aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorNeale Ranns <neale@graphiant.com>2021-02-25 16:01:28 +0000
committerFlorin Coras <florin.coras@gmail.com>2021-02-26 02:12:06 +0000
commitc5fe57dac12a46fa618259643909afaec1ac5aae (patch)
tree6962f3f1a8d10f2f30f0884889aaa379d0d3e509 /src
parentcc9a1a0d39f22f653801f5d08bfe4892325254b5 (diff)
ipsec: move the IPSec SA pool out of ipsec_main
Type: refactor this allows the ipsec_sa_get funtion to be moved from ipsec.h to ipsec_sa.h where it belongs. Also use ipsec_sa_get throughout the code base. Signed-off-by: Neale Ranns <neale@graphiant.com> Change-Id: I2dce726c4f7052b5507dd8dcfead0ed5604357df
Diffstat (limited to 'src')
-rw-r--r--src/plugins/dpdk/ipsec/esp_decrypt.c6
-rw-r--r--src/plugins/dpdk/ipsec/esp_encrypt.c2
-rw-r--r--src/plugins/dpdk/ipsec/ipsec.c4
-rw-r--r--src/plugins/ikev2/ikev2.c8
-rw-r--r--src/plugins/unittest/ipsec_test.c3
-rw-r--r--src/vnet/ipsec/ah_decrypt.c7
-rw-r--r--src/vnet/ipsec/ah_encrypt.c4
-rw-r--r--src/vnet/ipsec/esp_decrypt.c12
-rw-r--r--src/vnet/ipsec/esp_encrypt.c2
-rw-r--r--src/vnet/ipsec/ipsec.c27
-rw-r--r--src/vnet/ipsec/ipsec.h9
-rw-r--r--src/vnet/ipsec/ipsec_api.c15
-rw-r--r--src/vnet/ipsec/ipsec_cli.c19
-rw-r--r--src/vnet/ipsec/ipsec_format.c5
-rw-r--r--src/vnet/ipsec/ipsec_input.c4
-rw-r--r--src/vnet/ipsec/ipsec_output.c2
-rw-r--r--src/vnet/ipsec/ipsec_sa.c42
-rw-r--r--src/vnet/ipsec/ipsec_sa.h12
18 files changed, 85 insertions, 98 deletions
diff --git a/src/plugins/dpdk/ipsec/esp_decrypt.c b/src/plugins/dpdk/ipsec/esp_decrypt.c
index 4981de33457..9a782abeb94 100644
--- a/src/plugins/dpdk/ipsec/esp_decrypt.c
+++ b/src/plugins/dpdk/ipsec/esp_decrypt.c
@@ -98,7 +98,6 @@ dpdk_esp_decrypt_inline (vlib_main_t * vm,
vlib_frame_t * from_frame, int is_ip6)
{
u32 n_left_from, *from, *to_next, next_index, thread_index;
- ipsec_main_t *im = &ipsec_main;
u32 thread_idx = vlib_get_thread_index ();
dpdk_crypto_main_t *dcm = &dpdk_crypto_main;
crypto_resource_t *res = 0;
@@ -181,7 +180,7 @@ dpdk_esp_decrypt_inline (vlib_main_t * vm,
if (sa_index0 != last_sa_index)
{
- sa0 = pool_elt_at_index (im->sad, sa_index0);
+ sa0 = ipsec_sa_get (sa_index0);
cipher_alg =
vec_elt_at_index (dcm->cipher_algs, sa0->crypto_alg);
@@ -498,7 +497,6 @@ dpdk_esp_decrypt_post_inline (vlib_main_t * vm,
u32 n_left_from, *from, *to_next = 0, next_index;
ipsec_sa_t *sa0;
u32 sa_index0 = ~0;
- ipsec_main_t *im = &ipsec_main;
dpdk_crypto_main_t *dcm = &dpdk_crypto_main;
from = vlib_frame_vector_args (from_frame);
@@ -535,7 +533,7 @@ dpdk_esp_decrypt_post_inline (vlib_main_t * vm,
esp0 = vlib_buffer_get_current (b0);
sa_index0 = vnet_buffer (b0)->ipsec.sad_index;
- sa0 = pool_elt_at_index (im->sad, sa_index0);
+ sa0 = ipsec_sa_get (sa_index0);
to_next[0] = bi0;
to_next += 1;
diff --git a/src/plugins/dpdk/ipsec/esp_encrypt.c b/src/plugins/dpdk/ipsec/esp_encrypt.c
index f50291fcf2f..157c93f417e 100644
--- a/src/plugins/dpdk/ipsec/esp_encrypt.c
+++ b/src/plugins/dpdk/ipsec/esp_encrypt.c
@@ -229,7 +229,7 @@ dpdk_esp_encrypt_inline (vlib_main_t * vm,
if (sa_index0 != last_sa_index)
{
- sa0 = pool_elt_at_index (im->sad, sa_index0);
+ sa0 = ipsec_sa_get (sa_index0);
cipher_alg =
vec_elt_at_index (dcm->cipher_algs, sa0->crypto_alg);
diff --git a/src/plugins/dpdk/ipsec/ipsec.c b/src/plugins/dpdk/ipsec/ipsec.c
index 5d9e10b3aa5..e260ba7dcc4 100644
--- a/src/plugins/dpdk/ipsec/ipsec.c
+++ b/src/plugins/dpdk/ipsec/ipsec.c
@@ -325,7 +325,6 @@ create_sym_session (struct rte_cryptodev_sym_session **session,
crypto_worker_main_t * cwm, u8 is_outbound)
{
dpdk_crypto_main_t *dcm = &dpdk_crypto_main;
- ipsec_main_t *im = &ipsec_main;
crypto_data_t *data;
ipsec_sa_t *sa;
struct rte_crypto_sym_xform cipher_xform = { 0 };
@@ -334,8 +333,7 @@ create_sym_session (struct rte_cryptodev_sym_session **session,
struct rte_cryptodev_sym_session **s;
clib_error_t *error = 0;
-
- sa = pool_elt_at_index (im->sad, sa_idx);
+ sa = ipsec_sa_get (sa_idx);
if ((sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128) |
(sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_192) |
diff --git a/src/plugins/ikev2/ikev2.c b/src/plugins/ikev2/ikev2.c
index aaebf625ab2..7c57f22d5a3 100644
--- a/src/plugins/ikev2/ikev2.c
+++ b/src/plugins/ikev2/ikev2.c
@@ -5074,7 +5074,6 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
vlib_frame_t * f)
{
ikev2_main_t *km = &ikev2_main;
- ipsec_main_t *im = &ipsec_main;
ikev2_profile_t *p;
ikev2_child_sa_t *c;
u32 *sai;
@@ -5148,9 +5147,10 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
/* process ipsec sas */
ipsec_sa_t *sa;
/* *INDENT-OFF* */
- pool_foreach (sa, im->sad) {
- ikev2_mngr_process_ipsec_sa(sa);
- }
+ pool_foreach (sa, ipsec_sa_pool)
+ {
+ ikev2_mngr_process_ipsec_sa (sa);
+ }
/* *INDENT-ON* */
ikev2_process_pending_sa_init (km);
diff --git a/src/plugins/unittest/ipsec_test.c b/src/plugins/unittest/ipsec_test.c
index c40e954786d..0e9865052b4 100644
--- a/src/plugins/unittest/ipsec_test.c
+++ b/src/plugins/unittest/ipsec_test.c
@@ -38,12 +38,11 @@ test_ipsec_command_fn (vlib_main_t * vm,
if (~0 != sa_id)
{
- ipsec_main_t *im = &ipsec_main;
ipsec_sa_t *sa;
u32 sa_index;
sa_index = ipsec_sa_find_and_lock (sa_id);
- sa = pool_elt_at_index (im->sad, sa_index);
+ sa = ipsec_sa_get (sa_index);
sa->seq = seq_num & 0xffffffff;
sa->seq_hi = seq_num >> 32;
diff --git a/src/vnet/ipsec/ah_decrypt.c b/src/vnet/ipsec/ah_decrypt.c
