diff options
Diffstat (limited to 'src/plugins/sixrd/ip4_sixrd.c')
| -rw-r--r-- | src/plugins/sixrd/ip4_sixrd.c | 114 |
1 files changed, 76 insertions, 38 deletions
diff --git a/src/plugins/sixrd/ip4_sixrd.c b/src/plugins/sixrd/ip4_sixrd.c index 2fb8015d994..f700f14978c 100644 --- a/src/plugins/sixrd/ip4_sixrd.c +++ b/src/plugins/sixrd/ip4_sixrd.c @@ -13,9 +13,10 @@ * limitations under the License. *--------------------------------------------------------------------------- */ + #include "sixrd.h" -static vlib_node_registration_t ip4_sixrd_node; +vlib_node_registration_t ip4_sixrd_node; typedef enum { IP4_SIXRD_NEXT_IP6_LOOKUP, @@ -23,29 +24,45 @@ typedef enum { IP4_SIXRD_N_NEXT, } ip4_sixrd_next_t; +typedef struct { + u32 tunnel_id; + u32 length; + ip4_address_t src; + ip4_address_t dst; +} sixrd_rx_trace_t; + +u8 * +format_sixrd_rx_trace (u8 * s, va_list * args) +{ + CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); + CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); + sixrd_rx_trace_t *t = va_arg (*args, sixrd_rx_trace_t *); + + s = format (s, "6RD: tunnel %d len %d src %U dst %U", + t->tunnel_id, clib_net_to_host_u16 (t->length), + format_ip4_address, &t->src, format_ip4_address, &t->dst); + return s; +} + /* * ip4_sixrd_sec_check */ static_always_inline void -ip4_sixrd_sec_check (sixrd_domain_t *d, ip4_address_t sa4, ip6_address_t sa6, u8 *error) -{ - u32 a = sixrd_get_addr(d, sa6.as_u64[0]); - clib_warning("Security check: %U %U", format_ip4_address, &a, format_ip4_address, &sa4); - if (PREDICT_FALSE(sixrd_get_addr(d, sa6.as_u64[0]) != sa4.as_u32)) +ip4_sixrd_sec_check(sixrd_tunnel_t *t, ip4_address_t sa4, + ip6_address_t sa6, u8 *error) { + if (PREDICT_FALSE(sixrd_get_addr_net(t, sa6.as_u64[0]) != sa4.as_u32)) *error = SIXRD_ERROR_SEC_CHECK; } /* * ip4_sixrd */ -static uword -ip4_sixrd (vlib_main_t *vm, - vlib_node_runtime_t *node, - vlib_frame_t *frame) -{ +uword ip4_sixrd(vlib_main_t *vm, vlib_node_runtime_t *node, + vlib_frame_t *frame) { u32 n_left_from, *from, next_index, *to_next, n_left_to_next; vlib_node_runtime_t *error_node = vlib_node_get_runtime(vm, ip4_sixrd_node.index); - u32 decap = 0; + vnet_interface_main_t * im = &vnet_get_main()->interface_main; + u32 thread_index = vlib_get_thread_index (); from = vlib_frame_vector_args(frame); n_left_from = frame->n_vectors; @@ -58,16 +75,16 @@ ip4_sixrd (vlib_main_t *vm, u32 pi0; vlib_buffer_t *p0; u8 error0 = SIXRD_ERROR_NONE; - sixrd_domain_t *d0 = 0; + sixrd_tunnel_t *t0 = 0; ip4_header_t *ip40; ip6_header_t *ip60; - u32 sixrd_domain_index0 = ~0; - u32 next0; + u32 tunnel_sw_if_index = ~0; + u32 next0 = IP4_SIXRD_NEXT_DROP; pi0 = to_next[0] = from[0]; from += 1; n_left_from -= 1; - to_next +=1; + to_next += 1; n_left_to_next -= 1; p0 = vlib_get_buffer(vm, pi0); @@ -75,52 +92,73 @@ ip4_sixrd (vlib_main_t *vm, /* Throw away anything that isn't IP in IP. */ if (PREDICT_TRUE(ip40->protocol == IP_PROTOCOL_IPV6 && clib_net_to_host_u16(ip40->length) >= 