src/vnet/ipsec/ipsec.c

   1 /*
   2  * decap.c : IPSec tunnel support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21 #include <vnet/interface.h>
  22 #include <vnet/udp/udp.h>
  23
  24 #include <vnet/ipsec/ipsec.h>
  25 #include <vnet/ipsec/ikev2.h>
  26 #include <vnet/ipsec/esp.h>
  27 #include <vnet/ipsec/ah.h>
  28
  29
  30 ipsec_main_t ipsec_main;
  31
  32 u32
  33 ipsec_get_sa_index_by_sa_id (u32 sa_id)
  34 {
  35   ipsec_main_t *im = &ipsec_main;
  36   uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
  37   if (!p)
  38     return ~0;
  39
  40   return p[0];
  41 }
  42
  43 int
  44 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
  45                          int is_add)
  46 {
  47   ipsec_main_t *im = &ipsec_main;
  48   ip4_ipsec_config_t config;
  49
  50   u32 spd_index;
  51   uword *p;
  52
  53   p = hash_get (im->spd_index_by_spd_id, spd_id);
  54   if (!p)
  55     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such spd-id */
  56
  57   spd_index = p[0];
  58
  59   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
  60   if (p && is_add)
  61     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* spd already assigned */
  62
  63   if (is_add)
  64     {
  65       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
  66     }
  67   else
  68     {
  69       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
  70     }
  71
  72   clib_warning ("sw_if_index %u spd_id %u spd_index %u",
  73                 sw_if_index, spd_id, spd_index);
  74
  75   /* enable IPsec on TX */
  76   vnet_feature_enable_disable ("ip4-output", "ipsec4-output-feature",
  77                                sw_if_index, is_add, 0, 0);
  78   vnet_feature_enable_disable ("ip6-output", "ipsec6-output-feature",
  79                                sw_if_index, is_add, 0, 0);
  80
  81   config.spd_index = spd_index;
  82
  83   /* enable IPsec on RX */
  84   vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input-feature",
  85                                sw_if_index, is_add, &config, sizeof (config));
  86   vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input-feature",
  87                                sw_if_index, is_add, &config, sizeof (config));
  88
  89   return 0;
  90 }
  91
  92 int
  93 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
  94 {
  95   ipsec_main_t *im = &ipsec_main;
  96   ipsec_spd_t *spd = 0;
  97   uword *p;
  98   u32 spd_index, k, v;
  99
 100   p = hash_get (im->spd_index_by_spd_id, spd_id);
 101   if (p && is_add)
 102     return VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
 103   if (!p && !is_add)
 104     return VNET_API_ERROR_NO_SUCH_ENTRY;
 105
 106   if (!is_add)                  /* delete */
 107     {
 108       spd_index = p[0];
 109       spd = pool_elt_at_index (im->spds, spd_index);
 110       if (!spd)
 111         return VNET_API_ERROR_INVALID_VALUE;
 112       /* *INDENT-OFF* */
 113       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
 114         if (v == spd_index)
 115           ipsec_set_interface_spd(vm, k, spd_id, 0);
 116       }));
 117       /* *INDENT-ON* */
 118       hash_unset (im->spd_index_by_spd_id, spd_id);
 119       pool_free (spd->policies);
 120       vec_free (spd->ipv4_outbound_policies);
 121       vec_free (spd->ipv6_outbound_policies);
 122       vec_free (spd->ipv4_inbound_protect_policy_indices);
 123       vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
 124       pool_put (im->spds, spd);
 125     }
 126   else                          /* create new SPD */
 127     {
 128       pool_get (im->spds, spd);
 129       clib_memset (spd, 0, sizeof (*spd));
 130       spd_index = spd - im->spds;
 131       spd->id = spd_id;
 132       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 133     }
 134   return 0;
 135 }
 136
 137 static int
 138 ipsec_spd_entry_sort (void *a1, void *a2)
 139 {
 140   u32 *id1 = a1;
 141   u32 *id2 = a2;
 142   ipsec_spd_t *spd = ipsec_main.spd_to_sort;
 143   ipsec_policy_t *p1, *p2;
 144
 145   p1 = pool_elt_at_index (spd->policies, *id1);
 146   p2 = pool_elt_at_index (spd->policies, *id2);
 147   if (p1 && p2)
 148     return p2->priority - p1->priority;
 149
 150   return 0;
 151 }
 152
 153 int
 154 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
 155 {
 156   ipsec_main_t *im = &ipsec_main;
 157   ipsec_spd_t *spd = 0;
 158   ipsec_policy_t *vp;
 159   uword *p;
 160   u32 spd_index;
 161
 162   clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
