From 01034be6738b9bd072a3d3cfdeb1b900aac2b54f Mon Sep 17 00:00:00 2001 From: Matthew Smith Date: Tue, 16 May 2017 11:51:18 -0500 Subject: [PATCH] Use counters on ipsec tunnel interfaces Increment byte & packet counters when packets are sent or received on an IPsec tunnel interface. Set counters to zero when the interface is deleted. Change-Id: Ie9584aa82778875dd4d0c931005f7720b4d5c76d Signed-off-by: Matthew Smith --- src/vnet/ipsec/ipsec_if.c | 9 ++++++ src/vnet/ipsec/ipsec_if_in.c | 71 ++++++++++++++++++++++++++++++++++++++++--- src/vnet/ipsec/ipsec_if_out.c | 33 ++++++++++++++++++-- 3 files changed, 107 insertions(+), 6 deletions(-) diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c index 9b0eb5b2779..1928e5ac200 100644 --- a/src/vnet/ipsec/ipsec_if.c +++ b/src/vnet/ipsec/ipsec_if.c @@ -220,6 +220,8 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, } else { + vnet_interface_main_t *vim = &vnm->interface_main; + /* check if exists */ if (!p) return VNET_API_ERROR_INVALID_VALUE; @@ -229,6 +231,13 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */ vec_add1 (im->free_tunnel_if_indices, t->hw_if_index); + vnet_interface_counter_lock (vim); + vlib_zero_combined_counter (vim->combined_sw_if_counters + + VNET_INTERFACE_COUNTER_TX, hi->sw_if_index); + vlib_zero_combined_counter (vim->combined_sw_if_counters + + VNET_INTERFACE_COUNTER_RX, hi->sw_if_index); + vnet_interface_counter_unlock (vim); + /* delete input and output SA */ sa = pool_elt_at_index (im->sad, t->input_sa_index); diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c index bd2a9f78195..861d27c1233 100644 --- a/src/vnet/ipsec/ipsec_if_in.c +++ b/src/vnet/ipsec/ipsec_if_in.c @@ -63,8 +63,16 @@ ipsec_if_input_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * from_frame) { ipsec_main_t *im = &ipsec_main; + vnet_main_t *vnm = im->vnet_main; + vnet_interface_main_t *vim = &vnm->interface_main; + esp_main_t *em = &esp_main; u32 *from, *to_next = 0, next_index; - u32 n_left_from; + u32 n_left_from, last_sw_if_index = ~0; + u32 thread_index = vlib_get_thread_index (); + u64 n_bytes = 0, n_packets = 0; + u8 icv_len; + ipsec_tunnel_if_t *last_t = NULL; + ipsec_sa_t *sa0; from = vlib_frame_vector_args (from_frame); n_left_from = from_frame->n_vectors; @@ -78,7 +86,7 @@ ipsec_if_input_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, while (n_left_from > 0 && n_left_to_next > 0) { - u32 bi0, next0; + u32 bi0, next0, sw_if_index0; vlib_buffer_t *b0; ip4_header_t *ip0; esp_header_t *esp0; @@ -105,8 +113,49 @@ ipsec_if_input_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, ipsec_tunnel_if_t *t; t = pool_elt_at_index (im->tunnel_interfaces, p[0]); vnet_buffer (b0)->ipsec.sad_index = t->input_sa_index; - vnet_buffer (b0)->ipsec.flags = - t->hw_if_index == ~0 ? IPSEC_FLAG_IPSEC_GRE_TUNNEL : 0; + if (t->hw_if_index != ~0) + { + vnet_hw_interface_t *hi; + + vnet_buffer (b0)->ipsec.flags = 0; + hi = vnet_get_hw_interface (vnm, t->hw_if_index); + sw_if_index0 = hi->sw_if_index; + + if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index)) + { + n_packets++; + n_bytes += vlib_buffer_length_in_chain (vm, b0); + } + else + { + sa0 = pool_elt_at_index (im->sad, t->input_sa_index); + icv_len = em->esp_integ_algs[sa0->integ_alg].trunc_size; + + /* length = packet length - ESP/tunnel overhead */ + n_bytes -= n_packets * (sizeof (ip4_header_t) + + sizeof (esp_header_t) + + sizeof (esp_footer_t) + + 16 /* aes-cbc IV */ + icv_len); + + if (last_t) + { + vlib_increment_combined_counter + (vim->combined_sw_if_counters + + VNET_INTERFACE_COUNTER_RX, + thread_index, sw_if_index0, n_packets, n_bytes); + } + + last_sw_if_index = sw_if_index0; + last_t = t; + n_packets = 1; + n_bytes = vlib_buffer_length_in_chain (vm, b0); + } + } + else + { + vnet_buffer (b0)->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL; + } + vlib_buffer_advance (b0, ip4_header_bytes (ip0)); next0 = im->esp_decrypt_next_index; } @@ -125,6 +174,20 @@ ipsec_if_input_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_put_next_frame (vm, node, next_index, n_left_to_next); } + if (last_t) + { + sa0 = pool_elt_at_index (im->sad, last_t->input_sa_index); + icv_len = em->esp_integ_algs[sa0->integ_alg].trunc_size; + + n_bytes -= n_packets * (sizeof (ip4_header_t) + sizeof (esp_header_t) + + sizeof (esp_footer_t) + 16 /* aes-cbc IV */ + + icv_len); + vlib_increment_combined_counter (vim->combined_sw_if_counters + + VNET_INTERFACE_COUNTER_RX, + thread_index, + last_sw_if_index, n_packets, n_bytes); + } + vlib_node_increment_counter (vm, ipsec_if_input_node.index, IPSEC_IF_INPUT_ERROR_RX, from_frame->n_vectors); diff --git a/src/vnet/ipsec/ipsec_if_out.c b/src/vnet/ipsec/ipsec_if_out.c index 62ff67ac951..cab6ff3a278 100644 --- a/src/vnet/ipsec/ipsec_if_out.c +++ b/src/vnet/ipsec/ipsec_if_out.c @@ -63,8 +63,11 @@ ipsec_if_output_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, { ipsec_main_t *im = &ipsec_main; vnet_main_t *vnm = im->vnet_main; + vnet_interface_main_t *vim = &vnm->interface_main; u32 *from, *to_next = 0, next_index; - u32 n_left_from, sw_if_index0; + u32 n_left_from, sw_if_index0, last_sw_if_index = ~0; + u32 thread_index = vlib_get_thread_index (); + u32 n_bytes = 0, n_packets = 0; from = vlib_frame_vector_args (from_frame); n_left_from = from_frame->n_vectors; @@ -78,7 +81,7 @@ ipsec_if_output_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, while (n_left_from > 0 && n_left_to_next > 0) { - u32 bi0, next0; + u32 bi0, next0, len0; vlib_buffer_t *b0; ipsec_tunnel_if_t *t0; vnet_hw_interface_t *hi0; @@ -95,6 +98,24 @@ ipsec_if_output_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, vnet_buffer (b0)->ipsec.sad_index = t0->output_sa_index; next0 = im->esp_encrypt_next_index; + len0 = vlib_buffer_length_in_chain (vm, b0); + + if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index)) + { + n_packets++; + n_bytes += len0; + } + else + { + vlib_increment_combined_counter (vim->combined_sw_if_counters + + VNET_INTERFACE_COUNTER_TX, + thread_index, sw_if_index0, + n_packets, n_bytes); + last_sw_if_index = sw_if_index0; + n_packets = 1; + n_bytes = len0; + } + if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) { ipsec_if_output_trace_t *tr = @@ -111,6 +132,14 @@ ipsec_if_output_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_put_next_frame (vm, node, next_index, n_left_to_next); } + if (last_sw_if_index != ~0) + { + vlib_increment_combined_counter (vim->combined_sw_if_counters + + VNET_INTERFACE_COUNTER_TX, + thread_index, + last_sw_if_index, n_packets, n_bytes); + } + vlib_node_increment_counter (vm, ipsec_if_output_node.index, IPSEC_IF_OUTPUT_ERROR_TX, from_frame->n_vectors); -- 2.16.6