IPSEC-GRE: fixes and API update to common types.

[vpp.git] / src / vnet / ipsec / ipsec_input.c

diff --git a/src/vnet/ipsec/ipsec_input.c b/src/vnet/ipsec/ipsec_input.c
index e3fd4aa..5be72c3 100644 (file)
--- a/src/vnet/ipsec/ipsec_input.c
+++ b/src/vnet/ipsec/ipsec_input.c
@@ -23,10 +23,11 @@
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/esp.h>
 #include <vnet/ipsec/ah.h>
+#include <vnet/ipsec/ipsec_io.h>
 
-#define foreach_ipsec_input_error                   \
- _(RX_PKTS, "IPSEC pkts received")                  \
- _(DECRYPTION_FAILED, "IPSEC decryption failed")
+#define foreach_ipsec_input_error               \
+_(RX_PKTS, "IPSEC pkts received")              \
+_(RX_MATCH_PKTS, "IPSEC pkts matched")
 
 typedef enum
 {
@@ -83,7 +84,7 @@ ipsec_input_protect_policy_match (ipsec_spd_t * spd, u32 sa, u32 da, u32 spi)
     if (spi != s->spi)
       continue;
 
-    if (s->is_tunnel)
+    if (ipsec_sa_is_set_IS_TUNNEL (s))
       {
        if (da != clib_net_to_host_u32 (s->tunnel_dst_addr.ip4.as_u32))
          continue;
@@ -139,7 +140,7 @@ ipsec6_input_protect_policy_match (ipsec_spd_t * spd,
     if (spi != s->spi)
       continue;
 
-    if (s->is_tunnel)
+    if (ipsec_sa_is_set_IS_TUNNEL (s))
       {
        if (!ip6_address_is_equal (sa, &s->tunnel_src_addr.ip6))
          continue;
@@ -169,6 +170,8 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
 {
   u32 n_left_from, *from, next_index, *to_next, thread_index;
   ipsec_main_t *im = &ipsec_main;
+  u32 ipsec_unprocessed = 0;
+  u32 ipsec_matched = 0;
 
   from = vlib_frame_vector_args (from_frame);
   n_left_from = from_frame->n_vectors;
@@ -241,6 +244,8 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
 
              if (PREDICT_TRUE (p0 != NULL))
                {
+                 ipsec_matched += 1;
+
                  pi0 = p0 - im->policies;
                  vlib_increment_combined_counter
                    (&ipsec_spd_policy_counters,
@@ -248,7 +253,6 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
                     clib_net_to_host_u16 (ip0->length));
 
                  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
-                 vnet_buffer (b0)->ipsec.flags = 0;
                  next0 = im->esp4_decrypt_next_index;
                  vlib_buffer_advance (b0, ((u8 *) esp0 - (u8 *) ip0));
                  goto trace0;
@@ -275,8 +279,7 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
                  tr->policy_index = pi0;
                }
            }
-
-         if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_AH))
+         else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
            {
              ah0 = (ah_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
              p0 = ipsec_input_protect_policy_match (spd0,
@@ -291,13 +294,15 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
 
              if (PREDICT_TRUE (p0 != 0))
                {
+                 ipsec_matched += 1;
+
                  pi0 = p0 - im->policies;
                  vlib_increment_combined_counter
                    (&ipsec_spd_policy_counters,
                     thread_index, pi0, 1,
                     clib_net_to_host_u16 (ip0->length));
+
                  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
-                 vnet_buffer (b0)->ipsec.flags = 0;
                  next0 = im->ah4_decrypt_next_index;
                  goto trace1;
                }
@@ -322,6 +327,10 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
                  tr->policy_index = pi0;
                }
            }
+         else
+           {
+             ipsec_unprocessed += 1;
+           }
 
          vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
                                           to_next, n_left_to_next, bi0,
@@ -329,10 +338,14 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
        }
       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
     }
+
   vlib_node_increment_counter (vm, ipsec4_input_node.index,
                               IPSEC_INPUT_ERROR_RX_PKTS,
-                              from_frame->n_vectors);
+                              from_frame->n_vectors - ipsec_unprocessed);
 
