ipsec: split ipsec nodes into ip4/ip6 nodes

[vpp.git] / src / vnet / ipsec / ipsec.c

diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c
index cfe434a..d1b82b5 100644 (file)
--- a/src/vnet/ipsec/ipsec.c
+++ b/src/vnet/ipsec/ipsec.c
@@ -19,10 +19,15 @@
 #include <vnet/api_errno.h>
 #include <vnet/ip/ip.h>
 #include <vnet/interface.h>
+#include <vnet/udp/udp.h>
 
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/ikev2.h>
 #include <vnet/ipsec/esp.h>
+#include <vnet/ipsec/ah.h>
+
+
+ipsec_main_t ipsec_main;
 
 u32
 ipsec_get_sa_index_by_sa_id (u32 sa_id)
@@ -68,15 +73,17 @@ ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
                sw_if_index, spd_id, spd_index);
 
   /* enable IPsec on TX */
-  vnet_feature_enable_disable ("ip4-output", "ipsec-output-ip4", sw_if_index,
+  vnet_feature_enable_disable ("ip4-output", "ipsec4-output", sw_if_index,
                               is_add, 0, 0);
-  vnet_feature_enable_disable ("ip6-output", "ipsec-output-ip6", sw_if_index,
+  vnet_feature_enable_disable ("ip6-output", "ipsec6-output", sw_if_index,
                               is_add, 0, 0);
 
+  config.spd_index = spd_index;
+
   /* enable IPsec on RX */
-  vnet_feature_enable_disable ("ip4-unicast", "ipsec-input-ip4", sw_if_index,
+  vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input", sw_if_index,
                               is_add, &config, sizeof (config));
-  vnet_feature_enable_disable ("ip6-unicast", "ipsec-input-ip6", sw_if_index,
+  vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input", sw_if_index,
                               is_add, &config, sizeof (config));
 
   return 0;
@@ -130,20 +137,15 @@ ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
 static int
 ipsec_spd_entry_sort (void *a1, void *a2)
 {
-  ipsec_main_t *im = &ipsec_main;
   u32 *id1 = a1;
   u32 *id2 = a2;
-  ipsec_spd_t *spd;
+  ipsec_spd_t *spd = ipsec_main.spd_to_sort;
   ipsec_policy_t *p1, *p2;
 
-  /* *INDENT-OFF* */
-  pool_foreach (spd, im->spds, ({
-    p1 = pool_elt_at_index(spd->policies, *id1);
-    p2 = pool_elt_at_index(spd->policies, *id2);
-    if (p1 && p2)
-      return p2->priority - p1->priority;
-  }));
-  /* *INDENT-ON* */
+  p1 = pool_elt_at_index (spd->policies, *id1);
+  p2 = pool_elt_at_index (spd->policies, *id2);
+  if (p1 && p2)
+    return p2->priority - p1->priority;
 
   return 0;
 }
@@ -186,6 +188,8 @@ ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
       clib_memcpy (vp, policy, sizeof (*vp));
       policy_index = vp - spd->policies;
 
+      ipsec_main.spd_to_sort = spd;
+
       if (policy->is_outbound)
        {
          if (policy->is_ipv6)
@@ -251,6 +255,7 @@ ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
            }
        }
 
+      ipsec_main.spd_to_sort = NULL;
     }
   else
     {
@@ -363,13 +368,13 @@ ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
                       if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
                         vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
                         break;
+                      }
                     }
                   }
               }
           }
           pool_put (spd->policies, vp);
           break;
-        }
       }));
       /* *INDENT-ON* */
     }
@@ -377,7 +382,7 @@ ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
   return 0;
 }
 
-static u8
+u8
 ipsec_is_sa_used (u32 sa_index)
 {
   ipsec_main_t *im = &ipsec_main;
@@ -414,6 +419,7 @@ ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
   ipsec_sa_t *sa = 0;
   uword *p;
   u32 sa_index;
+  clib_error_t *err;
 
   clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
 
@@ -433,9 +439,12 @@ ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
          return VNET_API_ERROR_SYSCALL_ERROR_1;        /* sa used in policy */
        }
       hash_unset (im->sa_index_by_sa_id, sa->id);
-      if (im->cb.add_del_sa_sess_cb &&
-         im->cb.add_del_sa_sess_cb (sa_index, is_add) < 0)
-       return VNET_API_ERROR_SYSCALL_ERROR_1;
+      if (im->cb.add_del_sa_sess_cb)
+       {
+         err = im->cb.add_del_sa_sess_cb (sa_index, 0);
+         if (err)
+           return VNET_API_ERROR_SYSCALL_ERROR_1;
+       }
       pool_put (im->sad, sa);
     }
   else                         /* create new SA */
@@ -444,9 +453,12 @@ ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
       clib_memcpy (sa, new_sa, sizeof (*sa));
       sa_index = sa - im->sad;
       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
-      if (im->cb.add_del_sa_sess_cb &&
-         im->cb.add_del_sa_sess_cb (sa_index, is_add) < 0)
-       return VNET_API_ERROR_SYSCALL_ERROR_1;
+      if (im->cb.add_del_sa_sess_cb)
+       {
+         err = im->cb.add_del_sa_sess_cb (sa_index, 1);
+         if (err)
+           return VNET_API_ERROR_SYSCALL_ERROR_1;
+       }
     }
   return 0;
 }
@@ -458,6 +470,7 @@ ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
   uword *p;
   u32 sa_index;
   ipsec_sa_t *sa = 0;
+  clib_error_t *err;
 
