2 *------------------------------------------------------------------
3 * ipsec_api.c - ipsec api
5 * Copyright (c) 2016 Cisco and/or its affiliates.
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at:
10 * http://www.apache.org/licenses/LICENSE-2.0
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
17 *------------------------------------------------------------------
20 #include <vnet/vnet.h>
21 #include <vlibmemory/api.h>
22 #include <vnet/api_errno.h>
23 #include <vpp/app/version.h>
25 #include <ikev2/ikev2.h>
26 #include <ikev2/ikev2_priv.h>
28 /* define message IDs */
29 #include <vnet/format_fns.h>
30 #include <plugins/ikev2/ikev2.api_enum.h>
31 #include <plugins/ikev2/ikev2.api_types.h>
34 #define vl_endianfun /* define message structures */
35 #include <plugins/ikev2/ikev2_types.api.h>
38 extern ikev2_main_t ikev2_main;
40 #define IKEV2_PLUGIN_VERSION_MAJOR 1
41 #define IKEV2_PLUGIN_VERSION_MINOR 0
42 #define REPLY_MSG_ID_BASE ikev2_main.msg_id_base
43 #include <vlibapi/api_helper_macros.h>
46 cp_transforms (vl_api_ikev2_transforms_set_t * vl_api_ts,
47 ikev2_transforms_set * ts)
49 vl_api_ts->crypto_alg = ts->crypto_alg;
50 vl_api_ts->integ_alg = ts->integ_alg;
51 vl_api_ts->dh_type = ts->dh_type;
52 vl_api_ts->crypto_key_size = ts->crypto_key_size;
56 cp_id (vl_api_ikev2_id_t * vl_api_id, ikev2_id_t * id)
62 vl_api_id->type = id->type;
63 size_data = sizeof (vl_api_id->data) - 1; // size without zero ending character
64 if (vec_len (id->data) < size_data)
65 size_data = vec_len (id->data);
67 vl_api_id->data_len = size_data;
68 clib_memcpy (vl_api_id->data, id->data, size_data);
72 cp_ts (vl_api_ikev2_ts_t * vl_api_ts, ikev2_ts_t * ts)
74 vl_api_ts->ts_type = ts->ts_type;
75 vl_api_ts->protocol_id = ts->protocol_id;
76 vl_api_ts->selector_len = ts->selector_len;
77 vl_api_ts->start_port = ts->start_port;
78 vl_api_ts->end_port = ts->end_port;
79 clib_memcpy (&vl_api_ts->start_addr, &ts->start_addr,
80 sizeof (ip4_address_t));
81 clib_memcpy (&vl_api_ts->end_addr, &ts->end_addr, sizeof (ip4_address_t));
85 cp_auth (vl_api_ikev2_auth_t * vl_api_auth, ikev2_auth_t * auth)
87 vl_api_auth->method = auth->method;
88 vl_api_auth->data_len = vec_len (auth->data);
89 vl_api_auth->hex = auth->hex;
90 clib_memcpy (&vl_api_auth->data, auth->data, vec_len (auth->data));
94 cp_responder (vl_api_ikev2_responder_t * vl_api_responder,
95 ikev2_responder_t * responder)
97 vl_api_responder->sw_if_index = responder->sw_if_index;
98 clib_memcpy (&vl_api_responder->ip4, &responder->ip4,
99 sizeof (ip4_address_t));
103 send_profile (ikev2_profile_t * profile, vl_api_registration_t * reg,
106 vl_api_ikev2_profile_details_t *rmp = 0;
108 rmp = vl_msg_api_alloc (sizeof (*rmp) + vec_len (profile->auth.data));
109 clib_memset (rmp, 0, sizeof (*rmp) + vec_len (profile->auth.data));
110 ikev2_main_t *im = &ikev2_main;
111 rmp->_vl_msg_id = ntohs (VL_API_IKEV2_PROFILE_DETAILS + im->msg_id_base);
112 rmp->context = context;
114 int size_data = sizeof (rmp->profile.name) - 1;
115 if (vec_len (profile->name) < size_data)
116 size_data = vec_len (profile->name);
117 clib_memcpy (rmp->profile.name, profile->name, size_data);
119 cp_transforms (&rmp->profile.ike_ts, &profile->ike_ts);
120 cp_transforms (&rmp->profile.esp_ts, &profile->esp_ts);
