FD.io VPP  v18.07.1-13-g909ba93
Vector Packet Processing
ipsec_api.c
Go to the documentation of this file.
1 /*
2  *------------------------------------------------------------------
3  * ipsec_api.c - ipsec api
4  *
5  * Copyright (c) 2016 Cisco and/or its affiliates.
6  * Licensed under the Apache License, Version 2.0 (the "License");
7  * you may not use this file except in compliance with the License.
8  * You may obtain a copy of the License at:
9  *
10  * http://www.apache.org/licenses/LICENSE-2.0
11  *
12  * Unless required by applicable law or agreed to in writing, software
13  * distributed under the License is distributed on an "AS IS" BASIS,
14  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15  * See the License for the specific language governing permissions and
16  * limitations under the License.
17  *------------------------------------------------------------------
18  */
19 
20 #include <vnet/vnet.h>
21 #include <vlibmemory/api.h>
22 
23 #include <vnet/interface.h>
24 #include <vnet/api_errno.h>
25 #include <vnet/ip/ip.h>
26 
27 #include <vnet/vnet_msg_enum.h>
28 
29 #if WITH_LIBSSL > 0
30 #include <vnet/ipsec/ipsec.h>
31 #include <vnet/ipsec/ikev2.h>
32 #endif /* IPSEC */
33 
34 #define vl_typedefs /* define message structures */
35 #include <vnet/vnet_all_api_h.h>
36 #undef vl_typedefs
37 
38 #define vl_endianfun /* define message structures */
39 #include <vnet/vnet_all_api_h.h>
40 #undef vl_endianfun
41 
42 /* instantiate all the print functions we know about */
43 #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
44 #define vl_printfun
45 #include <vnet/vnet_all_api_h.h>
46 #undef vl_printfun
47 
49 
50 #define foreach_vpe_api_msg \
51 _(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
52 _(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
53 _(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \
54 _(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \
55 _(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \
56 _(IPSEC_SA_DUMP, ipsec_sa_dump) \
57 _(IPSEC_SPD_DUMP, ipsec_spd_dump) \
58 _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \
59 _(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \
60 _(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \
61 _(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \
62 _(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \
63 _(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \
64 _(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \
65 _(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \
66 _(IKEV2_SET_RESPONDER, ikev2_set_responder) \
67 _(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \
68 _(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \
69 _(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \
70 _(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \
71 _(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \
72 _(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \
73 _(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa)
74 
77 {
78 #if WITH_LIBSSL == 0
79  clib_warning ("unimplemented");
80 #else
81 
82  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
83  vl_api_ipsec_spd_add_del_reply_t *rmp;
84  int rv;
85 
86  rv = ipsec_add_del_spd (vm, ntohl (mp->spd_id), mp->is_add);
87 
88  REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_REPLY);
89 #endif
90 }
91 
94 {
95  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
96  vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
97  int rv;
98  u32 sw_if_index __attribute__ ((unused));
99  u32 spd_id __attribute__ ((unused));
100 
101  sw_if_index = ntohl (mp->sw_if_index);
102  spd_id = ntohl (mp->spd_id);
103 
105 
106 #if WITH_LIBSSL > 0
107  rv = ipsec_set_interface_spd (vm, sw_if_index, spd_id, mp->is_add);
108 #else
109  rv = VNET_API_ERROR_UNIMPLEMENTED;
110 #endif
111 
113 
114  REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
115 }
116 
119 {
120  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
121  vl_api_ipsec_spd_add_del_entry_reply_t *rmp;
122  int rv;
123 
124 #if WITH_LIBSSL > 0
125  ipsec_policy_t p;
126 
127  memset (&p, 0, sizeof (p));
128 
129  p.id = ntohl (mp->spd_id);
130  p.priority = ntohl (mp->priority);
131  p.is_outbound = mp->is_outbound;
132  p.is_ipv6 = mp->is_ipv6;
133 
134  if (mp->is_ipv6 || mp->is_ip_any)
135  {
140  }
141  else
142  {
