ipsec: ipsec.h tidy up

[vpp.git] / src / vnet / ipsec / ah_encrypt.c

diff --git a/src/vnet/ipsec/ah_encrypt.c b/src/vnet/ipsec/ah_encrypt.c
index b4e9af3..a1f233c 100644 (file)
--- a/src/vnet/ipsec/ah_encrypt.c
+++ b/src/vnet/ipsec/ah_encrypt.c
@@ -22,6 +22,7 @@
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/esp.h>
 #include <vnet/ipsec/ah.h>
+#include <vnet/tunnel/tunnel_dp.h>
 
 #define foreach_ah_encrypt_next \
   _ (DROP, "error-drop")                           \
@@ -111,20 +112,21 @@ typedef struct
 {
   union
   {
+    /* Variable fields in the IP header not covered by the AH
+     * integrity check */
     struct
     {
-      u8 hop_limit;
       u32 ip_version_traffic_class_and_flow_label;
+      u8 hop_limit;
     };
-
     struct
     {
       u8 ttl;
       u8 tos;
     };
   };
-  i16 current_data;
   u8 skip;
+  i16 current_data;
   u32 sa_index;
 } ah_encrypt_packet_data_t;
 
@@ -182,17 +184,18 @@ ah_encrypt_inline (vlib_main_t * vm,
       pd->sa_index = current_sa_index;
       next[0] = AH_ENCRYPT_NEXT_DROP;
 
-      if (PREDICT_FALSE (~0 == sa0->encrypt_thread_index))
+      if (PREDICT_FALSE (~0 == sa0->thread_index))
        {
          /* this is the first packet to use this SA, claim the SA
           * for this thread. this could happen simultaneously on
           * another thread */
-         clib_atomic_cmp_and_swap (&sa0->encrypt_thread_index, ~0,
+         clib_atomic_cmp_and_swap (&sa0->thread_index, ~0,
                                    ipsec_sa_assign_thread (thread_index));
        }
 
-      if (PREDICT_TRUE (thread_index != sa0->encrypt_thread_index))
+      if (PREDICT_TRUE (thread_index != sa0->thread_index))
        {
+         vnet_buffer (b[0])->ipsec.thread_index = sa0->thread_index;
          next[0] = AH_ENCRYPT_NEXT_HANDOFF;
          goto next;
        }
@@ -209,8 +212,6 @@ ah_encrypt_inline (vlib_main_t * vm,
 
       ssize_t adv;
       ih0 = vlib_buffer_get_current (b[0]);
-      pd->ttl = ih0->ip4.ttl;
-      pd->tos = ih0->ip4.tos;
 
       if (PREDICT_TRUE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
        {
@@ -246,10 +247,20 @@ ah_encrypt_inline (vlib_main_t * vm,
          ip_hdr_size = sizeof (ip6_header_t);
          oh6_0 = vlib_buffer_get_current (b[0]);
          pd->current_data = b[0]->current_data;
-
          pd->hop_limit = ih6_0->ip6.hop_limit;
-         pd->ip_version_traffic_class_and_flow_label =
+
+         oh6_0->ip6.ip_version_traffic_class_and_flow_label =
            ih6_0->ip6.ip_version_traffic_class_and_flow_label;
+
+         if (PREDICT_FALSE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
+           {
+             ip6_set_dscp_network_order (&oh6_0->ip6, sa0->tunnel.t_dscp);
+             tunnel_encap_fixup_6o6 (sa0->tunnel_flags, &ih6_0->ip6,
+                                     &oh6_0->ip6);
+           }
+         pd->ip_version_traffic_class_and_flow_label =
+           oh6_0->ip6.ip_version_traffic_class_and_flow_label;
+
          if (PREDICT_TRUE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
            {
              next_hdr_type = IP_PROTOCOL_IPV6;
@@ -275,8 +286,31 @@ ah_encrypt_inline (vlib_main_t * vm,
        {
          ip_hdr_size = sizeof (ip4_header_t);
          oh0 = vlib_buffer_get_current (b[0]);
-         clib_memset (oh0, 0, sizeof (ip4_and_ah_header_t));
+         pd->ttl = ih0->ip4.ttl;
+
+         if (PREDICT_FALSE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
+           {
+             if (sa0->tunnel.t_dscp)
+               pd->tos = sa0->tunnel.t_dscp << 2;
+             else
+               {
+                 pd->tos = ih0->ip4.tos;
+
+                 if (!(sa0->tunnel_flags &
+                       TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP))
+                   pd->tos &= 0x3;
+                 if (!(sa0->tunnel_flags &
+                       TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN))
+                   pd->tos &= 0xfc;
+               }
+           }
+         else
+           {
+             pd->tos = ih0->ip4.tos;
+           }
+
          pd->current_data = b[0]->current_data;
+         clib_memset (oh0, 0, sizeof (ip4_and_ah_header_t));
 
          if (PREDICT_TRUE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
            {
@@ -351,6 +385,18 @@ ah_encrypt_inline (vlib_main_t * vm,
        }
 
     next:
+      if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
+       {
+         sa0 = vec_elt_at_index (im->sad, pd->sa_index);
+         ah_encrypt_trace_t *tr =
+           vlib_add_trace (vm, node, b[0], sizeof (*tr));
+         tr->spi = sa0->spi;
+         tr->seq_lo = sa0->seq;
+         tr->seq_hi = sa0->seq_hi;
+         tr->integ_alg = sa0->integ_alg;
+         tr->sa_index = pd->sa_index;
+       }
+
       n_left -= 1;
       next += 1;
       pd += 1;
@@ -373,7 +419,7 @@ ah_encrypt_inline (vlib_main_t * vm,
   while (n_left)
     {
       if (pd->skip)
-       goto trace;
+       goto next_pkt;
 
       if (is_ip6)
        {
@@ -390,19 +436,7 @@ ah_encrypt_inline (vlib_main_t * vm,
          oh0->ip4.checksum = ip4_header_checksum (&oh0->ip4);
        }
 
-    trace:
-      if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
-       {
-         sa0 = vec_elt_at_index (im->sad, pd->sa_index);
-         ah_encrypt_trace_t *tr =
-           vlib_add_trace (vm, node, b[0], sizeof (*tr));
-         tr->spi = sa0->spi;
-         tr->seq_lo = sa0->seq;
-         tr->seq_hi = sa0->seq_hi;
-         tr->integ_alg = sa0->integ_alg;
-         tr->sa_index = pd->sa_index;
-       }
-
+    next_pkt:
       n_left -= 1;
       next += 1;
       pd += 1;
@@ -467,6 +501,25 @@ VLIB_REGISTER_NODE (ah6_encrypt_node) = {
 };
 /* *INDENT-ON* */
 
+#ifndef CLIB_MARCH_VARIANT
+
+static clib_error_t *
+ah_encrypt_init (vlib_main_t *vm)
+{
+  ipsec_main_t *im = &ipsec_main;
+
+  im->ah4_enc_fq_index =
+    vlib_frame_queue_main_init (ah4_encrypt_node.index, 0);
+  im->ah6_enc_fq_index =
+    vlib_frame_queue_main_init (ah6_encrypt_node.index, 0);
+
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (ah_encrypt_init);
+
+#endif
+
 /*
  * fd.io coding-style-patch-verification: ON
  *