ipsec: add support for tx-table-id in cli + example

Type: improvement

Change-Id: I840741dfe040718b682935cdbcb0ba958d45a591
Signed-off-by: Benoît Ganne <bganne@cisco.com>
(cherry picked from commit 40aa27ef7cf63daa11974d0b06ea9ee1a102cb32)

3 files changed, 89 insertions, 3 deletions

diff --git a/src/scripts/vnet/ipsec_spd_vrf b/src/scripts/vnet/ipsec_spd_vrf
new file mode 100644
index 00000000000..faa891dc2c4
--- /dev/null
+++ b/src/scripts/vnet/ipsec_spd_vrf
@@ -0,0 +1,72 @@
+
+create packet-generator interface pg0
+set int mac addr pg0 4.5.6
+
+create sub-interfaces pg0 1
+create sub-interfaces pg0 2
+create sub-interfaces pg0 3
+
+ip table add 1
+ip table add 2
+ip table add 3
+
+set int ip table pg0.1 1
+set int ip table pg0.2 2
+set int ip table pg0.3 3
+
+set int ip address pg0.1 192.168.0.1/24
+set int ip address pg0.2 192.168.0.1/24
+set int ip address pg0.3 192.168.0.1/24
+
+set int state pg0 up
+set int state pg0.1 up
+set int state pg0.2 up
+set int state pg0.3 up
+
+ipsec sa add 2 spi 2 crypto-key 6541686776336961656264656f6f6579 crypto-alg aes-cbc-128 tunnel-src 192.168.0.1 tunnel-dst 192.168.0.2 tx-table-id 2
+ipsec sa add 3 spi 3 crypto-key 6541686776336961656264656f6f6579 crypto-alg aes-cbc-128 tunnel-src 192.168.0.1 tunnel-dst 192.168.0.2 tx-table-id 3
+
+ipsec spd add 1
+set interface ipsec spd pg0.1 1
+ipsec policy add spd 1 priority 100 outbound action bypass protocol 50
+ipsec policy add spd 1 priority 10 outbound action protect sa 2 local-ip-range 10.5.0.0 - 10.5.0.255 remote-ip-range 10.6.0.0 - 10.6.0.16
+ipsec policy add spd 1 priority 10 outbound action protect sa 3 local-ip-range 10.5.0.0 - 10.5.0.255 remote-ip-range 10.6.0.17 - 10.6.0.32
+
+ip route table 1 add 10.6.0.0/16 via 192.168.0.2 pg0.1
+set ip neighbor pg0.1 192.168.0.2 00:11:22:33:44:55
+set ip neighbor pg0.2 192.168.0.2 00:11:22:33:44:55
+set ip neighbor pg0.3 192.168.0.2 00:11:22:33:44:55
+
+trace add pg-input 100
+
+packet-generator new {
+  name ipsec2
+  limit 1
+  rate 1e4
+  node ethernet-input
+  interface pg0
+  size 100-100
+  data {
+   IP4: 1.2.3 -> 4.5.6 vlan 1
+   UDP: 10.5.0.1 -> 10.6.0.1
+   UDP: 4321 -> 1234
+    length 72
+    incrementing 100
+  }
+}
+
+packet-generator new {
+  name ipsec3
+  limit 1
+  rate 1e4
+  node ethernet-input
+  interface pg0
+  size 100-100
+  data {
+   IP4: 1.2.3 -> 4.5.6 vlan 1
+   UDP: 10.5.0.1 -> 10.6.0.22
+   UDP: 4321 -> 1234
+    length 72
+    incrementing 100
+  }
+}
diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index 0d1ab033aec..03727855b4f 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -36,6 +36,7 @@ set_interface_spd_command_fn (vlib_main_t * vm,
   u32 spd_id;
   int is_add = 1;
   clib_error_t *error = NULL;
+  int err;
 
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -53,7 +54,16 @@ set_interface_spd_command_fn (vlib_main_t * vm,
       goto done;
     }
 
-  ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
+  err = ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
+  switch (err)
+    {
+    case VNET_API_ERROR_SYSCALL_ERROR_1:
+      error = clib_error_return (0, "no such spd-id");
+      break;
+    case VNET_API_ERROR_SYSCALL_ERROR_2:
+      error = clib_error_return (0, "spd already assigned");
+      break;
+    }
 
 done:
   unformat_free (line_input);
@@ -90,6 +100,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
   u16 udp_src, udp_dst;
   int is_add, rv;
   u32 m_args = 0;
+  u32 tx_table_id;
 
   salt = 0;
   error = NULL;
@@ -99,6 +110,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
   integ_alg = IPSEC_INTEG_ALG_NONE;
   crypto_alg = IPSEC_CRYPTO_ALG_NONE;
   udp_src = udp_dst = IPSEC_UDP_PORT_NONE;
+  tx_table_id = 0;
 
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -144,6 +156,8 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
       else if (unformat (line_input, "tunnel-dst %U",
 			 unformat_ip46_address, &tun_dst, IP46_TYPE_ANY))
 	;
+      else if (unformat (line_input, "tx-table-id %d", &tx_table_id))
+	;
       else if (unformat (line_input, "inbound"))
 	flags |= IPSEC_SA_FLAG_IS_INBOUND;
       else if (unformat (line_input, "use-anti-replay"))
@@ -181,7 +195,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
 	}
       rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg,
 				  &ck, integ_alg, &ik, flags,
-				  0, clib_host_to_net_u32 (salt),
+				  tx_table_id, clib_host_to_net_u32 (salt),
 				  &tun_src, &tun_dst, &sai, udp_src, udp_dst);
     }
   else
diff --git a/src/vnet/ipsec/ipsec_spd.c b/src/vnet/ipsec/ipsec_spd.c
index ef41c2286c1..4e8017c35ff 100644
--- a/src/vnet/ipsec/ipsec_spd.c
+++ b/src/vnet/ipsec/ipsec_spd.c
@@ -77,7 +77,7 @@ ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
 
   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
   if (p && is_add)
-    return VNET_API_ERROR_SYSCALL_ERROR_1;	/* spd already assigned */
+    return VNET_API_ERROR_SYSCALL_ERROR_2;	/* spd already assigned */
 
   if (is_add)
     {