2 * decap.c : L2TPv3 tunnel decapsulation
4 * Copyright (c) 2013 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vppinfra/error.h>
19 #include <vppinfra/hash.h>
20 #include <vnet/vnet.h>
21 #include <vnet/ip/ip.h>
22 #include <vnet/ethernet/ethernet.h>
23 #include <vnet/l2tp/l2tp.h>
24 #include <vnet/l2/l2_input.h>
26 /* Statistics (not really errors) */
27 #define foreach_l2t_decap_error \
28 _(USER_TO_NETWORK, "L2TP user (ip6) to L2 network pkts") \
29 _(SESSION_ID_MISMATCH, "l2tpv3 local session id mismatches") \
30 _(COOKIE_MISMATCH, "l2tpv3 local cookie mismatches") \
31 _(NO_SESSION, "l2tpv3 session not found") \
32 _(ADMIN_DOWN, "l2tpv3 tunnel is down")
34 static char *l2t_decap_error_strings[] = {
35 #define _(sym,string) string,
36 foreach_l2t_decap_error
42 #define _(sym,str) L2T_DECAP_ERROR_##sym,
43 foreach_l2t_decap_error
51 L2T_DECAP_NEXT_L2_INPUT,
53 /* Pseudo next index */
54 L2T_DECAP_NEXT_NO_INTERCEPT = L2T_DECAP_N_NEXT,
60 stage0 (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_buffer_t * b)
62 vlib_prefetch_buffer_header (b, STORE);
63 /* l2tpv3 header is a long way away, need 2 cache lines */
64 CLIB_PREFETCH (b->data, 2 * CLIB_CACHE_LINE_BYTES, STORE);
68 stage1 (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_buffer_t * b)
70 l2t_main_t *lm = &l2t_main;
71 ip6_header_t *ip6 = vlib_buffer_get_current (b);
76 /* Not L2tpv3 (0x73, 0t115)? Use the normal path. */
77 if (PREDICT_FALSE (ip6->protocol != IP_PROTOCOL_L2TP))
79 vnet_buffer (b)->l2t.next_index = L2T_DECAP_NEXT_NO_INTERCEPT;
83 /* Make up your minds, people... */
84 switch (lm->lookup_type)
86 case L2T_LOOKUP_SRC_ADDRESS:
87 p = hash_get_mem (lm->session_by_src_address, &ip6->src_address);
89 case L2T_LOOKUP_DST_ADDRESS:
90 p = hash_get_mem (lm->session_by_dst_address, &ip6->dst_address);
92 case L2T_LOOKUP_SESSION_ID:
93 l2t = (l2tpv3_header_t *) (ip6 + 1);
94 p = hash_get (lm->session_by_session_id, l2t->session_id);
100 if (PREDICT_FALSE (p == 0))
102 vnet_buffer (b)->l2t.next_index = L2T_DECAP_NEXT_NO_INTERCEPT;
107 session_index = p[0];
110 /* Remember mapping index, prefetch the mini counter */
111 vnet_buffer (b)->l2t.next_index = L2T_DECAP_NEXT_L2_INPUT;
112 vnet_buffer (b)->l2t.session_index = session_index;
114 /* $$$$$ prefetch counter */
118 last_stage (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_buffer_t * b)
120 l2t_main_t *lm = &l2t_main;
121 ip6_header_t *ip6 = vlib_buffer_get_current (b);
122 vlib_node_t *n = vlib_get_node (vm, node->node_index);
123 u32 node_counter_base_index = n->error_heap_index;
124 vlib_error_main_t *em = &vm->error_main;
125 l2tpv3_header_t *l2tp;
127 l2t_session_t *session = 0;
130 u8 l2tp_decap_local = (l2t_decap_local_node.index == n->index);
132 /* Other-than-output pkt? We're done... */
133 if (vnet_buffer (b)->l2t.next_index != L2T_DECAP_NEXT_L2_INPUT)
135 next_index = vnet_buffer (b)->l2t.next_index;
139 em->counters[node_counter_base_index + L2T_DECAP_ERROR_USER_TO_NETWORK] +=
142 session_index = vnet_buffer (b)->l2t.session_index;
145 session_index_to_counter_index (session_index,
146 SESSION_COUNTER_USER_TO_NETWORK);
148 /* per-mapping byte stats include the ethernet header */
149 vlib_increment_combined_counter (&lm->counter_main,
150 vlib_get_thread_index (),
151 counter_index, 1 /* packet_increment */ ,
152 vlib_buffer_length_in_chain (vm, b) +
153 sizeof (ethernet_header_t));
155 session = pool_elt_at_index (lm->sessions, session_index);
157 l2tp = vlib_buffer_get_current (b) + sizeof (*ip6);
159 if (PREDICT_FALSE (l2tp->session_id != session->local_session_id))
