X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;ds=sidebyside;f=src%2Fvnet%2Fipsec%2Fipsec_api.c;h=04dff4d0fd05739b1e9f40973c0b618ba4506c9b;hb=refs%2Fchanges%2F67%2F6567%2F3;hp=30732266ed45d9f87cca051424c7c780c0d896ca;hpb=d04b60bfa940e21ab4676a1cb3c15989748be40a;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index 30732266ed4..04dff4d0fd0 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -54,11 +54,20 @@ _(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry)                     \
 _(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry)                     \
 _(IPSEC_SA_SET_KEY, ipsec_sa_set_key)                                   \
 _(IPSEC_SPD_DUMP, ipsec_spd_dump)                                       \
+_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del)                     \
 _(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del)                         \
 _(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth)                       \
 _(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id)                           \
 _(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts)                           \
-_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key)
+_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key)                             \
+_(IKEV2_SET_RESPONDER, ikev2_set_responder)                             \
+_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms)                   \
+_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms)                   \
+_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime)                         \
+_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init)                       \
+_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa)                 \
+_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa)             \
+_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa)
 
 static void vl_api_ipsec_spd_add_del_t_handler
   (vl_api_ipsec_spd_add_del_t * mp)
@@ -71,11 +80,7 @@ static void vl_api_ipsec_spd_add_del_t_handler
   vl_api_ipsec_spd_add_del_reply_t *rmp;
   int rv;
 
-#if DPDK > 0
   rv = ipsec_add_del_spd (vm, ntohl (mp->spd_id), mp->is_add);
-#else
-  rv = VNET_API_ERROR_UNIMPLEMENTED;
-#endif
 
   REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_REPLY);
 #endif
@@ -205,8 +210,7 @@ static void vl_api_ipsec_sad_add_del_entry_t_handler
   sa.crypto_key_len = mp->crypto_key_length;
   clib_memcpy (&sa.crypto_key, mp->crypto_key, sizeof (sa.crypto_key));
   /* check for unsupported integ-alg */
-  if (mp->integrity_algorithm < IPSEC_INTEG_ALG_NONE ||
-      mp->integrity_algorithm >= IPSEC_INTEG_N_ALG)
+  if (mp->integrity_algorithm >= IPSEC_INTEG_N_ALG)
     {
       clib_warning ("unsupported integ-alg: '%U'", format_ipsec_integ_alg,
 		    mp->integrity_algorithm);
@@ -348,6 +352,49 @@ vl_api_ipsec_sa_set_key_t_handler (vl_api_ipsec_sa_set_key_t * mp)
   REPLY_MACRO (VL_API_IPSEC_SA_SET_KEY_REPLY);
 }
 
+static void
+vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t *
+					  mp)
+{
+  vl_api_ipsec_tunnel_if_add_del_reply_t *rmp;
+  int rv;
+
+#if WITH_LIBSSL > 0
+  ipsec_add_del_tunnel_args_t tun;
+
+  memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
+
+  tun.is_add = mp->is_add;
+  tun.esn = mp->esn;
+  tun.anti_replay = mp->anti_replay;
+  tun.local_spi = ntohl (mp->local_spi);
+  tun.remote_spi = ntohl (mp->remote_spi);
+  tun.crypto_alg = mp->crypto_alg;
+  tun.local_crypto_key_len = mp->local_crypto_key_len;
+  tun.remote_crypto_key_len = mp->remote_crypto_key_len;
+  tun.integ_alg = mp->integ_alg;
+  tun.local_integ_key_len = mp->local_integ_key_len;
+  tun.remote_integ_key_len = mp->remote_integ_key_len;
+  memcpy (&tun.local_ip, mp->local_ip, 4);
+  memcpy (&tun.remote_ip, mp->remote_ip, 4);
+  memcpy (&tun.local_crypto_key, &mp->local_crypto_key,
+	  mp->local_crypto_key_len);
+  memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key,
+	  mp->remote_crypto_key_len);
+  memcpy (&tun.local_integ_key, &mp->local_integ_key,
+	  mp->local_integ_key_len);
+  memcpy (&tun.remote_integ_key, &mp->remote_integ_key,
+	  mp->remote_integ_key_len);
+
+  rv = ipsec_add_del_tunnel_if (&tun);
+
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_ADD_DEL_REPLY);
+}
+
 static void
 vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp)
 {
@@ -461,6 +508,194 @@ vl_api_ikev2_set_local_key_t_handler (vl_api_ikev2_set_local_key_t * mp)
   REPLY_MACRO (VL_API_IKEV2_SET_LOCAL_KEY_REPLY);
 }
 
