ipsec: IPSec interface correct drop w/ no protection - vpp

diff options

author	Neale Ranns <neale@graphiant.com>	2022-01-10 10:38:43 +0000
committer	Matthew Smith <mgsmith@netgate.com>	2022-01-17 19:55:13 +0000
commit	49378f206b8e780a898e632f7dd8db912b9b118e (patch)
tree	35c6629f14b753878251fe92d5afcdd9c837554b /src/vnet/ip/ip4_to_ip6.h
parent	88a9c0e02ab919cadd4e035133995a6afb4d1c32 (diff)

ipsec: IPSec interface correct drop w/ no protection

Type: improvement When an IPSec interface is first constructed, the end node of the feature arc is not changed, which means it is interface-output. This means that traffic directed into adjacencies on the link, that do not have protection (w/ an SA), drop like this: ... 00:00:01:111710: ip4-midchain tx_sw_if_index 4 dpo-idx 24 : ipv4 via 0.0.0.0 ipsec0: mtu:9000 next:6 flags:[] stacked-on: [@1]: dpo-drop ip4 flow hash: 0x00000000 00000000: 4500005c000100003f01cb8cac100202010101010800ecf40000000058585858 00000020: 58585858585858585858585858585858585858585858585858585858 00:00:01:111829: local0-output ipsec0 00000000: 4500005c000100003f01cb8cac100202010101010800ecf40000000058585858 00000020: 5858585858585858585858585858585858585858585858585858585858585858 00000040: 58585858585858585858585858585858585858585858585858585858c2cf08c0 00000060: 2a2c103cd0126bd8b03c4ec20ce2bd02dd77b3e3a4f49664 00:00:01:112017: error-drop rx:pg1 00:00:01:112034: drop local0-output: interface is down although that's a drop, no packets should go to local0, and we want all IPvX packets to go through ipX-drop. This change sets the interface's end-arc node to the appropriate drop node when the interface is created, and when the last protection is removed. The resulting drop is: ... 00:00:01:111504: ip4-midchain tx_sw_if_index 4 dpo-idx 24 : ipv4 via 0.0.0.0 ipsec0: mtu:9000 next:0 flags:[] stacked-on: [@1]: dpo-drop ip4 flow hash: 0x00000000 00000000: 4500005c000100003f01cb8cac100202010101010800ecf40000000058585858 00000020: 58585858585858585858585858585858585858585858585858585858 00:00:01:111533: ip4-drop ICMP: 172.16.2.2 -> 1.1.1.1 tos 0x00, ttl 63, length 92, checksum 0xcb8c dscp CS0 ecn NON_ECN fragment id 0x0001 ICMP echo_request checksum 0xecf4 id 0 00:00:01:111620: error-drop rx:pg1 00:00:01:111640: drop null-node: blackholed packets Signed-off-by: Neale Ranns <neale@graphiant.com> Change-Id: I7e7de23c541d9f1210a05e6984a688f1f821a155

Diffstat (limited to 'src/vnet/ip/ip4_to_ip6.h')

0 files changed, 0 insertions, 0 deletions

/* * Copyright (c) 2016 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #undef BIHASH_TYPE #undef BIHASH_KVP_PER_PAGE #define BIHASH_TYPE _48_8 #define BIHASH_KVP_PER_PAGE 4 #ifndef __included_bihash_48_8_h__ #define __included_bihash_48_8_h__ #include <vppinfra/crc32.h> #include <vppinfra/heap.h> #include <vppinfra/format.h> #include <vppinfra/pool.h> #include <vppinfra/xxhash.h> typedef struct { u64 key[6]; u64 value; } clib_bihash_kv_48_8_t; static inline int clib_bihash_is_free_48_8 (const clib_bihash_kv_48_8_t * v) { /* Free values are clib_memset to 0xff, check a bit... */ if (v->key[0] == ~0ULL && v->value == ~0ULL) return 1; return 0; } static inline u64 clib_bihash_hash_48_8 (const clib_bihash_kv_48_8_t * v) { #ifdef clib_crc32c_uses_intrinsics return clib_crc32c ((u8 *) v->key, 48); #else u64 tmp = v->key[0] ^ v->key[1] ^ v->key[2] ^ v->key[3] ^ v->key[4] ^ v->key[5]; return clib_xxhash (tmp); #endif } static inline u8 * format_bihash_kvp_48_8 (u8 * s, va_list * args) { clib_bihash_kv_48_8_t *v = va_arg (*args, clib_bihash_kv_48_8_t *); s = format (s, "key %llu %llu %llu %llu %llu %llu value %llu", v->key[0], v->key[1], v->key[2], v->key[3], v->key[4], v->key[5], v->value); return s; } static inline int clib_bihash_key_compare_48_8 (u64 * a, u64 * b) { #if defined (CLIB_HAVE_VEC512) u64x8 v = u64x8_load_unaligned (a) ^ u64x8_load_unaligned (b); return (u64x8_is_zero_mask (v) & 0x3f) == 0; #elif defined (CLIB_HAVE_VEC256) u64x4 v = { 0 }; v = u64x4_insert_lo (v, u64x2_load_unaligned (a + 4) ^ u64x2_load_unaligned (b + 4)); v |= u64x4_load_unaligned (a) ^ u64x4_load_unaligned (b); return u64x4_is_all_zero (v); #elif defined(CLIB_HAVE_VEC128) && defined(CLIB_HAVE_VEC128_UNALIGNED_LOAD_STORE) u64x2 v; v = u64x2_load_unaligned (a) ^ u64x2_load_unaligned (b); v |= u64x2_load_unaligned (a + 2) ^ u64x2_load_unaligned (b + 2); v |= u64x2_load_unaligned (a + 4) ^ u64x2_load_unaligned (b + 4); return u64x2_is_all_zero (v); #else return ((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2]) | (a[3] ^ b[3]) | (a[4] ^ b[4]) | (a[5] ^ b[5])) == 0; #endif } #undef __included_bihash_template_h__ #include <vppinfra/bihash_template.h> #endif /* __included_bihash_48_8_h__ */ /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */


context:
space:
mode: