2 *------------------------------------------------------------------
3 * ipsec_api.c - ipsec api
5 * Copyright (c) 2016 Cisco and/or its affiliates.
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at:
10 * http://www.apache.org/licenses/LICENSE-2.0
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
17 *------------------------------------------------------------------
20 #include <vnet/vnet.h>
21 #include <vlibmemory/api.h>
23 #include <vnet/interface.h>
24 #include <vnet/api_errno.h>
25 #include <vnet/ip/ip.h>
26 #include <vnet/ip/ip_types_api.h>
27 #include <vnet/ipsec/ipsec_types_api.h>
28 #include <vnet/tunnel/tunnel_types_api.h>
29 #include <vnet/fib/fib.h>
30 #include <vnet/ipip/ipip.h>
31 #include <vnet/tunnel/tunnel_types_api.h>
33 #include <vnet/vnet_msg_enum.h>
36 #include <vnet/ipsec/ipsec.h>
37 #include <vnet/ipsec/ipsec_tun.h>
38 #include <vnet/ipsec/ipsec_itf.h>
41 #define vl_typedefs /* define message structures */
42 #include <vnet/vnet_all_api_h.h>
45 #define vl_endianfun /* define message structures */
46 #include <vnet/vnet_all_api_h.h>
49 /* instantiate all the print functions we know about */
50 #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
52 #include <vnet/vnet_all_api_h.h>
55 #include <vlibapi/api_helper_macros.h>
57 #define foreach_vpe_api_msg \
58 _ (IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
59 _ (IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
60 _ (IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \
61 _ (IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \
62 _ (IPSEC_SAD_ENTRY_ADD_DEL_V2, ipsec_sad_entry_add_del_v2) \
63 _ (IPSEC_SAD_ENTRY_ADD_DEL_V3, ipsec_sad_entry_add_del_v3) \
64 _ (IPSEC_SA_DUMP, ipsec_sa_dump) \
65 _ (IPSEC_SA_V2_DUMP, ipsec_sa_v2_dump) \
66 _ (IPSEC_SA_V3_DUMP, ipsec_sa_v3_dump) \
67 _ (IPSEC_SPDS_DUMP, ipsec_spds_dump) \
68 _ (IPSEC_SPD_DUMP, ipsec_spd_dump) \
69 _ (IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \
70 _ (IPSEC_ITF_CREATE, ipsec_itf_create) \
71 _ (IPSEC_ITF_DELETE, ipsec_itf_delete) \
72 _ (IPSEC_ITF_DUMP, ipsec_itf_dump) \
73 _ (IPSEC_SELECT_BACKEND, ipsec_select_backend) \
74 _ (IPSEC_BACKEND_DUMP, ipsec_backend_dump) \
75 _ (IPSEC_TUNNEL_PROTECT_UPDATE, ipsec_tunnel_protect_update) \
76 _ (IPSEC_TUNNEL_PROTECT_DEL, ipsec_tunnel_protect_del) \
77 _ (IPSEC_TUNNEL_PROTECT_DUMP, ipsec_tunnel_protect_dump) \
78 _ (IPSEC_SET_ASYNC_MODE, ipsec_set_async_mode)
81 vl_api_ipsec_spd_add_del_t_handler (vl_api_ipsec_spd_add_del_t * mp)
84 clib_warning ("unimplemented");
87 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
88 vl_api_ipsec_spd_add_del_reply_t *rmp;
91 rv = ipsec_add_del_spd (vm, ntohl (mp->spd_id), mp->is_add);
93 REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_REPLY);
97 static void vl_api_ipsec_interface_add_del_spd_t_handler
98 (vl_api_ipsec_interface_add_del_spd_t * mp)
100 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
101 vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
103 u32 sw_if_index __attribute__ ((unused));
104 u32 spd_id __attribute__ ((unused));
106 sw_if_index = ntohl (mp->sw_if_index);
107 spd_id = ntohl (mp->spd_id);
109 VALIDATE_SW_IF_INDEX (mp);
112 rv = ipsec_set_interface_spd (vm, sw_if_index, spd_id, mp->is_add);
114 rv = VNET_API_ERROR_UNIMPLEMENTED;
117 BAD_SW_IF_INDEX_LABEL;
119 REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
