aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/scripts/vnet/ipsec_spd_vrf72
-rw-r--r--src/vnet/ipsec/ipsec_cli.c18
-rw-r--r--src/vnet/ipsec/ipsec_spd.c2
3 files changed, 89 insertions, 3 deletions
diff --git a/src/scripts/vnet/ipsec_spd_vrf b/src/scripts/vnet/ipsec_spd_vrf
new file mode 100644
index 00000000000..faa891dc2c4
--- /dev/null
+++ b/src/scripts/vnet/ipsec_spd_vrf
@@ -0,0 +1,72 @@
+
+create packet-generator interface pg0
+set int mac addr pg0 4.5.6
+
+create sub-interfaces pg0 1
+create sub-interfaces pg0 2
+create sub-interfaces pg0 3
+
+ip table add 1
+ip table add 2
+ip table add 3
+
+set int ip table pg0.1 1
+set int ip table pg0.2 2
+set int ip table pg0.3 3
+
+set int ip address pg0.1 192.168.0.1/24
+set int ip address pg0.2 192.168.0.1/24
+set int ip address pg0.3 192.168.0.1/24
+
+set int state pg0 up
+set int state pg0.1 up
+set int state pg0.2 up
+set int state pg0.3 up
+
+ipsec sa add 2 spi 2 crypto-key 6541686776336961656264656f6f6579 crypto-alg aes-cbc-128 tunnel-src 192.168.0.1 tunnel-dst 192.168.0.2 tx-table-id 2
+ipsec sa add 3 spi 3 crypto-key 6541686776336961656264656f6f6579 crypto-alg aes-cbc-128 tunnel-src 192.168.0.1 tunnel-dst 192.168.0.2 tx-table-id 3
+
+ipsec spd add 1
+set interface ipsec spd pg0.1 1
+ipsec policy add spd 1 priority 100 outbound action bypass protocol 50
+ipsec policy add spd 1 priority 10 outbound action protect sa 2 local-ip-range 10.5.0.0 - 10.5.0.255 remote-ip-range 10.6.0.0 - 10.6.0.16
+ipsec policy add spd 1 priority 10 outbound action protect sa 3 local-ip-range 10.5.0.0 - 10.5.0.255 remote-ip-range 10.6.0.17 - 10.6.0.32
+
+ip route table 1 add 10.6.0.0/16 via 192.168.0.2 pg0.1
+set ip neighbor pg0.1 192.168.0.2 00:11:22:33:44:55
+set ip neighbor pg0.2 192.168.0.2 00:11:22:33:44:55
+set ip neighbor pg0.3 192.168.0.2 00:11:22:33:44:55
+
+trace add pg-input 100
+
+packet-generator new {
+ name ipsec2
+ limit 1
+ rate 1e4
+ node ethernet-input
+ interface pg0
+ size 100-100
+ data {
+ IP4: 1.2.3 -> 4.5.6 vlan 1
+ UDP: 10.5.0.1 -> 10.6.0.1
+ UDP: 4321 -> 1234
+ length 72
+ incrementing 100
+ }
+}
+
+packet-generator new {
+ name ipsec3
+ limit 1
+ rate 1e4
+ node ethernet-input
+ interface pg0
+ size 100-100
+ data {
+ IP4: 1.2.3 -> 4.5.6 vlan 1
+ UDP: 10.5.0.1 -> 10.6.0.22
+ UDP: 4321 -> 1234
+ length 72
+ incrementing 100
+ }
+}
diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index fc79c4ca347..e0a271db87d 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -36,6 +36,7 @@ set_interface_spd_command_fn (vlib_main_t * vm,
u32 spd_id;
int is_add = 1;
clib_error_t *error = NULL;
+ int err;
if (!unformat_user (input, unformat_line_input, line_input))
return 0;
@@ -53,7 +54,16 @@ set_interface_spd_command_fn (vlib_main_t * vm,
goto done;
}
- ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
+ err = ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
+ switch (err)
+ {
+ case VNET_API_ERROR_SYSCALL_ERROR_1:
+ error = clib_error_return (0, "no such spd-id");
+ break;
+ case VNET_API_ERROR_SYSCALL_ERROR_2:
+ error = clib_error_return (0, "spd already assigned");
+ break;
+ }
done:
unformat_free (line_input);
@@ -91,6 +101,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
int is_add, rv;
u32 m_args = 0;
ip_dscp_t dscp;
+ u32 tx_table_id;
salt = 0;
error = NULL;
@@ -101,6 +112,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
crypto_alg = IPSEC_CRYPTO_ALG_NONE;
udp_src = udp_dst = IPSEC_UDP_PORT_NONE;
dscp = IP_DSCP_CS0;
+ tx_table_id = 0;
if (!unformat_user (input, unformat_line_input, line_input))
return 0;
@@ -146,6 +158,8 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
else if (unformat (line_input, "tunnel-dst %U",
unformat_ip46_address, &tun_dst, IP46_TYPE_ANY))
;
+ else if (unformat (line_input, "tx-table-id %d", &tx_table_id))
+ ;
else if (unformat (line_input, "inbound"))
flags |= IPSEC_SA_FLAG_IS_INBOUND;
else if (unformat (line_input, "use-anti-replay"))
@@ -183,7 +197,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
}
rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg,
&ck, integ_alg, &ik, flags,
- 0, clib_host_to_net_u32 (salt),
+ tx_table_id, clib_host_to_net_u32 (salt),
&tun_src, &tun_dst,
TUNNEL_ENCAP_DECAP_FLAG_NONE, dscp,
&sai, udp_src, udp_dst);
diff --git a/src/vnet/ipsec/ipsec_spd.c b/src/vnet/ipsec/ipsec_spd.c
index ef41c2286c1..4e8017c35ff 100644
--- a/src/vnet/ipsec/ipsec_spd.c
+++ b/src/vnet/ipsec/ipsec_spd.c
@@ -77,7 +77,7 @@ ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
if (p && is_add)
- return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
+ return VNET_API_ERROR_SYSCALL_ERROR_2; /* spd already assigned */
if (is_add)
{