60)) { - vlib_buffer_advance(p0, sizeof(ip4_header_t)); - ip60 = vlib_buffer_get_current(p0); - d0 = ip4_sixrd_get_domain(vnet_buffer(p0)->ip.adj_index[VLIB_TX], (ip6_address_t *)&ip60->src_address, - &sixrd_domain_index0, &error0); + vlib_buffer_advance(p0, sizeof(ip4_header_t)); + t0 = ip4_sixrd_get_tunnel(vnet_buffer(p0)->ip.adj_index[VLIB_TX], (ip4_address_t *)&ip40->dst_address, &error0); } else { - error0 = SIXRD_ERROR_BAD_PROTOCOL; + error0 = SIXRD_ERROR_BAD_PROTOCOL; } - if (d0) { - /* SIXRD inbound security check */ - ip4_sixrd_sec_check(d0, ip40->src_address, ip60->src_address, &error0); + + if (!t0) { + error0 = SIXRD_ERROR_NO_TUNNEL; + goto error; } - next0 = error0 == SIXRD_ERROR_NONE ? IP4_SIXRD_NEXT_IP6_LOOKUP : IP4_SIXRD_NEXT_DROP; + tunnel_sw_if_index = t0->sw_if_index; - if (PREDICT_FALSE(p0->flags & VLIB_BUFFER_IS_TRACED)) { - sixrd_trace_t *tr = vlib_add_trace(vm, node, p0, sizeof(*tr)); - tr->sixrd_domain_index = sixrd_domain_index0; + /* SIXRD inbound security check */ + if (t0->security_check) { + ip60 = vlib_buffer_get_current(p0); + ip4_sixrd_sec_check(t0, ip40->src_address, ip60->src_address, &error0); } + next0 = error0 == SIXRD_ERROR_NONE ? IP4_SIXRD_NEXT_IP6_LOOKUP + : IP4_SIXRD_NEXT_DROP; - p0->error = error_node->errors[error0]; - if (PREDICT_TRUE(error0 == SIXRD_ERROR_NONE)) decap++; - vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, pi0, next0); + if (PREDICT_FALSE(p0->flags & VLIB_BUFFER_IS_TRACED)) { + sixrd_rx_trace_t *tr = vlib_add_trace(vm, node, p0, sizeof(*tr)); + tr->tunnel_id = tunnel_sw_if_index; + tr->length = ip40->length; + tr->src.as_u32 = ip40->src_address.as_u32; + tr->dst.as_u32 = ip40->dst_address.as_u32; + } + error: + if (PREDICT_TRUE(error0 == SIXRD_ERROR_NONE)) { + u32 len = vlib_buffer_length_in_chain (vm, p0); + vlib_increment_combined_counter (im->combined_sw_if_counters + + VNET_INTERFACE_COUNTER_RX, + thread_index, + tunnel_sw_if_index, + 1 /* packets */ , + len /* bytes */ ); + + vnet_buffer (p0)->sw_if_index[VLIB_RX] = tunnel_sw_if_index; + } else { + p0->error = error_node->errors[error0]; + } + vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, + n_left_to_next, pi0, next0); } vlib_put_next_frame(vm, node, next_index, n_left_to_next); } - vlib_node_increment_counter(vm, ip4_sixrd_node.index, SIXRD_ERROR_DECAPSULATED, decap); - return frame->n_vectors; } static char *sixrd_error_strings[] = { -#define _(sym,string) string, - foreach_sixrd_error +#define _(sym, string) string, + foreach_sixrd_error #undef _ }; -VLIB_REGISTER_NODE(ip4_sixrd_node,static) = { +VLIB_REGISTER_NODE(ip4_sixrd_node) = { .function = ip4_sixrd, .name = "ip4-sixrd", .vector_size = sizeof(u32), - .format_trace = format_sixrd_trace, + .format_trace = format_sixrd_rx_trace, .n_errors = SIXRD_N_ERROR, .error_strings = sixrd_error_strings, .n_next_nodes = IP4_SIXRD_N_NEXT, - .next_nodes = { + .next_nodes = + { [IP4_SIXRD_NEXT_IP6_LOOKUP] = "ip6-lookup", [IP4_SIXRD_NEXT_DROP] = "error-drop", }, |