122 static void vl_api_ipsec_tunnel_protect_update_t_handler
123 (vl_api_ipsec_tunnel_protect_update_t * mp)
125 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
126 vl_api_ipsec_tunnel_protect_update_reply_t *rmp;
127 u32 sw_if_index, ii, *sa_ins = NULL;
131 sw_if_index = ntohl (mp->tunnel.sw_if_index);
133 VALIDATE_SW_IF_INDEX (&(mp->tunnel));
137 for (ii = 0; ii < mp->tunnel.n_sa_in; ii++)
138 vec_add1 (sa_ins, ntohl (mp->tunnel.sa_in[ii]));
140 ip_address_decode2 (&mp->tunnel.nh, &nh);
142 rv = ipsec_tun_protect_update (sw_if_index, &nh,
143 ntohl (mp->tunnel.sa_out), sa_ins);
145 rv = VNET_API_ERROR_UNIMPLEMENTED;
148 BAD_SW_IF_INDEX_LABEL;
150 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_UPDATE_REPLY);
153 static void vl_api_ipsec_tunnel_protect_del_t_handler
154 (vl_api_ipsec_tunnel_protect_del_t * mp)
156 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
157 vl_api_ipsec_tunnel_protect_del_reply_t *rmp;
162 sw_if_index = ntohl (mp->sw_if_index);
164 VALIDATE_SW_IF_INDEX (mp);
167 ip_address_decode2 (&mp->nh, &nh);
168 rv = ipsec_tun_protect_del (sw_if_index, &nh);
170 rv = VNET_API_ERROR_UNIMPLEMENTED;
173 BAD_SW_IF_INDEX_LABEL;
175 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_DEL_REPLY);
178 typedef struct ipsec_dump_walk_ctx_t_
180 vl_api_registration_t *reg;
182 } ipsec_dump_walk_ctx_t;
185 send_ipsec_tunnel_protect_details (index_t itpi, void *arg)
187 ipsec_dump_walk_ctx_t *ctx = arg;
188 vl_api_ipsec_tunnel_protect_details_t *mp;
189 ipsec_tun_protect_t *itp;
193 itp = ipsec_tun_protect_get (itpi);
195 mp = vl_msg_api_alloc (sizeof (*mp) + (sizeof (u32) * itp->itp_n_sa_in));
196 clib_memset (mp, 0, sizeof (*mp));
197 mp->_vl_msg_id = ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS);
198 mp->context = ctx->context;
200 mp->tun.sw_if_index = htonl (itp->itp_sw_if_index);
201 ip_address_encode2 (itp->itp_key, &mp->tun.nh);
203 sa = ipsec_sa_get (itp->itp_out_sa);
204 mp->tun.sa_out = htonl (sa->id);
205 mp->tun.n_sa_in = itp->itp_n_sa_in;
207 FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
209 mp->tun.sa_in[ii++] = htonl (sa->id);
213 vl_api_send_msg (ctx->reg, (u8 *) mp);
215 return (WALK_CONTINUE);
219 vl_api_ipsec_tunnel_protect_dump_t_handler (vl_api_ipsec_tunnel_protect_dump_t
222 vl_api_registration_t *reg;
226 reg = vl_api_client_index_to_registration (mp->client_index);
230 ipsec_dump_walk_ctx_t ctx = {
232 .context = mp->context,
235 sw_if_index = ntohl (mp->sw_if_index);
237 if (~0 == sw_if_index)
239 ipsec_tun_protect_walk (send_ipsec_tunnel_protect_details, &ctx);
243 ipsec_tun_protect_walk_itf (sw_if_index,
244 send_ipsec_tunnel_protect_details, &ctx);
247 clib_warning ("unimplemented");
252 ipsec_spd_action_decode (vl_api_ipsec_spd_action_t in,
253 ipsec_policy_action_t * out)
255 in = clib_net_to_host_u32 (in);
259 #define _(v,f,s) case IPSEC_API_SPD_ACTION_##f: \
260 *out = IPSEC_POLICY_ACTION_##f; \
262 foreach_ipsec_policy_action
265 return (VNET_API_ERROR_UNIMPLEMENTED);
268 static void vl_api_ipsec_spd_entry_add_del_t_handler
269 (vl_api_ipsec_spd_entry_add_del_t * mp)
271 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
272 vl_api_ipsec_spd_entry_add_del_reply_t *rmp;
282 clib_memset (&p, 0, sizeof (p));
284 p.id = ntohl (mp->entry.spd_id);
285 p.priority = ntohl (mp->entry.priority);
287 itype = ip_address_decode (&mp->entry.remote_address_start, &p.raddr.start);