   p = hash_get (im->sa_index_by_sa_id, sa_update->id);
   if (!p)
@@ -482,11 +495,14 @@ ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
       sa->integ_key_len = sa_update->integ_key_len;
     }
 
-  if (sa->crypto_key_len + sa->integ_key_len > 0)
+  if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
     {
-      if (im->cb.add_del_sa_sess_cb &&
-         im->cb.add_del_sa_sess_cb (sa_index, 0) < 0)
-       return VNET_API_ERROR_SYSCALL_ERROR_1;
+      if (im->cb.add_del_sa_sess_cb)
+       {
+         err = im->cb.add_del_sa_sess_cb (sa_index, 0);
+         if (err)
+           return VNET_API_ERROR_SYSCALL_ERROR_1;
+       }
     }
 
   return 0;
@@ -516,8 +532,6 @@ ipsec_check_support (ipsec_sa_t * sa)
     return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
   if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
     return clib_error_return (0, "unsupported none integ-alg");
-  if (sa->integ_alg == IPSEC_INTEG_ALG_AES_GCM_128)
-    return clib_error_return (0, "unsupported aes-gcm-128 integ-alg");
 
   return 0;
 }
@@ -548,16 +562,47 @@ ipsec_init (vlib_main_t * vm)
   ASSERT (node);
   im->error_drop_node_index = node->index;
 
-  node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
+  node = vlib_get_node_by_name (vm, (u8 *) "esp4-encrypt");
+  ASSERT (node);
+  im->esp4_encrypt_node_index = node->index;
+
+  node = vlib_get_node_by_name (vm, (u8 *) "esp4-decrypt");
+  ASSERT (node);
+  im->esp4_decrypt_node_index = node->index;
+
+  node = vlib_get_node_by_name (vm, (u8 *) "ah4-encrypt");
+  ASSERT (node);
+  im->ah4_encrypt_node_index = node->index;
+
+  node = vlib_get_node_by_name (vm, (u8 *) "ah4-decrypt");
+  ASSERT (node);
+  im->ah4_decrypt_node_index = node->index;
+
+  im->esp4_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP4_ENCRYPT;
+  im->esp4_decrypt_next_index = IPSEC_INPUT_NEXT_ESP4_DECRYPT;
+  im->ah4_encrypt_next_index = IPSEC_OUTPUT_NEXT_AH4_ENCRYPT;
+  im->ah4_decrypt_next_index = IPSEC_INPUT_NEXT_AH4_DECRYPT;
+
+  node = vlib_get_node_by_name (vm, (u8 *) "esp6-encrypt");
+  ASSERT (node);
+  im->esp6_encrypt_node_index = node->index;
+
+  node = vlib_get_node_by_name (vm, (u8 *) "esp6-decrypt");
+  ASSERT (node);
+  im->esp6_decrypt_node_index = node->index;
+
+  node = vlib_get_node_by_name (vm, (u8 *) "ah6-encrypt");
   ASSERT (node);
-  im->esp_encrypt_node_index = node->index;
+  im->ah6_encrypt_node_index = node->index;
 
-  node = vlib_get_node_by_name (vm, (u8 *) "esp-decrypt");
+  node = vlib_get_node_by_name (vm, (u8 *) "ah6-decrypt");
   ASSERT (node);
-  im->esp_decrypt_node_index = node->index;
+  im->ah6_decrypt_node_index = node->index;
 
-  im->esp_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP_ENCRYPT;
-  im->esp_decrypt_next_index = IPSEC_INPUT_NEXT_ESP_DECRYPT;
+  im->esp6_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP6_ENCRYPT;
+  im->esp6_decrypt_next_index = IPSEC_INPUT_NEXT_ESP6_DECRYPT;
+  im->ah6_encrypt_next_index = IPSEC_OUTPUT_NEXT_AH6_ENCRYPT;
+  im->ah6_decrypt_next_index = IPSEC_INPUT_NEXT_AH6_DECRYPT;
 
   im->cb.check_support_cb = ipsec_check_support;
 
@@ -567,7 +612,7 @@ ipsec_init (vlib_main_t * vm)
   if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
     return error;
 
-  esp_init ();
+  ipsec_proto_init ();
 
   if ((error = ikev2_init (vm)))
     return error;