IKEv2 to plugin

[vpp.git] / src / vnet / ipsec / ipsec_if_in.c

diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c
index 1dbd127..ffa9c8e 100644 (file)
--- a/src/vnet/ipsec/ipsec_if_in.c
+++ b/src/vnet/ipsec/ipsec_if_in.c
@@ -21,11 +21,13 @@
 
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/esp.h>
+#include <vnet/ipsec/ipsec_io.h>
 
 /* Statistics (not really errors) */
 #define foreach_ipsec_if_input_error                             \
 _(RX, "good packets received")                                   \
-_(DISABLED, "ipsec packets received on disabled interface")
+_(DISABLED, "ipsec packets received on disabled interface")       \
+_(NO_TUNNEL, "no matching tunnel")
 
 static char *ipsec_if_input_error_strings[] = {
 #define _(sym,string) string,
@@ -48,7 +50,7 @@ typedef struct
   u32 seq;
 } ipsec_if_input_trace_t;
 
-u8 *
+static u8 *
 format_ipsec_if_input_trace (u8 * s, va_list * args)
 {
   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
@@ -76,7 +78,7 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm,
   ipsec_sa_t *sa0;
   vlib_combined_counter_main_t *rx_counter;
   vlib_combined_counter_main_t *drop_counter;
-  u32 n_disabled = 0;
+  u32 n_disabled = 0, n_no_tunnel = 0;
 
   rx_counter = vim->combined_sw_if_counters + VNET_INTERFACE_COUNTER_RX;
   drop_counter = vim->combined_sw_if_counters + VNET_INTERFACE_COUNTER_DROP;
@@ -111,8 +113,7 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm,
 
          next0 = IPSEC_INPUT_NEXT_DROP;
 
-         u64 key = (u64) ip0->src_address.as_u32 << 32 |
-           (u64) clib_net_to_host_u32 (esp0->spi);
+         u64 key = (u64) ip0->src_address.as_u32 << 32 | (u64) esp0->spi;
 
          p = hash_get (im->ipsec_if_pool_index_by_key, key);
 
@@ -181,6 +182,11 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm,
              vlib_buffer_advance (b0, ip4_header_bytes (ip0));
              next0 = im->esp4_decrypt_next_index;
            }
+         else
+           {
+             b0->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
+             n_no_tunnel++;
+           }
 
        trace:
          if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
@@ -216,6 +222,8 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm,
 
   vlib_node_increment_counter (vm, ipsec_if_input_node.index,
                               IPSEC_IF_INPUT_ERROR_DISABLED, n_disabled);
+  vlib_node_increment_counter (vm, ipsec_if_input_node.index,
+                              IPSEC_IF_INPUT_ERROR_DISABLED, n_no_tunnel);
 
   return from_frame->n_vectors;
 }