vat_json_object_add_uint (node, "table_index", ntohl (mp->table_index));
}
-static void vl_api_ipsec_gre_add_del_tunnel_reply_t_handler
- (vl_api_ipsec_gre_add_del_tunnel_reply_t * mp)
+static void vl_api_ipsec_gre_tunnel_add_del_reply_t_handler
+ (vl_api_ipsec_gre_tunnel_add_del_reply_t * mp)
{
vat_main_t *vam = &vat_main;
i32 retval = ntohl (mp->retval);
vam->regenerate_interface_table = 1;
}
-static void vl_api_ipsec_gre_add_del_tunnel_reply_t_handler_json
- (vl_api_ipsec_gre_add_del_tunnel_reply_t * mp)
+static void vl_api_ipsec_gre_tunnel_add_del_reply_t_handler_json
+ (vl_api_ipsec_gre_tunnel_add_del_reply_t * mp)
{
vat_main_t *vam = &vat_main;
vat_json_node_t node;
ip_source_and_port_range_check_add_del_reply) \
_(IP_SOURCE_AND_PORT_RANGE_CHECK_INTERFACE_ADD_DEL_REPLY, \
ip_source_and_port_range_check_interface_add_del_reply) \
-_(IPSEC_GRE_ADD_DEL_TUNNEL_REPLY, ipsec_gre_add_del_tunnel_reply) \
+_(IPSEC_GRE_TUNNEL_ADD_DEL_REPLY, ipsec_gre_tunnel_add_del_reply) \
_(IPSEC_GRE_TUNNEL_DETAILS, ipsec_gre_tunnel_details) \
_(DELETE_SUBIF_REPLY, delete_subif_reply) \
_(L2_INTERFACE_PBB_TAG_REWRITE_REPLY, l2_interface_pbb_tag_rewrite_reply) \
}
static int
-api_ipsec_gre_add_del_tunnel (vat_main_t * vam)
+api_ipsec_gre_tunnel_add_del (vat_main_t * vam)
{
unformat_input_t *i = vam->input;
- vl_api_ipsec_gre_add_del_tunnel_t *mp;
+ vl_api_ipsec_gre_tunnel_add_del_t *mp;
u32 local_sa_id = 0;
u32 remote_sa_id = 0;
- ip4_address_t src_address;
- ip4_address_t dst_address;
+ vl_api_ip4_address_t src_address;
+ vl_api_ip4_address_t dst_address;
u8 is_add = 1;
int ret;
;
else if (unformat (i, "remote_sa %d", &remote_sa_id))
;
- else if (unformat (i, "src %U", unformat_ip4_address, &src_address))
+ else
+ if (unformat (i, "src %U", unformat_vl_api_ip4_address, &src_address))
;
- else if (unformat (i, "dst %U", unformat_ip4_address, &dst_address))
+ else
+ if (unformat (i, "dst %U", unformat_vl_api_ip4_address, &dst_address))
;
else if (unformat (i, "del"))
is_add = 0;
}
}
- M (IPSEC_GRE_ADD_DEL_TUNNEL, mp);
+ M (IPSEC_GRE_TUNNEL_ADD_DEL, mp);
- mp->local_sa_id = ntohl (local_sa_id);
- mp->remote_sa_id = ntohl (remote_sa_id);
- clib_memcpy (mp->src_address, &src_address, sizeof (src_address));
- clib_memcpy (mp->dst_address, &dst_address, sizeof (dst_address));
+ mp->tunnel.local_sa_id = ntohl (local_sa_id);
+ mp->tunnel.remote_sa_id = ntohl (remote_sa_id);
+ clib_memcpy (mp->tunnel.src, &src_address, sizeof (src_address));
+ clib_memcpy (mp->tunnel.dst, &dst_address, sizeof (dst_address));
mp->is_add = is_add;
S (mp);
vat_main_t *vam = &vat_main;
print (vam->ofp, "%11d%15U%15U%14d%14d",
- ntohl (mp->sw_if_index),
- format_ip4_address, &mp->src_address,
- format_ip4_address, &mp->dst_address,
- ntohl (mp->local_sa_id), ntohl (mp->remote_sa_id));
+ ntohl (mp->tunnel.sw_if_index),
+ format_vl_api_ip4_address, mp->tunnel.src,
+ format_vl_api_ip4_address, mp->tunnel.dst,
+ ntohl (mp->tunnel.local_sa_id), ntohl (mp->tunnel.remote_sa_id));
+}
+
+static void
+vat_json_object_add_vl_api_ip4 (vat_json_node_t * node,
+ const char *name,
+ const vl_api_ip4_address_t addr)
