This is automatically generated documentation. Edit after the "COMMENTS" heading; changes to the main body will be lost.
IPsecRouteTable -- Click element; IP routing table superclass
Package: ipsec (core)
IPsecRouteTable defines an interface useful for implementing IPv4 route lookup
elements. It parses configuration strings -- see LinearIPLookup for an example
-- and calls virtual functions to add the resulting routes. A default
function uses those virtual functions to look up routes and output packets
accordingly. There are also some functions useful for implementing handlers.
IPsecRouteTable also supports IPsec ESP tunnels between gateways.
Click provides several elements that implement all or part of the IPsecRouteTable interface. Marko Zec has compared their performance, in terms of lookup speed and memory size, for full BGP feeds; here are the results. Methodology: 2.8GHz Pentium P4 CPU, 521K L2 cache, FreeBSD 4.10, userspace Click. RangeIPsecLookup has two lookup tables, the larger of which is used only at update time. The "warm cache" numbers perform the same lookup several times in a loop to populate the cache; only the last lookup's performance is reported.
ICSI BGP dump, 150700 routes, 2 next-hops Element | cycles | lookups | setup | lookup | /lookup | /sec | time | tbl. size -----------------+---------+---------+-------+---------------- RadixIPLookup | 1025 | 2.73M | 0.59s | 5.8 MB DirectIPsecLookup | 432 | 6.48M | 0.74s | 33 MB RangeIPsecLookup | 279 | 10.0 M | 0.83s | 0.21MB (+33MB) " (warm cache) | 44 | 63.6 M | " | " " routeviews.org dump, 167000 routes, 52 nexthops Element | cycles | lookups | setup | lookup | /lookup | /sec | time | tbl. size -----------------+---------+---------+-------+---------------- RadixIPLookup | 1095 | 2.55M | 0.67s | 6.6 MB DirectIPsecLookup | 434 | 6.45M | 0.77s | 33 MB RangeIPsecLookup | 508 | 5.51M | 0.88s | 0.51MB (+33MB) " (warm cache) | 61 | 45.9 M | " | " "
The RadixIPLookup, DirectIPsecLookup, and RangeIPsecLookup elements are well suited for implementing large tables. We also provide the LinearIPLookup, StaticIPLookup, and SortedIPLookup elements; they are simple, but their O(N) lookup speed is orders of magnitude slower. RadixIPLookup or DirectIPsecLookup should be preferred for almost all purposes.
1500-entry fraction of the ICSI BGP dump Method | cycles | lookups | setup | lookup | /lookup | /sec | time | tbl. size ---------------+---------+---------+-------+---------- LinearIPLookup | 12000 | 233K | 10s | 29 KB StaticIPLookup | 12000 | 233K | 10s | 29 KB SortedIPLookup | 12500 | 224K | 38s | 29 KB
These four IPsecRouteTable virtual functions should generally be overridden by particular routing table elements.
int add_route(const IPsecRoute& r, bool set, IPsecRoute* old_route, ErrorHandler *errh)
r.gw, via output port
r.port. If a route for this exact prefix already exists, then the behavior depends on
setis true, then any existing route is silently overwritten (after possibly being stored in
setis false, the function should return
-EEXIST. Report errors to
errh. Should return 0 on success and negative on failure. The default implementation reports an error "cannot add routes to this routing table".
int remove_route(const IPsecRoute& r, IPsecRoute* old_route, ErrorHandler *errh)
r.gw, via the element's output port
r.port. All four fields must match, unless
r.portis less than 0, in which case only
r.addr/r.maskmust match. If no route for that prefix exists, the function should return
-ENOENT; otherwise, the old route should be stored in
*old_route(assuming it's not null). Any errors are reported to
errh. Should return 0 on success and negative on failure. The default implementation reports an error "cannot delete routes from this routing table".
int lookup_route(IPAddress dst, IPAddress &gw_return) const
dst. Should set
gw_returnto the resulting gateway and return the relevant output port (or negative if there is no route). The default implementation returns -1.
int configure(Vector<String> &conf, ErrorHandler *)
confas a list of routes, where each route is the space-separated list `
address/mask [gateway] output'. The routes are successively added to the element with add_route.
void push(int port, Packet *p)
static int add_route_handler(const String &, Element *, void *, ErrorHandler *)
static int remove_route_handler(const String &, Element *, void *, ErrorHandler *)
static int ctrl_handler(const String &, Element *, void *, ErrorHandler *)
static String table_handler(Element *, void *)
Ports 0 and 1 must be connected to the proper IPSEC modules that handle incoming tunneled traffic and outgoing
tunneled traffic accordingly. All the routing table entries that refer to an IPSEC tunnel must use these ports respectively. Routing table entries that refer to an IPSEC ESP tunnel must have the following entries:
|SPI||128-BIT ENCRYPTION_KEY||128-BIT AUTHENTICATION_KEY||REPLAY PROTECTION COUNTER||OUT-OF-ORDER REPLAY WINDOW|
The encryption and authentication keys will generally be specified using
syntax such as
\<0183 A947 1ABE 01FF FA04 103B B102<gt>.
This module uses 4 and 5 annotation space integers to pass Security Association Data between IPsec modules.
Generated by 'click-elem2man' from '../elements/ipsec/ipsecroutetable.hh:10' on 12/Jul/2011.