src/vnet/ipsec/ipsec.c

   1 /*
   2  * decap.c : IPSec tunnel support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21 #include <vnet/interface.h>
  22 #include <vnet/udp/udp.h>
  23
  24 #include <vnet/ipsec/ipsec.h>
  25 #include <vnet/ipsec/ikev2.h>
  26 #include <vnet/ipsec/esp.h>
  27 #include <vnet/ipsec/ah.h>
  28
  29
  30 ipsec_main_t ipsec_main;
  31
  32 u32
  33 ipsec_get_sa_index_by_sa_id (u32 sa_id)
  34 {
  35   ipsec_main_t *im = &ipsec_main;
  36   uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
  37   if (!p)
  38     return ~0;
  39
  40   return p[0];
  41 }
  42
  43 int
  44 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
  45                          int is_add)
  46 {
  47   ipsec_main_t *im = &ipsec_main;
  48   ip4_ipsec_config_t config;
  49
  50   u32 spd_index;
  51   uword *p;
  52
  53   p = hash_get (im->spd_index_by_spd_id, spd_id);
  54   if (!p)
  55     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such spd-id */
  56
  57   spd_index = p[0];
  58
  59   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
  60   if (p && is_add)
  61     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* spd already assigned */
  62
  63   if (is_add)
  64     {
  65       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
  66     }
  67   else
  68     {
  69       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
  70     }
  71
  72   clib_warning ("sw_if_index %u spd_id %u spd_index %u",
  73                 sw_if_index, spd_id, spd_index);
  74
  75   /* enable IPsec on TX */
  76   vnet_feature_enable_disable ("ip4-output", "ipsec4-output", sw_if_index,
  77                                is_add, 0, 0);
  78   vnet_feature_enable_disable ("ip6-output", "ipsec6-output", sw_if_index,
  79                                is_add, 0, 0);
  80
  81   config.spd_index = spd_index;
  82
  83   /* enable IPsec on RX */
  84   vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input", sw_if_index,
  85                                is_add, &config, sizeof (config));
  86   vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input", sw_if_index,
  87                                is_add, &config, sizeof (config));
  88
  89   return 0;
  90 }
  91
  92 int
  93 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
  94 {
  95   ipsec_main_t *im = &ipsec_main;
  96   ipsec_spd_t *spd = 0;
  97   uword *p;
  98   u32 spd_index, k, v;
  99
 100   p = hash_get (im->spd_index_by_spd_id, spd_id);
 101   if (p && is_add)
 102     return VNET_API_ERROR_INVALID_VALUE;
 103   if (!p && !is_add)
 104     return VNET_API_ERROR_INVALID_VALUE;
 105
 106   if (!is_add)                  /* delete */
 107     {
 108       spd_index = p[0];
 109       spd = pool_elt_at_index (im->spds, spd_index);
 110       if (!spd)
 111         return VNET_API_ERROR_INVALID_VALUE;
 112       /* *INDENT-OFF* */
 113       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
 114         if (v == spd_index)
 115           ipsec_set_interface_spd(vm, k, spd_id, 0);
 116       }));
 117       /* *INDENT-ON* */
 118       hash_unset (im->spd_index_by_spd_id, spd_id);
 119       pool_free (spd->policies);
 120       vec_free (spd->ipv4_outbound_policies);
 121       vec_free (spd->ipv6_outbound_policies);
 122       vec_free (spd->ipv4_inbound_protect_policy_indices);
 123       vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
 124       pool_put (im->spds, spd);
 125     }
 126   else                          /* create new SPD */
 127     {
 128       pool_get (im->spds, spd);
 129       clib_memset (spd, 0, sizeof (*spd));
 130       spd_index = spd - im->spds;
 131       spd->id = spd_id;
 132       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 133     }
 134   return 0;
 135 }
 136
 137 static int
 138 ipsec_spd_entry_sort (void *a1, void *a2)
 139 {
 140   u32 *id1 = a1;
 141   u32 *id2 = a2;
 142   ipsec_spd_t *spd = ipsec_main.spd_to_sort;
 143   ipsec_policy_t *p1, *p2;
 144
 145   p1 = pool_elt_at_index (spd->policies, *id1);
 146   p2 = pool_elt_at_index (spd->policies, *id2);
 147   if (p1 && p2)
 148     return p2->priority - p1->priority;
 149
 150   return 0;
 151 }
 152
 153 int
 154 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
 155 {
 156   ipsec_main_t *im = &ipsec_main;
 157   ipsec_spd_t *spd = 0;
 158   ipsec_policy_t *vp;
 159   uword *p;
 160   u32 spd_index;
 161
 162   clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
 163                 policy->priority, policy->is_outbound);
