X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_sa.c;h=8e8546985ecca7c70f7444fbb8a201c70507ca9d;hb=e6be702362299566990678f505512b1b74b49112;hp=eb21ecf81a4d12e3a7000d07b7aaebfa4c98da45;hpb=1e3aa5e213c23588981ee17d1413a0441a40527a;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c
index eb21ecf81a4..8e8546985ec 100644
--- a/src/vnet/ipsec/ipsec_sa.c
+++ b/src/vnet/ipsec/ipsec_sa.c
@@ -66,7 +66,7 @@ ipsec_mk_key (ipsec_key_t * key, const u8 * data, u8 len)
 /**
  * 'stack' (resolve the recursion for) the SA tunnel destination
  */
-void
+static void
 ipsec_sa_stack (ipsec_sa_t * sa)
 {
   ipsec_main_t *im = &ipsec_main;
@@ -98,9 +98,16 @@ ipsec_sa_set_crypto_alg (ipsec_sa_t * sa, ipsec_crypto_alg_t crypto_alg)
   sa->crypto_alg = crypto_alg;
   sa->crypto_iv_size = im->crypto_algs[crypto_alg].iv_size;
   sa->crypto_block_size = im->crypto_algs[crypto_alg].block_size;
-  sa->crypto_enc_op_type = im->crypto_algs[crypto_alg].enc_op_type;
-  sa->crypto_dec_op_type = im->crypto_algs[crypto_alg].dec_op_type;
+  sa->crypto_enc_op_id = im->crypto_algs[crypto_alg].enc_op_id;
+  sa->crypto_dec_op_id = im->crypto_algs[crypto_alg].dec_op_id;
+  sa->crypto_calg = im->crypto_algs[crypto_alg].alg;
+  ASSERT (sa->crypto_iv_size <= ESP_MAX_IV_SIZE);
   ASSERT (sa->crypto_block_size <= ESP_MAX_BLOCK_SIZE);
+  if (IPSEC_CRYPTO_ALG_IS_GCM (crypto_alg))
+    {
+      sa->integ_icv_size = im->crypto_algs[crypto_alg].icv_size;
+      ipsec_sa_set_IS_AEAD (sa);
+    }
 }
 
 void
@@ -108,9 +115,10 @@ ipsec_sa_set_integ_alg (ipsec_sa_t * sa, ipsec_integ_alg_t integ_alg)
 {
   ipsec_main_t *im = &ipsec_main;
   sa->integ_alg = integ_alg;
-  sa->integ_trunc_size = im->integ_algs[integ_alg].trunc_size;
-  sa->integ_op_type = im->integ_algs[integ_alg].op_type;
-  ASSERT (sa->integ_trunc_size <= ESP_MAX_ICV_SIZE);
+  sa->integ_icv_size = im->integ_algs[integ_alg].icv_size;
+  sa->integ_op_id = im->integ_algs[integ_alg].op_id;
+  sa->integ_calg = im->integ_algs[integ_alg].alg;
+  ASSERT (sa->integ_icv_size <= ESP_MAX_ICV_SIZE);
 }
 
 int
@@ -123,9 +131,11 @@ ipsec_sa_add (u32 id,
 	      const ipsec_key_t * ik,
 	      ipsec_sa_flags_t flags,
 	      u32 tx_table_id,
+	      u32 salt,
 	      const ip46_address_t * tun_src,
 	      const ip46_address_t * tun_dst, u32 * sa_out_index)
 {
+  vlib_main_t *vm = vlib_get_main ();
   ipsec_main_t *im = &ipsec_main;
   clib_error_t *err;
   ipsec_sa_t *sa;
@@ -148,23 +158,32 @@ ipsec_sa_add (u32 id,
   sa->spi = spi;
   sa->stat_index = sa_index;
   sa->protocol = proto;
-  ipsec_sa_set_crypto_alg (sa, crypto_alg);
-  clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key));
+  sa->flags = flags;
+  sa->salt = salt;
   ipsec_sa_set_integ_alg (sa, integ_alg);
   clib_memcpy (&sa->integ_key, ik, sizeof (sa->integ_key));
+  ipsec_sa_set_crypto_alg (sa, crypto_alg);
+  clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key));
   ip46_address_copy (&sa->tunnel_src_addr, tun_src);
   ip46_address_copy (&sa->tunnel_dst_addr, tun_dst);
 