 163                 policy->priority, policy->is_outbound);
 164
 165   if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 166     {
 167       p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
 168       if (!p)
 169         return VNET_API_ERROR_SYSCALL_ERROR_1;
 170       policy->sa_index = p[0];
 171     }
 172
 173   p = hash_get (im->spd_index_by_spd_id, policy->id);
 174
 175   if (!p)
 176     return VNET_API_ERROR_SYSCALL_ERROR_1;
 177
 178   spd_index = p[0];
 179   spd = pool_elt_at_index (im->spds, spd_index);
 180   if (!spd)
 181     return VNET_API_ERROR_SYSCALL_ERROR_1;
 182
 183   if (is_add)
 184     {
 185       u32 policy_index;
 186
 187       pool_get (spd->policies, vp);
 188       clib_memcpy (vp, policy, sizeof (*vp));
 189       policy_index = vp - spd->policies;
 190
 191       ipsec_main.spd_to_sort = spd;
 192
 193       if (policy->is_outbound)
 194         {
 195           if (policy->is_ipv6)
 196             {
 197               vec_add1 (spd->ipv6_outbound_policies, policy_index);
 198               vec_sort_with_function (spd->ipv6_outbound_policies,
 199                                       ipsec_spd_entry_sort);
 200             }
 201           else
 202             {
 203               vec_add1 (spd->ipv4_outbound_policies, policy_index);
 204               vec_sort_with_function (spd->ipv4_outbound_policies,
 205                                       ipsec_spd_entry_sort);
 206             }
 207         }
 208       else
 209         {
 210           if (policy->is_ipv6)
 211             {
 212               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 213                 {
 214                   vec_add1 (spd->ipv6_inbound_protect_policy_indices,
 215                             policy_index);
 216                   vec_sort_with_function
 217                     (spd->ipv6_inbound_protect_policy_indices,
 218                      ipsec_spd_entry_sort);
 219                 }
 220               else
 221                 {
 222                   vec_add1
 223                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 224                      policy_index);
 225                   vec_sort_with_function
 226                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 227                      ipsec_spd_entry_sort);
 228                 }
 229             }
 230           else
 231             {
 232               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 233                 {
 234                   vec_add1 (spd->ipv4_inbound_protect_policy_indices,
 235                             policy_index);
 236                   vec_sort_with_function
 237                     (spd->ipv4_inbound_protect_policy_indices,
 238                      ipsec_spd_entry_sort);
 239                 }
 240               else
 241                 {
 242                   vec_add1
 243                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 244                      policy_index);
 245                   vec_sort_with_function
 246                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 247                      ipsec_spd_entry_sort);
 248                 }
 249             }
 250         }
 251
 252       ipsec_main.spd_to_sort = NULL;
 253     }
 254   else
 255     {
 256       u32 i, j;
 257       /* *INDENT-OFF* */
 258       pool_foreach_index(i, spd->policies, ({
 259         vp = pool_elt_at_index(spd->policies, i);
 260         if (vp->priority != policy->priority)
 261           continue;
 262         if (vp->is_outbound != policy->is_outbound)
 263           continue;
 264         if (vp->policy != policy->policy)
 265           continue;
 266         if (vp->sa_id != policy->sa_id)
 267           continue;
 268         if (vp->protocol != policy->protocol)
 269           continue;
 270         if (vp->lport.start != policy->lport.start)
 271           continue;
 272         if (vp->lport.stop != policy->lport.stop)
 273           continue;
 274         if (vp->rport.start != policy->rport.start)
 275           continue;
 276         if (vp->rport.stop != policy->rport.stop)
 277           continue;
 278         if (vp->is_ipv6 != policy->is_ipv6)
 279           continue;
 280         if (policy->is_ipv6)
 281           {
 282             if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
 283               continue;
 284             if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
 285               continue;
 286             if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
