X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fikev2%2Fikev2.c;h=ad727a9e3555b4834cdc80c327f86491a8077b30;hb=d7fc12f07;hp=62a77f9c6d856368a00fee1b1ee0c7614b0ba6e8;hpb=dc6378f71bc7c9835845a91dbbc1646ea46df51e;p=vpp.git diff --git a/src/plugins/ikev2/ikev2.c b/src/plugins/ikev2/ikev2.c index 62a77f9c6d8..ad727a9e355 100644 --- a/src/plugins/ikev2/ikev2.c +++ b/src/plugins/ikev2/ikev2.c @@ -105,7 +105,7 @@ typedef u32 ikev2_non_esp_marker; static_always_inline u16 ikev2_get_port (ikev2_sa_t * sa) { - return sa->natt ? IKEV2_PORT_NATT : IKEV2_PORT; + return ikev2_natt_active (sa) ? IKEV2_PORT_NATT : IKEV2_PORT; } static_always_inline int @@ -343,19 +343,17 @@ ikev2_sa_free_all_vec (ikev2_sa_t * sa) } static void -ikev2_delete_sa (ikev2_sa_t * sa) +ikev2_delete_sa (ikev2_main_per_thread_data_t * ptd, ikev2_sa_t * sa) { - ikev2_main_t *km = &ikev2_main; - u32 thread_index = vlib_get_thread_index (); uword *p; ikev2_sa_free_all_vec (sa); - p = hash_get (km->per_thread_data[thread_index].sa_by_rspi, sa->rspi); + p = hash_get (ptd->sa_by_rspi, sa->rspi); if (p) { - hash_unset (km->per_thread_data[thread_index].sa_by_rspi, sa->rspi); - pool_put (km->per_thread_data[thread_index].sas, sa); + hash_unset (ptd->sa_by_rspi, sa->rspi); + pool_put (ptd->sas, sa); } } @@ -429,6 +427,7 @@ ikev2_complete_sa_data (ikev2_sa_t * sa, ikev2_sa_t * sai) sa->profile_index = sai->profile_index; sa->tun_itf = sai->tun_itf; sa->is_tun_itf_set = sai->is_tun_itf_set; + sa->natt_state = sai->natt_state; sa->i_id.data = _(sai->i_id.data); sa->r_id.data = _(sai->r_id.data); sa->i_auth.method = sai->i_auth.method; @@ -642,7 +641,7 @@ ikev2_compute_nat_sha1 (u64 ispi, u64 rspi, ip_address_t * ia, u16 port) clib_memcpy_fast (&buf[8], &rspi, sizeof (rspi)); clib_memcpy_fast (&buf[8 + 8], ip_addr_bytes (ia), ip_address_size (ia)); clib_memcpy_fast (&buf[8 + 8 + ip_address_size (ia)], &port, sizeof (port)); - SHA1 (buf, sizeof (buf), res); + SHA1 (buf, 2 * sizeof (ispi) + sizeof (port) + ip_address_size (ia), res); return res; } @@ -745,7 +744,8 @@ ikev2_process_sa_init_req (vlib_main_t * vm, udp->src_port); if (clib_memcmp (src_sha, n->data, vec_len (src_sha))) { - sa->natt = 1; + if (sa->natt_state == IKEV2_NATT_ENABLED) + sa->natt_state = IKEV2_NATT_ACTIVE; ikev2_elog_uint (IKEV2_LOG_DEBUG, "ispi %lx initiator" " behind NAT", sa->ispi); } @@ -758,7 +758,8 @@ ikev2_process_sa_init_req (vlib_main_t * vm, udp->dst_port); if (clib_memcmp (dst_sha, n->data, vec_len (dst_sha))) { - sa->natt = 1; + if (sa->natt_state == IKEV2_NATT_ENABLED) + sa->natt_state = IKEV2_NATT_ACTIVE; ikev2_elog_uint (IKEV2_LOG_DEBUG, "ispi %lx responder" " (self) behind NAT", sa->ispi); } @@ -871,7 +872,8 @@ ikev2_process_sa_init_resp (vlib_main_t * vm, udp->dst_port); if (clib_memcmp (dst_sha, n->data, vec_len (dst_sha))) { - sa->natt = 1; + if (sa->natt_state == IKEV2_NATT_ENABLED) + sa->natt_state = IKEV2_NATT_ACTIVE; ikev2_elog_uint (IKEV2_LOG_DEBUG, "ispi %lx initiator" " (self) behind NAT", sa->ispi); } @@ -1026,43 +1028,61 @@ ikev2_is_id_equal (ikev2_id_t * i1, ikev2_id_t * i2) } static void -ikev2_initial_contact_cleanup (ikev2_sa_t * sa) +ikev2_initial_contact_cleanup_internal (ikev2_main_per_thread_data_t * ptd, + ikev2_sa_t * sa) { ikev2_main_t *km = &ikev2_main; ikev2_sa_t *tmp; u32 i, *delete = 0; ikev2_child_sa_t *c; - u32 thread_index = vlib_get_thread_index (); - - if (!sa->initial_contact) - return; /* find old IKE SAs with the same authenticated identity */ /* *INDENT-OFF* */ - pool_foreach (tmp, km->per_thread_data[thread_index].sas, ({ - if (!ikev2_is_id_equal (&tmp->i_id, &sa->i_id) - || !ikev2_is_id_equal(&tmp->r_id, &sa->r_id)) - continue; + pool_foreach (tmp, ptd->sas, ({ + if (!ikev2_is_id_equal (&tmp->i_id, &sa->i_id) + || !ikev2_is_id_equal(&tmp->r_id, &sa->r_id)) + continue; - if (sa->rspi != tmp->rspi) - vec_add1(delete, tmp - km->per_thread_data[thread_index].sas); + if (sa->rspi != tmp->rspi) + vec_add1(delete, tmp - ptd->sas); })); /* *INDENT-ON* */ for (i = 0; i < vec_len (delete); i++) { - tmp = - pool_elt_at_index (km->per_thread_data[thread_index].sas, delete[i]); - vec_foreach (c, - tmp->childs) ikev2_delete_tunnel_interface (km->vnet_main, - tmp, c); - ikev2_delete_sa (tmp); + tmp = pool_elt_at_index (ptd->sas, delete[i]); + vec_foreach (c, tmp->childs) + { + ikev2_delete_tunnel_interface (km->vnet_main, tmp, c); + } + ikev2_delete_sa (ptd, tmp); } vec_free (delete); sa->initial_contact = 0; } +static void +ikev2_initial_contact_cleanup (ikev2_main_per_thread_data_t * ptd, + ikev2_sa_t * sa) +{ + ikev2_main_t *km = &ikev2_main; + + if (!sa->initial_contact) + return; + + if (ptd) + { + ikev2_initial_contact_cleanup_internal (ptd, sa); + } + else + { + vec_foreach (ptd, km->per_thread_data) + ikev2_initial_contact_cleanup_internal (ptd, sa); + } + sa->initial_contact = 0; +} + static int ikev2_parse_id_payload (const void *p, u16 rlen, ikev2_id_t * sa_id) { @@ -1426,17 +1446,22 @@ ikev2_process_create_child_sa_req (vlib_main_t * vm, rekey->tsi = tsi; rekey->tsr = tsr; /* update Ni */ - vec_free (sa->i_nonce); + vec_reset_length (sa->i_nonce); vec_add (sa->i_nonce, nonce, IKEV2_NONCE_SIZE); /* generate new Nr */ vec_validate (sa->r_nonce, IKEV2_NONCE_SIZE - 1); RAND_bytes ((u8 *) sa->r_nonce, IKEV2_NONCE_SIZE); - vec_free (n); } + else + goto cleanup_and_exit; + vec_free (n); return 1; cleanup_and_exit: vec_free (n); + vec_free (proposal); + vec_free (tsr); + vec_free (tsi); return 0; } @@ -1840,13 +1865,17 @@ ikev2_add_tunnel_from_main (ikev2_add_ipsec_tunnel_args_t * a) IPSEC_PROTOCOL_ESP, a->encr_type, &a->loc_ckey, a->integ_type, &a->loc_ikey, a->flags, 0, a->salt_local, &zero_addr, - &zero_addr, NULL, a->src_port, a->dst_port); + &zero_addr, TUNNEL_ENCAP_DECAP_FLAG_NONE, + IP_DSCP_CS0, NULL, a->src_port, a->dst_port); + rv |= ipsec_sa_add_and_lock (a->remote_sa_id, a->remote_spi, IPSEC_PROTOCOL_ESP, a->encr_type, &a->rem_ckey, a->integ_type, &a->rem_ikey, (a->flags | IPSEC_SA_FLAG_IS_INBOUND), 0, a->salt_remote, &zero_addr, - &zero_addr, NULL, a->ipsec_over_udp_port, + &zero_addr, TUNNEL_ENCAP_DECAP_FLAG_NONE, + IP_DSCP_CS0, NULL, + a->ipsec_over_udp_port, a->ipsec_over_udp_port); rv |= ipsec_tun_protect_update (sw_if_index, NULL, a->local_sa_id, sas_in); @@ -1899,7 +1928,7 @@ ikev2_create_tunnel_interface (vlib_main_t * vm, a.flags |= IPSEC_SA_FLAG_IS_TUNNEL; a.flags |= IPSEC_SA_FLAG_UDP_ENCAP; } - if (sa->natt) + if (ikev2_natt_active (sa)) a.flags |= IPSEC_SA_FLAG_UDP_ENCAP; a.is_rekey = is_rekey; @@ -2025,7 +2054,8 @@ ikev2_create_tunnel_interface (vlib_main_t * vm, a.salt_remote = child->salt_ei; a.salt_local = child->salt_er; } - a.dst_port = sa->natt ? sa->dst_port : sa->ipsec_over_udp_port; + a.dst_port = + ikev2_natt_active (sa) ? sa->dst_port : sa->ipsec_over_udp_port; a.src_port = sa->ipsec_over_udp_port; } @@ -2336,7 +2366,7 @@ ikev2_generate_message (vlib_buffer_t * b, ikev2_sa_t * sa, { if (sa->del[0].protocol_id == IKEV2_PROTOCOL_IKE) { - if (sa->is_initiator) + if (ike_hdr_is_request (ike)) ikev2_payload_add_delete (chain, sa->del); /* The response to a request that deletes the IKE SA is an empty @@ -2430,16 +2460,14 @@ ikev2_generate_message (vlib_buffer_t * b, ikev2_sa_t * sa, ike->version = IKE_VERSION_2; ike->nextpayload = IKEV2_PAYLOAD_SK; tlen = sizeof (*ike); + if (sa->is_initiator) + ike->flags |= IKEV2_HDR_FLAG_INITIATOR; + + if (ike_hdr_is_request (ike)) { - ike->flags = IKEV2_HDR_FLAG_INITIATOR; sa->last_init_msg_id = clib_net_to_host_u32 (ike->msgid); } - else - { - ike->flags = IKEV2_HDR_FLAG_RESPONSE; - } - if (ike->exchange == IKEV2_EXCHANGE_SA_INIT) { @@ -2530,75 +2558,88 @@ done: return tlen; } +static u32 +ikev2_retransmit_sa_init_one (ikev2_sa_t * sa, ike_header_t * ike, + ip_address_t iaddr, ip_address_t raddr, + u32 rlen) +{ + int p = 0; + ike_header_t *tmp; + u8 payload = ike->nextpayload; + + if (sa->ispi != clib_net_to_host_u64 (ike->ispi) || + ip_address_cmp (&sa->iaddr, &iaddr) || + ip_address_cmp (&sa->raddr, &raddr)) + { + return 0; + } + + while (p < rlen && payload != IKEV2_PAYLOAD_NONE) + { + ike_payload_header_t *ikep = (ike_payload_header_t *) & ike->payload[p]; + u32 plen = clib_net_to_host_u16 (ikep->length); + + if (plen < sizeof (ike_payload_header_t)) + return ~0; + + if (payload == IKEV2_PAYLOAD_NONCE && + !clib_memcmp (sa->i_nonce, ikep->payload, plen - sizeof (*ikep))) + { + /* req is retransmit */ + if (sa->state == IKEV2_STATE_SA_INIT) + { + tmp = (ike_header_t *) sa->last_sa_init_res_packet_data; + u32 slen = clib_net_to_host_u32 (tmp->length); + ike->ispi = tmp->ispi; + ike->rspi = tmp->rspi; + ike->nextpayload = tmp->nextpayload; + ike->version = tmp->version; + ike->exchange = tmp->exchange; + ike->flags = tmp->flags; + ike->msgid = tmp->msgid; + ike->length = tmp->length; + clib_memcpy_fast (ike->payload, tmp->payload, + slen - sizeof (*ike)); + ikev2_elog_uint_peers (IKEV2_LOG_DEBUG, + "ispi %lx IKE_SA_INIT retransmit " + "from %d.%d.%d.%d to %d.%d.%d.