ipsec: IPSec protection for multi-point tunnel interfaces

[vpp.git] / src / vnet / ip / ip4_source_check.c

diff --git a/src/vnet/ip/ip4_source_check.c b/src/vnet/ip/ip4_source_check.c
index 7c2b7be..b3d4b00 100644 (file)
--- a/src/vnet/ip/ip4_source_check.c
+++ b/src/vnet/ip/ip4_source_check.c
@@ -150,14 +150,8 @@ ip4_source_check_inline (vlib_main_t * vm,
          ip0 = vlib_buffer_get_current (p0);
          ip1 = vlib_buffer_get_current (p1);
 
-         c0 =
-           vnet_feature_next_with_data (vnet_buffer (p0)->sw_if_index
-                                        [VLIB_RX], &next0, p0,
-                                        sizeof (c0[0]));
-         c1 =
-           vnet_feature_next_with_data (vnet_buffer (p1)->sw_if_index
-                                        [VLIB_RX], &next1, p1,
-                                        sizeof (c1[0]));
+         c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0]));
+         c1 = vnet_feature_next_with_data (&next1, p1, sizeof (c1[0]));
 
          mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie;
          mtrie1 = &ip4_fib_get (c1->fib_index)->mtrie;
@@ -165,11 +159,6 @@ ip4_source_check_inline (vlib_main_t * vm,
          leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address);
          leaf1 = ip4_fib_mtrie_lookup_step_one (mtrie1, &ip1->src_address);
 
-         leaf0 =
-           ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 1);
-         leaf1 =
-           ip4_fib_mtrie_lookup_step (mtrie1, leaf1, &ip1->src_address, 1);
-
          leaf0 =
            ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2);
          leaf1 =
@@ -239,18 +228,12 @@ ip4_source_check_inline (vlib_main_t * vm,
          p0 = vlib_get_buffer (vm, pi0);
          ip0 = vlib_buffer_get_current (p0);
 
-         c0 =
-           vnet_feature_next_with_data (vnet_buffer (p0)->sw_if_index
-                                        [VLIB_RX], &next0, p0,
-                                        sizeof (c0[0]));
+         c0 = vnet_feature_next_with_data (&next0, p0, sizeof (c0[0]));
 
          mtrie0 = &ip4_fib_get (c0->fib_index)->mtrie;
 
          leaf0 = ip4_fib_mtrie_lookup_step_one (mtrie0, &ip0->src_address);
 
-         leaf0 =
-           ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 1);
-
          leaf0 =
            ip4_fib_mtrie_lookup_step (mtrie0, leaf0, &ip0->src_address, 2);
 
@@ -291,19 +274,17 @@ ip4_source_check_inline (vlib_main_t * vm,
   return frame->n_vectors;
 }
 
-static uword
-ip4_source_check_reachable_via_any (vlib_main_t * vm,
-                                   vlib_node_runtime_t * node,
-                                   vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_check_source_reachable_via_any) (vlib_main_t * vm,
+                                                  vlib_node_runtime_t * node,
+                                                  vlib_frame_t * frame)
 {
   return ip4_source_check_inline (vm, node, frame,
                                  IP4_SOURCE_CHECK_REACHABLE_VIA_ANY);
 }
 
-static uword
-ip4_source_check_reachable_via_rx (vlib_main_t * vm,
-                                  vlib_node_runtime_t * node,
-                                  vlib_frame_t * frame)
+VLIB_NODE_FN (ip4_check_source_reachable_via_rx) (vlib_main_t * vm,
+                                                 vlib_node_runtime_t * node,
+                                                 vlib_frame_t * frame)
 {
   return ip4_source_check_inline (vm, node, frame,
                                  IP4_SOURCE_CHECK_REACHABLE_VIA_RX);
@@ -311,13 +292,12 @@ ip4_source_check_reachable_via_rx (vlib_main_t * vm,
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ip4_check_source_reachable_via_any) = {
-  .function = ip4_source_check_reachable_via_any,
   .name = "ip4-source-check-via-any",
   .vector_size = sizeof (u32),
 