143  clib_memcpy (&p.raddr.start.ip4.data, mp->remote_address_start, 4);
144  clib_memcpy (&p.raddr.stop.ip4.data, mp->remote_address_stop, 4);
145  clib_memcpy (&p.laddr.start.ip4.data, mp->local_address_start, 4);
146  clib_memcpy (&p.laddr.stop.ip4.data, mp->local_address_stop, 4);
147  }
148  p.protocol = mp->protocol;
149  p.rport.start = ntohs (mp->remote_port_start);
150  p.rport.stop = ntohs (mp->remote_port_stop);
151  p.lport.start = ntohs (mp->local_port_start);
152  p.lport.stop = ntohs (mp->local_port_stop);
153  /* policy action resolve unsupported */
154  if (mp->policy == IPSEC_POLICY_ACTION_RESOLVE)
155  {
156  clib_warning ("unsupported action: 'resolve'");
157  rv = VNET_API_ERROR_UNIMPLEMENTED;
158  goto out;
159  }
160  p.policy = mp->policy;
161  p.sa_id = ntohl (mp->sa_id);
162 
163  rv = ipsec_add_del_policy (vm, &p, mp->is_add);
164  if (rv)
165  goto out;
166 
167  if (mp->is_ip_any)
168  {
169  p.is_ipv6 = 1;
170  rv = ipsec_add_del_policy (vm, &p, mp->is_add);
171  }
172 #else
173  rv = VNET_API_ERROR_UNIMPLEMENTED;
174  goto out;
175 #endif
176 
177 out:
178  REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_ENTRY_REPLY);
179 }
180 
183 {
184  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
185  vl_api_ipsec_sad_add_del_entry_reply_t *rmp;
186  int rv;
187 #if WITH_LIBSSL > 0
188  ipsec_main_t *im = &ipsec_main;
189  ipsec_sa_t sa;
190 
191  memset (&sa, 0, sizeof (sa));
192 
193  sa.id = ntohl (mp->sad_id);
194  sa.spi = ntohl (mp->spi);
195  sa.protocol = mp->protocol;
196  /* check for unsupported crypto-alg */
198  {
199  clib_warning ("unsupported crypto-alg: '%U'", format_ipsec_crypto_alg,
200  mp->crypto_algorithm);
201  rv = VNET_API_ERROR_UNIMPLEMENTED;
202  goto out;
203  }
204  sa.crypto_alg = mp->crypto_algorithm;
206  clib_memcpy (&sa.crypto_key, mp->crypto_key, sizeof (sa.crypto_key));
207  /* check for unsupported integ-alg */
209  {
210  clib_warning ("unsupported integ-alg: '%U'", format_ipsec_integ_alg,
211  mp->integrity_algorithm);
212  rv = VNET_API_ERROR_UNIMPLEMENTED;
213  goto out;
214  }
215 
218  clib_memcpy (&sa.integ_key, mp->integrity_key, sizeof (sa.integ_key));
220  sa.is_tunnel = mp->is_tunnel;
221  sa.is_tunnel_ip6 = mp->is_tunnel_ipv6;
222  if (sa.is_tunnel_ip6)
223  {
226  }
227  else
228  {
229  clib_memcpy (&sa.tunnel_src_addr.ip4.data, mp->tunnel_src_address, 4);
230  clib_memcpy (&sa.tunnel_dst_addr.ip4.data, mp->tunnel_dst_address, 4);
231  }
233 
234  ASSERT (im->cb.check_support_cb);
235  clib_error_t *err = im->cb.check_support_cb (&sa);
236  if (err)
237  {
238  clib_warning ("%s", err->what);
239  rv = VNET_API_ERROR_UNIMPLEMENTED;
240  goto out;
241  }
242 
243  rv = ipsec_add_del_sa (vm, &sa, mp->is_add, mp->udp_encap);
244 #else
245  rv = VNET_API_ERROR_UNIMPLEMENTED;
246  goto out;
247 #endif
248 
249 out:
250  REPLY_MACRO (VL_API_IPSEC_SAD_ADD_DEL_ENTRY_REPLY);
251 }
252 
253 static void
255  u32 context)
256 {
258 
259  mp = vl_msg_api_alloc (sizeof (*mp));
260  memset (mp, 0, sizeof (*mp));
261  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
262  mp->context = context;
263 
264  mp->spd_id = htonl (p->id);
265  mp->priority = htonl (p->priority);
266  mp->is_outbound = p->is_outbound;
267  mp->is_ipv6 = p->is_ipv6;
268  if (p->is_ipv6)
269  {
270  memcpy (mp->local_start_addr, &p->laddr.start.ip6, 16);
271  memcpy (mp->local_stop_addr, &p->laddr.stop.ip6, 16);
272  memcpy (mp->remote_start_addr, &p->raddr.start.ip6, 16);
273  memcpy (mp->remote_stop_addr, &p->raddr.stop.ip6, 16);
274  }
275  else
276  {
277  memcpy (mp->local_start_addr, &p->laddr.start.ip4, 4);
278  memcpy (mp->local_stop_addr, &p->laddr.stop.ip4, 4);
279  memcpy (mp->remote_start_addr, &p->raddr.start.ip4, 4);
280  memcpy (mp->remote_stop_addr, &p->raddr.stop.ip4, 4);
281  }
282  mp->local_start_port = htons (p->lport.start);
283  mp->local_stop_port = htons (p->lport.stop);
284  mp->remote_start_port = htons (p->rport.start);
285  mp->remote_stop_port = htons (p->rport.stop);
286  mp->protocol = p->protocol;
287  mp->policy = p->policy;
288  mp->sa_id = htonl (p->sa_id);
289  mp->bytes = clib_host_to_net_u64 (p->counter.bytes);
290  mp->packets = clib_host_to_net_u64 (p->counter.packets);
291 
292  vl_api_send_msg (reg, (u8 *) mp);
293 }
294 
295 static void
297 {
299  ipsec_main_t *im = &ipsec_main;
300  ipsec_policy_t *policy;
301  ipsec_spd_t *spd;
302  uword *p;