288 ip_address_decode (&mp->entry.remote_address_stop, &p.raddr.stop);
289 ip_address_decode (&mp->entry.local_address_start, &p.laddr.start);
290 ip_address_decode (&mp->entry.local_address_stop, &p.laddr.stop);
292 p.is_ipv6 = (itype == IP46_TYPE_IP6);
294 p.protocol = mp->entry.protocol;
295 p.rport.start = ntohs (mp->entry.remote_port_start);
296 p.rport.stop = ntohs (mp->entry.remote_port_stop);
297 p.lport.start = ntohs (mp->entry.local_port_start);
298 p.lport.stop = ntohs (mp->entry.local_port_stop);
300 rv = ipsec_spd_action_decode (mp->entry.policy, &p.policy);
305 /* policy action resolve unsupported */
306 if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
308 clib_warning ("unsupported action: 'resolve'");
309 rv = VNET_API_ERROR_UNIMPLEMENTED;
312 p.sa_id = ntohl (mp->entry.sa_id);
314 ipsec_policy_mk_type (mp->entry.is_outbound, p.is_ipv6, p.policy,
319 rv = ipsec_add_del_policy (vm, &p, mp->is_add, &stat_index);
324 rv = VNET_API_ERROR_UNIMPLEMENTED;
330 REPLY_MACRO2 (VL_API_IPSEC_SPD_ENTRY_ADD_DEL_REPLY,
332 rmp->stat_index = ntohl(stat_index);
337 static void vl_api_ipsec_sad_entry_add_del_t_handler
338 (vl_api_ipsec_sad_entry_add_del_t * mp)
340 vl_api_ipsec_sad_entry_add_del_reply_t *rmp;
341 ipsec_key_t crypto_key, integ_key;
342 ipsec_crypto_alg_t crypto_alg;
343 ipsec_integ_alg_t integ_alg;
344 ipsec_protocol_t proto;
345 ipsec_sa_flags_t flags;
346 u32 id, spi, sa_index = ~0;
348 .t_flags = TUNNEL_FLAG_NONE,
349 .t_encap_decap_flags = TUNNEL_ENCAP_DECAP_FLAG_NONE,
351 .t_mode = TUNNEL_MODE_P2P,
359 id = ntohl (mp->entry.sad_id);
360 spi = ntohl (mp->entry.spi);
362 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
367 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
372 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
377 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
378 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
380 flags = ipsec_sa_flags_decode (mp->entry.flags);
382 ip_address_decode2 (&mp->entry.tunnel_src, &tun.t_src);
383 ip_address_decode2 (&mp->entry.tunnel_dst, &tun.t_dst);
386 rv = ipsec_sa_add_and_lock (
387 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
388 mp->entry.salt, htons (mp->entry.udp_src_port),
389 htons (mp->entry.udp_dst_port), &tun, &sa_index);
391 rv = ipsec_sa_unlock_id (id);
394 rv = VNET_API_ERROR_UNIMPLEMENTED;
399 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_REPLY,
401 rmp->stat_index = htonl (sa_index);
406 static void vl_api_ipsec_sad_entry_add_del_v2_t_handler
407 (vl_api_ipsec_sad_entry_add_del_v2_t * mp)
409 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
410 vl_api_ipsec_sad_entry_add_del_v2_reply_t *rmp;
411 ipsec_key_t crypto_key, integ_key;
412 ipsec_crypto_alg_t crypto_alg;
413 ipsec_integ_alg_t integ_alg;
414 ipsec_protocol_t proto;
415 ipsec_sa_flags_t flags;
416 u32 id, spi, sa_index = ~0;
419 .t_flags = TUNNEL_FLAG_NONE,
420 .t_encap_decap_flags = TUNNEL_ENCAP_DECAP_FLAG_NONE,
422 .t_mode = TUNNEL_MODE_P2P,
423 .t_table_id = htonl (mp->entry.tx_table_id),
429 id = ntohl (mp->entry.sad_id);
430 spi = ntohl (mp->entry.spi);
432 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
437 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
442 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
447 rv = tunnel_encap_decap_flags_decode (mp->entry.tunnel_flags,
448 &tun.t_encap_decap_flags);
453 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
