#define IPSEC_FLAG_IPSEC_GRE_TUNNEL (1 << 0)
-
-#define foreach_ipsec_output_next \
-_(DROP, "error-drop") \
-_(ESP_ENCRYPT, "esp-encrypt") \
-_(AH_ENCRYPT, "ah-encrypt")
+#define foreach_ipsec_output_next \
+ _ (DROP, "error-drop") \
+ _ (ESP4_ENCRYPT, "esp4-encrypt") \
+ _ (AH4_ENCRYPT, "ah4-encrypt") \
+ _ (ESP6_ENCRYPT, "esp6-encrypt") \
+ _ (AH6_ENCRYPT, "ah6-encrypt")
#define _(v, s) IPSEC_OUTPUT_NEXT_##v,
typedef enum
IPSEC_OUTPUT_N_NEXT,
} ipsec_output_next_t;
-
-#define foreach_ipsec_input_next \
-_(DROP, "error-drop") \
-_(ESP_DECRYPT, "esp-decrypt") \
-_(AH_DECRYPT, "ah-decrypt")
+#define foreach_ipsec_input_next \
+ _ (DROP, "error-drop") \
+ _ (ESP4_DECRYPT, "esp4-decrypt") \
+ _ (AH4_DECRYPT, "ah4-decrypt") \
+ _ (ESP6_DECRYPT, "esp6-decrypt") \
+ _ (AH6_DECRYPT, "ah6-decrypt")
#define _(v, s) IPSEC_INPUT_NEXT_##v,
typedef enum
u8 is_tunnel;
u8 is_tunnel_ip6;
+ u8 udp_encap;
ip46_address_t tunnel_src_addr;
ip46_address_t tunnel_dst_addr;
u8 remote_integ_key[128];
u8 renumber;
u32 show_instance;
+ u8 udp_encap;
} ipsec_add_del_tunnel_args_t;
typedef struct
uword *ipsec_if_pool_index_by_key;
uword *ipsec_if_real_dev_by_show_dev;
- /* node indeces */
+ /* node indices */
u32 error_drop_node_index;
- u32 esp_encrypt_node_index;
- u32 esp_decrypt_node_index;
- u32 ah_encrypt_node_index;
- u32 ah_decrypt_node_index;
- /* next node indeces */
- u32 esp_encrypt_next_index;
- u32 esp_decrypt_next_index;
- u32 ah_encrypt_next_index;
- u32 ah_decrypt_next_index;
+ u32 esp4_encrypt_node_index;
+ u32 esp4_decrypt_node_index;
+ u32 ah4_encrypt_node_index;
+ u32 ah4_decrypt_node_index;
+ u32 esp6_encrypt_node_index;
+ u32 esp6_decrypt_node_index;
+ u32 ah6_encrypt_node_index;
+ u32 ah6_decrypt_node_index;
+ /* next node indices */
+ u32 esp4_encrypt_next_index;
+ u32 esp4_decrypt_next_index;
+ u32 ah4_encrypt_next_index;
+ u32 ah4_decrypt_next_index;
+ u32 esp6_encrypt_next_index;
+ u32 esp6_decrypt_next_index;
+ u32 ah6_encrypt_next_index;
+ u32 ah6_decrypt_next_index;
/* callbacks */
ipsec_main_callbacks_t cb;
+
+ /* helper for sort function */
+ ipsec_spd_t *spd_to_sort;
} ipsec_main_t;
extern ipsec_main_t ipsec_main;
-extern vlib_node_registration_t esp_encrypt_node;
-extern vlib_node_registration_t esp_decrypt_node;
-extern vlib_node_registration_t ah_encrypt_node;
-extern vlib_node_registration_t ah_decrypt_node;
-extern vlib_node_registration_t ipsec_if_output_node;
+extern vlib_node_registration_t esp4_encrypt_node;
+extern vlib_node_registration_t esp4_decrypt_node;
+extern vlib_node_registration_t ah4_encrypt_node;
+extern vlib_node_registration_t ah4_decrypt_node;
+extern vlib_node_registration_t esp6_encrypt_node;
+extern vlib_node_registration_t esp6_decrypt_node;
+extern vlib_node_registration_t ah6_encrypt_node;
+extern vlib_node_registration_t ah6_decrypt_node;
extern vlib_node_registration_t ipsec_if_input_node;
u32 ipsec_get_sa_index_by_sa_id (u32 sa_id);
u8 ipsec_is_sa_used (u32 sa_index);
-u8 *format_ipsec_if_output_trace (u8 * s, va_list * args);
u8 *format_ipsec_policy_action (u8 * s, va_list * args);
u8 *format_ipsec_crypto_alg (u8 * s, va_list * args);
u8 *format_ipsec_integ_alg (u8 * s, va_list * args);
always_inline void
ipsec_alloc_empty_buffers (vlib_main_t * vm, ipsec_main_t * im)
{
- u32 thread_index = vlib_get_thread_index ();
+ u32 thread_index = vm->thread_index;
uword l = vec_len (im->empty_buffers[thread_index]);
uword n_alloc = 0;
vlib_node_runtime_t * nr)
{
u32 next;
- u32 sw_if_index = vnet_buffer (b)->sw_if_index[VLIB_TX];
vlib_main_t *vm = vlib_get_main ();
vlib_node_t *node = vlib_get_node (vm, nr->node_index);
- vnet_feature_next (sw_if_index, &next, b);
+ vnet_feature_next (&next, b);
return node->next_nodes[next];
}