303  u32 spd_index;
304 #if WITH_LIBSSL > 0
306  if (!reg)
307  return;
308 
309  p = hash_get (im->spd_index_by_spd_id, ntohl (mp->spd_id));
310  if (!p)
311  return;
312 
313  spd_index = p[0];
314  spd = pool_elt_at_index (im->spds, spd_index);
315 
316  /* *INDENT-OFF* */
317  pool_foreach (policy, spd->policies,
318  ({
319  if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == policy->sa_id)
320  send_ipsec_spd_details (policy, reg,
321  mp->context);}
322  ));
323  /* *INDENT-ON* */
324 #else
325  clib_warning ("unimplemented");
326 #endif
327 }
328 
329 static void
331 {
332  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
333  vl_api_ipsec_sa_set_key_reply_t *rmp;
334  int rv;
335 #if WITH_LIBSSL > 0
336  ipsec_sa_t sa;
337  sa.id = ntohl (mp->sa_id);
339  clib_memcpy (&sa.crypto_key, mp->crypto_key, sizeof (sa.crypto_key));
341  clib_memcpy (&sa.integ_key, mp->integrity_key, sizeof (sa.integ_key));
342 
343  rv = ipsec_set_sa_key (vm, &sa);
344 #else
345  rv = VNET_API_ERROR_UNIMPLEMENTED;
346 #endif
347 
348  REPLY_MACRO (VL_API_IPSEC_SA_SET_KEY_REPLY);
349 }
350 
351 static void
353  mp)
354 {
356  ipsec_main_t *im = &ipsec_main;
357  vnet_main_t *vnm = im->vnet_main;
358  u32 sw_if_index = ~0;
359  int rv;
360 
361 #if WITH_LIBSSL > 0
363 
364  memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
365 
366  tun.is_add = mp->is_add;
367  tun.esn = mp->esn;
368  tun.anti_replay = mp->anti_replay;
369  tun.local_spi = ntohl (mp->local_spi);
370  tun.remote_spi = ntohl (mp->remote_spi);
371  tun.crypto_alg = mp->crypto_alg;
374  tun.integ_alg = mp->integ_alg;
377  memcpy (&tun.local_ip, mp->local_ip, 4);
378  memcpy (&tun.remote_ip, mp->remote_ip, 4);
379  memcpy (&tun.local_crypto_key, &mp->local_crypto_key,
381  memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key,
383  memcpy (&tun.local_integ_key, &mp->local_integ_key,
384  mp->local_integ_key_len);
385  memcpy (&tun.remote_integ_key, &mp->remote_integ_key,
387  tun.renumber = mp->renumber;
388  tun.show_instance = ntohl (mp->show_instance);
389 
390  rv = ipsec_add_del_tunnel_if_internal (vnm, &tun, &sw_if_index);
391 
392 #else
393  rv = VNET_API_ERROR_UNIMPLEMENTED;
394 #endif
395 
396  REPLY_MACRO2 (VL_API_IPSEC_TUNNEL_IF_ADD_DEL_REPLY, (
397  {
398  rmp->sw_if_index =
399  htonl (sw_if_index);
400  }));
401 }
402 
403 static void
405  u32 context, u32 sw_if_index)
406 {
408 
409  mp = vl_msg_api_alloc (sizeof (*mp));
410  memset (mp, 0, sizeof (*mp));
411  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
412  mp->context = context;
413 
414  mp->sa_id = htonl (sa->id);
415  mp->sw_if_index = htonl (sw_if_index);
416 
417  mp->spi = htonl (sa->spi);
418  mp->protocol = sa->protocol;
419 
420  mp->crypto_alg = sa->crypto_alg;
421  mp->crypto_key_len = sa->crypto_key_len;
422  memcpy (mp->crypto_key, sa->crypto_key, sa->crypto_key_len);
423 
424  mp->integ_alg = sa->integ_alg;
425  mp->integ_key_len = sa->integ_key_len;
426  memcpy (mp->integ_key, sa->integ_key, sa->integ_key_len);
427 
428  mp->use_esn = sa->use_esn;
430 
431  mp->is_tunnel = sa->is_tunnel;
432  mp->is_tunnel_ip6 = sa->is_tunnel_ip6;
433 
434  if (sa->is_tunnel)
435  {
436  if (sa->is_tunnel_ip6)
437  {
438  memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip6, 16);
439  memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip6, 16);
440  }
441  else
442  {
443  memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip4, 4);
444  memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip4, 4);
445  }
446  }
447 
448  mp->salt = clib_host_to_net_u32 (sa->salt);
449  mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
450  mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
451  if (sa->use_esn)
452  {
453  mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
454  mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
455  }
456  if (sa->use_anti_replay)
457  mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
458  mp->total_data_size = clib_host_to_net_u64 (sa->total_data_size);
459  mp->udp_encap = sa->udp_encap;
460 
461  vl_api_send_msg (reg, (u8 *) mp);
462 }
463 
464 
465 static void
467 {
469  ipsec_main_t *im = &ipsec_main;
470  vnet_main_t *vnm = im->vnet_main;
471  ipsec_sa_t *sa;
473  u32 *sa_index_to_tun_if_index = 0;
474 
475 #if WITH_LIBSSL > 0
477  if (!reg || pool_elts (im->sad) == 0)
478  return;
479 
