FD.io VPP  v19.08-27-gf4dcae4
Vector Packet Processing
ipsec_if_in.c
Go to the documentation of this file.
1 /*
2  * ipsec_if_in.c : IPSec interface input node
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 
22 #include <vnet/ipsec/ipsec.h>
23 #include <vnet/ipsec/esp.h>
24 #include <vnet/ipsec/ipsec_io.h>
25 #include <vnet/ipsec/ipsec_punt.h>
26 
27 /* Statistics (not really errors) */
28 #define foreach_ipsec_if_input_error \
29 _(RX, "good packets received") \
30 _(DISABLED, "ipsec packets received on disabled interface") \
31 _(NO_TUNNEL, "no matching tunnel") \
32 _(NAT_KEEPALIVE, "NAT Keepalive") \
33 _(TOO_SHORT, "Too Short") \
34 _(SPI_0, "SPI 0")
35 
36 static char *ipsec_if_input_error_strings[] = {
37 #define _(sym,string) string,
39 #undef _
40 };
41 
42 typedef enum
43 {
44 #define _(sym,str) IPSEC_IF_INPUT_ERROR_##sym,
46 #undef _
49 
50 
51 typedef struct
52 {
53  union
54  {
55  ipsec4_tunnel_key_t key4;
56  ipsec6_tunnel_key_t key6;
57  };
61 
62 static u8 *
63 format_ipsec_if_input_trace (u8 * s, va_list * args)
64 {
65  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
66  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
67  ipsec_if_input_trace_t *t = va_arg (*args, ipsec_if_input_trace_t *);
68 
69  if (t->is_ip6)
70  s = format (s, "IPSec: %U seq %u",
72  else
73  s = format (s, "IPSec: %U seq %u",
75  return s;
76 }
77 
80  vlib_buffer_t * b,
81  const esp_header_t * esp,
82  const ip4_header_t * ip4, u16 offset)
83 {
84  if (PREDICT_FALSE (0 == esp->spi))
85  {
86  b->error = node->errors[IPSEC_IF_INPUT_ERROR_SPI_0];
87  b->punt_reason =
88  ipsec_punt_reason[(ip4->protocol == IP_PROTOCOL_UDP ?
89  IPSEC_PUNT_IP4_SPI_UDP_0 :
90  IPSEC_PUNT_IP4_NO_SUCH_TUNNEL)];
91  }
92  else
93  {
94  b->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
95  b->punt_reason = ipsec_punt_reason[IPSEC_PUNT_IP4_NO_SUCH_TUNNEL];
96  }
97  vlib_buffer_advance (b, -offset);
98  return IPSEC_INPUT_NEXT_PUNT;
99 }
100 
103  vlib_buffer_t * b,
104  const esp_header_t * esp, u16 offset)
105 {
106  b->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
107  b->punt_reason = ipsec_punt_reason[IPSEC_PUNT_IP6_NO_SUCH_TUNNEL];
108 
109  vlib_buffer_advance (b, -offset);
110  return (IPSEC_INPUT_NEXT_PUNT);
111 }
112 
115  vlib_frame_t * from_frame, int is_ip6)
116 {
117  ipsec_main_t *im = &ipsec_main;
118  vnet_main_t *vnm = im->vnet_main;
120 
121  int is_trace = node->flags & VLIB_NODE_FLAG_TRACE;
122  u32 thread_index = vm->thread_index;
123 
124  u32 n_left_from, *from;
125  u16 nexts[VLIB_FRAME_SIZE], *next;
126  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
127 
128  from = vlib_frame_vector_args (from_frame);
129  n_left_from = from_frame->n_vectors;
130 
131  vlib_get_buffers (vm, from, bufs, n_left_from);
132  b = bufs;
133  next = nexts;
134 
135  clib_memset_u16 (nexts, im->esp4_decrypt_next_index, n_left_from);
136 
137  u64 n_bytes = 0, n_packets = 0;
138  u32 n_disabled = 0, n_no_tunnel = 0;
139 
140  u32 last_sw_if_index = ~0;
141  u32 last_tunnel_id = ~0;
142  ipsec4_tunnel_key_t last_key4;
143  ipsec6_tunnel_key_t last_key6;
144 
145  vlib_combined_counter_main_t *rx_counter;
146  vlib_combined_counter_main_t *drop_counter;
147 
148  if (is_ip6)
149  clib_memset (&last_key6, 0xff, sizeof (last_key6));
150  else
151  last_key4.as_u64 = ~0;
152 
155 
156  while (n_left_from >= 2)
157  {
158  u32 sw_if_index0, sw_if_index1;
159  ip4_header_t *ip40, *ip41;
160  ip6_header_t *ip60, *ip61;
