FD.io VPP  v19.01.2-3-gf61a1a8
Vector Packet Processing
ipsec.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel support
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 #include <vnet/udp/udp.h>
23 
24 #include <vnet/ipsec/ipsec.h>
25 #include <vnet/ipsec/ikev2.h>
26 #include <vnet/ipsec/esp.h>
27 #include <vnet/ipsec/ah.h>
28 
29 
31 
32 u32
34 {
35  ipsec_main_t *im = &ipsec_main;
36  uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
37  if (!p)
38  return ~0;
39 
40  return p[0];
41 }
42 
43 int
45  int is_add)
46 {
47  ipsec_main_t *im = &ipsec_main;
48  ip4_ipsec_config_t config;
49 
50  u32 spd_index;
51  uword *p;
52 
53  p = hash_get (im->spd_index_by_spd_id, spd_id);
54  if (!p)
55  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
56 
57  spd_index = p[0];
58 
59  p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
60  if (p && is_add)
61  return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
62 
63  if (is_add)
64  {
65  hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
66  }
67  else
68  {
69  hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
70  }
71 
72  clib_warning ("sw_if_index %u spd_id %u spd_index %u",
73  sw_if_index, spd_id, spd_index);
74 
75  /* enable IPsec on TX */
76  vnet_feature_enable_disable ("ip4-output", "ipsec4-output-feature",
77  sw_if_index, is_add, 0, 0);
78  vnet_feature_enable_disable ("ip6-output", "ipsec6-output-feature",
79  sw_if_index, is_add, 0, 0);
80 
81  config.spd_index = spd_index;
82 
83  /* enable IPsec on RX */
84  vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input-feature",
85  sw_if_index, is_add, &config, sizeof (config));
86  vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input-feature",
87  sw_if_index, is_add, &config, sizeof (config));
88 
89  return 0;
90 }
91 
92 int
93 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
94 {
95  ipsec_main_t *im = &ipsec_main;
96  ipsec_spd_t *spd = 0;
97  uword *p;
98  u32 spd_index, k, v;
99 
100  p = hash_get (im->spd_index_by_spd_id, spd_id);
101  if (p && is_add)
102  return VNET_API_ERROR_INVALID_VALUE;
103  if (!p && !is_add)
104  return VNET_API_ERROR_INVALID_VALUE;
105 
106  if (!is_add) /* delete */
107  {
108  spd_index = p[0];
109  spd = pool_elt_at_index (im->spds, spd_index);
110  if (!spd)
111  return VNET_API_ERROR_INVALID_VALUE;
112  /* *INDENT-OFF* */
114  if (v == spd_index)
115  ipsec_set_interface_spd(vm, k, spd_id, 0);
116  }));
117  /* *INDENT-ON* */
118  hash_unset (im->spd_index_by_spd_id, spd_id);
119  pool_free (spd->policies);
124  pool_put (im->spds, spd);
125  }
126  else /* create new SPD */
127  {
128  pool_get (im->spds, spd);
129  clib_memset (spd, 0, sizeof (*spd));
130  spd_index = spd - im->spds;
131  spd->id = spd_id;
132  hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
133  }
134  return 0;
135 }
136 
137 static int
138 ipsec_spd_entry_sort (void *a1, void *a2)
139 {
140  u32 *id1 = a1;
141  u32 *id2 = a2;
142  ipsec_spd_t *spd = ipsec_main.spd_to_sort;
143  ipsec_policy_t *p1, *p2;
144 
145  p1 = pool_elt_at_index (spd->policies, *id1);
146  p2 = pool_elt_at_index (spd->policies, *id2);
147  if (p1 && p2)
148  return p2->priority - p1->priority;
149 
150  return 0;
151 }
152 
153 int
155 {
156  ipsec_main_t *im = &ipsec_main;
157  ipsec_spd_t *spd = 0;
158  ipsec_policy_t *vp;
159  uword *p;
160  u32 spd_index;
161 
162  clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
163  policy->priority, policy->is_outbound);
164 
165  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
166  {
167  p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
168  if (!p)
169  return VNET_API_ERROR_SYSCALL_ERROR_1;
170  policy->sa_index = p[0];
171  }
172 
173  p = hash_get (im->spd_index_by_spd_id, policy->id);
174 
175  if (!p)
176  return VNET_API_ERROR_SYSCALL_ERROR_1;
177 
178  spd_index = p[0];
