ipsec: introduce fast path ipv6 inbound matching

[vpp.git] / src / vnet / ipsec / ipsec_format.c

diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index 19321e7..9204b1c 100644 (file)
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -153,8 +153,8 @@ format_ipsec_replay_window (u8 * s, va_list * args)
   return s;
 }
 
-u8 *
-format_ipsec_policy (u8 * s, va_list * args)
+static u8 *
+format_ipsec_policy_with_suffix (u8 *s, va_list *args, u8 *suffix)
 {
   u32 pi = va_arg (*args, u32);
   ip46_type_t ip_type = IP46_TYPE_IP4;
@@ -168,7 +168,7 @@ format_ipsec_policy (u8 * s, va_list * args)
              pi, p->priority,
              format_ipsec_policy_action, p->policy,
              format_ipsec_policy_type, p->type);
-  if (p->protocol)
+  if (p->protocol != IPSEC_POLICY_PROTOCOL_ANY)
     {
       s = format (s, "%U", format_ip_protocol, p->protocol);
     }
@@ -180,6 +180,9 @@ format_ipsec_policy (u8 * s, va_list * args)
     {
       s = format (s, " sa %u", p->sa_id);
     }
+  if (suffix)
+    s = format (s, " %s", suffix);
+
   if (p->is_ipv6)
     {
       ip_type = IP46_TYPE_IP6;
@@ -200,6 +203,18 @@ format_ipsec_policy (u8 * s, va_list * args)
   return (s);
 }
 
+u8 *
+format_ipsec_policy (u8 *s, va_list *args)
+{
+  return format_ipsec_policy_with_suffix (s, args, 0);
+}
+
+u8 *
+format_ipsec_policy_fp (u8 *s, va_list *args)
+{
+  return format_ipsec_policy_with_suffix (s, args, (u8 *) "<fast-path>");
+}
+
 u8 *
 format_ipsec_spd (u8 * s, va_list * args)
 {
@@ -218,12 +233,16 @@ format_ipsec_spd (u8 * s, va_list * args)
 
   s = format (s, "spd %u", spd->id);
 
-#define _(v, n)                                                 \
-  s = format (s, "\n %s:", n);                                  \
-  vec_foreach(i, spd->policies[IPSEC_SPD_POLICY_##v])           \
-  {                                                             \
-    s = format (s, "\n %U", format_ipsec_policy, *i);           \
-  }
+#define _(v, n)                                                               \
+  s = format (s, "\n %s:", n);                                                \
+  vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_##v])                        \
+    {                                                                         \
+      s = format (s, "\n %U", format_ipsec_policy, *i);                       \
+    }                                                                         \
+  vec_foreach (i, spd->fp_spd.fp_policies[IPSEC_SPD_POLICY_##v])              \
+    {                                                                         \
+      s = format (s, "\n %U", format_ipsec_policy_fp, *i);                    \
+    }
   foreach_ipsec_spd_policy_type;
 #undef _
 
@@ -231,6 +250,28 @@ done:
   return (s);
 }
 
+u8 *
+format_ipsec_out_spd_flow_cache (u8 *s, va_list *args)
+{
+  ipsec_main_t *im = &ipsec_main;
+
+  s = format (s, "\nipv4-outbound-spd-flow-cache-entries: %u",
+             im->ipsec4_out_spd_flow_cache_entries);
+
+  return (s);
+}
+
+u8 *
+format_ipsec_in_spd_flow_cache (u8 *s, va_list *args)
+{
+  ipsec_main_t *im = &ipsec_main;
+
+  s = format (s, "\nipv4-inbound-spd-flow-cache-entries: %u",
+             im->ipsec4_in_spd_flow_cache_entries);
+
+  return (s);
+}
+
 u8 *
 format_ipsec_key (u8 * s, va_list * args)
 {
@@ -271,18 +312,17 @@ format_ipsec_sa (u8 * s, va_list * args)
 {
   u32 sai = va_arg (*args, u32);
   ipsec_format_flags_t flags = va_arg (*args, ipsec_format_flags_t);
-  ipsec_main_t *im = &ipsec_main;
   vlib_counter_t counts;
-  u32 tx_table_id;
+  counter_t lost;
   ipsec_sa_t *sa;
 
-  if (pool_is_free_index (im->sad, sai))
+  if (pool_is_free_index (ipsec_sa_pool, sai))
     {
       s = format (s, "No such SA index: %d", sai);
       goto done;
     }
 
-  sa = pool_elt_at_index (im->sad, sai);
+  sa = ipsec_sa_get (sai);
 
   s = format (s, "[%d] sa %u (0x%x) spi %u (0x%08x) protocol:%s flags:[%U]",
              sai, sa->id, sa->id, sa->spi, sa->spi,
@@ -295,9 +335,8 @@ format_ipsec_sa (u8 * s, va_list * args)
   s = format (s, "\n   salt 0x%x", clib_net_to_host_u32 (sa->salt));
   s = format (s, "\n   thread-index:%d", sa->thread_index);
   s = format (s, "\n   seq %u seq-hi %u", sa->seq, sa->seq_hi);
-  s = format (s, "\n   last-seq %u last-seq-hi %u window %U",
-             sa->last_seq, sa->last_seq_hi,
-             format_ipsec_replay_window, sa->replay_window);
+  s = format (s, "\n   window %U", format_ipsec_replay_window,
+             sa->replay_window);
   s = format (s, "\n   crypto alg %U",
              format_ipsec_crypto_alg, sa->crypto_alg);
   if (sa->crypto_alg && (flags & IPSEC_FORMAT_INSECURE))
@@ -315,29 +354,12 @@ format_ipsec_sa (u8 * s, va_list * args)
              clib_host_to_net_u16 (sa->udp_hdr.dst_port));
 
   vlib_get_combined_counter (&ipsec_sa_counters, sai, &counts);
-  s = format (s, "\n   packets %u bytes %u", counts.packets, counts.bytes);
+  lost = vlib_get_simple_counter (&ipsec_sa_lost_counters, sai);
+  s = format (s, "\n   tx/rx:[packets:%Ld bytes:%Ld], lost:[packets:%Ld]",
+             counts.packets, counts.bytes, lost);
 
   if (ipsec_sa_is_set_IS_TUNNEL (sa))
-    {
-      tx_table_id = fib_table_get_table_id (
-       sa->tx_fib_index,
-       (ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? FIB_PROTOCOL_IP6 :
-                                            FIB_PROTOCOL_IP4));
-      s = format (s, "\n   table-ID %d tunnel %U src %U dst %U flags %U",
-                 tx_table_id,
-                 format_ip_dscp, sa->dscp,
-                 format_ip46_address, &sa->tunnel_src_addr, IP46_TYPE_ANY,
-                 format_ip46_address, &sa->tunnel_dst_addr, IP46_TYPE_ANY,
-                 format_tunnel_encap_decap_flags, sa->tunnel_flags);
-      if (!ipsec_sa_is_set_IS_INBOUND (sa))
-       {
-         s =
-           format (s, "\n    resovle via fib-entry: %d",
-                   sa->fib_entry_index);
-         s = format (s, "\n    stacked on:");
-         s = format (s, "\n      %U", format_dpo_id, &sa->dpo, 6);
-       }
-    }
+    s = format (s, "\n%U", format_tunnel, &sa->tunnel, 3);
 
 done:
   return (s);