 287               continue;
 288             if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 289               continue;
 290             if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
 291               continue;
 292             if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
 293               continue;
 294             if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
 295               continue;
 296            if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 297               continue;
 298            if (policy->is_outbound)
 299              {
 300                vec_foreach_index(j, spd->ipv6_outbound_policies) {
 301                  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
 302                    vec_del1 (spd->ipv6_outbound_policies, j);
 303                    break;
 304                  }
 305                }
 306              }
 307            else
 308              {
 309                if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 310                  {
 311                    vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
 312                      if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
 313                        vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
 314                        break;
 315                      }
 316                    }
 317                  }
 318                else
 319                  {
 320                    vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
 321                      if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
 322                        vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
 323                        break;
 324                      }
 325                    }
 326                  }
 327              }
 328           }
 329         else
 330           {
 331             if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
 332               continue;
 333             if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
 334               continue;
 335             if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
 336               continue;
 337             if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
 338               continue;
 339             if (policy->is_outbound)
 340               {
 341                 vec_foreach_index(j, spd->ipv4_outbound_policies) {
 342                   if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
 343                     vec_del1 (spd->ipv4_outbound_policies, j);
 344                     break;
 345                   }
 346                 }
 347               }
 348             else
 349               {
 350                 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 351                   {
 352                     vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
 353                       if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
 354                         vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
 355                         break;
 356                       }
 357                     }
 358                   }
 359                 else
 360                   {
 361                     vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
 362                       if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
 363                         vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
 364                         break;
 365                       }
 366                     }
 367                   }
 368               }
 369           }
 370           pool_put (spd->policies, vp);
 371           break;
 372       }));
 373       /* *INDENT-ON* */
 374     }
 375
 376   return 0;
 377 }
 378
 379 u8
 380 ipsec_is_sa_used (u32 sa_index)
 381 {
 382   ipsec_main_t *im = &ipsec_main;
 383   ipsec_spd_t *spd;
 384   ipsec_policy_t *p;
 385   ipsec_tunnel_if_t *t;
 386
 387   /* *INDENT-OFF* */
 388   pool_foreach(spd, im->spds, ({
 389     pool_foreach(p, spd->policies, ({
 390       if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
 391         {
 392           if (p->sa_index == sa_index)
 393             return 1;
 394         }
 395     }));
 396   }));
 397
 398   pool_foreach(t, im->tunnel_interfaces, ({
 399     if (t->input_sa_index == sa_index)
 400       return 1;
 401     if (t->output_sa_index == sa_index)
 402       return 1;
 403   }));
 404   /* *INDENT-ON* */
 405
 406   return 0;
 407 }
 408
 409 clib_error_t *