   .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT,
   .next_nodes = {
-    [IP4_SOURCE_CHECK_NEXT_DROP] = "error-drop",
+    [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop",
   },
 
   .format_buffer = format_ip4_header,
@@ -325,18 +305,14 @@ VLIB_REGISTER_NODE (ip4_check_source_reachable_via_any) = {
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_check_source_reachable_via_any,
-                             ip4_source_check_reachable_via_any);
-
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ip4_check_source_reachable_via_rx) = {
-  .function = ip4_source_check_reachable_via_rx,
   .name = "ip4-source-check-via-rx",
   .vector_size = sizeof (u32),
 
   .n_next_nodes = IP4_SOURCE_CHECK_N_NEXT,
   .next_nodes = {
-    [IP4_SOURCE_CHECK_NEXT_DROP] = "error-drop",
+    [IP4_SOURCE_CHECK_NEXT_DROP] = "ip4-drop",
   },
 
   .format_buffer = format_ip4_header,
@@ -344,9 +320,6 @@ VLIB_REGISTER_NODE (ip4_check_source_reachable_via_rx) = {
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (ip4_check_source_reachable_via_rx,
-                             ip4_source_check_reachable_via_rx);
-
 static clib_error_t *
 set_ip_source_check (vlib_main_t * vm,
                     unformat_input_t * input, vlib_cli_command_t * cmd)
@@ -413,7 +386,7 @@ done:
  * Example of graph node before range checking is enabled:
  * @cliexstart{show vlib graph ip4-source-check-via-rx}
  *            Name                      Next                    Previous
- * ip4-source-check-via-rx         error-drop [0]
+ * ip4-source-check-via-rx         ip4-drop [0]
  * @cliexend
  *
  * Example of how to enable unicast source checking on an interface:
@@ -422,7 +395,7 @@ done:
  * Example of graph node after range checking is enabled:
  * @cliexstart{show vlib graph ip4-source-check-via-rx}
  *            Name                      Next                    Previous
- * ip4-source-check-via-rx         error-drop [0]         ip4-input-no-checksum
+ * ip4-source-check-via-rx         ip4-drop [0]           ip4-input-no-checksum
  *                           ip4-source-and-port-range-         ip4-input
  * @cliexend
  *
@@ -500,7 +473,7 @@ ip_source_check_accept (vlib_main_t * vm,
 
   if (~0 != table_id)
     {
-      fib_index = fib_table_id_find_fib_index (pfx.fp_proto, table_id);
+      fib_index = fib_table_find (pfx.fp_proto, table_id);
       if (~0 == fib_index)
        {
          error = clib_error_return (0, "Nonexistent table id %d", table_id);
@@ -517,7 +490,7 @@ ip_source_check_accept (vlib_main_t * vm,
       fib_table_entry_special_add (fib_index,
                                   &pfx,
                                   FIB_SOURCE_URPF_EXEMPT,
-                                  FIB_ENTRY_FLAG_DROP, ADJ_INDEX_INVALID);
+                                  FIB_ENTRY_FLAG_DROP);
     }
   else
     {
@@ -552,6 +525,7 @@ VLIB_CLI_COMMAND (ip_source_check_accept_command, static) = {
 /* *INDENT-ON* */
 
 
+#ifndef CLIB_MARCH_VARIANT
 /* Dummy init function to get us linked in. */
 clib_error_t *
 ip4_source_check_init (vlib_main_t * vm)
@@ -560,6 +534,7 @@ ip4_source_check_init (vlib_main_t * vm)
 }
 
 VLIB_INIT_FUNCTION (ip4_source_check_init);
+#endif /* CLIB_MARCH_VARIANT */
 
 /*
  * fd.io coding-style-patch-verification: ON