src/vnet/ipsec/ipsec.c

   1 /*
   2  * decap.c : IPSec tunnel support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21 #include <vnet/interface.h>
  22 #include <vnet/udp/udp.h>
  23
  24 #include <vnet/ipsec/ipsec.h>
  25 #include <vnet/ipsec/ikev2.h>
  26 #include <vnet/ipsec/esp.h>
  27 #include <vnet/ipsec/ah.h>
  28
  29
  30 ipsec_main_t ipsec_main;
  31
  32 u32
  33 ipsec_get_sa_index_by_sa_id (u32 sa_id)
  34 {
  35   ipsec_main_t *im = &ipsec_main;
  36   uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
  37   if (!p)
  38     return ~0;
  39
  40   return p[0];
  41 }
  42
  43 int
  44 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
  45                          int is_add)
  46 {
  47   ipsec_main_t *im = &ipsec_main;
  48   ip4_ipsec_config_t config;
  49
  50   u32 spd_index;
  51   uword *p;
  52
  53   p = hash_get (im->spd_index_by_spd_id, spd_id);
  54   if (!p)
  55     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such spd-id */
  56
  57   spd_index = p[0];
  58
  59   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
  60   if (p && is_add)
  61     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* spd already assigned */
  62
  63   if (is_add)
  64     {
  65       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
  66     }
  67   else
  68     {
  69       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
  70     }
  71
  72   clib_warning ("sw_if_index %u spd_id %u spd_index %u",
  73                 sw_if_index, spd_id, spd_index);
  74
  75   /* enable IPsec on TX */
  76   vnet_feature_enable_disable ("ip4-output", "ipsec4-output-feature",
  77                                sw_if_index, is_add, 0, 0);
  78   vnet_feature_enable_disable ("ip6-output", "ipsec6-output-feature",
  79                                sw_if_index, is_add, 0, 0);
  80
  81   config.spd_index = spd_index;
  82
  83   /* enable IPsec on RX */
  84   vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input-feature",
  85                                sw_if_index, is_add, &config, sizeof (config));
  86   vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input-feature",
  87                                sw_if_index, is_add, &config, sizeof (config));
  88
  89   return 0;
  90 }
  91
  92 int
  93 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
  94 {
  95   ipsec_main_t *im = &ipsec_main;
  96   ipsec_spd_t *spd = 0;
  97   uword *p;
  98   u32 spd_index, k, v;
  99
 100   p = hash_get (im->spd_index_by_spd_id, spd_id);
 101   if (p && is_add)
 102     return VNET_API_ERROR_INVALID_VALUE;
 103   if (!p && !is_add)
 104     return VNET_API_ERROR_INVALID_VALUE;
 105
 106   if (!is_add)                  /* delete */
 107     {
 108       spd_index = p[0];
 109       spd = pool_elt_at_index (im->spds, spd_index);
 110       if (!spd)
 111         return VNET_API_ERROR_INVALID_VALUE;
 112       /* *INDENT-OFF* */
 113       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
 114         if (v == spd_index)
 115           ipsec_set_interface_spd(vm, k, spd_id, 0);
 116       }));
 117       /* *INDENT-ON* */
 118       hash_unset (im->spd_index_by_spd_id, spd_id);
 119       pool_free (spd->policies);
 120       vec_free (spd->ipv4_outbound_policies);
 121       vec_free (spd->ipv6_outbound_policies);
 122       vec_free (spd->ipv4_inbound_protect_policy_indices);
 123       vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
 124       pool_put (im->spds, spd);
 125     }
 126   else                          /* create new SPD */
 127     {
 128       pool_get (im->spds, spd);
 129       clib_memset (spd, 0, sizeof (*spd));
 130       spd_index = spd - im->spds;
 131       spd->id = spd_id;
 132       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 133     }
 134   return 0;
 135 }
 136
 137 static int
 138 ipsec_spd_entry_sort (void *a1, void *a2)
 139 {
 140   u32 *id1 = a1;
 141   u32 *id2 = a2;
 142   ipsec_spd_t *spd = ipsec_main.spd_to_sort;
 143   ipsec_policy_t *p1, *p2;
 144
 145   p1 = pool_elt_at_index (spd->policies, *id1);
 146   p2 = pool_elt_at_index (spd->policies, *id2);
 147   if (p1 && p2)
 148     return p2->priority - p1->priority;
 149
 150   return 0;
 151 }
 152
 153 int
 154 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
 155 {
 156   ipsec_main_t *im = &ipsec_main;
 157   ipsec_spd_t *spd = 0;
 158   ipsec_policy_t *vp;
 159   uword *p;
 160   u32 spd_index;
 161
 162   clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
