2 *------------------------------------------------------------------
3 * ipsec_api.c - ipsec api
5 * Copyright (c) 2016 Cisco and/or its affiliates.
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at:
10 * http://www.apache.org/licenses/LICENSE-2.0
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
17 *------------------------------------------------------------------
20 #include <vnet/vnet.h>
21 #include <vlibmemory/api.h>
23 #include <vnet/interface.h>
24 #include <vnet/api_errno.h>
25 #include <vnet/ip/ip.h>
26 #include <vnet/ip/ip_types_api.h>
27 #include <vnet/ipsec/ipsec_types_api.h>
28 #include <vnet/tunnel/tunnel_types_api.h>
29 #include <vnet/fib/fib.h>
30 #include <vnet/ipip/ipip.h>
31 #include <vnet/tunnel/tunnel_types_api.h>
33 #include <vnet/vnet_msg_enum.h>
36 #include <vnet/ipsec/ipsec.h>
37 #include <vnet/ipsec/ipsec_tun.h>
38 #include <vnet/ipsec/ipsec_itf.h>
41 #define vl_typedefs /* define message structures */
42 #include <vnet/vnet_all_api_h.h>
45 #define vl_endianfun /* define message structures */
46 #include <vnet/vnet_all_api_h.h>
49 /* instantiate all the print functions we know about */
50 #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
52 #include <vnet/vnet_all_api_h.h>
55 #include <vlibapi/api_helper_macros.h>
57 #define foreach_vpe_api_msg \
58 _ (IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
59 _ (IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
60 _ (IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \
61 _ (IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \
62 _ (IPSEC_SAD_ENTRY_ADD_DEL_V2, ipsec_sad_entry_add_del_v2) \
63 _ (IPSEC_SAD_ENTRY_ADD_DEL_V3, ipsec_sad_entry_add_del_v3) \
64 _ (IPSEC_SA_DUMP, ipsec_sa_dump) \
65 _ (IPSEC_SA_V2_DUMP, ipsec_sa_v2_dump) \
66 _ (IPSEC_SA_V3_DUMP, ipsec_sa_v3_dump) \
67 _ (IPSEC_SPDS_DUMP, ipsec_spds_dump) \
68 _ (IPSEC_SPD_DUMP, ipsec_spd_dump) \
69 _ (IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \
70 _ (IPSEC_ITF_CREATE, ipsec_itf_create) \
71 _ (IPSEC_ITF_DELETE, ipsec_itf_delete) \
72 _ (IPSEC_ITF_DUMP, ipsec_itf_dump) \
73 _ (IPSEC_SELECT_BACKEND, ipsec_select_backend) \
74 _ (IPSEC_BACKEND_DUMP, ipsec_backend_dump) \
75 _ (IPSEC_TUNNEL_PROTECT_UPDATE, ipsec_tunnel_protect_update) \
76 _ (IPSEC_TUNNEL_PROTECT_DEL, ipsec_tunnel_protect_del) \
77 _ (IPSEC_TUNNEL_PROTECT_DUMP, ipsec_tunnel_protect_dump) \
78 _ (IPSEC_SET_ASYNC_MODE, ipsec_set_async_mode)
81 vl_api_ipsec_spd_add_del_t_handler (vl_api_ipsec_spd_add_del_t * mp)
84 clib_warning ("unimplemented");
87 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
88 vl_api_ipsec_spd_add_del_reply_t *rmp;
91 rv = ipsec_add_del_spd (vm, ntohl (mp->spd_id), mp->is_add);
93 REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_REPLY);
97 static void vl_api_ipsec_interface_add_del_spd_t_handler
98 (vl_api_ipsec_interface_add_del_spd_t * mp)
100 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
101 vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
103 u32 sw_if_index __attribute__ ((unused));
104 u32 spd_id __attribute__ ((unused));
106 sw_if_index = ntohl (mp->sw_if_index);
107 spd_id = ntohl (mp->spd_id);
109 VALIDATE_SW_IF_INDEX (mp);
112 rv = ipsec_set_interface_spd (vm, sw_if_index, spd_id, mp->is_add);
114 rv = VNET_API_ERROR_UNIMPLEMENTED;
117 BAD_SW_IF_INDEX_LABEL;
119 REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
122 static void vl_api_ipsec_tunnel_protect_update_t_handler