161  esp_header_t *esp0, *esp1;
162  u32 len0, len1;
163  u16 buf_adv0, buf_adv1;
164  u16 buf_rewind0, buf_rewind1;
165  u32 tid0, tid1;
166  ipsec_tunnel_if_t *t0, *t1;
167  ipsec4_tunnel_key_t key40, key41;
168  ipsec6_tunnel_key_t key60, key61;
169 
170  if (n_left_from >= 4)
171  {
172  CLIB_PREFETCH (b[2], CLIB_CACHE_LINE_BYTES, STORE);
174  CLIB_PREFETCH (b[3], CLIB_CACHE_LINE_BYTES, STORE);
176  }
177 
178  ip40 =
179  (ip4_header_t *) (b[0]->data + vnet_buffer (b[0])->l3_hdr_offset);
180  ip41 =
181  (ip4_header_t *) (b[1]->data + vnet_buffer (b[1])->l3_hdr_offset);
182 
183  if (is_ip6)
184  {
185  ip60 = (ip6_header_t *) ip40;
186  ip61 = (ip6_header_t *) ip41;
187  esp0 = (esp_header_t *) ((u8 *) ip60 + sizeof (ip6_header_t));
188  esp1 = (esp_header_t *) ((u8 *) ip61 + sizeof (ip6_header_t));
189  buf_adv0 = sizeof (ip6_header_t);
190  buf_adv1 = sizeof (ip6_header_t);
191  }
192  else
193  {
194  /* NAT UDP port 4500 case, don't advance any more */
195  if (ip40->protocol == IP_PROTOCOL_UDP)
196  {
197  esp0 =
198  (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40) +
199  sizeof (udp_header_t));
200  buf_adv0 = 0;
201  buf_rewind0 = ip4_header_bytes (ip40) + sizeof (udp_header_t);
202  }
203  else
204  {
205  esp0 = (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40));
206  buf_rewind0 = buf_adv0 = ip4_header_bytes (ip40);
207  }
208  /* NAT UDP port 4500 case, don't advance any more */
209  if (ip41->protocol == IP_PROTOCOL_UDP)
210  {
211  esp1 =
212  (esp_header_t *) ((u8 *) ip41 + ip4_header_bytes (ip41) +
213  sizeof (udp_header_t));
214  buf_adv1 = 0;
215  buf_rewind1 = ip4_header_bytes (ip41) + sizeof (udp_header_t);
216  }
217  else
218  {
219  esp1 = (esp_header_t *) ((u8 *) ip41 + ip4_header_bytes (ip41));
220  buf_rewind1 = buf_adv1 = ip4_header_bytes (ip41);
221  }
222  }
223 
224  vlib_buffer_advance (b[0], buf_adv0);
225  vlib_buffer_advance (b[1], buf_adv1);
226 
227  len0 = vlib_buffer_length_in_chain (vm, b[0]);
228  len1 = vlib_buffer_length_in_chain (vm, b[1]);
229 
230  /* If the packet is too short to contain an SPI, then maybe
231  * it's a keep alive */
232  if (len0 < sizeof (esp_header_t))
233  {
234  if (esp0->spi_bytes[0] == 0xff)
235  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NAT_KEEPALIVE];
236  else
237  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_TOO_SHORT];
238 
239  next[0] = IPSEC_INPUT_NEXT_DROP;
240  goto pkt1;
241  }
242 
243  if (is_ip6)
244  {
245  key60.remote_ip = ip60->src_address;
246  key60.spi = esp0->spi;
247 
248  if (memcmp (&key60, &last_key6, sizeof (last_key6)) == 0)
249  {
250  tid0 = last_tunnel_id;
251  }
252  else
253  {
254  uword *p =
256  if (p)
257  {
258  tid0 = p[0];
259  last_tunnel_id = tid0;
260  clib_memcpy_fast (&last_key6, &key60, sizeof (key60));
261  }
262  else
263  {
264  next[0] =
265  ipsec_ip6_if_no_tunnel (node, b[0], esp0, buf_adv0);
266  n_no_tunnel++;
267  goto pkt1;
268  }
269  }
270  }
271  else /* !is_ip6 */
272  {
273  key40.remote_ip = ip40->src_address;
274  key40.spi = esp0->spi;
275 
276  if (key40.as_u64 == last_key4.as_u64)
277  {
278  tid0 = last_tunnel_id;
279  }
280  else
281  {
282  uword *p =
283  hash_get (im->ipsec4_if_pool_index_by_key, key40.as_u64);
284  if (p)
285  {
286  tid0 = p[0];
287  last_tunnel_id = tid0;
288  last_key4.as_u64 = key40.as_u64;
289  }
290  else
291  {
292  next[0] =
293  ipsec_ip4_if_no_tunnel (node, b[0], esp0, ip40,
294  buf_rewind0);
295  n_no_tunnel++;
296  goto pkt1;
