ikev2: increase tick interval in process node

[vpp.git] / src / plugins / ikev2 / ikev2.c

diff --git a/src/plugins/ikev2/ikev2.c b/src/plugins/ikev2/ikev2.c
index 3ce9114..5103da0 100644 (file)
--- a/src/plugins/ikev2/ikev2.c
+++ b/src/plugins/ikev2/ikev2.c
@@ -1442,17 +1442,22 @@ ikev2_process_create_child_sa_req (vlib_main_t * vm,
       rekey->tsi = tsi;
       rekey->tsr = tsr;
       /* update Ni */
-      vec_free (sa->i_nonce);
+      vec_reset_length (sa->i_nonce);
       vec_add (sa->i_nonce, nonce, IKEV2_NONCE_SIZE);
       /* generate new Nr */
       vec_validate (sa->r_nonce, IKEV2_NONCE_SIZE - 1);
       RAND_bytes ((u8 *) sa->r_nonce, IKEV2_NONCE_SIZE);
-      vec_free (n);
     }
+  else
+    goto cleanup_and_exit;
+  vec_free (n);
   return 1;
 
 cleanup_and_exit:
   vec_free (n);
+  vec_free (proposal);
+  vec_free (tsr);
+  vec_free (tsi);
   return 0;
 }
 
@@ -1856,13 +1861,17 @@ ikev2_add_tunnel_from_main (ikev2_add_ipsec_tunnel_args_t * a)
                               IPSEC_PROTOCOL_ESP, a->encr_type,
                               &a->loc_ckey, a->integ_type, &a->loc_ikey,
                               a->flags, 0, a->salt_local, &zero_addr,
-                              &zero_addr, NULL, a->src_port, a->dst_port);
+                              &zero_addr, TUNNEL_ENCAP_DECAP_FLAG_NONE,
+                              IP_DSCP_CS0, NULL, a->src_port, a->dst_port);
+
   rv |= ipsec_sa_add_and_lock (a->remote_sa_id, a->remote_spi,
                               IPSEC_PROTOCOL_ESP, a->encr_type, &a->rem_ckey,
                               a->integ_type, &a->rem_ikey,
                               (a->flags | IPSEC_SA_FLAG_IS_INBOUND), 0,
                               a->salt_remote, &zero_addr,
-                              &zero_addr, NULL, a->ipsec_over_udp_port,
+                              &zero_addr, TUNNEL_ENCAP_DECAP_FLAG_NONE,
+                              IP_DSCP_CS0, NULL,
+                              a->ipsec_over_udp_port,
                               a->ipsec_over_udp_port);
 
   rv |= ipsec_tun_protect_update (sw_if_index, NULL, a->local_sa_id, sas_in);
@@ -2352,7 +2361,7 @@ ikev2_generate_message (vlib_buffer_t * b, ikev2_sa_t * sa,
        {
          if (sa->del[0].protocol_id == IKEV2_PROTOCOL_IKE)
            {
-             if (sa->is_initiator)
+             if (ike_hdr_is_request (ike))
                ikev2_payload_add_delete (chain, sa->del);
 
              /* The response to a request that deletes the IKE SA is an empty
@@ -2446,16 +2455,14 @@ ikev2_generate_message (vlib_buffer_t * b, ikev2_sa_t * sa,
   ike->version = IKE_VERSION_2;
   ike->nextpayload = IKEV2_PAYLOAD_SK;
   tlen = sizeof (*ike);
+
   if (sa->is_initiator)
+    ike->flags |= IKEV2_HDR_FLAG_INITIATOR;
+
+  if (ike_hdr_is_request (ike))
     {
-      ike->flags = IKEV2_HDR_FLAG_INITIATOR;
       sa->last_init_msg_id = clib_net_to_host_u32 (ike->msgid);
     }
-  else
-    {
-      ike->flags = IKEV2_HDR_FLAG_RESPONSE;
-    }
-
 
   if (ike->exchange == IKEV2_EXCHANGE_SA_INIT)
     {
@@ -2638,6 +2645,9 @@ ikev2_retransmit_sa_init (ike_header_t * ike, ip_address_t iaddr,
 static u32
 ikev2_retransmit_resp (ikev2_sa_t * sa, ike_header_t * ike)
 {
+  if (ike_hdr_is_response (ike))
+    return 0;
+
   u32 msg_id = clib_net_to_host_u32 (ike->msgid);
 
   /* new req */
@@ -2852,7 +2862,7 @@ ikev2_node_internal (vlib_main_t * vm,
          sa0 = &sa;
          clib_memset (sa0, 0, sizeof (*sa0));
 
