blob: e6cf837d796096502d71982c2ff969f38e72fb62 [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * ipsec_output.c : IPSec output node
3 *
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18#include <vnet/vnet.h>
19#include <vnet/api_errno.h>
20#include <vnet/ip/ip.h>
21
22#include <vnet/ipsec/ipsec.h>
Neale Ranns918c1612019-02-21 23:34:59 -080023#include <vnet/ipsec/ipsec_io.h>
Ed Warnickecb9cada2015-12-08 15:45:58 -070024
Damjan Mariona9a951f2017-01-16 22:06:10 +010025#if WITH_LIBSSL > 0
Ed Warnickecb9cada2015-12-08 15:45:58 -070026
Ed Warnickecb9cada2015-12-08 15:45:58 -070027#define foreach_ipsec_output_error \
28 _(RX_PKTS, "IPSec pkts received") \
29 _(POLICY_DISCARD, "IPSec policy discard") \
30 _(POLICY_NO_MATCH, "IPSec policy (no match)") \
31 _(POLICY_PROTECT, "IPSec policy protect") \
32 _(POLICY_BYPASS, "IPSec policy bypass") \
33 _(ENCAPS_FAILED, "IPSec encapsulation failed")
34
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070035typedef enum
36{
Ed Warnickecb9cada2015-12-08 15:45:58 -070037#define _(sym,str) IPSEC_OUTPUT_ERROR_##sym,
38 foreach_ipsec_output_error
39#undef _
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070040 IPSEC_DECAP_N_ERROR,
Ed Warnickecb9cada2015-12-08 15:45:58 -070041} ipsec_output_error_t;
42
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070043static char *ipsec_output_error_strings[] = {
Ed Warnickecb9cada2015-12-08 15:45:58 -070044#define _(sym,string) string,
45 foreach_ipsec_output_error
46#undef _
47};
48
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070049typedef struct
50{
Ed Warnickecb9cada2015-12-08 15:45:58 -070051 u32 spd_id;
Neale Rannsa09c1ff2019-02-04 01:10:30 -080052 u32 policy_id;
Ed Warnickecb9cada2015-12-08 15:45:58 -070053} ipsec_output_trace_t;
54
55/* packet trace format function */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070056static u8 *
57format_ipsec_output_trace (u8 * s, va_list * args)
Ed Warnickecb9cada2015-12-08 15:45:58 -070058{
59 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
60 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070061 ipsec_output_trace_t *t = va_arg (*args, ipsec_output_trace_t *);
Ed Warnickecb9cada2015-12-08 15:45:58 -070062
Neale Rannsa09c1ff2019-02-04 01:10:30 -080063 s = format (s, "spd %u policy %d", t->spd_id, t->policy_id);
64
Ed Warnickecb9cada2015-12-08 15:45:58 -070065 return s;
66}
67
Ed Warnickecb9cada2015-12-08 15:45:58 -070068always_inline ipsec_policy_t *
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070069ipsec_output_policy_match (ipsec_spd_t * spd, u8 pr, u32 la, u32 ra, u16 lp,
70 u16 rp)
Ed Warnickecb9cada2015-12-08 15:45:58 -070071{
Neale Rannsa09c1ff2019-02-04 01:10:30 -080072 ipsec_main_t *im = &ipsec_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070073 ipsec_policy_t *p;
74 u32 *i;
Ed Warnickecb9cada2015-12-08 15:45:58 -070075
Damjan Marion3f54b182016-08-16 11:27:02 +020076 if (!spd)
77 return 0;
78
Neale Rannsa09c1ff2019-02-04 01:10:30 -080079 vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP4_OUTBOUND])
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070080 {
Neale Rannsa09c1ff2019-02-04 01:10:30 -080081 p = pool_elt_at_index (im->policies, *i);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070082 if (PREDICT_FALSE (p->protocol && (p->protocol != pr)))
83 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -070084
Neale Rannsa4d24312019-07-10 13:46:21 +000085 if (ra < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070086 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -070087
Neale Rannsa4d24312019-07-10 13:46:21 +000088 if (ra > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070089 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -070090
Neale Rannsa4d24312019-07-10 13:46:21 +000091 if (la < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
Radu Nicolaude412ce2018-03-12 13:52:41 +000092 continue;
93