454 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
456 flags = ipsec_sa_flags_decode (mp->entry.flags);
457 tun.t_dscp = ip_dscp_decode (mp->entry.dscp);
459 ip_address_decode2 (&mp->entry.tunnel_src, &tun.t_src);
460 ip_address_decode2 (&mp->entry.tunnel_dst, &tun.t_dst);
463 rv = ipsec_sa_add_and_lock (
464 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
465 mp->entry.salt, htons (mp->entry.udp_src_port),
466 htons (mp->entry.udp_dst_port), &tun, &sa_index);
468 rv = ipsec_sa_unlock_id (id);
471 rv = VNET_API_ERROR_UNIMPLEMENTED;
476 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_V2_REPLY,
478 rmp->stat_index = htonl (sa_index);
484 vl_api_ipsec_sad_entry_add_del_v3_t_handler (
485 vl_api_ipsec_sad_entry_add_del_v3_t *mp)
487 vl_api_ipsec_sad_entry_add_del_v3_reply_t *rmp;
488 ipsec_key_t crypto_key, integ_key;
489 ipsec_crypto_alg_t crypto_alg;
490 ipsec_integ_alg_t integ_alg;
491 ipsec_protocol_t proto;
492 ipsec_sa_flags_t flags;
493 u32 id, spi, sa_index = ~0;
499 id = ntohl (mp->entry.sad_id);
500 spi = ntohl (mp->entry.spi);
502 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
507 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
512 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
517 flags = ipsec_sa_flags_decode (mp->entry.flags);
519 if (flags & IPSEC_SA_FLAG_IS_TUNNEL)
521 rv = tunnel_decode (&mp->entry.tunnel, &tun);
527 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
528 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
531 rv = ipsec_sa_add_and_lock (
532 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
533 mp->entry.salt, htons (mp->entry.udp_src_port),
534 htons (mp->entry.udp_dst_port), &tun, &sa_index);
536 rv = ipsec_sa_unlock_id (id);
539 rv = VNET_API_ERROR_UNIMPLEMENTED;
543 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_V3_REPLY,
544 { rmp->stat_index = htonl (sa_index); });
548 send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg,
551 vl_api_ipsec_spds_details_t *mp;
554 mp = vl_msg_api_alloc (sizeof (*mp));
555 clib_memset (mp, 0, sizeof (*mp));
556 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
557 mp->context = context;
559 mp->spd_id = htonl (spd->id);
560 #define _(s, n) n_policies += vec_len (spd->policies[IPSEC_SPD_POLICY_##s]);
561 foreach_ipsec_spd_policy_type
563 mp->npolicies = htonl (n_policies);
565 vl_api_send_msg (reg, (u8 *) mp);
569 vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp)
571 vl_api_registration_t *reg;
572 ipsec_main_t *im = &ipsec_main;
575 reg = vl_api_client_index_to_registration (mp->client_index);
580 pool_foreach (spd, im->spds) {
581 send_ipsec_spds_details (spd, reg, mp->context);
585 clib_warning ("unimplemented");
589 vl_api_ipsec_spd_action_t
590 ipsec_spd_action_encode (ipsec_policy_action_t in)
592 vl_api_ipsec_spd_action_t out = IPSEC_API_SPD_ACTION_BYPASS;
596 #define _(v,f,s) case IPSEC_POLICY_ACTION_##f: \
597 out = IPSEC_API_SPD_ACTION_##f; \
599 foreach_ipsec_policy_action
602 return (clib_host_to_net_u32 (out));
606 send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
609 vl_api_ipsec_spd_details_t *mp;
611 mp = vl_msg_api_alloc (sizeof (*mp));
612 clib_memset (mp, 0, sizeof (*mp));
613 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
614 mp->context = context;
616 mp->entry.spd_id = htonl (p->id);
617 mp->entry.priority = htonl (p->priority);