 163                 policy->priority, policy->is_outbound);
 164
 165   if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 166     {
 167       p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
 168       if (!p)
 169         return VNET_API_ERROR_SYSCALL_ERROR_1;
 170       policy->sa_index = p[0];
 171     }
 172
 173   p = hash_get (im->spd_index_by_spd_id, policy->id);
 174
 175   if (!p)
 176     return VNET_API_ERROR_SYSCALL_ERROR_1;
 177
 178   spd_index = p[0];
 179   spd = pool_elt_at_index (im->spds, spd_index);
 180   if (!spd)
 181     return VNET_API_ERROR_SYSCALL_ERROR_1;
 182
 183   if (is_add)
 184     {
 185       u32 policy_index;
 186
 187       pool_get (spd->policies, vp);
 188       clib_memcpy (vp, policy, sizeof (*vp));
 189       policy_index = vp - spd->policies;
 190
 191       ipsec_main.spd_to_sort = spd;
 192
 193       if (policy->is_outbound)
 194         {
 195           if (policy->is_ipv6)
 196             {
 197               vec_add1 (spd->ipv6_outbound_policies, policy_index);
 198               vec_sort_with_function (spd->ipv6_outbound_policies,
 199                                       ipsec_spd_entry_sort);
 200             }
 201           else
 202             {
 203               vec_add1 (spd->ipv4_outbound_policies, policy_index);
 204               vec_sort_with_function (spd->ipv4_outbound_policies,
 205                                       ipsec_spd_entry_sort);
 206             }
 207         }
 208       else
 209         {
 210           if (policy->is_ipv6)
 211             {
 212               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 213                 {
 214                   vec_add1 (spd->ipv6_inbound_protect_policy_indices,
 215                             policy_index);
 216                   vec_sort_with_function
 217                     (spd->ipv6_inbound_protect_policy_indices,
 218                      ipsec_spd_entry_sort);
 219                 }
 220               else
 221                 {
 222                   vec_add1
 223                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 224                      policy_index);
 225                   vec_sort_with_function
 226                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 227                      ipsec_spd_entry_sort);
 228                 }
 229             }
 230           else
 231             {
 232               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 233                 {
 234                   vec_add1 (spd->ipv4_inbound_protect_policy_indices,
 235                             policy_index);
 236                   vec_sort_with_function
 237                     (spd->ipv4_inbound_protect_policy_indices,
 238                      ipsec_spd_entry_sort);
 239                 }
 240               else
 241                 {
 242                   vec_add1
 243                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 244                      policy_index);
 245                   vec_sort_with_function
 246                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 247                      ipsec_spd_entry_sort);
 248                 }
 249             }
 250         }
 251
 252       ipsec_main.spd_to_sort = NULL;
 253     }
 254   else
 255     {
 256       u32 i, j;
 257       /* *INDENT-OFF* */
 258       pool_foreach_index(i, spd->policies, ({
 259         vp = pool_elt_at_index(spd->policies, i);
 260         if (vp->priority != policy->priority)
 261           continue;
 262         if (vp->is_outbound != policy->is_outbound)
 263           continue;
 264         if (vp->policy != policy->policy)
 265           continue;
 266         if (vp->sa_id != policy->sa_id)
 267           continue;
 268         if (vp->protocol != policy->protocol)
 269           continue;
 270         if (vp->lport.start != policy->lport.start)
 271           continue;
 272         if (vp->lport.stop != policy->lport.stop)
 273           continue;
 274         if (vp->rport.start != policy->rport.start)
 275           continue;
 276         if (vp->rport.stop != policy->rport.stop)
 277           continue;
 278         if (vp->is_ipv6 != policy->is_ipv6)
 279           continue;
 280         if (policy->is_ipv6)
 281           {
 282             if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
 283               continue;
 284             if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
