X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fesp_encrypt.c;h=e1690439c885c0f772ed5eeb21488c26260a8d63;hb=47727c02df4c79c21c6ceffaff65222c32cf6996;hp=101c5efbfc8c9b00f3dd15587bedda51a940e451;hpb=178cf493d009995b28fdf220f04c98860ff79a9b;p=vpp.git

diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index 101c5efbfc8..e1690439c88 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -23,7 +23,9 @@
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/esp.h>
 
+#ifndef CLIB_MARCH_VARIANT
 ipsec_proto_main_t ipsec_proto_main;
+#endif /* CLIB_MARCH_VARIANT */
 
 #define foreach_esp_encrypt_next                   \
 _(DROP, "error-drop")                              \
@@ -62,6 +64,7 @@ static char *esp_encrypt_error_strings[] = {
 
 typedef struct
 {
+  u32 sa_index;
   u32 spi;
   u32 seq;
   u8 udp_encap;
@@ -77,8 +80,8 @@ format_esp_encrypt_trace (u8 * s, va_list * args)
   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
   esp_encrypt_trace_t *t = va_arg (*args, esp_encrypt_trace_t *);
 
-  s = format (s, "esp: spi %u seq %u crypto %U integrity %U%s",
-	      t->spi, t->seq,
+  s = format (s, "esp: sa-index %d spi %u seq %u crypto %U integrity %U%s",
+	      t->sa_index, t->spi, t->seq,
 	      format_ipsec_crypto_alg, t->crypto_alg,
 	      format_ipsec_integ_alg, t->integ_alg,
 	      t->udp_encap ? " udp-encap-enabled" : "");
@@ -137,14 +140,8 @@ esp_encrypt_inline (vlib_main_t * vm,
 
   if (PREDICT_FALSE (vec_len (empty_buffers) < n_left_from))
     {
-      if (is_ip6)
-	vlib_node_increment_counter (vm, esp6_encrypt_node.index,
-				     ESP_ENCRYPT_ERROR_NO_BUFFER,
-				     n_left_from);
-      else
-	vlib_node_increment_counter (vm, esp4_encrypt_node.index,
-				     ESP_ENCRYPT_ERROR_NO_BUFFER,
-				     n_left_from);
+      vlib_node_increment_counter (vm, node->node_index,
+				   ESP_ENCRYPT_ERROR_NO_BUFFER, n_left_from);
       clib_warning ("not enough empty buffers. discarding frame");
       goto free_buffers_and_exit;
     }
@@ -189,12 +186,8 @@ esp_encrypt_inline (vlib_main_t * vm,
 	    {
 	      clib_warning ("sequence number counter has cycled SPI %u",
 			    sa0->spi);
-	      if (is_ip6)
-		vlib_node_increment_counter (vm, esp6_encrypt_node.index,
-					     ESP_ENCRYPT_ERROR_SEQ_CYCLED, 1);
-	      else
-		vlib_node_increment_counter (vm, esp4_encrypt_node.index,
-					     ESP_ENCRYPT_ERROR_SEQ_CYCLED, 1);
+	      vlib_node_increment_counter (vm, node->node_index,
+					   ESP_ENCRYPT_ERROR_SEQ_CYCLED, 1);
 	      //TODO: rekey SA
 	      o_bi0 = i_bi0;
 	      to_next[0] = o_bi0;
@@ -289,7 +282,9 @@ esp_encrypt_inline (vlib_main_t * vm,
 	      oh0->ip4.src_address.as_u32 = sa0->tunnel_src_addr.ip4.as_u32;
 	      oh0->ip4.dst_address.as_u32 = sa0->tunnel_dst_addr.ip4.as_u32;
 
