tuple->laddr.as_u32 = da;
161 tuple->raddr.as_u32 = sa;
163 tuple->action = action;
168 ipsec_fp_in_5tuple_from_ip6_range (ipsec_fp_5tuple_t *tuple, ip6_address_t *sa,
169 ip6_address_t *da, u32 spi, u8 action)
172 clib_memcpy (&tuple->ip6_laddr, da, sizeof (ip6_address_t));
173 clib_memcpy (&tuple->ip6_raddr, sa, sizeof (ip6_address_t));
176 tuple->action = action;
180 always_inline ipsec_policy_t *
181 ipsec_input_policy_match (ipsec_spd_t *spd, u32 sa, u32 da,
182 ipsec_spd_policy_type_t policy_type)
184 ipsec_main_t *im = &ipsec_main;
188 vec_foreach (i, spd->policies[policy_type])
190 p = pool_elt_at_index (im->policies, *i);
192 if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
195 if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
198 if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
201 if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
204 if (im->input_flow_cache_flag)
206 /* Add an Entry in Flow cache */
207 ipsec4_input_spd_add_flow_cache_entry (im, sa, da, policy_type, *i);
214 always_inline ipsec_policy_t *
215 ipsec_input_protect_policy_match (ipsec_spd_t *spd, u32 sa, u32 da, u32 spi)
217 ipsec_main_t *im = &ipsec_main;
222 vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT])
224 p = pool_elt_at_index (im->policies, *i);
225 s = ipsec_sa_get (p->sa_index);
230 if (ipsec_sa_is_set_IS_TUNNEL (s))
232 if (da != clib_net_to_host_u32 (s->tunnel.t_dst.ip.ip4.as_u32))
235 if (sa != clib_net_to_host_u32 (s->tunnel.t_src.ip.ip4.as_u32))
241 if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
244 if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
247 if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
250 if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
254 if (im->input_flow_cache_flag)
256 /* Add an Entry in Flow cache */
257 ipsec4_input_spd_add_flow_cache_entry (
258 im, sa, da, IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT, *i);
267 ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la,
270 if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
271 (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
276 always_inline ipsec_policy_t *
277 ipsec6_input_protect_policy_match (ipsec_spd_t * spd,
279 ip6_address_t * da, u32 spi)
281 ipsec_main_t *im = &ipsec_main;
286 vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT])
288 p = pool_elt_at_index (im->policies, *i);
289 s = ipsec_sa_get (p->sa_index);
294 if (ipsec_sa_is_set_IS_TUNNEL (s))
296 if (!ip6_address_is_equal (sa, &s->tunnel.t_src.ip.ip6))
299 if (!ip6_address_is_equal (da, &s->tunnel.t_dst.ip.ip6))
305 if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6))
308 if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6))
316 extern vlib_node_registration_t ipsec4_input_node;
318 VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
319 vlib_node_runtime_t * node,
320 vlib_frame_t * frame)
322 u32 n_left_from, *from, thread_index;
323 ipsec_main_t *im = &ipsec_main;
324 u64 ipsec_unprocessed = 0, ipsec_matched = 0;
325 u64 ipsec_dropped = 0, ipsec_bypassed = 0;
326 vlib_buffer_t *bufs[VLIB_FRAME_SIZE];
327 vlib_buffer_t **b = bufs;
328 u16 nexts[VLIB_FRAME_SIZE], *next;
330 from = vlib_frame_vector_args (frame);
331 n_left_from = frame->n_vectors;
333 vlib_get_buffers (vm, from, bufs, n_left_from);
334 thread_index = vm->thread_index;
337 while (n_left_from > 0)
341 esp_header_t *esp0 = NULL;
343 ip4_ipsec_config_t *c0;
345 ipsec_policy_t *p0 = NULL;
347 bool search_flow_cache = false;
348 ipsec_policy_t *policies[1];
349 ipsec_fp_5tuple_t tuples[1];
354 vlib_prefetch_buffer_data (b[1], LOAD);
357 b[0]->flags |= VNET_BUFFER_F_IS_IP4;
358 b[0]->flags &= ~VNET_BUFFER_F_IS_IP6;
359 c0 = vnet_feature_next_with_data (&next32, b[0], sizeof (c0[0]));
360 next[0] = (u16) next32;
362 spd0 = pool_elt_at_index (im->spds, c0->spd_index);
364 ip0 = vlib_buffer_get_current (b[0]);
367 (ip0->protocol == IP_PROTOCOL_IPSEC_ESP
368 || ip0->protocol == IP_PROTOCOL_UDP))
371 esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
372 if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_UDP))
374 /* FIXME Skip, if not a UDP encapsulated packet */
375 esp0 = (esp_header_t *) ((u8 *) esp0 + sizeof (udp_header_t));