618 mp->entry.is_outbound = ((p->type == IPSEC_SPD_POLICY_IP6_OUTBOUND) ||
619 (p->type == IPSEC_SPD_POLICY_IP4_OUTBOUND));
621 ip_address_encode (&p->laddr.start, IP46_TYPE_ANY,
622 &mp->entry.local_address_start);
623 ip_address_encode (&p->laddr.stop, IP46_TYPE_ANY,
624 &mp->entry.local_address_stop);
625 ip_address_encode (&p->raddr.start, IP46_TYPE_ANY,
626 &mp->entry.remote_address_start);
627 ip_address_encode (&p->raddr.stop, IP46_TYPE_ANY,
628 &mp->entry.remote_address_stop);
629 mp->entry.local_port_start = htons (p->lport.start);
630 mp->entry.local_port_stop = htons (p->lport.stop);
631 mp->entry.remote_port_start = htons (p->rport.start);
632 mp->entry.remote_port_stop = htons (p->rport.stop);
633 mp->entry.protocol = p->protocol;
634 mp->entry.policy = ipsec_spd_action_encode (p->policy);
635 mp->entry.sa_id = htonl (p->sa_id);
637 vl_api_send_msg (reg, (u8 *) mp);
641 vl_api_ipsec_spd_dump_t_handler (vl_api_ipsec_spd_dump_t * mp)
643 vl_api_registration_t *reg;
644 ipsec_main_t *im = &ipsec_main;
645 ipsec_spd_policy_type_t ptype;
646 ipsec_policy_t *policy;
651 reg = vl_api_client_index_to_registration (mp->client_index);
655 p = hash_get (im->spd_index_by_spd_id, ntohl (mp->spd_id));
660 spd = pool_elt_at_index (im->spds, spd_index);
663 FOR_EACH_IPSEC_SPD_POLICY_TYPE(ptype) {
664 vec_foreach(ii, spd->policies[ptype])
666 policy = pool_elt_at_index(im->policies, *ii);
668 if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == policy->sa_id)
669 send_ipsec_spd_details (policy, reg, mp->context);
674 clib_warning ("unimplemented");
679 send_ipsec_spd_interface_details (vl_api_registration_t * reg, u32 spd_index,
680 u32 sw_if_index, u32 context)
682 vl_api_ipsec_spd_interface_details_t *mp;
684 mp = vl_msg_api_alloc (sizeof (*mp));
685 clib_memset (mp, 0, sizeof (*mp));
686 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
687 mp->context = context;
689 mp->spd_index = htonl (spd_index);
690 mp->sw_if_index = htonl (sw_if_index);
692 vl_api_send_msg (reg, (u8 *) mp);
696 vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t *
699 ipsec_main_t *im = &ipsec_main;
700 vl_api_registration_t *reg;
704 reg = vl_api_client_index_to_registration (mp->client_index);
708 if (mp->spd_index_valid)
710 spd_index = ntohl (mp->spd_index);
712 hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
714 send_ipsec_spd_interface_details(reg, v, k, mp->context);
721 hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
722 send_ipsec_spd_interface_details(reg, v, k, mp->context);
728 clib_warning ("unimplemented");
733 vl_api_ipsec_itf_create_t_handler (vl_api_ipsec_itf_create_t * mp)
735 vl_api_ipsec_itf_create_reply_t *rmp;
737 u32 sw_if_index = ~0;
740 rv = tunnel_mode_decode (mp->itf.mode, &mode);
743 rv = ipsec_itf_create (ntohl (mp->itf.user_instance), mode, &sw_if_index);
746 REPLY_MACRO2 (VL_API_IPSEC_ITF_CREATE_REPLY,
748 rmp->sw_if_index = htonl (sw_if_index);
754 vl_api_ipsec_itf_delete_t_handler (vl_api_ipsec_itf_delete_t * mp)
756 vl_api_ipsec_itf_delete_reply_t *rmp;
759 rv = ipsec_itf_delete (ntohl (mp->sw_if_index));
761 REPLY_MACRO (VL_API_IPSEC_ITF_DELETE_REPLY);
765 vl_api_ipsec_itf_dump_t_handler (vl_api_ipsec_itf_dump_t * mp)
769 typedef struct ipsec_sa_dump_match_ctx_t_
773 } ipsec_sa_dump_match_ctx_t;
776 ipsec_sa_dump_match_sa (index_t itpi, void *arg)
778 ipsec_sa_dump_match_ctx_t *ctx = arg;
779 ipsec_tun_protect_t *itp;
782 itp = ipsec_tun_protect_get (itpi);
784 if (itp->itp_out_sa == ctx->sai)
786 ctx->sw_if_index = itp->itp_sw_if_index;
790 FOR_EACH_IPSEC_PROTECT_INPUT_SAI (itp, sai,
794 ctx->sw_if_index = itp->itp_sw_if_index;
800 return (WALK_CONTINUE);
804 send_ipsec_sa_details (ipsec_sa_t * sa, void *arg)
806 ipsec_dump_walk_ctx_t *ctx = arg;
807 vl_api_ipsec_sa_details_t *mp;
809 mp = vl_msg_api_alloc (sizeof (*mp));
810 clib_memset (mp, 0, sizeof (*mp));
811 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
812 mp->context = ctx->context;
814 mp->entry.sad_id = htonl (sa->id);
815 mp->entry.spi = htonl (sa->spi);
816 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
817 mp->entry.tx_table_id = htonl (sa->tunnel.t_table_id);
819 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
820 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
822 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
823 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
825 mp->entry.flags = ipsec_sad_flags_encode (sa);
826 mp->entry.salt = clib_host_to_net_u32 (sa->salt);
828 if (ipsec_sa_is_set_IS_PROTECT (sa))
830 ipsec_sa_dump_match_ctx_t ctx = {
831 .sai = sa - ipsec_sa_pool,
834 ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
836 mp->sw_if_index = htonl (ctx.sw_if_index);
839 mp->sw_if_index = ~0;
841 if (ipsec_sa_is_set_IS_TUNNEL (sa))
843 ip_address_encode2 (&sa->tunnel.t_src, &mp->entry.tunnel_src);
844 ip_address_encode2 (&sa->tunnel.t_dst, &mp->entry.tunnel_dst);
846 if (ipsec_sa_is_set_UDP_ENCAP (sa))
848 mp->entry.udp_src_port = sa->udp_hdr.src_port;
849 mp->entry.udp_dst_port = sa->udp_hdr.dst_port;
852 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
853 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
854 if (ipsec_sa_is_set_USE_ESN (sa))
856 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
857 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
859 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
860 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
862 mp->stat_index = clib_host_to_net_u32 (sa->stat_index);
864 vl_api_send_msg (ctx->reg, (u8 *) mp);
866 return (WALK_CONTINUE);
870 vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp)
872 vl_api_registration_t *reg;
875 reg = vl_api_client_index_to_registration (mp->client_index);
879 ipsec_dump_walk_ctx_t ctx = {
881 .context = mp->context,
884 ipsec_sa_walk (send_ipsec_sa_details, &ctx);
887 clib_warning ("unimplemented");
892 send_ipsec_sa_v2_details (ipsec_sa_t * sa, void *arg)
894 ipsec_dump_walk_ctx_t *ctx = arg;
895 vl_api_ipsec_sa_v2_details_t *mp;
897 mp = vl_msg_api_alloc (sizeof (*mp));
898 clib_memset (mp, 0, sizeof (*mp));
899 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_V2_DETAILS);
900 mp->context = ctx->context;
902 mp->entry.sad_id = htonl (sa->id);
903 mp->entry.spi = htonl (sa->spi);
904 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
905 mp->entry.tx_table_id = htonl (sa->tunnel.t_table_id);
907 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
908 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
910 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
911 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
913 mp->entry.flags = ipsec_sad_flags_encode (sa);
914 mp->entry.salt = clib_host_to_net_u32 (sa->salt);
916 if (ipsec_sa_is_set_IS_PROTECT (sa))
918 ipsec_sa_dump_match_ctx_t ctx = {
919 .sai = sa - ipsec_sa_pool,
922 ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
924 mp->sw_if_index = htonl (ctx.sw_if_index);
927 mp->sw_if_index = ~0;
929 if (ipsec_sa_is_set_IS_TUNNEL (sa))
931 ip_address_encode2 (&sa->tunnel.t_src, &mp->entry.tunnel_src);
932 ip_address_encode2 (&sa->tunnel.t_dst, &mp->entry.tunnel_dst);
934 if (ipsec_sa_is_set_UDP_ENCAP (sa))
936 mp->entry.udp_src_port = sa->udp_hdr.src_port;
937 mp->entry.udp_dst_port = sa->udp_hdr.dst_port;
940 mp->entry.tunnel_flags =
941 tunnel_encap_decap_flags_encode (sa->tunnel.t_encap_decap_flags);
942 mp->entry.dscp = ip_dscp_encode (sa->tunnel.t_dscp);
944 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
945 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
946 if (ipsec_sa_is_set_USE_ESN (sa))
948 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
949 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
951 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
952 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
954 mp->stat_index = clib_host_to_net_u32 (sa->stat_index);
956 vl_api_send_msg (ctx->reg, (u8 *) mp);
958 return (WALK_CONTINUE);
962 vl_api_ipsec_sa_v2_dump_t_handler (vl_api_ipsec_sa_v2_dump_t *mp)
964 vl_api_registration_t *reg;
967 reg = vl_api_client_index_to_registration (mp->client_index);
971 ipsec_dump_walk_ctx_t ctx = {
973 .context = mp->context,
976 ipsec_sa_walk (send_ipsec_sa_v2_details, &ctx);
979 clib_warning ("unimplemented");
984 send_ipsec_sa_v3_details (ipsec_sa_t *sa, void *arg)
986 ipsec_dump_walk_ctx_t *ctx = arg;
987 vl_api_ipsec_sa_v3_details_t *mp;
989 mp = vl_msg_api_alloc (sizeof (*mp));
990 clib_memset (mp, 0, sizeof (*mp));
991 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_V3_DETAILS);
992 mp->context = ctx->context;
994 mp->entry.sad_id = htonl (sa->id);
995 mp->entry.spi = htonl (sa->spi);
996 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
998 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
999 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
1001 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
1002 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
1004 mp->entry.flags = ipsec_sad_flags_encode (sa);
1005 mp->entry.salt = clib_host_to_net_u32 (sa->salt);
1007 if (ipsec_sa_is_set_IS_PROTECT (sa))
1009 ipsec_sa_dump_match_ctx_t ctx = {
1010 .sai = sa - ipsec_sa_pool,
1013 ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
1015 mp->sw_if_index = htonl (ctx.sw_if_index);
1018 mp->sw_if_index = ~0;
1020 if (ipsec_sa_is_set_IS_TUNNEL (sa))
1021 tunnel_encode (&sa->tunnel, &mp->entry.tunnel);
1023 if (ipsec_sa_is_set_UDP_ENCAP (sa))
1025 mp->entry.udp_src_port = sa->udp_hdr.src_port;
1026 mp->entry.udp_dst_port = sa->udp_hdr.dst_port;
1029 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
1030 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
1031 if (ipsec_sa_is_set_USE_ESN (sa))
1033 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
1034 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
1036 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
1037 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
1039 mp->stat_index = clib_host_to_net_u32 (sa->stat_index);
1041 vl_api_send_msg (ctx->reg, (u8 *) mp);
1043 return (WALK_CONTINUE);
1047 vl_api_ipsec_sa_v3_dump_t_handler (vl_api_ipsec_sa_v3_dump_t *mp)
1049 vl_api_registration_t *reg;
1052 reg = vl_api_client_index_to_registration (mp->client_index);
