while (n_left_from >= 8 && n_left_to_next > 4)
{
+ const ip_adjacency_t *adj0, *adj1, *adj2, *adj3;
+ const dpo_id_t *dpo0, *dpo1, *dpo2, *dpo3;
+ vlib_buffer_t * b0, *b1, *b2, *b3;
u32 bi0, adj_index0, next0;
- const ip_adjacency_t * adj0;
- const dpo_id_t *dpo0;
- vlib_buffer_t * b0;
u32 bi1, adj_index1, next1;
- const ip_adjacency_t * adj1;
- const dpo_id_t *dpo1;
- vlib_buffer_t * b1;
u32 bi2, adj_index2, next2;
- const ip_adjacency_t * adj2;
- const dpo_id_t *dpo2;
- vlib_buffer_t * b2;
u32 bi3, adj_index3, next3;
- const ip_adjacency_t * adj3;
- const dpo_id_t *dpo3;
- vlib_buffer_t * b3;
/* Prefetch next iteration. */
{
(adj->lookup_next_index == IP_LOOKUP_NEXT_GLEAN) ||
(adj->lookup_next_index == IP_LOOKUP_NEXT_BCAST));
- /*
- * tunnels can always provide a rewrite.
- */
- ASSERT(NULL != rewrite);
-
adj_midchain_setup(adj_index, fixup, fixup_data, flags);
/*
ip_adjacency_t * adj = adj_get(index);
s = format (s, "%U", format_vnet_link, adj->ia_link);
+ if (adj->rewrite_header.flags & VNET_REWRITE_HAS_FEATURES)
+ s = format(s, " [features]");
s = format (s, " via %U",
format_ip46_address, &adj->sub_type.nbr.next_hop,
adj_proto_to_46(adj->ia_nh_proto));
--- /dev/null
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * interface_output.c: interface output node
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __INTERFACE_INLINES_H__
+#define __INTERFACE_INLINES_H__
+
+#include <vnet/vnet.h>
+
+static_always_inline void
+calc_checksums (vlib_main_t * vm, vlib_buffer_t * b)
+{
+ ip4_header_t *ip4;
+ ip6_header_t *ip6;
+ tcp_header_t *th;
+ udp_header_t *uh;
+
+ int is_ip4 = (b->flags & VNET_BUFFER_F_IS_IP4) != 0;
+ int is_ip6 = (b->flags & VNET_BUFFER_F_IS_IP6) != 0;
+
+ ASSERT (!(is_ip4 && is_ip6));
+
+ ip4 = (ip4_header_t *) (b->data + vnet_buffer (b)->l3_hdr_offset);
+ ip6 = (ip6_header_t *) (b->data + vnet_buffer (b)->l3_hdr_offset);
+ th = (tcp_header_t *) (b->data + vnet_buffer (b)->l4_hdr_offset);
+ uh = (udp_header_t *) (b->data + vnet_buffer (b)->l4_hdr_offset);
+
+ if (is_ip4)
+ {
+ ip4 = (ip4_header_t *) (b->data + vnet_buffer (b)->l3_hdr_offset);
+ if (b->flags & VNET_BUFFER_F_OFFLOAD_IP_CKSUM)
+ ip4->checksum = ip4_header_checksum (ip4);
+ if (b->flags & VNET_BUFFER_F_OFFLOAD_TCP_CKSUM)
+ {
+ th->checksum = 0;
+ th->checksum = ip4_tcp_udp_compute_checksum (vm, b, ip4);
+ }
+ if (b->flags & VNET_BUFFER_F_OFFLOAD_UDP_CKSUM)
+ uh->checksum = ip4_tcp_udp_compute_checksum (vm, b, ip4);
+ }
+ if (is_ip6)
+ {
+ int bogus;
+ if (b->flags & VNET_BUFFER_F_OFFLOAD_TCP_CKSUM)
+ {
+ th->checksum = 0;
+ th->checksum =
+ ip6_tcp_udp_icmp_compute_checksum (vm, b, ip6, &bogus);
+ }
+ if (b->flags & VNET_BUFFER_F_OFFLOAD_UDP_CKSUM)
+ {
+ uh->checksum = 0;
+ uh->checksum =
+ ip6_tcp_udp_icmp_compute_checksum (vm, b, ip6, &bogus);
+ }
+ }
+
+ b->flags &= ~VNET_BUFFER_F_OFFLOAD_TCP_CKSUM;
+ b->flags &= ~VNET_BUFFER_F_OFFLOAD_UDP_CKSUM;
+ b->flags &= ~VNET_BUFFER_F_OFFLOAD_IP_CKSUM;
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
#include <vnet/mfib/mfib_table.h> /* for mFIB table and entry creation */
#include <vnet/ip/ip4_forward.h>
+#include <vnet/interface_output.h>
/** @brief IPv4 lookup node.
