FD.io VPP  v20.01-48-g3e0dafb74
Vector Packet Processing
ipsec_input.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel decapsulation
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/feature/feature.h>
22 
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 #include <vnet/ipsec/ah.h>
26 #include <vnet/ipsec/ipsec_io.h>
27 
28 #define foreach_ipsec_input_error \
29 _(RX_PKTS, "IPSEC pkts received") \
30 _(RX_MATCH_PKTS, "IPSEC pkts matched")
31 
32 typedef enum
33 {
34 #define _(sym,str) IPSEC_INPUT_ERROR_##sym,
36 #undef _
39 
40 static char *ipsec_input_error_strings[] = {
41 #define _(sym,string) string,
43 #undef _
44 };
45 
46 typedef struct
47 {
55 
56 /* packet trace format function */
57 static u8 *
58 format_ipsec_input_trace (u8 * s, va_list * args)
59 {
60  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
61  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
62  ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
63 
64  s = format (s, "%U: sa_id %u spd %u policy %d spi %u (0x%08x) seq %u",
66  t->spd, t->policy_index, t->spi, t->spi, t->seq);
67 
68  return s;
69 }
70 
73 {
74  ipsec_main_t *im = &ipsec_main;
75  ipsec_policy_t *p;
76  ipsec_sa_t *s;
77  u32 *i;
78 
79  vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT])
80  {
81  p = pool_elt_at_index (im->policies, *i);
82  s = pool_elt_at_index (im->sad, p->sa_index);
83 
84  if (spi != s->spi)
85  continue;
86 
87  if (ipsec_sa_is_set_IS_TUNNEL (s))
88  {
89  if (da != clib_net_to_host_u32 (s->tunnel_dst_addr.ip4.as_u32))
90  continue;
91 
92  if (sa != clib_net_to_host_u32 (s->tunnel_src_addr.ip4.as_u32))
93  continue;
94 
95  return p;
96  }
97 
98  if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
99  continue;
100 
101  if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
102  continue;
103 
104  if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
105  continue;
106 
107  if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
108  continue;
109 
110  return p;
111  }
112  return 0;
113 }
114 
117  ip6_address_t * ua)
118 {
119  if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
120  (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
121  return 1;
122  return 0;
123 }
124 
127  ip6_address_t * sa,
128  ip6_address_t * da, u32 spi)
129 {
130  ipsec_main_t *im = &ipsec_main;
131  ipsec_policy_t *p;
132  ipsec_sa_t *s;
133  u32 *i;
134 
135  vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT])
136  {
137  p = pool_elt_at_index (im->policies, *i);
138  s = pool_elt_at_index (im->sad, p->sa_index);
139 
140  if (spi != s->spi)
141  continue;
142 
143  if (ipsec_sa_is_set_IS_TUNNEL (s))
144  {
145  if (!ip6_address_is_equal (sa, &s->tunnel_src_addr.ip6))
146  continue;
147 
148  if (!ip6_address_is_equal (da, &s->tunnel_dst_addr.ip6))
149  continue;
150 
151  return p;
152  }
153 
154  if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6))
155  continue;
156 
157  if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6))
158  continue;
159 
160  return p;
161  }
162  return 0;
163 }
164 
166 
169  vlib_frame_t * from_frame)
170 {
171  u32 n_left_from, *from, next_index, *to_next, thread_index;