index a5e277ee09f..d192fb6b80a 100644
--- a/src/vnet/ipsec/ah_decrypt.c
+++ b/src/vnet/ipsec/ah_decrypt.c
@@ -169,7 +169,7 @@ ah_decrypt_inline (vlib_main_t * vm,
current_sa_pkts,
current_sa_bytes);
current_sa_index = vnet_buffer (b[0])->ipsec.sad_index;
- sa0 = pool_elt_at_index (im->sad, current_sa_index);
+ sa0 = ipsec_sa_get (current_sa_index);
current_sa_bytes = current_sa_pkts = 0;
vlib_prefetch_combined_counter (&ipsec_sa_counters,
@@ -317,7 +317,7 @@ ah_decrypt_inline (vlib_main_t * vm,
if (next[0] < AH_DECRYPT_N_NEXT)
goto trace;
- sa0 = vec_elt_at_index (im->sad, pd->sa_index);
+ sa0 = ipsec_sa_get (pd->sa_index);
if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE))
{
@@ -399,8 +399,7 @@ ah_decrypt_inline (vlib_main_t * vm,
trace:
if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
{
- sa0 = pool_elt_at_index (im->sad,
- vnet_buffer (b[0])->ipsec.sad_index);
+ sa0 = ipsec_sa_get (vnet_buffer (b[0])->ipsec.sad_index);
ah_decrypt_trace_t *tr =
vlib_add_trace (vm, node, b[0], sizeof (*tr));
tr->integ_alg = sa0->integ_alg;
diff --git a/src/vnet/ipsec/ah_encrypt.c b/src/vnet/ipsec/ah_encrypt.c
index a1f233cfda9..c962ea90387 100644
--- a/src/vnet/ipsec/ah_encrypt.c
+++ b/src/vnet/ipsec/ah_encrypt.c
@@ -176,7 +176,7 @@ ah_encrypt_inline (vlib_main_t * vm,
current_sa_pkts,
current_sa_bytes);
current_sa_index = vnet_buffer (b[0])->ipsec.sad_index;
- sa0 = pool_elt_at_index (im->sad, current_sa_index);
+ sa0 = ipsec_sa_get (current_sa_index);
current_sa_bytes = current_sa_pkts = 0;
}
@@ -387,7 +387,7 @@ ah_encrypt_inline (vlib_main_t * vm,
next:
if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
{
- sa0 = vec_elt_at_index (im->sad, pd->sa_index);
+ sa0 = ipsec_sa_get (pd->sa_index);
ah_encrypt_trace_t *tr =
vlib_add_trace (vm, node, b[0], sizeof (*tr));
tr->spi = sa0->spi;
diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index 274fbf810c0..80ce08bf853 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -750,8 +750,7 @@ esp_decrypt_post_crypto (vlib_main_t * vm, vlib_node_runtime_t * node,
esp_decrypt_packet_data2_t * pd2, vlib_buffer_t * b,
u16 * next, int is_ip6, int is_tun, int is_async)
{
- ipsec_main_t *im = &ipsec_main;
- ipsec_sa_t *sa0 = vec_elt_at_index (im->sad, pd->sa_index);
+ ipsec_sa_t *sa0 = ipsec_sa_get (pd->sa_index);
vlib_buffer_t *lb = b;
const u8 esp_sz = sizeof (esp_header_t);
const u8 tun_flags = IPSEC_SA_FLAG_IS_TUNNEL | IPSEC_SA_FLAG_IS_TUNNEL_V6;
@@ -1086,7 +1085,7 @@ esp_decrypt_inline (vlib_main_t * vm,
current_sa_bytes = current_sa_pkts = 0;
current_sa_index = vnet_buffer (b[0])->ipsec.sad_index;
- sa0 = pool_elt_at_index (im->sad, current_sa_index);
+ sa0 = ipsec_sa_get (current_sa_index);
/* fetch the second cacheline ASAP */