480  vec_validate_init_empty (sa_index_to_tun_if_index, vec_len (im->sad) - 1,
481  ~0);
482 
483  /* *INDENT-OFF* */
485  ({
486  vnet_hw_interface_t *hi;
487  u32 sw_if_index = ~0;
488 
489  hi = vnet_get_hw_interface (vnm, t->hw_if_index);
490  sw_if_index = hi->sw_if_index;
491  sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index;
492  sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index;
493  }));
494 
495  pool_foreach (sa, im->sad,
496  ({
497  if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id)
498  send_ipsec_sa_details (sa, reg, mp->context,
499  sa_index_to_tun_if_index[sa - im->sad]);
500  }));
501  /* *INDENT-ON* */
502 
503  vec_free (sa_index_to_tun_if_index);
504 #else
505  clib_warning ("unimplemented");
506 #endif
507 }
508 
509 
510 static void
512  mp)
513 {
514  vl_api_ipsec_tunnel_if_set_key_reply_t *rmp;
515  ipsec_main_t *im = &ipsec_main;
516  vnet_main_t *vnm = im->vnet_main;
518  u8 *key = 0;
519  int rv;
520 
521 #if WITH_LIBSSL > 0
522  sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index));
523 
524  switch (mp->key_type)
525  {
528  if (mp->alg < IPSEC_CRYPTO_ALG_AES_CBC_128 ||
529  mp->alg >= IPSEC_CRYPTO_N_ALG)
530  {
531  rv = VNET_API_ERROR_UNIMPLEMENTED;
532  goto out;
533  }
534  break;
537  if (mp->alg >= IPSEC_INTEG_N_ALG)
538  {
539  rv = VNET_API_ERROR_UNIMPLEMENTED;
540  goto out;
541  }
542  break;
544  default:
545  rv = VNET_API_ERROR_UNIMPLEMENTED;
546  goto out;
547  break;
548  }
549 
550  key = vec_new (u8, mp->key_len);
551  clib_memcpy (key, mp->key, mp->key_len);
552 
553  rv = ipsec_set_interface_key (vnm, sw->hw_if_index, mp->key_type, mp->alg,
554  key);
555  vec_free (key);
556 #else
557  clib_warning ("unimplemented");
558 #endif
559 
560 out:
561  REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_KEY_REPLY);
562 }
563 
564 
565 static void
567 {
568  vl_api_ipsec_tunnel_if_set_sa_reply_t *rmp;
569  ipsec_main_t *im = &ipsec_main;
570  vnet_main_t *vnm = im->vnet_main;
572  int rv;
573 
574 #if WITH_LIBSSL > 0
575  sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index));
576 
577  rv = ipsec_set_interface_sa (vnm, sw->hw_if_index, ntohl (mp->sa_id),
578  mp->is_outbound);
579 #else
580  clib_warning ("unimplemented");
581 #endif
582 
583  REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_SA_REPLY);
584 }
585 
586 
587 static void
589 {
590  vl_api_ikev2_profile_add_del_reply_t *rmp;
591  int rv = 0;
592 
593 #if WITH_LIBSSL > 0
595  clib_error_t *error;
596  u8 *tmp = format (0, "%s", mp->name);
597  error = ikev2_add_del_profile (vm, tmp, mp->is_add);
598  vec_free (tmp);
599  if (error)
600  rv = VNET_API_ERROR_UNSPECIFIED;
601 #else
602  rv = VNET_API_ERROR_UNIMPLEMENTED;
603 #endif
604 
605  REPLY_MACRO (VL_API_IKEV2_PROFILE_ADD_DEL_REPLY);
606 }
607 
608 static void
611 {
612  vl_api_ikev2_profile_set_auth_reply_t *rmp;
613  int rv = 0;
614 
615 #if WITH_LIBSSL > 0
617  clib_error_t *error;
618  u8 *tmp = format (0, "%s", mp->name);
619  u8 *data = vec_new (u8, mp->data_len);
620  clib_memcpy (data, mp->data, mp->data_len);
621  error = ikev2_set_profile_auth (vm, tmp, mp->auth_method, data, mp->is_hex);
622  vec_free (tmp);
623  vec_free (data);
624  if (error)
625  rv = VNET_API_ERROR_UNSPECIFIED;
626 #else
627  rv = VNET_API_ERROR_UNIMPLEMENTED;
628 #endif
629 
630  REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_AUTH_REPLY);
631 }
632 
633 static void
635 {
636  vl_api_ikev2_profile_add_del_reply_t *rmp;
637  int rv = 0;
638 
639 #if WITH_LIBSSL > 0
641  clib_error_t *error;
642  u8 *tmp = format (0, "%s", mp->name);
643  u8 *data = vec_new (u8, mp->data_len);
644  clib_memcpy (data, mp->data, mp->data_len);
645  error = ikev2_set_profile_id (vm, tmp, mp->id_type, data, mp->is_local);
646  vec_free (tmp);
647  vec_free (data);
648  if (error)
649  rv = VNET_API_ERROR_UNSPECIFIED;
650 #else
651  rv = VNET_API_ERROR_UNIMPLEMENTED;
652 #endif
653 
654  REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_ID_REPLY);
655 }
656 
657 static void
659 {
660  vl_api_ikev2_profile_set_ts_reply_t *rmp;
661  int rv = 0;
662 
663 #if WITH_LIBSSL > 0
665  clib_error_t *error;
666  u8 *tmp = format (0, "%s", mp->name);
667  error = ikev2_set_profile_ts (vm, tmp, mp->proto, mp->start_port,
668  mp->end_port, (ip4_address_t) mp->start_addr,
669  (ip4_address_t) mp->end_addr, mp->is_local);
670  vec_free (tmp);
671  if (error)
