3 files changed, 178 insertions, 125 deletions

diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index 6e5007151b9..ebcf0ed8e08 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -220,7 +220,7 @@ esp_process_ops (vlib_main_t * vm, vlib_node_runtime_t * node,
 
 always_inline uword
 esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
-		    vlib_frame_t * frame, int is_ip6)
+		    vlib_frame_t * frame, int is_ip6, int is_tun)
 {
   ipsec_main_t *im = &ipsec_main;
   ipsec_per_thread_data_t *ptd = vec_elt_at_index (im->ptd, vm->thread_index);
@@ -258,7 +258,19 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  CLIB_PREFETCH (p, CLIB_CACHE_LINE_BYTES, LOAD);
 	}
 
-      if (vnet_buffer (b[0])->ipsec.sad_index != current_sa_index)
+      if (is_tun)
+	{
+	  /* we are on a ipsec tunnel's feature arc */
+	  u32 next0;
+	  sa_index0 = *(u32 *) vnet_feature_next_with_data (&next0, b[0],
+							    sizeof
+							    (sa_index0));
+	  next[0] = next0;
+	}
+      else
+	sa_index0 = vnet_buffer (b[0])->ipsec.sad_index;
+
+      if (sa_index0 != current_sa_index)
 	{
 	  sa0 = pool_elt_at_index (im->sad, sa_index0);
 	  current_sa_index = sa_index0;
@@ -335,8 +347,11 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	    }
 
 	  dpo = sa0->dpo + IPSEC_PROTOCOL_ESP;
-	  next[0] = dpo->dpoi_next_node;
-	  vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
+	  if (!is_tun)
+	    {
+	      next[0] = dpo->dpoi_next_node;
+	      vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
+	    }
 	}
       else			/* transport mode */
 	{
@@ -483,7 +498,7 @@ VLIB_NODE_FN (esp4_encrypt_node) (vlib_main_t * vm,
 				  vlib_node_runtime_t * node,
 				  vlib_frame_t * from_frame)
 {
-  return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
+  return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 0);
 }
 
 /* *INDENT-OFF* */
@@ -509,7 +524,7 @@ VLIB_NODE_FN (esp6_encrypt_node) (vlib_main_t * vm,
 				  vlib_node_runtime_t * node,
 				  vlib_frame_t * from_frame)
 {
-  return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
+  return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 0);
 }
 
 /* *INDENT-OFF* */
@@ -531,6 +546,60 @@ VLIB_REGISTER_NODE (esp6_encrypt_node) = {
 };
 /* *INDENT-ON* */
 
+VLIB_NODE_FN (esp4_encrypt_tun_node) (vlib_main_t * vm,
+				      vlib_node_runtime_t * node,
+				      vlib_frame_t * from_frame)
+{
+  return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 1);
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (esp4_encrypt_tun_node) = {
+  .name = "esp4-encrypt-tun",
+  .vector_size = sizeof (u32),
+  .format_trace = format_esp_encrypt_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
+  .error_strings = esp_encrypt_error_strings,
+};
+
+VNET_FEATURE_INIT (esp4_encrypt_tun_feat_node, static) =
+{
+  .arc_name = "ip4-output",
+  .node_name = "esp4-encrypt-tun",
+  .runs_before = VNET_FEATURES ("ip4-frag",
+                                "adj-midchain-tx"),
+};
+/* *INDENT-ON* */
+
+VLIB_NODE_FN (esp6_encrypt_tun_node) (vlib_main_t * vm,
+				      vlib_node_runtime_t * node,
+				      vlib_frame_t * from_frame)
+{
+  return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 1);
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (esp6_encrypt_tun_node) = {
+  .name = "esp6-encrypt-tun",
+  .vector_size = sizeof (u32),
+  .format_trace = format_esp_encrypt_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
+  .error_strings = esp_encrypt_error_strings,
+};
+
+VNET_FEATURE_INIT (esp6_encrypt_tun_feat_node, static) =
+{
+  .arc_name = "ip6-output",
+  .node_name = "esp6-encrypt-tun",
+  .runs_before = VNET_FEATURES ("ip6-frag",
+                                "adj-midchain-tx"),
+};
+/* *INDENT-ON* */
+
 /*
  * fd.io coding-style-patch-verification: ON
  *
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index 9a5dbb3e8b2..47b3ed370b8 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -109,6 +109,7 @@ typedef struct
   uword *ipsec4_if_pool_index_by_key;
   uword *ipsec6_if_pool_index_by_key;
   uword *ipsec_if_real_dev_by_show_dev;
+  uword *ipsec_if_by_sw_if_index;
 