172  ipsec_main_t *im = &ipsec_main;
173  u32 ipsec_unprocessed = 0;
174  u32 ipsec_matched = 0;
175 
176  from = vlib_frame_vector_args (from_frame);
177  n_left_from = from_frame->n_vectors;
178  thread_index = vm->thread_index;
179 
180  next_index = node->cached_next_index;
181 
182  while (n_left_from > 0)
183  {
184  u32 n_left_to_next;
185 
186  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
187 
188  while (n_left_from > 0 && n_left_to_next > 0)
189  {
190  u32 bi0, next0, pi0;
191  vlib_buffer_t *b0;
192  ip4_header_t *ip0;
193  esp_header_t *esp0;
194  ah_header_t *ah0;
195  ip4_ipsec_config_t *c0;
196  ipsec_spd_t *spd0;
197  ipsec_policy_t *p0 = 0;
198  u8 has_space0;
199 
200  bi0 = to_next[0] = from[0];
201  from += 1;
202  n_left_from -= 1;
203  to_next += 1;
204  n_left_to_next -= 1;
205 
206  b0 = vlib_get_buffer (vm, bi0);
207  b0->flags |= VNET_BUFFER_F_IS_IP4;
208  b0->flags &= ~VNET_BUFFER_F_IS_IP6;
209  c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
210 
211  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
212 
213  ip0 = vlib_buffer_get_current (b0);
214 
215  if (PREDICT_TRUE
216  (ip0->protocol == IP_PROTOCOL_IPSEC_ESP
217  || ip0->protocol == IP_PROTOCOL_UDP))
218  {
219 #if 0
221  ("packet received from %U to %U spi %u size %u spd_id %u",
224  clib_net_to_host_u32 (esp0->spi),
225  clib_net_to_host_u16 (ip0->length), spd0->id);
226 #endif
227 
228  esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
229  if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_UDP))
230  {
231  esp0 =
232  (esp_header_t *) ((u8 *) esp0 + sizeof (udp_header_t));
233  }
234 
236  clib_net_to_host_u32
237  (ip0->src_address.
238  as_u32),
239  clib_net_to_host_u32
240  (ip0->dst_address.
241  as_u32),
242  clib_net_to_host_u32
243  (esp0->spi));
244 
245  has_space0 =
247  (clib_address_t) (esp0 + 1) -
248  (clib_address_t) ip0);
249 
250  if (PREDICT_TRUE ((p0 != NULL) & (has_space0)))
251  {
252  ipsec_matched += 1;
253 
254  pi0 = p0 - im->policies;
257  thread_index, pi0, 1,
258  clib_net_to_host_u16 (ip0->length));
259 
260  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
261  next0 = im->esp4_decrypt_next_index;
262  vlib_buffer_advance (b0, ((u8 *) esp0 - (u8 *) ip0));
263  goto trace0;
264  }
265  else
266  {
267  p0 = 0;
268  pi0 = ~0;
269  };
270 
271  /* FIXME bypass and discard */
272  trace0:
273  if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
274  PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
275  {
276  ipsec_input_trace_t *tr =
277  vlib_add_trace (vm, node, b0, sizeof (*tr));
278 
279  tr->proto = ip0->protocol;
280  tr->sa_id = p0 ? p0->sa_id : ~0;
281  tr->spi =
282  has_space0 ? clib_net_to_host_u32 (esp0->spi) : ~0;
283  tr->seq =
284  has_space0 ? clib_net_to_host_u32 (esp0->seq) : ~0;
285  tr->spd = spd0->id;
286  tr->policy_index = pi0;
287  }
288  }
289  else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
290  {
291  ah0 = (ah_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
293  clib_net_to_host_u32
294  (ip0->src_address.
295  as_u32),
296  clib_net_to_host_u32
297  (ip0->dst_address.
