ikev2: remove assert condition
Remove assert condition ensuring that a packet was punted with reason
spi=0. We can't rely on data in punt_reason because it is defind in an
union. This patch adds a new IKE node that handles punted IKE packets
separately.
Type: fix
Change-Id: I2e1b44922e53e049bd8512fa5cb85cee6a2b8aa7
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
diff --git a/src/plugins/ikev2/ikev2.c b/src/plugins/ikev2/ikev2.c
index 8d06bd3..cfc3d9f 100644
--- a/src/plugins/ikev2/ikev2.c
+++ b/src/plugins/ikev2/ikev2.c
@@ -2834,9 +2834,8 @@
}
static_always_inline uword
-ikev2_node_internal (vlib_main_t * vm,
- vlib_node_runtime_t * node, vlib_frame_t * frame,
- u8 is_ip4)
+ikev2_node_internal (vlib_main_t *vm, vlib_node_runtime_t *node,
+ vlib_frame_t *frame, u8 is_ip4, u8 natt)
{
u32 n_left = frame->n_vectors, *from;
ikev2_main_t *km = &ikev2_main;
@@ -2862,15 +2861,9 @@
ikev2_sa_t sa; /* temporary store for SA */
u32 rlen, slen = 0;
int ip_hdr_sz = 0;
- int is_req = 0, has_non_esp_marker = 0;
+ int is_req = 0;
- ASSERT (0 == b0->punt_reason
- || (is_ip4
- && b0->punt_reason ==
- ipsec_punt_reason[IPSEC_PUNT_IP4_SPI_UDP_0]));
-
- if (is_ip4
- && b0->punt_reason == ipsec_punt_reason[IPSEC_PUNT_IP4_SPI_UDP_0])
+ if (natt)
{
u8 *ptr = vlib_buffer_get_current (b0);
ip40 = (ip4_header_t *) ptr;
@@ -2903,12 +2896,12 @@
rlen = b0->current_length - ip_hdr_sz - sizeof (*udp0);
/* check for non-esp marker */
- if (*((u32 *) ike0) == 0)
+ if (natt)
{
+ ASSERT (*((u32 *) ike0) == 0);
ike0 =
(ike_header_t *) ((u8 *) ike0 + sizeof (ikev2_non_esp_marker));
rlen -= sizeof (ikev2_non_esp_marker);
- has_non_esp_marker = 1;
}
if (clib_net_to_host_u32 (ike0->length) != rlen)
@@ -3273,13 +3266,13 @@
if (udp0->dst_port == clib_net_to_host_u16 (IKEV2_PORT_NATT)
&& ikev2_natt_active (sa0))
{
- if (!has_non_esp_marker)
+ if (!natt)
slen = ikev2_insert_non_esp_marker (ike0, slen);
}
}
else
{
- if (has_non_esp_marker)
+ if (natt)
slen += sizeof (ikev2_non_esp_marker);
u16 tp = udp0->dst_port;
@@ -3334,13 +3327,20 @@
static uword
ikev2_ip4 (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
{
- return ikev2_node_internal (vm, node, frame, 1 /* is_ip4 */ );
+ return ikev2_node_internal (vm, node, frame, 1 /* is_ip4 */, 0);
+}
+
+static uword
+ikev2_ip4_natt (vlib_main_t *vm, vlib_node_runtime_t *node,
+ vlib_frame_t *frame)
+{
+ return ikev2_node_internal (vm, node, frame, 1 /* is_ip4 */, 1 /* natt */);
}
static uword
ikev2_ip6 (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
{
- return ikev2_node_internal (vm, node, frame, 0 /* is_ip4 */ );
+ return ikev2_node_internal (vm, node, frame, 0 /* is_ip4 */, 0);
}
/* *INDENT-OFF* */
@@ -3361,6 +3361,23 @@
},
};
+VLIB_REGISTER_NODE (ikev2_node_ip4_natt,static) = {
+ .function = ikev2_ip4_natt,
+ .name = "ikev2-ip4-natt",
+ .vector_size = sizeof (u32),
+ .format_trace = format_ikev2_trace,
+ .type = VLIB_NODE_TYPE_INTERNAL,
+
+ .n_errors = ARRAY_LEN(ikev2_error_strings),
+ .error_strings = ikev2_error_strings,
+
+ .n_next_nodes = IKEV2_IP4_N_NEXT,
+ .next_nodes = {
+ [IKEV2_NEXT_IP4_LOOKUP] = "ip4-lookup",
+ [IKEV2_NEXT_IP4_ERROR_DROP] = "error-drop",
+ },
+};
+
VLIB_REGISTER_NODE (ikev2_node_ip6,static) = {
.function = ikev2_ip6,
.name = "ikev2-ip6",
@@ -4666,9 +4683,9 @@
udp_register_dst_port (vm, IKEV2_PORT_NATT, ikev2_node_ip4.index, 1);
udp_register_dst_port (vm, IKEV2_PORT_NATT, ikev2_node_ip6.index, 0);
- vlib_punt_hdl_t punt_hdl = vlib_punt_client_register ("ikev2-ip4");
+ vlib_punt_hdl_t punt_hdl = vlib_punt_client_register ("ikev2-ip4-natt");
vlib_punt_register (punt_hdl, ipsec_punt_reason[IPSEC_PUNT_IP4_SPI_UDP_0],
- "ikev2-ip4");
+ "ikev2-ip4-natt");
ikev2_cli_reference ();
km->log_level = IKEV2_LOG_ERROR;