X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_spd_policy.c;h=6424210b4e31b96173b420dd0ad2b294e97ad687;hb=f18f09b16b02f3b136be0794a3de5f9ef6e6f651;hp=0a576595a5a374938073e9249830c033ecbdde99;hpb=999c8ee6d6f1c07ba7877fb3f9aa66a90774aacc;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_spd_policy.c b/src/vnet/ipsec/ipsec_spd_policy.c
index 0a576595a5a..6424210b4e3 100644
--- a/src/vnet/ipsec/ipsec_spd_policy.c
+++ b/src/vnet/ipsec/ipsec_spd_policy.c
@@ -15,16 +15,81 @@
 
 #include <vnet/ipsec/ipsec.h>
 
+/**
+ * @brief
+ * Policy packet & bytes counters
+ */
+vlib_combined_counter_main_t ipsec_spd_policy_counters = {
+  .name = "policy",
+  .stat_segment_name = "/net/ipsec/policy",
+};
+
+static int
+ipsec_policy_is_equal (ipsec_policy_t * p1, ipsec_policy_t * p2)
+{
+  if (p1->priority != p2->priority)
+    return 0;
+  if (p1->type != p2->type)
+    return (0);
+  if (p1->policy != p2->policy)
+    return (0);
+  if (p1->sa_id != p2->sa_id)
+    return (0);
+  if (p1->protocol != p2->protocol)
+    return (0);
+  if (p1->lport.start != p2->lport.start)
+    return (0);
+  if (p1->lport.stop != p2->lport.stop)
+    return (0);
+  if (p1->rport.start != p2->rport.start)
+    return (0);
+  if (p1->rport.stop != p2->rport.stop)
+    return (0);
+  if (p1->is_ipv6 != p2->is_ipv6)
+    return (0);
+  if (p2->is_ipv6)
+    {
+      if (p1->laddr.start.ip6.as_u64[0] != p2->laddr.start.ip6.as_u64[0])
+	return (0);
+      if (p1->laddr.start.ip6.as_u64[1] != p2->laddr.start.ip6.as_u64[1])
+	return (0);
+      if (p1->laddr.stop.ip6.as_u64[0] != p2->laddr.stop.ip6.as_u64[0])
+	return (0);
+      if (p1->laddr.stop.ip6.as_u64[1] != p2->laddr.stop.ip6.as_u64[1])
+	return (0);
+      if (p1->raddr.start.ip6.as_u64[0] != p2->raddr.start.ip6.as_u64[0])
+	return (0);
+      if (p1->raddr.start.ip6.as_u64[1] != p2->raddr.start.ip6.as_u64[1])
+	return (0);
+      if (p1->raddr.stop.ip6.as_u64[0] != p2->raddr.stop.ip6.as_u64[0])
+	return (0);
+      if (p1->laddr.stop.ip6.as_u64[1] != p2->laddr.stop.ip6.as_u64[1])
+	return (0);
+    }
+  else
+    {
+      if (p1->laddr.start.ip4.as_u32 != p2->laddr.start.ip4.as_u32)
+	return (0);
+      if (p1->laddr.stop.ip4.as_u32 != p2->laddr.stop.ip4.as_u32)
+	return (0);
+      if (p1->raddr.start.ip4.as_u32 != p2->raddr.start.ip4.as_u32)
+	return (0);
+      if (p1->raddr.stop.ip4.as_u32 != p2->raddr.stop.ip4.as_u32)
+	return (0);
+    }
+  return (1);
+}
+
 static int
 ipsec_spd_entry_sort (void *a1, void *a2)
 {
+  ipsec_main_t *im = &ipsec_main;
   u32 *id1 = a1;
   u32 *id2 = a2;
-  ipsec_spd_t *spd = ipsec_main.spd_to_sort;
   ipsec_policy_t *p1, *p2;
 
-  p1 = pool_elt_at_index (spd->policies, *id1);
-  p2 = pool_elt_at_index (spd->policies, *id2);
+  p1 = pool_elt_at_index (im->policies, *id1);
+  p2 = pool_elt_at_index (im->policies, *id2);
   if (p1 && p2)
     return p2->priority - p1->priority;
 