378 // if flow cache is enabled, first search through flow cache for a
379 // policy match for either protect, bypass or discard rules, in that
380 // order. if no match is found search_flow_cache is set to false (1)
381 // and we revert back to linear search
382 search_flow_cache = im->input_flow_cache_flag;
385 if (im->fp_spd_ipv4_in_is_enabled &&
386 PREDICT_TRUE (INDEX_INVALID !=
387 spd0->fp_spd.ip4_in_lookup_hash_idx))
389 ipsec_fp_in_5tuple_from_ip4_range (
390 &tuples[0], ip0->src_address.as_u32, ip0->dst_address.as_u32,
391 clib_net_to_host_u32 (esp0->spi),
392 IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT);
393 ipsec_fp_in_policy_match_n (&spd0->fp_spd, !ip_v6, tuples,
397 else if (search_flow_cache) // attempt to match policy in flow cache
399 p0 = ipsec4_input_spd_find_flow_cache_entry (
400 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
401 IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT);
404 else // linear search if flow cache is not enabled,
405 // or flow cache search just failed
407 p0 = ipsec_input_protect_policy_match (
408 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
409 clib_net_to_host_u32 (ip0->dst_address.as_u32),
410 clib_net_to_host_u32 (esp0->spi));
414 vlib_buffer_has_space (b[0],
415 (clib_address_t) (esp0 + 1) -
416 (clib_address_t) ip0);
418 if (PREDICT_TRUE ((p0 != NULL) & (has_space0)))
422 pi0 = p0 - im->policies;
423 vlib_increment_combined_counter
424 (&ipsec_spd_policy_counters,
425 thread_index, pi0, 1, clib_net_to_host_u16 (ip0->length));
427 vnet_buffer (b[0])->ipsec.sad_index = p0->sa_index;
428 next[0] = im->esp4_decrypt_next_index;
429 vlib_buffer_advance (b[0], ((u8 *) esp0 - (u8 *) ip0));
438 if (im->fp_spd_ipv4_in_is_enabled &&
439 PREDICT_TRUE (INDEX_INVALID !=
440 spd0->fp_spd.ip4_in_lookup_hash_idx))
442 tuples->action = IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS;
443 ipsec_fp_in_policy_match_n (&spd0->fp_spd, !ip_v6, tuples,
447 else if (search_flow_cache)
449 p0 = ipsec4_input_spd_find_flow_cache_entry (
450 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
451 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
456 p0 = ipsec_input_policy_match (
457 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
458 clib_net_to_host_u32 (ip0->dst_address.as_u32),
459 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
462 if (PREDICT_TRUE ((p0 != NULL)))
466 pi0 = p0 - im->policies;
467 vlib_increment_combined_counter (
468 &ipsec_spd_policy_counters, thread_index, pi0, 1,
469 clib_net_to_host_u16 (ip0->length));
479 if (im->fp_spd_ipv4_in_is_enabled &&
480 PREDICT_TRUE (INDEX_INVALID !=
481 spd0->fp_spd.ip4_in_lookup_hash_idx))
483 tuples->action = IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD;
484 ipsec_fp_in_policy_match_n (&spd0->fp_spd, !ip_v6, tuples,
490 if (search_flow_cache)
492 p0 = ipsec4_input_spd_find_flow_cache_entry (
493 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
494 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
499 p0 = ipsec_input_policy_match (
500 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
501 clib_net_to_host_u32 (ip0->dst_address.as_u32),
502 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
505 if (PREDICT_TRUE ((p0 != NULL)))
509 pi0 = p0 - im->policies;
510 vlib_increment_combined_counter (
511 &ipsec_spd_policy_counters, thread_index, pi0, 1,
512 clib_net_to_host_u16 (ip0->length));
514 next[0] = IPSEC_INPUT_NEXT_DROP;
523 // flow cache search failed, try again with linear search
524 if (search_flow_cache && p0 == NULL)
526 search_flow_cache = false;
530 /* Drop by default if no match on PROTECT, BYPASS or DISCARD */
531 ipsec_unprocessed += 1;
532 next[0] = IPSEC_INPUT_NEXT_DROP;
535 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
536 PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
538 ipsec_input_trace_t *tr =
539 vlib_add_trace (vm, node, b[0], sizeof (*tr));
541 tr->proto = ip0->protocol;
542 tr->sa_id = p0 ? p0->sa_id : ~0;
543 tr->spi = has_space0 ? clib_net_to_host_u32 (esp0->spi) : ~0;
544 tr->seq = has_space0 ? clib_net_to_host_u32 (esp0->seq) : ~0;
546 tr->policy_index = pi0;
549 else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
551 ah0 = (ah_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
553 // if flow cache is enabled, first search through flow cache for a
554 // policy match and revert back to linear search on failure
555 search_flow_cache = im->input_flow_cache_flag;
558 if (search_flow_cache)
560 p0 = ipsec4_input_spd_find_flow_cache_entry (
561 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
562 IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT);
567 p0 = ipsec_input_protect_policy_match (
568 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
569 clib_net_to_host_u32 (ip0->dst_address.as_u32),
570 clib_net_to_host_u32 (ah0->spi));
574 vlib_buffer_has_space (b[0],
575 (clib_address_t) (ah0 + 1) -
576 (clib_address_t) ip0);
578 if (PREDICT_TRUE ((p0 != NULL) & (has_space0)))
582 pi0 = p0 - im->policies;
583 vlib_increment_combined_counter
584 (&ipsec_spd_policy_counters,
585 thread_index, pi0, 1, clib_net_to_host_u16 (ip0->length));
587 vnet_buffer (b[0])->ipsec.sad_index = p0->sa_index;
588 next[0] = im->ah4_decrypt_next_index;
597 if (search_flow_cache)
599 p0 = ipsec4_input_spd_find_flow_cache_entry (
600 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
601 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
606 p0 = ipsec_input_policy_match (
607 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
608 clib_net_to_host_u32 (ip0->dst_address.as_u32),
609 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
612 if (PREDICT_TRUE ((p0 != NULL)))
616 pi0 = p0 - im->policies;
617 vlib_increment_combined_counter (
618 &ipsec_spd_policy_counters, thread_index, pi0, 1,
619 clib_net_to_host_u16 (ip0->length));
629 if (search_flow_cache)
631 p0 = ipsec4_input_spd_find_flow_cache_entry (
632 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
633 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
638 p0 = ipsec_input_policy_match (
639 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
640 clib_net_to_host_u32 (ip0->dst_address.as_u32),
641 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
644 if (PREDICT_TRUE ((p0 != NULL)))
648 pi0 = p0 - im->policies;
649 vlib_increment_combined_counter (
650 &ipsec_spd_policy_counters, thread_index, pi0, 1,
651 clib_net_to_host_u16 (ip0->length));
653 next[0] = IPSEC_INPUT_NEXT_DROP;
662 // flow cache search failed, retry with linear search
663 if (search_flow_cache && p0 == NULL)
665 search_flow_cache = false;
669 /* Drop by default if no match on PROTECT, BYPASS or DISCARD */
670 ipsec_unprocessed += 1;
671 next[0] = IPSEC_INPUT_NEXT_DROP;
674 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
675 PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
677 ipsec_input_trace_t *tr =
678 vlib_add_trace (vm, node, b[0], sizeof (*tr));
680 tr->proto = ip0->protocol;
681 tr->sa_id = p0 ? p0->sa_id : ~0;
682 tr->spi = has_space0 ? clib_net_to_host_u32 (ah0->spi) : ~0;
683 tr->seq = has_space0 ? clib_net_to_host_u32 (ah0->seq_no) : ~0;
685 tr->policy_index = pi0;
690 ipsec_unprocessed += 1;
697 vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
699 vlib_node_increment_counter (vm, ipsec4_input_node.index,
700 IPSEC_INPUT_ERROR_RX_PKTS, frame->n_vectors);
702 vlib_node_increment_counter (vm, ipsec4_input_node.index,
703 IPSEC_INPUT_ERROR_RX_POLICY_MATCH,
706 vlib_node_increment_counter (vm, ipsec4_input_node.index,
707 IPSEC_INPUT_ERROR_RX_POLICY_NO_MATCH,
710 vlib_node_increment_counter (vm, ipsec4_input_node.index,
711 IPSEC_INPUT_ERROR_RX_POLICY_DISCARD,
714 vlib_node_increment_counter (vm, ipsec4_input_node.index,
715 IPSEC_INPUT_ERROR_RX_POLICY_BYPASS,
718 return frame->n_vectors;
723 VLIB_REGISTER_NODE (ipsec4_input_node) = {
724 .name = "ipsec4-input-feature",
725 .vector_size = sizeof (u32),
726 .format_trace = format_ipsec_input_trace,
727 .type = VLIB_NODE_TYPE_INTERNAL,
728 .n_errors = ARRAY_LEN(ipsec_input_error_strings),
729 .error_strings = ipsec_input_error_strings,
730 .n_next_nodes = IPSEC_INPUT_N_NEXT,
732 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
733 foreach_ipsec_input_next
739 extern vlib_node_registration_t ipsec6_input_node;
742 VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
743 vlib_node_runtime_t * node,
744 vlib_frame_t * from_frame)