672  rv = VNET_API_ERROR_UNSPECIFIED;
673 #else
674  rv = VNET_API_ERROR_UNIMPLEMENTED;
675 #endif
676 
677  REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_TS_REPLY);
678 }
679 
680 static void
682 {
683  vl_api_ikev2_profile_set_ts_reply_t *rmp;
684  int rv = 0;
685 
686 #if WITH_LIBSSL > 0
688  clib_error_t *error;
689 
690  error = ikev2_set_local_key (vm, mp->key_file);
691  if (error)
692  rv = VNET_API_ERROR_UNSPECIFIED;
693 #else
694  rv = VNET_API_ERROR_UNIMPLEMENTED;
695 #endif
696 
697  REPLY_MACRO (VL_API_IKEV2_SET_LOCAL_KEY_REPLY);
698 }
699 
700 static void
702 {
703  vl_api_ikev2_set_responder_reply_t *rmp;
704  int rv = 0;
705 
706 #if WITH_LIBSSL > 0
708  clib_error_t *error;
709 
710  u8 *tmp = format (0, "%s", mp->name);
711  ip4_address_t ip4;
712  clib_memcpy (&ip4, mp->address, sizeof (ip4));
713 
714  error = ikev2_set_profile_responder (vm, tmp, mp->sw_if_index, ip4);
715  vec_free (tmp);
716  if (error)
717  rv = VNET_API_ERROR_UNSPECIFIED;
718 #else
719  rv = VNET_API_ERROR_UNIMPLEMENTED;
720 #endif
721 
722  REPLY_MACRO (VL_API_IKEV2_SET_RESPONDER_REPLY);
723 }
724 
725 static void
727  mp)
728 {
729  vl_api_ikev2_set_ike_transforms_reply_t *rmp;
730  int rv = 0;
731 
732 #if WITH_LIBSSL > 0
734  clib_error_t *error;
735 
736  u8 *tmp = format (0, "%s", mp->name);
737 
738  error =
740  mp->dh_group, mp->crypto_key_size);
741  vec_free (tmp);
742  if (error)
743  rv = VNET_API_ERROR_UNSPECIFIED;
744 #else
745  rv = VNET_API_ERROR_UNIMPLEMENTED;
746 #endif
747 
748  REPLY_MACRO (VL_API_IKEV2_SET_IKE_TRANSFORMS_REPLY);
749 }
750 
751 static void
753  mp)
754 {
755  vl_api_ikev2_set_esp_transforms_reply_t *rmp;
756  int rv = 0;
757 
758 #if WITH_LIBSSL > 0
760  clib_error_t *error;
761 
762  u8 *tmp = format (0, "%s", mp->name);
763 
764  error =
766  mp->dh_group, mp->crypto_key_size);
767  vec_free (tmp);
768  if (error)
769  rv = VNET_API_ERROR_UNSPECIFIED;
770 #else
771  rv = VNET_API_ERROR_UNIMPLEMENTED;
772 #endif
773 
774  REPLY_MACRO (VL_API_IKEV2_SET_ESP_TRANSFORMS_REPLY);
775 }
776 
777 static void
779 {
780  vl_api_ikev2_set_sa_lifetime_reply_t *rmp;
781  int rv = 0;
782 
783 #if WITH_LIBSSL > 0
785  clib_error_t *error;
786 
787  u8 *tmp = format (0, "%s", mp->name);
788 
789  error =
791  mp->handover, mp->lifetime_maxdata);
792  vec_free (tmp);
793  if (error)
794  rv = VNET_API_ERROR_UNSPECIFIED;
795 #else
796  rv = VNET_API_ERROR_UNIMPLEMENTED;
797 #endif
798 
799  REPLY_MACRO (VL_API_IKEV2_SET_SA_LIFETIME_REPLY);
800 }
801 
802 static void
804 {
805  vl_api_ikev2_initiate_sa_init_reply_t *rmp;
806  int rv = 0;
807 
808 #if WITH_LIBSSL > 0
810  clib_error_t *error;
811 
812  u8 *tmp = format (0, "%s", mp->name);
813 
814  error = ikev2_initiate_sa_init (vm, tmp);
815  vec_free (tmp);
816  if (error)
817  rv = VNET_API_ERROR_UNSPECIFIED;
818 #else
819  rv = VNET_API_ERROR_UNIMPLEMENTED;
820 #endif
821 
822  REPLY_MACRO (VL_API_IKEV2_INITIATE_SA_INIT_REPLY);
823 }
824 
825 static void
827  * mp)
828 {
829  vl_api_ikev2_initiate_del_ike_sa_reply_t *rmp;
830  int rv = 0;
831 
832 #if WITH_LIBSSL > 0
834  clib_error_t *error;
835 
836  error = ikev2_initiate_delete_ike_sa (vm, mp->ispi);
837  if (error)
838  rv = VNET_API_ERROR_UNSPECIFIED;
839 #else
840  rv = VNET_API_ERROR_UNIMPLEMENTED;
841 #endif
842 
843  REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_IKE_SA_REPLY);
844 }
845 
846 static void
849 {
850  vl_api_ikev2_initiate_del_child_sa_reply_t *rmp;
851  int rv = 0;
852 
853 #if WITH_LIBSSL > 0
855  clib_error_t *error;
856 
857  error = ikev2_initiate_delete_child_sa (vm, mp->ispi);
858  if (error)
859  rv = VNET_API_ERROR_UNSPECIFIED;
860 #else
861  rv = VNET_API_ERROR_UNIMPLEMENTED;
862 #endif
863 
864  REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_CHILD_SA_REPLY);
865 }
866 
867 static void
870 {
871  vl_api_ikev2_initiate_rekey_child_sa_reply_t *rmp;
872  int rv = 0;
873 
874 #if WITH_LIBSSL > 0
876  clib_error_t *error;
877 
878  error = ikev2_initiate_rekey_child_sa (vm, mp->ispi);
879  if (error)
880  rv = VNET_API_ERROR_UNSPECIFIED;
881 #else
882  rv = VNET_API_ERROR_UNIMPLEMENTED;
883 #endif
884 
885  REPLY_MACRO (VL_API_IKEV2_INITIATE_REKEY_CHILD_SA_REPLY);
886 }
887 
888 /*
889  * ipsec_api_hookup
890  * Add vpe's API message handlers to the table.
891  * vlib has alread mapped shared memory and
892  * added the client registration handlers.
