X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fesp_encrypt.c;h=16f985c6cfe6d3903cfa0f60fbf3276f3312921b;hb=4c422f9a3c9d5a4ecae3f4ef6bee16bb8ce35bb2;hp=9c775ef1e479b6908bf085d1f1eebf8f0e1ecfd7;hpb=be5a5dd904d4d25857c53a4b5dee7951f724e3e2;p=vpp.git

diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index 9c775ef1e47..16f985c6cfe 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -137,15 +137,9 @@ esp_encrypt_inline (vlib_main_t * vm,
 
   if (PREDICT_FALSE (vec_len (empty_buffers) < n_left_from))
     {
-      if (is_ip6)
-	vlib_node_increment_counter (vm, esp6_encrypt_node.index,
-				     ESP_ENCRYPT_ERROR_NO_BUFFER,
-				     n_left_from);
-      else
-	vlib_node_increment_counter (vm, esp4_encrypt_node.index,
-				     ESP_ENCRYPT_ERROR_NO_BUFFER,
-				     n_left_from);
-      clib_warning ("no enough empty buffers. discarding frame");
+      vlib_node_increment_counter (vm, node->node_index,
+				   ESP_ENCRYPT_ERROR_NO_BUFFER, n_left_from);
+      clib_warning ("not enough empty buffers. discarding frame");
       goto free_buffers_and_exit;
     }
 
@@ -189,12 +183,8 @@ esp_encrypt_inline (vlib_main_t * vm,
 	    {
 	      clib_warning ("sequence number counter has cycled SPI %u",
 			    sa0->spi);
-	      if (is_ip6)
-		vlib_node_increment_counter (vm, esp6_encrypt_node.index,
-					     ESP_ENCRYPT_ERROR_SEQ_CYCLED, 1);
-	      else
-		vlib_node_increment_counter (vm, esp4_encrypt_node.index,
-					     ESP_ENCRYPT_ERROR_SEQ_CYCLED, 1);
+	      vlib_node_increment_counter (vm, node->node_index,
+					   ESP_ENCRYPT_ERROR_SEQ_CYCLED, 1);
 	      //TODO: rekey SA
 	      o_bi0 = i_bi0;
 	      to_next[0] = o_bi0;
@@ -289,7 +279,7 @@ esp_encrypt_inline (vlib_main_t * vm,
 	      oh0->ip4.src_address.as_u32 = sa0->tunnel_src_addr.ip4.as_u32;
 	      oh0->ip4.dst_address.as_u32 = sa0->tunnel_dst_addr.ip4.as_u32;
 
-	      vnet_buffer (o_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      vnet_buffer (o_b0)->sw_if_index[VLIB_TX] = sa0->tx_fib_index;
 	    }
 	  else if (is_ip6 && sa0->is_tunnel && sa0->is_tunnel_ip6)
 	    {
@@ -302,7 +292,7 @@ esp_encrypt_inline (vlib_main_t * vm,
 	      oh6_0->ip6.dst_address.as_u64[1] =
 		sa0->tunnel_dst_addr.ip6.as_u64[1];
 
-	      vnet_buffer (o_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      vnet_buffer (o_b0)->sw_if_index[VLIB_TX] = sa0->tx_fib_index;
 	    }
 	  else
 	    {
@@ -316,12 +306,20 @@ esp_encrypt_inline (vlib_main_t * vm,
 					   vlib_buffer_get_current (i_b0) -
 					   sizeof (ethernet_header_t));
 		  oeh0 = (ethernet_header_t *) o_b0->data;
-		  clib_memcpy (oeh0, ieh0, sizeof (ethernet_header_t));
+		  clib_memcpy_fast (oeh0, ieh0, sizeof (ethernet_header_t));
 		  next0 = ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT;
 		  vnet_buffer (o_b0)->sw_if_index[VLIB_TX] =
 		    vnet_buffer (i_b0)->sw_if_index[VLIB_TX];
 		}
-	      vlib_buffer_advance (i_b0, ip_udp_hdr_size);
+
+	      if (is_ip6)
+		{
+		  vlib_buffer_advance (i_b0, sizeof (ip6_header_t));
+		}
+	      else
+		{
+		  vlib_buffer_advance (i_b0, sizeof (ip4_header_t));
+		}
 	    }
 
