From e524d45eff40c773049e03ea5063216b469bbfcc Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Tue, 19 Feb 2019 15:22:46 +0000 Subject: [PATCH] IPSEC-GRE: fixes and API update to common types. Change-Id: Icdcbac7453baa837a9c0c4a2401dff4a6aa6cba0 Signed-off-by: Neale Ranns --- src/vat/api_format.c | 70 +++++++++++++++++++++++--------------- src/vnet/buffer.h | 1 - src/vnet/interface_format.c | 4 +-- src/vnet/ipsec-gre/interface.c | 62 ++++++++++++--------------------- src/vnet/ipsec-gre/ipsec_gre.api | 37 ++++++++++++-------- src/vnet/ipsec-gre/ipsec_gre.c | 3 +- src/vnet/ipsec-gre/ipsec_gre.h | 23 ++++--------- src/vnet/ipsec-gre/ipsec_gre_api.c | 50 ++++++++++++++------------- src/vnet/ipsec-gre/node.c | 8 ++--- src/vnet/ipsec/ah_decrypt.c | 5 +-- src/vnet/ipsec/esp_decrypt.c | 2 +- src/vnet/ipsec/ipsec_api.c | 17 ++++++--- src/vnet/ipsec/ipsec_format.c | 21 ++++++++---- src/vnet/ipsec/ipsec_if.c | 15 +++++--- src/vnet/ipsec/ipsec_if.h | 11 +++--- src/vnet/ipsec/ipsec_if_in.c | 31 ++++++----------- src/vnet/ipsec/ipsec_input.c | 4 --- src/vnet/ipsec/ipsec_io.h | 2 -- src/vnet/ipsec/ipsec_sa.h | 1 + src/vpp/api/custom_dump.c | 18 +++++----- 20 files changed, 189 insertions(+), 196 deletions(-) diff --git a/src/vat/api_format.c b/src/vat/api_format.c index bfc9e3cb644..bdfa8c1b56a 100644 --- a/src/vat/api_format.c +++ b/src/vat/api_format.c @@ -5030,8 +5030,8 @@ static void vl_api_policer_classify_details_t_handler_json vat_json_object_add_uint (node, "table_index", ntohl (mp->table_index)); } -static void vl_api_ipsec_gre_add_del_tunnel_reply_t_handler - (vl_api_ipsec_gre_add_del_tunnel_reply_t * mp) +static void vl_api_ipsec_gre_tunnel_add_del_reply_t_handler + (vl_api_ipsec_gre_tunnel_add_del_reply_t * mp) { vat_main_t *vam = &vat_main; i32 retval = ntohl (mp->retval); @@ -5048,8 +5048,8 @@ static void vl_api_ipsec_gre_add_del_tunnel_reply_t_handler vam->regenerate_interface_table = 1; } -static void vl_api_ipsec_gre_add_del_tunnel_reply_t_handler_json - (vl_api_ipsec_gre_add_del_tunnel_reply_t * mp) +static void vl_api_ipsec_gre_tunnel_add_del_reply_t_handler_json + (vl_api_ipsec_gre_tunnel_add_del_reply_t * mp) { vat_main_t *vam = &vat_main; vat_json_node_t node; @@ -5550,7 +5550,7 @@ _(IP_SOURCE_AND_PORT_RANGE_CHECK_ADD_DEL_REPLY, \ ip_source_and_port_range_check_add_del_reply) \ _(IP_SOURCE_AND_PORT_RANGE_CHECK_INTERFACE_ADD_DEL_REPLY, \ ip_source_and_port_range_check_interface_add_del_reply) \ -_(IPSEC_GRE_ADD_DEL_TUNNEL_REPLY, ipsec_gre_add_del_tunnel_reply) \ +_(IPSEC_GRE_TUNNEL_ADD_DEL_REPLY, ipsec_gre_tunnel_add_del_reply) \ _(IPSEC_GRE_TUNNEL_DETAILS, ipsec_gre_tunnel_details) \ _(DELETE_SUBIF_REPLY, delete_subif_reply) \ _(L2_INTERFACE_PBB_TAG_REWRITE_REPLY, l2_interface_pbb_tag_rewrite_reply) \ @@ -20346,14 +20346,14 @@ api_ip_source_and_port_range_check_interface_add_del (vat_main_t * vam) } static int -api_ipsec_gre_add_del_tunnel (vat_main_t * vam) +api_ipsec_gre_tunnel_add_del (vat_main_t * vam) { unformat_input_t *i = vam->input; - vl_api_ipsec_gre_add_del_tunnel_t *mp; + vl_api_ipsec_gre_tunnel_add_del_t *mp; u32 local_sa_id = 0; u32 remote_sa_id = 0; - ip4_address_t src_address; - ip4_address_t dst_address; + vl_api_ip4_address_t src_address; + vl_api_ip4_address_t dst_address; u8 is_add = 1; int ret; @@ -20363,9 +20363,11 @@ api_ipsec_gre_add_del_tunnel (vat_main_t * vam) ; else if (unformat (i, "remote_sa %d", &remote_sa_id)) ; - else if (unformat (i, "src %U", unformat_ip4_address, &src_address)) + else + if (unformat (i, "src %U", unformat_vl_api_ip4_address, &src_address)) ; - else if (unformat (i, "dst %U", unformat_ip4_address, &dst_address)) + else + if (unformat (i, "dst %U", unformat_vl_api_ip4_address, &dst_address)) ; else if (unformat (i, "del")) is_add = 0; @@ -20376,12 +20378,12 @@ api_ipsec_gre_add_del_tunnel (vat_main_t * vam) } } - M (IPSEC_GRE_ADD_DEL_TUNNEL, mp); + M (IPSEC_GRE_TUNNEL_ADD_DEL, mp); - mp->local_sa_id = ntohl (local_sa_id); - mp->remote_sa_id = ntohl (remote_sa_id); - clib_memcpy (mp->src_address, &src_address, sizeof (src_address)); - clib_memcpy (mp->dst_address, &dst_address, sizeof (dst_address)); + mp->tunnel.local_sa_id = ntohl (local_sa_id); + mp->tunnel.remote_sa_id = ntohl (remote_sa_id); + clib_memcpy (mp->tunnel.src, &src_address, sizeof (src_address)); + clib_memcpy (mp->tunnel.dst, &dst_address, sizeof (dst_address)); mp->is_add = is_add; S (mp); @@ -20435,10 +20437,21 @@ static void vl_api_ipsec_gre_tunnel_details_t_handler vat_main_t *vam = &vat_main; print (vam->ofp, "%11d%15U%15U%14d%14d", - ntohl (mp->sw_if_index), - format_ip4_address, &mp->src_address, - format_ip4_address, &mp->dst_address, - ntohl (mp->local_sa_id), ntohl (mp->remote_sa_id)); + ntohl (mp->tunnel.sw_if_index), + format_vl_api_ip4_address, mp->tunnel.src, + format_vl_api_ip4_address, mp->tunnel.dst, + ntohl (mp->tunnel.local_sa_id), ntohl (mp->tunnel.remote_sa_id)); +} + +static void +vat_json_object_add_vl_api_ip4 (vat_json_node_t * node, + const char *name, + const vl_api_ip4_address_t addr) +{ + struct in_addr ip4; + + clib_memcpy (&ip4, addr, sizeof (ip4)); + vat_json_object_add_ip4 (node, name, ip4); } static void vl_api_ipsec_gre_tunnel_details_t_handler_json @@ -20456,13 +20469,14 @@ static void vl_api_ipsec_gre_tunnel_details_t_handler_json node = vat_json_array_add (&vam->json_tree); vat_json_init_object (node); - vat_json_object_add_uint (node, "sw_if_index", ntohl (mp->sw_if_index)); - clib_memcpy (&ip4, &mp->src_address, sizeof (ip4)); - vat_json_object_add_ip4 (node, "src_address", ip4); - clib_memcpy (&ip4, &mp->dst_address, sizeof (ip4)); - vat_json_object_add_ip4 (node, "dst_address", ip4); - vat_json_object_add_uint (node, "local_sa_id", ntohl (mp->local_sa_id)); - vat_json_object_add_uint (node, "remote_sa_id", ntohl (mp->remote_sa_id)); + vat_json_object_add_uint (node, "sw_if_index", + ntohl (mp->tunnel.sw_if_index)); + vat_json_object_add_vl_api_ip4 (node, "src", mp->tunnel.src); + vat_json_object_add_vl_api_ip4 (node, "src", mp->tunnel.dst); + vat_json_object_add_uint (node, "local_sa_id", + ntohl (mp->tunnel.local_sa_id)); + vat_json_object_add_uint (node, "remote_sa_id", + ntohl (mp->tunnel.remote_sa_id)); } static int @@ -22657,7 +22671,7 @@ _(ip_source_and_port_range_check_add_del, \ _(ip_source_and_port_range_check_interface_add_del, \ " | sw_if_index [tcp-out-vrf ] [tcp-in-vrf ]" \ "[udp-in-vrf ] [udp-out-vrf ]") \ -_(ipsec_gre_add_del_tunnel, \ +_(ipsec_gre_tunnel_add_del, \ "src dst local_sa remote_sa [del]") \ _(ipsec_gre_tunnel_dump, "[sw_if_index ]") \ _(delete_subif," | sw_if_index ") \ diff --git a/src/vnet/buffer.h b/src/vnet/buffer.h index c9b99c9a231..2144ed3a9df 100644 --- a/src/vnet/buffer.h +++ b/src/vnet/buffer.h @@ -274,7 +274,6 @@ typedef struct /* interface output features */ struct { - u32 flags; u32 sad_index; } ipsec; diff --git a/src/vnet/interface_format.c b/src/vnet/interface_format.c index 2cc10f9b057..ee332f398e9 100644 --- a/src/vnet/interface_format.c +++ b/src/vnet/interface_format.c @@ -486,9 +486,7 @@ format_vnet_buffer_opaque (u8 * s, va_list * args) s = format (s, "policer.index: %d", o->policer.index); vec_add1 (s, '\n'); - s = format (s, - "ipsec.flags: 0x%x, ipsec.sad_index: %d", - o->ipsec.flags, o->ipsec.sad_index); + s = format (s, "ipsec.sad_index: %d", o->ipsec.sad_index); vec_add1 (s, '\n'); s = format (s, "map.mtu: %d", (u32) (o->map.mtu)); diff --git a/src/vnet/ipsec-gre/interface.c b/src/vnet/ipsec-gre/interface.c index 700072350ca..6a8bb7d8f0b 100644 --- a/src/vnet/ipsec-gre/interface.c +++ b/src/vnet/ipsec-gre/interface.c @@ -86,31 +86,23 @@ VLIB_INIT_FUNCTION (ipsec_gre_interface_init); /** * @brief Add or delete ipsec-gre tunnel interface. * - * @param *a vnet_ipsec_gre_add_del_tunnel_args_t - tunnel interface parameters + * @param *a vnet_ipsec_gre_tunnel_add_del_args_t - tunnel interface parameters * @param *sw_if_indexp u32 - software interface index * @return int - 0 if success otherwise VNET_API_ERROR_ */ int -vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, +vnet_ipsec_gre_tunnel_add_del (const ipsec_gre_tunnel_add_del_args_t * a, u32 * sw_if_indexp) { ipsec_gre_main_t *igm = &ipsec_gre_main; vnet_main_t *vnm = igm->vnet_main; - ip4_main_t *im = &ip4_main; + ipsec_main_t *im = &ipsec_main; ipsec_gre_tunnel_t *t; vnet_hw_interface_t *hi; u32 hw_if_index, sw_if_index; u32 slot; uword *p; u64 key; - ipsec_add_del_ipsec_gre_tunnel_args_t args; - - clib_memset (&args, 0, sizeof (args)); - args.is_add = a->is_add; - args.local_sa_id = a->lsa; - args.remote_sa_id = a->rsa; - args.local_ip.as_u32 = a->src.as_u32; - args.remote_ip.as_u32 = a->dst.as_u32; key = (u64) a->src.as_u32 << 32 | (u64) a->dst.as_u32; p = hash_get (igm->tunnel_by_key, key); @@ -160,10 +152,10 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, t->hw_if_index = hw_if_index; t->sw_if_index = sw_if_index; - t->local_sa_id = a->lsa; - t->remote_sa_id = a->rsa; - t->local_sa = ipsec_get_sa_index_by_sa_id (a->lsa); - t->remote_sa = ipsec_get_sa_index_by_sa_id (a->rsa); + t->local_sa_id = a->local_sa_id; + t->remote_sa_id = a->remote_sa_id; + t->local_sa = ipsec_get_sa_index_by_sa_id (t->local_sa_id); + t->remote_sa = ipsec_get_sa_index_by_sa_id (t->remote_sa_id); ip4_sw_interface_enable_disable (sw_if_index, 1); @@ -171,8 +163,6 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, sw_if_index, ~0); igm->tunnel_index_by_sw_if_index[sw_if_index] = t - igm->tunnels; - vec_validate (im->fib_index_by_sw_if_index, sw_if_index); - hi->min_packet_bytes = 64 + sizeof (gre_header_t) + sizeof (ip4_header_t) + sizeof (esp_header_t) + sizeof (esp_footer_t); @@ -185,12 +175,11 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, hash_set (igm->tunnel_by_key, key, t - igm->tunnels); - slot = vlib_node_add_named_next_with_slot - (vnm->vlib_main, hi->tx_node_index, "esp4-encrypt", + slot = vlib_node_add_next_with_slot + (vnm->vlib_main, hi->tx_node_index, im->esp4_encrypt_node_index, IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT); ASSERT (slot == IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT); - } else { /* !is_add => delete */ @@ -216,7 +205,7 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, if (sw_if_indexp) *sw_if_indexp = sw_if_index; - return ipsec_add_del_ipsec_gre_tunnel (vnm, &args); + return ipsec_add_del_ipsec_gre_tunnel (vnm, a); } static clib_error_t * @@ -225,15 +214,15 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; - u8 is_add = 1; u32 num_m_args = 0; - ip4_address_t src, dst; - u32 lsa = 0, rsa = 0; - vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a; + ipsec_gre_tunnel_add_del_args_t _a, *a = &_a; int rv; u32 sw_if_index; clib_error_t *error = NULL; + clib_memset (a, 0, sizeof (*a)); + a->is_add = 1; + /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -241,14 +230,14 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) { if (unformat (line_input, "del")) - is_add = 0; - else if (unformat (line_input, "src %U", unformat_ip4_address, &src)) + a->is_add = 0; + else if (unformat (line_input, "src %U", unformat_ip4_address, &a->src)) num_m_args++; - else if (unformat (line_input, "dst %U", unformat_ip4_address, &dst)) + else if (unformat (line_input, "dst %U", unformat_ip4_address, &a->dst)) num_m_args++; - else if (unformat (line_input, "local-sa %d", &lsa)) + else if (unformat (line_input, "local-sa %d", &a->local_sa_id)) num_m_args++; - else if (unformat (line_input, "remote-sa %d", &rsa)) + else if (unformat (line_input, "remote-sa %d", &a->remote_sa_id)) num_m_args++; else { @@ -264,20 +253,13 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, goto done; } - if (memcmp (&src, &dst, sizeof (src)) == 0) + if (memcmp (&a->src, &a->dst, sizeof (a->src)) == 0) { error = clib_error_return (0, "src and dst are identical"); goto done; } - clib_memset (a, 0, sizeof (*a)); - a->is_add = is_add; - a->lsa = lsa; - a->rsa = rsa; - clib_memcpy (&a->src, &src, sizeof (src)); - clib_memcpy (&a->dst, &dst, sizeof (dst)); - - rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index); + rv = vnet_ipsec_gre_tunnel_add_del (a, &sw_if_index); switch (rv) { @@ -290,7 +272,7 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, goto done; default: error = clib_error_return (0, - "vnet_ipsec_gre_add_del_tunnel returned %d", + "vnet_ipsec_gre_tunnel_add_del returned %d", rv); goto done; } diff --git a/src/vnet/ipsec-gre/ipsec_gre.api b/src/vnet/ipsec-gre/ipsec_gre.api index 770746d5e32..b4950097f61 100644 --- a/src/vnet/ipsec-gre/ipsec_gre.api +++ b/src/vnet/ipsec-gre/ipsec_gre.api @@ -13,25 +13,37 @@ * limitations under the License. */ -option version = "1.0.0"; +option version = "1.1.0"; + +import "vnet/ip/ip_types.api"; /** \brief Add / del ipsec gre tunnel request @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request - @param local_sa_id - local