-	      vnet_buffer (o_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      next0 = sa0->dpo[IPSEC_PROTOCOL_ESP].dpoi_next_node;
+	      vnet_buffer (o_b0)->ip.adj_index[VLIB_TX] =
+		sa0->dpo[IPSEC_PROTOCOL_ESP].dpoi_index;
 	    }
 	  else if (is_ip6 && sa0->is_tunnel && sa0->is_tunnel_ip6)
 	    {
@@ -302,7 +297,9 @@ esp_encrypt_inline (vlib_main_t * vm,
 	      oh6_0->ip6.dst_address.as_u64[1] =
 		sa0->tunnel_dst_addr.ip6.as_u64[1];
 
-	      vnet_buffer (o_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      next0 = sa0->dpo[IPSEC_PROTOCOL_ESP].dpoi_next_node;
+	      vnet_buffer (o_b0)->ip.adj_index[VLIB_TX] =
+		sa0->dpo[IPSEC_PROTOCOL_ESP].dpoi_index;
 	    }
 	  else
 	    {
@@ -321,7 +318,15 @@ esp_encrypt_inline (vlib_main_t * vm,
 		  vnet_buffer (o_b0)->sw_if_index[VLIB_TX] =
 		    vnet_buffer (i_b0)->sw_if_index[VLIB_TX];
 		}
-	      vlib_buffer_advance (i_b0, ip_udp_hdr_size);
+
+	      if (is_ip6)
+		{
+		  vlib_buffer_advance (i_b0, sizeof (ip6_header_t));
+		}
+	      else
+		{
+		  vlib_buffer_advance (i_b0, sizeof (ip4_header_t));
+		}
 	    }
 
 	  ASSERT (sa0->crypto_alg < IPSEC_CRYPTO_N_ALG);
@@ -369,17 +374,15 @@ esp_encrypt_inline (vlib_main_t * vm,
 			       (u8 *) vlib_buffer_get_current (o_b0) +
 			       ip_udp_hdr_size + sizeof (esp_header_t) +
 			       IV_SIZE, BLOCK_SIZE * blocks,
-			       sa0->crypto_key, iv);
+			       sa0->crypto_key.data, iv);
 	    }
 
-	  o_b0->current_length += hmac_calc (sa0->integ_alg, sa0->integ_key,
-					     sa0->integ_key_len,
-					     (u8 *) o_esp0,
-					     o_b0->current_length -
-					     ip_udp_hdr_size,
-					     vlib_buffer_get_current (o_b0) +
-					     o_b0->current_length,
-					     sa0->use_esn, sa0->seq_hi);
+	  o_b0->current_length +=
+	    hmac_calc (sa0->integ_alg, sa0->integ_key.data,
+		       sa0->integ_key.len, (u8 *) o_esp0,
+		       o_b0->current_length - ip_udp_hdr_size,
+		       vlib_buffer_get_current (o_b0) + o_b0->current_length,
+		       sa0->use_esn, sa0->seq_hi);
 
 
 	  if (is_ip6)
@@ -414,6 +417,7 @@ esp_encrypt_inline (vlib_main_t * vm,
 		  o_b0->trace_index = i_b0->trace_index;
 		  esp_encrypt_trace_t *tr =
 		    vlib_add_trace (vm, node, o_b0, sizeof (*tr));
+		  tr->sa_index = sa_index0;
 		  tr->spi = sa0->spi;
 		  tr->seq = sa0->seq - 1;
 		  tr->udp_encap = sa0->udp_encap;
@@ -428,14 +432,9 @@ esp_encrypt_inline (vlib_main_t * vm,
 	}
       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
     }
-  if (is_ip6)
-    vlib_node_increment_counter (vm, esp6_encrypt_node.index,
-				 ESP_ENCRYPT_ERROR_RX_PKTS,
-				 from_frame->n_vectors);
-  else
-    vlib_node_increment_counter (vm, esp4_encrypt_node.index,
-				 ESP_ENCRYPT_ERROR_RX_PKTS,
-				 from_frame->n_vectors);
+  vlib_node_increment_counter (vm, node->node_index,
+			       ESP_ENCRYPT_ERROR_RX_PKTS,
+			       from_frame->n_vectors);
 
 free_buffers_and_exit:
   if (recycle)