123 (vl_api_ipsec_tunnel_protect_update_t * mp)
125 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
126 vl_api_ipsec_tunnel_protect_update_reply_t *rmp;
127 u32 sw_if_index, ii, *sa_ins = NULL;
131 sw_if_index = ntohl (mp->tunnel.sw_if_index);
133 VALIDATE_SW_IF_INDEX (&(mp->tunnel));
137 for (ii = 0; ii < mp->tunnel.n_sa_in; ii++)
138 vec_add1 (sa_ins, ntohl (mp->tunnel.sa_in[ii]));
140 ip_address_decode2 (&mp->tunnel.nh, &nh);
142 rv = ipsec_tun_protect_update (sw_if_index, &nh,
143 ntohl (mp->tunnel.sa_out), sa_ins);
145 rv = VNET_API_ERROR_UNIMPLEMENTED;
148 BAD_SW_IF_INDEX_LABEL;
150 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_UPDATE_REPLY);
153 static void vl_api_ipsec_tunnel_protect_del_t_handler
154 (vl_api_ipsec_tunnel_protect_del_t * mp)
156 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
157 vl_api_ipsec_tunnel_protect_del_reply_t *rmp;
162 sw_if_index = ntohl (mp->sw_if_index);
164 VALIDATE_SW_IF_INDEX (mp);
167 ip_address_decode2 (&mp->nh, &nh);
168 rv = ipsec_tun_protect_del (sw_if_index, &nh);
170 rv = VNET_API_ERROR_UNIMPLEMENTED;
173 BAD_SW_IF_INDEX_LABEL;
175 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_DEL_REPLY);
178 typedef struct ipsec_dump_walk_ctx_t_
180 vl_api_registration_t *reg;
182 } ipsec_dump_walk_ctx_t;
185 send_ipsec_tunnel_protect_details (index_t itpi, void *arg)
187 ipsec_dump_walk_ctx_t *ctx = arg;
188 vl_api_ipsec_tunnel_protect_details_t *mp;
189 ipsec_tun_protect_t *itp;
193 itp = ipsec_tun_protect_get (itpi);
195 mp = vl_msg_api_alloc (sizeof (*mp) + (sizeof (u32) * itp->itp_n_sa_in));
196 clib_memset (mp, 0, sizeof (*mp));
197 mp->_vl_msg_id = ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS);
198 mp->context = ctx->context;
200 mp->tun.sw_if_index = htonl (itp->itp_sw_if_index);
201 ip_address_encode2 (itp->itp_key, &mp->tun.nh);
203 sa = ipsec_sa_get (itp->itp_out_sa);
204 mp->tun.sa_out = htonl (sa->id);
205 mp->tun.n_sa_in = itp->itp_n_sa_in;
207 FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
209 mp->tun.sa_in[ii++] = htonl (sa->id);
213 vl_api_send_msg (ctx->reg, (u8 *) mp);
215 return (WALK_CONTINUE);
219 vl_api_ipsec_tunnel_protect_dump_t_handler (vl_api_ipsec_tunnel_protect_dump_t
222 vl_api_registration_t *reg;
226 reg = vl_api_client_index_to_registration (mp->client_index);
230 ipsec_dump_walk_ctx_t ctx = {
232 .context = mp->context,
235 sw_if_index = ntohl (mp->sw_if_index);
237 if (~0 == sw_if_index)
239 ipsec_tun_protect_walk (send_ipsec_tunnel_protect_details, &ctx);
243 ipsec_tun_protect_walk_itf (sw_if_index,
244 send_ipsec_tunnel_protect_details, &ctx);
247 clib_warning ("unimplemented");
252 ipsec_spd_action_decode (vl_api_ipsec_spd_action_t in,
253 ipsec_policy_action_t * out)
255 in = clib_net_to_host_u32 (in);
259 #define _(v,f,s) case IPSEC_API_SPD_ACTION_##f: \
260 *out = IPSEC_POLICY_ACTION_##f; \
262 foreach_ipsec_policy_action
265 return (VNET_API_ERROR_UNIMPLEMENTED);
268 static void vl_api_ipsec_spd_entry_add_del_t_handler
269 (vl_api_ipsec_spd_entry_add_del_t * mp)
271 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
272 vl_api_ipsec_spd_entry_add_del_reply_t *rmp;
282 clib_memset (&p, 0, sizeof (p));
284 p.id = ntohl (mp->entry.spd_id);
285 p.priority = ntohl (mp->entry.priority);
287 itype = ip_address_decode (&mp->entry.remote_address_start, &p.raddr.start);
