blob: deaa7b7b165ca41f4b7063d1c80ae859450ce843 [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * decap.c : IPSec tunnel decapsulation
3 *
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18#include <vnet/vnet.h>
19#include <vnet/api_errno.h>
20#include <vnet/ip/ip.h>
Damjan Marion8b3191e2016-11-09 19:54:20 +010021#include <vnet/feature/feature.h>
Ed Warnickecb9cada2015-12-08 15:45:58 -070022
23#include <vnet/ipsec/ipsec.h>
24#include <vnet/ipsec/esp.h>
25
Ed Warnickecb9cada2015-12-08 15:45:58 -070026#define foreach_ipsec_input_error \
27 _(RX_PKTS, "IPSEC pkts received") \
28 _(DECRYPTION_FAILED, "IPSEC decryption failed")
29
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070030typedef enum
31{
Ed Warnickecb9cada2015-12-08 15:45:58 -070032#define _(sym,str) IPSEC_INPUT_ERROR_##sym,
33 foreach_ipsec_input_error
34#undef _
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070035 IPSEC_INPUT_N_ERROR,
Ed Warnickecb9cada2015-12-08 15:45:58 -070036} ipsec_input_error_t;
37
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070038static char *ipsec_input_error_strings[] = {
Ed Warnickecb9cada2015-12-08 15:45:58 -070039#define _(sym,string) string,
40 foreach_ipsec_input_error
41#undef _
42};
43
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070044typedef struct
45{
Matus Fabian5539a072016-09-07 05:57:09 -070046 u32 sa_id;
Ed Warnickecb9cada2015-12-08 15:45:58 -070047 u32 spi;
48 u32 seq;
49} ipsec_input_trace_t;
50
51/* packet trace format function */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070052static u8 *
53format_ipsec_input_trace (u8 * s, va_list * args)
Ed Warnickecb9cada2015-12-08 15:45:58 -070054{
55 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
56 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070057 ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
Ed Warnickecb9cada2015-12-08 15:45:58 -070058
Matus Fabian5539a072016-09-07 05:57:09 -070059 if (t->spi == 0 && t->seq == 0)
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070060 {
Matus Fabian5539a072016-09-07 05:57:09 -070061 s = format (s, "esp: no esp packet");
62 return s;
63 }
64
65 if (t->sa_id != 0)
66 {
67 s = format (s, "esp: sa_id %u spi %u seq %u", t->sa_id, t->spi, t->seq);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070068 }
Ed Warnickecb9cada2015-12-08 15:45:58 -070069 else
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070070 {
Matus Fabian5539a072016-09-07 05:57:09 -070071 s = format (s, "esp: no sa spi %u seq %u", t->spi, t->seq);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070072 }
Ed Warnickecb9cada2015-12-08 15:45:58 -070073 return s;
74}
75
76always_inline ipsec_policy_t *
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070077ipsec_input_protect_policy_match (ipsec_spd_t * spd, u32 sa, u32 da, u32 spi)
Ed Warnickecb9cada2015-12-08 15:45:58 -070078{
79 ipsec_main_t *im = &ipsec_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070080 ipsec_policy_t *p;
81 ipsec_sa_t *s;
82 u32 *i;
Ed Warnickecb9cada2015-12-08 15:45:58 -070083
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070084 vec_foreach (i, spd->ipv4_inbound_protect_policy_indices)
85 {
86 p = pool_elt_at_index (spd->policies, *i);
87 s = pool_elt_at_index (im->sad, p->sa_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -070088
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070089 if (spi != s->spi)
90 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -070091
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070092 if (s->is_tunnel)
93 {
94 if (da != clib_net_to_host_u32 (s->tunnel_dst_addr.ip4.as_u32))
95 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -070096
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070097 if (sa != clib_net_to_host_u32 (s->tunnel_src_addr.ip4.as_u32))
98 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -070099
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700100 return p;
101 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700102
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700103 if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
104 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700105
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700106 if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
107 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700108
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700109 if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
110 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700111
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700112 if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
113 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700114
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700115 return p;
116 }
117 return 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700118}
119
120always_inline uword
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700121ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la,
