summaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec/ipsec_output.c
diff options
context:
space:
mode:
authorPiotr Bronowski <piotrx.bronowski@intel.com>2022-05-10 14:06:29 +0000
committerPiotr Bronowski <piotrx.bronowski@intel.com>2022-06-29 09:10:33 +0000
commite1dce37588c4f144e5be0b5bd0fb900b4adda117 (patch)
tree17cf45fd61230c2ff1fa6ecf913131ea2582be91 /src/vnet/ipsec/ipsec_output.c
parent829bff853e534d46a68d3499ee6a4df0ccb62700 (diff)
ipsec: add spd fast path matching
This patch adds matching functionality for spd fast path policy matching. Fast path matching has been introduced for outbound traffic only. Type: feature Signed-off-by: Piotr Bronowski <piotrx.bronowski@intel.com> Change-Id: I03d5edf7d7fbc03bf3e6edbe33cb15bc965f9d4e
Diffstat (limited to 'src/vnet/ipsec/ipsec_output.c')
-rw-r--r--src/vnet/ipsec/ipsec_output.c26
1 files changed, 26 insertions, 0 deletions
diff --git a/src/vnet/ipsec/ipsec_output.c b/src/vnet/ipsec/ipsec_output.c
index d2eb412bb18..96c6f27fee1 100644
--- a/src/vnet/ipsec/ipsec_output.c
+++ b/src/vnet/ipsec/ipsec_output.c
@@ -74,6 +74,20 @@ ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la,
return 0;
}
+always_inline void
+ipsec_fp_5tuple_from_ip6_range (ipsec_fp_5tuple_t *tuple, ip6_address_t *la,
+ ip6_address_t *ra, u16 lp, u16 rp, u8 pr)
+
+{
+ clib_memcpy_fast (&tuple->ip6_laddr, la, sizeof (ip6_address_t));
+ clib_memcpy_fast (&tuple->ip6_laddr, la, sizeof (ip6_address_t));
+
+ tuple->lport = lp;
+ tuple->rport = rp;
+ tuple->protocol = pr;
+ tuple->is_ipv6 = 1;
+}
+
always_inline ipsec_policy_t *
ipsec6_output_policy_match (ipsec_spd_t * spd,
ip6_address_t * la,
@@ -81,12 +95,24 @@ ipsec6_output_policy_match (ipsec_spd_t * spd,
{
ipsec_main_t *im = &ipsec_main;
ipsec_policy_t *p;
+ ipsec_policy_t *policies[1];
+ ipsec_fp_5tuple_t tuples[1];
+ u32 fp_policy_ids[1];
u32 *i;
if (!spd)
return 0;
+ ipsec_fp_5tuple_from_ip6_range (&tuples[0], la, ra, lp, rp, pr);
+ if (im->fp_spd_is_enabled &&
+ (0 == ipsec_fp_out_policy_match_n (&spd->fp_spd, 1, tuples, policies,
+ fp_policy_ids, 1)))
+ {
+ p = policies[0];
+ i = fp_policy_ids;
+ }
+
vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_OUTBOUND])
{
p = pool_elt_at_index (im->policies, *i);