Neale Rannsa4d24312019-07-10 13:46:21 +000094 if (la > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
Radu Nicolaude412ce2018-03-12 13:52:41 +000095 continue;
96
Marco Varlese191a5942017-10-30 18:17:21 +010097 if (PREDICT_FALSE
98 ((pr != IP_PROTOCOL_TCP) && (pr != IP_PROTOCOL_UDP)
99 && (pr != IP_PROTOCOL_SCTP)))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700100 return p;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700101
102 if (lp < p->lport.start)
103 continue;
104
105 if (lp > p->lport.stop)
106 continue;
107
108 if (rp < p->rport.start)
109 continue;
110
111 if (rp > p->rport.stop)
112 continue;
113
114 return p;
115 }
116 return 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700117}
118
119always_inline uword
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700120ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la,
121 ip6_address_t * ua)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700122{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700123 if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
124 (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700125 return 1;
126 return 0;
127}
128
129always_inline ipsec_policy_t *
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200130ipsec6_output_policy_match (ipsec_spd_t * spd,
131 ip6_address_t * la,
132 ip6_address_t * ra, u16 lp, u16 rp, u8 pr)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700133{
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800134 ipsec_main_t *im = &ipsec_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700135 ipsec_policy_t *p;
136 u32 *i;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700137
Damjan Marion3f54b182016-08-16 11:27:02 +0200138 if (!spd)
139 return 0;
140
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800141 vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_OUTBOUND])
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700142 {
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800143 p = pool_elt_at_index (im->policies, *i);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700144 if (PREDICT_FALSE (p->protocol && (p->protocol != pr)))
145 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700146
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700147 if (!ip6_addr_match_range (ra, &p->raddr.start.ip6, &p->raddr.stop.ip6))
148 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700149
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700150 if (!ip6_addr_match_range (la, &p->laddr.start.ip6, &p->laddr.stop.ip6))
151 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700152
Marco Varlese191a5942017-10-30 18:17:21 +0100153 if (PREDICT_FALSE
154 ((pr != IP_PROTOCOL_TCP) && (pr != IP_PROTOCOL_UDP)
155 && (pr != IP_PROTOCOL_SCTP)))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700156 return p;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700157
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700158 if (lp < p->lport.start)
159 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700160
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700161 if (lp > p->lport.stop)
162 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700163
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700164 if (rp < p->rport.start)
165 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700166
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700167 if (rp > p->rport.stop)
168 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700169
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700170 return p;
171 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700172
173 return 0;
174}
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700175
Matus Fabian08a6f012016-11-15 06:08:51 -0800176static inline uword
177ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
178 vlib_frame_t * from_frame, int is_ipv6)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700179{
