From a09c1ff5b6ae535932b4fc9477ffc4e39748ca62 Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Mon, 4 Feb 2019 01:10:30 -0800 Subject: IPSEC: SPD counters in the stats sgement - return the stats_index of each SPD in the create API call - no ip_any in the API as this creates 2 SPD entries. client must add both v4 and v6 explicitly - only one pool of SPD entries (rhter than one per-SPD) to support this - no packets/bytes in the dump API. Polling the stats segment is much more efficient (if the SA lifetime is based on packet/bytes) - emit the policy index in the packet trace and CLI commands. Change-Id: I7eaf52c9d0495fa24450facf55229941279b8569 Signed-off-by: Neale Ranns --- src/vnet/ipsec/ipsec_spd.h | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) (limited to 'src/vnet/ipsec/ipsec_spd.h') diff --git a/src/vnet/ipsec/ipsec_spd.h b/src/vnet/ipsec/ipsec_spd.h index 854076ece6d..dd09041b046 100644 --- a/src/vnet/ipsec/ipsec_spd.h +++ b/src/vnet/ipsec/ipsec_spd.h @@ -17,23 +17,34 @@ #include -struct ipsec_policy_t_; +#define foreach_ipsec_spd_policy_type \ + _(IP4_OUTBOUND, "ip4-outbound") \ + _(IP6_OUTBOUND, "ip6-outbound") \ + _(IP4_INBOUND_PROTECT, "ip4-inbound-protect") \ + _(IP6_INBOUND_PROTECT, "ip6-inbound-protect") \ + _(IP4_INBOUND_BYPASS, "ip4-inbound-bypass") \ + _(IP6_INBOUND_BYPASS, "ip6-inbound-bypass") + +typedef enum ipsec_spd_policy_t_ +{ +#define _(s,v) IPSEC_SPD_POLICY_##s, + foreach_ipsec_spd_policy_type +#undef _ + IPSEC_SPD_POLICY_N_TYPES, +} ipsec_spd_policy_t; + +#define FOR_EACH_IPSEC_SPD_POLICY_TYPE(_t) \ + for (_t = 0; _t < IPSEC_SPD_POLICY_N_TYPES; _t++) /** * @brief A Secruity Policy Database */ -typedef struct ipsec_spd_t_ +typedef struct { + /** the User's ID for this policy */ u32 id; - /* pool of policies */ - struct ipsec_policy_t_ *policies; - /* vectors of policy indices */ - u32 *ipv4_outbound_policies; - u32 *ipv6_outbound_policies; - u32 *ipv4_inbound_protect_policy_indices; - u32 *ipv4_inbound_policy_discard_and_bypass_indices; - u32 *ipv6_inbound_protect_policy_indices; - u32 *ipv6_inbound_policy_discard_and_bypass_indices; + /** vectors for each of the policy types */ + u32 *policies[IPSEC_SPD_POLICY_N_TYPES]; } ipsec_spd_t; /** @@ -47,6 +58,8 @@ extern int ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add); extern int ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id, int is_add); +extern u8 *format_ipsec_spd (u8 * s, va_list * args); + #endif /* __IPSEC_SPD_H__ */ /* -- cgit 1.2.3-korg