2 * decap.c : L2TPv3 tunnel decapsulation
4 * Copyright (c) 2013 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vppinfra/error.h>
19 #include <vppinfra/hash.h>
20 #include <vnet/vnet.h>
21 #include <vnet/ip/ip.h>
22 #include <vnet/ethernet/ethernet.h>
23 #include <vnet/l2tp/l2tp.h>
25 /* Statistics (not really errors) */
26 #define foreach_l2t_decap_error \
27 _(USER_TO_NETWORK, "L2TP user (ip6) to L2 network pkts") \
28 _(SESSION_ID_MISMATCH, "l2tpv3 local session id mismatches") \
29 _(COOKIE_MISMATCH, "l2tpv3 local cookie mismatches") \
30 _(NO_SESSION, "l2tpv3 session not found")
32 static char * l2t_decap_error_strings[] = {
33 #define _(sym,string) string,
34 foreach_l2t_decap_error
39 #define _(sym,str) L2T_DECAP_ERROR_##sym,
40 foreach_l2t_decap_error
47 L2T_DECAP_NEXT_L2_INPUT,
49 /* Pseudo next index */
50 L2T_DECAP_NEXT_NO_INTERCEPT = L2T_DECAP_N_NEXT,
55 static inline void stage0 (vlib_main_t * vm,
56 vlib_node_runtime_t * node,
59 vlib_buffer_t *b = vlib_get_buffer (vm, buffer_index);
60 vlib_prefetch_buffer_header (b, STORE);
61 /* l2tpv3 header is a long way away, need 2 cache lines */
62 CLIB_PREFETCH (b->data, 2*CLIB_CACHE_LINE_BYTES, STORE);
65 static inline void stage1 (vlib_main_t * vm,
66 vlib_node_runtime_t * node,
69 vlib_buffer_t *b = vlib_get_buffer (vm, bi);
70 l2t_main_t *lm = &l2t_main;
71 ip6_header_t * ip6 = vlib_buffer_get_current (b);
74 l2tpv3_header_t * l2t;
76 /* Not L2tpv3 (0x73, 0t115)? Use the normal path. */
77 if (PREDICT_FALSE(ip6->protocol != IP_PROTOCOL_L2TP)) {
78 vnet_buffer(b)->l2t.next_index = L2T_DECAP_NEXT_NO_INTERCEPT;
82 /* Make up your minds, people... */
83 switch (lm->lookup_type) {
84 case L2T_LOOKUP_SRC_ADDRESS:
85 p = hash_get_mem (lm->session_by_src_address, &ip6->src_address);
87 case L2T_LOOKUP_DST_ADDRESS:
88 p = hash_get_mem (lm->session_by_dst_address, &ip6->dst_address);
90 case L2T_LOOKUP_SESSION_ID:
91 l2t = (l2tpv3_header_t*)(ip6+1);
92 p = hash_get (lm->session_by_session_id, l2t->session_id);
98 if (PREDICT_FALSE(p == 0)) {
99 vnet_buffer(b)->l2t.next_index = L2T_DECAP_NEXT_NO_INTERCEPT;
102 session_index = p[0];
105 /* Remember mapping index, prefetch the mini counter */
106 vnet_buffer(b)->l2t.next_index = L2T_DECAP_NEXT_L2_INPUT;
107 vnet_buffer(b)->l2t.session_index = session_index;
109 /* $$$$$ prefetch counter */
112 static inline u32 last_stage (vlib_main_t *vm, vlib_node_runtime_t *node,
115 vlib_buffer_t *b = vlib_get_buffer (vm, bi);
116 l2t_main_t *lm = &l2t_main;
117 ip6_header_t * ip6 = vlib_buffer_get_current (b);
118 vlib_node_t *n = vlib_get_node (vm, node->node_index);
119 u32 node_counter_base_index = n->error_heap_index;
120 vlib_error_main_t * em = &vm->error_main;
121 l2tpv3_header_t * l2tp;
123 l2t_session_t * session;
126 u8 l2tp_decap_local = (l2t_decap_local_node.index == n->index);
128 /* Other-than-output pkt? We're done... */
129 if (vnet_buffer(b)->l2t.next_index != L2T_DECAP_NEXT_L2_INPUT) {
130 next_index = vnet_buffer(b)->l2t.next_index;
134 em->counters[node_counter_base_index + L2T_DECAP_ERROR_USER_TO_NETWORK] += 1;
136 session_index = vnet_buffer(b)->l2t.session_index;
139 session_index_to_counter_index (session_index,
140 SESSION_COUNTER_USER_TO_NETWORK);
142 /* per-mapping byte stats include the ethernet header */
143 vlib_increment_combined_counter (&lm->counter_main,
146 1 /* packet_increment */,
147 vlib_buffer_length_in_chain (vm, b) +
148 sizeof (ethernet_header_t));
150 session = pool_elt_at_index (lm->sessions, session_index);
152 l2tp = vlib_buffer_get_current (b) + sizeof (*ip6);
154 if (PREDICT_FALSE(l2tp->session_id != session->local_session_id)) {
155 // Key matched but session id does not. Assume packet is not for us.