288 ip_address_decode (&mp->entry.remote_address_stop, &p.raddr.stop);
289 ip_address_decode (&mp->entry.local_address_start, &p.laddr.start);
290 ip_address_decode (&mp->entry.local_address_stop, &p.laddr.stop);
292 p.is_ipv6 = (itype == IP46_TYPE_IP6);
294 p.protocol = mp->entry.protocol;
295 p.rport.start = ntohs (mp->entry.remote_port_start);
296 p.rport.stop = ntohs (mp->entry.remote_port_stop);
297 p.lport.start = ntohs (mp->entry.local_port_start);
298 p.lport.stop = ntohs (mp->entry.local_port_stop);
300 rv = ipsec_spd_action_decode (mp->entry.policy, &p.policy);
305 /* policy action resolve unsupported */
306 if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
308 clib_warning ("unsupported action: 'resolve'");
309 rv = VNET_API_ERROR_UNIMPLEMENTED;
312 p.sa_id = ntohl (mp->entry.sa_id);
314 ipsec_policy_mk_type (mp->entry.is_outbound, p.is_ipv6, p.policy,
319 rv = ipsec_add_del_policy (vm, &p, mp->is_add, &stat_index);
324 rv = VNET_API_ERROR_UNIMPLEMENTED;
330 REPLY_MACRO2 (VL_API_IPSEC_SPD_ENTRY_ADD_DEL_REPLY,
332 rmp->stat_index = ntohl(stat_index);
337 static void vl_api_ipsec_sad_entry_add_del_t_handler
338 (vl_api_ipsec_sad_entry_add_del_t * mp)
340 vl_api_ipsec_sad_entry_add_del_reply_t *rmp;
341 ipsec_key_t crypto_key, integ_key;
342 ipsec_crypto_alg_t crypto_alg;
343 ipsec_integ_alg_t integ_alg;
344 ipsec_protocol_t proto;
345 ipsec_sa_flags_t flags;
346 u32 id, spi, sa_index = ~0;
348 .t_flags = TUNNEL_FLAG_NONE,
349 .t_encap_decap_flags = TUNNEL_ENCAP_DECAP_FLAG_NONE,
351 .t_mode = TUNNEL_MODE_P2P,
359 id = ntohl (mp->entry.sad_id);
360 spi = ntohl (mp->entry.spi);
362 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
367 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
372 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
377 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
378 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
380 flags = ipsec_sa_flags_decode (mp->entry.flags);
382 ip_address_decode2 (&mp->entry.tunnel_src, &tun.t_src);
383 ip_address_decode2 (&mp->entry.tunnel_dst, &tun.t_dst);
386 rv = ipsec_sa_add_and_lock (
387 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
388 mp->entry.salt, htons (mp->entry.udp_src_port),
389 htons (mp->entry.udp_dst_port), &tun, &sa_index);
391 rv = ipsec_sa_unlock_id (id);
394 rv = VNET_API_ERROR_UNIMPLEMENTED;
399 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_REPLY,
401 rmp->stat_index = htonl (sa_index);
406 static void vl_api_ipsec_sad_entry_add_del_v2_t_handler
407 (vl_api_ipsec_sad_entry_add_del_v2_t * mp)
409 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
410 vl_api_ipsec_sad_entry_add_del_v2_reply_t *rmp;
411 ipsec_key_t crypto_key, integ_key;
412 ipsec_crypto_alg_t crypto_alg;
413 ipsec_integ_alg_t integ_alg;
414 ipsec_protocol_t proto;
415 ipsec_sa_flags_t flags;
416 u32 id, spi, sa_index = ~0;
419 .t_flags = TUNNEL_FLAG_NONE,
420 .t_encap_decap_flags = TUNNEL_ENCAP_DECAP_FLAG_NONE,
422 .t_mode = TUNNEL_MODE_P2P,
423 .t_table_id = htonl (mp->entry.tx_table_id),
429 id = ntohl (mp->entry.sad_id);
430 spi = ntohl (mp->entry.spi);
432 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
437 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
442 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
447 rv = tunnel_encap_decap_flags_decode (mp->entry.tunnel_flags,
448 &tun.t_encap_decap_flags);
453 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
