X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_api.c;h=5ce64d9a7d6932ae57b61ad790b640152d089f7b;hb=f16e9a550;hp=a26f486d6ef885a024bb16b8dfd63611f15bceff;hpb=eba31ecebed1a7d168da17194cab7a8955761f2b;p=vpp.git diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index a26f486d6ef..5ce64d9a7d6 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -24,13 +24,18 @@ #include #include #include +#include +#include #include +#include +#include #include #if WITH_LIBSSL > 0 #include -#include +#include +#include #endif /* IPSEC */ #define vl_typedefs /* define message structures */ @@ -49,34 +54,28 @@ #include -#define foreach_vpe_api_msg \ -_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \ -_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ -_(IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \ -_(IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \ -_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \ -_(IPSEC_SA_DUMP, ipsec_sa_dump) \ -_(IPSEC_SPDS_DUMP, ipsec_spds_dump) \ -_(IPSEC_SPD_DUMP, ipsec_spd_dump) \ -_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ -_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ -_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \ -_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \ -_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \ -_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \ -_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \ -_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \ -_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \ -_(IKEV2_SET_RESPONDER, ikev2_set_responder) \ -_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \ -_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \ -_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \ -_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \ -_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \ -_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \ -_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa) \ -_(IPSEC_SELECT_BACKEND, ipsec_select_backend) \ -_(IPSEC_BACKEND_DUMP, ipsec_backend_dump) +#define foreach_vpe_api_msg \ + _ (IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \ + _ (IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ + _ (IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \ + _ (IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \ + _ (IPSEC_SAD_ENTRY_ADD_DEL_V2, ipsec_sad_entry_add_del_v2) \ + _ (IPSEC_SAD_ENTRY_ADD_DEL_V3, ipsec_sad_entry_add_del_v3) \ + _ (IPSEC_SA_DUMP, ipsec_sa_dump) \ + _ (IPSEC_SA_V2_DUMP, ipsec_sa_v2_dump) \ + _ (IPSEC_SA_V3_DUMP, ipsec_sa_v3_dump) \ + _ (IPSEC_SPDS_DUMP, ipsec_spds_dump) \ + _ (IPSEC_SPD_DUMP, ipsec_spd_dump) \ + _ (IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ + _ (IPSEC_ITF_CREATE, ipsec_itf_create) \ + _ (IPSEC_ITF_DELETE, ipsec_itf_delete) \ + _ (IPSEC_ITF_DUMP, ipsec_itf_dump) \ + _ (IPSEC_SELECT_BACKEND, ipsec_select_backend) \ + _ (IPSEC_BACKEND_DUMP, ipsec_backend_dump) \ + _ (IPSEC_TUNNEL_PROTECT_UPDATE, ipsec_tunnel_protect_update) \ + _ (IPSEC_TUNNEL_PROTECT_DEL, ipsec_tunnel_protect_del) \ + _ (IPSEC_TUNNEL_PROTECT_DUMP, ipsec_tunnel_protect_dump) \ + _ (IPSEC_SET_ASYNC_MODE, ipsec_set_async_mode) static void vl_api_ipsec_spd_add_del_t_handler (vl_api_ipsec_spd_add_del_t * mp) @@ -120,6 +119,135 @@ static void vl_api_ipsec_interface_add_del_spd_t_handler REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY); } +static void vl_api_ipsec_tunnel_protect_update_t_handler + (vl_api_ipsec_tunnel_protect_update_t * mp) +{ + vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main (); + vl_api_ipsec_tunnel_protect_update_reply_t *rmp; + u32 sw_if_index, ii, *sa_ins = NULL; + ip_address_t nh; + int rv; + + sw_if_index = ntohl (mp->tunnel.sw_if_index); + + VALIDATE_SW_IF_INDEX (&(mp->tunnel)); + +#if WITH_LIBSSL > 0 + + for (ii = 0; ii < mp->tunnel.n_sa_in; ii++) + vec_add1 (sa_ins, ntohl (mp->tunnel.sa_in[ii])); + + ip_address_decode2 (&mp->tunnel.nh, &nh); + + rv = ipsec_tun_protect_update (sw_if_index, &nh, + ntohl (mp->tunnel.sa_out), sa_ins); +#else + rv = VNET_API_ERROR_UNIMPLEMENTED; +#endif + + BAD_SW_IF_INDEX_LABEL; + + REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_UPDATE_REPLY); +} + +static void vl_api_ipsec_tunnel_protect_del_t_handler + (vl_api_ipsec_tunnel_protect_del_t * mp) +{ + vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main (); + vl_api_ipsec_tunnel_protect_del_reply_t *rmp; + ip_address_t nh; + u32 sw_if_index; + int rv; + + sw_if_index = ntohl (mp->sw_if_index); + + VALIDATE_SW_IF_INDEX (mp); + +#if WITH_LIBSSL > 0 + ip_address_decode2 (&mp->nh, &nh); + rv = ipsec_tun_protect_del (sw_if_index, &nh); +#else + rv = VNET_API_ERROR_UNIMPLEMENTED; +#endif + + BAD_SW_IF_INDEX_LABEL; + + REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_DEL_REPLY); +} + +typedef struct ipsec_dump_walk_ctx_t_ +{ + vl_api_registration_t *reg; + u32 context; +} ipsec_dump_walk_ctx_t; + +static walk_rc_t +send_ipsec_tunnel_protect_details (index_t itpi, void *arg) +{ + ipsec_dump_walk_ctx_t *ctx = arg; + vl_api_ipsec_tunnel_protect_details_t *mp; + ipsec_tun_protect_t *itp; + u32 ii = 0; + ipsec_sa_t *sa; + + itp = ipsec_tun_protect_get (itpi); + + mp = vl_msg_api_alloc (sizeof (*mp) + (sizeof (u32) * itp->itp_n_sa_in)); + clib_memset (mp, 0, sizeof (*mp)); + mp->_vl_msg_id = ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS); + mp->context = ctx->context; + + mp->tun.sw_if_index = htonl (itp->itp_sw_if_index); + ip_address_encode2 (itp->itp_key, &mp->tun.nh); + + sa = ipsec_sa_get (itp->itp_out_sa); + mp->tun.sa_out = htonl (sa->id); + mp->tun.n_sa_in = itp->itp_n_sa_in; + /* *INDENT-OFF* */ + FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa, + ({ + mp->tun.sa_in[ii++] = htonl (sa->id); + })); + /* *INDENT-ON* */ + + vl_api_send_msg (ctx->reg, (u8 *) mp); + + return (WALK_CONTINUE); +} + +static void +vl_api_ipsec_tunnel_protect_dump_t_handler (vl_api_ipsec_tunnel_protect_dump_t + * mp) +{ + vl_api_registration_t *reg; + u32 sw_if_index; + +#if WITH_LIBSSL > 0 + reg = vl_api_client_index_to_registration (mp->client_index); + if (!reg) + return; + + ipsec_dump_walk_ctx_t ctx = { + .reg = reg, + .context = mp->context, + }; + + sw_if_index = ntohl (mp->sw_if_index); + + if (~0 == sw_if_index) + { + ipsec_tun_protect_walk (send_ipsec_tunnel_protect_details, &ctx); + } + else + { + ipsec_tun_protect_walk_itf (sw_if_index, + send_ipsec_tunnel_protect_details, &ctx); + } +#else + clib_warning ("unimplemented"); +#endif +} + static int ipsec_spd_action_decode (vl_api_ipsec_spd_action_t in, ipsec_policy_action_t * out) @@ -146,6 +274,8 @@ static void vl_api_ipsec_spd_entry_add_del_t_handler u32 stat_index; int rv; + stat_index = ~0; + #if WITH_LIBSSL > 0 ipsec_policy_t p; @@ -153,7 +283,6 @@ static void vl_api_ipsec_spd_entry_add_del_t_handler p.id = ntohl (mp->entry.spd_id); p.priority = ntohl (mp->entry.priority); - p.is_outbound = mp->entry.is_outbound; itype = ip_address_decode (&mp->entry.remote_address_start, &p.raddr.start); ip_address_decode (&mp->entry.remote_address_stop, &p.raddr.stop); @@ -181,6 +310,11 @@ static void vl_api_ipsec_spd_entry_add_del_t_handler goto out; } p.sa_id = ntohl (mp->entry.sa_id); + rv = + ipsec_policy_mk_type (mp->entry.is_outbound, p.is_ipv6, p.policy, + &p.type); + if (rv) + goto out; rv = ipsec_add_del_policy (vm, &p, mp->is_add, &stat_index); if (rv) @@ -200,162 +334,95 @@ out: /* *INDENT-ON* */ } -static int -ipsec_proto_decode (vl_api_ipsec_proto_t in, ipsec_protocol_t * out) +static void vl_api_ipsec_sad_entry_add_del_t_handler + (vl_api_ipsec_sad_entry_add_del_t * mp) { - in = clib_net_to_host_u32 (in); + vl_api_ipsec_sad_entry_add_del_reply_t *rmp; + ipsec_key_t crypto_key, integ_key; + ipsec_crypto_alg_t crypto_alg; + ipsec_integ_alg_t integ_alg; + ipsec_protocol_t proto; + ipsec_sa_flags_t flags; + u32 id, spi, sa_index = ~0; + tunnel_t tun = { + .t_flags = TUNNEL_FLAG_NONE, + .t_encap_decap_flags = TUNNEL_ENCAP_DECAP_FLAG_NONE, + .t_dscp = 0, + .t_mode = TUNNEL_MODE_P2P, + .t_table_id = 0, + .t_hop_limit = 255, + }; + int rv; - switch (in) - { - case IPSEC_API_PROTO_ESP: - *out = IPSEC_PROTOCOL_ESP; - return (0); - case IPSEC_API_PROTO_AH: - *out = IPSEC_PROTOCOL_AH; - return (0); - } - return (VNET_API_ERROR_UNIMPLEMENTED); -} +#if WITH_LIBSSL > 0 -static vl_api_ipsec_proto_t -ipsec_proto_encode (ipsec_protocol_t p) -{ - switch (p) - { - case IPSEC_PROTOCOL_ESP: - return clib_host_to_net_u32 (IPSEC_API_PROTO_ESP); - case IPSEC_PROTOCOL_AH: - return clib_host_to_net_u32 (IPSEC_API_PROTO_AH); - } - return (VNET_API_ERROR_UNIMPLEMENTED); -} + id = ntohl (mp->entry.sad_id); + spi = ntohl (mp->entry.spi); -static int -ipsec_crypto_algo_decode (vl_api_ipsec_crypto_alg_t in, - ipsec_crypto_alg_t * out) -{ - in = clib_net_to_host_u32 (in); + rv = ipsec_proto_decode (mp->entry.protocol, &proto); - switch (in) - { -#define _(v,f,s) case IPSEC_API_CRYPTO_ALG_##f: \ - *out = IPSEC_CRYPTO_ALG_##f; \ - return (0); - foreach_ipsec_crypto_alg -#undef _ - } - return (VNET_API_ERROR_UNIMPLEMENTED); -} + if (rv) + goto out; -static vl_api_ipsec_crypto_alg_t -ipsec_crypto_algo_encode (ipsec_crypto_alg_t c) -{ - switch (c) - { -#define _(v,f,s) case IPSEC_CRYPTO_ALG_##f: \ - return clib_host_to_net_u32(IPSEC_API_CRYPTO_ALG_##f); - foreach_ipsec_crypto_alg -#undef _ - case IPSEC_CRYPTO_N_ALG: - break; - } - ASSERT (0); - return (VNET_API_ERROR_UNIMPLEMENTED); -} + rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg); + if (rv) + goto out; -static int -ipsec_integ_algo_decode (vl_api_ipsec_integ_alg_t in, ipsec_integ_alg_t * out) -{ - in = clib_net_to_host_u32 (in); + rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg); - switch (in) - { -#define _(v,f,s) case IPSEC_API_INTEG_ALG_##f: \ - *out = IPSEC_INTEG_ALG_##f; \ - return (0); - foreach_ipsec_integ_alg -#undef _ - } - return (VNET_API_ERROR_UNIMPLEMENTED); -} + if (rv) + goto out; -static vl_api_ipsec_integ_alg_t -ipsec_integ_algo_encode (ipsec_integ_alg_t i) -{ - switch (i) - { -#define _(v,f,s) case IPSEC_INTEG_ALG_##f: \ - return (clib_host_to_net_u32(IPSEC_API_INTEG_ALG_##f)); - foreach_ipsec_integ_alg -#undef _ - case IPSEC_INTEG_N_ALG: - break; - } - ASSERT (0); - return (VNET_API_ERROR_UNIMPLEMENTED); -} + ipsec_key_decode (&mp->entry.crypto_key, &crypto_key); + ipsec_key_decode (&mp->entry.integrity_key, &integ_key); -static void -ipsec_key_decode (const vl_api_key_t * key, ipsec_key_t * out) -{ - ipsec_mk_key (out, key->data, key->length); -} + flags = ipsec_sa_flags_decode (mp->entry.flags); -static void -ipsec_key_encode (const ipsec_key_t * in, vl_api_key_t * out) -{ - out->length = in->len; - clib_memcpy (out->data, in->data, out->length); -} + ip_address_decode2 (&mp->entry.tunnel_src, &tun.t_src); + ip_address_decode2 (&mp->entry.tunnel_dst, &tun.t_dst); -static ipsec_sa_flags_t -ipsec_sa_flags_decode (vl_api_ipsec_sad_flags_t in) -{ - ipsec_sa_flags_t flags = IPSEC_SA_FLAG_NONE; - in = clib_net_to_host_u32 (in); + if (mp->is_add) + rv = ipsec_sa_add_and_lock ( + id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags, + mp->entry.salt, htons (mp->entry.udp_src_port), + htons (mp->entry.udp_dst_port), &tun, &sa_index); + else + rv = ipsec_sa_unlock_id (id); -#define _(v,f,s) if (in & IPSEC_API_SAD_FLAG_##f) \ - flags |= IPSEC_SA_FLAG_##f; - foreach_ipsec_sa_flags -#undef _ - return (flags); -} +#else + rv = VNET_API_ERROR_UNIMPLEMENTED; +#endif -static vl_api_ipsec_sad_flags_t -ipsec_sad_flags_encode (const ipsec_sa_t * sa) -{ - vl_api_ipsec_sad_flags_t flags = IPSEC_API_SAD_FLAG_NONE; - - if (sa->use_esn) - flags |= IPSEC_API_SAD_FLAG_USE_EXTENDED_SEQ_NUM; - if (sa->use_anti_replay) - flags |= IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY; - if (sa->is_tunnel) - flags |= IPSEC_API_SAD_FLAG_IS_TUNNEL; - if (sa->is_tunnel_ip6) - flags |= IPSEC_API_SAD_FLAG_IS_TUNNEL_V6; - if (sa->udp_encap) - flags |= IPSEC_API_SAD_FLAG_UDP_ENCAP; - - return clib_host_to_net_u32 (flags); +out: + /* *INDENT-OFF* */ + REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_REPLY, + { + rmp->stat_index = htonl (sa_index); + }); + /* *INDENT-ON* */ } -static void vl_api_ipsec_sad_entry_add_del_t_handler - (vl_api_ipsec_sad_entry_add_del_t * mp) +static void vl_api_ipsec_sad_entry_add_del_v2_t_handler + (vl_api_ipsec_sad_entry_add_del_v2_t * mp) { vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main (); - vl_api_ipsec_sad_entry_add_del_reply_t *rmp; - ip46_address_t tun_src = { }, tun_dst = - { - }; + vl_api_ipsec_sad_entry_add_del_v2_reply_t *rmp; ipsec_key_t crypto_key, integ_key; ipsec_crypto_alg_t crypto_alg; ipsec_integ_alg_t integ_alg; ipsec_protocol_t proto; ipsec_sa_flags_t flags; - u32 id, spi, sa_index; + u32 id, spi, sa_index = ~0; int rv; + tunnel_t tun = { + .t_flags = TUNNEL_FLAG_NONE, + .t_encap_decap_flags = TUNNEL_ENCAP_DECAP_FLAG_NONE, + .t_dscp = 0, + .t_mode = TUNNEL_MODE_P2P, + .t_table_id = htonl (mp->entry.tx_table_id), + .t_hop_limit = 255, + }; #if WITH_LIBSSL > 0 @@ -374,6 +441,12 @@ static void vl_api_ipsec_sad_entry_add_del_t_handler rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg); + if (rv) + goto out; + + rv = tunnel_encap_decap_flags_decode (mp->entry.tunnel_flags, + &tun.t_encap_decap_flags); + if (rv) goto out; @@ -381,18 +454,18 @@ static void vl_api_ipsec_sad_entry_add_del_t_handler ipsec_key_decode (&mp->entry.integrity_key, &integ_key); flags = ipsec_sa_flags_decode (mp->entry.flags); + tun.t_dscp = ip_dscp_decode (mp->entry.dscp); - ip_address_decode (&mp->entry.tunnel_src, &tun_src); - ip_address_decode (&mp->entry.tunnel_dst, &tun_dst); - + ip_address_decode2 (&mp->entry.tunnel_src, &tun.t_src); + ip_address_decode2 (&mp->entry.tunnel_dst, &tun.t_dst); if (mp->is_add) - rv = ipsec_sa_add (id, spi, proto, - crypto_alg, &crypto_key, - integ_alg, &integ_key, flags, - 0, &tun_src, &tun_dst, &sa_index); + rv = ipsec_sa_add_and_lock ( + id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags, + mp->entry.salt, htons (mp->entry.udp_src_port), + htons (mp->entry.udp_dst_port), &tun, &sa_index); else - rv = ipsec_sa_del (id); + rv = ipsec_sa_unlock_id (id); #else rv = VNET_API_ERROR_UNIMPLEMENTED; @@ -400,13 +473,77 @@ static void vl_api_ipsec_sad_entry_add_del_t_handler out: /* *INDENT-OFF* */ - REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_REPLY, + REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_V2_REPLY, { rmp->stat_index = htonl (sa_index); }); /* *INDENT-ON* */ } +static void +vl_api_ipsec_sad_entry_add_del_v3_t_handler ( + vl_api_ipsec_sad_entry_add_del_v3_t *mp) +{ + vl_api_ipsec_sad_entry_add_del_v3_reply_t *rmp; + ipsec_key_t crypto_key, integ_key; + ipsec_crypto_alg_t crypto_alg; + ipsec_integ_alg_t integ_alg; + ipsec_protocol_t proto; + ipsec_sa_flags_t flags; + u32 id, spi, sa_index = ~0; + tunnel_t tun; + int rv; + +#if WITH_LIBSSL > 0 + + id = ntohl (mp->entry.sad_id); + spi = ntohl (mp->entry.spi); + + rv = ipsec_proto_decode (mp->entry.protocol, &proto); + + if (rv) + goto out; + + rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg); + + if (rv) + goto out; + + rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg); + + if (rv) + goto out; + + flags = ipsec_sa_flags_decode (mp->entry.flags); + + if (flags & IPSEC_SA_FLAG_IS_TUNNEL) + { + rv = tunnel_decode (&mp->entry.tunnel, &tun); + + if (rv) + goto out; + } + + ipsec_key_decode (&mp->entry.crypto_key, &crypto_key); + ipsec_key_decode (&mp->entry.integrity_key, &integ_key); + + if (mp->is_add) + rv = ipsec_sa_add_and_lock ( + id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags, + mp->entry.salt, htons (mp->entry.udp_src_port), + htons (mp->entry.udp_dst_port), &tun, &sa_index); + else + rv = ipsec_sa_unlock_id (id); + +#else + rv = VNET_API_ERROR_UNIMPLEMENTED; +#endif + +out: + REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_V3_REPLY, + { rmp->stat_index = htonl (sa_index); }); +} + static void send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg, u32 context) @@ -440,9 +577,9 @@ vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp) return; /* *INDENT-OFF* */ - pool_foreach (spd, im->spds, ({ + pool_foreach (spd, im->spds) { send_ipsec_spds_details (spd, reg, mp->context); - })); + } /* *INDENT-ON* */ #else clib_warning ("unimplemented"); @@ -478,7 +615,8 @@ send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg, mp->entry.spd_id = htonl (p->id); mp->entry.priority = htonl (p->priority); - mp->entry.is_outbound = p->is_outbound; + mp->entry.is_outbound = ((p->type == IPSEC_SPD_POLICY_IP6_OUTBOUND) || + (p->type == IPSEC_SPD_POLICY_IP4_OUTBOUND)); ip_address_encode (&p->laddr.start, IP46_TYPE_ANY, &mp->entry.local_address_start); @@ -504,7 +642,7 @@ vl_api_ipsec_spd_dump_t_handler (vl_api_ipsec_spd_dump_t * mp) { vl_api_registration_t *reg; ipsec_main_t *im = &ipsec_main; - ipsec_spd_policy_t ptype; + ipsec_spd_policy_type_t ptype; ipsec_policy_t *policy; ipsec_spd_t *spd; uword *p; @@ -592,99 +730,91 @@ vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t * } static void -vl_api_ipsec_sa_set_key_t_handler (vl_api_ipsec_sa_set_key_t * mp) +vl_api_ipsec_itf_create_t_handler (vl_api_ipsec_itf_create_t * mp) { - vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main (); - vl_api_ipsec_sa_set_key_reply_t *rmp; - ipsec_key_t ck, ik; - u32 id; + vl_api_ipsec_itf_create_reply_t *rmp; + tunnel_mode_t mode; + u32 sw_if_index = ~0; int rv; -#if WITH_LIBSSL > 0 - - id = ntohl (mp->sa_id); - ipsec_key_decode (&mp->crypto_key, &ck); - ipsec_key_decode (&mp->integrity_key, &ik); + rv = tunnel_mode_decode (mp->itf.mode, &mode); - rv = ipsec_set_sa_key (id, &ck, &ik); -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + if (!rv) + rv = ipsec_itf_create (ntohl (mp->itf.user_instance), mode, &sw_if_index); - REPLY_MACRO (VL_API_IPSEC_SA_SET_KEY_REPLY); + /* *INDENT-OFF* */ + REPLY_MACRO2 (VL_API_IPSEC_ITF_CREATE_REPLY, + ({ + rmp->sw_if_index = htonl (sw_if_index); + })); + /* *INDENT-ON* */ } static void -vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * - mp) +vl_api_ipsec_itf_delete_t_handler (vl_api_ipsec_itf_delete_t * mp) { - vl_api_ipsec_tunnel_if_add_del_reply_t *rmp; - ipsec_main_t *im = &ipsec_main; - vnet_main_t *vnm = im->vnet_main; - u32 sw_if_index = ~0; + vl_api_ipsec_itf_delete_reply_t *rmp; int rv; -#if WITH_LIBSSL > 0 - ipsec_add_del_tunnel_args_t tun; - - clib_memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t)); - - tun.is_add = mp->is_add; - tun.esn = mp->esn; - tun.anti_replay = mp->anti_replay; - tun.local_spi = ntohl (mp->local_spi); - tun.remote_spi = ntohl (mp->remote_spi); - tun.crypto_alg = mp->crypto_alg; - tun.local_crypto_key_len = mp->local_crypto_key_len; - tun.remote_crypto_key_len = mp->remote_crypto_key_len; - tun.integ_alg = mp->integ_alg; - tun.local_integ_key_len = mp->local_integ_key_len; - tun.remote_integ_key_len = mp->remote_integ_key_len; - tun.udp_encap = mp->udp_encap; - tun.tx_table_id = ntohl (mp->tx_table_id); - memcpy (&tun.local_ip.ip4, mp->local_ip, 4); - memcpy (&tun.remote_ip.ip4, mp->remote_ip, 4); - memcpy (&tun.local_crypto_key, &mp->local_crypto_key, - mp->local_crypto_key_len); - memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key, - mp->remote_crypto_key_len); - memcpy (&tun.local_integ_key, &mp->local_integ_key, - mp->local_integ_key_len); - memcpy (&tun.remote_integ_key, &mp->remote_integ_key, - mp->remote_integ_key_len); - tun.renumber = mp->renumber; - tun.show_instance = ntohl (mp->show_instance); - - rv = ipsec_add_del_tunnel_if_internal (vnm, &tun, &sw_if_index); + rv = ipsec_itf_delete (ntohl (mp->sw_if_index)); -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + REPLY_MACRO (VL_API_IPSEC_ITF_DELETE_REPLY); +} + +static void +vl_api_ipsec_itf_dump_t_handler (vl_api_ipsec_itf_dump_t * mp) +{ +} +typedef struct ipsec_sa_dump_match_ctx_t_ +{ + index_t sai; + u32 sw_if_index; +} ipsec_sa_dump_match_ctx_t; + +static walk_rc_t +ipsec_sa_dump_match_sa (index_t itpi, void *arg) +{ + ipsec_sa_dump_match_ctx_t *ctx = arg; + ipsec_tun_protect_t *itp; + index_t sai; + + itp = ipsec_tun_protect_get (itpi); + + if (itp->itp_out_sa == ctx->sai) + { + ctx->sw_if_index = itp->itp_sw_if_index; + return (WALK_STOP); + } /* *INDENT-OFF* */ - REPLY_MACRO2 (VL_API_IPSEC_TUNNEL_IF_ADD_DEL_REPLY, + FOR_EACH_IPSEC_PROTECT_INPUT_SAI (itp, sai, ({ - rmp->sw_if_index = htonl (sw_if_index); + if (sai == ctx->sai) + { + ctx->sw_if_index = itp->itp_sw_if_index; + return (WALK_STOP); + } })); - /* *INDENT-ON* */ + /* *INDENT-OFF* */ + + return (WALK_CONTINUE); } -static void -send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg, - u32 context, u32 sw_if_index) +static walk_rc_t +send_ipsec_sa_details (ipsec_sa_t * sa, void *arg) { + ipsec_dump_walk_ctx_t *ctx = arg; vl_api_ipsec_sa_details_t *mp; mp = vl_msg_api_alloc (sizeof (*mp)); clib_memset (mp, 0, sizeof (*mp)); mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS); - mp->context = context; + mp->context = ctx->context; mp->entry.sad_id = htonl (sa->id); mp->entry.spi = htonl (sa->spi); mp->entry.protocol = ipsec_proto_encode (sa->protocol); - mp->entry.tx_table_id = - htonl (fib_table_get_table_id (sa->tx_fib_index, FIB_PROTOCOL_IP4)); + mp->entry.tx_table_id = htonl (sa->tunnel.t_table_id); mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg); ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key); @@ -693,473 +823,246 @@ send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg, ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key); mp->entry.flags = ipsec_sad_flags_encode (sa); + mp->entry.salt = clib_host_to_net_u32 (sa->salt); - if (sa->is_tunnel) + if (ipsec_sa_is_set_IS_PROTECT (sa)) { - ip_address_encode (&sa->tunnel_src_addr, IP46_TYPE_ANY, - &mp->entry.tunnel_src); - ip_address_encode (&sa->tunnel_dst_addr, IP46_TYPE_ANY, - &mp->entry.tunnel_dst); + ipsec_sa_dump_match_ctx_t ctx = { + .sai = sa - ipsec_sa_pool, + .sw_if_index = ~0, + }; + ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx); + + mp->sw_if_index = htonl (ctx.sw_if_index); + } + else + mp->sw_if_index = ~0; + + if (ipsec_sa_is_set_IS_TUNNEL (sa)) + { + ip_address_encode2 (&sa->tunnel.t_src, &mp->entry.tunnel_src); + ip_address_encode2 (&sa->tunnel.t_dst, &mp->entry.tunnel_dst); + } + if (ipsec_sa_is_set_UDP_ENCAP (sa)) + { + mp->entry.udp_src_port = sa->udp_hdr.src_port; + mp->entry.udp_dst_port = sa->udp_hdr.dst_port; } - mp->sw_if_index = htonl (sw_if_index); - mp->salt = clib_host_to_net_u32 (sa->salt); mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq)); mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq)); - if (sa->use_esn) + if (ipsec_sa_is_set_USE_ESN (sa)) { mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi)); mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi)); } - if (sa->use_anti_replay) + if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa)) mp->replay_window = clib_host_to_net_u64 (sa->replay_window); - vl_api_send_msg (reg, (u8 *) mp); -} + mp->stat_index = clib_host_to_net_u32 (sa->stat_index); + vl_api_send_msg (ctx->reg, (u8 *) mp); + + return (WALK_CONTINUE); +} static void vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp) { vl_api_registration_t *reg; - ipsec_main_t *im = &ipsec_main; - vnet_main_t *vnm = im->vnet_main; - ipsec_sa_t *sa; - ipsec_tunnel_if_t *t; - u32 *sa_index_to_tun_if_index = 0; #if WITH_LIBSSL > 0 reg = vl_api_client_index_to_registration (mp->client_index); - if (!reg || pool_elts (im->sad) == 0) + if (!reg) return; - vec_validate_init_empty (sa_index_to_tun_if_index, vec_len (im->sad) - 1, - ~0); - - /* *INDENT-OFF* */ - pool_foreach (t, im->tunnel_interfaces, - ({ - vnet_hw_interface_t *hi; - u32 sw_if_index = ~0; - - hi = vnet_get_hw_interface (vnm, t->hw_if_index); - sw_if_index = hi->sw_if_index; - sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index; - sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index; - })); - - pool_foreach (sa, im->sad, - ({ - if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id) - send_ipsec_sa_details (sa, reg, mp->context, - sa_index_to_tun_if_index[sa - im->sad]); - })); - /* *INDENT-ON* */ - - vec_free (sa_index_to_tun_if_index); -#else - clib_warning ("unimplemented"); -#endif -} - - -static void -vl_api_ipsec_tunnel_if_set_key_t_handler (vl_api_ipsec_tunnel_if_set_key_t * - mp) -{ - vl_api_ipsec_tunnel_if_set_key_reply_t *rmp; - ipsec_main_t *im = &ipsec_main; - vnet_main_t *vnm = im->vnet_main; - vnet_sw_interface_t *sw; - u8 *key = 0; - int rv; - -#if WITH_LIBSSL > 0 - sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index)); - - switch (mp->key_type) - { - case IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO: - case IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO: - if (mp->alg < IPSEC_CRYPTO_ALG_AES_CBC_128 || - mp->alg >= IPSEC_CRYPTO_N_ALG) - { - rv = VNET_API_ERROR_UNIMPLEMENTED; - goto out; - } - break; - case IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG: - case IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG: - if (mp->alg >= IPSEC_INTEG_N_ALG) - { - rv = VNET_API_ERROR_UNIMPLEMENTED; - goto out; - } - break; - case IPSEC_IF_SET_KEY_TYPE_NONE: - default: - rv = VNET_API_ERROR_UNIMPLEMENTED; - goto