122 cp_id (&rmp->profile.loc_id, &profile->loc_id);
123 cp_id (&rmp->profile.rem_id, &profile->rem_id);
125 cp_ts (&rmp->profile.rem_ts, &profile->rem_ts);
126 cp_ts (&rmp->profile.loc_ts, &profile->loc_ts);
128 cp_auth (&rmp->profile.auth, &profile->auth);
130 cp_responder (&rmp->profile.responder, &profile->responder);
132 rmp->profile.udp_encap = profile->udp_encap;
133 rmp->profile.tun_itf = profile->tun_itf;
135 rmp->profile.ipsec_over_udp_port = profile->ipsec_over_udp_port;
137 rmp->profile.lifetime = profile->lifetime;
138 rmp->profile.lifetime_maxdata = profile->lifetime_maxdata;
139 rmp->profile.lifetime_jitter = profile->lifetime_jitter;
140 rmp->profile.handover = profile->handover;
142 vl_api_ikev2_profile_t_endian (&rmp->profile);
144 vl_api_send_msg (reg, (u8 *) rmp);
148 vl_api_ikev2_profile_dump_t_handler (vl_api_ikev2_profile_dump_t * mp)
150 ikev2_main_t *im = &ikev2_main;
151 ikev2_profile_t *profile;
152 vl_api_registration_t *reg;
153 reg = vl_api_client_index_to_registration (mp->client_index);
158 pool_foreach (profile, im->profiles,
160 send_profile (profile, reg, mp->context);
166 vl_api_ikev2_plugin_get_version_t_handler (vl_api_ikev2_plugin_get_version_t *
169 ikev2_main_t *im = &ikev2_main;
170 vl_api_ikev2_plugin_get_version_reply_t *rmp;
171 int msg_size = sizeof (*rmp);
172 vl_api_registration_t *reg;
174 reg = vl_api_client_index_to_registration (mp->client_index);
178 rmp = vl_msg_api_alloc (msg_size);
179 clib_memset (rmp, 0, msg_size);
181 ntohs (VL_API_IKEV2_PLUGIN_GET_VERSION_REPLY + im->msg_id_base);
182 rmp->context = mp->context;
183 rmp->major = htonl (IKEV2_PLUGIN_VERSION_MAJOR);
184 rmp->minor = htonl (IKEV2_PLUGIN_VERSION_MINOR);
186 vl_api_send_msg (reg, (u8 *) rmp);
190 vl_api_ikev2_profile_set_liveness_t_handler
191 (vl_api_ikev2_profile_set_liveness_t * mp)
193 vl_api_ikev2_profile_set_liveness_reply_t *rmp;
198 error = ikev2_set_liveness_params (clib_net_to_host_u32 (mp->period),
199 clib_net_to_host_u32 (mp->max_retries));
201 rv = VNET_API_ERROR_UNSPECIFIED;
203 rv = VNET_API_ERROR_UNIMPLEMENTED;
206 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_LIVENESS_REPLY);
210 vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp)
212 vl_api_ikev2_profile_add_del_reply_t *rmp;
216 vlib_main_t *vm = vlib_get_main ();
218 u8 *tmp = format (0, "%s", mp->name);
219 error = ikev2_add_del_profile (vm, tmp, mp->is_add);
222 rv = VNET_API_ERROR_UNSPECIFIED;
224 rv = VNET_API_ERROR_UNIMPLEMENTED;
227 REPLY_MACRO (VL_API_IKEV2_PROFILE_ADD_DEL_REPLY);
231 vl_api_ikev2_profile_set_auth_t_handler
232 (vl_api_ikev2_profile_set_auth_t * mp)
234 vl_api_ikev2_profile_set_auth_reply_t *rmp;
238 vlib_main_t *vm = vlib_get_main ();
240 int data_len = ntohl (mp->data_len);
241 u8 *tmp = format (0, "%s", mp->name);
242 u8 *data = vec_new (u8, data_len);
243 clib_memcpy (data, mp->data, data_len);
244 error = ikev2_set_profile_auth (vm, tmp, mp->auth_method, data, mp->is_hex);
248 rv = VNET_API_ERROR_UNSPECIFIED;
250 rv = VNET_API_ERROR_UNIMPLEMENTED;
253 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_AUTH_REPLY);
257 vl_api_ikev2_profile_set_id_t_handler (vl_api_ikev2_profile_set_id_t * mp)
259 vl_api_ikev2_profile_set_id_reply_t *rmp;
263 vlib_main_t *vm = vlib_get_main ();