179  spd = pool_elt_at_index (im->spds, spd_index);
180  if (!spd)
181  return VNET_API_ERROR_SYSCALL_ERROR_1;
182 
183  if (is_add)
184  {
185  u32 policy_index;
186 
187  pool_get (spd->policies, vp);
188  clib_memcpy (vp, policy, sizeof (*vp));
189  policy_index = vp - spd->policies;
190 
191  ipsec_main.spd_to_sort = spd;
192 
193  if (policy->is_outbound)
194  {
195  if (policy->is_ipv6)
196  {
197  vec_add1 (spd->ipv6_outbound_policies, policy_index);
200  }
201  else
202  {
203  vec_add1 (spd->ipv4_outbound_policies, policy_index);
206  }
207  }
208  else
209  {
210  if (policy->is_ipv6)
211  {
212  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
213  {
215  policy_index);
219  }
220  else
221  {
222  vec_add1
224  policy_index);
228  }
229  }
230  else
231  {
232  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
233  {
235  policy_index);
239  }
240  else
241  {
242  vec_add1
244  policy_index);
248  }
249  }
250  }
251 
252  ipsec_main.spd_to_sort = NULL;
253  }
254  else
255  {
256  u32 i, j;
257  /* *INDENT-OFF* */
258  pool_foreach_index(i, spd->policies, ({
259  vp = pool_elt_at_index(spd->policies, i);
260  if (vp->priority != policy->priority)
261  continue;
262  if (vp->is_outbound != policy->is_outbound)
263  continue;
264  if (vp->policy != policy->policy)
265  continue;
266  if (vp->sa_id != policy->sa_id)
267  continue;
268  if (vp->protocol != policy->protocol)
269  continue;
270  if (vp->lport.start != policy->lport.start)
271  continue;
272  if (vp->lport.stop != policy->lport.stop)
273  continue;
274  if (vp->rport.start != policy->rport.start)
275  continue;
276  if (vp->rport.stop != policy->rport.stop)
277  continue;
278  if (vp->is_ipv6 != policy->is_ipv6)
279  continue;
280  if (policy->is_ipv6)
281  {
282  if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
283  continue;
284  if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
285  continue;
286  if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
287  continue;
288  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
289  continue;
290  if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
291  continue;
292  if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
293  continue;
294  if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
295  continue;
296  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
297  continue;
298  if (policy->is_outbound)
299  {
300  vec_foreach_index(j, spd->ipv6_outbound_policies) {
301  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
302  vec_del1 (spd->ipv6_outbound_policies, j);
303  break;
304  }
305  }
306  }
307  else
308  {
309  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
310  {
311  vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
312  if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
313  vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
314  break;
315  }
316  }
317  }
318  else
319  {
320  vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
321  if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
322  vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
323  break;
324  }
325  }
326  }
327  }
328  }
329  else
330  {
331  if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
332  continue;
333  if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
334  continue;
335  if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
336  continue;
337  if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
338  continue;
339  if (policy->is_outbound)
340  {
341  vec_foreach_index(j, spd->ipv4_outbound_policies) {
342  if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
343  vec_del1 (spd->ipv4_outbound_policies, j);
344  break;
345  }
346  }
347  }
348  else
349  {
350  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
351  {
352  vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
353  if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