   /* node indices */
   u32 error_drop_node_index;
@@ -212,6 +213,13 @@ u32 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
 
 int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx);
 int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx);
+
+always_inline ipsec_sa_t *
+ipsec_sa_get (u32 sa_index)
+{
+  return (pool_elt_at_index (ipsec_main.sad, sa_index));
+}
+
 #endif /* __IPSEC_H__ */
 
 /*
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index b1c05346dd0..304c52eac7c 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -20,6 +20,7 @@
 #include <vnet/ip/ip.h>
 #include <vnet/fib/fib.h>
 #include <vnet/udp/udp.h>
+#include <vnet/adj/adj_midchain.h>
 
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/esp.h>
@@ -40,121 +41,68 @@ format_ipsec_name (u8 * s, va_list * args)
 #define foreach_ipsec_if_tx_error    \
 _(TX, "good packets transmitted")
 
-static char *ipsec_if_tx_error_strings[] = {
-#define _(sym,string) string,
-  foreach_ipsec_if_tx_error
-#undef _
-};
-
-typedef enum
-{
-#define _(sym,str) IPSEC_IF_OUTPUT_ERROR_##sym,
-  foreach_ipsec_if_tx_error
-#undef _
-    IPSEC_IF_TX_N_ERROR,
-} ipsec_if_tx_error_t;
-
-typedef struct
-{
-  u32 spi;
-  u32 seq;
-} ipsec_if_tx_trace_t;
-
-u8 *
-format_ipsec_if_tx_trace (u8 * s, va_list * args)
+static void
+ipsec_if_tunnel_stack (adj_index_t ai)
 {
-  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
-  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
-  ipsec_if_tx_trace_t *t = va_arg (*args, ipsec_if_tx_trace_t *);
+  ipsec_main_t *ipm = &ipsec_main;
+  ipsec_tunnel_if_t *it;
+  ip_adjacency_t *adj;
+  u32 sw_if_index;
 
-  s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq);
-  return s;
-}
+  adj = adj_get (ai);
+  sw_if_index = adj->rewrite_header.sw_if_index;
 
-static void
-ipsec_output_trace (vlib_main_t * vm,
-		    vlib_node_runtime_t * node,
-		    vlib_frame_t * frame, const ipsec_tunnel_if_t * t0)
-{
-  ipsec_main_t *im = &ipsec_main;
-  u32 *from, n_left;
+  if ((vec_len (ipm->ipsec_if_by_sw_if_index) <= sw_if_index) ||
+      (~0 == ipm->ipsec_if_by_sw_if_index[sw_if_index]))
+    return;
 
-  n_left = frame->n_vectors;
-  from = vlib_frame_vector_args (frame);
+  it = pool_elt_at_index (ipm->tunnel_interfaces,
+			  ipm->ipsec_if_by_sw_if_index[sw_if_index]);
 
-  while (n_left > 0)
+  if (!vnet_hw_interface_is_link_up (vnet_get_main (), it->hw_if_index))
     {
-      vlib_buffer_t *b0;
+      adj_midchain_delegate_unstack (ai);
+    }
+  else
+    {
+      ipsec_sa_t *sa;
 
-      b0 = vlib_get_buffer (vm, from[0]);
+      sa = ipsec_sa_get (it->output_sa_index);
 
