ipsec: split ipsec nodes into ip4/ip6 nodes

[vpp.git] / src / vnet / ipsec / ipsec.h

diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index 1572e55..6a9c5b1 100644 (file)
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -20,10 +20,12 @@
 
 #define IPSEC_FLAG_IPSEC_GRE_TUNNEL (1 << 0)
 
-
-#define foreach_ipsec_output_next                \
-_(DROP, "error-drop")                            \
-_(ESP_ENCRYPT, "esp-encrypt")
+#define foreach_ipsec_output_next        \
+  _ (DROP, "error-drop")                 \
+  _ (ESP4_ENCRYPT, "esp4-encrypt") \
+  _ (AH4_ENCRYPT, "ah4-encrypt")   \
+  _ (ESP6_ENCRYPT, "esp6-encrypt") \
+  _ (AH6_ENCRYPT, "ah6-encrypt")
 
 #define _(v, s) IPSEC_OUTPUT_NEXT_##v,
 typedef enum
@@ -33,10 +35,12 @@ typedef enum
     IPSEC_OUTPUT_N_NEXT,
 } ipsec_output_next_t;
 
-
-#define foreach_ipsec_input_next                \
-_(DROP, "error-drop")                           \
-_(ESP_DECRYPT, "esp-decrypt")
+#define foreach_ipsec_input_next         \
+  _ (DROP, "error-drop")                 \
+  _ (ESP4_DECRYPT, "esp4-decrypt") \
+  _ (AH4_DECRYPT, "ah4-decrypt")   \
+  _ (ESP6_DECRYPT, "esp6-decrypt") \
+  _ (AH6_DECRYPT, "ah6-decrypt")
 
 #define _(v, s) IPSEC_INPUT_NEXT_##v,
 typedef enum
@@ -71,7 +75,9 @@ typedef enum
   _(6, AES_CTR_256, "aes-ctr-256")  \
   _(7, AES_GCM_128, "aes-gcm-128")  \
   _(8, AES_GCM_192, "aes-gcm-192")  \
-  _(9, AES_GCM_256, "aes-gcm-256")
+  _(9, AES_GCM_256, "aes-gcm-256")  \
+  _(10, DES_CBC, "des-cbc")         \
+  _(11, 3DES_CBC, "3des-cbc")
 
 typedef enum
 {
@@ -123,6 +129,7 @@ typedef struct
 
   u8 is_tunnel;
   u8 is_tunnel_ip6;
+  u8 udp_encap;
   ip46_address_t tunnel_src_addr;
   ip46_address_t tunnel_dst_addr;
 
@@ -167,6 +174,9 @@ typedef struct
   u8 local_integ_key[128];
   u8 remote_integ_key_len;
   u8 remote_integ_key[128];
+  u8 renumber;
+  u32 show_instance;
+  u8 udp_encap;
 } ipsec_add_del_tunnel_args_t;
 
 typedef struct
@@ -236,9 +246,12 @@ typedef struct
 
 typedef struct
 {
+  /* Required for pool_get_aligned */
+  CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
   u32 input_sa_index;
   u32 output_sa_index;
   u32 hw_if_index;
+  u32 show_instance;
 } ipsec_tunnel_if_t;
 
 typedef struct
@@ -273,24 +286,45 @@ typedef struct
   uword *spd_index_by_sw_if_index;
   uword *sa_index_by_sa_id;
   uword *ipsec_if_pool_index_by_key;
+  uword *ipsec_if_real_dev_by_show_dev;
 
-  /* node indeces */
+  /* node indices */
   u32 error_drop_node_index;
-  u32 esp_encrypt_node_index;
-  u32 esp_decrypt_node_index;
-  /* next node indeces */
-  u32 esp_encrypt_next_index;
-  u32 esp_decrypt_next_index;
+  u32 esp4_encrypt_node_index;
+  u32 esp4_decrypt_node_index;
+  u32 ah4_encrypt_node_index;
+  u32 ah4_decrypt_node_index;
+  u32 esp6_encrypt_node_index;
+  u32 esp6_decrypt_node_index;
+  u32 ah6_encrypt_node_index;
+  u32 ah6_decrypt_node_index;
+  /* next node indices */
+  u32 esp4_encrypt_next_index;
+  u32 esp4_decrypt_next_index;
+  u32 ah4_encrypt_next_index;
+  u32 ah4_decrypt_next_index;
+  u32 esp6_encrypt_next_index;
+  u32 esp6_decrypt_next_index;
+  u32 ah6_encrypt_next_index;
+  u32 ah6_decrypt_next_index;
 
   /* callbacks */
   ipsec_main_callbacks_t cb;
+
+  /* helper for sort function */
+  ipsec_spd_t *spd_to_sort;
 } ipsec_main_t;
 
 extern ipsec_main_t ipsec_main;
 
-extern vlib_node_registration_t esp_encrypt_node;
-extern vlib_node_registration_t esp_decrypt_node;
-extern vlib_node_registration_t ipsec_if_output_node;
+extern vlib_node_registration_t esp4_encrypt_node;
+extern vlib_node_registration_t esp4_decrypt_node;
+extern vlib_node_registration_t ah4_encrypt_node;
+extern vlib_node_registration_t ah4_decrypt_node;
+extern vlib_node_registration_t esp6_encrypt_node;
+extern vlib_node_registration_t esp6_decrypt_node;
+extern vlib_node_registration_t ah6_encrypt_node;
+extern vlib_node_registration_t ah6_decrypt_node;
 extern vlib_node_registration_t ipsec_if_input_node;
 
 
@@ -307,7 +341,6 @@ int ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update);
 
 u32 ipsec_get_sa_index_by_sa_id (u32 sa_id);
 u8 ipsec_is_sa_used (u32 sa_index);
-u8 *format_ipsec_if_output_trace (u8 * s, va_list * args);
 u8 *format_ipsec_policy_action (u8 * s, va_list * args);
 u8 *format_ipsec_crypto_alg (u8 * s, va_list * args);
 u8 *format_ipsec_integ_alg (u8 * s, va_list * args);
@@ -336,7 +369,7 @@ int ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
 always_inline void
 ipsec_alloc_empty_buffers (vlib_main_t * vm, ipsec_main_t * im)
 {
-  u32 thread_index = vlib_get_thread_index ();
+  u32 thread_index = vm->thread_index;
   uword l = vec_len (im->empty_buffers[thread_index]);
   uword n_alloc = 0;
 
@@ -359,11 +392,10 @@ get_next_output_feature_node_index (vlib_buffer_t * b,
                                    vlib_node_runtime_t * nr)
 {
   u32 next;
-  u32 sw_if_index = vnet_buffer (b)->sw_if_index[VLIB_TX];
   vlib_main_t *vm = vlib_get_main ();
   vlib_node_t *node = vlib_get_node (vm, nr->node_index);
 
-  vnet_feature_next (sw_if_index, &next, b);
+  vnet_feature_next (&next, b);
   return node->next_nodes[next];
 }