From fe480f6830166e35f1073211cba9db066a5c858e Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Thu, 28 Feb 2019 12:03:58 +0000 Subject: IPSEC: tunnel-input; don't load the HW interface struct also fix the stats to include all the data in the tunnel. And don't load the SA. Change-Id: I7cd2e8d879f19683175fd0de78a606a2836e6da2 Signed-off-by: Neale Ranns --- src/vnet/ipsec/ipsec.h | 1 + src/vnet/ipsec/ipsec_if.c | 28 +++++++++++++++++------ src/vnet/ipsec/ipsec_if.h | 2 ++ src/vnet/ipsec/ipsec_if_in.c | 53 ++++++++++++++------------------------------ 4 files changed, 41 insertions(+), 43 deletions(-) diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h index 78d000030c9..3279fab6701 100644 --- a/src/vnet/ipsec/ipsec.h +++ b/src/vnet/ipsec/ipsec.h @@ -140,6 +140,7 @@ typedef struct uword *sa_index_by_sa_id; uword *ipsec_if_pool_index_by_key; uword *ipsec_if_real_dev_by_show_dev; + u32 *ipsec_if_by_sw_if_index; /* node indices */ u32 error_drop_node_index; diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c index 3ec4b0b460c..d03d1a9ffe3 100644 --- a/src/vnet/ipsec/ipsec_if.c +++ b/src/vnet/ipsec/ipsec_if.c @@ -70,6 +70,17 @@ format_ipsec_if_tx_trace (u8 * s, va_list * args) return s; } +always_inline ipsec_tunnel_if_t * +ipsec_tun_get_by_sw_if_index (u32 sw_if_index) +{ + ipsec_main_t *im = &ipsec_main; + u32 ti; + + ti = im->ipsec_if_by_sw_if_index[sw_if_index]; + + return (pool_elt_at_index (im->tunnel_interfaces, ti)); +} + static uword ipsec_if_tx_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * from_frame) @@ -94,10 +105,9 @@ ipsec_if_tx_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, while (n_left_from > 0 && n_left_to_next > 0) { + const ipsec_tunnel_if_t *t0; u32 bi0, next0, len0; vlib_buffer_t *b0; - ipsec_tunnel_if_t *t0; - vnet_hw_interface_t *hi0; bi0 = to_next[0] = from[0]; from += 1; @@ -106,8 +116,7 @@ ipsec_if_tx_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, n_left_to_next -= 1; b0 = vlib_get_buffer (vm, bi0); sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX]; - hi0 = vnet_get_sup_hw_interface (vnm, sw_if_index0); - t0 = pool_elt_at_index (im->tunnel_interfaces, hi0->dev_instance); + t0 = ipsec_tun_get_by_sw_if_index (sw_if_index0); vnet_buffer (b0)->ipsec.sad_index = t0->output_sa_index; /* 0, tx-node next[0] was added by vlib_node_add_next_with_slot */ @@ -170,6 +179,7 @@ ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags) hi = vnet_get_hw_interface (vnm, hw_if_index); t = pool_elt_at_index (im->tunnel_interfaces, hi->hw_instance); + t->flags = flags; if (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP) { @@ -290,8 +300,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, if (p) return VNET_API_ERROR_INVALID_VALUE; - pool_get_aligned (im->tunnel_interfaces, t, CLIB_CACHE_LINE_BYTES); - clib_memset (t, 0, sizeof (*t)); + pool_get_aligned_zero (im->tunnel_interfaces, t, CLIB_CACHE_LINE_BYTES); dev_instance = t - im->tunnel_interfaces; if (args->renumber) @@ -373,6 +382,11 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, ASSERT (slot == 0); t->hw_if_index = hw_if_index; + t->sw_if_index = hi->sw_if_index; + + vec_validate_init_empty (im->ipsec_if_by_sw_if_index, + t->sw_if_index, ~0); + im->ipsec_if_by_sw_if_index[t->sw_if_index] = t - im->tunnel_interfaces; vnet_feature_enable_disable ("interface-output", "ipsec-if-output", hi->sw_if_index, 1, 0, 0); @@ -400,6 +414,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, hash_unset (im->ipsec_if_pool_index_by_key, key); hash_unset (im->ipsec_if_real_dev_by_show_dev, t->show_instance); + im->ipsec_if_by_sw_if_index[t->sw_if_index] = ~0; pool_put (im->tunnel_interfaces, t); @@ -599,7 +614,6 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, return 0; } - clib_error_t * ipsec_tunnel_if_init (vlib_main_t * vm) { diff --git a/src/vnet/ipsec/ipsec_if.h b/src/vnet/ipsec/ipsec_if.h index 67d5554e777..3d042f0af01 100644 --- a/src/vnet/ipsec/ipsec_if.h +++ b/src/vnet/ipsec/ipsec_if.h @@ -33,6 +33,8 @@ typedef struct u32 input_sa_index; u32 