454 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
456 flags = ipsec_sa_flags_decode (mp->entry.flags);
457 tun.t_dscp = ip_dscp_decode (mp->entry.dscp);
459 ip_address_decode2 (&mp->entry.tunnel_src, &tun.t_src);
460 ip_address_decode2 (&mp->entry.tunnel_dst, &tun.t_dst);
463 rv = ipsec_sa_add_and_lock (
464 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
465 mp->entry.salt, htons (mp->entry.udp_src_port),
466 htons (mp->entry.udp_dst_port), &tun, &sa_index);
468 rv = ipsec_sa_unlock_id (id);
471 rv = VNET_API_ERROR_UNIMPLEMENTED;
476 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_V2_REPLY,
478 rmp->stat_index = htonl (sa_index);
484 vl_api_ipsec_sad_entry_add_del_v3_t_handler (
485 vl_api_ipsec_sad_entry_add_del_v3_t *mp)
487 vl_api_ipsec_sad_entry_add_del_v3_reply_t *rmp;
488 ipsec_key_t crypto_key, integ_key;
489 ipsec_crypto_alg_t crypto_alg;
490 ipsec_integ_alg_t integ_alg;
491 ipsec_protocol_t proto;
492 ipsec_sa_flags_t flags;
493 u32 id, spi, sa_index = ~0;
499 id = ntohl (mp->entry.sad_id);
500 spi = ntohl (mp->entry.spi);
502 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
507 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
512 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
517 flags = ipsec_sa_flags_decode (mp->entry.flags);
519 if (flags & IPSEC_SA_FLAG_IS_TUNNEL)
521 rv = tunnel_decode (&mp->entry.tunnel, &tun);
527 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
528 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
531 rv = ipsec_sa_add_and_lock (
532 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
533 mp->entry.salt, htons (mp->entry.udp_src_port),
534 htons (mp->entry.udp_dst_port), &tun, &sa_index);
536 rv = ipsec_sa_unlock_id (id);
539 rv = VNET_API_ERROR_UNIMPLEMENTED;
543 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_V3_REPLY,
544 { rmp->stat_index = htonl (sa_index); });
548 send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg,
551 vl_api_ipsec_spds_details_t *mp;
554 mp = vl_msg_api_alloc (sizeof (*mp));
555 clib_memset (mp, 0, sizeof (*mp));
556 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
557 mp->context = context;
559 mp->spd_id = htonl (spd->id);
560 #define _(s, n) n_policies += vec_len (spd->policies[IPSEC_SPD_POLICY_##s]);
561 foreach_ipsec_spd_policy_type
563 mp->npolicies = htonl (n_policies);
565 vl_api_send_msg (reg, (u8 *) mp);
569 vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp)
571 vl_api_registration_t *reg;
572 ipsec_main_t *im = &ipsec_main;
575 reg = vl_api_client_index_to_registration (mp->client_index);
580 pool_foreach (spd, im->spds) {
581 send_ipsec_spds_details (spd, reg, mp->context);
585 clib_warning ("unimplemented");
589 vl_api_ipsec_spd_action_t
590 ipsec_spd_action_encode (ipsec_policy_action_t in)
592 vl_api_ipsec_spd_action_t out = IPSEC_API_SPD_ACTION_BYPASS;
596 #define _(v,f,s) case IPSEC_POLICY_ACTION_##f: \
597 out = IPSEC_API_SPD_ACTION_##f; \
599 foreach_ipsec_policy_action
602 return (clib_host_to_net_u32 (out));
606 send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
609 vl_api_ipsec_spd_details_t *mp;
611 mp = vl_msg_api_alloc (sizeof (*mp));
612 clib_memset (mp, 0, sizeof (*mp));
613 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
614 mp->context = context;
616 mp->entry.spd_id = htonl (p->id);
617 mp->entry.priority = htonl (p->priority);
618 mp->entry.is_outbound = ((p->type == IPSEC_SPD_POLICY_IP6_OUTBOUND) ||