@node ip4-lookup
{
b[1]->error = error_node->errors[error1];
}
-
+ if (is_midchain)
+ {
+ calc_checksums (vm, b[0]);
+ calc_checksums (vm, b[1]);
+ }
/* Guess we are only writing on simple Ethernet header. */
vnet_rewrite_two_headers (adj0[0], adj1[0],
ip0, ip1, sizeof (ethernet_header_t));
if (is_midchain)
{
- adj0->sub_type.midchain.fixup_func
- (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
- adj1->sub_type.midchain.fixup_func
- (vm, adj1, b[1], adj1->sub_type.midchain.fixup_data);
+ if (adj0->sub_type.midchain.fixup_func)
+ adj0->sub_type.midchain.fixup_func
+ (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
+ if (adj1->sub_type.midchain.fixup_func)
+ adj1->sub_type.midchain.fixup_func
+ (vm, adj1, b[1], adj1->sub_type.midchain.fixup_data);
}
if (is_mcast)
{
b[0]->error = error_node->errors[error0];
}
-
+ if (is_midchain)
+ {
+ calc_checksums (vm, b[0]);
+ }
/* Guess we are only writing on simple Ethernet header. */
vnet_rewrite_one_header (adj0[0], ip0, sizeof (ethernet_header_t));
if (is_midchain)
{
- adj0->sub_type.midchain.fixup_func
- (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
+ if (adj0->sub_type.midchain.fixup_func)
+ adj0->sub_type.midchain.fixup_func
+ (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
}
if (is_mcast)
#include <vppinfra/bihash_template.c>
#endif
#include <vnet/ip/ip6_forward.h>
+#include <vnet/interface_output.h>
/* Flag used by IOAM code. Classifier sets it pop-hop-by-hop checks it */
#define OI_DECAP 0x80000000
p1->error = error_node->errors[error1];
}
+ if (is_midchain)
+ {
+ /* before we paint on the next header, update the L4
+ * checksums if required, since there's no offload on a tunnel */
+ calc_checksums (vm, p0);
+ calc_checksums (vm, p1);
+ }
+
/* Guess we are only writing on simple Ethernet header. */
vnet_rewrite_two_headers (adj0[0], adj1[0],
ip0, ip1, sizeof (ethernet_header_t));
if (is_midchain)
{
- adj0->sub_type.midchain.fixup_func
- (vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
- adj1->sub_type.midchain.fixup_func
- (vm, adj1, p1, adj1->sub_type.midchain.fixup_data);
+ if (adj0->sub_type.midchain.fixup_func)
+ adj0->sub_type.midchain.fixup_func
+ (vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
+ if (adj1->sub_type.midchain.fixup_func)
+ adj1->sub_type.midchain.fixup_func
+ (vm, adj1, p1, adj1->sub_type.midchain.fixup_data);
}
if (is_mcast)
{
p0->flags &= ~VNET_BUFFER_F_LOCALLY_ORIGINATED;
}
+ if (is_midchain)
+ {
+ calc_checksums (vm, p0);
+ }
+
/* Guess we are only writing on simple Ethernet header. */
vnet_rewrite_one_header (adj0[0], ip0, sizeof (ethernet_header_t));
if (is_midchain)
{
- adj0->sub_type.midchain.fixup_func
- (vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
+ if (adj0->sub_type.midchain.fixup_func)
+ adj0->sub_type.midchain.fixup_func
+ (vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
}
if (is_mcast)
{
always_inline uword
esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
- vlib_frame_t * frame, int is_ip6)
+ vlib_frame_t * frame, int is_ip6, int is_tun)
{
ipsec_main_t *im = &ipsec_main;
ipsec_per_thread_data_t *ptd = vec_elt_at_index (im->ptd, vm->thread_index);
CLIB_PREFETCH (p, CLIB_CACHE_LINE_BYTES, LOAD);
}
- if (vnet_buffer (b[0])->ipsec.sad_index != current_sa_index)
+ if (is_tun)
+ {
+ /* we are on a ipsec tunnel's feature arc */
+ u32 next0;
+ sa_index0 = *(u32 *) vnet_feature_next_with_data (&next0, b[0],
+ sizeof
+ (sa_index0));
+ next[0] = next0;
+ }
+ else
+ sa_index0 = vnet_buffer (b[0])->ipsec.sad_index;
+