-         if (ike0->flags & IKEV2_HDR_FLAG_INITIATOR)
+         if (ike_hdr_is_initiator (ike0))
            {
              if (ike0->rspi == 0)
                {
@@ -2898,6 +2908,7 @@ ikev2_node_internal (vlib_main_t * vm,
                  if (sa0->state == IKEV2_STATE_SA_INIT
                      || sa0->state == IKEV2_STATE_NOTIFY_AND_DELETE)
                    {
+                     ike0->flags = IKEV2_HDR_FLAG_RESPONSE;
                      slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0);
                      if (~0 == slen)
                        vlib_node_increment_counter (vm, node->node_index,
@@ -2945,6 +2956,7 @@ ikev2_node_internal (vlib_main_t * vm,
                          ikev2_complete_sa_data (sa0, sai);
                          ikev2_calc_keys (sa0);
                          ikev2_sa_auth_init (sa0);
+                         ike0->flags = IKEV2_HDR_FLAG_INITIATOR;
                          slen =
                            ikev2_generate_message (b0, sa0, ike0, 0, udp0);
                          if (~0 == slen)
@@ -3086,9 +3098,9 @@ ikev2_node_internal (vlib_main_t * vm,
                        }
                    }
                }
-             if (!(ike0->flags & IKEV2_HDR_FLAG_RESPONSE))
+             if (ike_hdr_is_request (ike0))
                {
-                 ike0->flags |= IKEV2_HDR_FLAG_RESPONSE;
+                 ike0->flags = IKEV2_HDR_FLAG_RESPONSE;
                  slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0);
                  if (~0 == slen)
                    vlib_node_increment_counter (vm, node->node_index,
@@ -3149,6 +3161,7 @@ ikev2_node_internal (vlib_main_t * vm,
                    }
                  else
                    {
+                     ike0->flags = IKEV2_HDR_FLAG_RESPONSE;
                      slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0);
                      if (~0 == slen)
                        vlib_node_increment_counter (vm, node->node_index,
@@ -3615,7 +3628,7 @@ ikev2_initiate_delete_ike_sa_internal (vlib_main_t * vm,
       ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL;
       ike0->ispi = clib_host_to_net_u64 (sa->ispi);
       ike0->rspi = clib_host_to_net_u64 (sa->rspi);
-
+      ike0->flags = 0;
       ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id + 1);
       sa->last_init_msg_id = clib_net_to_host_u32 (ike0->msgid);
       len = ikev2_generate_message (b0, sa, ike0, 0, 0);
@@ -4269,6 +4282,7 @@ ikev2_delete_child_sa_internal (vlib_main_t * vm, ikev2_sa_t * sa,
   ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL;
   ike0->ispi = clib_host_to_net_u64 (sa->ispi);
   ike0->rspi = clib_host_to_net_u64 (sa->rspi);
+  ike0->flags = 0;
   vec_resize (sa->del, 1);
   sa->del->protocol_id = IKEV2_PROTOCOL_ESP;
   sa->del->spi = csa->i_proposals->spi;
@@ -4837,6 +4851,7 @@ ikev2_send_informational_request (ikev2_sa_t * sa)
   ike0->ispi = clib_host_to_net_u64 (sa->ispi);
   ike0->rspi = clib_host_to_net_u64 (sa->rspi);
   ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id + 1);
+  ike0->flags = 0;
   sa->last_init_msg_id = clib_net_to_host_u32 (ike0->msgid);
   len = ikev2_generate_message (b0, sa, ike0, 0, 0);
   if (~0 == len)
@@ -4861,6 +4876,13 @@ ikev2_send_informational_request (ikev2_sa_t * sa)
                  sa->sw_if_index);
 }
 
+void
+ikev2_disable_dpd (void)
+{
+  ikev2_main_t *km = &ikev2_main;
+  km->dpd_disabled = 1;
+}
+
 static_always_inline int
 ikev2_mngr_process_responder_sas (ikev2_sa_t * sa)
 {
@@ -4896,8 +4918,7 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
 
   while (1)
     {
-      u8 req_sent = 0;
-      vlib_process_wait_for_event_or_clock (vm, 1);
+      vlib_process_wait_for_event_or_clock (vm, 2);
       vlib_process_get_events (vm, NULL);
 
       /* process ike child sas */
@@ -4924,11 +4945,9 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
             sa->old_id_expiration -= 1;
 
           vec_foreach (c, sa->childs)
-            {
-            req_sent |= ikev2_mngr_process_child_sa(sa, c, del_old_ids);
-            }
+            ikev2_mngr_process_child_sa(sa, c, del_old_ids);
 
-          if (ikev2_mngr_process_responder_sas (sa))
+          if (!km->dpd_disabled && ikev2_mngr_process_responder_sas (sa))
             vec_add1 (to_be_deleted, sa - tkm->sas);
         }));
         /* *INDENT-ON* */
@@ -4967,14 +4986,6 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
       /* *INDENT-ON* */
 
       ikev2_process_pending_sa_init (km);
-
-      if (req_sent)
-       {
-         vlib_process_wait_for_event_or_clock (vm, 5);
-         vlib_process_get_events (vm, NULL);
-         req_sent = 0;
-       }
-
     }
   return 0;
 }