 285               continue;
 286             if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
 287               continue;
 288             if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 289               continue;
 290             if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
 291               continue;
 292             if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
 293               continue;
 294             if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
 295               continue;
 296            if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 297               continue;
 298            if (policy->is_outbound)
 299              {
 300                vec_foreach_index(j, spd->ipv6_outbound_policies) {
 301                  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
 302                    vec_del1 (spd->ipv6_outbound_policies, j);
 303                    break;
 304                  }
 305                }
 306              }
 307            else
 308              {
 309                if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 310                  {
 311                    vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
 312                      if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
 313                        vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
 314                        break;
 315                      }
 316                    }
 317                  }
 318                else
 319                  {
 320                    vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
 321                      if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
 322                        vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
 323                        break;
 324                      }
 325                    }
 326                  }
 327              }
 328           }
 329         else
 330           {
 331             if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
 332               continue;
 333             if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
 334               continue;
 335             if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
 336               continue;
 337             if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
 338               continue;
 339             if (policy->is_outbound)
 340               {
 341                 vec_foreach_index(j, spd->ipv4_outbound_policies) {
 342                   if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
 343                     vec_del1 (spd->ipv4_outbound_policies, j);
 344                     break;
 345                   }
 346                 }
 347               }
 348             else
 349               {
 350                 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 351                   {
 352                     vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
 353                       if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
 354                         vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
 355                         break;
 356                       }
 357                     }
 358                   }
 359                 else
 360                   {
 361                     vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
 362                       if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
 363                         vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
 364                         break;
 365                       }
 366                     }
 367                   }
 368               }
 369           }
 370           pool_put (spd->policies, vp);
 371           break;
 372       }));
 373       /* *INDENT-ON* */
 374     }
 375
 376   return 0;
 377 }
 378
 379 u8
 380 ipsec_is_sa_used (u32 sa_index)
 381 {
 382   ipsec_main_t *im = &ipsec_main;
 383   ipsec_spd_t *spd;
 384   ipsec_policy_t *p;
 385   ipsec_tunnel_if_t *t;
 386
 387   /* *INDENT-OFF* */
 388   pool_foreach(spd, im->spds, ({
 389     pool_foreach(p, spd->policies, ({
 390       if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
 391         {
 392           if (p->sa_index == sa_index)
 393             return 1;
 394         }
 395     }));
 396   }));
 397
 398   pool_foreach(t, im->tunnel_interfaces, ({
 399     if (t->input_sa_index == sa_index)