output_sa_index; u32 hw_if_index; + u32 sw_if_index; + vnet_hw_interface_flags_t flags; u32 show_instance; } ipsec_tunnel_if_t; diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c index ffa9c8e515d..c7f5735a64e 100644 --- a/src/vnet/ipsec/ipsec_if_in.c +++ b/src/vnet/ipsec/ipsec_if_in.c @@ -68,14 +68,11 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, ipsec_main_t *im = &ipsec_main; vnet_main_t *vnm = im->vnet_main; vnet_interface_main_t *vim = &vnm->interface_main; - ipsec_proto_main_t *em = &ipsec_proto_main; u32 *from, *to_next = 0, next_index; u32 n_left_from, last_sw_if_index = ~0; u32 thread_index = vm->thread_index; u64 n_bytes = 0, n_packets = 0; - u8 icv_len; - ipsec_tunnel_if_t *last_t = NULL; - ipsec_sa_t *sa0; + const ipsec_tunnel_if_t *last_t = NULL; vlib_combined_counter_main_t *rx_counter; vlib_combined_counter_main_t *drop_counter; u32 n_disabled = 0, n_no_tunnel = 0; @@ -96,9 +93,9 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, while (n_left_from > 0 && n_left_to_next > 0) { u32 bi0, next0, sw_if_index0; + const esp_header_t *esp0; + const ip4_header_t *ip0; vlib_buffer_t *b0; - ip4_header_t *ip0; - esp_header_t *esp0; uword *p; u32 len0; @@ -109,7 +106,7 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, n_left_to_next -= 1; b0 = vlib_get_buffer (vm, bi0); ip0 = vlib_buffer_get_current (b0); - esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0)); + esp0 = (const esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0)); next0 = IPSEC_INPUT_NEXT_DROP; @@ -117,24 +114,26 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, p = hash_get (im->ipsec_if_pool_index_by_key, key); + /* stats for the tunnel include all the data after the IP header + just like a norml IP-IP tunnel */ + vlib_buffer_advance (b0, ip4_header_bytes (ip0)); len0 = vlib_buffer_length_in_chain (vm, b0); - if (p) + if (PREDICT_TRUE (NULL != p)) { - ipsec_tunnel_if_t *t; - t = pool_elt_at_index (im->tunnel_interfaces, p[0]); - vnet_buffer (b0)->ipsec.sad_index = t->input_sa_index; - if (t->hw_if_index != ~0) - { - vnet_hw_interface_t *hi; + const ipsec_tunnel_if_t *t0; + + t0 = pool_elt_at_index (im->tunnel_interfaces, p[0]); + vnet_buffer (b0)->ipsec.sad_index = t0->input_sa_index; + if (PREDICT_TRUE (t0->hw_if_index != ~0)) + { vnet_buffer (b0)->ipsec.flags = 0; - hi = vnet_get_hw_interface (vnm, t->hw_if_index); - sw_if_index0 = hi->sw_if_index; + sw_if_index0 = t0->sw_if_index; vnet_buffer (b0)->sw_if_index[VLIB_RX] = sw_if_index0; if (PREDICT_FALSE - (!(hi->flags & VNET_HW_INTERFACE_FLAG_LINK_UP))) + (!(t0->flags & VNET_HW_INTERFACE_FLAG_LINK_UP))) { vlib_increment_combined_counter (drop_counter, thread_index, sw_if_index0, 1, len0); @@ -150,17 +149,6 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, } else { - sa0 = pool_elt_at_index (im->sad, t->input_sa_index); - icv_len = - em->ipsec_proto_main_integ_algs[sa0-> - integ_alg].trunc_size; - - /* length = packet length - ESP/tunnel overhead */ - n_bytes -= n_packets * (sizeof (ip4_header_t) + - sizeof (esp_header_t) + - sizeof (esp_footer_t) + - 16 /* aes-cbc IV */ + icv_len); - if (last_t) { vlib_increment_combined_counter @@ -169,7 +157,7 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, } last_sw_if_index = sw_if_index0; - last_t = t; + last_t = t0; n_packets = 1; n_bytes = len0; } @@ -179,7 +167,6 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, vnet_buffer (b0)->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL; } - vlib_buffer_advance (b0, ip4_header_bytes (ip0)); next0 = im->esp4_decrypt_next_index; } else @@ -205,12 +192,6 @@ VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, if (last_t) { - sa0 = pool_elt_at_index (im->sad, last_t->input_sa_index); - icv_len = em->ipsec_proto_main_integ_algs[sa0->integ_alg].trunc_size; - - n_bytes -= n_packets * (sizeof (ip4_header_t) + sizeof (esp_header_t) + - sizeof (esp_footer_t) + 16 /* aes-cbc IV */ + - icv_len); vlib_increment_combined_counter (rx_counter, thread_index, last_sw_if_index, n_packets, n_bytes); -- cgit 1.2.3-korg