CLIB_PREFETCH (sa0->cacheline1, CLIB_CACHE_LINE_BYTES, LOAD);
@@ -1295,7 +1294,7 @@ esp_decrypt_inline (vlib_main_t * vm,
{
esp_decrypt_trace_t *tr;
tr = vlib_add_trace (vm, node, b[0], sizeof (*tr));
- sa0 = pool_elt_at_index (im->sad, current_sa_index);
+ sa0 = ipsec_sa_get (current_sa_index);
tr->crypto_alg = sa0->crypto_alg;
tr->integ_alg = sa0->integ_alg;
tr->seq = pd->seq;
@@ -1325,7 +1324,6 @@ esp_decrypt_post_inline (vlib_main_t * vm,
vlib_node_runtime_t * node,
vlib_frame_t * from_frame, int is_ip6, int is_tun)
{
- ipsec_main_t *im = &ipsec_main;
u32 *from = vlib_frame_vector_args (from_frame);
u32 n_left = from_frame->n_vectors;
vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
@@ -1355,12 +1353,12 @@ esp_decrypt_post_inline (vlib_main_t * vm,
/*trace: */
if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
{
- ipsec_sa_t *sa0 = pool_elt_at_index (im->sad, pd->sa_index);
+ ipsec_sa_t *sa0 = ipsec_sa_get (pd->sa_index);
esp_decrypt_trace_t *tr;
esp_decrypt_packet_data_t *async_pd =
&(esp_post_data (b[0]))->decrypt_data;
tr = vlib_add_trace (vm, node, b[0], sizeof (*tr));
- sa0 = pool_elt_at_index (im->sad, async_pd->sa_index);
+ sa0 = ipsec_sa_get (async_pd->sa_index);
tr->crypto_alg = sa0->crypto_alg;
tr->integ_alg = sa0->integ_alg;
diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index 8251e82d4ba..16bca1da536 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -646,7 +646,7 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node,
current_sa_bytes);
current_sa_packets = current_sa_bytes = 0;
- sa0 = pool_elt_at_index (im->sad, sa_index0);
+ sa0 = ipsec_sa_get (sa_index0);
/* fetch the second cacheline ASAP */
CLIB_PREFETCH (sa0->cacheline1, CLIB_CACHE_LINE_BYTES, LOAD);
diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c
index 84d2293d482..45ae5acd4b0 100644
--- a/src/vnet/ipsec/ipsec.c
+++ b/src/vnet/ipsec/ipsec.c
@@ -246,10 +246,9 @@ clib_error_t *
ipsec_rsc_in_use (ipsec_main_t * im)
{
/* return an error is crypto resource are in use */
- if (pool_elts (im->sad) > 0)
- return clib_error_return (0,
- "%d SA entries configured",
- pool_elts (im->sad));
+ if (pool_elts (ipsec_sa_pool) > 0)
+ return clib_error_return (0, "%d SA entries configured",
+ pool_elts (ipsec_sa_pool));
return (NULL);
}
@@ -331,20 +330,20 @@ ipsec_set_async_mode (u32 is_enabled)
ipsec_sa_t *sa;
/* lock all SAs before change im->async_mode */
- pool_foreach (sa, im->sad)
- {
- fib_node_lock (&sa->node);
- }
+ pool_foreach (sa, ipsec_sa_pool)
+ {
+ fib_node_lock (&sa->node);
+ }
im->async_mode = is_enabled;
/* change SA crypto op data before unlock them */
- pool_foreach (sa, im->sad)
- {
- sa->crypto_op_data = is_enabled ?