+static void
+vl_api_ikev2_set_responder_t_handler (vl_api_ikev2_set_responder_t * mp)
+{
+  vl_api_ikev2_set_responder_reply_t *rmp;
+  int rv = 0;
+
+#if WITH_LIBSSL > 0
+  vlib_main_t *vm = vlib_get_main ();
+  clib_error_t *error;
+
+  u8 *tmp = format (0, "%s", mp->name);
+  ip4_address_t ip4;
+  clib_memcpy (&ip4, mp->address, sizeof (ip4));
+
+  error = ikev2_set_profile_responder (vm, tmp, mp->sw_if_index, ip4);
+  vec_free (tmp);
+  if (error)
+    rv = VNET_API_ERROR_UNSPECIFIED;
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IKEV2_SET_RESPONDER_REPLY);
+}
+
+static void
+vl_api_ikev2_set_ike_transforms_t_handler (vl_api_ikev2_set_ike_transforms_t *
+					   mp)
+{
+  vl_api_ikev2_set_ike_transforms_reply_t *rmp;
+  int rv = 0;
+
+#if WITH_LIBSSL > 0
+  vlib_main_t *vm = vlib_get_main ();
+  clib_error_t *error;
+
+  u8 *tmp = format (0, "%s", mp->name);
+
+  error =
+    ikev2_set_profile_ike_transforms (vm, tmp, mp->crypto_alg, mp->integ_alg,
+				      mp->dh_group, mp->crypto_key_size);
+  vec_free (tmp);
+  if (error)
+    rv = VNET_API_ERROR_UNSPECIFIED;
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IKEV2_SET_IKE_TRANSFORMS_REPLY);
+}
+
+static void
+vl_api_ikev2_set_esp_transforms_t_handler (vl_api_ikev2_set_esp_transforms_t *
+					   mp)
+{
+  vl_api_ikev2_set_esp_transforms_reply_t *rmp;
+  int rv = 0;
+
+#if WITH_LIBSSL > 0
+  vlib_main_t *vm = vlib_get_main ();
+  clib_error_t *error;
+
+  u8 *tmp = format (0, "%s", mp->name);
+
+  error =
+    ikev2_set_profile_esp_transforms (vm, tmp, mp->crypto_alg, mp->integ_alg,
+				      mp->dh_group, mp->crypto_key_size);
+  vec_free (tmp);
+  if (error)
+    rv = VNET_API_ERROR_UNSPECIFIED;
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IKEV2_SET_ESP_TRANSFORMS_REPLY);
+}
+
+static void
+vl_api_ikev2_set_sa_lifetime_t_handler (vl_api_ikev2_set_sa_lifetime_t * mp)
+{
+  vl_api_ikev2_set_sa_lifetime_reply_t *rmp;
+  int rv = 0;
+
+#if WITH_LIBSSL > 0
+  vlib_main_t *vm = vlib_get_main ();
+  clib_error_t *error;
+
+  u8 *tmp = format (0, "%s", mp->name);
+
+  error =
+    ikev2_set_profile_sa_lifetime (vm, tmp, mp->lifetime, mp->lifetime_jitter,
+				   mp->handover, mp->lifetime_maxdata);
+  vec_free (tmp);
+  if (error)
+    rv = VNET_API_ERROR_UNSPECIFIED;
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IKEV2_SET_SA_LIFETIME_REPLY);
+}
+
+static void
+vl_api_ikev2_initiate_sa_init_t_handler (vl_api_ikev2_initiate_sa_init_t * mp)
+{
+  vl_api_ikev2_initiate_sa_init_reply_t *rmp;
+  int rv = 0;
+
+#if WITH_LIBSSL > 0
+  vlib_main_t *vm = vlib_get_main ();
+  clib_error_t *error;
+
+  u8 *tmp = format (0, "%s", mp->name);
+
+  error = ikev2_initiate_sa_init (vm, tmp);
+  vec_free (tmp);
+  if (error)
+    rv = VNET_API_ERROR_UNSPECIFIED;
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IKEV2_INITIATE_SA_INIT_REPLY);
+}
+
+static void
+vl_api_ikev2_initiate_del_ike_sa_t_handler (vl_api_ikev2_initiate_del_ike_sa_t
+					    * mp)
+{
+  vl_api_ikev2_initiate_del_ike_sa_reply_t *rmp;
+  int rv = 0;
+
+#if WITH_LIBSSL > 0
+  vlib_main_t *vm = vlib_get_main ();
+  clib_error_t *error;
+
+  error = ikev2_initiate_delete_ike_sa (vm, mp->ispi);
+  if (error)
+    rv = VNET_API_ERROR_UNSPECIFIED;
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_IKE_SA_REPLY);
+}
+
+static void
+  vl_api_ikev2_initiate_del_child_sa_t_handler
+  (vl_api_ikev2_initiate_del_child_sa_t * mp)
+{
+  vl_api_ikev2_initiate_del_child_sa_reply_t *rmp;
+  int rv = 0;
+
+#if WITH_LIBSSL > 0
+  vlib_main_t *vm = vlib_get_main ();
+  clib_error_t *error;
+
+  error = ikev2_initiate_delete_child_sa (vm, mp->ispi);
+  if (error)
+    rv = VNET_API_ERROR_UNSPECIFIED;
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_CHILD_SA_REPLY);
+}
+
+static void
+  vl_api_ikev2_initiate_rekey_child_sa_t_handler
+  (vl_api_ikev2_initiate_rekey_child_sa_t * mp)
+{
+  vl_api_ikev2_initiate_rekey_child_sa_reply_t *rmp;
+  int rv = 0;
+
+#if WITH_LIBSSL > 0
+  vlib_main_t *vm = vlib_get_main ();
+  clib_error_t *error;
+
+  error = ikev2_initiate_rekey_child_sa (vm, mp->ispi);
+  if (error)
+    rv = VNET_API_ERROR_UNSPECIFIED;
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IKEV2_INITIATE_REKEY_CHILD_SA_REPLY);
+}
+
 /*
  * ipsec_api_hookup
  * Add vpe's API message handlers to the table.