297  }
298  }
299  }
300 
301  t0 = pool_elt_at_index (im->tunnel_interfaces, tid0);
302  vnet_buffer (b[0])->ipsec.sad_index = t0->input_sa_index;
303 
304  if (PREDICT_TRUE (t0->hw_if_index != ~0))
305  {
306  sw_if_index0 = t0->sw_if_index;
307  vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0;
308 
310  {
312  (drop_counter, thread_index, sw_if_index0, 1, len0);
313  n_disabled++;
314  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
315  next[0] = IPSEC_INPUT_NEXT_DROP;
316  goto pkt1;
317  }
318 
319  if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index))
320  {
321  n_packets++;
322  n_bytes += len0;
323  }
324  else
325  {
326  if (n_packets)
327  {
329  (rx_counter, thread_index, last_sw_if_index,
330  n_packets, n_bytes);
331  }
332 
333  last_sw_if_index = sw_if_index0;
334  n_packets = 1;
335  n_bytes = len0;
336  }
337  }
338 
339  pkt1:
340 
341  if (len1 < sizeof (esp_header_t))
342  {
343  if (esp0->spi_bytes[0] == 0xff)
344  b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_NAT_KEEPALIVE];
345  else
346  b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_TOO_SHORT];
347 
348  next[1] = IPSEC_INPUT_NEXT_DROP;
349  goto trace1;
350  }
351 
352  if (is_ip6)
353  {
354  key61.remote_ip = ip61->src_address;
355  key61.spi = esp1->spi;
356 
357  if (memcmp (&key61, &last_key6, sizeof (last_key6)) == 0)
358  {
359  tid1 = last_tunnel_id;
360  }
361  else
362  {
363  uword *p =
365  if (p)
366  {
367  tid1 = p[0];
368  last_tunnel_id = tid1;
369  clib_memcpy_fast (&last_key6, &key61, sizeof (key61));
370  }
371  else
372  {
373  next[1] =
374  ipsec_ip6_if_no_tunnel (node, b[1], esp1, buf_adv1);
375  n_no_tunnel++;
376  goto trace1;
377  }
378  }
379  }
380  else /* !is_ip6 */
381  {
382  key41.remote_ip = ip41->src_address;
383  key41.spi = esp1->spi;
384 
385  if (key41.as_u64 == last_key4.as_u64)
386  {
387  tid1 = last_tunnel_id;
388  }
389  else
390  {
391  uword *p =
392  hash_get (im->ipsec4_if_pool_index_by_key, key41.as_u64);
393  if (p)
394  {
395  tid1 = p[0];
396  last_tunnel_id = tid1;
397  last_key4.as_u64 = key41.as_u64;
398  }
399  else
400  {
401  next[1] =
402  ipsec_ip4_if_no_tunnel (node, b[1], esp1, ip41,
403  buf_rewind1);
404  n_no_tunnel++;
405  goto trace1;
406  }
407  }
408  }
409 
410  t1 = pool_elt_at_index (im->tunnel_interfaces, tid1);
411  vnet_buffer (b[1])->ipsec.sad_index = t1->input_sa_index;
412 
413  if (PREDICT_TRUE (t1->hw_if_index != ~0))
414  {
415  sw_if_index1 = t1->sw_if_index;
416  vnet_buffer (b[1])->sw_if_index[VLIB_RX] = sw_if_index1;
417 
419  {
421  (drop_counter, thread_index, sw_if_index1, 1, len1);
422  n_disabled++;
423  b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
424  next[1] = IPSEC_INPUT_NEXT_DROP;
425  goto trace1;
426  }
427 
428  if (PREDICT_TRUE (sw_if_index1 == last_sw_if_index))
429  {
430  n_packets++;
431  n_bytes += len1;
432  }
433  else
434  {
435  if (n_packets)
436  {
438  (rx_counter, thread_index, last_sw_if_index,
439  n_packets, n_bytes);
440  }
441 
442  last_sw_if_index = sw_if_index1;
443  n_packets = 1;
444  n_bytes = len1;
445  }
446  }
447 
448  trace1:
449  if (PREDICT_FALSE (is_trace))
450  {
451  if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
452  {
454  vlib_add_trace (vm, node, b[0], sizeof (*tr));
455  if (is_ip6)
456  clib_memcpy (&tr->key6, &key60, sizeof (tr->key6));
457  else
458  clib_memcpy (&tr->key4, &key40, sizeof (tr->key4));
459  tr->is_ip6 = is_ip6;