 164
 165   if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 166     {
 167       p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
 168       if (!p)
 169         return VNET_API_ERROR_SYSCALL_ERROR_1;
 170       policy->sa_index = p[0];
 171     }
 172
 173   p = hash_get (im->spd_index_by_spd_id, policy->id);
 174
 175   if (!p)
 176     return VNET_API_ERROR_SYSCALL_ERROR_1;
 177
 178   spd_index = p[0];
 179   spd = pool_elt_at_index (im->spds, spd_index);
 180   if (!spd)
 181     return VNET_API_ERROR_SYSCALL_ERROR_1;
 182
 183   if (is_add)
 184     {
 185       u32 policy_index;
 186
 187       pool_get (spd->policies, vp);
 188       clib_memcpy (vp, policy, sizeof (*vp));
 189       policy_index = vp - spd->policies;
 190
 191       ipsec_main.spd_to_sort = spd;
 192
 193       if (policy->is_outbound)
 194         {
 195           if (policy->is_ipv6)
 196             {
 197               vec_add1 (spd->ipv6_outbound_policies, policy_index);
 198               clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 199               vec_sort_with_function (spd->ipv6_outbound_policies,
 200                                       ipsec_spd_entry_sort);
 201             }
 202           else
 203             {
 204               vec_add1 (spd->ipv4_outbound_policies, policy_index);
 205               clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 206               vec_sort_with_function (spd->ipv4_outbound_policies,
 207                                       ipsec_spd_entry_sort);
 208             }
 209         }
 210       else
 211         {
 212           if (policy->is_ipv6)
 213             {
 214               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 215                 {
 216                   vec_add1 (spd->ipv6_inbound_protect_policy_indices,
 217                             policy_index);
 218                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 219                   vec_sort_with_function
 220                     (spd->ipv6_inbound_protect_policy_indices,
 221                      ipsec_spd_entry_sort);
 222                 }
 223               else
 224                 {
 225                   vec_add1
 226                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 227                      policy_index);
 228                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 229                   vec_sort_with_function
 230                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 231                      ipsec_spd_entry_sort);
 232                 }
 233             }
 234           else
 235             {
 236               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 237                 {
 238                   vec_add1 (spd->ipv4_inbound_protect_policy_indices,
 239                             policy_index);
 240                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 241                   vec_sort_with_function
 242                     (spd->ipv4_inbound_protect_policy_indices,
 243                      ipsec_spd_entry_sort);
 244                 }
 245               else
 246                 {
 247                   vec_add1
 248                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 249                      policy_index);
 250                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 251                   vec_sort_with_function
 252                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 253                      ipsec_spd_entry_sort);
 254                 }
 255             }
 256         }
 257
 258       ipsec_main.spd_to_sort = NULL;
 259     }
 260   else
 261     {
 262       u32 i, j;
 263       /* *INDENT-OFF* */
 264       pool_foreach_index(i, spd->policies, ({
 265         vp = pool_elt_at_index(spd->policies, i);
 266         if (vp->priority != policy->priority)
 267           continue;
 268         if (vp->is_outbound != policy->is_outbound)
 269           continue;
 270         if (vp->policy != policy->policy)
 271           continue;
 272         if (vp->sa_id != policy->sa_id)
 273           continue;
 274         if (vp->protocol != policy->protocol)
 275           continue;
 276         if (vp->lport.start != policy->lport.start)
 277           continue;
 278         if (vp->lport.stop != policy->lport.stop)
 279           continue;
 280         if (vp->rport.start != policy->rport.start)
 281           continue;
 282         if (vp->rport.stop != policy->rport.stop)
 283           continue;
 284         if (vp->is_ipv6 != policy->is_ipv6)
 285           continue;
 286         if (policy->is_ipv6)
 287           {
 288             if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
 289               continue;
 290             if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
 291               continue;
 292             if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
 293               continue;
 294             if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 295               continue;
 296             if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
 297               continue;
 298             if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
 299               continue;
 300             if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
 301               continue;
 302            if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 303               continue;
 304            if (policy->is_outbound)
 305              {
 306                vec_foreach_index(j, spd->ipv6_outbound_policies) {
 307                  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
 308                    vec_del1 (spd->ipv6_outbound_policies, j);
 309                    break;
 310                  }
 311                }
 312              }
 313            else
 314              {
 315                if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 316                  {
 317                    vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
 318                      if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
 319                        vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
 320                        break;
 321                      }
 322                    }
 323                  }
 324                else
 325                  {
 326                    vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
 327                      if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
 328                        vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
 329                        break;
 330                      }
 331                    }
 332                  }
 333              }
 334           }
 335         else
 336           {
 337             if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
 338               continue;
 339             if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
 340               continue;
 341             if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
 342               continue;
 343             if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
 344               continue;
 345             if (policy->is_outbound)
 346               {
 347                 vec_foreach_index(j, spd->ipv4_outbound_policies) {
 348                   if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
 349                     vec_del1 (spd->ipv4_outbound_policies, j);
 350                     break;
 351                   }
 352                 }
 353               }
 354             else
 355               {
 356                 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 357                   {
 358                     vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
 359                       if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
 360                         vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
 361                         break;
 362                       }
 363                     }
 364                   }
 365                 else
 366                   {
 367                     vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
 368                       if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
 369                         vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
 370                         break;
 371                       }
 372                     }
 373                   }
 374               }
 375           }
 376           pool_put (spd->policies, vp);
 377           break;
 378       }));
 379       /* *INDENT-ON* */
 380     }
 381
 382   return 0;
 383 }
 384
 385 u8
 386 ipsec_is_sa_used (u32 sa_index)
 387 {
 388   ipsec_main_t *im = &ipsec_main;
 389   ipsec_spd_t *spd;
 390   ipsec_policy_t *p;
 391   ipsec_tunnel_if_t *t;
 392
 393   /* *INDENT-OFF* */
 394   pool_foreach(spd, im->spds, ({
 395     pool_foreach(p, spd->policies, ({
 396       if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
 397         {
 398           if (p->sa_index == sa_index)
 399             return 1;
 400         }
 401     }));
 402   }));
 403
 404   pool_foreach(t, im->tunnel_interfaces, ({
 405     if (t->input_sa_index == sa_index)
 406       return 1;
 407     if (t->output_sa_index == sa_index)
 408       return 1;
 409   }));
 410   /* *INDENT-ON* */
 411
 412   return 0;
 413 }
 414
 415 clib_error_t *
 416 ipsec_call_add_del_callbacks (ipsec_main_t * im, ipsec_sa_t * sa,
 417                               u32 sa_index, int is_add)
 418 {
 419   ipsec_ah_backend_t *ab;
 420   ipsec_esp_backend_t *eb;
 421   switch (sa->protocol)
 422     {
 423     case IPSEC_PROTOCOL_AH:
 424       ab = pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 425       if (ab->add_del_sa_sess_cb)
 426         return ab->add_del_sa_sess_cb (sa_index, is_add);
 427       break;
 428     case IPSEC_PROTOCOL_ESP:
 429       eb = pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 430       if (eb->add_del_sa_sess_cb)
 431         return eb->add_del_sa_sess_cb (sa_index, is_add);
 432       break;
 433     }
 434   return 0;
 435 }
 436
 437 int
 438 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
 439 {
 440   ipsec_main_t *im = &ipsec_main;
 441   ipsec_sa_t *sa = 0;
 442   uword *p;
 443   u32 sa_index;
 444   clib_error_t *err;
 445
 446   clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
 447
 448   p = hash_get (im->sa_index_by_sa_id, new_sa->id);
 449   if (p && is_add)
 450     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* already exists */
 451   if (!p && !is_add)
 452     return VNET_API_ERROR_SYSCALL_ERROR_1;
 453
 454   if (!is_add)                  /* delete */
 455     {
 456       sa_index = p[0];
 457       sa = pool_elt_at_index (im->sad, sa_index);
 458       if (ipsec_is_sa_used (sa_index))
 459         {
 460           clib_warning ("sa_id %u used in policy", sa->id);
 461           return VNET_API_ERROR_SYSCALL_ERROR_1;        /* sa used in policy */
 462         }
 463       hash_unset (im->sa_index_by_sa_id, sa->id);
 464       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
 465       if (err)
 466         return VNET_API_ERROR_SYSCALL_ERROR_1;
 467       pool_put (im->sad, sa);
 468     }
 469   else                          /* create new SA */
 470     {
 471       pool_get (im->sad, sa);
 472       clib_memcpy (sa, new_sa, sizeof (*sa));
 473       sa_index = sa - im->sad;
 474       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
 475       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 1);
 476       if (err)
 477         return VNET_API_ERROR_SYSCALL_ERROR_1;
 478     }
 479   return 0;
 480 }
 481
 482 int
 483 ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
 484 {
 485   ipsec_main_t *im = &ipsec_main;
 486   uword *p;
 487   u32 sa_index;
 488   ipsec_sa_t *sa = 0;
 489   clib_error_t *err;
 490
 491   p = hash_get (im->sa_index_by_sa_id, sa_update->id);
 492   if (!p)
 493     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such sa-id */
 494
 495   sa_index = p[0];
 496   sa = pool_elt_at_index (im->sad, sa_index);
 497
 498   /* new crypto key */
 499   if (0 < sa_update->crypto_key_len)
 500     {
 501       clib_memcpy (sa->crypto_key, sa_update->crypto_key,
 502                    sa_update->crypto_key_len);
 503       sa->crypto_key_len = sa_update->crypto_key_len;
 504     }
 505
 506   /* new integ key */
 507   if (0 < sa_update->integ_key_len)
 508     {
 509       clib_memcpy (sa->integ_key, sa_update->integ_key,
 510                    sa_update->integ_key_len);
 511       sa->integ_key_len = sa_update->integ_key_len;
 512     }
 513
 514   if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
 515     {
 516       err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
 517       if (err)
 518         return VNET_API_ERROR_SYSCALL_ERROR_1;
 519     }
 520
 521   return 0;
 522 }
 523
 524 static void
 525 ipsec_rand_seed (void)
 526 {
 527   struct
 528   {
 529     time_t time;
 530     pid_t pid;
 531     void *p;
 532   } seed_data;
 533
 534   seed_data.time = time (NULL);
 535   seed_data.pid = getpid ();
 536   seed_data.p = (void *) &seed_data;
 537
 538   RAND_seed ((const void *) &seed_data, sizeof (seed_data));
 539 }
 540
 541 static clib_error_t *
 542 ipsec_check_support (ipsec_sa_t * sa)
 543 {
 544   if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
 545     return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
 546   if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
 547     return clib_error_return (0, "unsupported none integ-alg");
 548
 549   return 0;
 550 }
 551
 552 clib_error_t *
 553 ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, u8 is_add)
 554 {
 555   ipsec_ah_backend_t *ah =
 556     pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 557   if (ah->add_del_sa_sess_cb)
 558     {
 559       clib_error_t *err = ah->add_del_sa_sess_cb (sa_index, is_add);
 560       if (err)
 561         return err;
 562     }
 563   ipsec_esp_backend_t *esp =
 564     pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 565   if (esp->add_del_sa_sess_cb)
 566     {
 567       clib_error_t *err = esp->add_del_sa_sess_cb (sa_index, is_add);
 568       if (err)
 569         return err;
 570     }
 571   return 0;
 572 }
 573
 574 clib_error_t *
 575 ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa)
 576 {
 577   clib_error_t *error = 0;
 578   ipsec_ah_backend_t *ah =
 579     pool_elt_at_index (im->ah_backends, im->ah_current_backend);
 580   ASSERT (ah->check_support_cb);
 581   error = ah->check_support_cb (sa);
 582   if (error)
 583     return error;
 584   ipsec_esp_backend_t *esp =
 585     pool_elt_at_index (im->esp_backends, im->esp_current_backend);
 586   ASSERT (esp->check_support_cb);
 587   error = esp->check_support_cb (sa);
 588   return error;
 589 }
 590
 591
 592 static void
 593 ipsec_add_node (vlib_main_t * vm, const char *node_name,
 594                 const char *prev_node_name, u32 * out_node_index,
 595                 u32 * out_next_index)
 596 {
 597   vlib_node_t *prev_node, *node;
 598   prev_node = vlib_get_node_by_name (vm, (u8 *) prev_node_name);
 599   ASSERT (prev_node);
 600   node = vlib_get_node_by_name (vm, (u8 *) node_name);
 601   ASSERT (node);
 602   *out_node_index = node->index;
 603   *out_next_index = vlib_node_add_next (vm, prev_node->index, node->index);
 604 }
 605
 606 u32
 607 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im,
 608                            const char *name,
 609                            const char *ah4_encrypt_node_name,
 610                            const char *ah4_decrypt_node_name,
 611                            const char *ah6_encrypt_node_name,
 612                            const char *ah6_decrypt_node_name,
 613                            check_support_cb_t ah_check_support_cb,
 614                            add_del_sa_sess_cb_t ah_add_del_sa_sess_cb)
 615 {
 616   ipsec_ah_backend_t *b;
 617   pool_get (im->ah_backends, b);
 618   b->name = format (NULL, "%s", name);
 619
 620   ipsec_add_node (vm, ah4_encrypt_node_name, "ipsec4-output",
 621                   &b->ah4_encrypt_node_index, &b->ah4_encrypt_next_index);
 622   ipsec_add_node (vm, ah4_decrypt_node_name, "ipsec4-input",
 623                   &b->ah4_decrypt_node_index, &b->ah4_decrypt_next_index);
 624   ipsec_add_node (vm, ah6_encrypt_node_name, "ipsec6-output",
 625                   &b->ah6_encrypt_node_index, &b->ah6_encrypt_next_index);
 626   ipsec_add_node (vm, ah6_decrypt_node_name, "ipsec6-input",
 627                   &b->ah6_decrypt_node_index, &b->ah6_decrypt_next_index);
 628
 629   b->check_support_cb = ah_check_support_cb;
 630   b->add_del_sa_sess_cb = ah_add_del_sa_sess_cb;
 631   return b - im->ah_backends;
 632 }
 633
 634 u32
 635 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
 636                             const char *name,
 637                             const char *esp4_encrypt_node_name,
 638                             const char *esp4_decrypt_node_name,
 639                             const char *esp6_encrypt_node_name,
 640                             const char *esp6_decrypt_node_name,
 641                             check_support_cb_t esp_check_support_cb,
 642                             add_del_sa_sess_cb_t esp_add_del_sa_sess_cb)
 643 {
 644   ipsec_esp_backend_t *b;
 645   pool_get (im->esp_backends, b);
 646   b->name = format (NULL, "%s", name);
 647
 648   ipsec_add_node (vm, esp4_encrypt_node_name, "ipsec4-output",
 649                   &b->esp4_encrypt_node_index, &b->esp4_encrypt_next_index);
 650   ipsec_add_node (vm, esp4_decrypt_node_name, "ipsec4-input",
 651                   &b->esp4_decrypt_node_index, &b->esp4_decrypt_next_index);
 652   ipsec_add_node (vm, esp6_encrypt_node_name, "ipsec6-output",
 653                   &b->esp6_encrypt_node_index, &b->esp6_encrypt_next_index);
 654   ipsec_add_node (vm, esp6_decrypt_node_name, "ipsec6-input",
 655                   &b->esp6_decrypt_node_index, &b->esp6_decrypt_next_index);
 656
 657   b->check_support_cb = esp_check_support_cb;
 658   b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb;
 659   return b - im->esp_backends;
 660 }
 661
 662 int
 663 ipsec_select_ah_backend (ipsec_main_t * im, u32 backend_idx)
 664 {
 665   if (pool_elts (im->sad) > 0
 666       || pool_is_free_index (im->ah_backends, backend_idx))
 667     {
 668       return -1;
 669     }
 670   ipsec_ah_backend_t *b = pool_elt_at_index (im->ah_backends, backend_idx);
 671   im->ah_current_backend = backend_idx;
 672   im->ah4_encrypt_node_index = b->ah4_encrypt_node_index;
 673   im->ah4_decrypt_node_index = b->ah4_decrypt_node_index;
 674   im->ah4_encrypt_next_index = b->ah4_encrypt_next_index;
 675   im->ah4_decrypt_next_index = b->ah4_decrypt_next_index;
 676   im->ah6_encrypt_node_index = b->ah6_encrypt_node_index;
 677   im->ah6_decrypt_node_index = b->ah6_decrypt_node_index;
 678   im->ah6_encrypt_next_index = b->ah6_encrypt_next_index;
 679   im->ah6_decrypt_next_index = b->ah6_decrypt_next_index;
 680   return 0;
 681 }
 682
 683 int
 684 ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
 685 {
 686   if (pool_elts (im->sad) > 0
 687       || pool_is_free_index (im->esp_backends, backend_idx))
 688     {
 689       return -1;
 690     }
 691   ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx);
 692   im->esp_current_backend = backend_idx;
 693   im->esp4_encrypt_node_index = b->esp4_encrypt_node_index;
 694   im->esp4_decrypt_node_index = b->esp4_decrypt_node_index;
 695   im->esp4_encrypt_next_index = b->esp4_encrypt_next_index;
 696   im->esp4_decrypt_next_index = b->esp4_decrypt_next_index;
 697   im->esp6_encrypt_node_index = b->esp6_encrypt_node_index;
 698   im->esp6_decrypt_node_index = b->esp6_decrypt_node_index;
 699   im->esp6_encrypt_next_index = b->esp6_encrypt_next_index;
 700   im->esp6_decrypt_next_index = b->esp6_decrypt_next_index;
 701   return 0;
 702 }
 703
 704 static clib_error_t *
 705 ipsec_init (vlib_main_t * vm)
 706 {
 707   clib_error_t *error;
 708   ipsec_main_t *im = &ipsec_main;
 709   vlib_thread_main_t *tm = vlib_get_thread_main ();
 710
 711   ipsec_rand_seed ();
 712
 713   clib_memset (im, 0, sizeof (im[0]));
 714
 715   im->vnet_main = vnet_get_main ();
 716   im->vlib_main = vm;
 717
 718   im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
 719   im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
 720   im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
 721
 722   vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1,
 723                         CLIB_CACHE_LINE_BYTES);
 724
 725   vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
 726   ASSERT (node);
 727   im->error_drop_node_index = node->index;
 728
 729   u32 idx = ipsec_register_ah_backend (vm, im, "default openssl backend",
 730                                        "ah4-encrypt",
 731                                        "ah4-decrypt",
 732                                        "ah6-encrypt",
 733                                        "ah6-decrypt",
 734                                        ipsec_check_support,
 735                                        NULL);
 736
 737   im->ah_default_backend = idx;
 738   int rv = ipsec_select_ah_backend (im, idx);
 739   ASSERT (0 == rv);
 740   (void) (rv);                  // avoid warning
 741
 742   idx = ipsec_register_esp_backend (vm, im, "default openssl backend",
 743                                     "esp4-encrypt",
 744                                     "esp4-decrypt",
 745                                     "esp6-encrypt",
 746                                     "esp6-decrypt",
 747                                     ipsec_check_support, NULL);
 748   im->esp_default_backend = idx;
 749
 750   rv = ipsec_select_esp_backend (im, idx);
 751   ASSERT (0 == rv);
 752   (void) (rv);                  // avoid warning
 753
 754   if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
 755     return error;
 756
 757   if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
 758     return error;
 759
 760   ipsec_proto_init ();
 761
 762   if ((error = ikev2_init (vm)))
 763     return error;
 764
 765   return 0;
 766 }
 767
 768 VLIB_INIT_FUNCTION (ipsec_init);
 769
 770 /*
 771  * fd.io coding-style-patch-verification: ON
 772  *
 773  * Local Variables:
 774  * eval: (c-set-style "gnu")
 775  * End:
 776  */