893  * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
894  */
895 #define vl_msg_name_crc_list
896 #include <vnet/vnet_all_api_h.h>
897 #undef vl_msg_name_crc_list
898 
899 static void
901 {
902 #define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id);
903  foreach_vl_msg_name_crc_ipsec;
904 #undef _
905 }
906 
907 static clib_error_t *
909 {
910  api_main_t *am = &api_main;
911 
912 #define _(N,n) \
913  vl_msg_api_set_handlers(VL_API_##N, #n, \
914  vl_api_##n##_t_handler, \
915  vl_noop_handler, \
916  vl_api_##n##_t_endian, \
917  vl_api_##n##_t_print, \
918  sizeof(vl_api_##n##_t), 1);
920 #undef _
921 
922  /*
923  * Set up the (msg_name, crc, message-id) table
924  */
926 
927  return 0;
928 }
929 
931 
932 /*
933  * fd.io coding-style-patch-verification: ON
934  *
935  * Local Variables:
936  * eval: (c-set-style "gnu")
937  * End:
938  */
ip46_address_t stop
Definition: ipsec.h:149
int ipsec_set_interface_key(vnet_main_t *vnm, u32 hw_if_index, ipsec_if_set_key_type_t type, u8 alg, u8 *key)
Definition: ipsec_if.c:484
static void vl_api_ikev2_profile_set_auth_t_handler(vl_api_ikev2_profile_set_auth_t *mp)
Definition: ipsec_api.c:610
static void vl_api_ipsec_sa_set_key_t_handler(vl_api_ipsec_sa_set_key_t *mp)
Definition: ipsec_api.c:330
static void vl_api_ikev2_set_local_key_t_handler(vl_api_ikev2_set_local_key_t *mp)
Definition: ipsec_api.c:681
ipsec_spd_t * spds
Definition: ipsec.h:263
int ipsec_set_interface_sa(vnet_main_t *vnm, u32 hw_if_index, u32 sa_id, u8 is_outbound)
Definition: ipsec_if.c:534
u8 crypto_algorithm
Definition: ipsec.api:152
u8 use_extended_sequence_number
Definition: ipsec.api:160
u32 sa_id
Definition: ipsec.api:105
u8 integrity_key_length
Definition: ipsec.api:157
clib_error_t * ikev2_set_profile_responder(vlib_main_t *vm, u8 *name, u32 sw_if_index, ip4_address_t ip4)
Definition: ikev2.c:2807
ipsec_tunnel_if_t * tunnel_interfaces
Definition: ipsec.h:267
u16 stop
Definition: ipsec.h:154
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
Definition: ipsec.c:152
ip46_address_t tunnel_src_addr
Definition: ipsec.h:131
IKEv2: Set Child SA lifetime, limited by time and/or data.
Definition: ipsec.api:372
u32 id
Definition: ipsec.h:113
clib_error_t * ikev2_add_del_profile(vlib_main_t *vm, u8 *name, int is_add)
Definition: ikev2.c:2666
static void vl_api_ikev2_initiate_rekey_child_sa_t_handler(vl_api_ikev2_initiate_rekey_child_sa_t *mp)
Definition: ipsec_api.c:869
static void vl_api_ipsec_tunnel_if_set_key_t_handler(vl_api_ipsec_tunnel_if_set_key_t *mp)
Definition: ipsec_api.c:511
u8 tunnel_dst_address[16]
Definition: ipsec.api:166
IKEv2: Add/delete profile.
Definition: ipsec.api:204
u16 local_port_start
Definition: ipsec.api:100
VLIB_API_INIT_FUNCTION(ipsec_api_hookup)
i32 priority
Definition: ipsec.h:200
IPsec: Update Security Association keys.
Definition: ipsec.api:183
unsigned long u64
Definition: types.h:89
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Definition: ipsec.c:44
clib_error_t * ikev2_initiate_delete_ike_sa(vlib_main_t *vm, u64 ispi)
Definition: ikev2.c:3125
u8 is_add
Definition: ipsec.api:82
#define REPLY_MACRO2(t, body)
static void vl_api_send_msg(vl_api_registration_t *rp, u8 *elem)
Definition: api.h:34
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:121
IPsec: Add/delete Security Policy Database entry.
Definition: ipsec.api:78
static void setup_message_id_table(api_main_t *am)
Definition: ipsec_api.c:900
u8 is_tunnel
Definition: ipsec.h:128
static void vl_api_ipsec_sa_dump_t_handler(vl_api_ipsec_sa_dump_t *mp)
Definition: ipsec_api.c:466
static vnet_sw_interface_t * vnet_get_sw_interface(vnet_main_t *vnm, u32 sw_if_index)
static void vl_api_ipsec_spd_add_del_entry_t_handler(vl_api_ipsec_spd_add_del_entry_t *mp)
Definition: ipsec_api.c:118
clib_error_t * ikev2_set_profile_sa_lifetime(vlib_main_t *vm, u8 *name, u64 lifetime, u32 jitter, u32 handover, u64 maxdata)
Definition: ikev2.c:2878
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
u8 policy
Definition: ipsec.api:104
u16 remote_port_stop
Definition: ipsec.api:99
void * vl_msg_api_alloc(int nbytes)
u8 crypto_key[128]
Definition: ipsec.api:154
unsigned char u8
Definition: types.h:56
#define foreach_vpe_api_msg
Definition: ipsec_api.c:50
u8 crypto_key[128]
Definition: ipsec.h:119
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Definition: ipsec.c:91
u8 protocol
Definition: ipsec.api:96
u32 spi
Definition: ipsec.h:114
port_range_t lport
Definition: ipsec.h:208
u32 seq_hi
Definition: ipsec.h:138
static void vl_api_ipsec_interface_add_del_spd_t_handler(vl_api_ipsec_interface_add_del_spd_t *mp)
Definition: ipsec_api.c:93
u8 udp_encap
Definition: ipsec.api:167
IKEv2: Set IKEv2 IKE transforms in SA_INIT proposal (RFC 7296)
Definition: ipsec.api:326
u64 replay_window
Definition: ipsec.h:141
u32 spd_id
Definition: ipsec.api:84
u8 local_address_start[16]
Definition: ipsec.api:93
u8 integ_key[128]
Definition: ipsec.h:123
u8 is_tunnel
Definition: ipsec.api:163
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:443
u8 crypto_key_length
Definition: ipsec.api:153
u32 sad_id
Definition: ipsec.api:146
ipsec_main_t ipsec_main
Definition: ipsec.c:30
clib_error_t * ikev2_initiate_sa_init(vlib_main_t *vm, u8 *name)
Definition: ikev2.c:2901
#define vec_new(T, N)
Create new vector of given type and length (unspecified alignment, no header).
