From e524d45eff40c773049e03ea5063216b469bbfcc Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Tue, 19 Feb 2019 15:22:46 +0000 Subject: IPSEC-GRE: fixes and API update to common types. Change-Id: Icdcbac7453baa837a9c0c4a2401dff4a6aa6cba0 Signed-off-by: Neale Ranns --- src/vnet/ipsec-gre/interface.c | 62 ++++++++++++++------------------------ src/vnet/ipsec-gre/ipsec_gre.api | 37 ++++++++++++++--------- src/vnet/ipsec-gre/ipsec_gre.c | 3 +- src/vnet/ipsec-gre/ipsec_gre.h | 23 ++++---------- src/vnet/ipsec-gre/ipsec_gre_api.c | 50 +++++++++++++++--------------- src/vnet/ipsec-gre/node.c | 8 ++--- 6 files changed, 81 insertions(+), 102 deletions(-) (limited to 'src/vnet/ipsec-gre') diff --git a/src/vnet/ipsec-gre/interface.c b/src/vnet/ipsec-gre/interface.c index 700072350ca..6a8bb7d8f0b 100644 --- a/src/vnet/ipsec-gre/interface.c +++ b/src/vnet/ipsec-gre/interface.c @@ -86,31 +86,23 @@ VLIB_INIT_FUNCTION (ipsec_gre_interface_init); /** * @brief Add or delete ipsec-gre tunnel interface. * - * @param *a vnet_ipsec_gre_add_del_tunnel_args_t - tunnel interface parameters + * @param *a vnet_ipsec_gre_tunnel_add_del_args_t - tunnel interface parameters * @param *sw_if_indexp u32 - software interface index * @return int - 0 if success otherwise VNET_API_ERROR_ */ int -vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, +vnet_ipsec_gre_tunnel_add_del (const ipsec_gre_tunnel_add_del_args_t * a, u32 * sw_if_indexp) { ipsec_gre_main_t *igm = &ipsec_gre_main; vnet_main_t *vnm = igm->vnet_main; - ip4_main_t *im = &ip4_main; + ipsec_main_t *im = &ipsec_main; ipsec_gre_tunnel_t *t; vnet_hw_interface_t *hi; u32 hw_if_index, sw_if_index; u32 slot; uword *p; u64 key; - ipsec_add_del_ipsec_gre_tunnel_args_t args; - - clib_memset (&args, 0, sizeof (args)); - args.is_add = a->is_add; - args.local_sa_id = a->lsa; - args.remote_sa_id = a->rsa; - args.local_ip.as_u32 = a->src.as_u32; - args.remote_ip.as_u32 = a->dst.as_u32; key = (u64) a->src.as_u32 << 32 | (u64) a->dst.as_u32; p = hash_get (igm->tunnel_by_key, key); @@ -160,10 +152,10 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, t->hw_if_index = hw_if_index; t->sw_if_index = sw_if_index; - t->local_sa_id = a->lsa; - t->remote_sa_id = a->rsa; - t->local_sa = ipsec_get_sa_index_by_sa_id (a->lsa); - t->remote_sa = ipsec_get_sa_index_by_sa_id (a->rsa); + t->local_sa_id = a->local_sa_id; + t->remote_sa_id = a->remote_sa_id; + t->local_sa = ipsec_get_sa_index_by_sa_id (t->local_sa_id); + t->remote_sa = ipsec_get_sa_index_by_sa_id (t->remote_sa_id); ip4_sw_interface_enable_disable (sw_if_index, 1); @@ -171,8 +163,6 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, sw_if_index, ~0); igm->tunnel_index_by_sw_if_index[sw_if_index] = t - igm->tunnels; - vec_validate (im->fib_index_by_sw_if_index, sw_if_index); - hi->min_packet_bytes = 64 + sizeof (gre_header_t) + sizeof (ip4_header_t) + sizeof (esp_header_t) + sizeof (esp_footer_t); @@ -185,12 +175,11 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, hash_set (igm->tunnel_by_key, key, t - igm->tunnels); - slot = vlib_node_add_named_next_with_slot - (vnm->vlib_main, hi->tx_node_index, "esp4-encrypt", + slot = vlib_node_add_next_with_slot + (vnm->vlib_main, hi->tx_node_index, im->esp4_encrypt_node_index, IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT); ASSERT (slot == IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT); - } else { /* !is_add => delete */ @@ -216,7 +205,7 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, if (sw_if_indexp) *sw_if_indexp = sw_if_index; - return ipsec_add_del_ipsec_gre_tunnel (vnm, &args); + return ipsec_add_del_ipsec_gre_tunnel (vnm, a); } static clib_error_t * @@ -225,15 +214,15 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, vlib_cli_command_t * cmd) { unformat_input_t _line_input, *line_input = &_line_input; - u8 is_add = 1; u32 num_m_args = 0; - ip4_address_t src, dst; - u32 lsa = 0, rsa = 0; - vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a; + ipsec_gre_tunnel_add_del_args_t _a, *a = &_a; int rv; u32 sw_if_index; clib_error_t *error = NULL; + clib_memset (a, 0, sizeof (*a)); + a->is_add = 1; + /* Get a line of input. */ if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -241,14 +230,14 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) { if (unformat (line_input, "del")) - is_add = 0; - else if (unformat (line_input, "src %U", unformat_ip4_address, &src)) + a->is_add = 0; + else if (unformat (line_input, "src %U", unformat_ip4_address, &a->src)) num_m_args++; - else if (unformat (line_input, "dst %U", unformat_ip4_address, &dst)) + else if (unformat (line_input, "dst %U", unformat_ip4_address, &a->dst)) num_m_args++; - else if (unformat (line_input, "local-sa %d", &lsa)) + else if (unformat (line_input, "local-sa %d", &a->local_sa_id)) num_m_args++; - else if (unformat (line_input, "remote-sa %d", &rsa)) + else if (unformat (line_input, "remote-sa %d", &a->remote_sa_id)) num_m_args++; else { @@ -264,20 +253,13 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, goto done; } - if (memcmp (&src, &dst, sizeof (src)) == 0) + if (memcmp (&a->src, &a->dst, sizeof (a->src)) == 0) { error = clib_error_return (0, "src and dst are identical"); goto done; } - clib_memset (a, 0, sizeof (*a)); - a->is_add = is_add; - a->lsa = lsa; - a->rsa = rsa; - clib_memcpy (&a->src, &src, sizeof (src)); - clib_memcpy (&a->dst, &dst, sizeof (dst)); - - rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index); + rv = vnet_ipsec_gre_tunnel_add_del (a, &sw_if_index); switch (rv) { @@ -290,7 +272,7 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, goto done; default: error = clib_error_return (0, - "vnet_ipsec_gre_add_del_tunnel returned %d", + "vnet_ipsec_gre_tunnel_add_del returned %d", rv); goto done; } diff --git a/src/vnet/ipsec-gre/ipsec_gre.api b/src/vnet/ipsec-gre/ipsec_gre.api index 770746d5e32..b4950097f61 100644 --- a/src/vnet/ipsec-gre/ipsec_gre.api +++ b/src/vnet/ipsec-gre/ipsec_gre.api @@ -13,25 +13,37 @@ * limitations under the License. */ -option version = "1.0.0"; +option version = "1.1.0"; + +import "vnet/ip/ip_types.api"; /** \brief Add / del ipsec gre tunnel request @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request - @param local_sa_id - local SA id - @param remote_sa_id - remote SA id + @param local_sa_id - local/output SA id + @param remote_sa_id - remote/input SA id @param is_add - 1 if adding the tunnel, 0 if deleting - @param src_address - tunnel source address - @param dst_address - tunnel destination address + @param sw_if_index - software index of the ipsec gre tunnel + ignored on create. set in dump/details + @param src - tunnel source address + @param dst - tunnel destination address */ -define ipsec_gre_add_del_tunnel { +typedef ipsec_gre_tunnel { u32 client_index; u32 context; u32 local_sa_id; u32 remote_sa_id; u8 is_add; - u8 src_address[4]; - u8 dst_address[4]; + u32 sw_if_index; + vl_api_ip4_address_t src; + vl_api_ip4_address_t dst; +}; + +define ipsec_gre_tunnel_add_del { + u32 client_index; + u32 context; + u8 is_add; + vl_api_ipsec_gre_tunnel_t tunnel; }; /** \brief Reply for add / del ipsec gre