 400       return 1;
 401     if (t->output_sa_index == sa_index)
 402       return 1;
 403   }));
 404   /* *INDENT-ON* */
 405
 406   return 0;
 407 }
 408
 409 clib_error_t *
 410 ipsec_call_add_del_callbacks (ipsec_main_t * im, ipsec_sa_t * sa,
 411                               u32 sa_index, int is_add)
 412 {
 413   ipsec_ah_backend_t *ab;
 414   ipsec_esp_backend_t *eb;
 415   switch (sa->protocol)
 416     {
 417     case IPSEC_PROTOCOL_AH:
 418       ab = pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 419       if (ab->add_del_sa_sess_cb)
 420         return ab->add_del_sa_sess_cb (sa_index, is_add);
 421       break;
 422     case IPSEC_PROTOCOL_ESP:
 423       eb = pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 424       if (eb->add_del_sa_sess_cb)
 425         return eb->add_del_sa_sess_cb (sa_index, is_add);
 426       break;
 427     }
 428   return 0;
 429 }
 430
 431 int
 432 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
 433 {
 434   ipsec_main_t *im = &ipsec_main;
 435   ipsec_sa_t *sa = 0;
 436   uword *p;
 437   u32 sa_index;
 438   clib_error_t *err;
 439
 440   clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
 441
 442   p = hash_get (im->sa_index_by_sa_id, new_sa->id);
 443   if (p && is_add)
 444     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* already exists */
 445   if (!p && !is_add)
 446     return VNET_API_ERROR_SYSCALL_ERROR_1;
 447
 448   if (!is_add)                  /* delete */
 449     {
 450       sa_index = p[0];
 451       sa = pool_elt_at_index (im->sad, sa_index);
 452       if (ipsec_is_sa_used (sa_index))
 453         {
 454           clib_warning ("sa_id %u used in policy", sa->id);
 455           return VNET_API_ERROR_SYSCALL_ERROR_1;        /* sa used in policy */
 456         }
 457       hash_unset (im->sa_index_by_sa_id, sa->id);
 458       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
 459       if (err)
 460         return VNET_API_ERROR_SYSCALL_ERROR_1;
 461       pool_put (im->sad, sa);
 462     }
 463   else                          /* create new SA */
 464     {
 465       pool_get (im->sad, sa);
 466       clib_memcpy (sa, new_sa, sizeof (*sa));
 467       sa_index = sa - im->sad;
 468       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
 469       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 1);
 470       if (err)
 471         return VNET_API_ERROR_SYSCALL_ERROR_1;
 472     }
 473   return 0;
 474 }
 475
 476 int
 477 ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
 478 {
 479   ipsec_main_t *im = &ipsec_main;
 480   uword *p;
 481   u32 sa_index;
 482   ipsec_sa_t *sa = 0;
 483   clib_error_t *err;
 484
 485   p = hash_get (im->sa_index_by_sa_id, sa_update->id);
 486   if (!p)
 487     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such sa-id */
 488
 489   sa_index = p[0];
 490   sa = pool_elt_at_index (im->sad, sa_index);
 491
 492   /* new crypto key */
 493   if (0 < sa_update->crypto_key_len)
 494     {
 495       clib_memcpy (sa->crypto_key, sa_update->crypto_key,
 496                    sa_update->crypto_key_len);
 497       sa->crypto_key_len = sa_update->crypto_key_len;
 498     }
 499
 500   /* new integ key */
 501   if (0 < sa_update->integ_key_len)
 502     {
 503       clib_memcpy (sa->integ_key, sa_update->integ_key,
 504                    sa_update->integ_key_len);
 505       sa->integ_key_len = sa_update->integ_key_len;
 506     }
 507
 508   if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
 509     {
 510       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
 511       if (err)
 512         return VNET_API_ERROR_SYSCALL_ERROR_1;
 513     }
 514
 515   return 0;
 516 }
 517
 518 static void
 519 ipsec_rand_seed (void)
 520 {
 521   struct
 522   {
 523     time_t time;
 524     pid_t pid;
 525     void *p;
 526   } seed_data;
 527
 528   seed_data.time = time (NULL);
 529   seed_data.pid = getpid ();
 530   seed_data.p = (void *) &seed_data;
 531
 532   RAND_seed ((const void *) &seed_data, sizeof (seed_data));
 533 }
 534
 535 static clib_error_t *
 536 ipsec_check_support (ipsec_sa_t * sa)
 537 {
 538   if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
 539     return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
 540   if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
 541     return clib_error_return (0, "unsupported none integ-alg");
 542
 543   return 0;
 544 }
 545
 546 clib_error_t *
