ipsec: add udp-encap option to debug cli commands

[vpp.git] / src / vnet / ipsec / ipsec_input.c

diff --git a/src/vnet/ipsec/ipsec_input.c b/src/vnet/ipsec/ipsec_input.c
index 9aa5654..b7bb07b 100644 (file)
--- a/src/vnet/ipsec/ipsec_input.c
+++ b/src/vnet/ipsec/ipsec_input.c
@@ -207,16 +207,17 @@ ipsec_input_ip4_node_fn (vlib_main_t * vm,
          n_left_to_next -= 1;
 
          b0 = vlib_get_buffer (vm, bi0);
-         c0 =
-           vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index
-                                        [VLIB_RX], &next0, b0,
-                                        sizeof (c0[0]));
+         b0->flags |= VNET_BUFFER_F_IS_IP4;
+         b0->flags &= ~VNET_BUFFER_F_IS_IP6;
+         c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
 
          spd0 = pool_elt_at_index (im->spds, c0->spd_index);
 
          ip0 = vlib_buffer_get_current (b0);
 
-         if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
+         if (PREDICT_TRUE
+             (ip0->protocol == IP_PROTOCOL_IPSEC_ESP
+              || ip0->protocol == IP_PROTOCOL_UDP))
            {
 #if 0
              clib_warning
@@ -228,6 +229,13 @@ ipsec_input_ip4_node_fn (vlib_main_t * vm,
 #endif
 
              esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
+             if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_UDP))
+               {
+                 esp0 =
+                   (esp_header_t *) ((u8 *) esp0 + sizeof (udp_header_t));
+               }
+             /* FIXME TODO missing check whether there is enough data inside
+              * IP/UDP to contain ESP header & stuff ? */
              p0 = ipsec_input_protect_policy_match (spd0,
                                                     clib_net_to_host_u32
                                                     (ip0->src_address.
@@ -245,7 +253,7 @@ ipsec_input_ip4_node_fn (vlib_main_t * vm,
                  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
                  vnet_buffer (b0)->ipsec.flags = 0;
                  next0 = im->esp_decrypt_next_index;
-                 vlib_buffer_advance (b0, ip4_header_bytes (ip0));
+                 vlib_buffer_advance (b0, ((u8 *) esp0 - (u8 *) ip0));
                  goto trace0;
                }
 
@@ -255,7 +263,8 @@ ipsec_input_ip4_node_fn (vlib_main_t * vm,
                {
                  ipsec_input_trace_t *tr =
                    vlib_add_trace (vm, node, b0, sizeof (*tr));
-                 if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
+                 if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP ||
+                     ip0->protocol == IP_PROTOCOL_UDP)
                    {
                      if (p0)
                        tr->sa_id = p0->sa_id;
@@ -379,10 +388,9 @@ VLIB_NODE_FUNCTION_MULTIARCH (ipsec_input_ip4_node, ipsec_input_ip4_node_fn)
          n_left_to_next -= 1;
 
          b0 = vlib_get_buffer (vm, bi0);
-         c0 =
-           vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index
-                                        [VLIB_RX], &next0, b0,
-                                        sizeof (c0[0]));
+         b0->flags |= VNET_BUFFER_F_IS_IP6;
+         b0->flags &= ~VNET_BUFFER_F_IS_IP4;
+         c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
 
          spd0 = pool_elt_at_index (im->spds, c0->spd_index);