+{
+ struct in_addr ip4;
+
+ clib_memcpy (&ip4, addr, sizeof (ip4));
+ vat_json_object_add_ip4 (node, name, ip4);
}
static void vl_api_ipsec_gre_tunnel_details_t_handler_json
node = vat_json_array_add (&vam->json_tree);
vat_json_init_object (node);
- vat_json_object_add_uint (node, "sw_if_index", ntohl (mp->sw_if_index));
- clib_memcpy (&ip4, &mp->src_address, sizeof (ip4));
- vat_json_object_add_ip4 (node, "src_address", ip4);
- clib_memcpy (&ip4, &mp->dst_address, sizeof (ip4));
- vat_json_object_add_ip4 (node, "dst_address", ip4);
- vat_json_object_add_uint (node, "local_sa_id", ntohl (mp->local_sa_id));
- vat_json_object_add_uint (node, "remote_sa_id", ntohl (mp->remote_sa_id));
+ vat_json_object_add_uint (node, "sw_if_index",
+ ntohl (mp->tunnel.sw_if_index));
+ vat_json_object_add_vl_api_ip4 (node, "src", mp->tunnel.src);
+ vat_json_object_add_vl_api_ip4 (node, "src", mp->tunnel.dst);
+ vat_json_object_add_uint (node, "local_sa_id",
+ ntohl (mp->tunnel.local_sa_id));
+ vat_json_object_add_uint (node, "remote_sa_id",
+ ntohl (mp->tunnel.remote_sa_id));
}
static int
_(ip_source_and_port_range_check_interface_add_del, \
"<intf> | sw_if_index <nn> [tcp-out-vrf <id>] [tcp-in-vrf <id>]" \
"[udp-in-vrf <id>] [udp-out-vrf <id>]") \
-_(ipsec_gre_add_del_tunnel, \
+_(ipsec_gre_tunnel_add_del, \
"src <addr> dst <addr> local_sa <sa-id> remote_sa <sa-id> [del]") \
_(ipsec_gre_tunnel_dump, "[sw_if_index <nn>]") \
_(delete_subif,"<intfc> | sw_if_index <nn>") \
/* interface output features */
struct
{
- u32 flags;
u32 sad_index;
} ipsec;
s = format (s, "policer.index: %d", o->policer.index);
vec_add1 (s, '\n');
- s = format (s,
- "ipsec.flags: 0x%x, ipsec.sad_index: %d",
- o->ipsec.flags, o->ipsec.sad_index);
+ s = format (s, "ipsec.sad_index: %d", o->ipsec.sad_index);
vec_add1 (s, '\n');
s = format (s, "map.mtu: %d", (u32) (o->map.mtu));
/**
* @brief Add or delete ipsec-gre tunnel interface.
*
- * @param *a vnet_ipsec_gre_add_del_tunnel_args_t - tunnel interface parameters
+ * @param *a vnet_ipsec_gre_tunnel_add_del_args_t - tunnel interface parameters
* @param *sw_if_indexp u32 - software interface index
* @return int - 0 if success otherwise <code>VNET_API_ERROR_</code>
*/
int
-vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a,
+vnet_ipsec_gre_tunnel_add_del (const ipsec_gre_tunnel_add_del_args_t * a,
u32 * sw_if_indexp)
{
ipsec_gre_main_t *igm = &ipsec_gre_main;
vnet_main_t *vnm = igm->vnet_main;
- ip4_main_t *im = &ip4_main;
+ ipsec_main_t *im = &ipsec_main;
ipsec_gre_tunnel_t *t;
vnet_hw_interface_t *hi;
u32 hw_if_index, sw_if_index;
u32 slot;
uword *p;
u64 key;
- ipsec_add_del_ipsec_gre_tunnel_args_t args;
-
- clib_memset (&args, 0, sizeof (args));
- args.is_add = a->is_add;
- args.local_sa_id = a->lsa;
- args.remote_sa_id = a->rsa;
- args.local_ip.as_u32 = a->src.as_u32;
- args.remote_ip.as_u32 = a->dst.as_u32;
key = (u64) a->src.as_u32 << 32 | (u64) a->dst.as_u32;
p = hash_get (igm->tunnel_by_key, key);
t->hw_if_index = hw_if_index;
t->sw_if_index = sw_if_index;
- t->local_sa_id = a->lsa;
- t->remote_sa_id = a->rsa;
- t->local_sa = ipsec_get_sa_index_by_sa_id (a->lsa);