 	  ASSERT (sa0->crypto_alg < IPSEC_CRYPTO_N_ALG);
@@ -359,10 +357,10 @@ esp_encrypt_inline (vlib_main_t * vm,
 		    ipsec_proto_main_crypto_algs[sa0->crypto_alg].iv_size];
 	      RAND_bytes (iv, sizeof (iv));
 
-	      clib_memcpy ((u8 *) vlib_buffer_get_current (o_b0) +
-			   ip_udp_hdr_size + sizeof (esp_header_t), iv,
-			   em->ipsec_proto_main_crypto_algs[sa0->
-							    crypto_alg].iv_size);
+	      clib_memcpy_fast ((u8 *) vlib_buffer_get_current (o_b0) +
+				ip_udp_hdr_size + sizeof (esp_header_t), iv,
+				em->ipsec_proto_main_crypto_algs[sa0->
+								 crypto_alg].iv_size);
 
 	      esp_encrypt_cbc (vm, sa0->crypto_alg,
 			       (u8 *) vlib_buffer_get_current (i_b0),
@@ -428,14 +426,9 @@ esp_encrypt_inline (vlib_main_t * vm,
 	}
       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
     }
-  if (is_ip6)
-    vlib_node_increment_counter (vm, esp6_encrypt_node.index,
-				 ESP_ENCRYPT_ERROR_RX_PKTS,
-				 from_frame->n_vectors);
-  else
-    vlib_node_increment_counter (vm, esp4_encrypt_node.index,
-				 ESP_ENCRYPT_ERROR_RX_PKTS,
-				 from_frame->n_vectors);
+  vlib_node_increment_counter (vm, node->node_index,
+			       ESP_ENCRYPT_ERROR_RX_PKTS,
+			       from_frame->n_vectors);
 
 free_buffers_and_exit:
   if (recycle)
@@ -444,16 +437,15 @@ free_buffers_and_exit:
   return from_frame->n_vectors;
 }
 
-static uword
-esp4_encrypt_node_fn (vlib_main_t * vm,
-		      vlib_node_runtime_t * node, vlib_frame_t * from_frame)
+VLIB_NODE_FN (esp4_encrypt_node) (vlib_main_t * vm,
+				  vlib_node_runtime_t * node,
+				  vlib_frame_t * from_frame)
 {
   return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
 }
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (esp4_encrypt_node) = {
-  .function = esp4_encrypt_node_fn,
   .name = "esp4-encrypt",
   .vector_size = sizeof (u32),
   .format_trace = format_esp_encrypt_trace,
@@ -471,18 +463,15 @@ VLIB_REGISTER_NODE (esp4_encrypt_node) = {
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (esp4_encrypt_node, esp4_encrypt_node_fn);
-
-static uword
-esp6_encrypt_node_fn (vlib_main_t * vm,
-		      vlib_node_runtime_t * node, vlib_frame_t * from_frame)
+VLIB_NODE_FN (esp6_encrypt_node) (vlib_main_t * vm,
+				  vlib_node_runtime_t * node,
+				  vlib_frame_t * from_frame)
 {
   return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
 }
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (esp6_encrypt_node) = {
-  .function = esp6_encrypt_node_fn,
   .name = "esp6-encrypt",
   .vector_size = sizeof (u32),
   .format_trace = format_esp_encrypt_trace,
@@ -500,7 +489,6 @@ VLIB_REGISTER_NODE (esp6_encrypt_node) = {
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (esp6_encrypt_node, esp6_encrypt_node_fn);
 /*
  * fd.io coding-style-patch-verification: ON
  *