+ if (sa_index0 != current_sa_index)
{
sa0 = pool_elt_at_index (im->sad, sa_index0);
current_sa_index = sa_index0;
}
dpo = sa0->dpo + IPSEC_PROTOCOL_ESP;
- next[0] = dpo->dpoi_next_node;
- vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
+ if (!is_tun)
+ {
+ next[0] = dpo->dpoi_next_node;
+ vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
+ }
}
else /* transport mode */
{
vlib_node_runtime_t * node,
vlib_frame_t * from_frame)
{
- return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
+ return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 0);
}
/* *INDENT-OFF* */
vlib_node_runtime_t * node,
vlib_frame_t * from_frame)
{
- return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
+ return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 0);
}
/* *INDENT-OFF* */
};
/* *INDENT-ON* */
+VLIB_NODE_FN (esp4_encrypt_tun_node) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * from_frame)
+{
+ return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 1);
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (esp4_encrypt_tun_node) = {
+ .name = "esp4-encrypt-tun",
+ .vector_size = sizeof (u32),
+ .format_trace = format_esp_encrypt_trace,
+ .type = VLIB_NODE_TYPE_INTERNAL,
+
+ .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
+ .error_strings = esp_encrypt_error_strings,
+};
+
+VNET_FEATURE_INIT (esp4_encrypt_tun_feat_node, static) =
+{
+ .arc_name = "ip4-output",
+ .node_name = "esp4-encrypt-tun",
+ .runs_before = VNET_FEATURES ("ip4-frag",
+ "adj-midchain-tx"),
+};
+/* *INDENT-ON* */
+
+VLIB_NODE_FN (esp6_encrypt_tun_node) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * from_frame)
+{
+ return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 1);
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (esp6_encrypt_tun_node) = {
+ .name = "esp6-encrypt-tun",
+ .vector_size = sizeof (u32),
+ .format_trace = format_esp_encrypt_trace,
+ .type = VLIB_NODE_TYPE_INTERNAL,
+
+ .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
+ .error_strings = esp_encrypt_error_strings,
+};
+
+VNET_FEATURE_INIT (esp6_encrypt_tun_feat_node, static) =
+{
+ .arc_name = "ip6-output",
+ .node_name = "esp6-encrypt-tun",
+ .runs_before = VNET_FEATURES ("ip6-frag",
+ "adj-midchain-tx"),
+};
+/* *INDENT-ON* */
+
/*
* fd.io coding-style-patch-verification: ON
*
uword *ipsec4_if_pool_index_by_key;
uword *ipsec6_if_pool_index_by_key;
uword *ipsec_if_real_dev_by_show_dev;
+ uword *ipsec_if_by_sw_if_index;
/* node indices */
u32 error_drop_node_index;
int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx);
int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx);
+
+always_inline ipsec_sa_t *
+ipsec_sa_get (u32 sa_index)
+{
+ return (pool_elt_at_index (ipsec_main.sad, sa_index));
+}
+
#endif /* __IPSEC_H__ */
/*
#include <vnet/ip/ip.h>
#include <vnet/fib/fib.h>
#include <vnet/udp/udp.h>
+#include <vnet/adj/adj_midchain.h>
#include <vnet/ipsec/ipsec.h>
#include <vnet/ipsec/esp.h>
#define foreach_ipsec_if_tx_error \
_(TX, "good packets transmitted")
-static char *ipsec_if_tx_error_strings[] = {
-#define _(sym,string) string,
- foreach_ipsec_if_tx_error
-#undef _
-};
-
-typedef enum
-{
-#define _(sym,str) IPSEC_IF_OUTPUT_ERROR_##sym,
- foreach_ipsec_if_tx_error
-#undef _
- IPSEC_IF_TX_N_ERROR,
-} ipsec_if_tx_error_t;
-
-typedef struct
-{
- u32 spi;
- u32 seq;
-} ipsec_if_tx_trace_t;
-
-u8 *
-format_ipsec_if_tx_trace (u8 * s, va_list * args)
+static void
+ipsec_if_tunnel_stack (adj_index_t ai)
{
- CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
- CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
- ipsec_if_tx_trace_t *t = va_arg (*args, ipsec_if_tx_trace_t *);
+ ipsec_main_t *ipm = &ipsec_main;
+ ipsec_tunnel_if_t *it;
+ ip_adjacency_t *adj;
+ u32 sw_if_index;
- s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq);
- return s;
-}
+ adj = adj_get (ai);
+ sw_if_index = adj->rewrite_header.sw_if_index;
-static void
-ipsec_output_trace (vlib_main_t * vm,
- vlib_node_runtime_t * node,
- vlib_frame_t * frame, const ipsec_tunnel_if_t * t0)
-{
- ipsec_main_t *im = &ipsec_main;
- u32 *from, n_left;
+ if ((vec_len (ipm->ipsec_if_by_sw_if_index) <= sw_if_index) ||
+ (~0 == ipm->ipsec_if_by_sw_if_index[sw_if_index]))
+ return;
- n_left = frame->n_vectors;
- from = vlib_frame_vector_args (frame);
+ it = pool_elt_at_index (ipm->tunnel_interfaces,
+ ipm->ipsec_if_by_sw_if_index[sw_if_index]);
- while (n_left > 0)
+ if (!vnet_hw_interface_is_link_up (vnet_get_main (), it->hw_if_index))
{
- vlib_buffer_t *b0;
+ adj_midchain_delegate_unstack (ai);
+ }
+ else
+ {
+ ipsec_sa_t *sa;
- b0 = vlib_get_buffer (vm, from[0]);
+ sa = ipsec_sa_get (it->output_sa_index);
- if (b0->flags & VLIB_BUFFER_IS_TRACED)
- {
- ipsec_if_tx_trace_t *tr =
- vlib_add_trace (vm, node, b0, sizeof (*tr));
- ipsec_sa_t *sa0 = pool_elt_at_index (im->sad, t0->output_sa_index);
- tr->spi = sa0->spi;
- tr->seq = sa0->seq;
- }
+ fib_prefix_t pfx = {
+ .fp_addr = sa->tunnel_dst_addr,
+ .fp_len = (sa->is_tunnel_ip6 ? 128 : 32),
+ .fp_proto = (sa->is_tunnel_ip6 ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4),
+ };
- from += 1;
- n_left -= 1;
+ adj_midchain_delegate_stack (ai, sa->tx_fib_index, &pfx);
}
}
-VNET_DEVICE_CLASS_TX_FN (ipsec_device_class) (vlib_main_t * vm,
- vlib_node_runtime_t * node,
- vlib_frame_t * frame)
+/**
+ * @brief Call back when restacking all adjacencies on a GRE interface
+ */
+static adj_walk_rc_t
+ipsec_if_adj_walk_cb (adj_index_t ai, void *ctx)
{
- ipsec_main_t *im = &ipsec_main;
- u32 *from, n_left;
- vnet_interface_output_runtime_t *rd = (void *) node->runtime_data;
- const ipsec_tunnel_if_t *t0;
- vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
- u16 nexts[VLIB_FRAME_SIZE];
-
- from = vlib_frame_vector_args (frame);
- t0 = pool_elt_at_index (im->tunnel_interfaces, rd->dev_instance);
- n_left = frame->n_vectors;
- b = bufs;
-
- /* All going to encrypt */
- clib_memset (nexts, 0, sizeof (nexts));
-
- if (node->flags & VLIB_NODE_FLAG_TRACE)
- ipsec_output_trace (vm, node, frame, t0);
-
- vlib_get_buffers (vm, from, bufs, n_left);
+ ipsec_if_tunnel_stack (ai);
- while (n_left >= 8)
- {
- /* Prefetch the buffer header for the N+2 loop iteration */
- vlib_prefetch_buffer_header (b[4], STORE);
- vlib_prefetch_buffer_header (b[5], STORE);
- vlib_prefetch_buffer_header (b[6], STORE);
- vlib_prefetch_buffer_header (b[7], STORE);
-
- vnet_buffer (b[0])->ipsec.sad_index = t0->output_sa_index;
- vnet_buffer (b[1])->ipsec.sad_index = t0->output_sa_index;
- vnet_buffer (b[2])->ipsec.sad_index = t0->output_sa_index;
- vnet_buffer (b[3])->ipsec.sad_index = t0->output_sa_index;
-
- n_left -= 4;
- b += 4;
- }
- while (n_left > 0)
- {
- vnet_buffer (b[0])->ipsec.sad_index = t0->output_sa_index;
-
- n_left -= 1;
- b += 1;
- }
-
- vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
-
- return frame->n_vectors;
+ return (ADJ_WALK_RC_CONTINUE);
}
+static void
+ipsec_if_tunnel_restack (ipsec_tunnel_if_t * it)
+{
+ fib_protocol_t proto;
+
+ /*
+ * walk all the adjacencies on th GRE interface and restack them
+ */
+ FOR_EACH_FIB_IP_PROTOCOL (proto)