1056 ipsec_dump_walk_ctx_t ctx = {
1058 .context = mp->context,
1061 ipsec_sa_walk (send_ipsec_sa_v3_details, &ctx);
1064 clib_warning ("unimplemented");
1069 vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp)
1071 vl_api_registration_t *rp;
1072 ipsec_main_t *im = &ipsec_main;
1073 u32 context = mp->context;
1075 rp = vl_api_client_index_to_registration (mp->client_index);
1079 clib_warning ("Client %d AWOL", mp->client_index);
1083 ipsec_ah_backend_t *ab;
1084 ipsec_esp_backend_t *eb;
1086 pool_foreach (ab, im->ah_backends) {
1087 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
1088 clib_memset (mp, 0, sizeof (*mp));
1089 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
1090 mp->context = context;
1091 snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (ab->name),
1093 mp->protocol = ntohl (IPSEC_API_PROTO_AH);
1094 mp->index = ab - im->ah_backends;
1095 mp->active = mp->index == im->ah_current_backend ? 1 : 0;
1096 vl_api_send_msg (rp, (u8 *)mp);
1098 pool_foreach (eb, im->esp_backends) {
1099 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
1100 clib_memset (mp, 0, sizeof (*mp));
1101 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
1102 mp->context = context;
1103 snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (eb->name),
1105 mp->protocol = ntohl (IPSEC_API_PROTO_ESP);
1106 mp->index = eb - im->esp_backends;
1107 mp->active = mp->index == im->esp_current_backend ? 1 : 0;
1108 vl_api_send_msg (rp, (u8 *)mp);
1114 vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp)
1116 ipsec_main_t *im = &ipsec_main;
1117 vl_api_ipsec_select_backend_reply_t *rmp;
1118 ipsec_protocol_t protocol;
1120 if (pool_elts (ipsec_sa_pool) > 0)
1122 rv = VNET_API_ERROR_INSTANCE_IN_USE;
1126 rv = ipsec_proto_decode (mp->protocol, &protocol);
1134 case IPSEC_PROTOCOL_ESP:
1135 rv = ipsec_select_esp_backend (im, mp->index);
1137 case IPSEC_PROTOCOL_AH:
1138 rv = ipsec_select_ah_backend (im, mp->index);
1141 rv = VNET_API_ERROR_INVALID_PROTOCOL;
1145 clib_warning ("unimplemented"); /* FIXME */
1148 REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY);
1152 vl_api_ipsec_set_async_mode_t_handler (vl_api_ipsec_set_async_mode_t * mp)
1154 vl_api_ipsec_set_async_mode_reply_t *rmp;
1157 vnet_crypto_request_async_mode (mp->async_enable);
1158 ipsec_set_async_mode (mp->async_enable);
1160 REPLY_MACRO (VL_API_IPSEC_SET_ASYNC_MODE_REPLY);
1165 * Add vpe's API message handlers to the table.
1166 * vlib has already mapped shared memory and
1167 * added the client registration handlers.
1168 * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
1170 #define vl_msg_name_crc_list
1171 #include <vnet/vnet_all_api_h.h>
1172 #undef vl_msg_name_crc_list
1175 setup_message_id_table (api_main_t * am)
1177 #define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id);
1178 foreach_vl_msg_name_crc_ipsec;
1182 static clib_error_t *
1183 ipsec_api_hookup (vlib_main_t * vm)
1185 api_main_t *am = vlibapi_get_main ();
1188 vl_msg_api_set_handlers(VL_API_##N, #n, \
1189 vl_api_##n##_t_handler, \
1191 vl_api_##n##_t_endian, \
1192 vl_api_##n##_t_print, \
1193 sizeof(vl_api_##n##_t), 1);
1194 foreach_vpe_api_msg;
1198 * Set up the (msg_name, crc, message-id) table
1200 setup_message_id_table (am);
1205 VLIB_API_INIT_FUNCTION (ipsec_api_hookup);
1208 * fd.io coding-style-patch-verification: ON
1211 * eval: (c-set-style "gnu")