298  as_u32),
299  clib_net_to_host_u32
300  (ah0->spi));
301 
302  has_space0 =
304  (clib_address_t) (ah0 + 1) -
305  (clib_address_t) ip0);
306 
307  if (PREDICT_TRUE ((p0 != NULL) & (has_space0)))
308  {
309  ipsec_matched += 1;
310 
311  pi0 = p0 - im->policies;
314  thread_index, pi0, 1,
315  clib_net_to_host_u16 (ip0->length));
316 
317  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
318  next0 = im->ah4_decrypt_next_index;
319  goto trace1;
320  }
321  else
322  {
323  p0 = 0;
324  pi0 = ~0;
325  }
326  /* FIXME bypass and discard */
327  trace1:
328  if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
329  PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
330  {
331  ipsec_input_trace_t *tr =
332  vlib_add_trace (vm, node, b0, sizeof (*tr));
333 
334  tr->proto = ip0->protocol;
335  tr->sa_id = p0 ? p0->sa_id : ~0;
336  tr->spi = has_space0 ? clib_net_to_host_u32 (ah0->spi) : ~0;
337  tr->seq =
338  has_space0 ? clib_net_to_host_u32 (ah0->seq_no) : ~0;
339  tr->spd = spd0->id;
340  tr->policy_index = pi0;
341  }
342  }
343  else
344  {
345  ipsec_unprocessed += 1;
346  }
347 
348  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
349  to_next, n_left_to_next, bi0,
350  next0);
351  }
352  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
353  }
354 
356  IPSEC_INPUT_ERROR_RX_PKTS,
357  from_frame->n_vectors - ipsec_unprocessed);
358 
360  IPSEC_INPUT_ERROR_RX_MATCH_PKTS,
361  ipsec_matched);
362  return from_frame->n_vectors;
363 }
364 
365 
366 /* *INDENT-OFF* */
368  .name = "ipsec4-input-feature",
369  .vector_size = sizeof (u32),
370  .format_trace = format_ipsec_input_trace,
373  .error_strings = ipsec_input_error_strings,
374  .n_next_nodes = IPSEC_INPUT_N_NEXT,
375  .next_nodes = {
376 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
378 #undef _
379  },
380 };
381 /* *INDENT-ON* */
382 
384 
385 
388  vlib_frame_t * from_frame)
389 {
390  u32 n_left_from, *from, next_index, *to_next, thread_index;
391  ipsec_main_t *im = &ipsec_main;
392  u32 ipsec_unprocessed = 0;
393  u32 ipsec_matched = 0;
394 
395  from = vlib_frame_vector_args (from_frame);
396  n_left_from = from_frame->n_vectors;
397  thread_index = vm->thread_index;
398 
399  next_index = node->cached_next_index;
400 
401  while (n_left_from > 0)
402  {
403  u32 n_left_to_next;
404 
405  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
406 
407  while (n_left_from > 0 && n_left_to_next > 0)
408  {
409  u32 bi0, next0, pi0;
410  vlib_buffer_t *b0;
411  ip6_header_t *ip0;
412  esp_header_t *esp0;
413  ip4_ipsec_config_t *c0;
414  ipsec_spd_t *spd0;
415  ipsec_policy_t *p0 = 0;
416  ah_header_t *ah0;
417  u32 header_size = sizeof (ip0[0]);
418 
419  bi0 = to_next[0] = from[0];
420  from += 1;
421  n_left_from -= 1;
422  to_next += 1;
423  n_left_to_next -= 1;
424 
425  b0 = vlib_get_buffer (vm, bi0);
426  b0->flags |= VNET_BUFFER_F_IS_IP6;
427  b0->flags &= ~VNET_BUFFER_F_IS_IP4;
428  c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
429 
430  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
431 
432  ip0 = vlib_buffer_get_current (b0);
433  esp0 = (esp_header_t *) ((u8 *) ip0 + header_size);
434  ah0 = (ah_header_t *) ((u8 *) ip0 + header_size);
435 
436  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
437  {
438 #if 0
440  ("packet received from %U to %U spi %u size %u spd_id %u",
442  &ip0->dst_address, clib_net_to_host_u32 (esp0->spi),
443  clib_net_to_host_u16 (ip0->payload_length) + header_size,
444  spd0->id);
445 #endif
447  &ip0->src_address,
448  &ip0->dst_address,
449  clib_net_to_host_u32
450  (esp0->spi));
451 