+ {
+ adj_nbr_walk (it->sw_if_index, proto, ipsec_if_adj_walk_cb, NULL);
+ }
+}
static clib_error_t *
ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
return err;
}
- return /* no error */ 0;
+ ipsec_if_tunnel_restack (t);
+
+ return (NULL);
}
+static u8 *
+ipsec_if_build_rewrite (vnet_main_t * vnm,
+ u32 sw_if_index,
+ vnet_link_t link_type, const void *dst_address)
+{
+ return (NULL);
+}
+
+static void
+ipsec_if_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
+{
+ adj_nbr_midchain_update_rewrite
+ (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK,
+ ipsec_if_build_rewrite (vnm, sw_if_index, adj_get_link_type (ai), NULL));
+
+ ipsec_if_tunnel_stack (ai);
+}
/* *INDENT-OFF* */
VNET_DEVICE_CLASS (ipsec_device_class) =
{
.name = "IPSec",
.format_device_name = format_ipsec_name,
- .format_tx_trace = format_ipsec_if_tx_trace,
- .tx_function_n_errors = IPSEC_IF_TX_N_ERROR,
- .tx_function_error_strings = ipsec_if_tx_error_strings,
.admin_up_down_function = ipsec_admin_up_down_function,
};
/* *INDENT-ON* */
{
.name = "IPSec",
.build_rewrite = default_build_rewrite,
+ .update_adjacency = ipsec_if_update_adj,
.flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
};
/* *INDENT-ON* */
hi = vnet_get_hw_interface (vnm, hw_if_index);
- /* add esp4/6 as the next-node-index of this tx-node */
- uword slot = vlib_node_add_next_with_slot
- (vnm->vlib_main, hi->tx_node_index,
- is_ip6 ? im->esp6_encrypt_node_index : im->esp4_encrypt_node_index,
- 0);
-
- ASSERT (slot == 0);
-
t->hw_if_index = hw_if_index;
t->sw_if_index = hi->sw_if_index;
- vnet_feature_enable_disable ("interface-output",
- args->is_ip6 ? "ipsec6-if-output" :
- "ipsec4-if-output", hi->sw_if_index, 1, 0,
- 0);
+ /* Add the new tunnel to the DB of tunnels per sw_if_index ... */
+ vec_validate_init_empty (im->ipsec_if_by_sw_if_index, t->sw_if_index,
+ ~0);
+ im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance;
+
+ vnet_feature_enable_disable ("ip4-output",
+ "esp4-encrypt-tun",
+ t->sw_if_index, 1,
+ &t->output_sa_index,
+ sizeof (t->output_sa_index));
+ vnet_feature_enable_disable ("ip6-output",
+ "esp6-encrypt-tun",
+ t->sw_if_index, 1,
+ &t->output_sa_index,
+ sizeof (t->output_sa_index));
+
/*1st interface, register protocol */
if (pool_elts (im->tunnel_interfaces) == 1)
{
hi = vnet_get_hw_interface (vnm, t->hw_if_index);
vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
- vnet_feature_enable_disable ("interface-output",
- args->is_ip6 ? "ipsec6-if-output" :
- "ipsec4-if-output", hi->sw_if_index, 0, 0,
- 0);
+ vnet_feature_enable_disable ("ip4-output",
+ "esp4-encrypt-tun",
+ hi->sw_if_index, 0,
+ &t->output_sa_index,
+ sizeof (t->output_sa_index));
+ vnet_feature_enable_disable ("ip6-output",
+ "esp6-encrypt-tun",
+ hi->sw_if_index, 0,
+ &t->output_sa_index,
+ sizeof (t->output_sa_index));
vnet_delete_hw_interface (vnm, t->hw_if_index);
if (is_ip6)
hash_unset (im->ipsec4_if_pool_index_by_key, key4.as_u64);
hash_unset (im->ipsec_if_real_dev_by_show_dev, t->show_instance);
+ im->ipsec_if_by_sw_if_index[t->sw_if_index] = ~0;
pool_put (im->tunnel_interfaces, t);
tun_if.admin_up()
tun_if.config_ip4()
- VppIpRoute(self, p.remote_tun_if_host, 32,
+ VppIpRoute(self, p.remote_tun_if_host, 32,
[VppRoutePath(tun_if.remote_ip4,
0xffffffff)]).add_vpp_config()
tun_if.admin_up()
tun_if.config_ip6()
- VppIpRoute(self, p.remote_tun_if_host, 128,
+ VppIpRoute(self, p.remote_tun_if_host, 128,
[VppRoutePath(tun_if.remote_ip6,
0xffffffff,
proto=DpoProto.DPO_PROTO_IP6)],
Code Review / vpp.git / commitdiff