current_sa_packets = current_sa_bytes = 0;
spi = clib_net_to_host_u32 (sa0->spi);
block_sz = sa0->crypto_block_size;
- icv_sz = sa0->integ_trunc_size;
+ icv_sz = sa0->integ_icv_size;
iv_sz = sa0->crypto_iv_size;
}
hdr_len += len;
ip6 = (ip6_header_t *) (payload - hdr_len);
clib_memcpy_fast (ip6, &sa0->ip6_hdr, len);
- *next_hdr_ptr = IP_PROTOCOL_IPV6;
+ *next_hdr_ptr = (is_ip6 ?
+ IP_PROTOCOL_IPV6 : IP_PROTOCOL_IP_IN_IP);
len = payload_len + hdr_len - len;
ip6->payload_length = clib_net_to_host_u16 (len);
}
hdr_len += len;
ip4 = (ip4_header_t *) (payload - hdr_len);
clib_memcpy_fast (ip4, &sa0->ip4_hdr, len);
- *next_hdr_ptr = IP_PROTOCOL_IP_IN_IP;
+ *next_hdr_ptr = (is_ip6 ?
+ IP_PROTOCOL_IPV6 : IP_PROTOCOL_IP_IN_IP);
len = payload_len + hdr_len;
esp_update_ip4_hdr (ip4, len, /* is_transport */ 0, 0);
}
esp->spi = spi;
esp->seq = clib_net_to_host_u32 (sa0->seq);
- if (sa0->crypto_enc_op_type)
+ if (sa0->crypto_enc_op_id)
{
vnet_crypto_op_t *op;
vec_add2_aligned (ptd->crypto_ops, op, 1, CLIB_CACHE_LINE_BYTES);
- op->op = sa0->crypto_enc_op_type;
+ vnet_crypto_op_init (op, sa0->crypto_enc_op_id);
op->iv = payload - iv_sz;
op->src = op->dst = payload;
op->key = sa0->crypto_key.data;
op->user_data = b - bufs;
}
- if (sa0->integ_op_type)
+ if (sa0->integ_op_id)
{
vnet_crypto_op_t *op;
vec_add2_aligned (ptd->integ_ops, op, 1, CLIB_CACHE_LINE_BYTES);
- op->op = sa0->integ_op_type;
+ vnet_crypto_op_init (op, sa0->integ_op_id);
op->src = payload - iv_sz - sizeof (esp_header_t);
- op->dst = payload + payload_len - icv_sz;
+ op->digest = payload + payload_len - icv_sz;
op->key = sa0->integ_key.data;
op->key_len = sa0->integ_key.len;
- op->hmac_trunc_len = icv_sz;
+ op->digest_len = icv_sz;
op->len = payload_len - icv_sz + iv_sz + sizeof (esp_header_t);
- op->flags = 0;
op->user_data = b - bufs;
- if (ipsec_sa_is_set_USE_EXTENDED_SEQ_NUM (sa0))
+ if (ipsec_sa_is_set_USE_ESN (sa0))
{
u32 seq_hi = clib_net_to_host_u32 (sa0->seq_hi);
clib_memcpy_fast (op->dst, &seq_hi, sizeof (seq_hi));
vlib_increment_combined_counter (&ipsec_sa_counters, thread_index,
current_sa_index, current_sa_packets,
current_sa_bytes);
-
esp_process_ops (vm, node, ptd->crypto_ops, bufs, nexts);
esp_process_ops (vm, node, ptd->integ_ops, bufs, nexts);
.n_errors = ARRAY_LEN(esp_encrypt_error_strings),
.error_strings = esp_encrypt_error_strings,
+
+ .n_next_nodes = 1,
+ .next_nodes = {
+ [ESP_ENCRYPT_NEXT_DROP] = "ip4-drop",
+ },
};
VNET_FEATURE_INIT (esp4_encrypt_tun_feat_node, static) =
{
.arc_name = "ip4-output",
.node_name = "esp4-encrypt-tun",
- .runs_before = VNET_FEATURES ("ip4-frag",
- "adj-midchain-tx"),
+ .runs_before = VNET_FEATURES ("adj-midchain-tx"),
};
/* *INDENT-ON* */
.n_errors = ARRAY_LEN(esp_encrypt_error_strings),
.error_strings = esp_encrypt_error_strings,
+
+ .n_next_nodes = 1,
+ .next_nodes = {
+ [ESP_ENCRYPT_NEXT_DROP] = "ip6-drop",
+ },
};
VNET_FEATURE_INIT (esp6_encrypt_tun_feat_node, static) =
{
.arc_name = "ip6-output",
.node_name = "esp6-encrypt-tun",
- .runs_before = VNET_FEATURES ("ip6-frag",
- "adj-midchain-tx"),
+ .runs_before = VNET_FEATURES ("adj-midchain-tx"),
};
/* *INDENT-ON* */