619 (p->type == IPSEC_SPD_POLICY_IP4_OUTBOUND));
621 ip_address_encode (&p->laddr.start, IP46_TYPE_ANY,
622 &mp->entry.local_address_start);
623 ip_address_encode (&p->laddr.stop, IP46_TYPE_ANY,
624 &mp->entry.local_address_stop);
625 ip_address_encode (&p->raddr.start, IP46_TYPE_ANY,
626 &mp->entry.remote_address_start);
627 ip_address_encode (&p->raddr.stop, IP46_TYPE_ANY,
628 &mp->entry.remote_address_stop);
629 mp->entry.local_port_start = htons (p->lport.start);
630 mp->entry.local_port_stop = htons (p->lport.stop);
631 mp->entry.remote_port_start = htons (p->rport.start);
632 mp->entry.remote_port_stop = htons (p->rport.stop);
633 mp->entry.protocol = p->protocol;
634 mp->entry.policy = ipsec_spd_action_encode (p->policy);
635 mp->entry.sa_id = htonl (p->sa_id);
637 vl_api_send_msg (reg, (u8 *) mp);
641 vl_api_ipsec_spd_dump_t_handler (vl_api_ipsec_spd_dump_t * mp)
643 vl_api_registration_t *reg;
644 ipsec_main_t *im = &ipsec_main;
645 ipsec_spd_policy_type_t ptype;
646 ipsec_policy_t *policy;
651 reg = vl_api_client_index_to_registration (mp->client_index);
655 p = hash_get (im->spd_index_by_spd_id, ntohl (mp->spd_id));
660 spd = pool_elt_at_index (im->spds, spd_index);
663 FOR_EACH_IPSEC_SPD_POLICY_TYPE(ptype) {
664 vec_foreach(ii, spd->policies[ptype])
666 policy = pool_elt_at_index(im->policies, *ii);
668 if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == policy->sa_id)
669 send_ipsec_spd_details (policy, reg, mp->context);
674 clib_warning ("unimplemented");
679 send_ipsec_spd_interface_details (vl_api_registration_t * reg, u32 spd_index,
680 u32 sw_if_index, u32 context)
682 vl_api_ipsec_spd_interface_details_t *mp;
684 mp = vl_msg_api_alloc (sizeof (*mp));
685 clib_memset (mp, 0, sizeof (*mp));
686 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
687 mp->context = context;
689 mp->spd_index = htonl (spd_index);
690 mp->sw_if_index = htonl (sw_if_index);
692 vl_api_send_msg (reg, (u8 *) mp);
696 vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t *
699 ipsec_main_t *im = &ipsec_main;
700 vl_api_registration_t *reg;
704 reg = vl_api_client_index_to_registration (mp->client_index);
708 if (mp->spd_index_valid)
710 spd_index = ntohl (mp->spd_index);
712 hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
714 send_ipsec_spd_interface_details(reg, v, k, mp->context);
721 hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
722 send_ipsec_spd_interface_details(reg, v, k, mp->context);
728 clib_warning ("unimplemented");
733 vl_api_ipsec_itf_create_t_handler (vl_api_ipsec_itf_create_t * mp)
735 vl_api_ipsec_itf_create_reply_t *rmp;
737 u32 sw_if_index = ~0;
740 rv = tunnel_mode_decode (mp->itf.mode, &mode);
743 rv = ipsec_itf_create (ntohl (mp->itf.user_instance), mode, &sw_if_index);
746 REPLY_MACRO2 (VL_API_IPSEC_ITF_CREATE_REPLY,
748 rmp->sw_if_index = htonl (sw_if_index);
754 vl_api_ipsec_itf_delete_t_handler (vl_api_ipsec_itf_delete_t * mp)
756 vl_api_ipsec_itf_delete_reply_t *rmp;
759 rv = ipsec_itf_delete (ntohl (mp->sw_if_index));
761 REPLY_MACRO (VL_API_IPSEC_ITF_DELETE_REPLY);
765 vl_api_ipsec_itf_dump_t_handler (vl_api_ipsec_itf_dump_t * mp)
769 typedef struct ipsec_sa_dump_match_ctx_t_
773 } ipsec_sa_dump_match_ctx_t;
776 ipsec_sa_dump_match_sa (index_t itpi, void *arg)
778 ipsec_sa_dump_match_ctx_t *ctx = arg;
779 ipsec_tun_protect_t *itp;
782 itp = ipsec_tun_protect_get (itpi);