354  vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
355  break;
356  }
357  }
358  }
359  else
360  {
361  vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
362  if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
363  vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
364  break;
365  }
366  }
367  }
368  }
369  }
370  pool_put (spd->policies, vp);
371  break;
372  }));
373  /* *INDENT-ON* */
374  }
375 
376  return 0;
377 }
378 
379 u8
381 {
382  ipsec_main_t *im = &ipsec_main;
383  ipsec_spd_t *spd;
384  ipsec_policy_t *p;
386 
387  /* *INDENT-OFF* */
388  pool_foreach(spd, im->spds, ({
389  pool_foreach(p, spd->policies, ({
390  if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
391  {
392  if (p->sa_index == sa_index)
393  return 1;
394  }
395  }));
396  }));
397 
398  pool_foreach(t, im->tunnel_interfaces, ({
399  if (t->input_sa_index == sa_index)
400  return 1;
401  if (t->output_sa_index == sa_index)
402  return 1;
403  }));
404  /* *INDENT-ON* */
405 
406  return 0;
407 }
408 
409 clib_error_t *
411  u32 sa_index, int is_add)
412 {
413  ipsec_ah_backend_t *ab;
415  switch (sa->protocol)
416  {
417  case IPSEC_PROTOCOL_AH:
419  if (ab->add_del_sa_sess_cb)
420  return ab->add_del_sa_sess_cb (sa_index, is_add);
421  break;
422  case IPSEC_PROTOCOL_ESP:
424  if (eb->add_del_sa_sess_cb)
425  return eb->add_del_sa_sess_cb (sa_index, is_add);
426  break;
427  }
428  return 0;
429 }
430 
431 int
432 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
433 {
434  ipsec_main_t *im = &ipsec_main;
435  ipsec_sa_t *sa = 0;
436  uword *p;
437  u32 sa_index;
438  clib_error_t *err;
439 
440  clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
441 
442  p = hash_get (im->sa_index_by_sa_id, new_sa->id);
443  if (p && is_add)
444  return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
445  if (!p && !is_add)
446  return VNET_API_ERROR_SYSCALL_ERROR_1;
447 
448  if (!is_add) /* delete */
449  {
450  sa_index = p[0];
451  sa = pool_elt_at_index (im->sad, sa_index);
452  if (ipsec_is_sa_used (sa_index))
453  {
454  clib_warning ("sa_id %u used in policy", sa->id);
455  return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
456  }
457  hash_unset (im->sa_index_by_sa_id, sa->id);
458  err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
459  if (err)
460  return VNET_API_ERROR_SYSCALL_ERROR_1;
461  pool_put (im->sad, sa);
462  }
463  else /* create new SA */
464  {
465  pool_get (im->sad, sa);
466  clib_memcpy (sa, new_sa, sizeof (*sa));
467  sa_index = sa - im->sad;
468  hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
469  err = ipsec_call_add_del_callbacks (im, sa, sa_index, 1);
470  if (err)
471  return VNET_API_ERROR_SYSCALL_ERROR_1;
472  }
473  return 0;
474 }
475 
476 int
478 {
479  ipsec_main_t *im = &ipsec_main;
480  uword *p;
481  u32 sa_index;
482  ipsec_sa_t *sa = 0;
483  clib_error_t *err;
484 
485  p = hash_get (im->sa_index_by_sa_id, sa_update->id);
486  if (!p)
487  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
488 
489  sa_index = p[0];
490  sa = pool_elt_at_index (im->sad, sa_index);
491 
492  /* new crypto key */
493  if (0 < sa_update->crypto_key_len)
494  {
495  clib_memcpy (sa->crypto_key, sa_update->crypto_key,
496  sa_update->crypto_key_len);
497  sa->crypto_key_len = sa_update->crypto_key_len;
498  }
499 
500  /* new integ key */
501  if (0 < sa_update->integ_key_len)
502  {
503  clib_memcpy (sa->integ_key, sa_update->integ_key,
504  sa_update->integ_key_len);
505  sa->integ_key_len = sa_update->integ_key_len;
506  }
507 
508  if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
509  {
510  err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
511  if (err)
512  return VNET_API_ERROR_SYSCALL_ERROR_1;
513  }
514 
515  return 0;
516 }
517 
518 static void
520 {
521  struct
522  {
523  time_t time;