265 u8 *tmp = format (0, "%s", mp->name);
266 int data_len = ntohl (mp->data_len);
267 u8 *data = vec_new (u8, data_len);
268 clib_memcpy (data, mp->data, data_len);
269 error = ikev2_set_profile_id (vm, tmp, mp->id_type, data, mp->is_local);
273 rv = VNET_API_ERROR_UNSPECIFIED;
275 rv = VNET_API_ERROR_UNIMPLEMENTED;
278 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_ID_REPLY);
282 vl_api_ikev2_profile_set_udp_encap_t_handler
283 (vl_api_ikev2_profile_set_udp_encap_t * mp)
285 vl_api_ikev2_profile_set_udp_encap_reply_t *rmp;
289 vlib_main_t *vm = vlib_get_main ();
291 u8 *tmp = format (0, "%s", mp->name);
292 error = ikev2_set_profile_udp_encap (vm, tmp);
295 rv = VNET_API_ERROR_UNSPECIFIED;
297 rv = VNET_API_ERROR_UNIMPLEMENTED;
300 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_UDP_ENCAP);
304 vl_api_ikev2_profile_set_ts_t_handler (vl_api_ikev2_profile_set_ts_t * mp)
306 vl_api_ikev2_profile_set_ts_reply_t *rmp;
310 vlib_main_t *vm = vlib_get_main ();
312 u8 *tmp = format (0, "%s", mp->name);
314 ikev2_set_profile_ts (vm, tmp, mp->proto,
315 clib_net_to_host_u16 (mp->start_port),
316 clib_net_to_host_u16 (mp->end_port),
317 (ip4_address_t) mp->start_addr,
318 (ip4_address_t) mp->end_addr, mp->is_local);
321 rv = VNET_API_ERROR_UNSPECIFIED;
323 rv = VNET_API_ERROR_UNIMPLEMENTED;
326 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_TS_REPLY);
330 vl_api_ikev2_set_local_key_t_handler (vl_api_ikev2_set_local_key_t * mp)
332 vl_api_ikev2_set_local_key_reply_t *rmp;
336 vlib_main_t *vm = vlib_get_main ();
339 error = ikev2_set_local_key (vm, mp->key_file);
341 rv = VNET_API_ERROR_UNSPECIFIED;
343 rv = VNET_API_ERROR_UNIMPLEMENTED;
346 REPLY_MACRO (VL_API_IKEV2_SET_LOCAL_KEY_REPLY);
350 vl_api_ikev2_set_responder_t_handler (vl_api_ikev2_set_responder_t * mp)
352 vl_api_ikev2_set_responder_reply_t *rmp;
356 vlib_main_t *vm = vlib_get_main ();
359 u8 *tmp = format (0, "%s", mp->name);
361 clib_memcpy (&ip4, mp->address, sizeof (ip4));
363 error = ikev2_set_profile_responder (vm, tmp, ntohl (mp->sw_if_index), ip4);
366 rv = VNET_API_ERROR_UNSPECIFIED;
368 rv = VNET_API_ERROR_UNIMPLEMENTED;
371 REPLY_MACRO (VL_API_IKEV2_SET_RESPONDER_REPLY);
375 vl_api_ikev2_set_ike_transforms_t_handler (vl_api_ikev2_set_ike_transforms_t *
378 vl_api_ikev2_set_ike_transforms_reply_t *rmp;
382 vlib_main_t *vm = vlib_get_main ();
385 u8 *tmp = format (0, "%s", mp->name);
388 ikev2_set_profile_ike_transforms (vm, tmp, ntohl (mp->crypto_alg),
389 ntohl (mp->integ_alg),
390 ntohl (mp->dh_group),
391 ntohl (mp->crypto_key_size));
394 rv = VNET_API_ERROR_UNSPECIFIED;
396 rv = VNET_API_ERROR_UNIMPLEMENTED;
399 REPLY_MACRO (VL_API_IKEV2_SET_IKE_TRANSFORMS_REPLY);
403 vl_api_ikev2_set_esp_transforms_t_handler (vl_api_ikev2_set_esp_transforms_t *
406 vl_api_ikev2_set_esp_transforms_reply_t *rmp;
410 vlib_main_t *vm = vlib_get_main ();
413 u8 *tmp = format (0, "%s", mp->name);
416 ikev2_set_profile_esp_transforms (vm, tmp, ntohl (mp->crypto_alg),
417 ntohl (mp->integ_alg),
418 ntohl (mp->dh_group),
419 ntohl (mp->crypto_key_size));
422 rv = VNET_API_ERROR_UNSPECIFIED;
424 rv = VNET_API_ERROR_UNIMPLEMENTED;
427 REPLY_MACRO (VL_API_IKEV2_SET_ESP_TRANSFORMS_REPLY);
431 vl_api_ikev2_set_sa_lifetime_t_handler (vl_api_ikev2_set_sa_lifetime_t * mp)