460  tr->seq = clib_host_to_net_u32 (esp0->seq);
461  }
462  if (b[1]->flags & VLIB_BUFFER_IS_TRACED)
463  {
465  vlib_add_trace (vm, node, b[1], sizeof (*tr));
466  if (is_ip6)
467  clib_memcpy (&tr->key6, &key61, sizeof (tr->key6));
468  else
469  clib_memcpy (&tr->key4, &key41, sizeof (tr->key4));
470  tr->is_ip6 = is_ip6;
471  tr->seq = clib_host_to_net_u32 (esp1->seq);
472  }
473  }
474 
475  /* next */
476  b += 2;
477  next += 2;
478  n_left_from -= 2;
479  }
480  while (n_left_from > 0)
481  {
482  u32 sw_if_index0;
483  ip4_header_t *ip40;
484  ip6_header_t *ip60;
485  esp_header_t *esp0;
486  u32 len0;
487  u16 buf_adv0, buf_rewind0;
488  u32 tid0;
489  ipsec_tunnel_if_t *t0;
490  ipsec4_tunnel_key_t key40;
491  ipsec6_tunnel_key_t key60;
492 
493  ip40 =
494  (ip4_header_t *) (b[0]->data + vnet_buffer (b[0])->l3_hdr_offset);
495 
496  if (is_ip6)
497  {
498  ip60 = (ip6_header_t *) ip40;
499  esp0 = (esp_header_t *) ((u8 *) ip60 + sizeof (ip6_header_t));
500  buf_adv0 = sizeof (ip6_header_t);
501  }
502  else
503  {
504  /* NAT UDP port 4500 case, don't advance any more */
505  if (ip40->protocol == IP_PROTOCOL_UDP)
506  {
507  esp0 =
508  (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40) +
509  sizeof (udp_header_t));
510  buf_adv0 = 0;
511  buf_rewind0 = ip4_header_bytes (ip40) + sizeof (udp_header_t);
512  }
513  else
514  {
515  esp0 = (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40));
516  buf_rewind0 = buf_adv0 = ip4_header_bytes (ip40);
517  }
518  }
519 
520  /* stats for the tunnel include all the data after the IP header
521  just like a norml IP-IP tunnel */
522  vlib_buffer_advance (b[0], buf_adv0);
523  len0 = vlib_buffer_length_in_chain (vm, b[0]);
524 
525  if (len0 < sizeof (esp_header_t))
526  {
527  if (esp0->spi_bytes[0] == 0xff)
528  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NAT_KEEPALIVE];
529  else
530  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_TOO_SHORT];
531 
532  next[0] = IPSEC_INPUT_NEXT_DROP;
533  goto trace00;
534  }
535 
536  if (is_ip6)
537  {
538  key60.remote_ip = ip60->src_address;
539  key60.spi = esp0->spi;
540 
541  if (memcmp (&key60, &last_key6, sizeof (last_key6)) == 0)
542  {
543  tid0 = last_tunnel_id;
544  }
545  else
546  {
547  uword *p =
549  if (p)
550  {
551  tid0 = p[0];
552  last_tunnel_id = tid0;
553  clib_memcpy_fast (&last_key6, &key60, sizeof (key60));
554  }
555  else
556  {
557  next[0] =
558  ipsec_ip6_if_no_tunnel (node, b[0], esp0, buf_adv0);
559  n_no_tunnel++;
560  goto trace00;
561  }
562  }
563  }
564  else /* !is_ip6 */
565  {
566  key40.remote_ip = ip40->src_address;
567  key40.spi = esp0->spi;
568 
569  if (key40.as_u64 == last_key4.as_u64)
570  {
571  tid0 = last_tunnel_id;
572  }
573  else
574  {
575  uword *p =
576  hash_get (im->ipsec4_if_pool_index_by_key, key40.as_u64);
577  if (p)
578  {
579  tid0 = p[0];
580  last_tunnel_id = tid0;
581  last_key4.as_u64 = key40.as_u64;
582  }
583  else
584  {
585  next[0] =
586  ipsec_ip4_if_no_tunnel (node, b[0], esp0, ip40,
587  buf_rewind0);
588  n_no_tunnel++;
589  goto trace00;
590  }
591  }
592  }
593 
594  t0 = pool_elt_at_index (im->tunnel_interfaces, tid0);
595  vnet_buffer (b[0])->ipsec.sad_index = t0->input_sa_index;
596 
597  if (PREDICT_TRUE (t0->hw_if_index != ~0))
598  {
599  sw_if_index0 = t0->sw_if_index;
600  vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0;
601 
603  {
605  (drop_counter, thread_index, sw_if_index0, 1, len0);
606  n_disabled++;