180 ipsec_main_t *im = &ipsec_main;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700181
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800182 u32 *from, *to_next = 0, thread_index;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700183 u32 n_left_from, sw_if_index0, last_sw_if_index = (u32) ~ 0;
184 u32 next_node_index = (u32) ~ 0, last_next_node_index = (u32) ~ 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700185 vlib_frame_t *f = 0;
186 u32 spd_index0 = ~0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700187 ipsec_spd_t *spd0 = 0;
Klement Sekera31da2e32018-06-24 22:49:55 +0200188 int bogus;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700189 u64 nc_protect = 0, nc_bypass = 0, nc_discard = 0, nc_nomatch = 0;
190
191 from = vlib_frame_vector_args (from_frame);
192 n_left_from = from_frame->n_vectors;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800193 thread_index = vm->thread_index;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700194
195 while (n_left_from > 0)
196 {
Zhiyong Yangf9221162019-04-22 00:18:38 -0400197 u32 bi0, pi0, bi1;
198 vlib_buffer_t *b0, *b1;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700199 ipsec_policy_t *p0;
200 ip4_header_t *ip0;
201 ip6_header_t *ip6_0 = 0;
202 udp_header_t *udp0;
Florin Corasfb28e9a2016-09-06 15:18:21 +0200203 u32 iph_offset = 0;
Klement Sekera31da2e32018-06-24 22:49:55 +0200204 tcp_header_t *tcp0;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800205 u64 bytes0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700206
207 bi0 = from[0];
208 b0 = vlib_get_buffer (vm, bi0);
Vratko Polakea6a34c2019-04-23 15:52:28 +0200209 if (n_left_from > 1)
210 {
211 bi1 = from[1];
212 b1 = vlib_get_buffer (vm, bi1);
213 CLIB_PREFETCH (b1, CLIB_CACHE_LINE_BYTES * 2, STORE);
214 vlib_prefetch_buffer_data (b1, LOAD);
215 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700216 sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX];
Florin Corasfb28e9a2016-09-06 15:18:21 +0200217 iph_offset = vnet_buffer (b0)->ip.save_rewrite_length;
218 ip0 = (ip4_header_t *) ((u8 *) vlib_buffer_get_current (b0)
219 + iph_offset);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700220
Ed Warnickecb9cada2015-12-08 15:45:58 -0700221 /* lookup for SPD only if sw_if_index is changed */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700222 if (PREDICT_FALSE (last_sw_if_index != sw_if_index0))
223 {
224 uword *p = hash_get (im->spd_index_by_sw_if_index, sw_if_index0);
Dave Barach47d41ad2020-02-17 09:13:26 -0500225 ALWAYS_ASSERT (p);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700226 spd_index0 = p[0];
227 spd0 = pool_elt_at_index (im->spds, spd_index0);
228 last_sw_if_index = sw_if_index0;
229 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700230
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700231 if (is_ipv6)
232 {
Matus Fabian08a6f012016-11-15 06:08:51 -0800233 ip6_0 = (ip6_header_t *) ((u8 *) vlib_buffer_get_current (b0)
234 + iph_offset);
235
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700236 udp0 = ip6_next_header (ip6_0);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700237#if 0
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700238 clib_warning
239 ("packet received from %U port %u to %U port %u spd_id %u",
240 format_ip6_address, &ip6_0->src_address,
241 clib_net_to_host_u16 (udp0->src_port), format_ip6_address,
242 &ip6_0->dst_address, clib_net_to_host_u16 (udp0->dst_port),
243 spd0->id);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700244#endif
245
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200246 p0 = ipsec6_output_policy_match (spd0,
247 &ip6_0->src_address,
248 &ip6_0->dst_address,
Neale Rannsa4d24312019-07-10 13:46:21 +0000249 clib_net_to_host_u16
250 (udp0->src_port),
251 clib_net_to_host_u16
252 (udp0->dst_port), ip6_0->protocol);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700253 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700254 else