tunnel request @@ -39,7 +51,7 @@ define ipsec_gre_add_del_tunnel { @param retval - return code @param sw_if_index - software index of the new ipsec gre tunnel */ -define ipsec_gre_add_del_tunnel_reply { +define ipsec_gre_tunnel_add_del_reply { u32 context; i32 retval; u32 sw_if_index; @@ -58,7 +70,6 @@ define ipsec_gre_tunnel_dump { /** \brief ipsec gre tunnel operational state response @param context - returned sender context, to match reply w/ request - @param sw_if_index - software index of the ipsec gre tunnel @param local_sa_id - local SA id @param remote_sa_id - remote SA id @param src_address - tunnel source address @@ -66,11 +77,7 @@ define ipsec_gre_tunnel_dump { */ define ipsec_gre_tunnel_details { u32 context; - u32 sw_if_index; - u32 local_sa_id; - u32 remote_sa_id; - u8 src_address[4]; - u8 dst_address[4]; + vl_api_ipsec_gre_tunnel_t tunnel; }; /* diff --git a/src/vnet/ipsec-gre/ipsec_gre.c b/src/vnet/ipsec-gre/ipsec_gre.c index e4f5e805289..cdb23dd9deb 100644 --- a/src/vnet/ipsec-gre/ipsec_gre.c +++ b/src/vnet/ipsec-gre/ipsec_gre.c @@ -106,8 +106,7 @@ VNET_DEVICE_CLASS_TX_FN (ipsec_gre_device_class) (vlib_main_t * vm, vnet_interface_output_runtime_t *rd = (void *) node->runtime_data; ipsec_gre_tunnel_t *t = pool_elt_at_index (igm->tunnels, rd->dev_instance); - /* use an ethertype of 0x01 for l2-gre */ - u16 l2_gre_protocol_ethertype = clib_net_to_host_u16 (0x01); + u16 l2_gre_protocol_ethertype = clib_net_to_host_u16 (GRE_PROTOCOL_teb); /* Vector of buffer / pkt indices we're supposed to process */ from = vlib_frame_vector_args (frame); diff --git a/src/vnet/ipsec-gre/ipsec_gre.h b/src/vnet/ipsec-gre/ipsec_gre.h index caf2ecf8b30..730cd717795 100644 --- a/src/vnet/ipsec-gre/ipsec_gre.h +++ b/src/vnet/ipsec-gre/ipsec_gre.h @@ -28,6 +28,8 @@ #include #include #include +#include +#include extern vnet_hw_interface_class_t ipsec_gre_hw_interface_class; @@ -86,24 +88,11 @@ extern vlib_node_registration_t ipsec_gre_input_node; extern vnet_device_class_t ipsec_gre_device_class; /* manually added to the interface output node in ipsec_gre.c */ -#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT 1 +#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT 0 -/** - * @brief IPSec-GRE tunnel add/del arguments. - * -*/ -typedef struct -{ - u8 is_add; /**< 1 - add, 0 - delete */ - - ip4_address_t src; /**< tunnel IPv4 src address */ - ip4_address_t dst; /**< tunnel IPv4 dst address */ - u32 lsa; /**< local IPSec SA id */ - u32 rsa; /**< remote IPSec SA id */ -} vnet_ipsec_gre_add_del_tunnel_args_t; - -int vnet_ipsec_gre_add_del_tunnel - (vnet_ipsec_gre_add_del_tunnel_args_t * a, u32 * sw_if_indexp); +extern int vnet_ipsec_gre_tunnel_add_del (const + ipsec_gre_tunnel_add_del_args_t * a, + u32 * sw_if_indexp); #endif /* included_ipsec_gre_h */ diff --git a/src/vnet/ipsec-gre/ipsec_gre_api.c b/src/vnet/ipsec-gre/ipsec_gre_api.c index 3f85c4fc266..24c1f0d5600 100644 --- a/src/vnet/ipsec-gre/ipsec_gre_api.c +++ b/src/vnet/ipsec-gre/ipsec_gre_api.c @@ -23,6 +23,7 @@ #include #include #include +#include #include @@ -43,43 +44,43 @@ #include #define foreach_vpe_api_msg \ -_(IPSEC_GRE_ADD_DEL_TUNNEL, ipsec_gre_add_del_tunnel) \ +_(IPSEC_GRE_TUNNEL_ADD_DEL, ipsec_gre_tunnel_add_del) \ _(IPSEC_GRE_TUNNEL_DUMP, ipsec_gre_tunnel_dump) static void -vl_api_ipsec_gre_add_del_tunnel_t_handler (vl_api_ipsec_gre_add_del_tunnel_t * +vl_api_ipsec_gre_tunnel_add_del_t_handler (vl_api_ipsec_gre_tunnel_add_del_t * mp) { - vl_api_ipsec_gre_add_del_tunnel_reply_t *rmp; + vl_api_ipsec_gre_tunnel_add_del_reply_t *rmp; int rv = 0; - vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a; + ipsec_gre_tunnel_add_del_args_t _a, *a = &_a; u32 sw_if_index = ~0; + clib_memset (a, 0, sizeof (*a)); + + ip4_address_decode (mp->tunnel.src, &a->src); + ip4_address_decode (mp->tunnel.dst, &a->dst); + /* Check src & dst are different */ - if (memcmp (mp->src_address, mp->dst_address, 4) == 0) + if (a->src.as_u32 == a->dst.as_u32) { rv = VNET_API_ERROR_SAME_SRC_DST; goto out; } - clib_memset (a, 0, sizeof (*a)); - - /* ip addresses sent in network byte order */ - clib_memcpy (&(a->src), mp->src_address, 4); - clib_memcpy (&(a->dst), mp->dst_address, 4); a->is_add = mp->is_add; - a->lsa = ntohl (mp->local_sa_id); - a->rsa = ntohl (mp->remote_sa_id); + a->local_sa_id = ntohl (mp->tunnel.local_sa_id); + a->remote_sa_id = ntohl (mp->tunnel.remote_sa_id); - rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index); + rv = vnet_ipsec_gre_tunnel_add_del (a, &sw_if_index); out: - /* *INDENT-OFF* */ - REPLY_MACRO2(VL_API_GRE_ADD_DEL_TUNNEL_REPLY, - ({ - rmp->sw_if_index = ntohl (sw_if_index); - })); - /* *INDENT-ON* */ + /* *INDENT-OFF* */ + REPLY_MACRO2(VL_API_GRE_ADD_DEL_TUNNEL_REPLY, + ({ + rmp->sw_if_index = ntohl (sw_if_index); + })); + /* *INDENT-ON* */ } static void send_ipsec_gre_tunnel_details @@ -90,11 +91,12 @@ static void send_ipsec_gre_tunnel_details rmp = vl_msg_api_alloc (sizeof (*rmp)); clib_memset (rmp, 0, sizeof (*rmp)); rmp->_vl_msg_id = ntohs (VL_API_IPSEC_GRE_TUNNEL_DETAILS); - clib_memcpy (rmp->src_address, &(t->tunnel_src), 4); - clib_memcpy (rmp->dst_address, &(t->tunnel_dst), 4); - rmp->sw_if_index = htonl (t->sw_if_index); - rmp->local_sa_id = htonl (t->local_sa_id); - rmp->remote_sa_id = htonl (t->remote_sa_id); + + ip4_address_encode (&t->tunnel_src, rmp->tunnel.src); + ip4_address_encode (&t->tunnel_dst, rmp->tunnel.dst); + rmp->tunnel.sw_if_index = htonl (t->sw_if_index); + rmp->tunnel.local_sa_id = htonl (t->local_sa_id); + rmp->tunnel.remote_sa_id = htonl (t->remote_sa_id); rmp->context = context; vl_api_send_msg (reg, (u8 *) rmp); diff --git a/src/vnet/ipsec-gre/node.c b/src/vnet/ipsec-gre/node.c index 9e1ab206ad4..6a3aaa12e8c 100644 --- a/src/vnet/ipsec-gre/node.c +++ b/src/vnet/ipsec-gre/node.c @@ -160,7 +160,7 @@ VLIB_NODE_FN (ipsec_gre_input_node) (vlib_main_t * vm, protocol0 = clib_net_to_host_u16 (h0->protocol); protocol1 = clib_net_to_host_u16 (h1->protocol); - if (PREDICT_TRUE(protocol0 == 0x0001)) + if (PREDICT_TRUE(protocol0 == GRE_PROTOCOL_teb)) { next0 = IPSEC_GRE_INPUT_NEXT_L2_INPUT; b0->error = node->errors[IPSEC_GRE_ERROR_NONE]; @@ -170,7 +170,7 @@ VLIB_NODE_FN (ipsec_gre_input_node) (vlib_main_t * vm, b0->error = node->errors[IPSEC_GRE_ERROR_UNKNOWN_PROTOCOL]; next0 = IPSEC_GRE_INPUT_NEXT_DROP; } - if (PREDICT_TRUE(protocol1 == 0x0001)) + if (PREDICT_TRUE(protocol1 == GRE_PROTOCOL_teb)) { next1 = IPSEC_GRE_INPUT_NEXT_L2_INPUT; b1->error = node->errors[IPSEC_GRE_ERROR_NONE]; @@ -314,7 +314,7 @@ drop1: h0 = vlib_buffer_get_current (b0); protocol0 = clib_net_to_host_u16 (h0->protocol); - if (PREDICT_TRUE(protocol0 == 0x0001)) + if (PREDICT_TRUE(protocol0 == GRE_PROTOCOL_teb)) { next0 = IPSEC_GRE_INPUT_NEXT_L2_INPUT; b0->error = node->errors[IPSEC_GRE_ERROR_NONE]; @@ -332,7 +332,7 @@ drop1: next0 = verr0 ? IPSEC_GRE_INPUT_NEXT_DROP : next0; /* For L2 payload set input sw_if_index to GRE tunnel for learning */ - if (PREDICT_FALSE(next0 == IPSEC_GRE_INPUT_NEXT_L2_INPUT)) + if (PREDICT_TRUE(next0 == IPSEC_GRE_INPUT_NEXT_L2_INPUT)) { u64 key = ((u64)(tun_dst0) << 32) | (u64)(tun_src0); -- cgit 1.2.3-korg