-      if (b0->flags & VLIB_BUFFER_IS_TRACED)
-	{
-	  ipsec_if_tx_trace_t *tr =
-	    vlib_add_trace (vm, node, b0, sizeof (*tr));
-	  ipsec_sa_t *sa0 = pool_elt_at_index (im->sad, t0->output_sa_index);
-	  tr->spi = sa0->spi;
-	  tr->seq = sa0->seq;
-	}
+      fib_prefix_t pfx = {
+	.fp_addr = sa->tunnel_dst_addr,
+	.fp_len = (sa->is_tunnel_ip6 ? 128 : 32),
+	.fp_proto = (sa->is_tunnel_ip6 ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4),
+      };
 
-      from += 1;
-      n_left -= 1;
+      adj_midchain_delegate_stack (ai, sa->tx_fib_index, &pfx);
     }
 }
 
-VNET_DEVICE_CLASS_TX_FN (ipsec_device_class) (vlib_main_t * vm,
-					      vlib_node_runtime_t * node,
-					      vlib_frame_t * frame)
+/**
+ * @brief Call back when restacking all adjacencies on a GRE interface
+ */
+static adj_walk_rc_t
+ipsec_if_adj_walk_cb (adj_index_t ai, void *ctx)
 {
-  ipsec_main_t *im = &ipsec_main;
-  u32 *from, n_left;
-  vnet_interface_output_runtime_t *rd = (void *) node->runtime_data;
-  const ipsec_tunnel_if_t *t0;
-  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
-  u16 nexts[VLIB_FRAME_SIZE];
-
-  from = vlib_frame_vector_args (frame);
-  t0 = pool_elt_at_index (im->tunnel_interfaces, rd->dev_instance);
-  n_left = frame->n_vectors;
-  b = bufs;
-
-  /* All going to encrypt */
-  clib_memset (nexts, 0, sizeof (nexts));
-
-  if (node->flags & VLIB_NODE_FLAG_TRACE)
-    ipsec_output_trace (vm, node, frame, t0);
-
-  vlib_get_buffers (vm, from, bufs, n_left);
+  ipsec_if_tunnel_stack (ai);
 
-  while (n_left >= 8)
-    {
-      /* Prefetch the buffer header for the N+2 loop iteration */
-      vlib_prefetch_buffer_header (b[4], STORE);
-      vlib_prefetch_buffer_header (b[5], STORE);
-      vlib_prefetch_buffer_header (b[6], STORE);
-      vlib_prefetch_buffer_header (b[7], STORE);
-
-      vnet_buffer (b[0])->ipsec.sad_index = t0->output_sa_index;
-      vnet_buffer (b[1])->ipsec.sad_index = t0->output_sa_index;
-      vnet_buffer (b[2])->ipsec.sad_index = t0->output_sa_index;
-      vnet_buffer (b[3])->ipsec.sad_index = t0->output_sa_index;
-
-      n_left -= 4;
-      b += 4;
-    }
-  while (n_left > 0)
-    {
-      vnet_buffer (b[0])->ipsec.sad_index = t0->output_sa_index;
-
-      n_left -= 1;
-      b += 1;
-    }
-
-  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
-
-  return frame->n_vectors;
+  return (ADJ_WALK_RC_CONTINUE);
 }
 
+static void
+ipsec_if_tunnel_restack (ipsec_tunnel_if_t * it)
+{
+  fib_protocol_t proto;
+
+  /*
+   * walk all the adjacencies on th GRE interface and restack them
+   */
+  FOR_EACH_FIB_IP_PROTOCOL (proto)
+  {
+    adj_nbr_walk (it->sw_if_index, proto, ipsec_if_adj_walk_cb, NULL);
+  }
+}
 
 static clib_error_t *
 ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
@@ -207,18 +155,34 @@ ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
 	return err;
     }
 
-  return /* no error */ 0;
+  ipsec_if_tunnel_restack (t);
+
+  return (NULL);
 }
 