 547 ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, u8 is_add)
 548 {
 549   ipsec_ah_backend_t *ah =
 550     pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 551   if (ah->add_del_sa_sess_cb)
 552     {
 553       clib_error_t *err = ah->add_del_sa_sess_cb (sa_index, is_add);
 554       if (err)
 555         return err;
 556     }
 557   ipsec_esp_backend_t *esp =
 558     pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 559   if (esp->add_del_sa_sess_cb)
 560     {
 561       clib_error_t *err = esp->add_del_sa_sess_cb (sa_index, is_add);
 562       if (err)
 563         return err;
 564     }
 565   return 0;
 566 }
 567
 568 clib_error_t *
 569 ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa)
 570 {
 571   clib_error_t *error = 0;
 572
 573   if (PREDICT_FALSE (sa->protocol == IPSEC_PROTOCOL_AH))
 574     {
 575       ipsec_ah_backend_t *ah =
 576         pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 577       ASSERT (ah->check_support_cb);
 578       error = ah->check_support_cb (sa);
 579     }
 580   else
 581     {
 582       ipsec_esp_backend_t *esp =
 583         pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 584       ASSERT (esp->check_support_cb);
 585       error = esp->check_support_cb (sa);
 586     }
 587   return error;
 588 }
 589
 590
 591 static void
 592 ipsec_add_node (vlib_main_t * vm, const char *node_name,
 593                 const char *prev_node_name, u32 * out_node_index,
 594                 u32 * out_next_index)
 595 {
 596   vlib_node_t *prev_node, *node;
 597   prev_node = vlib_get_node_by_name (vm, (u8 *) prev_node_name);
 598   ASSERT (prev_node);
 599   node = vlib_get_node_by_name (vm, (u8 *) node_name);
 600   ASSERT (node);
 601   *out_node_index = node->index;
 602   *out_next_index = vlib_node_add_next (vm, prev_node->index, node->index);
 603 }
 604
 605 u32
 606 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im,
 607                            const char *name,
 608                            const char *ah4_encrypt_node_name,
 609                            const char *ah4_decrypt_node_name,
 610                            const char *ah6_encrypt_node_name,
 611                            const char *ah6_decrypt_node_name,
 612                            check_support_cb_t ah_check_support_cb,
 613                            add_del_sa_sess_cb_t ah_add_del_sa_sess_cb)
 614 {
 615   ipsec_ah_backend_t *b;
 616   pool_get (im->ah_backends, b);
 617   b->name = format (NULL, "%s", name);
 618
 619   ipsec_add_node (vm, ah4_encrypt_node_name, "ipsec4-output-feature",
 620                   &b->ah4_encrypt_node_index, &b->ah4_encrypt_next_index);
 621   ipsec_add_node (vm, ah4_decrypt_node_name, "ipsec4-input-feature",
 622                   &b->ah4_decrypt_node_index, &b->ah4_decrypt_next_index);
 623   ipsec_add_node (vm, ah6_encrypt_node_name, "ipsec6-output-feature",
 624                   &b->ah6_encrypt_node_index, &b->ah6_encrypt_next_index);
 625   ipsec_add_node (vm, ah6_decrypt_node_name, "ipsec6-input-feature",
 626                   &b->ah6_decrypt_node_index, &b->ah6_decrypt_next_index);
 627
 628   b->check_support_cb = ah_check_support_cb;
 629   b->add_del_sa_sess_cb = ah_add_del_sa_sess_cb;
 630   return b - im->ah_backends;
 631 }
 632
 633 u32
 634 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
 635                             const char *name,
 636                             const char *esp4_encrypt_node_name,
 637                             const char *esp4_decrypt_node_name,
 638                             const char *esp6_encrypt_node_name,
 639                             const char *esp6_decrypt_node_name,
 640                             check_support_cb_t esp_check_support_cb,
 641                             add_del_sa_sess_cb_t esp_add_del_sa_sess_cb)
 642 {
 643   ipsec_esp_backend_t *b;
 644   pool_get (im->esp_backends, b);
 645   b->name = format (NULL, "%s", name);
 646
 647   ipsec_add_node (vm, esp4_encrypt_node_name, "ipsec4-output-feature",
 648                   &b->esp4_encrypt_node_index, &b->esp4_encrypt_next_index);
 649   ipsec_add_node (vm, esp4_decrypt_node_name, "ipsec4-input-feature",
 650                   &b->esp4_decrypt_node_index, &b->esp4_decrypt_next_index);
 651   ipsec_add_node (vm, esp6_encrypt_node_name, "ipsec6-output-feature",
 652                   &b->esp6_encrypt_node_index, &b->esp6_encrypt_next_index);
 653   ipsec_add_node (vm, esp6_decrypt_node_name, "ipsec6-input-feature",