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700255 {
256 udp0 = (udp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700257
258#if 0
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700259 clib_warning ("packet received from %U to %U port %u",
260 format_ip4_address, ip0->src_address.as_u8,
261 format_ip4_address, ip0->dst_address.as_u8,
262 clib_net_to_host_u16 (udp0->dst_port));
263 clib_warning ("sw_if_index0 %u spd_index0 %u spd_id %u",
264 sw_if_index0, spd_index0, spd0->id);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700265#endif
266
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700267 p0 = ipsec_output_policy_match (spd0, ip0->protocol,
Neale Rannsa4d24312019-07-10 13:46:21 +0000268 clib_net_to_host_u32
269 (ip0->src_address.as_u32),
270 clib_net_to_host_u32
271 (ip0->dst_address.as_u32),
272 clib_net_to_host_u16
273 (udp0->src_port),
274 clib_net_to_host_u16
275 (udp0->dst_port));
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700276 }
Klement Sekera31da2e32018-06-24 22:49:55 +0200277 tcp0 = (void *) udp0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700278
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700279 if (PREDICT_TRUE (p0 != NULL))
280 {
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800281 pi0 = p0 - im->policies;
282
283 vlib_prefetch_combined_counter (&ipsec_spd_policy_counters,
284 thread_index, pi0);
285
286 if (is_ipv6)
287 {
288 bytes0 = clib_net_to_host_u16 (ip6_0->payload_length);
289 bytes0 += sizeof (ip6_header_t);
290 }
291 else
292 {
293 bytes0 = clib_net_to_host_u16 (ip0->length);
294 }
295
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700296 if (p0->policy == IPSEC_POLICY_ACTION_PROTECT)
297 {
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800298 ipsec_sa_t *sa = 0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700299 nc_protect++;
Radu Nicolaude412ce2018-03-12 13:52:41 +0000300 sa = pool_elt_at_index (im->sad, p0->sa_index);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800301 if (sa->protocol == IPSEC_PROTOCOL_ESP)
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200302 if (is_ipv6)
303 next_node_index = im->esp6_encrypt_node_index;
304 else
305 next_node_index = im->esp4_encrypt_node_index;
306 else if (is_ipv6)
307 next_node_index = im->ah6_encrypt_node_index;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800308 else
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200309 next_node_index = im->ah4_encrypt_node_index;
Damjan Marion9c6ae5f2016-11-15 23:20:01 +0100310 vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800311
Mohsin Kazmi68095382021-02-10 11:26:24 +0100312 if (PREDICT_FALSE (b0->flags & VNET_BUFFER_F_OFFLOAD))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700313 {
Mohsin Kazmi68095382021-02-10 11:26:24 +0100314 u32 oflags = vnet_buffer2 (b0)->oflags;
315
316 /*
317 * Clearing offload flags before checksum is computed
318 * It guarantees the cache hit!
319 */
320 vnet_buffer_offload_flags_clear (b0, oflags);
321
322 if (is_ipv6)
Klement Sekera31da2e32018-06-24 22:49:55 +0200323 {
Mohsin Kazmi68095382021-02-10 11:26:24 +0100324 if (PREDICT_FALSE (oflags &
325 VNET_BUFFER_OFFLOAD_F_TCP_CKSUM))
326 {
327 tcp0->checksum = ip6_tcp_udp_icmp_compute_checksum (
328 vm, b0, ip6_0, &bogus);
329 }
330 if (PREDICT_FALSE (oflags &
331 VNET_BUFFER_OFFLOAD_F_UDP_CKSUM))
332 {
333 udp0->checksum = ip6_tcp_udp_icmp_compute_checksum (
334 vm, b0, ip6_0, &bogus);
335 }
Klement Sekera31da2e32018-06-24 22:49:55 +0200336 }
Mohsin Kazmi68095382021-02-10 11:26:24 +0100337 else
Klement Sekera31da2e32018-06-24 22:49:55 +0200338 {
Mohsin Kazmi68095382021-02-10 11:26:24 +0100339 if (PREDICT_FALSE (oflags &
340 VNET_BUFFER_OFFLOAD_F_IP_CKSUM))
341 {
342 ip0->checksum = ip4_header_checksum (ip0);
343 }
344 if (PREDICT_FALSE (oflags &
345 VNET_BUFFER_OFFLOAD_F_TCP_CKSUM))