@@ -32,24 +97,50 @@ ipsec_spd_entry_sort (void *a1, void *a2)
 }
 
 int
-ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
+ipsec_policy_mk_type (bool is_outbound,
+		      bool is_ipv6,
+		      ipsec_policy_action_t action,
+		      ipsec_spd_policy_type_t * type)
+{
+  if (is_outbound)
+    {
+      *type = (is_ipv6 ?
+	       IPSEC_SPD_POLICY_IP6_OUTBOUND : IPSEC_SPD_POLICY_IP4_OUTBOUND);
+      return (0);
+    }
+  else
+    {
+      switch (action)
+	{
+	case IPSEC_POLICY_ACTION_PROTECT:
+	  *type = (is_ipv6 ?
+		   IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT :
+		   IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT);
+	  return (0);
+	case IPSEC_POLICY_ACTION_BYPASS:
+	  *type = (is_ipv6 ?
+		   IPSEC_SPD_POLICY_IP6_INBOUND_BYPASS :
+		   IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
+	  return (0);
+	case IPSEC_POLICY_ACTION_DISCARD:
+	case IPSEC_POLICY_ACTION_RESOLVE:
+	  break;
+	}
+    }
+
+  /* Unsupported type */
+  return (-1);
+}
+
+int
+ipsec_add_del_policy (vlib_main_t * vm,
+		      ipsec_policy_t * policy, int is_add, u32 * stat_index)
 {
   ipsec_main_t *im = &ipsec_main;
   ipsec_spd_t *spd = 0;
   ipsec_policy_t *vp;
-  uword *p;
   u32 spd_index;
-
-  clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
-		policy->priority, policy->is_outbound);
-
-  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
-    {
-      p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
-      if (!p)
-	return VNET_API_ERROR_SYSCALL_ERROR_1;
-      policy->sa_index = p[0];
-    }
+  uword *p;
 
   p = hash_get (im->spd_index_by_spd_id, policy->id);
 
@@ -65,193 +156,46 @@ ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
     {
       u32 policy_index;
 
-      pool_get (spd->policies, vp);
-      clib_memcpy (vp, policy, sizeof (*vp));
-      policy_index = vp - spd->policies;
-
-      ipsec_main.spd_to_sort = spd;
-
-      if (policy->is_outbound)
+      if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 	{
-	  if (policy->is_ipv6)
-	    {
-	      vec_add1 (spd->ipv6_outbound_policies, policy_index);
-	      vec_sort_with_function (spd->ipv6_outbound_policies,
-				      ipsec_spd_entry_sort);
-	    }
-	  else
-	    {
-	      vec_add1 (spd->ipv4_outbound_policies, policy_index);
-	      vec_sort_with_function (spd->ipv4_outbound_policies,
-				      ipsec_spd_entry_sort);
-	    }
+	  index_t sa_index = ipsec_sa_find_and_lock (policy->sa_id);
+
+	  if (INDEX_INVALID == sa_index)
+	    return VNET_API_ERROR_SYSCALL_ERROR_1;
+	  policy->sa_index = sa_index;
 	}
       else
-	{
-	  if (policy->is_ipv6)
-	    {
-	      if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
-		{
-		  vec_add1 (spd->ipv6_inbound_protect_policy_indices,
-			    policy_index);
-		  vec_sort_with_function
-		    (spd->ipv6_inbound_protect_policy_indices,
-		     ipsec_spd_entry_sort);
-		}
-	      else
-		{
-		  vec_add1
-		    (spd->ipv6_inbound_policy_discard_and_bypass_indices,
-		     policy_index);
-		  vec_sort_with_function
-		    (spd->ipv6_inbound_policy_discard_and_bypass_indices,
-		     ipsec_spd_entry_sort);
-		}
-	    }
-	  else
-	    {
-	      if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
-		{
-		  vec_add1 (spd->ipv4_inbound_protect_policy_indices,
-			    policy_index);
-		  vec_sort_with_function
-		    (spd->ipv4_inbound_protect_policy_indices,
-		     ipsec_spd_entry_sort);
-		}
-	      else
-		{
-		  vec_add1
-		    (spd->ipv4_inbound_policy_discard_and_bypass_indices,
-		     policy_index);
-		  vec_sort_with_function
-		    (spd->ipv4_inbound_policy_discard_and_bypass_indices,
-		     ipsec_spd_entry_sort);
-		}
-	    }
-	}
+	policy->sa_index = INDEX_INVALID;
+
+      pool_get (im->policies, vp);
+      clib_memcpy (vp, policy, sizeof (*vp));
+      policy_index = vp - im->policies;
+
+      vlib_validate_combined_counter (&ipsec_spd_policy_counters,
+				      policy_index);
+      vlib_zero_combined_counter (&ipsec_spd_policy_counters, policy_index);
 