out; - break; - } - - key = vec_new (u8, mp->key_len); - clib_memcpy (key, mp->key, mp->key_len); - - rv = ipsec_set_interface_key (vnm, sw->hw_if_index, mp->key_type, mp->alg, - key); - vec_free (key); -#else - clib_warning ("unimplemented"); -#endif - -out: - REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_KEY_REPLY); -} - - -static void -vl_api_ipsec_tunnel_if_set_sa_t_handler (vl_api_ipsec_tunnel_if_set_sa_t * mp) -{ - vl_api_ipsec_tunnel_if_set_sa_reply_t *rmp; - ipsec_main_t *im = &ipsec_main; - vnet_main_t *vnm = im->vnet_main; - vnet_sw_interface_t *sw; - int rv; + ipsec_dump_walk_ctx_t ctx = { + .reg = reg, + .context = mp->context, + }; -#if WITH_LIBSSL > 0 - sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index)); + ipsec_sa_walk (send_ipsec_sa_details, &ctx); - rv = ipsec_set_interface_sa (vnm, sw->hw_if_index, ntohl (mp->sa_id), - mp->is_outbound); #else clib_warning ("unimplemented"); #endif - - REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_SA_REPLY); -} - - -static void -vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp) -{ - vl_api_ikev2_profile_add_del_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - u8 *tmp = format (0, "%s", mp->name); - error = ikev2_add_del_profile (vm, tmp, mp->is_add); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_PROFILE_ADD_DEL_REPLY); } -static void - vl_api_ikev2_profile_set_auth_t_handler - (vl_api_ikev2_profile_set_auth_t * mp) +static walk_rc_t +send_ipsec_sa_v2_details (ipsec_sa_t * sa, void *arg) { - vl_api_ikev2_profile_set_auth_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - int data_len = ntohl (mp->data_len); - u8 *tmp = format (0, "%s", mp->name); - u8 *data = vec_new (u8, data_len); - clib_memcpy (data, mp->data, data_len); - error = ikev2_set_profile_auth (vm, tmp, mp->auth_method, data, mp->is_hex); - vec_free (tmp); - vec_free (data); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + ipsec_dump_walk_ctx_t *ctx = arg; + vl_api_ipsec_sa_v2_details_t *mp; - REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_AUTH_REPLY); -} - -static void -vl_api_ikev2_profile_set_id_t_handler (vl_api_ikev2_profile_set_id_t * mp) -{ - vl_api_ikev2_profile_add_del_reply_t *rmp; - int rv = 0; - -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - u8 *tmp = format (0, "%s", mp->name); - int data_len = ntohl (mp->data_len); - u8 *data = vec_new (u8, data_len); - clib_memcpy (data, mp->data, data_len); - error = ikev2_set_profile_id (vm, tmp, mp->id_type, data, mp->is_local); - vec_free (tmp); - vec_free (data); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + mp = vl_msg_api_alloc (sizeof (*mp)); + clib_memset (mp, 0, sizeof (*mp)); + mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_V2_DETAILS); + mp->context = ctx->context; - REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_ID_REPLY); -} + mp->entry.sad_id = htonl (sa->id); + mp->entry.spi = htonl (sa->spi); + mp->entry.protocol = ipsec_proto_encode (sa->protocol); + mp->entry.tx_table_id = htonl (sa->tunnel.t_table_id); -static void -vl_api_ikev2_profile_set_ts_t_handler (vl_api_ikev2_profile_set_ts_t * mp) -{ - vl_api_ikev2_profile_set_ts_reply_t *rmp; - int rv = 0; + mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg); + ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key); -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - u8 *tmp = format (0, "%s", mp->name); - error = ikev2_set_profile_ts (vm, tmp, mp->proto, mp->start_port, - mp->end_port, (ip4_address_t) mp->start_addr, - (ip4_address_t) mp->end_addr, mp->is_local); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg); + ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key); - REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_TS_REPLY); -} + mp->entry.flags = ipsec_sad_flags_encode (sa); + mp->entry.salt = clib_host_to_net_u32 (sa->salt); -static void -vl_api_ikev2_set_local_key_t_handler (vl_api_ikev2_set_local_key_t * mp) -{ - vl_api_ikev2_profile_set_ts_reply_t *rmp; - int rv = 0; + if (ipsec_sa_is_set_IS_PROTECT (sa)) + { + ipsec_sa_dump_match_ctx_t ctx = { + .sai = sa - ipsec_sa_pool, + .sw_if_index = ~0, + }; + ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx); -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; + mp->sw_if_index = htonl (ctx.sw_if_index); + } + else + mp->sw_if_index = ~0; - error = ikev2_set_local_key (vm, mp->key_file); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + if (ipsec_sa_is_set_IS_TUNNEL (sa)) + { + ip_address_encode2 (&sa->tunnel.t_src, &mp->entry.tunnel_src); + ip_address_encode2 (&sa->tunnel.t_dst, &mp->entry.tunnel_dst); + } + if (ipsec_sa_is_set_UDP_ENCAP (sa)) + { + mp->entry.udp_src_port = sa->udp_hdr.src_port; + mp->entry.udp_dst_port = sa->udp_hdr.dst_port; + } - REPLY_MACRO (VL_API_IKEV2_SET_LOCAL_KEY_REPLY); -} + mp->entry.tunnel_flags = + tunnel_encap_decap_flags_encode (sa->tunnel.t_encap_decap_flags); + mp->entry.dscp = ip_dscp_encode (sa->tunnel.t_dscp); -static void -vl_api_ikev2_set_responder_t_handler (vl_api_ikev2_set_responder_t * mp) -{ - vl_api_ikev2_set_responder_reply_t *rmp; - int rv = 0; + mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq)); + mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq)); + if (ipsec_sa_is_set_USE_ESN (sa)) + { + mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi)); + mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi)); + } + if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa)) + mp->replay_window = clib_host_to_net_u64 (sa->replay_window); -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; + mp->stat_index = clib_host_to_net_u32 (sa->stat_index); - u8 *tmp = format (0, "%s", mp->name); - ip4_address_t ip4; - clib_memcpy (&ip4, mp->address, sizeof (ip4)); + vl_api_send_msg (ctx->reg, (u8 *) mp); - error = ikev2_set_profile_responder (vm, tmp, mp->sw_if_index, ip4); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_SET_RESPONDER_REPLY); + return (WALK_CONTINUE); } static void -vl_api_ikev2_set_ike_transforms_t_handler (vl_api_ikev2_set_ike_transforms_t * - mp) +vl_api_ipsec_sa_v2_dump_t_handler (vl_api_ipsec_sa_v2_dump_t *mp) { - vl_api_ikev2_set_ike_transforms_reply_t *rmp; - int rv = 0; + vl_api_registration_t *reg; #if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - u8 *tmp = format (0, "%s", mp->name); - - error = - ikev2_set_profile_ike_transforms (vm, tmp, mp->crypto_alg, mp->integ_alg, - mp->dh_group, mp->crypto_key_size); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_SET_IKE_TRANSFORMS_REPLY); -} - -static void -vl_api_ikev2_set_esp_transforms_t_handler (vl_api_ikev2_set_esp_transforms_t * - mp) -{ - vl_api_ikev2_set_esp_transforms_reply_t *rmp; - int rv = 0; + reg = vl_api_client_index_to_registration (mp->client_index); + if (!reg) + return; -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; + ipsec_dump_walk_ctx_t ctx = { + .reg = reg, + .context = mp->context, + }; - u8 *tmp = format (0, "%s", mp->name); + ipsec_sa_walk (send_ipsec_sa_v2_details, &ctx); - error = - ikev2_set_profile_esp_transforms (vm, tmp, mp->crypto_alg, mp->integ_alg, - mp->dh_group, mp->crypto_key_size); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; #else - rv = VNET_API_ERROR_UNIMPLEMENTED; + clib_warning ("unimplemented"); #endif - - REPLY_MACRO (VL_API_IKEV2_SET_ESP_TRANSFORMS_REPLY); } -static void -vl_api_ikev2_set_sa_lifetime_t_handler (vl_api_ikev2_set_sa_lifetime_t * mp) +static walk_rc_t +send_ipsec_sa_v3_details (ipsec_sa_t *sa, void *arg) { - vl_api_ikev2_set_sa_lifetime_reply_t *rmp; - int rv = 0; + ipsec_dump_walk_ctx_t *ctx = arg; + vl_api_ipsec_sa_v3_details_t *mp; -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; + mp = vl_msg_api_alloc (sizeof (*mp)); + clib_memset (mp, 0, sizeof (*mp)); + mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_V3_DETAILS); + mp->context = ctx->context; - u8 *tmp = format (0, "%s", mp->name); + mp->entry.sad_id = htonl (sa->id); + mp->entry.spi = htonl (sa->spi); + mp->entry.protocol = ipsec_proto_encode (sa->protocol); - error = - ikev2_set_profile_sa_lifetime (vm, tmp, mp->lifetime, mp->lifetime_jitter, - mp->handover, mp->lifetime_maxdata); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg); + ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key); - REPLY_MACRO (VL_API_IKEV2_SET_SA_LIFETIME_REPLY); -} + mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg); + ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key); -static void -vl_api_ikev2_initiate_sa_init_t_handler (vl_api_ikev2_initiate_sa_init_t * mp) -{ - vl_api_ikev2_initiate_sa_init_reply_t *rmp; - int rv = 0; + mp->entry.flags = ipsec_sad_flags_encode (sa); + mp->entry.salt = clib_host_to_net_u32 (sa->salt); -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; + if (ipsec_sa_is_set_IS_PROTECT (sa)) + { + ipsec_sa_dump_match_ctx_t ctx = { + .sai = sa - ipsec_sa_pool, + .sw_if_index = ~0, + }; + ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx); - u8 *tmp = format (0, "%s", mp->name); + mp->sw_if_index = htonl (ctx.sw_if_index); + } + else + mp->sw_if_index = ~0; - error = ikev2_initiate_sa_init (vm, tmp); - vec_free (tmp); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + if (ipsec_sa_is_set_IS_TUNNEL (sa)) + tunnel_encode (&sa->tunnel, &mp->entry.tunnel); - REPLY_MACRO (VL_API_IKEV2_INITIATE_SA_INIT_REPLY); -} + if (ipsec_sa_is_set_UDP_ENCAP (sa)) + { + mp->entry.udp_src_port = sa->udp_hdr.src_port; + mp->entry.udp_dst_port = sa->udp_hdr.dst_port; + } -static void -vl_api_ikev2_initiate_del_ike_sa_t_handler (vl_api_ikev2_initiate_del_ike_sa_t - * mp) -{ - vl_api_ikev2_initiate_del_ike_sa_reply_t *rmp; - int rv = 0; + mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq)); + mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq)); + if (ipsec_sa_is_set_USE_ESN (sa)) + { + mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi)); + mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi)); + } + if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa)) + mp->replay_window = clib_host_to_net_u64 (sa->replay_window); -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; + mp->stat_index = clib_host_to_net_u32 (sa->stat_index); - error = ikev2_initiate_delete_ike_sa (vm, mp->ispi); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif + vl_api_send_msg (ctx->reg, (u8 *) mp); - REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_IKE_SA_REPLY); + return (WALK_CONTINUE); } static void - vl_api_ikev2_initiate_del_child_sa_t_handler - (vl_api_ikev2_initiate_del_child_sa_t * mp) +vl_api_ipsec_sa_v3_dump_t_handler (vl_api_ipsec_sa_v3_dump_t *mp) { - vl_api_ikev2_initiate_del_child_sa_reply_t *rmp; - int rv = 0; + vl_api_registration_t *reg; #if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; - - error = ikev2_initiate_delete_child_sa (vm, mp->ispi); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_CHILD_SA_REPLY); -} + reg = vl_api_client_index_to_registration (mp->client_index); + if (!reg) + return; -static void - vl_api_ikev2_initiate_rekey_child_sa_t_handler - (vl_api_ikev2_initiate_rekey_child_sa_t * mp) -{ - vl_api_ikev2_initiate_rekey_child_sa_reply_t *rmp; - int rv = 0; + ipsec_dump_walk_ctx_t ctx = { + .reg = reg, + .context = mp->context, + }; -#if WITH_LIBSSL > 0 - vlib_main_t *vm = vlib_get_main (); - clib_error_t *error; + ipsec_sa_walk (send_ipsec_sa_v3_details, &ctx); - error = ikev2_initiate_rekey_child_sa (vm, mp->ispi); - if (error) - rv = VNET_API_ERROR_UNSPECIFIED; #else - rv = VNET_API_ERROR_UNIMPLEMENTED; + clib_warning ("unimplemented"); #endif - - REPLY_MACRO (VL_API_IKEV2_INITIATE_REKEY_CHILD_SA_REPLY); -} - -/* - * ipsec_api_hookup - * Add vpe's API message handlers to the table. - * vlib has already mapped shared memory and - * added the client registration handlers. - * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process() - */ -#define vl_msg_name_crc_list -#include -#undef vl_msg_name_crc_list - -static void -setup_message_id_table (api_main_t * am) -{ -#define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id); - foreach_vl_msg_name_crc_ipsec; -#undef _ } static void @@ -1180,7 +1083,7 @@ vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp) ipsec_ah_backend_t *ab; ipsec_esp_backend_t *eb; /* *INDENT-OFF* */ - pool_foreach (ab, im->ah_backends, { + pool_foreach (ab, im->ah_backends) { vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp)); clib_memset (mp, 0, sizeof (*mp)); mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS); @@ -1191,8 +1094,8 @@ vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp) mp->index = ab - im->ah_backends; mp->active = mp->index == im->ah_current_backend ? 1 : 0; vl_api_send_msg (rp, (u8 *)mp); - }); - pool_foreach (eb, im->esp_backends, { + } + pool_foreach (eb, im->esp_backends) { vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp)); clib_memset (mp, 0, sizeof (*mp)); mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS); @@ -1203,7 +1106,7 @@ vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp) mp->index = eb - im->esp_backends; mp->active = mp->index == im->esp_current_backend ? 1 : 0; vl_api_send_msg (rp, (u8 *)mp); - }); + } /* *INDENT-ON* */ } @@ -1214,7 +1117,7 @@ vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp) vl_api_ipsec_select_backend_reply_t *rmp; ipsec_protocol_t protocol; int rv = 0; - if (pool_elts (im->sad) > 0) + if (pool_elts (ipsec_sa_pool) > 0) { rv = VNET_API_ERROR_INSTANCE_IN_USE; goto done; @@ -1229,23 +1132,13 @@ vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp) switch (protocol) { case IPSEC_PROTOCOL_ESP: - if (pool_is_free_index (im->esp_backends, mp->index)) - { - rv = VNET_API_ERROR_INVALID_VALUE; - break; - } - ipsec_select_esp_backend (im, mp->index); + rv = ipsec_select_esp_backend (im, mp->index); break; case IPSEC_PROTOCOL_AH: - if (pool_is_free_index (im->ah_backends, mp->index)) - { - rv = VNET_API_ERROR_INVALID_VALUE; - break; - } - ipsec_select_ah_backend (im, mp->index); + rv = ipsec_select_ah_backend (im, mp->index); break; default: - rv = VNET_API_ERROR_INVALID_VALUE; + rv = VNET_API_ERROR_INVALID_PROTOCOL; break; } #else @@ -1255,10 +1148,40 @@ done: REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY); } +static void +vl_api_ipsec_set_async_mode_t_handler (vl_api_ipsec_set_async_mode_t * mp) +{ + vl_api_ipsec_set_async_mode_reply_t *rmp; + int rv = 0; + + ipsec_set_async_mode (mp->async_enable); + + REPLY_MACRO (VL_API_IPSEC_SET_ASYNC_MODE_REPLY); +} + +/* + * ipsec_api_hookup + * Add vpe's API message handlers to the table. + * vlib has already mapped shared memory and + * added the client registration handlers. + * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process() + */ +#define vl_msg_name_crc_list +#include +#undef vl_msg_name_crc_list + +static void +setup_message_id_table (api_main_t * am) +{ +#define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id); + foreach_vl_msg_name_crc_ipsec; +#undef _ +} + static clib_error_t * ipsec_api_hookup (vlib_main_t * vm) { - api_main_t *am = &api_main; + api_main_t *am = vlibapi_get_main (); #define _(N,n) \ vl_msg_api_set_handlers(VL_API_##N, #n, \