524  pid_t pid;
525  void *p;
526  } seed_data;
527 
528  seed_data.time = time (NULL);
529  seed_data.pid = getpid ();
530  seed_data.p = (void *) &seed_data;
531 
532  RAND_seed ((const void *) &seed_data, sizeof (seed_data));
533 }
534 
535 static clib_error_t *
537 {
538  if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
539  return clib_error_return (0, "unsupported none integ-alg");
540  return 0;
541 }
542 
543 static clib_error_t *
545 {
546  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
547  return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
548  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_192)
549  return clib_error_return (0, "unsupported aes-gcm-192 crypto-alg");
550  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_256)
551  return clib_error_return (0, "unsupported aes-gcm-256 crypto-alg");
552 
553  return 0;
554 }
555 
556 clib_error_t *
557 ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, u8 is_add)
558 {
559  ipsec_ah_backend_t *ah =
561  if (ah->add_del_sa_sess_cb)
562  {
563  clib_error_t *err = ah->add_del_sa_sess_cb (sa_index, is_add);
564  if (err)
565  return err;
566  }
567  ipsec_esp_backend_t *esp =
569  if (esp->add_del_sa_sess_cb)
570  {
571  clib_error_t *err = esp->add_del_sa_sess_cb (sa_index, is_add);
572  if (err)
573  return err;
574  }
575  return 0;
576 }
577 
578 clib_error_t *
580 {
581  clib_error_t *error = 0;
582 
584  {
585  ipsec_ah_backend_t *ah =
587  ASSERT (ah->check_support_cb);
588  error = ah->check_support_cb (sa);
589  }
590  else
591  {
592  ipsec_esp_backend_t *esp =
594  ASSERT (esp->check_support_cb);
595  error = esp->check_support_cb (sa);
596  }
597  return error;
598 }
599 
600 
601 static void
602 ipsec_add_node (vlib_main_t * vm, const char *node_name,
603  const char *prev_node_name, u32 * out_node_index,
604  u32 * out_next_index)
605 {
606  vlib_node_t *prev_node, *node;
607  prev_node = vlib_get_node_by_name (vm, (u8 *) prev_node_name);
608  ASSERT (prev_node);
609  node = vlib_get_node_by_name (vm, (u8 *) node_name);
610  ASSERT (node);
611  *out_node_index = node->index;
612  *out_next_index = vlib_node_add_next (vm, prev_node->index, node->index);
613 }
614 
615 u32
617  const char *name,
618  const char *ah4_encrypt_node_name,
619  const char *ah4_decrypt_node_name,
620  const char *ah6_encrypt_node_name,
621  const char *ah6_decrypt_node_name,
622  check_support_cb_t ah_check_support_cb,
623  add_del_sa_sess_cb_t ah_add_del_sa_sess_cb)
624 {
626  pool_get (im->ah_backends, b);
627  b->name = format (NULL, "%s", name);
628 
629  ipsec_add_node (vm, ah4_encrypt_node_name, "ipsec4-output-feature",
631  ipsec_add_node (vm, ah4_decrypt_node_name, "ipsec4-input-feature",
633  ipsec_add_node (vm, ah6_encrypt_node_name, "ipsec6-output-feature",
635  ipsec_add_node (vm, ah6_decrypt_node_name, "ipsec6-input-feature",
637 
638  b->check_support_cb = ah_check_support_cb;
639  b->add_del_sa_sess_cb = ah_add_del_sa_sess_cb;
640  return b - im->ah_backends;
641 }
642 
643 u32
645  const char *name,
646  const char *esp4_encrypt_node_name,
647  const char *esp4_decrypt_node_name,
648  const char *esp6_encrypt_node_name,
649  const char *esp6_decrypt_node_name,
650  check_support_cb_t esp_check_support_cb,
651  add_del_sa_sess_cb_t esp_add_del_sa_sess_cb)
652 {
654  pool_get (im->esp_backends, b);
655  b->name = format (NULL, "%s", name);
656 
657  ipsec_add_node (vm, esp4_encrypt_node_name, "ipsec4-output-feature",
659  ipsec_add_node (vm, esp4_decrypt_node_name, "ipsec4-input-feature",
661  ipsec_add_node (vm, esp6_encrypt_node_name, "ipsec6-output-feature",
663  ipsec_add_node (vm, esp6_decrypt_node_name, "ipsec6-input-feature",
665 
666  b->check_support_cb = esp_check_support_cb;
667  b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb;
668  return b - im->esp_backends;
669 }
670 
671 int
673 {