- sa->async_op_data.data : sa->sync_op_data.data;
- fib_node_unlock (&sa->node);
- }
+ pool_foreach (sa, ipsec_sa_pool)
+ {
+ sa->crypto_op_data =
+ is_enabled ? sa->async_op_data.data : sa->sync_op_data.data;
+ fib_node_unlock (&sa->node);
+ }
}
static void
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index 7e897686c66..7ca15866a14 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -108,8 +108,6 @@ typedef struct
{
/* pool of tunnel instances */
ipsec_spd_t *spds;
- /* Pool of security associations */
- ipsec_sa_t *sad;
/* pool of policies */
ipsec_policy_t *policies;
@@ -230,7 +228,6 @@ extern vlib_node_registration_t ipsec6_tun_input_node;
/*
* functions
*/
-u8 *format_ipsec_replay_window (u8 * s, va_list * args);
/*
* inline functions
@@ -274,12 +271,6 @@ int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx);
clib_error_t *ipsec_rsc_in_use (ipsec_main_t * im);
void ipsec_set_async_mode (u32 is_enabled);
-always_inline ipsec_sa_t *
-ipsec_sa_get (u32 sa_index)
-{
- return (pool_elt_at_index (ipsec_main.sad, sa_index));
-}
-
extern void ipsec_register_udp_port (u16 udp_port);
extern void ipsec_unregister_udp_port (u16 udp_port);
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index a3e0545c1b5..45e4e6f0703 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -805,7 +805,6 @@ send_ipsec_sa_details (ipsec_sa_t * sa, void *arg)
{
ipsec_dump_walk_ctx_t *ctx = arg;
vl_api_ipsec_sa_details_t *mp;
- ipsec_main_t *im = &ipsec_main;
mp = vl_msg_api_alloc (sizeof (*mp));
clib_memset (mp, 0, sizeof (*mp));
@@ -829,8 +828,8 @@ send_ipsec_sa_details (ipsec_sa_t * sa, void *arg)
if (ipsec_sa_is_set_IS_PROTECT (sa))
{
ipsec_sa_dump_match_ctx_t ctx = {
- .sai = sa - im->sad,
- .sw_if_index = ~0,
+ .sai = sa - ipsec_sa_pool,
+ .sw_if_index = ~0,
};
ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
@@ -894,7 +893,6 @@ send_ipsec_sa_v2_details (ipsec_sa_t * sa, void *arg)
{
ipsec_dump_walk_ctx_t *ctx = arg;
vl_api_ipsec_sa_v2_details_t *mp;
- ipsec_main_t *im = &ipsec_main;
mp = vl_msg_api_alloc (sizeof (*mp));
clib_memset (mp, 0, sizeof (*mp));
@@ -918,8 +916,8 @@ send_ipsec_sa_v2_details (ipsec_sa_t * sa, void *arg)
if (ipsec_sa_is_set_IS_PROTECT (sa))
{
ipsec_sa_dump_match_ctx_t ctx = {
- .sai = sa - im->sad,
- .sw_if_index = ~0,
+ .sai = sa - ipsec_sa_pool,
+ .sw_if_index = ~0,
};
ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
@@ -987,7 +985,6 @@ send_ipsec_sa_v3_details (ipsec_sa_t *sa, void *arg)
{
ipsec_dump_walk_ctx_t *ctx = arg;
vl_api_ipsec_sa_v3_details_t *mp;
- ipsec_main_t *im = &ipsec_main;
mp = vl_msg_api_alloc (sizeof (*mp));
clib_memset (mp, 0, sizeof (*mp));
@@ -1010,7 +1007,7 @@ send_ipsec_sa_v3_details (ipsec_sa_t *sa, void *arg)
if (ipsec_sa_is_set_IS_PROTECT (sa))
{
ipsec_sa_dump_match_ctx_t ctx = {
- .sai = sa - im->sad,
+ .sai = sa - ipsec_sa_pool,
.sw_if_index = ~0,
