#include <vlibapi/api_helper_macros.h>
-#define foreach_vpe_api_msg \
-_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
-_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
-_(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \
-_(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \
-_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \
-_(IPSEC_SA_DUMP, ipsec_sa_dump) \
-_(IPSEC_SPD_DUMP, ipsec_spd_dump) \
-_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \
-_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \
-_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \
-_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \
-_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \
-_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \
-_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \
-_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \
-_(IKEV2_SET_RESPONDER, ikev2_set_responder) \
-_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \
-_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \
-_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \
-_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \
-_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \
-_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \
-_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa)
-
-static void vl_api_ipsec_spd_add_del_t_handler
- (vl_api_ipsec_spd_add_del_t * mp)
+#define foreach_vpe_api_msg \
+_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
+_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
+_(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \
+_(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \
+_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \
+_(IPSEC_SA_DUMP, ipsec_sa_dump) \
+_(IPSEC_SPDS_DUMP, ipsec_spds_dump) \
+_(IPSEC_SPD_DUMP, ipsec_spd_dump) \
+_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \
+_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \
+_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \
+_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \
+_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \
+_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \
+_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \
+_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \
+_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \
+_(IKEV2_SET_RESPONDER, ikev2_set_responder) \
+_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \
+_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \
+_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \
+_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \
+_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \
+_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \
+_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa) \
+_(IPSEC_SELECT_BACKEND, ipsec_select_backend) \
+_(IPSEC_BACKEND_DUMP, ipsec_backend_dump)
+
+static void
+vl_api_ipsec_spd_add_del_t_handler (vl_api_ipsec_spd_add_del_t * mp)
{
#if WITH_LIBSSL == 0
clib_warning ("unimplemented");
#if WITH_LIBSSL > 0
ipsec_policy_t p;
- memset (&p, 0, sizeof (p));
+ clib_memset (&p, 0, sizeof (p));
p.id = ntohl (mp->spd_id);
p.priority = ntohl (mp->priority);
ipsec_main_t *im = &ipsec_main;
ipsec_sa_t sa;
- memset (&sa, 0, sizeof (sa));
+ clib_memset (&sa, 0, sizeof (sa));
sa.id = ntohl (mp->sad_id);
sa.spi = ntohl (mp->spi);
sa.use_esn = mp->use_extended_sequence_number;
sa.is_tunnel = mp->is_tunnel;
sa.is_tunnel_ip6 = mp->is_tunnel_ipv6;
+ sa.udp_encap = mp->udp_encap;
if (sa.is_tunnel_ip6)
{
clib_memcpy (&sa.tunnel_src_addr, mp->tunnel_src_address, 16);
}
sa.use_anti_replay = mp->use_anti_replay;
- ASSERT (im->cb.check_support_cb);
- clib_error_t *err = im->cb.check_support_cb (&sa);
+ clib_error_t *err = ipsec_check_support_cb (im, &sa);
if (err)
{
clib_warning ("%s", err->what);
goto out;
}
- rv = ipsec_add_del_sa (vm, &sa, mp->is_add, mp->udp_encap);
+ rv = ipsec_add_del_sa (vm, &sa, mp->is_add);
#else
rv = VNET_API_ERROR_UNIMPLEMENTED;
goto out;
REPLY_MACRO (VL_API_IPSEC_SAD_ADD_DEL_ENTRY_REPLY);
}
+static void
+send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg,
+ u32 context)
+{
+ vl_api_ipsec_spds_details_t *mp;
+
+ mp = vl_msg_api_alloc (sizeof (*mp));
+ clib_memset (mp, 0, sizeof (*mp));
+ mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
+ mp->context = context;
+
+ mp->spd_id = htonl (spd->id);
+ mp->npolicies = htonl (pool_len (spd->policies));
+
+ vl_api_send_msg (reg, (u8 *) mp);
+}
+
+static void
+vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp)
+{
+ vl_api_registration_t *reg;
+ ipsec_main_t *im = &ipsec_main;
+ ipsec_spd_t *spd;
+#if WITH_LIBSSL > 0
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ /* *INDENT-OFF* */
+ pool_foreach (spd, im->spds, ({
+ send_ipsec_spds_details (spd, reg, mp->context);
+ }));
+ /* *INDENT-ON* */
+#else
+ clib_warning ("unimplemented");
+#endif
+}
+
static void