Definition: vec.h:309
clib_error_t * ikev2_set_profile_auth(vlib_main_t *vm, u8 *name, u8 auth_method, u8 *auth_data, u8 data_hex_format)
Definition: ikev2.c:2697
static void vl_api_ipsec_tunnel_if_add_del_t_handler(vl_api_ipsec_tunnel_if_add_del_t *mp)
Definition: ipsec_api.c:352
static void vl_api_ikev2_set_responder_t_handler(vl_api_ikev2_set_responder_t *mp)
Definition: ipsec_api.c:701
u8 use_esn
Definition: ipsec.h:125
Set key on IPsec interface.
Definition: ipsec.api:636
ip4_address_t remote_ip
Definition: ipsec.h:162
static void vl_api_ipsec_spd_dump_t_handler(vl_api_ipsec_spd_dump_t *mp)
Definition: ipsec_api.c:296
u16 start
Definition: ipsec.h:154
static void vl_api_ikev2_profile_set_ts_t_handler(vl_api_ikev2_profile_set_ts_t *mp)
Definition: ipsec_api.c:658
ipsec_main_callbacks_t cb
Definition: ipsec.h:301
IKEv2: Initiate the delete Child SA exchange.
Definition: ipsec.api:421
clib_error_t * ikev2_set_profile_esp_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
Definition: ikev2.c:2853
unsigned int u32
Definition: types.h:88
IKEv2: Set IKEv2 profile local/remote identification.
Definition: ipsec.api:245
IKEv2: Set IKEv2 profile traffic selector parameters.
Definition: ipsec.api:269
static void vl_api_ikev2_initiate_del_child_sa_t_handler(vl_api_ikev2_initiate_del_child_sa_t *mp)
Definition: ipsec_api.c:848
u8 * format_ipsec_crypto_alg(u8 *s, va_list *args)
Definition: ipsec_format.c:58
ipsec_policy_t * policies
Definition: ipsec.h:224
i32 priority
Definition: ipsec.api:85
u8 udp_encap
Definition: ipsec.h:130
static void vl_api_ipsec_spd_add_del_t_handler(vl_api_ipsec_spd_add_del_t *mp)
Definition: ipsec_api.c:76
u8 local_address_stop[16]
Definition: ipsec.api:94
u32 last_seq
Definition: ipsec.h:139
#define hash_get(h, key)
Definition: hash.h:249
clib_error_t * ikev2_set_profile_id(vlib_main_t *vm, u8 *name, u8 id_type, u8 *data, int is_local)
Definition: ikev2.c:2729
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:464
counter_t packets
packet counter
Definition: counter.h:142
Add/delete IPsec tunnel interface response.
Definition: ipsec.api:550
u8 is_tunnel_ip6
Definition: ipsec.h:129
IKEv2: Initiate the rekey Child SA exchange.
Definition: ipsec.api:436
clib_error_t *(* check_support_cb)(ipsec_sa_t *sa)
Definition: ipsec.h:257
IPsec: Add/delete Security Policy Database.
Definition: ipsec.api:25
u32 salt
Definition: ipsec.h:134
vnet_main_t * vnet_main
Definition: ipsec.h:276
u32 last_seq_hi
Definition: ipsec.h:140
clib_error_t * ikev2_initiate_delete_child_sa(vlib_main_t *vm, u32 ispi)
Definition: ikev2.c:3085
static void vl_api_ikev2_initiate_sa_init_t_handler(vl_api_ikev2_initiate_sa_init_t *mp)
Definition: ipsec_api.c:803
#define REPLY_MACRO(t)
static void vl_api_ikev2_set_sa_lifetime_t_handler(vl_api_ikev2_set_sa_lifetime_t *mp)
Definition: ipsec_api.c:778
ip46_address_range_t laddr
Definition: ipsec.h:205
u8 is_add
Definition: ipsec.api:144
static void send_ipsec_sa_details(ipsec_sa_t *sa, vl_api_registration_t *reg, u32 context, u32 sw_if_index)
Definition: ipsec_api.c:404
u16 local_port_stop
Definition: ipsec.api:101
static void vl_api_ikev2_set_ike_transforms_t_handler(vl_api_ikev2_set_ike_transforms_t *mp)
Definition: ipsec_api.c:726
uword * spd_index_by_spd_id
Definition: ipsec.h:282
clib_error_t * ikev2_set_local_key(vlib_main_t *vm, u8 *file)
Definition: ikev2.c:2654
clib_error_t * ikev2_set_profile_ts(vlib_main_t *vm, u8 *name, u8 protocol_id, u16 start_port, u16 end_port, ip4_address_t start_addr, ip4_address_t end_addr, int is_local)
Definition: ikev2.c:2768
static void vl_api_ipsec_tunnel_if_set_sa_t_handler(vl_api_ipsec_tunnel_if_set_sa_t *mp)
Definition: ipsec_api.c:566
API main structure, used by both vpp and binary API clients.