};
ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
@@ -1120,7 +1117,7 @@ vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp)
vl_api_ipsec_select_backend_reply_t *rmp;
ipsec_protocol_t protocol;
int rv = 0;
- if (pool_elts (im->sad) > 0)
+ if (pool_elts (ipsec_sa_pool) > 0)
{
rv = VNET_API_ERROR_INSTANCE_IN_USE;
goto done;
diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index eed910edb93..bb80b328d56 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -414,10 +414,11 @@ ipsec_sa_show_all (vlib_main_t * vm, ipsec_main_t * im, u8 detail)
u32 sai;
/* *INDENT-OFF* */
- pool_foreach_index (sai, im->sad) {
- vlib_cli_output(vm, "%U", format_ipsec_sa, sai,
- (detail ? IPSEC_FORMAT_DETAIL : IPSEC_FORMAT_BRIEF));
- }
+ pool_foreach_index (sai, ipsec_sa_pool)
+ {
+ vlib_cli_output (vm, "%U", format_ipsec_sa, sai,
+ (detail ? IPSEC_FORMAT_DETAIL : IPSEC_FORMAT_BRIEF));
+ }
/* *INDENT-ON* */
}
@@ -521,7 +522,6 @@ static clib_error_t *
clear_ipsec_sa_command_fn (vlib_main_t * vm,
unformat_input_t * input, vlib_cli_command_t * cmd)
{
- ipsec_main_t *im = &ipsec_main;
u32 sai = ~0;
while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
@@ -535,14 +535,15 @@ clear_ipsec_sa_command_fn (vlib_main_t * vm,
if (~0 == sai)
{
/* *INDENT-OFF* */
- pool_foreach_index (sai, im->sad) {
- ipsec_sa_clear(sai);
- }
+ pool_foreach_index (sai, ipsec_sa_pool)
+ {
+ ipsec_sa_clear (sai);
+ }
/* *INDENT-ON* */
}
else
{
- if (pool_is_free_index (im->sad, sai))
+ if (pool_is_free_index (ipsec_sa_pool, sai))
return clib_error_return (0, "unknown SA index: %d", sai);
else
ipsec_sa_clear (sai);
diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index 001aa010364..b67c11da1cd 100644
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -271,17 +271,16 @@ format_ipsec_sa (u8 * s, va_list * args)
{
u32 sai = va_arg (*args, u32);
ipsec_format_flags_t flags = va_arg (*args, ipsec_format_flags_t);
- ipsec_main_t *im = &ipsec_main;
vlib_counter_t counts;
ipsec_sa_t *sa;
- if (pool_is_free_index (im->sad, sai))
+ if (pool_is_free_index (ipsec_sa_pool, sai))
{
s = format (s, "No such SA index: %d", sai);
goto done;
}
- sa = pool_elt_at_index (im->sad, sai);
+ sa = ipsec_sa_get (sai);
s = format (s, "[%d] sa %u (0x%x) spi %u (0x%08x) protocol:%s flags:[%U]",
sai, sa->id, sa->id, sa->spi, sa->spi,
diff --git a/src/vnet/ipsec/ipsec_input.c b/src/vnet/ipsec/ipsec_input.c
index 2ebc6c5a10c..15a0796fb15 100644
--- a/src/vnet/ipsec/ipsec_input.c
+++ b/src/vnet/ipsec/ipsec_input.c
@@ -111,7 +111,7 @@ ipsec_input_protect_policy_match (ipsec_spd_t * spd, u32 sa, u32 da, u32 spi)
vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT])
{
p = pool_elt_at_index (im->policies, *i);
- s = pool_elt_at_index (im->sad, p->sa_index);
+ s = ipsec_sa_get (p->sa_index);
if (spi != s->spi)
continue;
@@ -167,7 +167,7 @@ ipsec6_input_protect_policy_match (ipsec_spd_t * spd,
vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT])
{
p = pool_elt_at_index (im->policies, *i);
- s = pool_elt_at_index (im->sad, p->sa_index);
+ s = ipsec_sa_get (p->sa_index);
if (spi != s->spi)
continue;
diff --git a/src/vnet/ipsec/ipsec_output.c b/src/vnet/ipsec/ipsec_output.c
index e6cf837d796..23a86de0744 100644
--- a/src/vnet/ipsec/ipsec_output.c
+++ b/src/vnet/ipsec/ipsec_output.c
@@ -297,7 +297,7 @@ ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
{
ipsec_sa_t *sa = 0;
nc_protect++;
- sa = pool_elt_at_index (im->sad, p0->sa_index);
+ sa = ipsec_sa_get (p0->sa_index);
if (sa->protocol == IPSEC_PROTOCOL_ESP)
if (is_ipv6)
next_node_index = im->esp6_encrypt_node_index;
diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c
index 0a24aa2c8c0..7e2dc20ef90 100644
--- a/src/vnet/ipsec/ipsec_sa.c
+++ b/src/vnet/ipsec/ipsec_sa.c
@@ -29,6 +29,7 @@ vlib_combined_counter_main_t ipsec_sa_counters = {
.stat_segment_name = "/net/ipsec/sa",
};
+ipsec_sa_t *ipsec_sa_pool;
static clib_error_t *
ipsec_call_add_del_callbacks (ipsec_main_t * im, ipsec_sa_t * sa,
@@ -184,11 +185,11 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto,
if (p)
return VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
- pool_get_aligned_zero (im->sad, sa, CLIB_CACHE_LINE_BYTES);
+ pool_get_aligned_zero (ipsec_sa_pool, sa, CLIB_CACHE_LINE_BYTES);
fib_node_init (&sa->node, FIB_NODE_TYPE_IPSEC_SA);
fib_node_lock (&sa->node);
- sa_index = sa - im->sad;
+ sa_index = sa - ipsec_sa_pool;
vlib_validate_combined_counter (&ipsec_sa_counters, sa_index);
vlib_zero_combined_counter (&ipsec_sa_counters, sa_index);
@@ -216,7 +217,7 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto,
(u8 *) ck->data, ck->len);
if (~0 == sa->crypto_key_index)
{
- pool_put (im->sad, sa);
+ pool_put (ipsec_sa_pool, sa);
return VNET_API_ERROR_KEY_LENGTH;
}
@@ -228,7 +229,7 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto,
(u8 *) ik->data, ik->len);
if (~0 == sa->integ_key_index)
{
- pool_put (im->sad, sa);
+ pool_put (ipsec_sa_pool, sa);
return VNET_API_ERROR_KEY_LENGTH;
}
}
@@ -250,14 +251,14 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto,
if (err)
{
clib_warning ("%s", err->what);
- pool_put (im->sad, sa);
+ pool_put (ipsec_sa_pool, sa);
return VNET_API_ERROR_UNIMPLEMENTED;
}
err = ipsec_call_add_del_callbacks (im, sa, sa_index, 1);
if (err)
{
- pool_put (im->sad, sa);
+ pool_put (ipsec_sa_pool, sa);
return VNET_API_ERROR_SYSCALL_ERROR_1;
}
@@ -269,7 +270,7 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto,
if (rv)
{
- pool_put (im->sad, sa);
+ pool_put (ipsec_sa_pool, sa);
return rv;
}
ipsec_sa_stack (sa);
@@ -324,7 +325,7 @@ ipsec_sa_del (ipsec_sa_t * sa)
ipsec_main_t *im = &ipsec_main;
u32 sa_index;
- sa_index = sa - im->sad;
+ sa_index = sa - ipsec_sa_pool;
hash_unset (im->sa_index_by_sa_id, sa->id);