- t->remote_sa = ipsec_get_sa_index_by_sa_id (a->rsa);
+ t->local_sa_id = a->local_sa_id;
+ t->remote_sa_id = a->remote_sa_id;
+ t->local_sa = ipsec_get_sa_index_by_sa_id (t->local_sa_id);
+ t->remote_sa = ipsec_get_sa_index_by_sa_id (t->remote_sa_id);
ip4_sw_interface_enable_disable (sw_if_index, 1);
sw_if_index, ~0);
igm->tunnel_index_by_sw_if_index[sw_if_index] = t - igm->tunnels;
- vec_validate (im->fib_index_by_sw_if_index, sw_if_index);
-
hi->min_packet_bytes = 64 + sizeof (gre_header_t) +
sizeof (ip4_header_t) + sizeof (esp_header_t) + sizeof (esp_footer_t);
hash_set (igm->tunnel_by_key, key, t - igm->tunnels);
- slot = vlib_node_add_named_next_with_slot
- (vnm->vlib_main, hi->tx_node_index, "esp4-encrypt",
+ slot = vlib_node_add_next_with_slot
+ (vnm->vlib_main, hi->tx_node_index, im->esp4_encrypt_node_index,
IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT);
ASSERT (slot == IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT);
-
}
else
{ /* !is_add => delete */
if (sw_if_indexp)
*sw_if_indexp = sw_if_index;
- return ipsec_add_del_ipsec_gre_tunnel (vnm, &args);
+ return ipsec_add_del_ipsec_gre_tunnel (vnm, a);
}
static clib_error_t *
vlib_cli_command_t * cmd)
{
unformat_input_t _line_input, *line_input = &_line_input;
- u8 is_add = 1;
u32 num_m_args = 0;
- ip4_address_t src, dst;
- u32 lsa = 0, rsa = 0;
- vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a;
+ ipsec_gre_tunnel_add_del_args_t _a, *a = &_a;
int rv;
u32 sw_if_index;
clib_error_t *error = NULL;
+ clib_memset (a, 0, sizeof (*a));
+ a->is_add = 1;
+
/* Get a line of input. */
if (!unformat_user (input, unformat_line_input, line_input))
return 0;
while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
{
if (unformat (line_input, "del"))
- is_add = 0;
- else if (unformat (line_input, "src %U", unformat_ip4_address, &src))
+ a->is_add = 0;
+ else if (unformat (line_input, "src %U", unformat_ip4_address, &a->src))
num_m_args++;
- else if (unformat (line_input, "dst %U", unformat_ip4_address, &dst))
+ else if (unformat (line_input, "dst %U", unformat_ip4_address, &a->dst))
num_m_args++;
- else if (unformat (line_input, "local-sa %d", &lsa))
+ else if (unformat (line_input, "local-sa %d", &a->local_sa_id))
num_m_args++;
- else if (unformat (line_input, "remote-sa %d", &rsa))
+ else if (unformat (line_input, "remote-sa %d", &a->remote_sa_id))
num_m_args++;
else
{
goto done;
}
- if (memcmp (&src, &dst, sizeof (src)) == 0)
+ if (memcmp (&a->src, &a->dst, sizeof (a->src)) == 0)
{
error = clib_error_return (0, "src and dst are identical");
goto done;
}
- clib_memset (a, 0, sizeof (*a));
- a->is_add = is_add;
- a->lsa = lsa;
- a->rsa = rsa;
- clib_memcpy (&a->src, &src, sizeof (src));
- clib_memcpy (&a->dst, &dst, sizeof (dst));
-
- rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index);
+ rv = vnet_ipsec_gre_tunnel_add_del (a, &sw_if_index);
switch (rv)
{
goto done;
default:
error = clib_error_return (0,
- "vnet_ipsec_gre_add_del_tunnel returned %d",
+ "vnet_ipsec_gre_tunnel_add_del returned %d",
rv);
goto done;
}
* limitations under the License.
