diff options
| author |   Neale Ranns <nranns@cisco.com> | 2019-04-02 10:15:40 +0000 |
|---|---|---|
| committer |   Damjan Marion <dmarion@me.com> | 2019-04-02 14:10:10 +0000 |
| commit | 2b5ba9501c3dda3645bf01eb53b2821471f2a946 (patch) | |
| tree | e58a8ae09ba1ee08053c39422e7dd80805409d8b /src/vnet/ipsec/ipsec_sa.c | |
| parent | ea5bb7761d5f939174e9ee416adbbba5946cc0a4 (diff) | |
IPSEC: tunnel scaling - don't stack the inbould SA
Change-Id: I0b47590400aebea09aa1b27de753be638e1ba870
Signed-off-by: Neale Ranns <nranns@cisco.com>
Diffstat (limited to 'src/vnet/ipsec/ipsec_sa.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec_sa.c | 16 |
1 files changed, 3 insertions, 13 deletions
diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c index 9f2d8505c35..0ca2f376c67 100644 --- a/src/vnet/ipsec/ipsec_sa.c +++ b/src/vnet/ipsec/ipsec_sa.c @@ -149,6 +149,7 @@ ipsec_sa_add (u32 id, sa->spi = spi; sa->stat_index = sa_index; sa->protocol = proto; + sa->flags = flags; ipsec_sa_set_crypto_alg (sa, crypto_alg); clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key)); ipsec_sa_set_integ_alg (sa, integ_alg); @@ -156,17 +157,6 @@ ipsec_sa_add (u32 id, ip46_address_copy (&sa->tunnel_src_addr, tun_src); ip46_address_copy (&sa->tunnel_dst_addr, tun_dst); - if (flags & IPSEC_SA_FLAG_USE_ESN) - ipsec_sa_set_USE_ESN (sa); - if (flags & IPSEC_SA_FLAG_USE_ANTI_REPLAY) - ipsec_sa_set_USE_ANTI_REPLAY (sa); - if (flags & IPSEC_SA_FLAG_IS_TUNNEL) - ipsec_sa_set_IS_TUNNEL (sa); - if (flags & IPSEC_SA_FLAG_IS_TUNNEL_V6) - ipsec_sa_set_IS_TUNNEL_V6 (sa); - if (flags & IPSEC_SA_FLAG_UDP_ENCAP) - ipsec_sa_set_UDP_ENCAP (sa); - err = ipsec_check_support_cb (im, sa); if (err) { @@ -182,7 +172,7 @@ ipsec_sa_add (u32 id, return VNET_API_ERROR_SYSCALL_ERROR_1; } - if (ipsec_sa_is_set_IS_TUNNEL (sa)) + if (ipsec_sa_is_set_IS_TUNNEL (sa) && !ipsec_sa_is_set_IS_INBOUND (sa)) { fib_protocol_t fproto = (ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4); @@ -280,7 +270,7 @@ ipsec_sa_del (u32 id) if (err) return VNET_API_ERROR_SYSCALL_ERROR_1; - if (ipsec_sa_is_set_IS_TUNNEL (sa)) + if (ipsec_sa_is_set_IS_TUNNEL (sa) && !ipsec_sa_is_set_IS_INBOUND (sa)) { fib_entry_child_remove (sa->fib_entry_index, sa->sibling); fib_table_entry_special_remove |