122 ip6_address_t * ua)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700123{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700124 if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
125 (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700126 return 1;
127 return 0;
128}
129
130always_inline ipsec_policy_t *
131ipsec_input_ip6_protect_policy_match (ipsec_spd_t * spd,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700132 ip6_address_t * sa,
133 ip6_address_t * da, u32 spi)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700134{
135 ipsec_main_t *im = &ipsec_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700136 ipsec_policy_t *p;
137 ipsec_sa_t *s;
138 u32 *i;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700139
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700140 vec_foreach (i, spd->ipv6_inbound_protect_policy_indices)
141 {
142 p = pool_elt_at_index (spd->policies, *i);
143 s = pool_elt_at_index (im->sad, p->sa_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700144
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700145 if (spi != s->spi)
146 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700147
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700148 if (s->is_tunnel)
149 {
150 if (!ip6_address_is_equal (sa, &s->tunnel_src_addr.ip6))
151 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700152
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700153 if (!ip6_address_is_equal (da, &s->tunnel_dst_addr.ip6))
154 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700155
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700156 return p;
157 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700158
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700159 if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6))
160 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700161
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700162 if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6))
163 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700164
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700165 return p;
166 }
167 return 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700168}
169
Jean-Mickael Guerin8941ec22016-03-04 14:14:21 +0100170static vlib_node_registration_t ipsec_input_ip4_node;
171
Ed Warnickecb9cada2015-12-08 15:45:58 -0700172static uword
173ipsec_input_ip4_node_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700174 vlib_node_runtime_t * node,
175 vlib_frame_t * from_frame)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700176{
Ed Warnickecb9cada2015-12-08 15:45:58 -0700177 u32 n_left_from, *from, next_index, *to_next;
178 ipsec_main_t *im = &ipsec_main;
179
180 from = vlib_frame_vector_args (from_frame);
181 n_left_from = from_frame->n_vectors;
182
183 next_index = node->cached_next_index;
184
185 while (n_left_from > 0)
186 {
187 u32 n_left_to_next;
188
189 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
190
191 while (n_left_from > 0 && n_left_to_next > 0)
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700192 {
193 u32 bi0, next0;
194 vlib_buffer_t *b0;
195 ip4_header_t *ip0;
196 esp_header_t *esp0;
197 ip4_ipsec_config_t *c0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700198 ipsec_spd_t *spd0;
Matus Fabian5539a072016-09-07 05:57:09 -0700199 ipsec_policy_t *p0 = 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700200
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700201 bi0 = to_next[0] = from[0];
202 from += 1;
203 n_left_from -= 1;
204 to_next += 1;
205 n_left_to_next -= 1;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700206
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700207 b0 = vlib_get_buffer (vm, bi0);
Damjan Marion8b3191e2016-11-09 19:54:20 +0100208 c0 =
209 vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index
210 [VLIB_RX], &next0, b0,
211 sizeof (c0[0]));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700212
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700213 spd0 = pool_elt_at_index (im->spds, c0->spd_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700214
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700215 ip0 = vlib_buffer_get_current (b0);
216 esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700217
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700218 if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
219 {
Ed Warnickecb9cada2015-12-08 15:45:58 -0700220#if 0
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700221 clib_warning
222 ("packet received from %U to %U spi %u size %u spd_id %u",
223 format_ip4_address, ip0->src_address.as_u8,
224 format_ip4_address, ip0->dst_address.as_u8,
225 clib_net_to_host_u32 (esp0->spi),
226 clib_net_to_host_u16 (ip0->length), spd0->id);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700227#endif
Matus Fabian5539a072016-09-07 05:57:09 -0700228
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700229 p0 = ipsec_input_protect_policy_match (spd0,
230 clib_net_to_host_u32
Matus Fabian5539a072016-09-07 05:57:09 -0700231 (ip0->src_address.
232 as_u32),
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700233 clib_net_to_host_u32
Matus Fabian5539a072016-09-07 05:57:09 -0700234 (ip0->dst_address.
235 as_u32),
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700236 clib_net_to_host_u32
237 (esp0->spi));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700238
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700239 if (PREDICT_TRUE (p0 != 0))
240 {
241 p0->counter.packets++;
242 p0->counter.bytes += clib_net_to_host_u16 (ip0->length);
Damjan Marion9c6ae5f2016-11-15 23:20:01 +0100243 vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
244 vnet_buffer (b0)->ipsec.flags = 0;
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000245 next0 = im->esp_decrypt_next_index;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700246 vlib_buffer_advance (b0, ip4_header_bytes (ip0));
247 goto trace0;
248 }
249 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700250
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700251 /* FIXME bypass and discard */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700252
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700253 trace0:
254 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
255 {
256 ipsec_input_trace_t *tr =
257 vlib_add_trace (vm, node, b0, sizeof (*tr));
Matus Fabian5539a072016-09-07 05:57:09 -0700258 if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
259 {
260 if (p0)
261 tr->sa_id = p0->sa_id;
262 tr->spi = clib_host_to_net_u32 (esp0->spi);
263 tr->seq = clib_host_to_net_u32 (esp0->seq);
264 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700265 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700266
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700267 vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
268 to_next, n_left_to_next, bi0,
269 next0);
270 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700271 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
272 }
273 vlib_node_increment_counter (vm, ipsec_input_ip4_node.index,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700274 IPSEC_INPUT_ERROR_RX_PKTS,
275 from_frame->n_vectors);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700276
277 return from_frame->n_vectors;
278}
279
280
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700281/* *INDENT-OFF* */
Jean-Mickael Guerin8941ec22016-03-04 14:14:21 +0100282VLIB_REGISTER_NODE (ipsec_input_ip4_node,static) = {
Ed Warnickecb9cada2015-12-08 15:45:58 -0700283 .function = ipsec_input_ip4_node_fn,
284 .name = "ipsec-input-ip4",
285 .vector_size = sizeof (u32),
286 .format_trace = format_ipsec_input_trace,
287 .type = VLIB_NODE_TYPE_INTERNAL,
288
289 .n_errors = ARRAY_LEN(ipsec_input_error_strings),
290 .error_strings = ipsec_input_error_strings,
291
292 .n_next_nodes = IPSEC_INPUT_N_NEXT,
293 .next_nodes = {
294#define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
295 foreach_ipsec_input_next
296#undef _
297 },
298};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700299/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700300
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700301VLIB_NODE_FUNCTION_MULTIARCH (ipsec_input_ip4_node, ipsec_input_ip4_node_fn)
302 static vlib_node_registration_t ipsec_input_ip6_node;
Damjan Marion1c80e832016-05-11 23:07:18 +0200303
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700304 static uword
305 ipsec_input_ip6_node_fn (vlib_main_t * vm,
306 vlib_node_runtime_t * node,
307 vlib_frame_t * from_frame)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700308{
Ed Warnickecb9cada2015-12-08 15:45:58 -0700309 u32 n_left_from, *from, next_index, *to_next;
310 ipsec_main_t *im = &ipsec_main;
311
312 from = vlib_frame_vector_args (from_frame);
313 n_left_from = from_frame->n_vectors;
314
315 next_index = node->cached_next_index;
316
317 while (n_left_from > 0)
318 {
319 u32 n_left_to_next;
320
321 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
322
323 while (n_left_from > 0 && n_left_to_next > 0)
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700324 {
325 u32 bi0, next0;
326 vlib_buffer_t *b0;
327 ip6_header_t *ip0;
328 esp_header_t *esp0;
329 ip4_ipsec_config_t *c0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700330 ipsec_spd_t *spd0;
Matus Fabian5539a072016-09-07 05:57:09 -0700331 ipsec_policy_t *p0 = 0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700332 u32 header_size = sizeof (ip0[0]);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700333
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700334 bi0 = to_next[0] = from[0];
