X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_tun_in.c;h=501ab0276341239723f241ea4652306aad7cedf3;hb=282872127bbeee6ae59ab3f885c09bad601ee0cc;hp=f25a76319f1d89c2893799f3896b6b24da391bb6;hpb=12989b538881f9681f078cf1485c51df1251877a;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_tun_in.c b/src/vnet/ipsec/ipsec_tun_in.c
index f25a76319f1..501ab027634 100644
--- a/src/vnet/ipsec/ipsec_tun_in.c
+++ b/src/vnet/ipsec/ipsec_tun_in.c
@@ -55,8 +55,7 @@ typedef enum ipsec_tun_next_t_
 #define _(v, s) IPSEC_TUN_PROTECT_NEXT_##v,
   foreach_ipsec_input_next
 #undef _
-    IPSEC_TUN_PROTECT_NEXT_DECRYPT,
-  IPSEC_TUN_PROTECT_N_NEXT,
+    IPSEC_TUN_PROTECT_N_NEXT,
 } ipsec_tun_next_t;
 
 typedef struct
@@ -274,7 +273,7 @@ ipsec_tun_protect_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	    }
 	}
 
-      itp0 = pool_elt_at_index (ipsec_protect_pool, itr0.tun_index);
+      itp0 = pool_elt_at_index (ipsec_tun_protect_pool, itr0.tun_index);
       vnet_buffer (b[0])->ipsec.sad_index = itr0.sa_index;
       vnet_buffer (b[0])->ipsec.protect_index = itr0.tun_index;
 
@@ -311,59 +310,7 @@ ipsec_tun_protect_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      n_bytes = len0;
 	    }
 
-	  /*
-	   * compare the packet's outer IP headers to that of the tunnels
-	   */
-	  if (is_ip6)
-	    {
-	      if (PREDICT_FALSE
-		  (!ip46_address_is_equal_v6
-		   (&itp0->itp_crypto.dst, &ip60->src_address)
-		   || !ip46_address_is_equal_v6 (&itp0->itp_crypto.src,
-						 &ip60->dst_address)))
-		{
-		  b[0]->error =
-		    node->errors
-		    [IPSEC_TUN_PROTECT_INPUT_ERROR_TUNNEL_MISMATCH];
-		  next[0] = IPSEC_INPUT_NEXT_DROP;
-		  goto trace00;
-		}
-	    }
-	  else
-	    {
-	      if (PREDICT_FALSE
-		  (!ip46_address_is_equal_v4
-		   (&itp0->itp_crypto.dst, &ip40->src_address)
-		   || !ip46_address_is_equal_v4 (&itp0->itp_crypto.src,
-						 &ip40->dst_address)))
-		{
-		  b[0]->error =
-		    node->errors
-		    [IPSEC_TUN_PROTECT_INPUT_ERROR_TUNNEL_MISMATCH];
-		  next[0] = IPSEC_INPUT_NEXT_DROP;
-		  goto trace00;
-		}
-	    }
-
-	  /*
-	   * There are two encap possibilities
-	   * 1) the tunnel and ths SA are prodiving encap, i.e. it's
-	   *   MAC | SA-IP | TUN-IP | ESP | PAYLOAD
-	   * implying the SA is in tunnel mode (on a tunnel interface)
-	   * 2) only the tunnel provides encap
-	   *   MAC | TUN-IP | ESP | PAYLOAD
-	   * implying the SA is in transport mode.
-	   *
-	   * For 2) we need only strip the tunnel encap and we're good.
-	   *  since the tunnel and crypto ecnap (int the tun=protect
-	   * object) are the same and we verified above that these match
-	   * for 1) we need to strip the SA-IP outer headers, to
-	   * reveal the tunnel IP and then check that this matches
-	   * the configured tunnel. this we can;t do here since it
-	   * involves a lookup in the per-tunnel-type DB - so ship
-	   * the packet to the tunnel-types provided node to do that
-	   */
-	  next[0] = IPSEC_TUN_PROTECT_NEXT_DECRYPT;
+	  next[0] = im->esp4_decrypt_tun_next_index;	//IPSEC_TUN_PROTECT_NEXT_DECRYPT;
 	}
     trace00:
       if (PREDICT_FALSE (is_trace))
@@ -410,8 +357,7 @@ VLIB_NODE_FN (ipsec4_tun_input_node) (vlib_main_t * vm,
 				      vlib_node_runtime_t * node,
 				      vlib_frame_t * from_frame)
 {
-  return ipsec_tun_protect_input_inline (vm, node, from_frame,
-					 0 /* is_ip6 */ );
+  return ipsec_tun_protect_input_inline (vm, node, from_frame, 0);
 }
 
 /* *INDENT-OFF* */
@@ -426,7 +372,6 @@ VLIB_REGISTER_NODE (ipsec4_tun_input_node) = {
   .next_nodes = {
     [IPSEC_TUN_PROTECT_NEXT_DROP] = "ip4-drop",
     [IPSEC_TUN_PROTECT_NEXT_PUNT] = "punt-dispatch",
-    [IPSEC_TUN_PROTECT_NEXT_DECRYPT] = "esp4-decrypt-tun",
   }
 };
 /* *INDENT-ON* */
@@ -435,8 +380,7 @@ VLIB_NODE_FN (ipsec6_tun_input_node) (vlib_main_t * vm,
 				      vlib_node_runtime_t * node,
 				      vlib_frame_t * from_frame)
 {
-  return ipsec_tun_protect_input_inline (vm, node, from_frame,
-					 1 /* is_ip6 */ );
+  return ipsec_tun_protect_input_inline (vm, node, from_frame, 1);
 }
 
 /* *INDENT-OFF* */
@@ -451,7 +395,6 @@ VLIB_REGISTER_NODE (ipsec6_tun_input_node) = {
   .next_nodes = {
     [IPSEC_TUN_PROTECT_NEXT_DROP] = "ip6-drop",
     [IPSEC_TUN_PROTECT_NEXT_PUNT] = "punt-dispatch",
-    [IPSEC_TUN_PROTECT_NEXT_DECRYPT] = "esp6-decrypt-tun",
   }
 };
 /* *INDENT-ON* */