ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec: add support for tx-table-id in cli + example

Browse Source 
Type: improvement

Change-Id: I840741dfe040718b682935cdbcb0ba958d45a591
Signed-off-by: Benoît Ganne <bganne@cisco.com>
This commit is contained in:
Benoît Ganne
2020-11-06 14:14:23 +01:00
committed by Matthew Smith
parent 1f85dad1e5
commit 40aa27ef7c
3 changed files with 89 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
src/scripts/vnet/ipsec_spd_vrf Normal file
View File

@ -0,0 +1,72 @@
create packet-generator interface pg0
set int mac addr pg0 4.5.6
create sub-interfaces pg0 1
create sub-interfaces pg0 2
create sub-interfaces pg0 3
ip table add 1
ip table add 2
ip table add 3
set int ip table pg0.1 1
set int ip table pg0.2 2
set int ip table pg0.3 3
set int ip address pg0.1 192.168.0.1/24
set int ip address pg0.2 192.168.0.1/24
set int ip address pg0.3 192.168.0.1/24
set int state pg0 up
set int state pg0.1 up
set int state pg0.2 up
set int state pg0.3 up
ipsec sa add 2 spi 2 crypto-key 6541686776336961656264656f6f6579 crypto-alg aes-cbc-128 tunnel-src 192.168.0.1 tunnel-dst 192.168.0.2 tx-table-id 2
ipsec sa add 3 spi 3 crypto-key 6541686776336961656264656f6f6579 crypto-alg aes-cbc-128 tunnel-src 192.168.0.1 tunnel-dst 192.168.0.2 tx-table-id 3
ipsec spd add 1
set interface ipsec spd pg0.1 1
ipsec policy add spd 1 priority 100 outbound action bypass protocol 50
ipsec policy add spd 1 priority 10 outbound action protect sa 2 local-ip-range 10.5.0.0 - 10.5.0.255 remote-ip-range 10.6.0.0 - 10.6.0.16
ipsec policy add spd 1 priority 10 outbound action protect sa 3 local-ip-range 10.5.0.0 - 10.5.0.255 remote-ip-range 10.6.0.17 - 10.6.0.32
ip route table 1 add 10.6.0.0/16 via 192.168.0.2 pg0.1
set ip neighbor pg0.1 192.168.0.2 00:11:22:33:44:55
set ip neighbor pg0.2 192.168.0.2 00:11:22:33:44:55
set ip neighbor pg0.3 192.168.0.2 00:11:22:33:44:55
trace add pg-input 100
packet-generator new {
name ipsec2
limit 1
rate 1e4
node ethernet-input
interface pg0
size 100-100
data {
IP4: 1.2.3 -> 4.5.6 vlan 1
UDP: 10.5.0.1 -> 10.6.0.1
UDP: 4321 -> 1234
length 72
incrementing 100
}
}
packet-generator new {
name ipsec3
limit 1
rate 1e4
node ethernet-input
interface pg0
size 100-100
data {
IP4: 1.2.3 -> 4.5.6 vlan 1
UDP: 10.5.0.1 -> 10.6.0.22
UDP: 4321 -> 1234
length 72
incrementing 100
}
}

18
src/vnet/ipsec/ipsec_cli.c
View File

@ -36,6 +36,7 @@ set_interface_spd_command_fn (vlib_main_t * vm,
u32 spd_id;
int is_add = 1;
clib_error_t *error = NULL;
int err;
if (!unformat_user (input, unformat_line_input, line_input))
return 0;
@ -53,7 +54,16 @@ set_interface_spd_command_fn (vlib_main_t * vm,
goto done;
}
ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
err = ipsec_set_interface_spd (vm, sw_if_index, spd_id, is_add);
switch (err)
{
case VNET_API_ERROR_SYSCALL_ERROR_1:
error = clib_error_return (0, "no such spd-id");
break;
case VNET_API_ERROR_SYSCALL_ERROR_2:
error = clib_error_return (0, "spd already assigned");
break;
}
done:
unformat_free (line_input);
@ -91,6 +101,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
int is_add, rv;
u32 m_args = 0;
ip_dscp_t dscp;
u32 tx_table_id;
salt = 0;
error = NULL;
@ -101,6 +112,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
crypto_alg = IPSEC_CRYPTO_ALG_NONE;
udp_src = udp_dst = IPSEC_UDP_PORT_NONE;
dscp = IP_DSCP_CS0;
tx_table_id = 0;
if (!unformat_user (input, unformat_line_input, line_input))
return 0;
@ -146,6 +158,8 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
else if (unformat (line_input, "tunnel-dst %U",
unformat_ip46_address, &tun_dst, IP46_TYPE_ANY))
;
else if (unformat (line_input, "tx-table-id %d", &tx_table_id))
;
else if (unformat (line_input, "inbound"))
flags |= IPSEC_SA_FLAG_IS_INBOUND;
else if (unformat (line_input, "use-anti-replay"))
@ -183,7 +197,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
}
rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg,
&ck, integ_alg, &ik, flags,
0, clib_host_to_net_u32 (salt),
tx_table_id, clib_host_to_net_u32 (salt),
&tun_src, &tun_dst,
TUNNEL_ENCAP_DECAP_FLAG_NONE, dscp,
&sai, udp_src, udp_dst);

2
src/vnet/ipsec/ipsec_spd.c
View File

@ -77,7 +77,7 @@ ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
if (p && is_add)
return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
return VNET_API_ERROR_SYSCALL_ERROR_2; /* spd already assigned */
if (is_add)
{