674  if (pool_elts (im->sad) > 0
675  || pool_is_free_index (im->ah_backends, backend_idx))
676  {
677  return -1;
678  }
679  ipsec_ah_backend_t *b = pool_elt_at_index (im->ah_backends, backend_idx);
680  im->ah_current_backend = backend_idx;
689  return 0;
690 }
691 
692 int
694 {
695  if (pool_elts (im->sad) > 0
696  || pool_is_free_index (im->esp_backends, backend_idx))
697  {
698  return -1;
699  }
700  ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx);
701  im->esp_current_backend = backend_idx;
710  return 0;
711 }
712 
713 static clib_error_t *
715 {
716  clib_error_t *error;
717  ipsec_main_t *im = &ipsec_main;
719 
720  ipsec_rand_seed ();
721 
722  clib_memset (im, 0, sizeof (im[0]));
723 
724  im->vnet_main = vnet_get_main ();
725  im->vlib_main = vm;
726 
727  im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
728  im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
729  im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
730 
733 
734  vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
735  ASSERT (node);
736  im->error_drop_node_index = node->index;
737 
738  u32 idx = ipsec_register_ah_backend (vm, im, "default openssl backend",
739  "ah4-encrypt",
740  "ah4-decrypt",
741  "ah6-encrypt",
742  "ah6-decrypt",
744  NULL);
745 
746  im->ah_default_backend = idx;
747  int rv = ipsec_select_ah_backend (im, idx);
748  ASSERT (0 == rv);
749  (void) (rv); // avoid warning
750 
751  idx = ipsec_register_esp_backend (vm, im, "default openssl backend",
752  "esp4-encrypt",
753  "esp4-decrypt",
754  "esp6-encrypt",
755  "esp6-decrypt",
757  im->esp_default_backend = idx;
758 
759  rv = ipsec_select_esp_backend (im, idx);
760  ASSERT (0 == rv);
761  (void) (rv); // avoid warning
762 
763  if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
764  return error;
765 
766  if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
767  return error;
768 
769  ipsec_proto_init ();
770 
771  if ((error = ikev2_init (vm)))
772  return error;
773 
774  return 0;
775 }
776 
778 
779 /*
780  * fd.io coding-style-patch-verification: ON
781  *
782  * Local Variables:
783  * eval: (c-set-style "gnu")
784  * End:
785  */
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:241
ipsec_spd_t * spds
Definition: ipsec.h:352
u32 ipsec_register_ah_backend(vlib_main_t *vm, ipsec_main_t *im, const char *name, const char *ah4_encrypt_node_name, const char *ah4_decrypt_node_name, const char *ah6_encrypt_node_name, const char *ah6_decrypt_node_name, check_support_cb_t ah_check_support_cb, add_del_sa_sess_cb_t ah_add_del_sa_sess_cb)
Definition: ipsec.c:616
#define hash_set(h, key, value)
Definition: hash.h:255
u32 esp_default_backend
Definition: ipsec.h:408
u32 esp4_encrypt_next_index
Definition: ipsec.h:294
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:239
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
Definition: ipsec.c:154
u32 esp6_decrypt_node_index
Definition: ipsec.h:384
#define hash_unset(h, key)
Definition: hash.h:261
u32 ah4_decrypt_next_index
Definition: ipsec.h:391
u32 id
Definition: ipsec.h:121
vnet_main_t * vnet_get_main(void)
Definition: misc.c:47
static void ipsec_add_node(vlib_main_t *vm, const char *node_name, const char *prev_node_name, u32 *out_node_index, u32 *out_next_index)
Definition: ipsec.c:602
i32 priority
Definition: ipsec.h:211
static void ipsec_rand_seed(void)
Definition: ipsec.c:519
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Definition: ipsec.c:44
#define NULL
Definition: clib.h:58
u32 index
Definition: node.h:304
u32 esp4_decrypt_node_index
Definition: ipsec.h:293
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:129
u32 ah6_decrypt_next_index
Definition: ipsec.h:282
u32 esp6_decrypt_next_index
Definition: ipsec.h:299
u32 ah4_encrypt_next_index
Definition: ipsec.h:390
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:525