346 {
347 tcp0->checksum =
348 ip4_tcp_udp_compute_checksum (vm, b0, ip0);
349 }
350 if (PREDICT_FALSE (oflags &
351 VNET_BUFFER_OFFLOAD_F_UDP_CKSUM))
352 {
353 udp0->checksum =
354 ip4_tcp_udp_compute_checksum (vm, b0, ip0);
355 }
Klement Sekera31da2e32018-06-24 22:49:55 +0200356 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700357 }
Klement Sekera31da2e32018-06-24 22:49:55 +0200358 vlib_buffer_advance (b0, iph_offset);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700359 }
360 else if (p0->policy == IPSEC_POLICY_ACTION_BYPASS)
361 {
362 nc_bypass++;
Matus Fabian08a6f012016-11-15 06:08:51 -0800363 next_node_index = get_next_output_feature_node_index (b0, node);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700364 }
365 else
366 {
367 nc_discard++;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700368 next_node_index = im->error_drop_node_index;
369 }
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800370 vlib_increment_combined_counter
371 (&ipsec_spd_policy_counters, thread_index, pi0, 1, bytes0);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700372 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700373 else
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700374 {
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800375 pi0 = ~0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700376 nc_nomatch++;
377 next_node_index = im->error_drop_node_index;
378 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700379
Ed Warnickecb9cada2015-12-08 15:45:58 -0700380 from += 1;
381 n_left_from -= 1;
382
Damjan Marion3f54b182016-08-16 11:27:02 +0200383 if (PREDICT_FALSE ((last_next_node_index != next_node_index) || f == 0))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700384 {
385 /* if this is not 1st frame */
386 if (f)
387 vlib_put_frame_to_node (vm, last_next_node_index, f);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700388
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700389 last_next_node_index = next_node_index;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700390
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700391 f = vlib_get_frame_to_node (vm, next_node_index);
Kingwel Xie2fab01e2018-10-10 21:03:10 -0400392
393 /* frame->frame_flags, copy it from node */
394 /* Copy trace flag from next_frame and from runtime. */
395 f->frame_flags |= node->flags & VLIB_NODE_FLAG_TRACE;
396
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700397 to_next = vlib_frame_vector_args (f);
398 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700399
400 to_next[0] = bi0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700401 to_next += 1;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700402 f->n_vectors++;
403
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800404 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
405 PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700406 {
407 ipsec_output_trace_t *tr =
408 vlib_add_trace (vm, node, b0, sizeof (*tr));
409 if (spd0)
410 tr->spd_id = spd0->id;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800411 tr->policy_id = pi0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700412 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700413 }
414
415 vlib_put_frame_to_node (vm, next_node_index, f);
Matus Fabian08a6f012016-11-15 06:08:51 -0800416 vlib_node_increment_counter (vm, node->node_index,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700417 IPSEC_OUTPUT_ERROR_POLICY_PROTECT, nc_protect);
Matus Fabian08a6f012016-11-15 06:08:51 -0800418 vlib_node_increment_counter (vm, node->node_index,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700419 IPSEC_OUTPUT_ERROR_POLICY_BYPASS, nc_bypass);
Matus Fabian08a6f012016-11-15 06:08:51 -0800420 vlib_node_increment_counter (vm, node->node_index,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700421 IPSEC_OUTPUT_ERROR_POLICY_DISCARD, nc_discard);