746 u32 n_left_from, *from, next_index, *to_next, thread_index;
747 ipsec_main_t *im = &ipsec_main;
748 u32 ipsec_unprocessed = 0;
749 u32 ipsec_matched = 0;
750 ipsec_policy_t *policies[1];
751 ipsec_fp_5tuple_t tuples[1];
754 from = vlib_frame_vector_args (from_frame);
755 n_left_from = from_frame->n_vectors;
756 thread_index = vm->thread_index;
758 next_index = node->cached_next_index;
760 while (n_left_from > 0)
764 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
766 while (n_left_from > 0 && n_left_to_next > 0)
768 u32 bi0, next0, pi0 = ~0;
772 ip4_ipsec_config_t *c0;
774 ipsec_policy_t *p0 = 0;
776 u32 header_size = sizeof (ip0[0]);
778 bi0 = to_next[0] = from[0];
784 b0 = vlib_get_buffer (vm, bi0);
785 b0->flags |= VNET_BUFFER_F_IS_IP6;
786 b0->flags &= ~VNET_BUFFER_F_IS_IP4;
787 c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
789 spd0 = pool_elt_at_index (im->spds, c0->spd_index);
791 ip0 = vlib_buffer_get_current (b0);
792 esp0 = (esp_header_t *) ((u8 *) ip0 + header_size);
793 ah0 = (ah_header_t *) ((u8 *) ip0 + header_size);
795 if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
799 ("packet received from %U to %U spi %u size %u spd_id %u",
800 format_ip6_address, &ip0->src_address, format_ip6_address,
801 &ip0->dst_address, clib_net_to_host_u32 (esp0->spi),
802 clib_net_to_host_u16 (ip0->payload_length) + header_size,
805 if (im->fp_spd_ipv6_in_is_enabled &&
806 PREDICT_TRUE (INDEX_INVALID !=
807 spd0->fp_spd.ip6_in_lookup_hash_idx))
809 ipsec_fp_in_5tuple_from_ip6_range (
810 &tuples[0], &ip0->src_address, &ip0->dst_address,
811 clib_net_to_host_u32 (esp0->spi),
812 IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT);
813 ipsec_fp_in_policy_match_n (&spd0->fp_spd, ip_v6, tuples,
818 p0 = ipsec6_input_protect_policy_match (
819 spd0, &ip0->src_address, &ip0->dst_address,
820 clib_net_to_host_u32 (esp0->spi));
822 if (PREDICT_TRUE (p0 != 0))
826 pi0 = p0 - im->policies;
827 vlib_increment_combined_counter
828 (&ipsec_spd_policy_counters,
829 thread_index, pi0, 1,
830 clib_net_to_host_u16 (ip0->payload_length) +
833 vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
834 next0 = im->esp6_decrypt_next_index;
835 vlib_buffer_advance (b0, header_size);
836 /* TODO Add policy matching for bypass and discard policy
843 ipsec_unprocessed += 1;
844 next0 = IPSEC_INPUT_NEXT_DROP;
847 else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
849 p0 = ipsec6_input_protect_policy_match (spd0,
855 if (PREDICT_TRUE (p0 != 0))
858 pi0 = p0 - im->policies;
859 vlib_increment_combined_counter
860 (&ipsec_spd_policy_counters,
861 thread_index, pi0, 1,
862 clib_net_to_host_u16 (ip0->payload_length) +
865 vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
866 next0 = im->ah6_decrypt_next_index;
872 ipsec_unprocessed += 1;
873 next0 = IPSEC_INPUT_NEXT_DROP;
878 ipsec_unprocessed += 1;
882 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
883 PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
885 ipsec_input_trace_t *tr =
886 vlib_add_trace (vm, node, b0, sizeof (*tr));
890 tr->sa_id = p0->sa_id;
891 tr->policy_type = p0->type;
894 tr->proto = ip0->protocol;
895 tr->spi = clib_net_to_host_u32 (esp0->spi);
896 tr->seq = clib_net_to_host_u32 (esp0->seq);
898 tr->policy_index = pi0;
901 vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
902 n_left_to_next, bi0, next0);
904 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
907 vlib_node_increment_counter (vm, ipsec6_input_node.index,
908 IPSEC_INPUT_ERROR_RX_PKTS,
909 from_frame->n_vectors - ipsec_unprocessed);
911 vlib_node_increment_counter (vm, ipsec6_input_node.index,
912 IPSEC_INPUT_ERROR_RX_POLICY_MATCH,
915 return from_frame->n_vectors;
920 VLIB_REGISTER_NODE (ipsec6_input_node) = {
921 .name = "ipsec6-input-feature",
922 .vector_size = sizeof (u32),
923 .format_trace = format_ipsec_input_trace,
924 .type = VLIB_NODE_TYPE_INTERNAL,
925 .n_errors = ARRAY_LEN(ipsec_input_error_strings),
926 .error_strings = ipsec_input_error_strings,
927 .n_next_nodes = IPSEC_INPUT_N_NEXT,
929 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
930 foreach_ipsec_input_next
937 * fd.io coding-style-patch-verification: ON
940 * eval: (c-set-style "gnu")