452  if (PREDICT_TRUE (p0 != 0))
453  {
454  ipsec_matched += 1;
455 
456  pi0 = p0 - im->policies;
459  thread_index, pi0, 1,
460  clib_net_to_host_u16 (ip0->payload_length) +
461  header_size);
462 
463  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
464  next0 = im->esp6_decrypt_next_index;
465  vlib_buffer_advance (b0, header_size);
466  goto trace0;
467  }
468  else
469  {
470  pi0 = ~0;
471  }
472  }
473  else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
474  {
476  &ip0->src_address,
477  &ip0->dst_address,
478  clib_net_to_host_u32
479  (ah0->spi));
480 
481  if (PREDICT_TRUE (p0 != 0))
482  {
483  ipsec_matched += 1;
484  pi0 = p0 - im->policies;
487  thread_index, pi0, 1,
488  clib_net_to_host_u16 (ip0->payload_length) +
489  header_size);
490 
491  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
492  next0 = im->ah6_decrypt_next_index;
493  goto trace0;
494  }
495  else
496  {
497  pi0 = ~0;
498  }
499  }
500  else
501  {
502  ipsec_unprocessed += 1;
503  }
504 
505  trace0:
506  if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
507  PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
508  {
509  ipsec_input_trace_t *tr =
510  vlib_add_trace (vm, node, b0, sizeof (*tr));
511 
512  if (p0)
513  tr->sa_id = p0->sa_id;
514  tr->proto = ip0->protocol;
515  tr->spi = clib_net_to_host_u32 (esp0->spi);
516  tr->seq = clib_net_to_host_u32 (esp0->seq);
517  tr->spd = spd0->id;
518  }
519 
520  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
521  n_left_to_next, bi0, next0);
522  }
523  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
524  }
525 
527  IPSEC_INPUT_ERROR_RX_PKTS,
528  from_frame->n_vectors - ipsec_unprocessed);
529 
531  IPSEC_INPUT_ERROR_RX_MATCH_PKTS,
532  ipsec_matched);
533 
534  return from_frame->n_vectors;
535 }
536 
537 
538 /* *INDENT-OFF* */
540  .name = "ipsec6-input-feature",
541  .vector_size = sizeof (u32),
542  .format_trace = format_ipsec_input_trace,
545  .error_strings = ipsec_input_error_strings,
546  .n_next_nodes = IPSEC_INPUT_N_NEXT,
547  .next_nodes = {
548 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
550 #undef _
551  },
552 };
553 /* *INDENT-ON* */
554 
555 /*
556  * fd.io coding-style-patch-verification: ON
557  *
558  * Local Variables:
559  * eval: (c-set-style "gnu")
560  * End:
561  */
static char * ipsec_input_error_strings[]
Definition: ipsec_input.c:40
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
u32 spi
format_function_t format_ip_protocol
Definition: format.h:45
ipsec_spd_t * spds
Definition: ipsec.h:100
#define CLIB_UNUSED(x)
Definition: clib.h:82
ip46_address_t tunnel_src_addr
Definition: ipsec_sa.h:156
u32 ah4_decrypt_next_index
Definition: ipsec.h:140
a
Definition: bitmap.h:538
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
Definition: counter.h:220
ip4_address_t src_address
Definition: ip4_packet.h:170
vlib_node_registration_t ipsec4_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_input_node)
Definition: ipsec_input.c:367
#define PREDICT_TRUE(x)
Definition: clib.h:112
u64 as_u64[2]
Definition: ip6_packet.h:51
unsigned long u64
Definition: types.h:89
ip46_address_range_t laddr
u64 clib_address_t
Definition: types.h:121
#define NULL
Definition: clib.h:58
u32 thread_index
Definition: main.h:218
static ipsec_policy_t * ipsec_input_protect_policy_match(ipsec_spd_t *spd, u32 sa, u32 da, u32 spi)
Definition: ipsec_input.c:72
int i
static uword ip6_addr_match_range(ip6_address_t *a, ip6_address_t *la, ip6_address_t *ua)
Definition: ipsec_input.c:116
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
A Secruity Policy Database.