tunnel_unresolve (&sa->tunnel);
@@ -339,19 +340,18 @@ ipsec_sa_del (ipsec_sa_t * sa)
vnet_crypto_key_del (vm, sa->crypto_key_index);
if (sa->integ_alg != IPSEC_INTEG_ALG_NONE)
vnet_crypto_key_del (vm, sa->integ_key_index);
- pool_put (im->sad, sa);
+ pool_put (ipsec_sa_pool, sa);
}
void
ipsec_sa_unlock (index_t sai)
{
- ipsec_main_t *im = &ipsec_main;
ipsec_sa_t *sa;
if (INDEX_INVALID == sai)
return;
- sa = pool_elt_at_index (im->sad, sai);
+ sa = ipsec_sa_get (sai);
fib_node_unlock (&sa->node);
}
@@ -359,13 +359,12 @@ ipsec_sa_unlock (index_t sai)
void
ipsec_sa_lock (index_t sai)
{
- ipsec_main_t *im = &ipsec_main;
ipsec_sa_t *sa;
if (INDEX_INVALID == sai)
return;
- sa = pool_elt_at_index (im->sad, sai);
+ sa = ipsec_sa_get (sai);
fib_node_lock (&sa->node);
}
@@ -382,7 +381,7 @@ ipsec_sa_find_and_lock (u32 id)
if (!p)
return INDEX_INVALID;
- sa = pool_elt_at_index (im->sad, p[0]);
+ sa = ipsec_sa_get (p[0]);
fib_node_lock (&sa->node);
@@ -414,15 +413,14 @@ ipsec_sa_clear (index_t sai)
void
ipsec_sa_walk (ipsec_sa_walk_cb_t cb, void *ctx)
{
- ipsec_main_t *im = &ipsec_main;
ipsec_sa_t *sa;
/* *INDENT-OFF* */
- pool_foreach (sa, im->sad)
- {
- if (WALK_CONTINUE != cb(sa, ctx))
- break;
- }
+ pool_foreach (sa, ipsec_sa_pool)
+ {
+ if (WALK_CONTINUE != cb (sa, ctx))
+ break;
+ }
/* *INDENT-ON* */
}
@@ -432,11 +430,9 @@ ipsec_sa_walk (ipsec_sa_walk_cb_t cb, void *ctx)
static fib_node_t *
ipsec_sa_fib_node_get (fib_node_index_t index)
{
- ipsec_main_t *im;
ipsec_sa_t *sa;
- im = &ipsec_main;
- sa = pool_elt_at_index (im->sad, index);
+ sa = ipsec_sa_get (index);
return (&sa->node);
}
diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h
index a5756f556f9..705034e8b47 100644
--- a/src/vnet/ipsec/ipsec_sa.h
+++ b/src/vnet/ipsec/ipsec_sa.h
@@ -223,6 +223,11 @@ typedef struct
STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline1, CLIB_CACHE_LINE_BYTES);
STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline2, 2 * CLIB_CACHE_LINE_BYTES);
+/**
+ * Pool of IPSec SAs
+ */
+extern ipsec_sa_t *ipsec_sa_pool;
+
/*
* Ensure that the IPsec data does not overlap with the IP data in
* the buffer meta data
@@ -279,6 +284,7 @@ extern void ipsec_sa_set_integ_alg (ipsec_sa_t * sa,
typedef walk_rc_t (*ipsec_sa_walk_cb_t) (ipsec_sa_t * sa, void *ctx);
extern void ipsec_sa_walk (ipsec_sa_walk_cb_t cd, void *ctx);
+extern u8 *format_ipsec_replay_window (u8 *s, va_list *args);
extern u8 *format_ipsec_crypto_alg (u8 * s, va_list * args);
extern u8 *format_ipsec_integ_alg (u8 * s, va_list * args);
extern u8 *format_ipsec_sa (u8 * s, va_list * args);
@@ -508,6 +514,12 @@ ipsec_sa_assign_thread (u32 thread_id)
: (unix_time_now_nsec () % vlib_num_workers ()) + 1);
}
+always_inline ipsec_sa_t *
+ipsec_sa_get (u32 sa_index)
+{
+ return (pool_elt_at_index (ipsec_sa_pool, sa_index));
+}
+
#endif /* __IPSEC_SPD_SA_H__ */
/*