784 if (itp->itp_out_sa == ctx->sai)
786 ctx->sw_if_index = itp->itp_sw_if_index;
790 FOR_EACH_IPSEC_PROTECT_INPUT_SAI (itp, sai,
794 ctx->sw_if_index = itp->itp_sw_if_index;
800 return (WALK_CONTINUE);
804 send_ipsec_sa_details (ipsec_sa_t * sa, void *arg)
806 ipsec_dump_walk_ctx_t *ctx = arg;
807 vl_api_ipsec_sa_details_t *mp;
808 ipsec_main_t *im = &ipsec_main;
810 mp = vl_msg_api_alloc (sizeof (*mp));
811 clib_memset (mp, 0, sizeof (*mp));
812 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
813 mp->context = ctx->context;
815 mp->entry.sad_id = htonl (sa->id);
816 mp->entry.spi = htonl (sa->spi);
817 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
818 mp->entry.tx_table_id = htonl (sa->tunnel.t_table_id);
820 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
821 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
823 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
824 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
826 mp->entry.flags = ipsec_sad_flags_encode (sa);
827 mp->entry.salt = clib_host_to_net_u32 (sa->salt);
829 if (ipsec_sa_is_set_IS_PROTECT (sa))
831 ipsec_sa_dump_match_ctx_t ctx = {
835 ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
837 mp->sw_if_index = htonl (ctx.sw_if_index);
840 mp->sw_if_index = ~0;
842 if (ipsec_sa_is_set_IS_TUNNEL (sa))
844 ip_address_encode2 (&sa->tunnel.t_src, &mp->entry.tunnel_src);
845 ip_address_encode2 (&sa->tunnel.t_dst, &mp->entry.tunnel_dst);
847 if (ipsec_sa_is_set_UDP_ENCAP (sa))
849 mp->entry.udp_src_port = sa->udp_hdr.src_port;
850 mp->entry.udp_dst_port = sa->udp_hdr.dst_port;
853 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
854 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
855 if (ipsec_sa_is_set_USE_ESN (sa))
857 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
858 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
860 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
861 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
863 mp->stat_index = clib_host_to_net_u32 (sa->stat_index);
865 vl_api_send_msg (ctx->reg, (u8 *) mp);
867 return (WALK_CONTINUE);
871 vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp)
873 vl_api_registration_t *reg;
876 reg = vl_api_client_index_to_registration (mp->client_index);
880 ipsec_dump_walk_ctx_t ctx = {
882 .context = mp->context,
885 ipsec_sa_walk (send_ipsec_sa_details, &ctx);
888 clib_warning ("unimplemented");
893 send_ipsec_sa_v2_details (ipsec_sa_t * sa, void *arg)
895 ipsec_dump_walk_ctx_t *ctx = arg;
896 vl_api_ipsec_sa_v2_details_t *mp;
897 ipsec_main_t *im = &ipsec_main;
899 mp = vl_msg_api_alloc (sizeof (*mp));
900 clib_memset (mp, 0, sizeof (*mp));
901 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_V2_DETAILS);
902 mp->context = ctx->context;
904 mp->entry.sad_id = htonl (sa->id);
905 mp->entry.spi = htonl (sa->spi);
906 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
907 mp->entry.tx_table_id = htonl (sa->tunnel.t_table_id);
909 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
910 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
912 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
913 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
915 mp->entry.flags = ipsec_sad_flags_encode (sa);
916 mp->entry.salt = clib_host_to_net_u32 (sa->salt);
918 if (ipsec_sa_is_set_IS_PROTECT (sa))
920 ipsec_sa_dump_match_ctx_t ctx = {
924 ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
926 mp->sw_if_index = htonl (ctx.sw_if_index);
929 mp->sw_if_index = ~0;
931 if (ipsec_sa_is_set_IS_TUNNEL (sa))
933 ip_address_encode2 (&sa->tunnel.t_src, &mp->entry.tunnel_src);
934 ip_address_encode2 (&sa->tunnel.t_dst, &mp->entry.tunnel_dst);
936 if (ipsec_sa_is_set_UDP_ENCAP (sa))
938 mp->entry.udp_src_port = sa->udp_hdr.src_port;
939 mp->entry.udp_dst_port = sa->udp_hdr.dst_port;
942 mp->entry.tunnel_flags =
943 tunnel_encap_decap_flags_encode (sa->tunnel.t_encap_decap_flags);
944 mp->entry.dscp = ip_dscp_encode (sa->tunnel.t_dscp);
946 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
947 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
948 if (ipsec_sa_is_set_USE_ESN (sa))
950 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
951 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
953 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
954 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
956 mp->stat_index = clib_host_to_net_u32 (sa->stat_index);
958 vl_api_send_msg (ctx->reg, (u8 *) mp);
960 return (WALK_CONTINUE);
964 vl_api_ipsec_sa_v2_dump_t_handler (vl_api_ipsec_sa_v2_dump_t *mp)
966 vl_api_registration_t *reg;
969 reg = vl_api_client_index_to_registration (mp->client_index);
973 ipsec_dump_walk_ctx_t ctx = {
975 .context = mp->context,
978 ipsec_sa_walk (send_ipsec_sa_v2_details, &ctx);
981 clib_warning ("unimplemented");
986 send_ipsec_sa_v3_details (ipsec_sa_t *sa, void *arg)
988 ipsec_dump_walk_ctx_t *ctx = arg;
989 vl_api_ipsec_sa_v3_details_t *mp;
990 ipsec_main_t *im = &ipsec_main;
992 mp = vl_msg_api_alloc (sizeof (*mp));
993 clib_memset (mp, 0, sizeof (*mp));
994 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_V3_DETAILS);
995 mp->context = ctx->context;
997 mp->entry.sad_id = htonl (sa->id);
998 mp->entry.spi = htonl (sa->spi);
999 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
1001 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
1002 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
1004 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
1005 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
1007 mp->entry.flags = ipsec_sad_flags_encode (sa);
1008 mp->entry.salt = clib_host_to_net_u32 (sa->salt);
1010 if (ipsec_sa_is_set_IS_PROTECT (sa))
1012 ipsec_sa_dump_match_ctx_t ctx = {
1013 .sai = sa - im->sad,
1016 ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
1018 mp->sw_if_index = htonl (ctx.sw_if_index);
1021 mp->sw_if_index = ~0;
1023 if (ipsec_sa_is_set_IS_TUNNEL (sa))
1024 tunnel_encode (&sa->tunnel, &mp->entry.tunnel);
1026 if (ipsec_sa_is_set_UDP_ENCAP (sa))
1028 mp->entry.udp_src_port = sa->udp_hdr.src_port;
1029 mp->entry.udp_dst_port = sa->udp_hdr.dst_port;
1032 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
1033 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
1034 if (ipsec_sa_is_set_USE_ESN (sa))
1036 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
1037 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
1039 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
1040 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
1042 mp->stat_index = clib_host_to_net_u32 (sa->stat_index);
1044 vl_api_send_msg (ctx->reg, (u8 *) mp);
1046 return (WALK_CONTINUE);
1050 vl_api_ipsec_sa_v3_dump_t_handler (vl_api_ipsec_sa_v3_dump_t *mp)
1052 vl_api_registration_t *reg;
1055 reg = vl_api_client_index_to_registration (mp->client_index);
1059 ipsec_dump_walk_ctx_t ctx = {
1061 .context = mp->context,
1064 ipsec_sa_walk (send_ipsec_sa_v3_details, &ctx);
1067 clib_warning ("unimplemented");
1072 vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp)
1074 vl_api_registration_t *rp;
1075 ipsec_main_t *im = &ipsec_main;
1076 u32 context = mp->context;
1078 rp = vl_api_client_index_to_registration (mp->client_index);
1082 clib_warning ("Client %d AWOL", mp->client_index);
1086 ipsec_ah_backend_t *ab;
1087 ipsec_esp_backend_t *eb;
1089 pool_foreach (ab, im->ah_backends) {
1090 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
1091 clib_memset (mp, 0, sizeof (*mp));
1092 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
1093 mp->context = context;
1094 snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (ab->name),
1096 mp->protocol = ntohl (IPSEC_API_PROTO_AH);
1097 mp->index = ab - im->ah_backends;
1098 mp->active = mp->index == im->ah_current_backend ? 1 : 0;
1099 vl_api_send_msg (rp, (u8 *)mp);
1101 pool_foreach (eb, im->esp_backends) {
1102 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
1103 clib_memset (mp, 0, sizeof (*mp));
1104 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
1105 mp->context = context;
1106 snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (eb->name),
1108 mp->protocol = ntohl (IPSEC_API_PROTO_ESP);
1109 mp->index = eb - im->esp_backends;
1110 mp->active = mp->index == im->esp_current_backend ? 1 : 0;
1111 vl_api_send_msg (rp, (u8 *)mp);
1117 vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp)
1119 ipsec_main_t *im = &ipsec_main;
1120 vl_api_ipsec_select_backend_reply_t *rmp;
1121 ipsec_protocol_t protocol;
1123 if (pool_elts (im->sad) > 0)
1125 rv = VNET_API_ERROR_INSTANCE_IN_USE;
1129 rv = ipsec_proto_decode (mp->protocol, &protocol);
1137 case IPSEC_PROTOCOL_ESP:
1138 rv = ipsec_select_esp_backend (im, mp->index);
1140 case IPSEC_PROTOCOL_AH:
1141 rv = ipsec_select_ah_backend (im, mp->index);
1144 rv = VNET_API_ERROR_INVALID_PROTOCOL;
1148 clib_warning ("unimplemented"); /* FIXME */
1151 REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY);
1155 vl_api_ipsec_set_async_mode_t_handler (vl_api_ipsec_set_async_mode_t * mp)
1157 vl_api_ipsec_set_async_mode_reply_t *rmp;
1160 vnet_crypto_request_async_mode (mp->async_enable);
1161 ipsec_set_async_mode (mp->async_enable);
1163 REPLY_MACRO (VL_API_IPSEC_SET_ASYNC_MODE_REPLY);
1168 * Add vpe's API message handlers to the table.
1169 * vlib has already mapped shared memory and
1170 * added the client registration handlers.
1171 * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
1173 #define vl_msg_name_crc_list
1174 #include <vnet/vnet_all_api_h.h>
1175 #undef vl_msg_name_crc_list
1178 setup_message_id_table (api_main_t * am)
1180 #define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id);
1181 foreach_vl_msg_name_crc_ipsec;
1185 static clib_error_t *
1186 ipsec_api_hookup (vlib_main_t * vm)
1188 api_main_t *am = vlibapi_get_main ();
1191 vl_msg_api_set_handlers(VL_API_##N, #n, \
1192 vl_api_##n##_t_handler, \
1194 vl_api_##n##_t_endian, \
1195 vl_api_##n##_t_print, \
1196 sizeof(vl_api_##n##_t), 1);
1197 foreach_vpe_api_msg;
1201 * Set up the (msg_name, crc, message-id) table
1203 setup_message_id_table (am);
1208 VLIB_API_INIT_FUNCTION (ipsec_api_hookup);
1211 * fd.io coding-style-patch-verification: ON
1214 * eval: (c-set-style "gnu")