-      ipsec_main.spd_to_sort = NULL;
+      vec_add1 (spd->policies[policy->type], policy_index);
+      vec_sort_with_function (spd->policies[policy->type],
+			      ipsec_spd_entry_sort);
+      *stat_index = policy_index;
     }
   else
     {
-      u32 i, j;
-      /* *INDENT-OFF* */
-      pool_foreach_index(i, spd->policies, ({
-        vp = pool_elt_at_index(spd->policies, i);
-        if (vp->priority != policy->priority)
-          continue;
-        if (vp->is_outbound != policy->is_outbound)
-          continue;
-        if (vp->policy != policy->policy)
-          continue;
-        if (vp->sa_id != policy->sa_id)
-          continue;
-        if (vp->protocol != policy->protocol)
-          continue;
-        if (vp->lport.start != policy->lport.start)
-          continue;
-        if (vp->lport.stop != policy->lport.stop)
-          continue;
-        if (vp->rport.start != policy->rport.start)
-          continue;
-        if (vp->rport.stop != policy->rport.stop)
-          continue;
-        if (vp->is_ipv6 != policy->is_ipv6)
-          continue;
-        if (policy->is_ipv6)
-          {
-            if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
-              continue;
-            if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
-              continue;
-            if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
-              continue;
-            if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
-              continue;
-            if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
-              continue;
-            if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
-              continue;
-            if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
-              continue;
-           if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
-              continue;
-           if (policy->is_outbound)
-             {
-               vec_foreach_index(j, spd->ipv6_outbound_policies) {
-                 if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
-                   vec_del1 (spd->ipv6_outbound_policies, j);
-                   break;
-                 }
-               }
-             }
-           else
-             {
-               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
-                 {
-                   vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
-                     if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
-                       vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
-                       break;
-                     }
-                   }
-                 }
-               else
-                 {
-                   vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
-                     if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
-                       vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
-                       break;
-                     }
-                   }
-                 }
-             }
-          }
-        else
-          {
-            if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
-              continue;
-            if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
-              continue;
-            if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
-              continue;
-            if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
-              continue;
-            if (policy->is_outbound)
-              {
-                vec_foreach_index(j, spd->ipv4_outbound_policies) {
-                  if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
-                    vec_del1 (spd->ipv4_outbound_policies, j);
-                    break;
-                  }
-                }
-              }
-            else
-              {
-                if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
-                  {
-                    vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
-                      if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
-                        vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
-                        break;
-                      }
-                    }
-                  }
-                else
-                  {
-                    vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
-                      if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
-                        vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
-                        break;
-                      }
-                    }
-                  }
-              }
-          }
-          pool_put (spd->policies, vp);
-          break;
-      }));
-      /* *INDENT-ON* */
+      u32 ii;
+
+      vec_foreach_index (ii, (spd->policies[policy->type]))
+      {
+	vp = pool_elt_at_index (im->policies,
+				spd->policies[policy->type][ii]);
+	if (ipsec_policy_is_equal (vp, policy))
+	  {
+	    vec_del1 (spd->policies[policy->type], ii);
+	    ipsec_sa_unlock (vp->sa_index);
+	    pool_put (im->policies, vp);
+	    break;
+	  }
+      }
     }
 
   return 0;