X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_api.c;h=4bb3a75b936c9e075a317778d10c3adb76c57233;hb=1ba5bc8d888d0164dd6e38857cbed09ab7ce1d8b;hp=a26f486d6ef885a024bb16b8dfd63611f15bceff;hpb=eba31ecebed1a7d168da17194cab7a8955761f2b;p=vpp.git diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index a26f486d6ef..4bb3a75b936 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -30,7 +30,6 @@ #if WITH_LIBSSL > 0 #include -#include #endif /* IPSEC */ #define vl_typedefs /* define message structures */ @@ -62,19 +61,6 @@ _(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ _(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \ _(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \ -_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \ -_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \ -_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \ -_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \ -_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \ -_(IKEV2_SET_RESPONDER, ikev2_set_responder) \ -_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \ -_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \ -_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \ -_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \ -_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \ -_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \ -_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa) \ _(IPSEC_SELECT_BACKEND, ipsec_select_backend) \ _(IPSEC_BACKEND_DUMP, ipsec_backend_dump) @@ -146,6 +132,8 @@ static void vl_api_ipsec_spd_entry_add_del_t_handler u32 stat_index; int rv; + stat_index = ~0; + #if WITH_LIBSSL > 0 ipsec_policy_t p; @@ -153,7 +141,6 @@ static void vl_api_ipsec_spd_entry_add_del_t_handler p.id = ntohl (mp->entry.spd_id); p.priority = ntohl (mp->entry.priority); - p.is_outbound = mp->entry.is_outbound; itype = ip_address_decode (&mp->entry.remote_address_start, &p.raddr.start); ip_address_decode (&mp->entry.remote_address_stop, &p.raddr.stop); @@ -163,10 +150,11 @@ static void vl_api_ipsec_spd_entry_add_del_t_handler p.is_ipv6 = (itype == IP46_TYPE_IP6); p.protocol = mp->entry.protocol; - p.rport.start = ntohs (mp->entry.remote_port_start); - p.rport.stop = ntohs (mp->entry.remote_port_stop); - p.lport.start = ntohs (mp->entry.local_port_start); - p.lport.stop = ntohs (mp->entry.local_port_stop); + /* leave the ports in network order */ + p.rport.start = mp->entry.remote_port_start; + p.rport.stop = mp->entry.remote_port_stop; + p.lport.start = mp->entry.local_port_start; + p.lport.stop = mp->entry.local_port_stop; rv = ipsec_spd_action_decode (mp->entry.policy, &p.policy); @@ -181,6 +169,11 @@ static void vl_api_ipsec_spd_entry_add_del_t_handler goto out; } p.sa_id = ntohl (mp->entry.sa_id); + rv = + ipsec_policy_mk_type (mp->entry.is_outbound, p.is_ipv6, p.policy, + &p.type); + if (rv) + goto out; rv = ipsec_add_del_policy (vm, &p, mp->is_add, &stat_index); if (rv) @@ -354,7 +347,7 @@ static void vl_api_ipsec_sad_entry_add_del_t_handler ipsec_integ_alg_t integ_alg; ipsec_protocol_t proto; ipsec_sa_flags_t flags; - u32 id, spi, sa_index; + u32 id, spi, sa_index = ~0; int rv; #if WITH_LIBSSL > 0 @@ -478,7 +471,8 @@ send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg, mp->entry.spd_id = htonl (p->id); mp->entry.priority = htonl (p->priority); - mp->entry.is_outbound = p->is_outbound; + mp->entry.is_outbound = ((p->type == IPSEC_SPD_POLICY_IP6_OUTBOUND) || + (p->type == IPSEC_SPD_POLICY_IP4_OUTBOUND)); ip_address_encode (&p->laddr.start, IP46_TYPE_ANY, &mp->entry.local_address_start); @@ -488,10 +482,10 @@ send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg, &mp->entry.remote_address_start); ip_address_encode (&p->raddr.stop, IP46_TYPE_ANY, &mp->entry.remote_address_stop); - mp->entry.local_port_start = htons (p->lport.start); - mp->entry.local_port_stop = htons (p->lport.stop); - mp->entry.remote_port_start = htons (p->rport.start); - mp->entry.remote_port_stop = htons (p->rport.stop); + mp->entry.local_port_start = p->lport.start; + mp->entry.local_port_stop = p->lport.stop; + mp->entry.remote_port_start = p->rport.start; + mp->entry.remote_port_stop = p->rport.stop; mp->entry.protocol = p->protocol; mp->entry.policy = ipsec_spd_action_encode (p->policy); mp->entry.sa_id = htonl (p->sa_id); @@ -504,7 +498,7 @@ vl_api_ipsec_spd_dump_t_handler (vl_api_ipsec_spd_dump_t * mp) { vl_api_registration_t *reg; ipsec_main_t *im = &ipsec_main; - ipsec_spd_policy_t ptype; + ipsec_spd_policy_type_t ptype; ipsec_policy_t *policy; ipsec_spd_t *spd; uword *p; @@ -622,6 +616,7 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * ipsec_main_t *im = &ipsec_main; vnet_main_t *vnm = im->vnet_main; u32 sw_if_index = ~0; + ip46_type_t itype; int rv; #if WITH_LIBSSL > 0 @@ -642,8 +637,9 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * tun.remote_integ_key_len = mp->remote_integ_key_len; tun.udp_encap = mp->udp_encap; tun.tx_table_id = ntohl (mp->tx_table_id); - memcpy (&tun.local_ip.ip4, mp->local_ip, 4); - memcpy (&tun.remote_ip.ip4, mp->remote_ip, 4); + itype = ip_address_decode (&mp->local_ip, &tun.local_ip); + itype = ip_address_decode (&mp->remote_ip, &tun.remote_ip); + tun.is_ip6 = (IP46_TYPE_IP6 == itype); memcpy (&tun.local_crypto_key, &mp->local_crypto_key, mp->local_crypto_key_len); memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key, @@ -839,329 +835,6 @@ vl_api_ipsec_tunnel_if_set_sa_t_handler (vl_api_ipsec_tunnel_if_set_sa_t * mp) REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_SA_REPLY); } - -static void -vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp) -{ - vl_api_ikev2_profile_add_del_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - u8 *tmp = format (0, "%s", mp->name); - error = ikev2_add_del_profile (vm, tmp, mp->is_add); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_PROFILE_ADD_DEL_REPLY); -} - -static void - vl_api_ikev2_profile_set_auth_t_handler - (vl_api_ikev2_profile_set_auth_t * mp) -{ - vl_api_ikev2_profile_set_auth_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - int data_len = ntohl (mp->data_len); - u8 *tmp = format (0, "%s", mp->name); - u8 *data = vec_new (u8, data_len); - clib_memcpy (data, mp->data, data_len); - error = ikev2_set_profile_auth (vm, tmp, mp->auth_method, data, mp->is_hex); - vec_free (tmp); - vec_free (data); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_AUTH_REPLY); -} - -static void -vl_api_ikev2_profile_set_id_t_handler (vl_api_ikev2_profile_set_id_t * mp) -{ - vl_api_ikev2_profile_add_del_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - u8 *tmp = format (0, "%s", mp->name); - int data_len = ntohl (mp->data_len); - u8 *data = vec_new (u8, data_len); - clib_memcpy (data, mp->data, data_len); - error = ikev2_set_profile_id (vm, tmp, mp->id_type, data, mp->is_local); - vec_free (tmp); - vec_free (data); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_ID_REPLY); -} - -static void -vl_api_ikev2_profile_set_ts_t_handler (vl_api_ikev2_profile_set_ts_t * mp) -{ - vl_api_ikev2_profile_set_ts_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - u8 *tmp = format (0, "%s", mp->name); - error = ikev2_set_profile_ts (vm, tmp, mp->proto, mp->start_port, - mp->end_port, (ip4_address_t) mp->start_addr, - (ip4_address_t) mp->end_addr, mp->is_local); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_TS_REPLY); -} - -static void -vl_api_ikev2_set_local_key_t_handler (vl_api_ikev2_set_local_key_t * mp) -{ - vl_api_ikev2_profile_set_ts_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - error = ikev2_set_local_key (vm, mp->key_file); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_SET_LOCAL_KEY_REPLY); -} - -static void -vl_api_ikev2_set_responder_t_handler (vl_api_ikev2_set_responder_t * mp) -{ - vl_api_ikev2_set_responder_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - u8 *tmp = format (0, "%s", mp->name); - ip4_address_t ip4; - clib_memcpy (&ip4, mp->address, sizeof (ip4)); - - error = ikev2_set_profile_responder (vm, tmp, mp->sw_if_index, ip4); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_SET_RESPONDER_REPLY); -} - -static void -vl_api_ikev2_set_ike_transforms_t_handler (vl_api_ikev2_set_ike_transforms_t * - mp) -{ - vl_api_ikev2_set_ike_transforms_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - u8 *tmp = format (0, "%s", mp->name); - - error = - ikev2_set_profile_ike_transforms (vm, tmp, mp->crypto_alg, mp->integ_alg, - mp->dh_group, mp->crypto_key_size); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_SET_IKE_TRANSFORMS_REPLY); -} - -static void -vl_api_ikev2_set_esp_transforms_t_handler (vl_api_ikev2_set_esp_transforms_t * - mp) -{ - vl_api_ikev2_set_esp_transforms_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - u8 *tmp = format (0, "%s", mp->name); - - error = - ikev2_set_profile_esp_transforms (vm, tmp, mp->crypto_alg, mp->integ_alg, - mp->dh_group, mp->crypto_key_size); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_SET_ESP_TRANSFORMS_REPLY); -} - -static void -vl_api_ikev2_set_sa_lifetime_t_handler (vl_api_ikev2_set_sa_lifetime_t * mp) -{ - vl_api_ikev2_set_sa_lifetime_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - u8 *tmp = format (0, "%s", mp->name); - - error = - ikev2_set_profile_sa_lifetime (vm, tmp, mp->lifetime, mp->lifetime_jitter, - mp->handover, mp->lifetime_maxdata); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_SET_SA_LIFETIME_REPLY); -} - -static void -vl_api_ikev2_initiate_sa_init_t_handler (vl_api_ikev2_initiate_sa_init_t * mp) -{ - vl_api_ikev2_initiate_sa_init_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - u8 *tmp = format (0, "%s", mp->name); - - error = ikev2_initiate_sa_init (vm, tmp); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_INITIATE_SA_INIT_REPLY); -} - -static void -vl_api_ikev2_initiate_del_ike_sa_t_handler (vl_api_ikev2_initiate_del_ike_sa_t - * mp) -{ - vl_api_ikev2_initiate_del_ike_sa_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - error = ikev2_initiate_delete_ike_sa (vm, mp->ispi); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_IKE_SA_REPLY); -} - -static void - vl_api_ikev2_initiate_del_child_sa_t_handler - (vl_api_ikev2_initiate_del_child_sa_t * mp) -{ - vl_api_ikev2_initiate_del_child_sa_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - error = ikev2_initiate_delete_child_sa (vm, mp->ispi); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_CHILD_SA_REPLY); -} - -static void - vl_api_ikev2_initiate_rekey_child_sa_t_handler - (vl_api_ikev2_initiate_rekey_child_sa_t * mp) -{ - vl_api_ikev2_initiate_rekey_child_sa_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - error = ikev2_initiate_rekey_child_sa (vm, mp->ispi); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_INITIATE_REKEY_CHILD_SA_REPLY); -} - -/* - * ipsec_api_hookup - * Add vpe's API message handlers to the table. - * vlib has already mapped shared memory and - * added the client registration handlers. - * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process() - */ -#define vl_msg_name_crc_list -#include -#undef vl_msg_name_crc_list - -static void -setup_message_id_table (api_main_t * am) -{ -#define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id); - foreach_vl_msg_name_crc_ipsec; -#undef _ -} - static void vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp) { @@ -1255,6 +928,25 @@ done: REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY); } +/* + * ipsec_api_hookup + * Add vpe's API message handlers to the table. + * vlib has already mapped shared memory and + * added the client registration handlers. + * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process() + */ +#define vl_msg_name_crc_list +#include +#undef vl_msg_name_crc_list + +static void +setup_message_id_table (api_main_t * am) +{ +#define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id); + foreach_vl_msg_name_crc_ipsec; +#undef _ +} + static clib_error_t * ipsec_api_hookup (vlib_main_t * vm) {