%d", + ike->ispi, + ip_addr_v4 (&raddr).as_u32, + ip_addr_v4 (&iaddr).as_u32); + return slen; + } + /* else ignore req */ + else + { + ikev2_elog_uint_peers (IKEV2_LOG_DEBUG, + "ispi %lx IKE_SA_INIT ignore " + "from %d.%d.%d.%d to %d.%d.%d.%d", + ike->ispi, + ip_addr_v4 (&raddr).as_u32, + ip_addr_v4 (&iaddr).as_u32); + return ~0; + } + } + payload = ikep->nextpayload; + p += plen; + } + + return 0; +} + static u32 ikev2_retransmit_sa_init (ike_header_t * ike, ip_address_t iaddr, ip_address_t raddr, u32 rlen) { ikev2_sa_t *sa; + u32 res; ikev2_main_per_thread_data_t *ptd = ikev2_get_per_thread_data (); /* *INDENT-OFF* */ pool_foreach (sa, ptd->sas, ({ - if (sa->ispi == clib_net_to_host_u64(ike->ispi) && - !ip_address_cmp(&sa->iaddr, &iaddr) && - !ip_address_cmp(&sa->raddr, &raddr)) - { - int p = 0; - u8 payload = ike->nextpayload; - - while (p < rlen && payload!= IKEV2_PAYLOAD_NONE) { - ike_payload_header_t * ikep = (ike_payload_header_t *) &ike->payload[p]; - u32 plen = clib_net_to_host_u16 (ikep->length); - if (plen > p + sizeof (*ike)) - return ~0; - - if (plen < sizeof(ike_payload_header_t)) - return ~0; - - if (payload == IKEV2_PAYLOAD_NONCE) - { - if (!clib_memcmp(sa->i_nonce, ikep->payload, - plen - sizeof(*ikep))) - { - /* req is retransmit */ - if (sa->state == IKEV2_STATE_SA_INIT) - { - ike_header_t * tmp = (ike_header_t*)sa->last_sa_init_res_packet_data; - u32 slen = clib_net_to_host_u32(tmp->length); - ike->ispi = tmp->ispi; - ike->rspi = tmp->rspi; - ike->nextpayload = tmp->nextpayload; - ike->version = tmp->version; - ike->exchange = tmp->exchange; - ike->flags = tmp->flags; - ike->msgid = tmp->msgid; - ike->length = tmp->length; - clib_memcpy_fast(ike->payload, tmp->payload, slen - sizeof(*ike)); - ikev2_elog_uint_peers (IKEV2_LOG_DEBUG, - "ispi %lx IKE_SA_INIT retransmit " - "from %d.%d.%d.%d to %d.%d.%d.%d", - ike->ispi, - ip_addr_v4(&raddr).as_u32, - ip_addr_v4 (&iaddr).as_u32); - return slen; - } - /* else ignore req */ - else - { - ikev2_elog_uint_peers (IKEV2_LOG_DEBUG, - "ispi %lx IKE_SA_INIT ignore " - "from %d.%d.%d.%d to %d.%d.%d.%d", - ike->ispi, - ip_addr_v4(&raddr).as_u32, - ip_addr_v4(&iaddr).as_u32); - return ~0; - } - } - } - payload = ikep->nextpayload; - p+=plen; - } - } + res = ikev2_retransmit_sa_init_one (sa, ike, iaddr, raddr, rlen); + if (res) + return res; })); /* *INDENT-ON* */ @@ -2609,6 +2650,9 @@ ikev2_retransmit_sa_init (ike_header_t * ike, ip_address_t iaddr, static u32 ikev2_retransmit_resp (ikev2_sa_t * sa, ike_header_t * ike) { + if (ike_hdr_is_response (ike)) + return 0; + u32 msg_id = clib_net_to_host_u32 (ike->msgid); /* new req */ @@ -2705,11 +2749,9 @@ ikev2_rewrite_v4_addrs (ikev2_sa_t * sa, ip4_header_t * ih) } static_always_inline void -ikev2_set_ip_address (ikev2_sa_t * sa, const void *src, - const void *dst, const int af, const int is_initiator) +ikev2_set_ip_address (ikev2_sa_t * sa, const void *iaddr, + const void *raddr, const int af) { - const void *raddr = is_initiator ? src : dst; - const void *iaddr = is_initiator ? dst : src; ip_address_set (&sa->raddr, raddr, af); ip_address_set (&sa->iaddr, iaddr, af); } @@ -2825,19 +2867,16 @@ ikev2_node_internal (vlib_main_t * vm, sa0 = &sa; clib_memset (sa0, 0, sizeof (*sa0)); - u8 is_initiator = ike0->flags & IKEV2_HDR_FLAG_INITIATOR; - if (is_initiator) + if (ike_hdr_is_initiator (ike0)) { if (ike0->rspi == 0) { if (is_ip4) - ikev2_set_ip_address (sa0, &ip40->dst_address, - &ip40->src_address, AF_IP4, - is_initiator); + ikev2_set_ip_address (sa0, &ip40->src_address, + &ip40->dst_address, AF_IP4); else - ikev2_set_ip_address (sa0, &ip60->dst_address, - &ip60->src_address, AF_IP6, - is_initiator); + ikev2_set_ip_address (sa0, &ip60->src_address, + &ip60->dst_address, AF_IP6); sa0->dst_port = clib_net_to_host_u16 (udp0->src_port); @@ -2874,6 +2913,7 @@ ikev2_node_internal (vlib_main_t * vm, if (sa0->state == IKEV2_STATE_SA_INIT || sa0->state == IKEV2_STATE_NOTIFY_AND_DELETE) { + ike0->flags = IKEV2_HDR_FLAG_RESPONSE; slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0); if (~0 == slen) vlib_node_increment_counter (vm, node->node_index, @@ -2898,13 +2938,11 @@ ikev2_node_internal (vlib_main_t * vm, else //received sa_init without initiator flag { if (is_ip4) - ikev2_set_ip_address (sa0, &ip40->src_address, - &ip40->dst_address, AF_IP4, - is_initiator); + ikev2_set_ip_address (sa0, &ip40->dst_address, + &ip40->src_address, AF_IP4); else - ikev2_set_ip_address (sa0, &ip60->src_address, - &ip60->dst_address, AF_IP6, - is_initiator); + ikev2_set_ip_address (sa0, &ip60->dst_address, + &ip60->src_address, AF_IP6); ikev2_process_sa_init_resp (vm, sa0, ike0, udp0, rlen); @@ -2923,6 +2961,7 @@ ikev2_node_internal (vlib_main_t * vm, ikev2_complete_sa_data (sa0, sai); ikev2_calc_keys (sa0); ikev2_sa_auth_init (sa0); + ike0->flags = IKEV2_HDR_FLAG_INITIATOR; slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0); if (~0 == slen) @@ -2981,7 +3020,7 @@ ikev2_node_internal (vlib_main_t * vm, IKEV2_ERROR_MALFORMED_PACKET, 1); if (sa0->state == IKEV2_STATE_AUTHENTICATED) { - ikev2_initial_contact_cleanup (sa0); + ikev2_initial_contact_cleanup (ptd, sa0); ikev2_sa_match_ts (sa0); if (sa0->state != IKEV2_STATE_TS_UNACCEPTABLE) ikev2_create_tunnel_interface (vm, sa0, @@ -3064,9 +3103,9 @@ ikev2_node_internal (vlib_main_t * vm, } } } - if (!(ike0->flags & IKEV2_HDR_FLAG_RESPONSE)) + if (ike_hdr_is_request (ike0)) { - ike0->flags |= IKEV2_HDR_FLAG_RESPONSE; + ike0->flags = IKEV2_HDR_FLAG_RESPONSE; slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0); if (~0 == slen) vlib_node_increment_counter (vm, node->node_index, @@ -3121,12 +3160,13 @@ ikev2_node_internal (vlib_main_t * vm, ikev2_create_tunnel_interface (vm, sa0, child, p[0], child - sa0->childs, 1); } - if (sa0->is_initiator) + if (ike_hdr_is_response (ike0)) { vec_free (sa0->rekey); } else { + ike0->flags = IKEV2_HDR_FLAG_RESPONSE; slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0); if (~0 == slen) vlib_node_increment_counter (vm, node->node_index, @@ -3162,7 +3202,7 @@ ikev2_node_internal (vlib_main_t * vm, clib_net_to_host_u16 (ikev2_get_port (sa0)); if (udp0->dst_port == clib_net_to_host_u16 (IKEV2_PORT_NATT) - && sa0->natt) + && ikev2_natt_active (sa0)) { if (!has_non_esp_marker) slen = ikev2_insert_non_esp_marker (ike0, slen); @@ -3201,7 +3241,7 @@ ikev2_node_internal (vlib_main_t * vm, vec_foreach (c, sa0->childs) ikev2_delete_tunnel_interface (km->vnet_main, sa0, c); - ikev2_delete_sa (sa0); + ikev2_delete_sa (ptd, sa0); } if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) && (b0->flags & VLIB_BUFFER_IS_TRACED))) @@ -3564,53 +3604,62 @@ ikev2_unregister_udp_port (ikev2_profile_t * p) static void ikev2_initiate_delete_ike_sa_internal (vlib_main_t * vm, ikev2_main_per_thread_data_t * tkm, - ikev2_sa_t * sa) + ikev2_sa_t * sa, u8 send_notification) { ikev2_main_t *km = &ikev2_main; ip_address_t *src, *dst; vlib_buffer_t *b0; + ikev2_child_sa_t *c; /* Create the Initiator notification for IKE SA removal */ ike_header_t *ike0; u32 bi0 = 0; int len; - bi0 = ikev2_get_new_ike_header_buff (vm, &b0); - if (!bi0) - { - ikev2_log_error ("buffer alloc failure"); - return; - } - - ike0 = vlib_buffer_get_current (b0); - ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL; - ike0->ispi = clib_host_to_net_u64 (sa->ispi); - ike0->rspi = clib_host_to_net_u64 (sa->rspi); vec_resize (sa->del, 1); sa->del->protocol_id = IKEV2_PROTOCOL_IKE; sa->del->spi = sa->ispi; - ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id + 1); - sa->last_init_msg_id = clib_net_to_host_u32 (ike0->msgid); - len = ikev2_generate_message (b0, sa, ike0, 0, 0); - if (~0 == len) - return; - if (sa->is_initiator) - { - src = &sa->iaddr; - dst = &sa->raddr; - } - else + if (send_notification) { - dst = &sa->iaddr; - src = &sa->raddr; - } + bi0 = ikev2_get_new_ike_header_buff (vm, &b0); + if (!bi0) + { + ikev2_log_error ("buffer alloc failure"); + goto delete_sa; + } + + ike0 = vlib_buffer_get_current (b0); + ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL; + ike0->ispi = clib_host_to_net_u64 (sa->ispi); + ike0->rspi = clib_host_to_net_u64 (sa->rspi); + ike0->flags = 0; + ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id + 1); + sa->last_init_msg_id = clib_net_to_host_u32 (ike0->msgid); + len = ikev2_generate_message (b0, sa, ike0, 0, 0); + if (~0 == len) + return; + + if (ikev2_natt_active (sa)) + len = ikev2_insert_non_esp_marker (ike0, len); + + if (sa->is_initiator) + { + src = &sa->iaddr; + dst = &sa->raddr; + } + else + { + dst = &sa->iaddr; + src = &sa->raddr; + } - ikev2_send_ike (vm, src, dst, bi0, len, - ikev2_get_port (sa), sa->dst_port, 0); + ikev2_send_ike (vm, src, dst, bi0, len, + ikev2_get_port (sa), sa->dst_port, 0); + } +delete_sa: /* delete local SA */ - ikev2_child_sa_t *c; vec_foreach (c, sa->childs) ikev2_delete_tunnel_interface (km->vnet_main, sa, c); @@ -3661,7 +3710,7 @@ ikev2_cleanup_profile_sessions (ikev2_main_t * km, ikev2_profile_t * p) vec_foreach (sai, del_sai) { sa = pool_elt_at_index (tkm->sas, sai[0]); - ikev2_initiate_delete_ike_sa_internal (km->vlib_main, tkm, sa); + ikev2_initiate_delete_ike_sa_internal (km->vlib_main, tkm, sa, 1); } vec_reset_length (del_sai); @@ -4018,12 +4067,45 @@ ikev2_set_profile_sa_lifetime (vlib_main_t * vm, u8 * name, return 0; } +static int +ikev2_get_if_address (u32 sw_if_index, ip_address_family_t af, + ip_address_t * out_addr) +{ + ip4_address_t *if_ip4; + ip6_address_t *if_ip6; + + if (af == AF_IP4) + { + if_ip4 = ip4_interface_first_address (&ip4_main, sw_if_index, 0); + if (if_ip4) + { + ip_address_set (out_addr, if_ip4, AF_IP4); + return 1; + } + } + else + { + if_ip6 = ip6_interface_first_address (&ip6_main, sw_if_index); + if (if_ip6) + { + ip_address_set (out_addr, if_ip6, AF_IP6); + return 1; + } + } + return 0; +} + clib_error_t * ikev2_initiate_sa_init (vlib_main_t * vm, u8 * name) { ikev2_profile_t *p; clib_error_t *r; ikev2_main_t *km = &ikev2_main; + vlib_buffer_t *b0; + ike_header_t *ike0; + u32 bi0 = 0; + int len = sizeof (ike_header_t), valid_ip = 0; + ip_address_t if_ip = ip_address_initializer; p = ikev2_profile_index_by_name (name); @@ -4040,159 +4122,147 @@ ikev2_initiate_sa_init (vlib_main_t * vm, u8 * name) return r; } + if (ikev2_get_if_address (p->responder.sw_if_index, + ip_addr_version (&p->responder.addr), &if_ip)) + { + valid_ip = 1; + } - /* Create the Initiator Request */ - { - vlib_buffer_t *b0; - ike_header_t *ike0; - u32 bi0 = 0; - int len = sizeof (ike_header_t); - ip4_address_t *if_ip4; - ip6_address_t *if_ip6; - ip_address_t if_ip = IP_ADDRESS_V4_ALL_0S; - - if (ip_addr_version (&p->responder.addr) == AF_IP4) - { - if_ip4 = ip4_interface_first_address (&ip4_main, - p->responder.sw_if_index, 0); - if (if_ip4) - { - ip_address_set (&if_ip, if_ip4, AF_IP4); - } - } - else - { - if_ip6 = ip6_interface_first_address (&ip6_main, - p->responder.sw_if_index); - if (if_ip6) - { - ip_address_set (&if_ip, if_ip6, AF_IP6); - } - } + bi0 = ikev2_get_new_ike_header_buff (vm, &b0); + if (!bi0) + { + char *errmsg = "buffer alloc failure"; + ikev2_log_error (errmsg); + return clib_error_return (0, errmsg); + } + ike0 = vlib_buffer_get_current (b0); - bi0 = ikev2_get_new_ike_header_buff (vm, &b0); - if (!bi0) - { - char *errmsg = "buffer alloc failure"; - ikev2_log_error (errmsg); - return clib_error_return (0, errmsg); - } - ike0 = vlib_buffer_get_current (b0); - - /* Prepare the SA and the IKE payload */ - ikev2_sa_t sa; - clib_memset (&sa, 0, sizeof (ikev2_sa_t)); - ikev2_payload_chain_t *chain = 0; - ikev2_payload_new_chain (chain); - - /* Build the IKE proposal payload */ - ikev2_sa_proposal_t *proposals = 0; - ikev2_set_initiator_proposals (vm, &sa, &p->ike_ts, &proposals, 1); - proposals[0].proposal_num = 1; - proposals[0].protocol_id = IKEV2_PROTOCOL_IKE; - - /* Add and then cleanup proposal data */ - ikev2_payload_add_sa (chain, proposals); - ikev2_sa_free_proposal_vector (&proposals); - - sa.is_initiator = 1; - sa.profile_index = p - km->profiles; - sa.state = IKEV2_STATE_SA_INIT; - sa.tun_itf = p->tun_itf; - sa.udp_encap = p->udp_encap; - sa.ipsec_over_udp_port = p->ipsec_over_udp_port; - sa.is_tun_itf_set = 1; - sa.initial_contact = 1; - sa.dst_port = IKEV2_PORT; - ikev2_generate_sa_init_data (&sa); - ikev2_payload_add_ke (chain, sa.dh_group, sa.i_dh_data); - ikev2_payload_add_nonce (chain, sa.i_nonce); - - /* Build the child SA proposal */ - vec_resize (sa.childs, 1); - ikev2_set_initiator_proposals (vm, &sa, &p->esp_ts, - &sa.childs[0].i_proposals, 0); - sa.childs[0].i_proposals[0].proposal_num = 1; - sa.childs[0].i_proposals[0].protocol_id = IKEV2_PROTOCOL_ESP; - RAND_bytes ((u8 *) & sa.childs[0].i_proposals[0].spi, - sizeof (sa.childs[0].i_proposals[0].spi)); - - /* Add NAT detection notification messages (mandatory) */ - u8 *nat_detection_sha1 = - ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa.ispi), - clib_host_to_net_u64 (sa.rspi), - &if_ip, clib_host_to_net_u16 (IKEV2_PORT)); - - ikev2_payload_add_notify (chain, IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP, - nat_detection_sha1); - vec_free (nat_detection_sha1); - nat_detection_sha1 = - ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa.ispi), - clib_host_to_net_u64 (sa.rspi), - &p->responder.addr, - clib_host_to_net_u16 (sa.dst_port)); - ikev2_payload_add_notify (chain, - IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP, - nat_detection_sha1); - vec_free (nat_detection_sha1); - - u8 *sig_hash_algo = vec_new (u8, 8); - u64 tmpsig = clib_host_to_net_u64 (0x0001000200030004); - clib_memcpy_fast (sig_hash_algo, &tmpsig, sizeof (tmpsig)); - ikev2_payload_add_notify (chain, - IKEV2_NOTIFY_MSG_SIGNATURE_HASH_ALGORITHMS, - sig_hash_algo); - vec_free (sig_hash_algo); - - - /* Buffer update and boilerplate */ - len += vec_len (chain->data); - ike0->nextpayload = chain->first_payload_type; - ike0->length = clib_host_to_net_u32 (len); - clib_memcpy_fast (ike0->payload, chain->data, vec_len (chain->data)); - ikev2_payload_destroy_chain (chain); - - ike0->version = IKE_VERSION_2; - ike0->flags = IKEV2_HDR_FLAG_INITIATOR; - ike0->exchange = IKEV2_EXCHANGE_SA_INIT; - ike0->ispi = clib_host_to_net_u64 (sa.ispi); - ike0->rspi = 0; - ike0->msgid = 0; - - /* store whole IKE payload - needed for PSK auth */ - vec_reset_length (sa.last_sa_init_req_packet_data); - vec_add (sa.last_sa_init_req_packet_data, ike0, len); - - /* add data to the SA then add it to the pool */ - ip_address_copy (&sa.iaddr, &if_ip); - ip_address_copy (&sa.raddr, &p->responder.addr); - sa.i_id.type = p->loc_id.type; - sa.i_id.data = vec_dup (p->loc_id.data); - sa.r_id.type = p->rem_id.type; - sa.r_id.data = vec_dup (p->rem_id.data); - sa.i_auth.method = p->auth.method; - sa.i_auth.hex = p->auth.hex; - sa.i_auth.data = vec_dup (p->auth.data); - sa.sw_if_index = p->responder.sw_if_index; - vec_add (sa.childs[0].tsi, &p->loc_ts, 1); - vec_add (sa.childs[0].tsr, &p->rem_ts, 1); - - ikev2_initial_contact_cleanup (&sa); - - /* add SA to the pool */ - ikev2_sa_t *sa0 = 0; - pool_get (km->sais, sa0); - clib_memcpy_fast (sa0, &sa, sizeof (*sa0)); - hash_set (km->sa_by_ispi, sa0->ispi, sa0 - km->sais); - - ikev2_send_ike (vm, &if_ip, &p->responder.addr, bi0, len, - IKEV2_PORT, sa.dst_port, sa.sw_if_index); - - ikev2_elog_exchange ("ispi %lx rspi %lx IKEV2_EXCHANGE_SA_INIT sent to ", - clib_host_to_net_u64 (sa0->ispi), 0, - ip_addr_v4 (&p->responder.addr).as_u32, - ip_addr_version (&p->responder.addr) == AF_IP4); - } + /* Prepare the SA and the IKE payload */ + ikev2_sa_t sa; + clib_memset (&sa, 0, sizeof (ikev2_sa_t)); + ikev2_payload_chain_t *chain = 0; + ikev2_payload_new_chain (chain); + + /* Build the IKE proposal payload */ + ikev2_sa_proposal_t *proposals = 0; + ikev2_set_initiator_proposals (vm, &sa, &p->ike_ts, &proposals, 1); + proposals[0].proposal_num = 1; + proposals[0].protocol_id = IKEV2_PROTOCOL_IKE; + + /* Add and then cleanup proposal data */ + ikev2_payload_add_sa (chain, proposals); + ikev2_sa_free_proposal_vector (&proposals); + + sa.is_initiator = 1; + sa.profile_index = p - km->profiles; + sa.state = IKEV2_STATE_SA_INIT; + sa.tun_itf = p->tun_itf; + sa.udp_encap = p->udp_encap; + if (p->natt_disabled) + sa.natt_state = IKEV2_NATT_DISABLED; + sa.ipsec_over_udp_port = p->ipsec_over_udp_port; + sa.is_tun_itf_set = 1; + sa.initial_contact = 1; + sa.dst_port = IKEV2_PORT; + ikev2_generate_sa_init_data (&sa); + ikev2_payload_add_ke (chain, sa.dh_group, sa.i_dh_data); + ikev2_payload_add_nonce (chain, sa.i_nonce); + + /* Build the child SA proposal */ + vec_resize (sa.childs, 1); + ikev2_set_initiator_proposals (vm, &sa, &p->esp_ts, + &sa.childs[0].i_proposals, 0); + sa.childs[0].i_proposals[0].proposal_num = 1; + sa.childs[0].i_proposals[0].protocol_id = IKEV2_PROTOCOL_ESP; + RAND_bytes ((u8 *) & sa.childs[0].i_proposals[0].spi, + sizeof (sa.childs[0].i_proposals[0].spi)); + + /* Add NAT detection notification messages (mandatory) */ + u8 *nat_detection_sha1 = + ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa.ispi), + clib_host_to_net_u64 (sa.rspi), + &if_ip, clib_host_to_net_u16 (IKEV2_PORT)); + + ikev2_payload_add_notify (chain, IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP, + nat_detection_sha1); + vec_free (nat_detection_sha1); + nat_detection_sha1 = + ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa.ispi), + clib_host_to_net_u64 (sa.rspi), + &p->responder.addr, + clib_host_to_net_u16 (sa.dst_port)); + ikev2_payload_add_notify (chain, + IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP, + nat_detection_sha1); + vec_free (nat_detection_sha1); + + u8 *sig_hash_algo = vec_new (u8, 8); + u64 tmpsig = clib_host_to_net_u64 (0x0001000200030004); + clib_memcpy_fast (sig_hash_algo, &tmpsig, sizeof (tmpsig)); + ikev2_payload_add_notify (chain, + IKEV2_NOTIFY_MSG_SIGNATURE_HASH_ALGORITHMS, + sig_hash_algo); + vec_free (sig_hash_algo); + + /* Buffer update and boilerplate */ + len += vec_len (chain->data); + ike0->nextpayload = chain->first_payload_type; + ike0->length = clib_host_to_net_u32 (len); + clib_memcpy_fast (ike0->payload, chain->data, vec_len (chain->data)); + ikev2_payload_destroy_chain (chain); + + ike0->version = IKE_VERSION_2; + ike0->flags = IKEV2_HDR_FLAG_INITIATOR; + ike0->exchange = IKEV2_EXCHANGE_SA_INIT; + ike0->ispi = clib_host_to_net_u64 (sa.ispi); + ike0->rspi = 0; + ike0->msgid = 0; + + /* store whole IKE payload - needed for PSK auth */ + vec_reset_length (sa.last_sa_init_req_packet_data); + vec_add (sa.last_sa_init_req_packet_data, ike0, len); + + /* add data to the SA then add it to the pool */ + ip_address_copy (&sa.iaddr, &if_ip); + ip_address_copy (&sa.raddr, &p->responder.addr); + sa.i_id.type = p->loc_id.type; + sa.i_id.data = vec_dup (p->loc_id.data); + sa.r_id.type = p->rem_id.type; + sa.r_id.data = vec_dup (p->rem_id.data); + sa.i_auth.method = p->auth.method; + sa.i_auth.hex = p->auth.hex; + sa.i_auth.data = vec_dup (p->auth.data); + sa.sw_if_index = p->responder.sw_if_index; + vec_add (sa.childs[0].tsi, &p->loc_ts, 1); + vec_add (sa.childs[0].tsr, &p->rem_ts, 1); + + ikev2_initial_contact_cleanup (0, &sa); + + /* add SA to the pool */ + ikev2_sa_t *sa0 = 0; + pool_get (km->sais, sa0); + clib_memcpy_fast (sa0, &sa, sizeof (*sa0)); + hash_set (km->sa_by_ispi, sa0->ispi, sa0 - km->sais); + + if (valid_ip) + { + ikev2_send_ike (vm, &if_ip, &p->responder.addr, bi0, len, + IKEV2_PORT, sa.dst_port, sa.sw_if_index); + + ikev2_elog_exchange + ("ispi %lx rspi %lx IKEV2_EXCHANGE_SA_INIT sent to ", + clib_host_to_net_u64 (sa0->ispi), 0, + ip_addr_v4 (&p->responder.addr).as_u32, + ip_addr_version (&p->responder.addr) == AF_IP4); + } + else + { + r = + clib_error_return (0, "interface %U does not have any IP address!", + format_vnet_sw_if_index_name, vnet_get_main (), + p->responder.sw_if_index); + return r; + } return 0; } @@ -4219,6 +4289,7 @@ ikev2_delete_child_sa_internal (vlib_main_t * vm, ikev2_sa_t * sa, ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL; ike0->ispi = clib_host_to_net_u64 (sa->ispi); ike0->rspi = clib_host_to_net_u64 (sa->rspi); + ike0->flags = 0; vec_resize (sa->del, 1); sa->del->protocol_id = IKEV2_PROTOCOL_ESP; sa->del->spi = csa->i_proposals->spi; @@ -4228,7 +4299,7 @@ ikev2_delete_child_sa_internal (vlib_main_t * vm, ikev2_sa_t * sa, if (~0 == len) return; - if (sa->natt) + if (ikev2_natt_active (sa)) len = ikev2_insert_non_esp_marker (ike0, len); ikev2_send_ike (vm, &sa->iaddr, &sa->raddr, bi0, len, ikev2_get_port (sa), sa->dst_port, sa->sw_if_index); @@ -4311,7 +4382,7 @@ ikev2_initiate_delete_ike_sa (vlib_main_t * vm, u64 ispi) return r; } - ikev2_initiate_delete_ike_sa_internal (vm, ftkm, fsa); + ikev2_initiate_delete_ike_sa_internal (vm, ftkm, fsa, 1); return 0; } @@ -4353,7 +4424,7 @@ ikev2_rekey_child_sa_internal (vlib_main_t * vm, ikev2_sa_t * sa, if (~0 == len) return; - if (sa->natt) + if (ikev2_natt_active (sa)) len = ikev2_insert_non_esp_marker (ike0, len); ikev2_send_ike (vm, &sa->iaddr, &sa->raddr, bi0, len, ikev2_get_port (sa), ikev2_get_port (sa), sa->sw_if_index); @@ -4400,6 +4471,74 @@ ikev2_initiate_rekey_child_sa (vlib_main_t * vm, u32 ispi) return 0; } +static int +ikev2_sa_sw_if_match (ikev2_sa_t * sa, u32 sw_if_index) +{ + return (sa->sw_if_index == sw_if_index) && sa->is_initiator; +} + +static void +ikev2_sa_del (ikev2_profile_t * p, u32 sw_if_index) +{ + u64 *ispi, *ispi_vec = 0; + ikev2_sa_t *sa, **sap, **sa_vec = 0; + ikev2_main_t *km = &ikev2_main; + ikev2_main_per_thread_data_t *tkm; + p->responder.sw_if_index = ~0; + + vec_foreach (tkm, km->per_thread_data) + { + /* *INDENT-OFF* */ + pool_foreach (sa, tkm->sas, ({ + if (ikev2_sa_sw_if_match (sa, sw_if_index)) + vec_add1 (sa_vec, sa); + })); + /* *INDENT-ON* */ + + vec_foreach (sap, sa_vec) + { + ikev2_initiate_delete_ike_sa_internal (km->vlib_main, tkm, *sap, 0); + } + vec_reset_length (sa_vec); + } + vec_free (sa_vec); + + /* *INDENT-OFF* */ + pool_foreach (sa, km->sais, ({ + if (ikev2_sa_sw_if_match (sa, sw_if_index)) + vec_add1 (ispi_vec, sa->ispi); + })); + /* *INDENT-ON* */ + + vec_foreach (ispi, ispi_vec) + { + ikev2_del_sa_init_from_main (ispi); + } + + vec_free (ispi_vec); +} + +static clib_error_t * +ikev2_sw_interface_add_del (vnet_main_t * vnm, u32 sw_if_index, u32 is_add) +{ + ikev2_main_t *km = &ikev2_main; + ikev2_profile_t *p; + + if (is_add) + return 0; + + /* *INDENT-OFF* */ + pool_foreach (p, km->profiles, ({ + if (p->responder.sw_if_index == sw_if_index) + ikev2_sa_del (p, sw_if_index); + })); + /* *INDENT-ON* */ + + return 0; +} + +VNET_SW_INTERFACE_ADD_DEL_FUNCTION (ikev2_sw_interface_add_del); + clib_error_t * ikev2_init (vlib_main_t * vm) { @@ -4588,6 +4727,17 @@ ikev2_set_liveness_params (u32 period, u32 max_retries) return 0; } +clib_error_t * +ikev2_profile_natt_disable (u8 * name) +{ + ikev2_profile_t *p = ikev2_profile_index_by_name (name); + if (!p) + return clib_error_return (0, "unknown profile %v", name); + + p->natt_disabled = 1; + return 0; +} + static void ikev2_mngr_process_ipsec_sa (ipsec_sa_t * ipsec_sa) { @@ -4632,6 +4782,51 @@ ikev2_mngr_process_ipsec_sa (ipsec_sa_t * ipsec_sa) } } +static void +ikev2_process_pending_sa_init_one (ikev2_main_t * km, ikev2_sa_t * sa) +{ + ikev2_profile_t *p; + u32 bi0; + u8 *nat_sha, *np; + + if (ip_address_is_zero (&sa->iaddr)) + { + p = pool_elt_at_index (km->profiles, sa->profile_index); + if (!ikev2_get_if_address (p->responder.sw_if_index, + ip_addr_version (&p->responder.addr), + &sa->iaddr)) + return; + + /* update NAT detection payload */ + np = + ikev2_find_ike_notify_payload + ((ike_header_t *) sa->last_sa_init_req_packet_data, + IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP); + if (np) + { + nat_sha = + ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa->ispi), + clib_host_to_net_u64 (sa->rspi), + &sa->iaddr, + clib_host_to_net_u16 (IKEV2_PORT)); + clib_memcpy_fast (np, nat_sha, vec_len (nat_sha)); + vec_free (nat_sha); + } + } + + if (vlib_buffer_alloc (km->vlib_main, &bi0, 1) != 1) + return; + + vlib_buffer_t *b = vlib_get_buffer (km->vlib_main, bi0); + clib_memcpy_fast (vlib_buffer_get_current (b), + sa->last_sa_init_req_packet_data, + vec_len (sa->last_sa_init_req_packet_data)); + + ikev2_send_ike (km->vlib_main, &sa->iaddr, &sa->raddr, bi0, + vec_len (sa->last_sa_init_req_packet_data), + ikev2_get_port (sa), IKEV2_PORT, sa->sw_if_index); +} + static void ikev2_process_pending_sa_init (ikev2_main_t * km) { @@ -4646,23 +4841,11 @@ ikev2_process_pending_sa_init (ikev2_main_t * km) if (sa->init_response_received) continue; - u32 bi0; - if (vlib_buffer_alloc (km->vlib_main, &bi0, 1) != 1) - return; - - vlib_buffer_t * b = vlib_get_buffer (km->vlib_main, bi0); - clib_memcpy_fast (vlib_buffer_get_current (b), - sa->last_sa_init_req_packet_data, - vec_len (sa->last_sa_init_req_packet_data)); - ikev2_send_ike (km->vlib_main, &sa->iaddr, &sa->raddr, bi0, - vec_len (sa->last_sa_init_req_packet_data), - ikev2_get_port (sa), IKEV2_PORT, sa->sw_if_index); + ikev2_process_pending_sa_init_one (km, sa); })); /* *INDENT-ON* */ } -static vlib_node_registration_t ikev2_mngr_process_node; - static void ikev2_send_informational_request (ikev2_sa_t * sa) { @@ -4686,12 +4869,13 @@ ikev2_send_informational_request (ikev2_sa_t * sa) ike0->ispi = clib_host_to_net_u64 (sa->ispi); ike0->rspi = clib_host_to_net_u64 (sa->rspi); ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id + 1); + ike0->flags = 0; sa->last_init_msg_id = clib_net_to_host_u32 (ike0->msgid); len = ikev2_generate_message (b0, sa, ike0, 0, 0); if (~0 == len) return; - if (sa->natt) + if (ikev2_natt_active (sa)) len = ikev2_insert_non_esp_marker (ike0, len); if (sa->is_initiator) @@ -4710,6 +4894,13 @@ ikev2_send_informational_request (ikev2_sa_t * sa) sa->sw_if_index); } +void +ikev2_disable_dpd (void) +{ + ikev2_main_t *km = &ikev2_main; + km->dpd_disabled = 1; +} + static_always_inline int ikev2_mngr_process_responder_sas (ikev2_sa_t * sa) { @@ -4745,8 +4936,7 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt, while (1) { - u8 req_sent = 0; - vlib_process_wait_for_event_or_clock (vm, 1); + vlib_process_wait_for_event_or_clock (vm, 2); vlib_process_get_events (vm, NULL); /* process ike child sas */ @@ -4760,6 +4950,10 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt, pool_foreach (sa, tkm->sas, ({ ikev2_child_sa_t *c; u8 del_old_ids = 0; + + if (sa->state != IKEV2_STATE_AUTHENTICATED) + continue; + if (sa->old_remote_id_present && 0 > sa->old_id_expiration) { sa->old_remote_id_present = 0; @@ -4769,11 +4963,9 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt, sa->old_id_expiration -= 1; vec_foreach (c, sa->childs) - { - req_sent |= ikev2_mngr_process_child_sa(sa, c, del_old_ids); - } + ikev2_mngr_process_child_sa(sa, c, del_old_ids); - if (ikev2_mngr_process_responder_sas (sa)) + if (!km->dpd_disabled && ikev2_mngr_process_responder_sas (sa)) vec_add1 (to_be_deleted, sa - tkm->sas); })); /* *INDENT-ON* */ @@ -4812,14 +5004,6 @@ ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt, /* *INDENT-ON* */ ikev2_process_pending_sa_init (km); - - if (req_sent) - { - vlib_process_wait_for_event_or_clock (vm, 5); - vlib_process_get_events (vm, NULL); - req_sent = 0; - } - } return 0; }