 410 ipsec_call_add_del_callbacks (ipsec_main_t * im, ipsec_sa_t * sa,
 411                               u32 sa_index, int is_add)
 412 {
 413   ipsec_ah_backend_t *ab;
 414   ipsec_esp_backend_t *eb;
 415   switch (sa->protocol)
 416     {
 417     case IPSEC_PROTOCOL_AH:
 418       ab = pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 419       if (ab->add_del_sa_sess_cb)
 420         return ab->add_del_sa_sess_cb (sa_index, is_add);
 421       break;
 422     case IPSEC_PROTOCOL_ESP:
 423       eb = pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 424       if (eb->add_del_sa_sess_cb)
 425         return eb->add_del_sa_sess_cb (sa_index, is_add);
 426       break;
 427     }
 428   return 0;
 429 }
 430
 431 int
 432 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
 433 {
 434   ipsec_main_t *im = &ipsec_main;
 435   ipsec_sa_t *sa = 0;
 436   uword *p;
 437   u32 sa_index;
 438   clib_error_t *err;
 439
 440   clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
 441
 442   p = hash_get (im->sa_index_by_sa_id, new_sa->id);
 443   if (p && is_add)
 444     return VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
 445   if (!p && !is_add)
 446     return VNET_API_ERROR_NO_SUCH_ENTRY;
 447
 448   if (!is_add)                  /* delete */
 449     {
 450       sa_index = p[0];
 451       sa = pool_elt_at_index (im->sad, sa_index);
 452       if (ipsec_is_sa_used (sa_index))
 453         {
 454           clib_warning ("sa_id %u used in policy", sa->id);
 455           return VNET_API_ERROR_SYSCALL_ERROR_1;        /* sa used in policy */
 456         }
 457       hash_unset (im->sa_index_by_sa_id, sa->id);
 458       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
 459       if (err)
 460         return VNET_API_ERROR_SYSCALL_ERROR_1;
 461       pool_put (im->sad, sa);
 462     }
 463   else                          /* create new SA */
 464     {
 465       pool_get (im->sad, sa);
 466       clib_memcpy (sa, new_sa, sizeof (*sa));
 467       sa_index = sa - im->sad;
 468       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
 469       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 1);
 470       if (err)
 471         return VNET_API_ERROR_SYSCALL_ERROR_1;
 472     }
 473   return 0;
 474 }
 475
 476 int
 477 ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
 478 {
 479   ipsec_main_t *im = &ipsec_main;
 480   uword *p;
 481   u32 sa_index;
 482   ipsec_sa_t *sa = 0;
 483   clib_error_t *err;
 484
 485   p = hash_get (im->sa_index_by_sa_id, sa_update->id);
 486   if (!p)
 487     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such sa-id */
 488
 489   sa_index = p[0];
 490   sa = pool_elt_at_index (im->sad, sa_index);
 491
 492   /* new crypto key */
 493   if (0 < sa_update->crypto_key_len)
 494     {
 495       clib_memcpy (sa->crypto_key, sa_update->crypto_key,
 496                    sa_update->crypto_key_len);
 497       sa->crypto_key_len = sa_update->crypto_key_len;
 498     }
 499
 500   /* new integ key */
 501   if (0 < sa_update->integ_key_len)
 502     {
 503       clib_memcpy (sa->integ_key, sa_update->integ_key,
 504                    sa_update->integ_key_len);
 505       sa->integ_key_len = sa_update->integ_key_len;
 506     }
 507
 508   if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
 509     {
 510       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
 511       if (err)
 512         return VNET_API_ERROR_SYSCALL_ERROR_1;
 513     }
 514
 515   return 0;
 516 }
 517
 518 static void
 519 ipsec_rand_seed (void)
 520 {
 521   struct
 522   {
 523     time_t time;
 524     pid_t pid;
 525     void *p;
 526   } seed_data;
 527
 528   seed_data.time = time (NULL);
 529   seed_data.pid = getpid ();
 530   seed_data.p = (void *) &seed_data;
 531
 532   RAND_seed ((const void *) &seed_data, sizeof (seed_data));
 533 }
 534
 535 static clib_error_t *
 536 ipsec_check_ah_support (ipsec_sa_t * sa)
 537 {
 538   if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
 539     return clib_error_return (0, "unsupported none integ-alg");
 540   return 0;
 541 }
 542
 543 static clib_error_t *
 544 ipsec_check_esp_support (ipsec_sa_t * sa)
 545 {
 546   if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
 547     return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
 548   if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_192)
 549     return clib_error_return (0, "unsupported aes-gcm-192 crypto-alg");
 550   if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_256)