Definition: ipsec_spd.h:44
#define VLIB_NODE_FN(node)
Definition: node.h:202
static u8 * format_ipsec_input_trace(u8 *s, va_list *args)
Definition: ipsec_input.c:58
ip6_address_t src_address
Definition: ip6_packet.h:307
unsigned char u8
Definition: types.h:56
format_function_t format_ip4_address
Definition: format.h:73
ipsec_main_t ipsec_main
Definition: ipsec.c:28
unsigned int seq_no
Definition: ah.h:27
ip4_address_t dst_address
Definition: ip4_packet.h:170
u32 esp4_decrypt_next_index
Definition: ipsec.h:137
vlib_node_registration_t ipsec6_input_node
(constructor) VLIB_REGISTER_NODE (ipsec6_input_node)
Definition: ipsec_input.c:539
unsigned int u32
Definition: types.h:88
vl_api_fib_path_type_t type
Definition: fib_types.api:123
static_always_inline void * vnet_feature_next_with_data(u32 *next0, vlib_buffer_t *b0, u32 n_data_bytes)
Definition: feature.h:289
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:519
vlib_combined_counter_main_t ipsec_spd_policy_counters
Policy packet & bytes counters.
ipsec_input_error_t
Definition: ipsec_input.c:32
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
#define PREDICT_FALSE(x)
Definition: clib.h:111
enum ip_protocol ip_protocol_t
#define always_inline
Definition: ipsec.h:28
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:338
vlib_main_t * vm
Definition: in2out_ed.c:1810
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
ip46_address_t tunnel_dst_addr
Definition: ipsec_sa.h:157
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
format_function_t format_ip6_address
Definition: format.h:91
ip46_address_t start
#define clib_warning(format, args...)
Definition: error.h:59
u32 esp6_decrypt_next_index
Definition: ipsec.h:142
#define ARRAY_LEN(x)
Definition: clib.h:62
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:456
A Secruity Policy.
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1810
ip_protocol_t proto
Definition: ipsec_input.c:48
ipsec_policy_t * policies
Definition: ipsec.h:104
ipsec_sa_t * sad
Definition: ipsec.h:102
u32 * policies[IPSEC_SPD_POLICY_N_TYPES]
vectors for each of the policy types
Definition: ipsec_spd.h:49
u32 seq
Definition: esp.h:29
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:248
static uword ip6_address_is_equal(const ip6_address_t *a, const ip6_address_t *b)
Definition: ip6_packet.h:164
u32 spi
Definition: esp.h:26
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
struct _vlib_node_registration vlib_node_registration_t
#define foreach_ipsec_input_error
Definition: ipsec_input.c:28
static u8 vlib_buffer_has_space(vlib_buffer_t *b, word l)
Check if there is enough space in buffer to advance.
Definition: buffer.h:265
u32 ah6_decrypt_next_index
Definition: ipsec.h:145
u16 payload_length
Definition: ip6_packet.h:298
ip46_address_range_t raddr
VLIB buffer representation.
Definition: buffer.h:102
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
u32 id
the User&#39;s ID for this policy
Definition: ipsec_spd.h:47
#define vnet_buffer(b)
Definition: buffer.h:408
Definition: ah.h:21
#define vec_foreach(var, vec)
Vector iterator.
static int ip4_header_bytes(const ip4_header_t *i)
Definition: ip4_packet.h:235
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:302
unsigned int spi
Definition: ah.h:26
static ipsec_policy_t * ipsec6_input_protect_policy_match(ipsec_spd_t *spd, ip6_address_t *sa, ip6_address_t *da, u32 spi)
Definition: ipsec_input.c:126
#define foreach_ipsec_input_next
Definition: ipsec_io.h:29
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
ip6_address_t dst_address
Definition: ip6_packet.h:307