161 /* Key matched but session id does not. Assume packet is not for us. */
162 em->counters[node_counter_base_index +
163 L2T_DECAP_ERROR_SESSION_ID_MISMATCH] += 1;
164 next_index = L2T_DECAP_NEXT_NO_INTERCEPT;
168 if (PREDICT_FALSE (l2tp->cookie != session->local_cookie[0]))
170 if (l2tp->cookie != session->local_cookie[1])
172 /* Key and session ID matched, but cookie doesn't. Drop this packet. */
173 b->error = node->errors[L2T_DECAP_ERROR_COOKIE_MISMATCH];
174 next_index = L2T_DECAP_NEXT_DROP;
179 vnet_buffer (b)->sw_if_index[VLIB_RX] = session->sw_if_index;
181 if (PREDICT_FALSE (!(session->admin_up)))
183 b->error = node->errors[L2T_DECAP_ERROR_ADMIN_DOWN];
184 next_index = L2T_DECAP_NEXT_DROP;
188 /* strip the ip6 and L2TP header */
189 vlib_buffer_advance (b, sizeof (*ip6) + session->l2tp_hdr_size);
191 /* Required to make the l2 tag push / pop code work on l2 subifs */
192 vnet_update_l2_len (b);
194 if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
196 l2t_trace_t *t = vlib_add_trace (vm, node, b, sizeof (*t));
197 t->is_user_to_network = 1;
198 t->our_address.as_u64[0] = ip6->dst_address.as_u64[0];
199 t->our_address.as_u64[1] = ip6->dst_address.as_u64[1];
200 t->client_address.as_u64[0] = ip6->src_address.as_u64[0];
201 t->client_address.as_u64[1] = ip6->src_address.as_u64[1];
202 t->session_index = session_index;
205 return L2T_DECAP_NEXT_L2_INPUT;
208 if (next_index == L2T_DECAP_NEXT_NO_INTERCEPT)
210 /* Small behavioral change between l2tp-decap and l2tp-decap-local */
211 if (l2tp_decap_local)
213 b->error = node->errors[L2T_DECAP_ERROR_NO_SESSION];
214 next_index = L2T_DECAP_NEXT_DROP;
218 /* Go to next node on the ip6 configuration chain */
219 if (PREDICT_TRUE (session != 0))
220 vnet_feature_next (&next_index, b);
224 if (PREDICT_FALSE (b->flags & VLIB_BUFFER_IS_TRACED))
226 l2t_trace_t *t = vlib_add_trace (vm, node, b, sizeof (*t));
227 t->is_user_to_network = 1;
228 t->our_address.as_u64[0] = ip6->dst_address.as_u64[0];
229 t->our_address.as_u64[1] = ip6->dst_address.as_u64[1];
230 t->client_address.as_u64[0] = ip6->src_address.as_u64[0];
231 t->client_address.as_u64[1] = ip6->src_address.as_u64[1];
232 t->session_index = ~0;
237 #include <vnet/pipeline.h>
239 VLIB_NODE_FN (l2t_decap_node) (vlib_main_t * vm,
240 vlib_node_runtime_t * node,
241 vlib_frame_t * frame)
243 return dispatch_pipeline (vm, node, frame);
247 * l2tp-decap and l2tp-decap-local have very slightly different behavior.
248 * When a packet has no associated session l2tp-decap let it go to ip6 forward,
249 * while l2tp-decap-local drops it.
253 VLIB_REGISTER_NODE (l2t_decap_node) = {
254 .name = "l2tp-decap",
255 .vector_size = sizeof (u32),
256 .format_trace = format_l2t_trace,
257 .type = VLIB_NODE_TYPE_INTERNAL,
259 .n_errors = ARRAY_LEN(l2t_decap_error_strings),
260 .error_strings = l2t_decap_error_strings,
262 .n_next_nodes = L2T_DECAP_N_NEXT,
264 /* edit / add dispositions here */
266 [L2T_DECAP_NEXT_L2_INPUT] = "l2-input",
267 [L2T_DECAP_NEXT_DROP] = "error-drop",
272 extern vlib_node_function_t l2t_decap_node_fn;
275 VLIB_REGISTER_NODE (l2t_decap_local_node) = {
276 .function = l2t_decap_node_fn,
277 .name = "l2tp-decap-local",
278 .vector_size = sizeof (u32),
279 .format_trace = format_l2t_trace,
280 .type = VLIB_NODE_TYPE_INTERNAL,
282 .n_errors = ARRAY_LEN(l2t_decap_error_strings),
283 .error_strings = l2t_decap_error_strings,
285 .n_next_nodes = L2T_DECAP_N_NEXT,
287 /* edit / add dispositions here */
289 [L2T_DECAP_NEXT_L2_INPUT] = "l2-input",
290 [L2T_DECAP_NEXT_DROP] = "error-drop",
296 * fd.io coding-style-patch-verification: ON
299 * eval: (c-set-style "gnu")