-  if (flags & IPSEC_SA_FLAG_USE_ESN)
-    ipsec_sa_set_USE_ESN (sa);
-  if (flags & IPSEC_SA_FLAG_USE_ANTI_REPLAY)
-    ipsec_sa_set_USE_ANTI_REPLAY (sa);
-  if (flags & IPSEC_SA_FLAG_IS_TUNNEL)
-    ipsec_sa_set_IS_TUNNEL (sa);
-  if (flags & IPSEC_SA_FLAG_IS_TUNNEL_V6)
-    ipsec_sa_set_IS_TUNNEL_V6 (sa);
-  if (flags & IPSEC_SA_FLAG_UDP_ENCAP)
-    ipsec_sa_set_UDP_ENCAP (sa);
+  sa->crypto_key_index = vnet_crypto_key_add (vm,
+					      im->crypto_algs[crypto_alg].alg,
+					      (u8 *) ck->data, ck->len);
+  if (~0 == sa->crypto_key_index)
+    {
+      pool_put (im->sad, sa);
+      return VNET_API_ERROR_KEY_LENGTH;
+    }
+
+  sa->integ_key_index = vnet_crypto_key_add (vm,
+					     im->integ_algs[integ_alg].alg,
+					     (u8 *) ik->data, ik->len);
+  if (~0 == sa->integ_key_index)
+    {
+      pool_put (im->sad, sa);
+      return VNET_API_ERROR_KEY_LENGTH;
+    }
 
   err = ipsec_check_support_cb (im, sa);
   if (err)
@@ -181,7 +200,7 @@ ipsec_sa_add (u32 id,
       return VNET_API_ERROR_SYSCALL_ERROR_1;
     }
 
-  if (ipsec_sa_is_set_IS_TUNNEL (sa))
+  if (ipsec_sa_is_set_IS_TUNNEL (sa) && !ipsec_sa_is_set_IS_INBOUND (sa))
     {
       fib_protocol_t fproto = (ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ?
 			       FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4);
@@ -255,6 +274,7 @@ ipsec_sa_add (u32 id,
 u32
 ipsec_sa_del (u32 id)
 {
+  vlib_main_t *vm = vlib_get_main ();
   ipsec_main_t *im = &ipsec_main;
   ipsec_sa_t *sa = 0;
   uword *p;
@@ -277,9 +297,9 @@ ipsec_sa_del (u32 id)
   hash_unset (im->sa_index_by_sa_id, sa->id);
   err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
   if (err)
-    return VNET_API_ERROR_SYSCALL_ERROR_1;
+    return VNET_API_ERROR_SYSCALL_ERROR_2;
 
-  if (ipsec_sa_is_set_IS_TUNNEL (sa))
+  if (ipsec_sa_is_set_IS_TUNNEL (sa) && !ipsec_sa_is_set_IS_INBOUND (sa))
     {
       fib_entry_child_remove (sa->fib_entry_index, sa->sibling);
       fib_table_entry_special_remove
@@ -288,6 +308,8 @@ ipsec_sa_del (u32 id)
       dpo_reset (&sa->dpo[IPSEC_PROTOCOL_AH]);
       dpo_reset (&sa->dpo[IPSEC_PROTOCOL_ESP]);
     }
+  vnet_crypto_key_del (vm, sa->crypto_key_index);
+  vnet_crypto_key_del (vm, sa->integ_key_index);
   pool_put (im->sad, sa);
   return 0;
 }
@@ -322,6 +344,7 @@ ipsec_is_sa_used (u32 sa_index)
 int
 ipsec_set_sa_key (u32 id, const ipsec_key_t * ck, const ipsec_key_t * ik)
 {
+  vlib_main_t *vm = vlib_get_main ();
   ipsec_main_t *im = &ipsec_main;
   uword *p;
   u32 sa_index;
@@ -339,12 +362,16 @@ ipsec_set_sa_key (u32 id, const ipsec_key_t * ck, const ipsec_key_t * ik)
   if (ck)
     {
       clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key));
+      vnet_crypto_key_modify (vm, sa->crypto_key_index, sa->crypto_calg,
+			      (u8 *) ck->data, ck->len);
     }
 
   /* new integ key */
   if (ik)
     {
-      clib_memcpy (&sa->integ_key, 0, sizeof (sa->integ_key));
+      clib_memcpy (&sa->integ_key, ik, sizeof (sa->integ_key));
+      vnet_crypto_key_modify (vm, sa->integ_key_index, sa->integ_calg,
+			      (u8 *) ik->data, ik->len);
     }
 
   if (ck || ik)