*/
-option version = "1.0.0";
+option version = "1.1.0";
+
+import "vnet/ip/ip_types.api";
/** \brief Add / del ipsec gre tunnel request
@param client_index - opaque cookie to identify the sender
@param context - sender context, to match reply w/ request
- @param local_sa_id - local SA id
- @param remote_sa_id - remote SA id
+ @param local_sa_id - local/output SA id
+ @param remote_sa_id - remote/input SA id
@param is_add - 1 if adding the tunnel, 0 if deleting
- @param src_address - tunnel source address
- @param dst_address - tunnel destination address
+ @param sw_if_index - software index of the ipsec gre tunnel
+ ignored on create. set in dump/details
+ @param src - tunnel source address
+ @param dst - tunnel destination address
*/
-define ipsec_gre_add_del_tunnel {
+typedef ipsec_gre_tunnel {
u32 client_index;
u32 context;
u32 local_sa_id;
u32 remote_sa_id;
u8 is_add;
- u8 src_address[4];
- u8 dst_address[4];
+ u32 sw_if_index;
+ vl_api_ip4_address_t src;
+ vl_api_ip4_address_t dst;
+};
+
+define ipsec_gre_tunnel_add_del {
+ u32 client_index;
+ u32 context;
+ u8 is_add;
+ vl_api_ipsec_gre_tunnel_t tunnel;
};
/** \brief Reply for add / del ipsec gre tunnel request
@param retval - return code
@param sw_if_index - software index of the new ipsec gre tunnel
*/
-define ipsec_gre_add_del_tunnel_reply {
+define ipsec_gre_tunnel_add_del_reply {
u32 context;
i32 retval;
u32 sw_if_index;
/** \brief ipsec gre tunnel operational state response
@param context - returned sender context, to match reply w/ request
- @param sw_if_index - software index of the ipsec gre tunnel
@param local_sa_id - local SA id
@param remote_sa_id - remote SA id
@param src_address - tunnel source address
*/
define ipsec_gre_tunnel_details {
u32 context;
- u32 sw_if_index;
- u32 local_sa_id;
- u32 remote_sa_id;
- u8 src_address[4];
- u8 dst_address[4];
+ vl_api_ipsec_gre_tunnel_t tunnel;
};
/*
vnet_interface_output_runtime_t *rd = (void *) node->runtime_data;
ipsec_gre_tunnel_t *t = pool_elt_at_index (igm->tunnels, rd->dev_instance);
- /* use an ethertype of 0x01 for l2-gre */
- u16 l2_gre_protocol_ethertype = clib_net_to_host_u16 (0x01);
+ u16 l2_gre_protocol_ethertype = clib_net_to_host_u16 (GRE_PROTOCOL_teb);
/* Vector of buffer / pkt indices we're supposed to process */
from = vlib_frame_vector_args (frame);
#include <vnet/ip/ip4_packet.h>
#include <vnet/pg/pg.h>
#include <vnet/ip/format.h>
+#include <vnet/ipsec/ipsec.h>
+#include <vnet/ipsec/ipsec_if.h>
extern vnet_hw_interface_class_t ipsec_gre_hw_interface_class;
extern vnet_device_class_t ipsec_gre_device_class;
/* manually added to the interface output node in ipsec_gre.c */
-#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT 1
+#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT 0
-/**
- * @brief IPSec-GRE tunnel add/del arguments.
- *
-*/
-typedef struct
-{
- u8 is_add; /**< 1 - add, 0 - delete */
-
- ip4_address_t src; /**< tunnel IPv4 src address */
- ip4_address_t dst; /**< tunnel IPv4 dst address */
- u32 lsa; /**< local IPSec SA id */
- u32 rsa; /**< remote IPSec SA id */
-} vnet_ipsec_gre_add_del_tunnel_args_t;
