summaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec/ipsec_output.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/vnet/ipsec/ipsec_output.c')
-rw-r--r--src/vnet/ipsec/ipsec_output.c85
1 files changed, 0 insertions, 85 deletions
diff --git a/src/vnet/ipsec/ipsec_output.c b/src/vnet/ipsec/ipsec_output.c
index 96c6f27fee1..028d9761c07 100644
--- a/src/vnet/ipsec/ipsec_output.c
+++ b/src/vnet/ipsec/ipsec_output.c
@@ -64,91 +64,6 @@ format_ipsec_output_trace (u8 * s, va_list * args)
return s;
}
-always_inline uword
-ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la,
- ip6_address_t * ua)
-{
- if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
- (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
- return 1;
- return 0;
-}
-
-always_inline void
-ipsec_fp_5tuple_from_ip6_range (ipsec_fp_5tuple_t *tuple, ip6_address_t *la,
- ip6_address_t *ra, u16 lp, u16 rp, u8 pr)
-
-{
- clib_memcpy_fast (&tuple->ip6_laddr, la, sizeof (ip6_address_t));
- clib_memcpy_fast (&tuple->ip6_laddr, la, sizeof (ip6_address_t));
-
- tuple->lport = lp;
- tuple->rport = rp;
- tuple->protocol = pr;
- tuple->is_ipv6 = 1;
-}
-
-always_inline ipsec_policy_t *
-ipsec6_output_policy_match (ipsec_spd_t * spd,
- ip6_address_t * la,
- ip6_address_t * ra, u16 lp, u16 rp, u8 pr)
-{
- ipsec_main_t *im = &ipsec_main;
- ipsec_policy_t *p;
- ipsec_policy_t *policies[1];
- ipsec_fp_5tuple_t tuples[1];
- u32 fp_policy_ids[1];
-
- u32 *i;
-
- if (!spd)
- return 0;
-
- ipsec_fp_5tuple_from_ip6_range (&tuples[0], la, ra, lp, rp, pr);
- if (im->fp_spd_is_enabled &&
- (0 == ipsec_fp_out_policy_match_n (&spd->fp_spd, 1, tuples, policies,
- fp_policy_ids, 1)))
- {
- p = policies[0];
- i = fp_policy_ids;
- }
-
- vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_OUTBOUND])
- {
- p = pool_elt_at_index (im->policies, *i);
- if (PREDICT_FALSE ((p->protocol != IPSEC_POLICY_PROTOCOL_ANY) &&
- (p->protocol != pr)))
- continue;
-
- if (!ip6_addr_match_range (ra, &p->raddr.start.ip6, &p->raddr.stop.ip6))
- continue;
-
- if (!ip6_addr_match_range (la, &p->laddr.start.ip6, &p->laddr.stop.ip6))
- continue;
-
- if (PREDICT_FALSE
- ((pr != IP_PROTOCOL_TCP) && (pr != IP_PROTOCOL_UDP)
- && (pr != IP_PROTOCOL_SCTP)))
- return p;
-
- if (lp < p->lport.start)
- continue;
-
- if (lp > p->lport.stop)
- continue;
-
- if (rp < p->rport.start)
- continue;
-
- if (rp > p->rport.stop)
- continue;
-
- return p;
- }
-
- return 0;
-}
-
static inline uword
ipsec_output_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
vlib_frame_t * from_frame, int is_ipv6)