send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
u32 context)
vl_api_ipsec_spd_details_t *mp;
mp = vl_msg_api_alloc (sizeof (*mp));
- memset (mp, 0, sizeof (*mp));
+ clib_memset (mp, 0, sizeof (*mp));
mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
mp->context = context;
#endif
}
+static void
+send_ipsec_spd_interface_details (vl_api_registration_t * reg, u32 spd_index,
+ u32 sw_if_index, u32 context)
+{
+ vl_api_ipsec_spd_interface_details_t *mp;
+
+ mp = vl_msg_api_alloc (sizeof (*mp));
+ clib_memset (mp, 0, sizeof (*mp));
+ mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
+ mp->context = context;
+
+ mp->spd_index = htonl (spd_index);
+ mp->sw_if_index = htonl (sw_if_index);
+
+ vl_api_send_msg (reg, (u8 *) mp);
+}
+
+static void
+vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t *
+ mp)
+{
+ ipsec_main_t *im = &ipsec_main;
+ vl_api_registration_t *reg;
+ u32 k, v, spd_index;
+
+#if WITH_LIBSSL > 0
+ reg = vl_api_client_index_to_registration (mp->client_index);
+ if (!reg)
+ return;
+
+ if (mp->spd_index_valid)
+ {
+ spd_index = ntohl (mp->spd_index);
+ /* *INDENT-OFF* */
+ hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
+ if (v == spd_index)
+ send_ipsec_spd_interface_details(reg, v, k, mp->context);
+ }));
+ /* *INDENT-ON* */
+ }
+ else
+ {
+ /* *INDENT-OFF* */
+ hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
+ send_ipsec_spd_interface_details(reg, v, k, mp->context);
+ }));
+ /* *INDENT-ON* */
+ }
+
+#else
+ clib_warning ("unimplemented");
+#endif
+}
+
static void
vl_api_ipsec_sa_set_key_t_handler (vl_api_ipsec_sa_set_key_t * mp)
{
#if WITH_LIBSSL > 0
ipsec_add_del_tunnel_args_t tun;
- memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
+ clib_memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
tun.is_add = mp->is_add;
tun.esn = mp->esn;
tun.integ_alg = mp->integ_alg;
tun.local_integ_key_len = mp->local_integ_key_len;
tun.remote_integ_key_len = mp->remote_integ_key_len;
+ tun.udp_encap = mp->udp_encap;
memcpy (&tun.local_ip, mp->local_ip, 4);
memcpy (&tun.remote_ip, mp->remote_ip, 4);
memcpy (&tun.local_crypto_key, &mp->local_crypto_key,
vl_api_ipsec_sa_details_t *mp;
mp = vl_msg_api_alloc (sizeof (*mp));
- memset (mp, 0, sizeof (*mp));
+ clib_memset (mp, 0, sizeof (*mp));
mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
mp->context = context;
/*
* ipsec_api_hookup
* Add vpe's API message handlers to the table.
- * vlib has alread mapped shared memory and
+ * vlib has already mapped shared memory and
* added the client registration handlers.
* See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
*/
#undef _
}
+static void
+vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp)
+{
+ vl_api_registration_t *rp;
+ ipsec_main_t *im = &ipsec_main;
+ u32 context = mp->context;
+
+ rp = vl_api_client_index_to_registration (mp->client_index);
+
+ if (rp == 0)
+ {
+ clib_warning ("Client %d AWOL", mp->client_index);
+ return;
+ }
+
+ ipsec_ah_backend_t *ab;
+ ipsec_esp_backend_t *eb;
+ /* *INDENT-OFF* */
+ pool_foreach (ab, im->ah_backends, {
+ vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
+ clib_memset (mp, 0, sizeof (*mp));
+ mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
+ mp->context = context;
+ snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (ab->name),
+ ab->name);
+ mp->protocol = IPSEC_PROTOCOL_AH;
+ mp->index = ab - im->ah_backends;
+ mp->active = mp->index == im->ah_current_backend ? 1 : 0;
+ vl_api_send_msg (rp, (u8 *)mp);
+ });
+ pool_foreach (eb, im->esp_backends, {
+ vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
+ clib_memset (mp, 0, sizeof (*mp));
+ mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
+ mp->context = context;
+ snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (eb->name),
+ eb->name);
+ mp->protocol = IPSEC_PROTOCOL_ESP;
+ mp->index = eb - im->esp_backends;
+ mp->active = mp->index == im->esp_current_backend ? 1 : 0;
+ vl_api_send_msg (rp, (u8 *)mp);
+ });
+ /* *INDENT-ON* */
+}
+
+static void
+vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp)
+{
+ ipsec_main_t *im = &ipsec_main;
+ vl_api_ipsec_select_backend_reply_t *rmp;
+ int rv = 0;
+ if (pool_elts (im->sad) > 0)
+ {
+ rv = VNET_API_ERROR_INSTANCE_IN_USE;
+ goto done;
+ }
+#if WITH_LIBSSL > 0
+ switch (mp->protocol)
+ {
+ case IPSEC_PROTOCOL_ESP:
+ if (pool_is_free_index (im->esp_backends, mp->index))
+ {
+ rv = VNET_API_ERROR_INVALID_VALUE;
+ break;
+ }
+ ipsec_select_esp_backend (im, mp->index);
+ break;
+ case IPSEC_PROTOCOL_AH:
+ if (pool_is_free_index (im->ah_backends, mp->index))
+ {
+ rv = VNET_API_ERROR_INVALID_VALUE;
+ break;
+ }
+ ipsec_select_ah_backend (im, mp->index);
+ break;
+ default:
+ rv = VNET_API_ERROR_INVALID_VALUE;
+ break;
+ }
+#else
+ clib_warning ("unimplemented"); /* FIXME */
+#endif
+done:
+ REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY);
+}
+
static clib_error_t *
ipsec_api_hookup (vlib_main_t * vm)
{
Code Review / vpp.git / blobdiff