335 from += 1;
336 n_left_from -= 1;
337 to_next += 1;
338 n_left_to_next -= 1;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700339
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700340 b0 = vlib_get_buffer (vm, bi0);
Damjan Marion8b3191e2016-11-09 19:54:20 +0100341 c0 =
342 vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index
343 [VLIB_RX], &next0, b0,
344 sizeof (c0[0]));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700345
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700346 spd0 = pool_elt_at_index (im->spds, c0->spd_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700347
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700348 ip0 = vlib_buffer_get_current (b0);
349 esp0 = (esp_header_t *) ((u8 *) ip0 + header_size);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700350
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700351 if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
352 {
Ed Warnickecb9cada2015-12-08 15:45:58 -0700353#if 0
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700354 clib_warning
355 ("packet received from %U to %U spi %u size %u spd_id %u",
356 format_ip6_address, &ip0->src_address, format_ip6_address,
357 &ip0->dst_address, clib_net_to_host_u32 (esp0->spi),
358 clib_net_to_host_u16 (ip0->payload_length) + header_size,
359 spd0->id);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700360#endif
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700361 p0 = ipsec_input_ip6_protect_policy_match (spd0,
362 &ip0->src_address,
363 &ip0->dst_address,
364 clib_net_to_host_u32
365 (esp0->spi));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700366
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700367 if (PREDICT_TRUE (p0 != 0))
368 {
369 p0->counter.packets++;
370 p0->counter.bytes +=
371 clib_net_to_host_u16 (ip0->payload_length);
372 p0->counter.bytes += header_size;
Damjan Marion9c6ae5f2016-11-15 23:20:01 +0100373 vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
374 vnet_buffer (b0)->ipsec.flags = 0;
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000375 next0 = im->esp_decrypt_next_index;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700376 vlib_buffer_advance (b0, header_size);
377 goto trace0;
378 }
379 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700380
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700381 trace0:
382 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
383 {
384 ipsec_input_trace_t *tr =
385 vlib_add_trace (vm, node, b0, sizeof (*tr));
Matus Fabian5539a072016-09-07 05:57:09 -0700386 if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
387 {
388 if (p0)
389 tr->sa_id = p0->sa_id;
390 tr->spi = clib_host_to_net_u32 (esp0->spi);
391 tr->seq = clib_host_to_net_u32 (esp0->seq);
392 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700393 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700394
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700395 vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
396 n_left_to_next, bi0, next0);
397 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700398 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
399 }
400 vlib_node_increment_counter (vm, ipsec_input_ip6_node.index,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700401 IPSEC_INPUT_ERROR_RX_PKTS,
402 from_frame->n_vectors);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700403
404 return from_frame->n_vectors;
405}
406
407
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700408/* *INDENT-OFF* */
Jean-Mickael Guerin8941ec22016-03-04 14:14:21 +0100409VLIB_REGISTER_NODE (ipsec_input_ip6_node,static) = {
Ed Warnickecb9cada2015-12-08 15:45:58 -0700410 .function = ipsec_input_ip6_node_fn,
411 .name = "ipsec-input-ip6",
412 .vector_size = sizeof (u32),
413 .format_trace = format_ipsec_input_trace,
414 .type = VLIB_NODE_TYPE_INTERNAL,
415
416 .n_errors = ARRAY_LEN(ipsec_input_error_strings),
417 .error_strings = ipsec_input_error_strings,
418
419 .n_next_nodes = IPSEC_INPUT_N_NEXT,
420 .next_nodes = {
421#define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
422 foreach_ipsec_input_next
423#undef _
424 },
425};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700426/* *INDENT-ON* */
Damjan Marion1c80e832016-05-11 23:07:18 +0200427
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700428VLIB_NODE_FUNCTION_MULTIARCH (ipsec_input_ip6_node, ipsec_input_ip6_node_fn)
429/*
430 * fd.io coding-style-patch-verification: ON
431 *
432 * Local Variables:
433 * eval: (c-set-style "gnu")
434 * End:
435 */