+  vlib_node_increment_counter (vm, ipsec4_input_node.index,
+                              IPSEC_INPUT_ERROR_RX_MATCH_PKTS,
+                              ipsec_matched);
   return from_frame->n_vectors;
 }
 
@@ -343,10 +356,8 @@ VLIB_REGISTER_NODE (ipsec4_input_node,static) = {
   .vector_size = sizeof (u32),
   .format_trace = format_ipsec_input_trace,
   .type = VLIB_NODE_TYPE_INTERNAL,
-
   .n_errors = ARRAY_LEN(ipsec_input_error_strings),
   .error_strings = ipsec_input_error_strings,
-
   .n_next_nodes = IPSEC_INPUT_N_NEXT,
   .next_nodes = {
 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
@@ -365,6 +376,8 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
 {
   u32 n_left_from, *from, next_index, *to_next, thread_index;
   ipsec_main_t *im = &ipsec_main;
+  u32 ipsec_unprocessed = 0;
+  u32 ipsec_matched = 0;
 
   from = vlib_frame_vector_args (from_frame);
   n_left_from = from_frame->n_vectors;
@@ -425,14 +438,16 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
 
              if (PREDICT_TRUE (p0 != 0))
                {
+                 ipsec_matched += 1;
+
                  pi0 = p0 - im->policies;
                  vlib_increment_combined_counter
                    (&ipsec_spd_policy_counters,
                     thread_index, pi0, 1,
                     clib_net_to_host_u16 (ip0->payload_length) +
                     header_size);
+
                  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
-                 vnet_buffer (b0)->ipsec.flags = 0;
                  next0 = im->esp6_decrypt_next_index;
                  vlib_buffer_advance (b0, header_size);
                  goto trace0;
@@ -452,14 +467,15 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
 
              if (PREDICT_TRUE (p0 != 0))
                {
+                 ipsec_matched += 1;
                  pi0 = p0 - im->policies;
                  vlib_increment_combined_counter
                    (&ipsec_spd_policy_counters,
                     thread_index, pi0, 1,
                     clib_net_to_host_u16 (ip0->payload_length) +
                     header_size);
+
                  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
-                 vnet_buffer (b0)->ipsec.flags = 0;
                  next0 = im->ah6_decrypt_next_index;
                  goto trace0;
                }
@@ -468,6 +484,10 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
                  pi0 = ~0;
                }
            }
+         else
+           {
+             ipsec_unprocessed += 1;
+           }
 
        trace0:
          if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
@@ -489,9 +509,14 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
        }
       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
     }
+
   vlib_node_increment_counter (vm, ipsec6_input_node.index,
                               IPSEC_INPUT_ERROR_RX_PKTS,
-                              from_frame->n_vectors);
+                              from_frame->n_vectors - ipsec_unprocessed);
+
+  vlib_node_increment_counter (vm, ipsec6_input_node.index,
+                              IPSEC_INPUT_ERROR_RX_MATCH_PKTS,
+                              ipsec_matched);
 
   return from_frame->n_vectors;
 }
@@ -503,11 +528,14 @@ VLIB_REGISTER_NODE (ipsec6_input_node,static) = {
   .vector_size = sizeof (u32),
   .format_trace = format_ipsec_input_trace,
   .type = VLIB_NODE_TYPE_INTERNAL,
-
   .n_errors = ARRAY_LEN(ipsec_input_error_strings),
   .error_strings = ipsec_input_error_strings,
-
-  .sibling_of = "ipsec4-input-feature",
+  .n_next_nodes = IPSEC_INPUT_N_NEXT,
+  .next_nodes = {
+#define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
+    foreach_ipsec_input_next
+#undef _
+  },
 };
 /* *INDENT-ON* */