433 vl_api_ikev2_set_sa_lifetime_reply_t *rmp;
437 vlib_main_t *vm = vlib_get_main ();
440 u8 *tmp = format (0, "%s", mp->name);
443 ikev2_set_profile_sa_lifetime (vm, tmp,
444 clib_net_to_host_u64 (mp->lifetime),
445 ntohl (mp->lifetime_jitter),
446 ntohl (mp->handover),
448 (mp->lifetime_maxdata));
451 rv = VNET_API_ERROR_UNSPECIFIED;
453 rv = VNET_API_ERROR_UNIMPLEMENTED;
456 REPLY_MACRO (VL_API_IKEV2_SET_SA_LIFETIME_REPLY);
460 vl_api_ikev2_profile_set_ipsec_udp_port_t_handler
461 (vl_api_ikev2_profile_set_ipsec_udp_port_t * mp)
463 vl_api_ikev2_profile_set_ipsec_udp_port_reply_t *rmp;
467 vlib_main_t *vm = vlib_get_main ();
469 u8 *tmp = format (0, "%s", mp->name);
472 ikev2_set_profile_ipsec_udp_port (vm, tmp,
473 clib_net_to_host_u16 (mp->port),
477 rv = VNET_API_ERROR_UNIMPLEMENTED;
480 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_IPSEC_UDP_PORT_REPLY);
484 vl_api_ikev2_set_tunnel_interface_t_handler
485 (vl_api_ikev2_set_tunnel_interface_t * mp)
487 vl_api_ikev2_set_tunnel_interface_reply_t *rmp;
490 VALIDATE_SW_IF_INDEX (mp);
493 u8 *tmp = format (0, "%s", mp->name);
496 error = ikev2_set_profile_tunnel_interface (vlib_get_main (), tmp,
497 ntohl (mp->sw_if_index));
500 rv = VNET_API_ERROR_UNSPECIFIED;
503 rv = VNET_API_ERROR_UNIMPLEMENTED;
506 BAD_SW_IF_INDEX_LABEL;
507 REPLY_MACRO (VL_API_IKEV2_SET_TUNNEL_INTERFACE_REPLY);
511 vl_api_ikev2_initiate_sa_init_t_handler (vl_api_ikev2_initiate_sa_init_t * mp)
513 vl_api_ikev2_initiate_sa_init_reply_t *rmp;
517 vlib_main_t *vm = vlib_get_main ();
520 u8 *tmp = format (0, "%s", mp->name);
522 error = ikev2_initiate_sa_init (vm, tmp);
525 rv = VNET_API_ERROR_UNSPECIFIED;
527 rv = VNET_API_ERROR_UNIMPLEMENTED;
530 REPLY_MACRO (VL_API_IKEV2_INITIATE_SA_INIT_REPLY);
534 vl_api_ikev2_initiate_del_ike_sa_t_handler (vl_api_ikev2_initiate_del_ike_sa_t
537 vl_api_ikev2_initiate_del_ike_sa_reply_t *rmp;
541 vlib_main_t *vm = vlib_get_main ();
544 error = ikev2_initiate_delete_ike_sa (vm, mp->ispi);
546 rv = VNET_API_ERROR_UNSPECIFIED;
548 rv = VNET_API_ERROR_UNIMPLEMENTED;
551 REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_IKE_SA_REPLY);
555 vl_api_ikev2_initiate_del_child_sa_t_handler
556 (vl_api_ikev2_initiate_del_child_sa_t * mp)
558 vl_api_ikev2_initiate_del_child_sa_reply_t *rmp;
562 vlib_main_t *vm = vlib_get_main ();
565 error = ikev2_initiate_delete_child_sa (vm, mp->ispi);
567 rv = VNET_API_ERROR_UNSPECIFIED;
569 rv = VNET_API_ERROR_UNIMPLEMENTED;
572 REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_CHILD_SA_REPLY);
576 vl_api_ikev2_initiate_rekey_child_sa_t_handler
577 (vl_api_ikev2_initiate_rekey_child_sa_t * mp)
579 vl_api_ikev2_initiate_rekey_child_sa_reply_t *rmp;
583 vlib_main_t *vm = vlib_get_main ();
586 error = ikev2_initiate_rekey_child_sa (vm, mp->ispi);
588 rv = VNET_API_ERROR_UNSPECIFIED;
590 rv = VNET_API_ERROR_UNIMPLEMENTED;
593 REPLY_MACRO (VL_API_IKEV2_INITIATE_REKEY_CHILD_SA_REPLY);
596 #include <ikev2/ikev2.api.c>
597 static clib_error_t *
598 ikev2_api_init (vlib_main_t * vm)
600 ikev2_main_t *im = &ikev2_main;
602 /* Ask for a correctly-sized block of API message decode slots */
603 im->msg_id_base = setup_message_id_table ();
608 VLIB_INIT_FUNCTION (ikev2_api_init);
611 * fd.io coding-style-patch-verification: ON
614 * eval: (c-set-style "gnu")