Definition: api_common.h:201
ip46_address_t tunnel_dst_addr
Definition: ipsec.h:132
An API client registration, only in vpp/vlib.
Definition: api_common.h:44
#define BAD_SW_IF_INDEX_LABEL
IPsec: Add/delete SPD from interface.
Definition: ipsec.api:43
clib_error_t * ikev2_initiate_rekey_child_sa(vlib_main_t *vm, u32 ispi)
Definition: ikev2.c:3235
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:165
u16 remote_port_start
Definition: ipsec.api:98
static void vl_api_ikev2_set_esp_transforms_t_handler(vl_api_ikev2_set_esp_transforms_t *mp)
Definition: ipsec_api.c:752
vlib_main_t * vm
Definition: buffer.c:294
u8 remote_address_stop[16]
Definition: ipsec.api:92
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:339
IPsec: Add/delete Security Association Database entry.
Definition: ipsec.api:140
ip46_address_t start
Definition: ipsec.h:149
#define clib_warning(format, args...)
Definition: error.h:59
#define clib_memcpy(a, b, c)
Definition: string.h:75
u8 remote_address_start[16]
Definition: ipsec.api:91
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
Definition: ipsec.c:467
u8 tunnel_src_address[16]
Definition: ipsec.api:165
Set new SA on IPsec interface.
Definition: ipsec.api:653
IKEv2: Initiate the SA_INIT exchange.
Definition: ipsec.api:391
static vl_api_registration_t * vl_api_client_index_to_registration(u32 index)
Definition: api.h:56
static void vl_api_ipsec_sad_add_del_entry_t_handler(vl_api_ipsec_sad_add_del_entry_t *mp)
Definition: ipsec_api.c:182
port_range_t rport
Definition: ipsec.h:209
ip46_address_range_t raddr
Definition: ipsec.h:206
static void send_ipsec_spd_details(ipsec_policy_t *p, vl_api_registration_t *reg, u32 context)
Definition: ipsec_api.c:254
#define ASSERT(truth)
Dump IPsec security association.
Definition: ipsec.api:561
IKEv2: Set IKEv2 responder interface and IP address.
Definition: ipsec.api:305
u32 spi
Definition: ipsec.api:148
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:170
ip4_address_t local_ip
Definition: ipsec.h:162
ipsec_sa_t * sad
Definition: ipsec.h:264
IKEv2: Initiate the delete IKE SA exchange.
Definition: ipsec.api:406
u64 total_data_size
Definition: ipsec.h:144
IKEv2: Set IKEv2 profile authentication method.
Definition: ipsec.api:223
u8 integ_key_len
Definition: ipsec.h:122
Dump ipsec policy database data.
Definition: ipsec.api:450
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add, u8 udp_encap)
Definition: ipsec.c:414
u8 use_anti_replay
Definition: ipsec.api:161
ipsec_protocol_t protocol
Definition: ipsec.h:115
static vlib_main_t * vlib_get_main(void)
Definition: global_funcs.h:23
u32 seq
Definition: ipsec.h:137
IPsec policy database response.
Definition: ipsec.api:477
u8 * format_ipsec_integ_alg(u8 *s, va_list *args)
Definition: ipsec_format.c:90
u8 crypto_key_len
Definition: ipsec.h:118
counter_t bytes
byte counter
Definition: counter.h:143
static void vl_api_ikev2_profile_set_id_t_handler(vl_api_ikev2_profile_set_id_t *mp)
Definition: ipsec_api.c:634
int ipsec_add_del_tunnel_if_internal(vnet_main_t *vnm, ipsec_add_del_tunnel_args_t *args, u32 *sw_if_index)
Definition: ipsec_if.c:271
IKEv2: Set IKEv2 local RSA private key.
Definition: ipsec.api:289
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
vlib_counter_t counter
Definition: ipsec.h:217
u8 is_outbound
Definition: ipsec.h:201
u8 integrity_algorithm
Definition: ipsec.api:156
u8 integrity_key[128]
Definition: ipsec.api:158
u8 is_tunnel_ipv6
Definition: ipsec.api:164
u64 uword
Definition: types.h:112
clib_error_t * ikev2_set_profile_ike_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
Definition: ikev2.c:2828
IKEv2: Set IKEv2 ESP transforms in SA_INIT proposal (RFC 7296)
Definition: ipsec.api:349
static void vl_api_ikev2_profile_add_del_t_handler(vl_api_ikev2_profile_add_del_t *mp)
Definition: ipsec_api.c:588
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:117
static void vl_api_ikev2_initiate_del_ike_sa_t_handler(vl_api_ikev2_initiate_del_ike_sa_t *mp)
Definition: ipsec_api.c:826
static clib_error_t * ipsec_api_hookup(vlib_main_t *vm)
Definition: ipsec_api.c:908
u8 is_outbound
Definition: ipsec.api:86
u8 is_ipv6
Definition: ipsec.api:89
IPsec security association database response.
Definition: ipsec.api:594
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
Definition: vec.h:486
u8 use_anti_replay
Definition: ipsec.h:126
api_main_t api_main
Definition: api_shared.c:35
Add or delete IPsec tunnel interface.
Definition: ipsec.api:521
#define VALIDATE_SW_IF_INDEX(mp)
u8 protocol
Definition: ipsec.api:150
u8 is_ip_any
Definition: ipsec.api:90
static uword pool_elts(void *v)
Number of active elements in a pool.
Definition: pool.h:128