156 em->counters[node_counter_base_index + L2T_DECAP_ERROR_SESSION_ID_MISMATCH] += 1;
157 next_index = L2T_DECAP_NEXT_NO_INTERCEPT;
161 if (PREDICT_FALSE (l2tp->cookie != session->local_cookie[0])) {
162 if (l2tp->cookie != session->local_cookie[1]) {
163 // Key and session ID matched, but cookie doesn't. Drop this packet.
164 b->error = node->errors[L2T_DECAP_ERROR_COOKIE_MISMATCH];
165 next_index = L2T_DECAP_NEXT_DROP;
170 vnet_buffer(b)->sw_if_index[VLIB_RX] = session->sw_if_index;
172 /* strip the ip6 and L2TP header */
173 vlib_buffer_advance (b, sizeof (*ip6) + session->l2tp_hdr_size);
175 /* Required to make the l2 tag push / pop code work on l2 subifs */
176 vnet_update_l2_len (b);
178 if (PREDICT_FALSE(b->flags & VLIB_BUFFER_IS_TRACED)) {
179 l2t_trace_t *t = vlib_add_trace (vm, node, b, sizeof (*t));
180 t->is_user_to_network = 1;
181 t->our_address.as_u64[0] =
182 ip6->dst_address.as_u64[0];
183 t->our_address.as_u64[1] =
184 ip6->dst_address.as_u64[1];
185 t->client_address.as_u64[0] =
186 ip6->src_address.as_u64[0];
187 t->client_address.as_u64[1] =
188 ip6->src_address.as_u64[1];
189 t->session_index = session_index;
192 return L2T_DECAP_NEXT_L2_INPUT;
195 if (next_index == L2T_DECAP_NEXT_NO_INTERCEPT) {
196 // Small behavioral change between l2tp-decap and l2tp-decap-local
197 if (l2tp_decap_local) {
198 b->error = node->errors[L2T_DECAP_ERROR_NO_SESSION];
199 next_index = L2T_DECAP_NEXT_DROP;
201 // Go to next node on the ip6 configuration chain
202 ip6_main_t * im = &ip6_main;
203 ip_lookup_main_t * lm = &im->lookup_main;
204 ip_config_main_t * cm = &lm->rx_config_mains[VNET_UNICAST];
205 ip6_l2tpv3_config_t * c0;
207 vnet_get_config_data (&cm->config_main,
208 &b->current_config_index,
214 if (PREDICT_FALSE(b->flags & VLIB_BUFFER_IS_TRACED)) {
215 l2t_trace_t *t = vlib_add_trace (vm, node, b, sizeof (*t));
216 t->is_user_to_network = 1;
217 t->our_address.as_u64[0] =
218 ip6->dst_address.as_u64[0];
219 t->our_address.as_u64[1] =
220 ip6->dst_address.as_u64[1];
221 t->client_address.as_u64[0] =
222 ip6->src_address.as_u64[0];
223 t->client_address.as_u64[1] =
224 ip6->src_address.as_u64[1];
225 t->session_index = ~0;
230 #include <vnet/pipeline.h>
232 static uword l2t_decap_node_fn (vlib_main_t * vm,
233 vlib_node_runtime_t * node,
234 vlib_frame_t * frame)
236 return dispatch_pipeline (vm, node, frame);
240 * l2tp-decap and l2tp-decap-local have very slightly different behavior.
241 * When a packet has no associated session l2tp-decap let it go to ip6 forward,
242 * while l2tp-decap-local drops it.
245 VLIB_REGISTER_NODE (l2t_decap_node) = {
246 .function = l2t_decap_node_fn,
247 .name = "l2tp-decap",
248 .vector_size = sizeof (u32),
249 .format_trace = format_l2t_trace,
250 .type = VLIB_NODE_TYPE_INTERNAL,
252 .n_errors = ARRAY_LEN(l2t_decap_error_strings),
253 .error_strings = l2t_decap_error_strings,
255 .n_next_nodes = L2T_DECAP_N_NEXT,
257 /* edit / add dispositions here */
259 [L2T_DECAP_NEXT_L2_INPUT] = "l2-input",
260 [L2T_DECAP_NEXT_DROP] = "error-drop",
264 VLIB_NODE_FUNCTION_MULTIARCH (l2t_decap_node, l2t_decap_node_fn)
266 VLIB_REGISTER_NODE (l2t_decap_local_node) = {
267 .function = l2t_decap_node_fn,
268 .name = "l2tp-decap-local",
269 .vector_size = sizeof (u32),
270 .format_trace = format_l2t_trace,
271 .type = VLIB_NODE_TYPE_INTERNAL,
273 .n_errors = ARRAY_LEN(l2t_decap_error_strings),
274 .error_strings = l2t_decap_error_strings,
276 .n_next_nodes = L2T_DECAP_N_NEXT,
278 /* edit / add dispositions here */
280 [L2T_DECAP_NEXT_L2_INPUT] = "l2-input",
281 [L2T_DECAP_NEXT_DROP] = "error-drop",
285 void l2tp_decap_init (void)
287 ip6_register_protocol (IP_PROTOCOL_L2TP, l2t_decap_local_node.index);