+static u8 *
+ipsec_if_build_rewrite (vnet_main_t * vnm,
+			u32 sw_if_index,
+			vnet_link_t link_type, const void *dst_address)
+{
+  return (NULL);
+}
+
+static void
+ipsec_if_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
+{
+  adj_nbr_midchain_update_rewrite
+    (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK,
+     ipsec_if_build_rewrite (vnm, sw_if_index, adj_get_link_type (ai), NULL));
+
+  ipsec_if_tunnel_stack (ai);
+}
 
 /* *INDENT-OFF* */
 VNET_DEVICE_CLASS (ipsec_device_class) =
 {
   .name = "IPSec",
   .format_device_name = format_ipsec_name,
-  .format_tx_trace = format_ipsec_if_tx_trace,
-  .tx_function_n_errors = IPSEC_IF_TX_N_ERROR,
-  .tx_function_error_strings = ipsec_if_tx_error_strings,
   .admin_up_down_function = ipsec_admin_up_down_function,
 };
 /* *INDENT-ON* */
@@ -228,6 +192,7 @@ VNET_HW_INTERFACE_CLASS (ipsec_hw_class) =
 {
   .name = "IPSec",
   .build_rewrite = default_build_rewrite,
+  .update_adjacency = ipsec_if_update_adj,
   .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
 };
 /* *INDENT-ON* */
@@ -380,21 +345,25 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 
       hi = vnet_get_hw_interface (vnm, hw_if_index);
 
-      /* add esp4/6 as the next-node-index of this tx-node */
-      uword slot = vlib_node_add_next_with_slot
-	(vnm->vlib_main, hi->tx_node_index,
-	 is_ip6 ? im->esp6_encrypt_node_index : im->esp4_encrypt_node_index,
-	 0);
-
-      ASSERT (slot == 0);
-
       t->hw_if_index = hw_if_index;
       t->sw_if_index = hi->sw_if_index;
 
-      vnet_feature_enable_disable ("interface-output",
-				   args->is_ip6 ? "ipsec6-if-output" :
-				   "ipsec4-if-output", hi->sw_if_index, 1, 0,
-				   0);
+      /* Add the new tunnel to the DB of tunnels per sw_if_index ... */
+      vec_validate_init_empty (im->ipsec_if_by_sw_if_index, t->sw_if_index,
+			       ~0);
+      im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance;
+
+      vnet_feature_enable_disable ("ip4-output",
+				   "esp4-encrypt-tun",
+				   t->sw_if_index, 1,
+				   &t->output_sa_index,
+				   sizeof (t->output_sa_index));
+      vnet_feature_enable_disable ("ip6-output",
+				   "esp6-encrypt-tun",
+				   t->sw_if_index, 1,
+				   &t->output_sa_index,
+				   sizeof (t->output_sa_index));
+
       /*1st interface, register protocol */
       if (pool_elts (im->tunnel_interfaces) == 1)
 	{
@@ -418,10 +387,16 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
       hi = vnet_get_hw_interface (vnm, t->hw_if_index);
       vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0);	/* admin down */
 
-      vnet_feature_enable_disable ("interface-output",
-				   args->is_ip6 ? "ipsec6-if-output" :
-				   "ipsec4-if-output", hi->sw_if_index, 0, 0,
-				   0);
+      vnet_feature_enable_disable ("ip4-output",
+				   "esp4-encrypt-tun",
+				   hi->sw_if_index, 0,
+				   &t->output_sa_index,
+				   sizeof (t->output_sa_index));
+      vnet_feature_enable_disable ("ip6-output",
+				   "esp6-encrypt-tun",
+				   hi->sw_if_index, 0,
+				   &t->output_sa_index,
+				   sizeof (t->output_sa_index));
       vnet_delete_hw_interface (vnm, t->hw_if_index);
 
       if (is_ip6)
@@ -430,6 +405,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 	hash_unset (im->ipsec4_if_pool_index_by_key, key4.as_u64);
 
       hash_unset (im->ipsec_if_real_dev_by_show_dev, t->show_instance);
+      im->ipsec_if_by_sw_if_index[t->sw_if_index] = ~0;
 
       pool_put (im->tunnel_interfaces, t);