-
-int vnet_ipsec_gre_add_del_tunnel
- (vnet_ipsec_gre_add_del_tunnel_args_t * a, u32 * sw_if_indexp);
+extern int vnet_ipsec_gre_tunnel_add_del (const
+ ipsec_gre_tunnel_add_del_args_t * a,
+ u32 * sw_if_indexp);
#endif /* included_ipsec_gre_h */
#include <vnet/interface.h>
#include <vnet/api_errno.h>
#include <vnet/ipsec-gre/ipsec_gre.h>
+#include <vnet/ip/ip_types_api.h>
#include <vnet/vnet_msg_enum.h>
#include <vlibapi/api_helper_macros.h>
#define foreach_vpe_api_msg \
-_(IPSEC_GRE_ADD_DEL_TUNNEL, ipsec_gre_add_del_tunnel) \
+_(IPSEC_GRE_TUNNEL_ADD_DEL, ipsec_gre_tunnel_add_del) \
_(IPSEC_GRE_TUNNEL_DUMP, ipsec_gre_tunnel_dump)
static void
-vl_api_ipsec_gre_add_del_tunnel_t_handler (vl_api_ipsec_gre_add_del_tunnel_t *
+vl_api_ipsec_gre_tunnel_add_del_t_handler (vl_api_ipsec_gre_tunnel_add_del_t *
mp)
{
- vl_api_ipsec_gre_add_del_tunnel_reply_t *rmp;
+ vl_api_ipsec_gre_tunnel_add_del_reply_t *rmp;
int rv = 0;
- vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a;
+ ipsec_gre_tunnel_add_del_args_t _a, *a = &_a;
u32 sw_if_index = ~0;
+ clib_memset (a, 0, sizeof (*a));
+
+ ip4_address_decode (mp->tunnel.src, &a->src);
+ ip4_address_decode (mp->tunnel.dst, &a->dst);
+
/* Check src & dst are different */
- if (memcmp (mp->src_address, mp->dst_address, 4) == 0)
+ if (a->src.as_u32 == a->dst.as_u32)
{
rv = VNET_API_ERROR_SAME_SRC_DST;
goto out;
}
- clib_memset (a, 0, sizeof (*a));
-
- /* ip addresses sent in network byte order */
- clib_memcpy (&(a->src), mp->src_address, 4);
- clib_memcpy (&(a->dst), mp->dst_address, 4);
a->is_add = mp->is_add;
- a->lsa = ntohl (mp->local_sa_id);
- a->rsa = ntohl (mp->remote_sa_id);
+ a->local_sa_id = ntohl (mp->tunnel.local_sa_id);
+ a->remote_sa_id = ntohl (mp->tunnel.remote_sa_id);
- rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index);
+ rv = vnet_ipsec_gre_tunnel_add_del (a, &sw_if_index);
out:
- /* *INDENT-OFF* */
- REPLY_MACRO2(VL_API_GRE_ADD_DEL_TUNNEL_REPLY,
- ({
- rmp->sw_if_index = ntohl (sw_if_index);
- }));
- /* *INDENT-ON* */
+ /* *INDENT-OFF* */
+ REPLY_MACRO2(VL_API_GRE_ADD_DEL_TUNNEL_REPLY,
+ ({
+ rmp->sw_if_index = ntohl (sw_if_index);
+ }));
+ /* *INDENT-ON* */
}
static void send_ipsec_gre_tunnel_details
rmp = vl_msg_api_alloc (sizeof (*rmp));
clib_memset (rmp, 0, sizeof (*rmp));
rmp->_vl_msg_id = ntohs (VL_API_IPSEC_GRE_TUNNEL_DETAILS);
- clib_memcpy (rmp->src_address, &(t->tunnel_src), 4);
- clib_memcpy (rmp->dst_address, &(t->tunnel_dst), 4);
- rmp->sw_if_index = htonl (t->sw_if_index);
- rmp->local_sa_id = htonl (t->local_sa_id);
- rmp->remote_sa_id = htonl (t->remote_sa_id);
+
+ ip4_address_encode (&t->tunnel_src, rmp->tunnel.src);
+ ip4_address_encode (&t->tunnel_dst, rmp->tunnel.dst);
+ rmp->tunnel.sw_if_index = htonl (t->sw_if_index);
+ rmp->tunnel.local_sa_id = htonl (t->local_sa_id);
+ rmp->tunnel.remote_sa_id = htonl (t->remote_sa_id);
rmp->context = context;
vl_api_send_msg (reg, (u8 *) rmp);
protocol0 = clib_net_to_host_u16 (h0->protocol);
protocol1 = clib_net_to_host_u16 (h1->protocol);
- if (PREDICT_TRUE(protocol0 == 0x0001))
+ if (PREDICT_TRUE(protocol0 == GRE_PROTOCOL_teb))
{
next0 = IPSEC_GRE_INPUT_NEXT_L2_INPUT;
b0->error = node->errors[IPSEC_GRE_ERROR_NONE];
b0->error = node->errors[IPSEC_GRE_ERROR_UNKNOWN_PROTOCOL];
next0 = IPSEC_GRE_INPUT_NEXT_DROP;
}
- if (PREDICT_TRUE(protocol1 == 0x0001))
+ if (PREDICT_TRUE(protocol1 == GRE_PROTOCOL_teb))
{
next1 = IPSEC_GRE_INPUT_NEXT_L2_INPUT;
b1->error = node->errors[IPSEC_GRE_ERROR_NONE];
h0 = vlib_buffer_get_current (b0);
protocol0 = clib_net_to_host_u16 (h0->protocol);
- if (PREDICT_TRUE(protocol0 == 0x0001))
+ if (PREDICT_TRUE(protocol0 == GRE_PROTOCOL_teb))
{
next0 = IPSEC_GRE_INPUT_NEXT_L2_INPUT;
b0->error = node->errors[IPSEC_GRE_ERROR_NONE];
next0 = verr0 ? IPSEC_GRE_INPUT_NEXT_DROP : next0;
/* For L2 payload set input sw_if_index to GRE tunnel for learning */
- if (PREDICT_FALSE(next0 == IPSEC_GRE_INPUT_NEXT_L2_INPUT))
+ if (PREDICT_TRUE(next0 == IPSEC_GRE_INPUT_NEXT_L2_INPUT))
{
u64 key = ((u64)(tun_dst0) << 32) | (u64)(tun_src0);
}
/* for IPSec-GRE tunnel next node is ipsec-gre-input */
- if (PREDICT_FALSE
- ((vnet_buffer (i_b0)->ipsec.flags) &
- IPSEC_FLAG_IPSEC_GRE_TUNNEL))
+ if (PREDICT_FALSE (ipsec_sa_is_set_IS_GRE (sa0)))
next0 = AH_DECRYPT_NEXT_IPSEC_GRE_INPUT;
-
vnet_buffer (i_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
trace:
if (PREDICT_FALSE (i_b0->flags & VLIB_BUFFER_IS_TRACED))
}
}
- if (vnet_buffer (b[0])->ipsec.flags & IPSEC_FLAG_IPSEC_GRE_TUNNEL)
+ if (PREDICT_FALSE (ipsec_sa_is_set_IS_GRE (sa0)))
next[0] = ESP_DECRYPT_NEXT_IPSEC_GRE_INPUT;
trace:
ipsec_sa_flags_t flags = IPSEC_SA_FLAG_NONE;
in = clib_net_to_host_u32 (in);
-#define _(v,f,s) if (in & IPSEC_API_SAD_FLAG_##f) \
- flags |= IPSEC_SA_FLAG_##f;
- foreach_ipsec_sa_flags
-#undef _
- return (flags);
+ if (in & IPSEC_API_SAD_FLAG_USE_ESN)
+ flags |= IPSEC_SA_FLAG_USE_ESN;
+ if (in & IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
+ flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
+ if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL)
+ flags |= IPSEC_SA_FLAG_IS_TUNNEL;
+ if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL_V6)
+ flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
+ if (in & IPSEC_API_SAD_FLAG_UDP_ENCAP)
+ flags |= IPSEC_SA_FLAG_UDP_ENCAP;
+
+ return (flags);
}
static vl_api_ipsec_sad_flags_t
return 1;
}
+u8 *
+format_ipsec_sa_flags (u8 * s, va_list * args)
+{
+ ipsec_sa_flags_t flags = va_arg (*args, int);
+
+ if (0)
+ ;
+#define _(v, f, str) else if (flags & IPSEC_SA_FLAG_##f) s = format(s, "%s ", str);
+ foreach_ipsec_sa_flags
+#undef _
+ return (s);
+}
+
u8 *
format_ipsec_sa (u8 * s, va_list * args)
{
sa = pool_elt_at_index (im->sad, sai);
- s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s%s%s%s",
+ s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s %U",
sai, sa->id, sa->spi,
ipsec_sa_is_set_IS_TUNNEL (sa) ? "tunnel" : "transport",
ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? "-ip6" : "",
- sa->protocol ? "esp" : "ah",
- ipsec_sa_is_set_UDP_ENCAP (sa) ? " udp-encap-enabled" : "",
- ipsec_sa_is_set_USE_ANTI_REPLAY (sa) ? " anti-replay" : "",
- ipsec_sa_is_set_USE_ESN (sa) ?