607  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
608  next[0] = IPSEC_INPUT_NEXT_DROP;
609  goto trace00;
610  }
611 
612  if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index))
613  {
614  n_packets++;
615  n_bytes += len0;
616  }
617  else
618  {
619  if (n_packets)
620  {
622  (rx_counter, thread_index, last_sw_if_index,
623  n_packets, n_bytes);
624  }
625 
626  last_sw_if_index = sw_if_index0;
627  n_packets = 1;
628  n_bytes = len0;
629  }
630  }
631 
632  trace00:
633  if (PREDICT_FALSE (is_trace))
634  {
635  if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
636  {
638  vlib_add_trace (vm, node, b[0], sizeof (*tr));
639  if (is_ip6)
640  clib_memcpy (&tr->key6, &key60, sizeof (tr->key6));
641  else
642  clib_memcpy (&tr->key4, &key40, sizeof (tr->key4));
643  tr->is_ip6 = is_ip6;
644  tr->seq = clib_host_to_net_u32 (esp0->seq);
645  }
646  }
647 
648  /* next */
649  b += 1;
650  next += 1;
651  n_left_from -= 1;
652  }
653 
654  if (n_packets)
655  {
657  thread_index,
658  last_sw_if_index, n_packets, n_bytes);
659  }
660 
662  IPSEC_IF_INPUT_ERROR_RX,
663  from_frame->n_vectors - (n_disabled +
664  n_no_tunnel));
665 
666  vlib_buffer_enqueue_to_next (vm, node, from, nexts, from_frame->n_vectors);
667 
668  return from_frame->n_vectors;
669 }
670 
672  vlib_node_runtime_t * node,
673  vlib_frame_t * from_frame)
674 {
675  return ipsec_if_input_inline (vm, node, from_frame, 0 /* is_ip6 */ );
676 }
677 
678 /* *INDENT-OFF* */
680  .name = "ipsec4-if-input",
681  .vector_size = sizeof (u32),
682  .format_trace = format_ipsec_if_input_trace,
685  .error_strings = ipsec_if_input_error_strings,
686  .sibling_of = "ipsec4-input-feature",
687 };
688 /* *INDENT-ON* */
689 
691  vlib_node_runtime_t * node,
692  vlib_frame_t * from_frame)
693 {
694  return ipsec_if_input_inline (vm, node, from_frame, 1 /* is_ip6 */ );
695 }
696 
697 /* *INDENT-OFF* */
699  .name = "ipsec6-if-input",
700  .vector_size = sizeof (u32),
701  .format_trace = format_ipsec_if_input_trace,
704  .error_strings = ipsec_if_input_error_strings,
705  .sibling_of = "ipsec6-input-feature",
706 };
707 /* *INDENT-ON* */
708 
709 /*
710  * fd.io coding-style-patch-verification: ON
711  *
712  * Local Variables:
713  * eval: (c-set-style "gnu")
714  * End:
715  */
ipsec_if_input_error_t
Definition: ipsec_if_in.c:42
u32 flags
Definition: vhost_user.h:141
#define CLIB_UNUSED(x)
Definition: clib.h:82
ipsec_tunnel_if_t * tunnel_interfaces
Definition: ipsec.h:102
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
Definition: counter.h:220
vlib_node_registration_t ipsec4_if_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_if_input_node)
Definition: ipsec_if_in.c:679
ip4_address_t src_address
Definition: ip4_packet.h:170
uword * ipsec4_if_pool_index_by_key
Definition: ipsec.h:114
vnet_interface_main_t interface_main
Definition: vnet.h:56
#define PREDICT_TRUE(x)
Definition: clib.h:112
unsigned long u64
Definition: types.h:89
#define foreach_ipsec_if_input_error
Definition: ipsec_if_in.c:28
#define clib_memcpy_fast(a, b, c)
Definition: string.h:81
u32 thread_index
Definition: main.h:197
static u8 * format_ipsec_if_input_trace(u8 *s, va_list *args)
Definition: ipsec_if_in.c:63
u8 * format_ipsec6_tunnel_key(u8 *s, va_list *args)
Definition: ipsec_format.c:415
clib_memset(h->entries, 0, sizeof(h->entries[0])*entries)
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
u8 data[128]
Definition: ipsec.api:249
#define VLIB_NODE_FN(node)
Definition: node.h:201
