summaryrefslogtreecommitdiffstats
path: root/src/vnet
diff options
context:
space:
mode:
authorMatthew Smith <mgsmith@netgate.com>2018-04-09 11:49:20 -0500
committerDamjan Marion <dmarion.lists@gmail.com>2018-04-10 10:30:11 +0000
commit537eeeca36dcc08a3c337a7cfd1c1c426d43f563 (patch)
tree6a8cf50bef441c1e3277c84a3e9db6866da5f04a /src/vnet
parent13adc3d48d562b13422259d8c7ac411fb43c7e8b (diff)
Make IPsec tunnel intf work with IPv4 output features
With no IPv4 output features on an IPsec tunnel inferface, when packets are forwarded to that interface, they reach the ipsec-if-output node via the output_node_index on the hw interface and they are handled correctly. When an IPv4 output feature (e.g. output ACL, outbound NAT) is enabled on an IPsec tunnel interface, outbound IPsec stops working for that interface. The last node in the ip4-output feature arc is interface-output. From there a packet is sent to ipsec<N>-output, and then ipsec<N>-tx. The tx function for an IPsec tunnel interface that is called by ipsec<N>-tx is a dummy that doesn't do anything except write a warning message. Enable a feature on the interface-output feature arc for an IPsec tunnel interface so the ipsec-if-output node is reached from the interface-output node. Change-Id: Ia9c73d3932f5930ec7ce0791a0375b1d37148b01 Signed-off-by: Matthew Smith <mgsmith@netgate.com>
Diffstat (limited to 'src/vnet')
-rw-r--r--src/vnet/interface_output.c6
-rw-r--r--src/vnet/ipsec/ipsec_if.c7
2 files changed, 13 insertions, 0 deletions
diff --git a/src/vnet/interface_output.c b/src/vnet/interface_output.c
index 563f6149708..fe029b865fa 100644
--- a/src/vnet/interface_output.c
+++ b/src/vnet/interface_output.c
@@ -1089,6 +1089,12 @@ VNET_FEATURE_INIT (span_tx, static) = {
.runs_before = VNET_FEATURES ("interface-tx"),
};
+VNET_FEATURE_INIT (ipsec_if_tx, static) = {
+ .arc_name = "interface-output",
+ .node_name = "ipsec-if-output",
+ .runs_before = VNET_FEATURES ("interface-tx"),
+};
+
VNET_FEATURE_INIT (interface_tx, static) = {
.arc_name = "interface-output",
.node_name = "interface-tx",
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index 0a080819523..852b142717f 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -242,6 +242,9 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
hi->output_node_index = ipsec_if_output_node.index;
t->hw_if_index = hw_if_index;
+ vnet_feature_enable_disable ("interface-output", "ipsec-if-output",
+ hi->sw_if_index, 1, 0, 0);
+
/*1st interface, register protocol */
if (pool_elts (im->tunnel_interfaces) == 1)
ip4_register_protocol (IP_PROTOCOL_IPSEC_ESP,
@@ -259,6 +262,10 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
t = pool_elt_at_index (im->tunnel_interfaces, p[0]);
hi = vnet_get_hw_interface (vnm, t->hw_if_index);
vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
+
+ vnet_feature_enable_disable ("interface-output", "ipsec-if-output",
+ hi->sw_if_index, 0, 0, 0);
+
vec_add1 (im->free_tunnel_if_indices, t->hw_if_index);
vnet_interface_counter_lock (vim);