- " extended-sequence-number" : "");
+ sa->protocol ? "esp" : "ah", format_ipsec_sa_flags, sa->flags);
s = format (s, "\n seq %u seq-hi %u", sa->seq, sa->seq_hi);
s = format (s, "\n last-seq %u last-seq-hi %u window %U",
sa->last_seq, sa->last_seq_hi,
int
ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm,
- ipsec_add_del_ipsec_gre_tunnel_args_t * args)
+ const ipsec_gre_tunnel_add_del_args_t * args)
{
ipsec_tunnel_if_t *t = 0;
ipsec_main_t *im = &ipsec_main;
p = hash_get (im->sa_index_by_sa_id, args->local_sa_id);
if (!p)
return VNET_API_ERROR_INVALID_VALUE;
- isa = p[0];
+ osa = p[0];
+ sa = pool_elt_at_index (im->sad, p[0]);
+ ipsec_sa_set_IS_GRE (sa);
p = hash_get (im->sa_index_by_sa_id, args->remote_sa_id);
if (!p)
return VNET_API_ERROR_INVALID_VALUE;
- osa = p[0];
+ isa = p[0];
sa = pool_elt_at_index (im->sad, p[0]);
+ ipsec_sa_set_IS_GRE (sa);
+ /* we form the key from the input/remote SA whose tunnel is srouce
+ * at the remote end */
if (ipsec_sa_is_set_IS_TUNNEL (sa))
{
- key.remote_ip = sa->tunnel_dst_addr.ip4.as_u32;
+ key.remote_ip = sa->tunnel_src_addr.ip4.as_u32;
key.spi = clib_host_to_net_u32 (sa->spi);
}
else
{
- key.remote_ip = args->remote_ip.as_u32;
+ key.remote_ip = args->src.as_u32;
key.spi = clib_host_to_net_u32 (sa->spi);
}
u8 is_add;
u32 local_sa_id;
u32 remote_sa_id;
- ip4_address_t local_ip;
- ip4_address_t remote_ip;
-} ipsec_add_del_ipsec_gre_tunnel_args_t;
+ ip4_address_t src;
+ ip4_address_t dst;
+} ipsec_gre_tunnel_add_del_args_t;
extern int ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
ipsec_add_del_tunnel_args_t *
args, u32 * sw_if_index);
extern int ipsec_add_del_tunnel_if (ipsec_add_del_tunnel_args_t * args);
extern int ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm,
- ipsec_add_del_ipsec_gre_tunnel_args_t
- * args);
+ const
+ ipsec_gre_tunnel_add_del_args_t *
+ args);
extern int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index,
ipsec_if_set_key_type_t type,
}
else
{
+ b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
n_no_tunnel++;
next[0] = IPSEC_INPUT_NEXT_DROP;
goto pkt1;
}
else
{
+ b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
n_no_tunnel++;
next[0] = IPSEC_INPUT_NEXT_DROP;
goto pkt1;
if (PREDICT_TRUE (t0->hw_if_index != ~0))
{
- vnet_buffer (b[0])->ipsec.flags = 0;
sw_if_index0 = t0->sw_if_index;
vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0;
vlib_increment_combined_counter
(drop_counter, thread_index, sw_if_index0, 1, len0);
n_disabled++;
+ b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
next[0] = IPSEC_INPUT_NEXT_DROP;
goto pkt1;
}
n_bytes = len0;
}
}
- else
- {
- vnet_buffer (b[0])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
- }
pkt1:
if (is_ip6)
}
else
{
+ b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
n_no_tunnel++;
next[1] = IPSEC_INPUT_NEXT_DROP;
goto trace1;
}
else
{
+ b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
n_no_tunnel++;
next[1] = IPSEC_INPUT_NEXT_DROP;
goto trace1;
if (PREDICT_TRUE (t1->hw_if_index != ~0))
{
- vnet_buffer (b[1])->ipsec.flags = 0;
sw_if_index1 = t1->sw_if_index;
vnet_buffer (b[1])->sw_if_index[VLIB_RX] = sw_if_index1;
vlib_increment_combined_counter
(drop_counter, thread_index, sw_if_index1, 1, len1);
n_disabled++;
+ b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
next[1] = IPSEC_INPUT_NEXT_DROP;
goto trace1;
}
n_bytes = len1;
}
}
- else
- {
- vnet_buffer (b[1])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
- }
trace1:
if (PREDICT_FALSE (is_trace))
}
else
{
+ b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
n_no_tunnel++;
next[0] = IPSEC_INPUT_NEXT_DROP;
goto trace00;
}
else
{
