VPP-1450: binary api call for dumping SPD to interface registration

[vpp.git] / src / vnet / ipsec / ipsec_api.c

diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index 74f993a..ced2c9c 100644 (file)
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -54,7 +54,9 @@ _(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry)                     \
 _(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry)                     \
 _(IPSEC_SA_SET_KEY, ipsec_sa_set_key)                                   \
 _(IPSEC_SA_DUMP, ipsec_sa_dump)                                         \
+_(IPSEC_SPDS_DUMP, ipsec_spds_dump)                                     \
 _(IPSEC_SPD_DUMP, ipsec_spd_dump)                                       \
+_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump)                  \
 _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del)                     \
 _(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key)                     \
 _(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa)                       \
@@ -124,7 +126,7 @@ static void vl_api_ipsec_spd_add_del_entry_t_handler
 #if WITH_LIBSSL > 0
   ipsec_policy_t p;
 
-  memset (&p, 0, sizeof (p));
+  clib_memset (&p, 0, sizeof (p));
 
   p.id = ntohl (mp->spd_id);
   p.priority = ntohl (mp->priority);
@@ -188,14 +190,13 @@ static void vl_api_ipsec_sad_add_del_entry_t_handler
   ipsec_main_t *im = &ipsec_main;
   ipsec_sa_t sa;
 
-  memset (&sa, 0, sizeof (sa));
+  clib_memset (&sa, 0, sizeof (sa));
 
   sa.id = ntohl (mp->sad_id);
   sa.spi = ntohl (mp->spi);
   sa.protocol = mp->protocol;
   /* check for unsupported crypto-alg */
-  if (mp->crypto_algorithm < IPSEC_CRYPTO_ALG_NONE ||
-      mp->crypto_algorithm >= IPSEC_CRYPTO_N_ALG)
+  if (mp->crypto_algorithm >= IPSEC_CRYPTO_N_ALG)
     {
       clib_warning ("unsupported crypto-alg: '%U'", format_ipsec_crypto_alg,
                    mp->crypto_algorithm);
@@ -220,6 +221,7 @@ static void vl_api_ipsec_sad_add_del_entry_t_handler
   sa.use_esn = mp->use_extended_sequence_number;
   sa.is_tunnel = mp->is_tunnel;
   sa.is_tunnel_ip6 = mp->is_tunnel_ipv6;
+  sa.udp_encap = mp->udp_encap;
   if (sa.is_tunnel_ip6)
     {
       clib_memcpy (&sa.tunnel_src_addr, mp->tunnel_src_address, 16);
@@ -251,6 +253,44 @@ out:
   REPLY_MACRO (VL_API_IPSEC_SAD_ADD_DEL_ENTRY_REPLY);
 }
 
+static void
+send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg,
+                        u32 context)
+{
+  vl_api_ipsec_spds_details_t *mp;
+
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  clib_memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
+  mp->context = context;
+
+  mp->spd_id = htonl (spd->id);
+  mp->npolicies = htonl (pool_len (spd->policies));
+
+  vl_api_send_msg (reg, (u8 *) mp);
+}
+
+static void
+vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp)
+{
+  vl_api_registration_t *reg;
+  ipsec_main_t *im = &ipsec_main;
+  ipsec_spd_t *spd;
+#if WITH_LIBSSL > 0
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  /* *INDENT-OFF* */
+  pool_foreach (spd, im->spds, ({
+    send_ipsec_spds_details (spd, reg, mp->context);
+  }));
+  /* *INDENT-ON* */
+#else
+  clib_warning ("unimplemented");
+#endif
+}
+
 static void
 send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
                        u32 context)
@@ -258,7 +298,7 @@ send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
   vl_api_ipsec_spd_details_t *mp;
 
   mp = vl_msg_api_alloc (sizeof (*mp));
-  memset (mp, 0, sizeof (*mp));
+  clib_memset (mp, 0, sizeof (*mp));
   mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
   mp->context = context;
 
@@ -327,6 +367,60 @@ vl_api_ipsec_spd_dump_t_handler (vl_api_ipsec_spd_dump_t * mp)
 #endif
 }
 
+static void
+send_ipsec_spd_interface_details (vl_api_registration_t * reg, u32 spd_index,
+                                 u32 sw_if_index, u32 context)
+{
+  vl_api_ipsec_spd_interface_details_t *mp;
+
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  clib_memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
+  mp->context = context;
+
+  mp->spd_index = htonl (spd_index);
+  mp->sw_if_index = htonl (sw_if_index);
+
+  vl_api_send_msg (reg, (u8 *) mp);
+}
+
+static void
+vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t *
+                                          mp)
+{
+  ipsec_main_t *im = &ipsec_main;
+  vl_api_registration_t *reg;
+  u32 k, v, spd_index;
+
+#if WITH_LIBSSL > 0
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  if (mp->spd_index_valid)
+    {
+      spd_index = ntohl (mp->spd_index);
+      /* *INDENT-OFF* */
+      hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
+        if (v == spd_index)
+          send_ipsec_spd_interface_details(reg, v, k, mp->context);
+      }));
+      /* *INDENT-ON* */
+    }
+  else
+    {
+      /* *INDENT-OFF* */
+      hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
+        send_ipsec_spd_interface_details(reg, v, k, mp->context);
+      }));
+      /* *INDENT-ON* */
+    }
+
+#else
+  clib_warning ("unimplemented");
+#endif
+}
+
 static void
 vl_api_ipsec_sa_set_key_t_handler (vl_api_ipsec_sa_set_key_t * mp)
 {
@@ -362,7 +456,7 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t *
 #if WITH_LIBSSL > 0
   ipsec_add_del_tunnel_args_t tun;
 
-  memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
+  clib_memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
 
   tun.is_add = mp->is_add;
   tun.esn = mp->esn;
@@ -408,7 +502,7 @@ send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg,
   vl_api_ipsec_sa_details_t *mp;
 
   mp = vl_msg_api_alloc (sizeof (*mp));
-  memset (mp, 0, sizeof (*mp));
+  clib_memset (mp, 0, sizeof (*mp));
   mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
   mp->context = context;
 
@@ -457,6 +551,7 @@ send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg,
   if (sa->use_anti_replay)
     mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
   mp->total_data_size = clib_host_to_net_u64 (sa->total_data_size);
+  mp->udp_encap = sa->udp_encap;
 
   vl_api_send_msg (reg, (u8 *) mp);
 }
@@ -526,7 +621,7 @@ vl_api_ipsec_tunnel_if_set_key_t_handler (vl_api_ipsec_tunnel_if_set_key_t *
     case IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO:
     case IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO:
       if (mp->alg < IPSEC_CRYPTO_ALG_AES_CBC_128 ||
-         mp->alg > IPSEC_CRYPTO_N_ALG)
+         mp->alg >= IPSEC_CRYPTO_N_ALG)
        {
          rv = VNET_API_ERROR_UNIMPLEMENTED;
          goto out;
@@ -534,7 +629,7 @@ vl_api_ipsec_tunnel_if_set_key_t_handler (vl_api_ipsec_tunnel_if_set_key_t *
       break;
     case IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG:
     case IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG:
-      if (mp->alg > IPSEC_INTEG_N_ALG)
+      if (mp->alg >= IPSEC_INTEG_N_ALG)
        {
          rv = VNET_API_ERROR_UNIMPLEMENTED;
          goto out;
@@ -888,7 +983,7 @@ static void
 /*
  * ipsec_api_hookup
  * Add vpe's API message handlers to the table.
- * vlib has alread mapped shared memory and
+ * vlib has already mapped shared memory and
  * added the client registration handlers.
  * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
  */