 654                   &b->esp6_decrypt_node_index, &b->esp6_decrypt_next_index);
 655
 656   b->check_support_cb = esp_check_support_cb;
 657   b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb;
 658   return b - im->esp_backends;
 659 }
 660
 661 int
 662 ipsec_select_ah_backend (ipsec_main_t * im, u32 backend_idx)
 663 {
 664   if (pool_elts (im->sad) > 0
 665       || pool_is_free_index (im->ah_backends, backend_idx))
 666     {
 667       return -1;
 668     }
 669   ipsec_ah_backend_t *b = pool_elt_at_index (im->ah_backends, backend_idx);
 670   im->ah_current_backend = backend_idx;
 671   im->ah4_encrypt_node_index = b->ah4_encrypt_node_index;
 672   im->ah4_decrypt_node_index = b->ah4_decrypt_node_index;
 673   im->ah4_encrypt_next_index = b->ah4_encrypt_next_index;
 674   im->ah4_decrypt_next_index = b->ah4_decrypt_next_index;
 675   im->ah6_encrypt_node_index = b->ah6_encrypt_node_index;
 676   im->ah6_decrypt_node_index = b->ah6_decrypt_node_index;
 677   im->ah6_encrypt_next_index = b->ah6_encrypt_next_index;
 678   im->ah6_decrypt_next_index = b->ah6_decrypt_next_index;
 679   return 0;
 680 }
 681
 682 int
 683 ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
 684 {
 685   if (pool_elts (im->sad) > 0
 686       || pool_is_free_index (im->esp_backends, backend_idx))
 687     {
 688       return -1;
 689     }
 690   ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx);
 691   im->esp_current_backend = backend_idx;
 692   im->esp4_encrypt_node_index = b->esp4_encrypt_node_index;
 693   im->esp4_decrypt_node_index = b->esp4_decrypt_node_index;
 694   im->esp4_encrypt_next_index = b->esp4_encrypt_next_index;
 695   im->esp4_decrypt_next_index = b->esp4_decrypt_next_index;
 696   im->esp6_encrypt_node_index = b->esp6_encrypt_node_index;
 697   im->esp6_decrypt_node_index = b->esp6_decrypt_node_index;
 698   im->esp6_encrypt_next_index = b->esp6_encrypt_next_index;
 699   im->esp6_decrypt_next_index = b->esp6_decrypt_next_index;
 700   return 0;
 701 }
 702
 703 static clib_error_t *
 704 ipsec_init (vlib_main_t * vm)
 705 {
 706   clib_error_t *error;
 707   ipsec_main_t *im = &ipsec_main;
 708   vlib_thread_main_t *tm = vlib_get_thread_main ();
 709
 710   ipsec_rand_seed ();
 711
 712   clib_memset (im, 0, sizeof (im[0]));
 713
 714   im->vnet_main = vnet_get_main ();
 715   im->vlib_main = vm;
 716
 717   im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
 718   im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
 719   im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
 720
 721   vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1,
 722                         CLIB_CACHE_LINE_BYTES);
 723
 724   vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
 725   ASSERT (node);
 726   im->error_drop_node_index = node->index;
 727
 728   u32 idx = ipsec_register_ah_backend (vm, im, "default openssl backend",
 729                                        "ah4-encrypt",
 730                                        "ah4-decrypt",
 731                                        "ah6-encrypt",
 732                                        "ah6-decrypt",
 733                                        ipsec_check_support,
 734                                        NULL);
 735
 736   im->ah_default_backend = idx;
 737   int rv = ipsec_select_ah_backend (im, idx);
 738   ASSERT (0 == rv);
 739   (void) (rv);                  // avoid warning
 740
 741   idx = ipsec_register_esp_backend (vm, im, "default openssl backend",
 742                                     "esp4-encrypt",
 743                                     "esp4-decrypt",
 744                                     "esp6-encrypt",
 745                                     "esp6-decrypt",
 746                                     ipsec_check_support, NULL);
 747   im->esp_default_backend = idx;
 748
 749   rv = ipsec_select_esp_backend (im, idx);
 750   ASSERT (0 == rv);
 751   (void) (rv);                  // avoid warning
 752
 753   if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
 754     return error;
 755
 756   if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
 757     return error;
 758
 759   ipsec_proto_init ();
 760
 761   if ((error = ikev2_init (vm)))
 762     return error;
 763
 764   return 0;
 765 }
 766
 767 VLIB_INIT_FUNCTION (ipsec_init);
 768
 769 /*
 770  * fd.io coding-style-patch-verification: ON
 771  *
 772  * Local Variables:
 773  * eval: (c-set-style "gnu")
 774  * End:
 775  */