X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_output.c;h=a37e8c2d777019d86f8bb0b448c8f3c3f963d1c4;hb=6230eeabb49bde6bbfa8586d44335aa3003c4e73;hp=3a20d512f6056a6bbc16255e11c342eb5a796949;hpb=be5a5dd904d4d25857c53a4b5dee7951f724e3e2;p=vpp.git diff --git a/src/vnet/ipsec/ipsec_output.c b/src/vnet/ipsec/ipsec_output.c index 3a20d512f60..a37e8c2d777 100644 --- a/src/vnet/ipsec/ipsec_output.c +++ b/src/vnet/ipsec/ipsec_output.c @@ -20,6 +20,7 @@ #include #include +#include #if WITH_LIBSSL > 0 @@ -48,6 +49,7 @@ static char *ipsec_output_error_strings[] = { typedef struct { u32 spd_id; + u32 policy_id; } ipsec_output_trace_t; /* packet trace format function */ @@ -58,14 +60,8 @@ format_ipsec_output_trace (u8 * s, va_list * args) CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); ipsec_output_trace_t *t = va_arg (*args, ipsec_output_trace_t *); - if (t->spd_id != ~0) - { - s = format (s, "spd %u ", t->spd_id); - } - else - { - s = format (s, "no spd"); - } + s = format (s, "spd %u policy %d", t->spd_id, t->policy_id); + return s; } @@ -73,28 +69,29 @@ always_inline ipsec_policy_t * ipsec_output_policy_match (ipsec_spd_t * spd, u8 pr, u32 la, u32 ra, u16 lp, u16 rp) { + ipsec_main_t *im = &ipsec_main; ipsec_policy_t *p; u32 *i; if (!spd) return 0; - vec_foreach (i, spd->ipv4_outbound_policies) + vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP4_OUTBOUND]) { - p = pool_elt_at_index (spd->policies, *i); + p = pool_elt_at_index (im->policies, *i); if (PREDICT_FALSE (p->protocol && (p->protocol != pr))) continue; - if (ra < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32)) + if (ra < p->raddr.start.ip4.as_u32) continue; - if (ra > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32)) + if (ra > p->raddr.stop.ip4.as_u32) continue; - if (la < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32)) + if (la < p->laddr.start.ip4.as_u32) continue; - if (la > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32)) + if (la > p->laddr.stop.ip4.as_u32) continue; if (PREDICT_FALSE @@ -134,15 +131,16 @@ ipsec6_output_policy_match (ipsec_spd_t * spd, ip6_address_t * la, ip6_address_t * ra, u16 lp, u16 rp, u8 pr) { + ipsec_main_t *im = &ipsec_main; ipsec_policy_t *p; u32 *i; if (!spd) return 0; - vec_foreach (i, spd->ipv6_outbound_policies) + vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_OUTBOUND]) { - p = pool_elt_at_index (spd->policies, *i); + p = pool_elt_at_index (im->policies, *i); if (PREDICT_FALSE (p->protocol && (p->protocol != pr))) continue; @@ -181,7 +179,7 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, { ipsec_main_t *im = &ipsec_main; - u32 *from, *to_next = 0; + u32 *from, *to_next = 0, thread_index; u32 n_left_from, sw_if_index0, last_sw_if_index = (u32) ~ 0; u32 next_node_index = (u32) ~ 0, last_next_node_index = (u32) ~ 0; vlib_frame_t *f = 0; @@ -192,20 +190,29 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, from = vlib_frame_vector_args (from_frame); n_left_from = from_frame->n_vectors; + thread_index = vm->thread_index; while (n_left_from > 0) { - u32 bi0; - vlib_buffer_t *b0; + u32 bi0, pi0, bi1; + vlib_buffer_t *b0, *b1; ipsec_policy_t *p0; ip4_header_t *ip0; ip6_header_t *ip6_0 = 0; udp_header_t *udp0; u32 iph_offset = 0; tcp_header_t *tcp0; + u64 bytes0; bi0 = from[0]; b0 = vlib_get_buffer (vm, bi0); + if (n_left_from > 1) + { + bi1 = from[1]; + b1 = vlib_get_buffer (vm, bi1); + CLIB_PREFETCH (b1, CLIB_CACHE_LINE_BYTES * 2, STORE); + vlib_prefetch_buffer_data (b1, LOAD); + } sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX]; iph_offset = vnet_buffer (b0)->ip.save_rewrite_length; ip0 = (ip4_header_t *) ((u8 *) vlib_buffer_get_current (b0) @@ -239,10 +246,8 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, p0 = ipsec6_output_policy_match (spd0, &ip6_0->src_address, &ip6_0->dst_address, - clib_net_to_host_u16 - (udp0->src_port), - clib_net_to_host_u16 - (udp0->dst_port), ip6_0->protocol); + udp0->src_port, + udp0->dst_port, ip6_0->protocol); } else { @@ -258,19 +263,29 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, #endif p0 = ipsec_output_policy_match (spd0, ip0->protocol, - clib_net_to_host_u32 - (ip0->src_address.as_u32), - clib_net_to_host_u32 - (ip0->dst_address.as_u32), - clib_net_to_host_u16 - (udp0->src_port), - clib_net_to_host_u16 - (udp0->dst_port)); + ip0->src_address.as_u32, + ip0->dst_address.as_u32, + udp0->src_port, udp0->dst_port); } tcp0 = (void *) udp0; if (PREDICT_TRUE (p0 != NULL)) { + pi0 = p0 - im->policies; + + vlib_prefetch_combined_counter (&ipsec_spd_policy_counters, + thread_index, pi0); + + if (is_ipv6) + { + bytes0 = clib_net_to_host_u16 (ip6_0->payload_length); + bytes0 += sizeof (ip6_header_t); + } + else + { + bytes0 = clib_net_to_host_u16 (ip0->length); + } + if (p0->policy == IPSEC_POLICY_ACTION_PROTECT) { ipsec_sa_t *sa = 0; @@ -286,12 +301,9 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, else next_node_index = im->ah4_encrypt_node_index; vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; - p0->counter.packets++; + if (is_ipv6) { - p0->counter.bytes += - clib_net_to_host_u16 (ip6_0->payload_length); - p0->counter.bytes += sizeof (ip6_header_t); if (PREDICT_FALSE (b0->flags & VNET_BUFFER_F_OFFLOAD_TCP_CKSUM)) { @@ -311,7 +323,6 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, } else { - p0->counter.bytes += clib_net_to_host_u16 (ip0->length); if (b0->flags & VNET_BUFFER_F_OFFLOAD_IP_CKSUM) { ip0->checksum = ip4_header_checksum (ip0); @@ -338,37 +349,18 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, { nc_bypass++; next_node_index = get_next_output_feature_node_index (b0, node); - p0->counter.packets++; - if (is_ipv6) - { - p0->counter.bytes += - clib_net_to_host_u16 (ip6_0->payload_length); - p0->counter.bytes += sizeof (ip6_header_t); - } - else - { - p0->counter.bytes += clib_net_to_host_u16 (ip0->length); - } } else { nc_discard++; - p0->counter.packets++; - if (is_ipv6) - { - p0->counter.bytes += - clib_net_to_host_u16 (ip6_0->payload_length); - p0->counter.bytes += sizeof (ip6_header_t); - } - else - { - p0->counter.bytes += clib_net_to_host_u16 (ip0->length); - } next_node_index = im->error_drop_node_index; } + vlib_increment_combined_counter + (&ipsec_spd_policy_counters, thread_index, pi0, 1, bytes0); } else { + pi0 = ~0; nc_nomatch++; next_node_index = im->error_drop_node_index; } @@ -385,6 +377,11 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, last_next_node_index = next_node_index; f = vlib_get_frame_to_node (vm, next_node_index); + + /* frame->frame_flags, copy it from node */ + /* Copy trace flag from next_frame and from runtime. */ + f->frame_flags |= node->flags & VLIB_NODE_FLAG_TRACE; + to_next = vlib_frame_vector_args (f); } @@ -392,12 +389,14 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, to_next += 1; f->n_vectors++; - if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) + if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) && + PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) { ipsec_output_trace_t *tr = vlib_add_trace (vm, node, b0, sizeof (*tr)); if (spd0) tr->spd_id = spd0->id; + tr->policy_id = pi0; } } @@ -414,17 +413,16 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node, return from_frame->n_vectors; } -static uword -ipsec4_output_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, - vlib_frame_t * frame) +VLIB_NODE_FN (ipsec4_output_node) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) { return ipsec_output_inline (vm, node, frame, 0); } /* *INDENT-OFF* */ -VLIB_REGISTER_NODE (ipsec4_output_node,static) = { - .function = ipsec4_output_node_fn, - .name = "ipsec4-output", +VLIB_REGISTER_NODE (ipsec4_output_node) = { + .name = "ipsec4-output-feature", .vector_size = sizeof (u32), .format_trace = format_ipsec_output_trace, .type = VLIB_NODE_TYPE_INTERNAL, @@ -441,19 +439,16 @@ VLIB_REGISTER_NODE (ipsec4_output_node,static) = { }; /* *INDENT-ON* */ -VLIB_NODE_FUNCTION_MULTIARCH (ipsec4_output_node, ipsec4_output_node_fn); - -static uword -ipsec6_output_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, - vlib_frame_t * frame) +VLIB_NODE_FN (ipsec6_output_node) (vlib_main_t * vm, + vlib_node_runtime_t * node, + vlib_frame_t * frame) { return ipsec_output_inline (vm, node, frame, 1); } /* *INDENT-OFF* */ -VLIB_REGISTER_NODE (ipsec6_output_node,static) = { - .function = ipsec6_output_node_fn, - .name = "ipsec6-output", +VLIB_REGISTER_NODE (ipsec6_output_node) = { + .name = "ipsec6-output-feature", .vector_size = sizeof (u32), .format_trace = format_ipsec_output_trace, .type = VLIB_NODE_TYPE_INTERNAL, @@ -470,7 +465,6 @@ VLIB_REGISTER_NODE (ipsec6_output_node,static) = { }; /* *INDENT-ON* */ -VLIB_NODE_FUNCTION_MULTIARCH (ipsec6_output_node, ipsec6_output_node_fn); #else /* IPSEC > 1 */ /* Dummy ipsec output node, in case when IPSec is disabled */ @@ -487,13 +481,13 @@ ipsec_output_node_fn (vlib_main_t * vm, VLIB_REGISTER_NODE (ipsec4_output_node) = { .vector_size = sizeof (u32), .function = ipsec_output_node_fn, - .name = "ipsec4-output", + .name = "ipsec4-output-feature", }; VLIB_REGISTER_NODE (ipsec6_output_node) = { .vector_size = sizeof (u32), .function = ipsec_output_node_fn, - .name = "ipsec6-output", + .name = "ipsec6-output-feature", }; /* *INDENT-ON* */ #endif