SA id - @param remote_sa_id - remote SA id + @param local_sa_id - local/output SA id + @param remote_sa_id - remote/input SA id @param is_add - 1 if adding the tunnel, 0 if deleting - @param src_address - tunnel source address - @param dst_address - tunnel destination address + @param sw_if_index - software index of the ipsec gre tunnel + ignored on create. set in dump/details + @param src - tunnel source address + @param dst - tunnel destination address */ -define ipsec_gre_add_del_tunnel { +typedef ipsec_gre_tunnel { u32 client_index; u32 context; u32 local_sa_id; u32 remote_sa_id; u8 is_add; - u8 src_address[4]; - u8 dst_address[4]; + u32 sw_if_index; + vl_api_ip4_address_t src; + vl_api_ip4_address_t dst; +}; + +define ipsec_gre_tunnel_add_del { + u32 client_index; + u32 context; + u8 is_add; + vl_api_ipsec_gre_tunnel_t tunnel; }; /** \brief Reply for add / del ipsec gre tunnel request @@ -39,7 +51,7 @@ define ipsec_gre_add_del_tunnel { @param retval - return code @param sw_if_index - software index of the new ipsec gre tunnel */ -define ipsec_gre_add_del_tunnel_reply { +define ipsec_gre_tunnel_add_del_reply { u32 context; i32 retval; u32 sw_if_index; @@ -58,7 +70,6 @@ define ipsec_gre_tunnel_dump { /** \brief ipsec gre tunnel operational state response @param context - returned sender context, to match reply w/ request - @param sw_if_index - software index of the ipsec gre tunnel @param local_sa_id - local SA id @param remote_sa_id - remote SA id @param src_address - tunnel source address @@ -66,11 +77,7 @@ define ipsec_gre_tunnel_dump { */ define ipsec_gre_tunnel_details { u32 context; - u32 sw_if_index; - u32 local_sa_id; - u32 remote_sa_id; - u8 src_address[4]; - u8 dst_address[4]; + vl_api_ipsec_gre_tunnel_t tunnel; }; /* diff --git a/src/vnet/ipsec-gre/ipsec_gre.c b/src/vnet/ipsec-gre/ipsec_gre.c index e4f5e805289..cdb23dd9deb 100644 --- a/src/vnet/ipsec-gre/ipsec_gre.c +++ b/src/vnet/ipsec-gre/ipsec_gre.c @@ -106,8 +106,7 @@ VNET_DEVICE_CLASS_TX_FN (ipsec_gre_device_class) (vlib_main_t * vm, vnet_interface_output_runtime_t *rd = (void *) node->runtime_data; ipsec_gre_tunnel_t *t = pool_elt_at_index (igm->tunnels, rd->dev_instance); - /* use an ethertype of 0x01 for l2-gre */ - u16 l2_gre_protocol_ethertype = clib_net_to_host_u16 (0x01); + u16 l2_gre_protocol_ethertype = clib_net_to_host_u16 (GRE_PROTOCOL_teb); /* Vector of buffer / pkt indices we're supposed to process */ from = vlib_frame_vector_args (frame); diff --git a/src/vnet/ipsec-gre/ipsec_gre.h b/src/vnet/ipsec-gre/ipsec_gre.h index caf2ecf8b30..730cd717795 100644 --- a/src/vnet/ipsec-gre/ipsec_gre.h +++ b/src/vnet/ipsec-gre/ipsec_gre.h @@ -28,6 +28,8 @@ #include #include #include +#include +#include extern vnet_hw_interface_class_t ipsec_gre_hw_interface_class; @@ -86,24 +88,11 @@ extern vlib_node_registration_t ipsec_gre_input_node; extern vnet_device_class_t ipsec_gre_device_class; /* manually added to the interface output node in ipsec_gre.c */ -#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT 1 +#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT 0 -/** - * @brief IPSec-GRE tunnel add/del arguments. - * -*/ -typedef struct -{ - u8 is_add; /**< 1 - add, 0 - delete */ - - ip4_address_t src; /**< tunnel IPv4 src address */ - ip4_address_t dst; /**< tunnel IPv4 dst address */ - u32 lsa; /**< local IPSec SA id */ - u32 rsa; /**< remote IPSec SA id */ -} vnet_ipsec_gre_add_del_tunnel_args_t; - -int vnet_ipsec_gre_add_del_tunnel - (vnet_ipsec_gre_add_del_tunnel_args_t * a, u32 * sw_if_indexp); +extern int vnet_ipsec_gre_tunnel_add_del (const + ipsec_gre_tunnel_add_del_args_t * a, + u32 * sw_if_indexp); #endif /* included_ipsec_gre_h */ diff --git a/src/vnet/ipsec-gre/ipsec_gre_api.c b/src/vnet/ipsec-gre/ipsec_gre_api.c index 3f85c4fc266..24c1f0d5600 100644 --- a/src/vnet/ipsec-gre/ipsec_gre_api.c +++ b/src/vnet/ipsec-gre/ipsec_gre_api.c @@ -23,6 +23,7 @@ #include #include #include +#include #include @@ -43,43 +44,43 @@ #include #define foreach_vpe_api_msg \ -_(IPSEC_GRE_ADD_DEL_TUNNEL, ipsec_gre_add_del_tunnel) \ +_(IPSEC_GRE_TUNNEL_ADD_DEL, ipsec_gre_tunnel_add_del) \ _(IPSEC_GRE_TUNNEL_DUMP, ipsec_gre_tunnel_dump) static void -vl_api_ipsec_gre_add_del_tunnel_t_handler (vl_api_ipsec_gre_add_del_tunnel_t * +vl_api_ipsec_gre_tunnel_add_del_t_handler (vl_api_ipsec_gre_tunnel_add_del_t * mp) { - vl_api_ipsec_gre_add_del_tunnel_reply_t *rmp; + vl_api_ipsec_gre_tunnel_add_del_reply_t *rmp; int rv = 0; - vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a; + ipsec_gre_tunnel_add_del_args_t _a, *a = &_a; u32 sw_if_index = ~0; + clib_memset (a, 0, sizeof (*a)); + + ip4_address_decode (mp->tunnel.src, &a->src); + ip4_address_decode (mp->tunnel.dst, &a->dst); + /* Check src & dst are different */ - if (memcmp (mp->src_address, mp->dst_address, 4) == 0) + if (a->src.as_u32 == a->dst.as_u32) { rv = VNET_API_ERROR_SAME_SRC_DST; goto out; } - clib_memset (a, 0, sizeof (*a)); - - /* ip addresses sent in network byte order */ - clib_memcpy (&(a->src), mp->src_address, 4); - clib_memcpy (&(a->dst), mp->dst_address, 4); a->is_add = mp->is_add; - a->lsa = ntohl (mp->local_sa_id); - a->rsa = ntohl (mp->remote_sa_id); + a->local_sa_id = ntohl (mp->tunnel.local_sa_id); + a->remote_sa_id = ntohl (mp->tunnel.remote_sa_id); - rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index); + rv = vnet_ipsec_gre_tunnel_add_del (a, &sw_if_index); out: - /* *INDENT-OFF* */ - REPLY_MACRO2(VL_API_GRE_ADD_DEL_TUNNEL_REPLY, - ({ - rmp->sw_if_index = ntohl (sw_if_index); - })); - /* *INDENT-ON* */ + /* *INDENT-OFF* */ + REPLY_MACRO2(VL_API_GRE_ADD_DEL_TUNNEL_REPLY, + ({ + rmp->sw_if_index = ntohl (sw_if_index); + })); + /* *INDENT-ON* */ } static void send_ipsec_gre_tunnel_details @@ -90,11 +91,12 @@ static void send_ipsec_gre_tunnel_details rmp = vl_msg_api_alloc (sizeof (*rmp)); clib_memset (rmp, 0, sizeof (*rmp)); rmp->_vl_msg_id = ntohs (VL_API_IPSEC_GRE_TUNNEL_DETAILS); - clib_memcpy (rmp->src_address, &(t->tunnel_src), 4); - clib_memcpy (rmp->dst_address, &(t->tunnel_dst), 4); - rmp->sw_if_index = htonl (t->sw_if_index); - rmp->local_sa_id = htonl (t->local_sa_id); - rmp->remote_sa_id = htonl (t->remote_sa_id); + + ip4_address_encode (&t->tunnel_src, rmp->tunnel.src); + ip4_address_encode (&t->tunnel_dst, rmp->tunnel.dst); + rmp->tunnel.sw_if_index = htonl (t->sw_if_index); + rmp->tunnel.local_sa_id = htonl (t->local_sa_id); + rmp->tunnel.remote_sa_id = htonl (t->remote_sa_id); rmp->context = context; vl_api_send_msg (reg, (u8 *) rmp); diff --git a/src/vnet/ipsec-gre/node.c b/src/vnet/ipsec-gre/node.c index 9e1ab206ad4..6a3aaa12e8c 100644 --- a/src/vnet/ipsec-gre/node.c +++ b/src/vnet/ipsec-gre/node.c @@ -160,7 +160,7 @@ VLIB_NODE_FN (ipsec_gre_input_node) (vlib_main_t * vm, protocol0 = clib_net_to_host_u16 (h0->protocol); protocol1 = clib_net_to_host_u16 (h1->protocol); - if (PREDICT_TRUE(protocol0 == 0x0001)) + if (PREDICT_TRUE(protocol0 == GRE_PROTOCOL_teb)) { next0 = IPSEC_GRE_INPUT_NEXT_L2_INPUT; b0->error = node->errors[IPSEC_GRE_ERROR_NONE]; @@ -170,7 +170,7 @@ VLIB_NODE_FN (ipsec_gre_input_node) (vlib_main_t * vm, b0->error = node->errors[IPSEC_GRE_ERROR_UNKNOWN_PROTOCOL]; next0 = IPSEC_GRE_INPUT_NEXT_DROP; } - if (PREDICT_TRUE(protocol1 == 0x0001)) + if (PREDICT_TRUE(protocol1 == GRE_PROTOCOL_teb)) { next1 = IPSEC_GRE_INPUT_NEXT_L2_INPUT; b1->error = node->errors[IPSEC_GRE_ERROR_NONE]; @@ -314,7 +314,7 @@ drop1: h0 = vlib_buffer_get_current (b0); protocol0 = clib_net_to_host_u16 (h0->protocol); - if (PREDICT_TRUE(protocol0 == 0x0001)) + if (PREDICT_TRUE(protocol0 == GRE_PROTOCOL_teb)) { next0 = IPSEC_GRE_INPUT_NEXT_L2_INPUT; b0->error = node->errors[IPSEC_GRE_ERROR_NONE]; @@ -332,7 +332,7 @@ drop1: next0 = verr0 ? IPSEC_GRE_INPUT_NEXT_DROP : next0; /* For L2 payload set input sw_if_index to GRE tunnel for learning */ - if (PREDICT_FALSE(next0 == IPSEC_GRE_INPUT_NEXT_L2_INPUT)) + if (PREDICT_TRUE(next0 == IPSEC_GRE_INPUT_NEXT_L2_INPUT)) { u64 key = ((u64)(tun_dst0) << 32) | (u64)(tun_src0); diff --git a/src/vnet/ipsec/ah_decrypt.c b/src/vnet/ipsec/ah_decrypt.c index cf955889420..e68accd9da2 100644 --- a/src/vnet/ipsec/ah_decrypt.c +++ b/src/vnet/ipsec/ah_decrypt.c @@ -259,12 +259,9 @@ ah_decrypt_inline (vlib_main_t * vm, } /* for IPSec-GRE tunnel next node is ipsec-gre-input */ - if (PREDICT_FALSE - ((vnet_buffer (i_b0)->ipsec.flags) & - IPSEC_FLAG_IPSEC_GRE_TUNNEL)) + if (PREDICT_FALSE (ipsec_sa_is_set_IS_GRE (sa0))) next0 = AH_DECRYPT_NEXT_IPSEC_GRE_INPUT; - vnet_buffer (i_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0; trace: if (PREDICT_FALSE (i_b0->flags & VLIB_BUFFER_IS_TRACED)) diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c index 3e09d9d74c2..c6cb439f1f8 100644 --- a/src/vnet/ipsec/esp_decrypt.c +++ b/src/vnet/ipsec/esp_decrypt.c @@ -396,7 +396,7 @@ esp_decrypt_inline (vlib_main_t * vm, } } - if (vnet_buffer (b[0])->ipsec.flags & IPSEC_FLAG_IPSEC_GRE_TUNNEL) + if (PREDICT_FALSE (ipsec_sa_is_set_IS_GRE (sa0))) next[0] = ESP_DECRYPT_NEXT_IPSEC_GRE_INPUT; trace: diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index 4c7242da30a..753d7530de4 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -308,11 +308,18 @@ ipsec_sa_flags_decode (vl_api_ipsec_sad_flags_t in) ipsec_sa_flags_t flags = IPSEC_SA_FLAG_NONE; in = clib_net_to_host_u32 (in); -#define _(v,f,s) if (in & IPSEC_API_SAD_FLAG_##f) \ - flags |= IPSEC_SA_FLAG_##f; - foreach_ipsec_sa_flags -#undef _ - return (flags); + if (in & IPSEC_API_SAD_FLAG_USE_ESN) + flags |= IPSEC_SA_FLAG_USE_ESN; + if (in & IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY) + flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY; + if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL) + flags |= IPSEC_SA_FLAG_IS_TUNNEL; + if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL_V6) + flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6; + if (in & IPSEC_API_SAD_FLAG_UDP_ENCAP) + flags |= IPSEC_SA_FLAG_UDP_ENCAP; + + return (flags); } static vl_api_ipsec_sad_flags_t diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c index dd99f780be6..a8616555629 100644 --- a/src/vnet/ipsec/ipsec_format.c +++ b/src/vnet/ipsec/ipsec_format.c @@ -243,6 +243,19 @@ unformat_ipsec_key (unformat_input_t * input, va_list * args) return 1; } +u8 * +format_ipsec_sa_flags (u8 * s, va_list * args) +{ + ipsec_sa_flags_t flags = va_arg (*args, int); + + if (0) + ; +#define _(v, f, str) else if (flags & IPSEC_SA_FLAG_##f) s = format(s, "%s ", str); + foreach_ipsec_sa_flags +#undef _ + return (s); +} + u8 * format_ipsec_sa (u8 * s, va_list * args) { @@ -254,15 +267,11 @@ format_ipsec_sa (u8 * s, va_list * args) sa = pool_elt_at_index (im->sad, sai); - s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s%s%s%s", + s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s %U", sai, sa->id, sa->spi, ipsec_sa_is_set_IS_TUNNEL (sa) ? "tunnel" : "transport", ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? "-ip6" : "", - sa->protocol ? "esp" : "ah", - ipsec_sa_is_set_UDP_ENCAP (sa) ? " udp-encap-enabled" : "", - ipsec_sa_is_set_USE_ANTI_REPLAY (sa) ? " anti-replay" : "", - ipsec_sa_is_set_USE_ESN (sa) ? - " extended-sequence-number" : ""); + sa->protocol ? "esp" : "ah", format_ipsec_sa_flags, sa->flags); s = format (s, "\n seq %u seq-hi %u", sa->seq, sa->seq_hi); s = format (s, "\n last-seq %u last-seq-hi %u window %U", sa->last_seq, sa->last_seq_hi, diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c index 17f28a09ac8..bfdc2bb6814 100644 --- a/src/vnet/ipsec/ipsec_if.c +++ b/src/vnet/ipsec/ipsec_if.c @@ -429,7 +429,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, int ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm, - ipsec_add_del_ipsec_gre_tunnel_args_t * args) + const ipsec_gre_tunnel_add_del_args_t * args) { ipsec_tunnel_if_t *t = 0; ipsec_main_t *im = &ipsec_main; @@ -441,22 +441,27 @@ ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm, p = hash_get (im->sa_index_by_sa_id, args->local_sa_id); if (!p) return VNET_API_ERROR_INVALID_VALUE; - isa = p[0]; + osa = p[0]; + sa = pool_elt_at_index (im->sad, p[0]); + ipsec_sa_set_IS_GRE (sa); p = hash_get (im->sa_index_by_sa_id, args->remote_sa_id); if (!p) return VNET_API_ERROR_INVALID_VALUE; - osa = p[0]; + isa = p[0]; sa = pool_elt_at_index (im->sad, p[0]); + ipsec_sa_set_IS_GRE (sa); + /* we form the key from the input/remote SA whose tunnel is srouce + * at the remote end */ if (ipsec_sa_is_set_IS_TUNNEL (sa)) { - key.remote_ip = sa->tunnel_dst_addr.ip4.as_u32; + key.remote_ip = sa->tunnel_src_addr.ip4.as_u32; key.spi = clib_host_to_net_u32 (sa->spi); } else { - key.remote_ip = args->remote_ip.as_u32; + key.remote_ip = args->src.as_u32; key.spi = clib_host_to_net_u32 (sa->spi); } diff --git a/src/vnet/ipsec/ipsec_if.h b/src/vnet/ipsec/ipsec_if.h index 7f0eb08b24c..34a1721f4fc 100644 --- a/src/vnet/ipsec/ipsec_if.h +++ b/src/vnet/ipsec/ipsec_if.h @@ -97,17 +97,18 @@ typedef struct u8 is_add; u32 local_sa_id; u32 remote_sa_id; - ip4_address_t local_ip; - ip4_address_t remote_ip; -} ipsec_add_del_ipsec_gre_tunnel_args_t; + ip4_address_t src; + ip4_address_t dst; +} ipsec_gre_tunnel_add_del_args_t; extern int ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, ipsec_add_del_tunnel_args_t * args, u32 * sw_if_index); extern int ipsec_add_del_tunnel_if (ipsec_add_del_tunnel_args_t * args); extern int ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm, - ipsec_add_del_ipsec_gre_tunnel_args_t - * args); + const + ipsec_gre_tunnel_add_del_args_t * + args); extern int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index, ipsec_if_set_key_type_t type, diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c index 63d463bd633..9ba2c10bca6 100644 --- a/src/vnet/ipsec/ipsec_if_in.c +++ b/src/vnet/ipsec/ipsec_if_in.c @@ -197,6 +197,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, } else { + b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL]; n_no_tunnel++; next[0] = IPSEC_INPUT_NEXT_DROP; goto pkt1; @@ -224,6 +225,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, } else { + b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL]; n_no_tunnel++; next[0] = IPSEC_INPUT_NEXT_DROP; goto pkt1; @@ -236,7 +238,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, if (PREDICT_TRUE (t0->hw_if_index != ~0)) { - vnet_buffer (b[0])->ipsec.flags = 0; sw_if_index0 = t0->sw_if_index; vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0; @@ -245,6 +246,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_increment_combined_counter (drop_counter, thread_index, sw_if_index0, 1, len0); n_disabled++; + b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED]; next[0] = IPSEC_INPUT_NEXT_DROP; goto pkt1; } @@ -268,10 +270,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, n_bytes = len0; } } - else - { - vnet_buffer (b[0])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL; - } pkt1: if (is_ip6) @@ -295,6 +293,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, } else { + b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL]; n_no_tunnel++; next[1] = IPSEC_INPUT_NEXT_DROP; goto trace1; @@ -322,6 +321,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, } else { + b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL]; n_no_tunnel++; next[1] = IPSEC_INPUT_NEXT_DROP; goto trace1; @@ -334,7 +334,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, if (PREDICT_TRUE (t1->hw_if_index != ~0)) { - vnet_buffer (b[1])->ipsec.flags = 0; sw_if_index1 = t1->sw_if_index; vnet_buffer (b[1])->sw_if_index[VLIB_RX] = sw_if_index1; @@ -343,6 +342,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_increment_combined_counter (drop_counter, thread_index, sw_if_index1, 1, len1); n_disabled++; + b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED]; next[1] = IPSEC_INPUT_NEXT_DROP; goto trace1; } @@ -366,10 +366,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, n_bytes = len1; } } - else - { - vnet_buffer (b[1])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL; - } trace1: if (PREDICT_FALSE (is_trace)) @@ -460,6 +456,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, } else { + b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL]; n_no_tunnel++; next[0] = IPSEC_INPUT_NEXT_DROP; goto trace00; @@ -487,6 +484,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, } else { + b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL]; n_no_tunnel++; next[0] = IPSEC_INPUT_NEXT_DROP; goto trace00; @@ -499,7 +497,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, if (PREDICT_TRUE (t0->hw_if_index != ~0)) { - vnet_buffer (b[0])->ipsec.flags = 0; sw_if_index0 = t0->sw_if_index; vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0; @@ -508,6 +505,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_increment_combined_counter (drop_counter, thread_index, sw_if_index0, 1, len0); n_disabled++; + b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED]; next[0] = IPSEC_INPUT_NEXT_DROP; goto trace00; } @@ -531,10 +529,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, n_bytes = len0; } } - else - { - vnet_buffer (b[0])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL; - } trace00: if (PREDICT_FALSE (is_trace)) @@ -563,11 +557,8 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_node_increment_counter (vm, node->node_index, IPSEC_IF_INPUT_ERROR_RX, - from_frame->n_vectors - n_disabled); - vlib_node_increment_counter (vm, node->node_index, - IPSEC_IF_INPUT_ERROR_DISABLED, n_disabled); - vlib_node_increment_counter (vm, node->node_index, - IPSEC_IF_INPUT_ERROR_NO_TUNNEL, n_no_tunnel); + from_frame->n_vectors - (n_disabled + + n_no_tunnel)); vlib_buffer_enqueue_to_next (vm, node, from, nexts, from_frame->n_vectors); diff --git a/src/vnet/ipsec/ipsec_input.c b/src/vnet/ipsec/ipsec_input.c index 970211eccaa..5be72c3a161 100644 --- a/src/vnet/ipsec/ipsec_input.c +++ b/src/vnet/ipsec/ipsec_input.c @@ -253,7 +253,6 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm, clib_net_to_host_u16 (ip0->length)); vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; - vnet_buffer (b0)->ipsec.flags = 0; next0 = im->esp4_decrypt_next_index; vlib_buffer_advance (b0, ((u8 *) esp0 - (u8 *) ip0)); goto trace0; @@ -304,7 +303,6 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm, clib_net_to_host_u16 (ip0->length)); vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; - vnet_buffer (b0)->ipsec.flags = 0; next0 = im->ah4_decrypt_next_index; goto trace1; } @@ -450,7 +448,6 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm, header_size); vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; - vnet_buffer (b0)->ipsec.flags = 0; next0 = im->esp6_decrypt_next_index; vlib_buffer_advance (b0, header_size); goto trace0; @@ -479,7 +476,6 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm, header_size); vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; - vnet_buffer (b0)->ipsec.flags = 0; next0 = im->ah6_decrypt_next_index; goto trace0; } diff --git a/src/vnet/ipsec/ipsec_io.h b/src/vnet/ipsec/ipsec_io.h index c180a784eaa..f156b48360f 100644 --- a/src/vnet/ipsec/ipsec_io.h +++ b/src/vnet/ipsec/ipsec_io.h @@ -15,8 +15,6 @@ #ifndef __IPSEC_IO_H__ #define __IPSEC_IO_H__ -#define IPSEC_FLAG_IPSEC_GRE_TUNNEL (1 << 0) - #define foreach_ipsec_output_next \ _ (DROP, "error-drop") diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h index 94f1554112f..cfb44b9e86d 100644 --- a/src/vnet/ipsec/ipsec_sa.h +++ b/src/vnet/ipsec/ipsec_sa.h @@ -90,6 +90,7 @@ typedef struct ipsec_key_t_ _ (4, IS_TUNNEL, "tunnel") \ _ (8, IS_TUNNEL_V6, "tunnel-v6") \ _ (16, UDP_ENCAP, "udp-encap") \ + _ (32, IS_GRE, "GRE") \ typedef enum ipsec_sad_flags_t_ { diff --git a/src/vpp/api/custom_dump.c b/src/vpp/api/custom_dump.c index a1206b1016a..fac2aa26c0d 100644 --- a/src/vpp/api/custom_dump.c +++ b/src/vpp/api/custom_dump.c @@ -3307,22 +3307,20 @@ static void *vl_api_lisp_eid_table_map_dump_t_print FINISH; } -static void *vl_api_ipsec_gre_add_del_tunnel_t_print - (vl_api_ipsec_gre_add_del_tunnel_t * mp, void *handle) +static void *vl_api_ipsec_gre_tunnel_add_del_t_print + (vl_api_ipsec_gre_tunnel_add_del_t * mp, void *handle) { u8 *s; - s = format (0, "SCRIPT: ipsec_gre_add_del_tunnel "); + s = format (0, "SCRIPT: ipsec_gre_tunnel_add_del "); - s = format (s, "dst %U ", format_ip4_address, - (ip4_address_t *) & (mp->dst_address)); + s = format (s, "dst %U ", format_vl_api_ip4_address, mp->tunnel.dst); - s = format (s, "src %U ", format_ip4_address, - (ip4_address_t *) & (mp->src_address)); + s = format (s, "src %U ", format_vl_api_ip4_address, mp->tunnel.src); - s = format (s, "local_sa %d ", ntohl (mp->local_sa_id)); + s = format (s, "local_sa %d ", ntohl (mp->tunnel.local_sa_id)); - s = format (s, "remote_sa %d ", ntohl (mp->remote_sa_id)); + s = format (s, "remote_sa %d ", ntohl (mp->tunnel.remote_sa_id)); if (mp->is_add == 0) s = format (s, "del "); @@ -3901,7 +3899,7 @@ _(SHOW_LISP_RLOC_PROBE_STATE, show_lisp_rloc_probe_state) \ _(SHOW_LISP_MAP_REGISTER_STATE, show_lisp_map_register_state) \ _(LISP_RLOC_PROBE_ENABLE_DISABLE, lisp_rloc_probe_enable_disable) \ _(LISP_MAP_REGISTER_ENABLE_DISABLE, lisp_map_register_enable_disable) \ -_(IPSEC_GRE_ADD_DEL_TUNNEL, ipsec_gre_add_del_tunnel) \ +_(IPSEC_GRE_TUNNEL_ADD_DEL, ipsec_gre_tunnel_add_del) \ _(IPSEC_GRE_TUNNEL_DUMP, ipsec_gre_tunnel_dump) \ _(DELETE_SUBIF, delete_subif) \ _(L2_INTERFACE_PBB_TAG_REWRITE, l2_interface_pbb_tag_rewrite) \ -- 2.16.6