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:468
static u16 ipsec_ip4_if_no_tunnel(vlib_node_runtime_t *node, vlib_buffer_t *b, const esp_header_t *esp, const ip4_header_t *ip4, u16 offset)
Definition: ipsec_if_in.c:79
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
Definition: buffer_funcs.h:366
ip6_address_t src_address
Definition: ip6_packet.h:383
unsigned char u8
Definition: types.h:56
#define clib_memcpy(d, s, n)
Definition: string.h:180
uword * ipsec6_if_pool_index_by_key
Definition: ipsec.h:115
ipsec_main_t ipsec_main
Definition: ipsec.c:28
#define always_inline
Definition: clib.h:98
vlib_combined_counter_main_t * combined_sw_if_counters
Definition: interface.h:842
u32 esp4_decrypt_next_index
Definition: ipsec.h:133
unsigned int u32
Definition: types.h:88
#define VLIB_FRAME_SIZE
Definition: node.h:376
vl_api_fib_path_type_t type
Definition: fib_types.api:123
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
#define hash_get(h, key)
Definition: hash.h:249
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:514
vnet_main_t * vnet_main
Definition: ipsec.h:108
unsigned short u16
Definition: types.h:57
#define PREDICT_FALSE(x)
Definition: clib.h:111
static u16 ipsec_ip6_if_no_tunnel(vlib_node_runtime_t *node, vlib_buffer_t *b, const esp_header_t *esp, u16 offset)
Definition: ipsec_if_in.c:102
u32 node_index
Node index.
Definition: node.h:494
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
u32 punt_reason
Definition: buffer.h:149
vlib_punt_reason_t ipsec_punt_reason[IPSEC_PUNT_N_REASONS]
Definition: ipsec_punt.c:23
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
u16 n_vectors
Definition: node.h:395
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:80
vlib_main_t * vm
Definition: buffer.c:312
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
Definition: buffer_node.h:332
u8 spi_bytes[4]
Definition: esp.h:27
vlib_node_registration_t ipsec6_if_input_node
(constructor) VLIB_REGISTER_NODE (ipsec6_if_input_node)
Definition: ipsec_if_in.c:698
#define ARRAY_LEN(x)
Definition: clib.h:62
ipsec4_tunnel_key_t key4
Definition: ipsec_if_in.c:55
static char * ipsec_if_input_error_strings[]
Definition: ipsec_if_in.c:36
vnet_hw_interface_flags_t flags
Definition: ipsec_if.h:28
ipsec6_tunnel_key_t key6
Definition: ipsec_if_in.c:56
u32 seq
Definition: esp.h:29
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:248
u32 spi
Definition: esp.h:26
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
static_always_inline void clib_memset_u16(void *p, u16 val, uword count)
Definition: string.h:378
template key/value backing page structure
Definition: bihash_doc.h:44
VLIB buffer representation.
Definition: buffer.h:102
u64 uword
Definition: types.h:112
static uword ipsec_if_input_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame, int is_ip6)
Definition: ipsec_if_in.c:114
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
A collection of combined counters.
Definition: counter.h:188
#define hash_get_mem(h, key)
Definition: hash.h:269
#define vnet_buffer(b)
Definition: buffer.h:361
u16 flags
Copy of main node flags.
Definition: node.h:507
static int ip4_header_bytes(const ip4_header_t *i)
Definition: ip4_packet.h:235
u8 * format_ipsec4_tunnel_key(u8 *s, va_list *args)
Definition: ipsec_format.c:402
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
Definition: buffer_funcs.h:244
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:301
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
Definition: defs.h:46