diff options
Diffstat (limited to 'src/vnet/ipsec/ipsec_output.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec_output.c | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/src/vnet/ipsec/ipsec_output.c b/src/vnet/ipsec/ipsec_output.c index d2eb412bb18..96c6f27fee1 100644 --- a/src/vnet/ipsec/ipsec_output.c +++ b/src/vnet/ipsec/ipsec_output.c @@ -74,6 +74,20 @@ ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la, return 0; } +always_inline void +ipsec_fp_5tuple_from_ip6_range (ipsec_fp_5tuple_t *tuple, ip6_address_t *la, + ip6_address_t *ra, u16 lp, u16 rp, u8 pr) + +{ + clib_memcpy_fast (&tuple->ip6_laddr, la, sizeof (ip6_address_t)); + clib_memcpy_fast (&tuple->ip6_laddr, la, sizeof (ip6_address_t)); + + tuple->lport = lp; + tuple->rport = rp; + tuple->protocol = pr; + tuple->is_ipv6 = 1; +} + always_inline ipsec_policy_t * ipsec6_output_policy_match (ipsec_spd_t * spd, ip6_address_t * la, @@ -81,12 +95,24 @@ ipsec6_output_policy_match (ipsec_spd_t * spd, { ipsec_main_t *im = &ipsec_main; ipsec_policy_t *p; + ipsec_policy_t *policies[1]; + ipsec_fp_5tuple_t tuples[1]; + u32 fp_policy_ids[1]; u32 *i; if (!spd) return 0; + ipsec_fp_5tuple_from_ip6_range (&tuples[0], la, ra, lp, rp, pr); + if (im->fp_spd_is_enabled && + (0 == ipsec_fp_out_policy_match_n (&spd->fp_spd, 1, tuples, policies, + fp_policy_ids, 1))) + { + p = policies[0]; + i = fp_policy_ids; + } + vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_OUTBOUND]) { p = pool_elt_at_index (im->policies, *i); |