Matus Fabian08a6f012016-11-15 06:08:51 -0800422 vlib_node_increment_counter (vm, node->node_index,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700423 IPSEC_OUTPUT_ERROR_POLICY_NO_MATCH,
424 nc_nomatch);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700425 return from_frame->n_vectors;
426}
427
Klement Sekerab8f35442018-10-29 13:38:19 +0100428VLIB_NODE_FN (ipsec4_output_node) (vlib_main_t * vm,
429 vlib_node_runtime_t * node,
430 vlib_frame_t * frame)
Matus Fabian08a6f012016-11-15 06:08:51 -0800431{
432 return ipsec_output_inline (vm, node, frame, 0);
433}
434
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700435/* *INDENT-OFF* */
Klement Sekerab8f35442018-10-29 13:38:19 +0100436VLIB_REGISTER_NODE (ipsec4_output_node) = {
Pierre Pfister057b3562018-12-10 17:01:01 +0100437 .name = "ipsec4-output-feature",
Ed Warnickecb9cada2015-12-08 15:45:58 -0700438 .vector_size = sizeof (u32),
439 .format_trace = format_ipsec_output_trace,
440 .type = VLIB_NODE_TYPE_INTERNAL,
441
442 .n_errors = ARRAY_LEN(ipsec_output_error_strings),
443 .error_strings = ipsec_output_error_strings,
444
445 .n_next_nodes = IPSEC_OUTPUT_N_NEXT,
446 .next_nodes = {
447#define _(s,n) [IPSEC_OUTPUT_NEXT_##s] = n,
Ed Warnickecb9cada2015-12-08 15:45:58 -0700448 foreach_ipsec_output_next
449#undef _
450 },
451};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700452/* *INDENT-ON* */
Damjan Marione936bbe2016-02-25 23:17:38 +0100453
Klement Sekerab8f35442018-10-29 13:38:19 +0100454VLIB_NODE_FN (ipsec6_output_node) (vlib_main_t * vm,
455 vlib_node_runtime_t * node,
456 vlib_frame_t * frame)
Matus Fabian08a6f012016-11-15 06:08:51 -0800457{
458 return ipsec_output_inline (vm, node, frame, 1);
459}
460
461/* *INDENT-OFF* */
Klement Sekerab8f35442018-10-29 13:38:19 +0100462VLIB_REGISTER_NODE (ipsec6_output_node) = {
Pierre Pfister057b3562018-12-10 17:01:01 +0100463 .name = "ipsec6-output-feature",
Matus Fabian08a6f012016-11-15 06:08:51 -0800464 .vector_size = sizeof (u32),
465 .format_trace = format_ipsec_output_trace,
466 .type = VLIB_NODE_TYPE_INTERNAL,
467
468 .n_errors = ARRAY_LEN(ipsec_output_error_strings),
469 .error_strings = ipsec_output_error_strings,
470
471 .n_next_nodes = IPSEC_OUTPUT_N_NEXT,
472 .next_nodes = {
473#define _(s,n) [IPSEC_OUTPUT_NEXT_##s] = n,
474 foreach_ipsec_output_next
475#undef _
476 },
477};
478/* *INDENT-ON* */
479
Damjan Marione936bbe2016-02-25 23:17:38 +0100480#else /* IPSEC > 1 */
481
482/* Dummy ipsec output node, in case when IPSec is disabled */
483
484static uword
485ipsec_output_node_fn (vlib_main_t * vm,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700486 vlib_node_runtime_t * node, vlib_frame_t * frame)
Damjan Marione936bbe2016-02-25 23:17:38 +0100487{
Damjan Marione936bbe2016-02-25 23:17:38 +0100488 return 0;
489}
490
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700491/* *INDENT-OFF* */
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200492VLIB_REGISTER_NODE (ipsec4_output_node) = {
Damjan Marione936bbe2016-02-25 23:17:38 +0100493 .vector_size = sizeof (u32),
494 .function = ipsec_output_node_fn,
Pierre Pfister057b3562018-12-10 17:01:01 +0100495 .name = "ipsec4-output-feature",
Matus Fabian08a6f012016-11-15 06:08:51 -0800496};
497
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200498VLIB_REGISTER_NODE (ipsec6_output_node) = {
Matus Fabian08a6f012016-11-15 06:08:51 -0800499 .vector_size = sizeof (u32),
500 .function = ipsec_output_node_fn,
Pierre Pfister057b3562018-12-10 17:01:01 +0100501 .name = "ipsec6-output-feature",
Damjan Marione936bbe2016-02-25 23:17:38 +0100502};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700503/* *INDENT-ON* */
Damjan Marione936bbe2016-02-25 23:17:38 +0100504#endif
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700505
506/*
507 * fd.io coding-style-patch-verification: ON
508 *
509 * Local Variables:
510 * eval: (c-set-style "gnu")
511 * End:
512 */