 551     return clib_error_return (0, "unsupported aes-gcm-256 crypto-alg");
 552
 553   return 0;
 554 }
 555
 556 clib_error_t *
 557 ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, u8 is_add)
 558 {
 559   ipsec_ah_backend_t *ah =
 560     pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 561   if (ah->add_del_sa_sess_cb)
 562     {
 563       clib_error_t *err = ah->add_del_sa_sess_cb (sa_index, is_add);
 564       if (err)
 565         return err;
 566     }
 567   ipsec_esp_backend_t *esp =
 568     pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 569   if (esp->add_del_sa_sess_cb)
 570     {
 571       clib_error_t *err = esp->add_del_sa_sess_cb (sa_index, is_add);
 572       if (err)
 573         return err;
 574     }
 575   return 0;
 576 }
 577
 578 clib_error_t *
 579 ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa)
 580 {
 581   clib_error_t *error = 0;
 582
 583   if (PREDICT_FALSE (sa->protocol == IPSEC_PROTOCOL_AH))
 584     {
 585       ipsec_ah_backend_t *ah =
 586         pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 587       ASSERT (ah->check_support_cb);
 588       error = ah->check_support_cb (sa);
 589     }
 590   else
 591     {
 592       ipsec_esp_backend_t *esp =
 593         pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 594       ASSERT (esp->check_support_cb);
 595       error = esp->check_support_cb (sa);
 596     }
 597   return error;
 598 }
 599
 600
 601 static void
 602 ipsec_add_node (vlib_main_t * vm, const char *node_name,
 603                 const char *prev_node_name, u32 * out_node_index,
 604                 u32 * out_next_index)
 605 {
 606   vlib_node_t *prev_node, *node;
 607   prev_node = vlib_get_node_by_name (vm, (u8 *) prev_node_name);
 608   ASSERT (prev_node);
 609   node = vlib_get_node_by_name (vm, (u8 *) node_name);
 610   ASSERT (node);
 611   *out_node_index = node->index;
 612   *out_next_index = vlib_node_add_next (vm, prev_node->index, node->index);
 613 }
 614
 615 u32
 616 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im,
 617                            const char *name,
 618                            const char *ah4_encrypt_node_name,
 619                            const char *ah4_decrypt_node_name,
 620                            const char *ah6_encrypt_node_name,
 621                            const char *ah6_decrypt_node_name,
 622                            check_support_cb_t ah_check_support_cb,
 623                            add_del_sa_sess_cb_t ah_add_del_sa_sess_cb)
 624 {
 625   ipsec_ah_backend_t *b;
 626   pool_get (im->ah_backends, b);
 627   b->name = format (NULL, "%s", name);
 628
 629   ipsec_add_node (vm, ah4_encrypt_node_name, "ipsec4-output-feature",
 630                   &b->ah4_encrypt_node_index, &b->ah4_encrypt_next_index);
 631   ipsec_add_node (vm, ah4_decrypt_node_name, "ipsec4-input-feature",
 632                   &b->ah4_decrypt_node_index, &b->ah4_decrypt_next_index);
 633   ipsec_add_node (vm, ah6_encrypt_node_name, "ipsec6-output-feature",
 634                   &b->ah6_encrypt_node_index, &b->ah6_encrypt_next_index);
 635   ipsec_add_node (vm, ah6_decrypt_node_name, "ipsec6-input-feature",
 636                   &b->ah6_decrypt_node_index, &b->ah6_decrypt_next_index);
 637
 638   b->check_support_cb = ah_check_support_cb;
 639   b->add_del_sa_sess_cb = ah_add_del_sa_sess_cb;
 640   return b - im->ah_backends;
 641 }
 642
 643 u32
 644 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
 645                             const char *name,
 646                             const char *esp4_encrypt_node_name,
 647                             const char *esp4_decrypt_node_name,
 648                             const char *esp6_encrypt_node_name,
 649                             const char *esp6_decrypt_node_name,
 650                             check_support_cb_t esp_check_support_cb,
 651                             add_del_sa_sess_cb_t esp_add_del_sa_sess_cb)
 652 {
 653   ipsec_esp_backend_t *b;
 654   pool_get (im->esp_backends, b);
 655   b->name = format (NULL, "%s", name);
 656
 657   ipsec_add_node (vm, esp4_encrypt_node_name, "ipsec4-output-feature",
 658                   &b->esp4_encrypt_node_index, &b->esp4_encrypt_next_index);
 659   ipsec_add_node (vm, esp4_decrypt_node_name, "ipsec4-input-feature",
 660                   &b->esp4_decrypt_node_index, &b->esp4_decrypt_next_index);
 661   ipsec_add_node (vm, esp6_encrypt_node_name, "ipsec6-output-feature",
 662                   &b->esp6_encrypt_node_index, &b->esp6_encrypt_next_index);
 663   ipsec_add_node (vm, esp6_decrypt_node_name, "ipsec6-input-feature",
 664                   &b->esp6_decrypt_node_index, &b->esp6_decrypt_next_index);
 665
 666   b->check_support_cb = esp_check_support_cb;
 667   b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb;
 668   return b - im->esp_backends;
 669 }
 670
 671 int
 672 ipsec_select_ah_backend (ipsec_main_t * im, u32 backend_idx)
 673 {
 674   if (pool_elts (im->sad) > 0
 675       || pool_is_free_index (im->ah_backends, backend_idx))
 676     {
 677       return -1;
 678     }
 679   ipsec_ah_backend_t *b = pool_elt_at_index (im->ah_backends, backend_idx);
 680   im->ah_current_backend = backend_idx;
 681   im->ah4_encrypt_node_index = b->ah4_encrypt_node_index;
 682   im->ah4_decrypt_node_index = b->ah4_decrypt_node_index;
 683   im->ah4_encrypt_next_index = b->ah4_encrypt_next_index;
 684   im->ah4_decrypt_next_index = b->ah4_decrypt_next_index;
 685   im->ah6_encrypt_node_index = b->ah6_encrypt_node_index;
 686   im->ah6_decrypt_node_index = b->ah6_decrypt_node_index;
 687   im->ah6_encrypt_next_index = b->ah6_encrypt_next_index;
 688   im->ah6_decrypt_next_index = b->ah6_decrypt_next_index;
 689   return 0;
 690 }
 691
 692 int
 693 ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
 694 {
 695   if (pool_elts (im->sad) > 0
 696       || pool_is_free_index (im->esp_backends, backend_idx))
 697     {
 698       return -1;
 699     }
 700   ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx);
 701   im->esp_current_backend = backend_idx;
 702   im->esp4_encrypt_node_index = b->esp4_encrypt_node_index;
 703   im->esp4_decrypt_node_index = b->esp4_decrypt_node_index;
 704   im->esp4_encrypt_next_index = b->esp4_encrypt_next_index;
 705   im->esp4_decrypt_next_index = b->esp4_decrypt_next_index;
 706   im->esp6_encrypt_node_index = b->esp6_encrypt_node_index;
 707   im->esp6_decrypt_node_index = b->esp6_decrypt_node_index;
 708   im->esp6_encrypt_next_index = b->esp6_encrypt_next_index;
 709   im->esp6_decrypt_next_index = b->esp6_decrypt_next_index;
 710   return 0;
 711 }
 712
 713 static clib_error_t *
 714 ipsec_init (vlib_main_t * vm)
 715 {
 716   clib_error_t *error;
 717   ipsec_main_t *im = &ipsec_main;
 718   vlib_thread_main_t *tm = vlib_get_thread_main ();
 719
 720   ipsec_rand_seed ();
 721
 722   clib_memset (im, 0, sizeof (im[0]));
 723
 724   im->vnet_main = vnet_get_main ();
 725   im->vlib_main = vm;
 726
 727   im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
 728   im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
 729   im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
 730
 731   vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1,
 732                         CLIB_CACHE_LINE_BYTES);
 733
 734   vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
 735   ASSERT (node);
 736   im->error_drop_node_index = node->index;
 737
 738   u32 idx = ipsec_register_ah_backend (vm, im, "default openssl backend",
 739                                        "ah4-encrypt",
 740                                        "ah4-decrypt",
 741                                        "ah6-encrypt",
 742                                        "ah6-decrypt",
 743                                        ipsec_check_ah_support,
 744                                        NULL);
 745
 746   im->ah_default_backend = idx;
 747   int rv = ipsec_select_ah_backend (im, idx);
 748   ASSERT (0 == rv);
 749   (void) (rv);                  // avoid warning
 750
 751   idx = ipsec_register_esp_backend (vm, im, "default openssl backend",
 752                                     "esp4-encrypt",
 753                                     "esp4-decrypt",
 754                                     "esp6-encrypt",
 755                                     "esp6-decrypt",
 756                                     ipsec_check_esp_support, NULL);
 757   im->esp_default_backend = idx;
 758
 759   rv = ipsec_select_esp_backend (im, idx);
 760   ASSERT (0 == rv);
 761   (void) (rv);                  // avoid warning
 762
 763   if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
 764     return error;
 765
 766   if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
 767     return error;
 768
 769   ipsec_proto_init ();
 770
 771   if ((error = ikev2_init (vm)))
 772     return error;
 773
 774   return 0;
 775 }
 776
 777 VLIB_INIT_FUNCTION (ipsec_init);
 778
 779 /*
 780  * fd.io coding-style-patch-verification: ON
 781  *
 782  * Local Variables:
 783  * eval: (c-set-style "gnu")
 784  * End:
 785  */