+ b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
n_no_tunnel++;
next[0] = IPSEC_INPUT_NEXT_DROP;
goto trace00;
if (PREDICT_TRUE (t0->hw_if_index != ~0))
{
- vnet_buffer (b[0])->ipsec.flags = 0;
sw_if_index0 = t0->sw_if_index;
vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0;
vlib_increment_combined_counter
(drop_counter, thread_index, sw_if_index0, 1, len0);
n_disabled++;
+ b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
next[0] = IPSEC_INPUT_NEXT_DROP;
goto trace00;
}
n_bytes = len0;
}
}
- else
- {
- vnet_buffer (b[0])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
- }
trace00:
if (PREDICT_FALSE (is_trace))
vlib_node_increment_counter (vm, node->node_index,
IPSEC_IF_INPUT_ERROR_RX,
- from_frame->n_vectors - n_disabled);
- vlib_node_increment_counter (vm, node->node_index,
- IPSEC_IF_INPUT_ERROR_DISABLED, n_disabled);
- vlib_node_increment_counter (vm, node->node_index,
- IPSEC_IF_INPUT_ERROR_NO_TUNNEL, n_no_tunnel);
+ from_frame->n_vectors - (n_disabled +
+ n_no_tunnel));
vlib_buffer_enqueue_to_next (vm, node, from, nexts, from_frame->n_vectors);
clib_net_to_host_u16 (ip0->length));
vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
- vnet_buffer (b0)->ipsec.flags = 0;
next0 = im->esp4_decrypt_next_index;
vlib_buffer_advance (b0, ((u8 *) esp0 - (u8 *) ip0));
goto trace0;
clib_net_to_host_u16 (ip0->length));
vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
- vnet_buffer (b0)->ipsec.flags = 0;
next0 = im->ah4_decrypt_next_index;
goto trace1;
}
header_size);
vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
- vnet_buffer (b0)->ipsec.flags = 0;
next0 = im->esp6_decrypt_next_index;
vlib_buffer_advance (b0, header_size);
goto trace0;
header_size);
vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
- vnet_buffer (b0)->ipsec.flags = 0;
next0 = im->ah6_decrypt_next_index;
goto trace0;
}
#ifndef __IPSEC_IO_H__
#define __IPSEC_IO_H__
-#define IPSEC_FLAG_IPSEC_GRE_TUNNEL (1 << 0)
-
#define foreach_ipsec_output_next \
_ (DROP, "error-drop")
_ (4, IS_TUNNEL, "tunnel") \
_ (8, IS_TUNNEL_V6, "tunnel-v6") \
_ (16, UDP_ENCAP, "udp-encap") \
+ _ (32, IS_GRE, "GRE") \
typedef enum ipsec_sad_flags_t_
{
FINISH;
}
-static void *vl_api_ipsec_gre_add_del_tunnel_t_print
- (vl_api_ipsec_gre_add_del_tunnel_t * mp, void *handle)
+static void *vl_api_ipsec_gre_tunnel_add_del_t_print
+ (vl_api_ipsec_gre_tunnel_add_del_t * mp, void *handle)
{
u8 *s;
- s = format (0, "SCRIPT: ipsec_gre_add_del_tunnel ");
+ s = format (0, "SCRIPT: ipsec_gre_tunnel_add_del ");
- s = format (s, "dst %U ", format_ip4_address,
- (ip4_address_t *) & (mp->dst_address));
+ s = format (s, "dst %U ", format_vl_api_ip4_address, mp->tunnel.dst);
- s = format (s, "src %U ", format_ip4_address,
- (ip4_address_t *) & (mp->src_address));
+ s = format (s, "src %U ", format_vl_api_ip4_address, mp->tunnel.src);
- s = format (s, "local_sa %d ", ntohl (mp->local_sa_id));
+ s = format (s, "local_sa %d ", ntohl (mp->tunnel.local_sa_id));
- s = format (s, "remote_sa %d ", ntohl (mp->remote_sa_id));
+ s = format (s, "remote_sa %d ", ntohl (mp->tunnel.remote_sa_id));
if (mp->is_add == 0)
s = format (s, "del ");
_(SHOW_LISP_MAP_REGISTER_STATE, show_lisp_map_register_state) \
_(LISP_RLOC_PROBE_ENABLE_DISABLE, lisp_rloc_probe_enable_disable) \
_(LISP_MAP_REGISTER_ENABLE_DISABLE, lisp_map_register_enable_disable) \
-_(IPSEC_GRE_ADD_DEL_TUNNEL, ipsec_gre_add_del_tunnel) \
+_(IPSEC_GRE_TUNNEL_ADD_DEL, ipsec_gre_tunnel_add_del) \
_(IPSEC_GRE_TUNNEL_DUMP, ipsec_gre_tunnel_dump) \
_(DELETE_SUBIF, delete_subif) \
_(L2_INTERFACE_PBB_TAG_REWRITE, l2_interface_pbb_tag_rewrite) \
Code Review / vpp.git / commitdiff