u32 ah4_encrypt_node_index
Definition: ipsec.h:275
u32 esp6_encrypt_node_index
Definition: ipsec.h:296
int i
u32 * ipv4_outbound_policies
Definition: ipsec.h:237
clib_memset(h->entries, 0, sizeof(h->entries[0])*entries)
int ipsec_select_ah_backend(ipsec_main_t *im, u32 backend_idx)
Definition: ipsec.c:672
u32 ah_current_backend
Definition: ipsec.h:402
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
u32 ipsec_get_sa_index_by_sa_id(u32 sa_id)
Definition: ipsec.c:33
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
Definition: vec.h:450
u32 esp_current_backend
Definition: ipsec.h:404
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:236
u32 ah6_decrypt_node_index
Definition: ipsec.h:280
static uword vlib_node_add_next(vlib_main_t *vm, uword node, uword next_node)
Definition: node_funcs.h:1122
unsigned char u8
Definition: types.h:56
u8 crypto_key[128]
Definition: ipsec.h:127
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Definition: ipsec.c:93
u32 spi
Definition: ipsec.h:122
uword * spd_index_by_sw_if_index
Definition: ipsec.h:372
#define clib_memcpy(d, s, n)
Definition: string.h:180
clib_error_t * ipsec_tunnel_if_init(vlib_main_t *vm)
Definition: ipsec_if.c:603
u32 esp6_encrypt_next_index
Definition: ipsec.h:298
static clib_error_t * ipsec_check_ah_support(ipsec_sa_t *sa)
Definition: ipsec.c:536
u32 ah6_encrypt_node_index
Definition: ipsec.h:279
u8 integ_key[128]
Definition: ipsec.h:131
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:490
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:163
ipsec_main_t ipsec_main
Definition: ipsec.c:30
u32 ah_default_backend
Definition: ipsec.h:406
u32 sw_if_index
Definition: vxlan_gbp.api:37
u32 esp6_encrypt_node_index
Definition: ipsec.h:383
u32 esp4_decrypt_next_index
Definition: ipsec.h:389
u32 ah6_encrypt_next_index
Definition: ipsec.h:281
int ipsec_select_esp_backend(ipsec_main_t *im, u32 backend_idx)
Definition: ipsec.c:693
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:442
#define clib_error_return(e, args...)
Definition: error.h:99
check_support_cb_t check_support_cb
Definition: ipsec.h:291
ipsec_spd_t * spd_to_sort
Definition: ipsec.h:411
unsigned int u32
Definition: types.h:88
clib_error_t *(* add_del_sa_sess_cb_t)(u32 sa_index, u8 is_add)
Definition: ipsec.h:265
#define vlib_call_init_function(vm, x)
Definition: init.h:260
u32 esp6_decrypt_node_index
Definition: ipsec.h:297
ipsec_policy_t * policies
Definition: ipsec.h:235
u32 ah4_decrypt_node_index
Definition: ipsec.h:382
u32 error_drop_node_index
Definition: ipsec.h:378
#define hash_get(h, key)
Definition: hash.h:249
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:511
u32 esp4_encrypt_node_index
Definition: ipsec.h:379
vnet_main_t * vnet_main
Definition: ipsec.h:365
clib_error_t * ipsec_check_support_cb(ipsec_main_t *im, ipsec_sa_t *sa)
Definition: ipsec.c:579
u32 ah4_decrypt_next_index
Definition: ipsec.h:278
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:286
#define PREDICT_FALSE(x)
Definition: clib.h:111
u8 name[64]
Definition: memclnt.api:152
u32 esp4_encrypt_node_index
Definition: ipsec.h:292
uword * spd_index_by_spd_id
Definition: ipsec.h:371
#define pool_free(p)
Free a pool.
Definition: pool.h:404
u32 ah4_decrypt_node_index
Definition: ipsec.h:276
clib_error_t * ipsec_add_del_sa_sess_cb(ipsec_main_t *im, u32 sa_index, u8 is_add)
Definition: ipsec.c:557
u32 ah6_encrypt_next_index
Definition: ipsec.h:394
vlib_main_t * vm
Definition: buffer.c:301
ipsec_ah_backend_t * ah_backends
Definition: ipsec.h:398
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add)
Definition: ipsec.c:432
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
Definition: ipsec_cli.c:1054
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:341
u32 sa_index
Definition: ipsec.h:225
u32 esp4_encrypt_next_index
Definition: ipsec.h:388
#define clib_warning(format, args...)
Definition: error.h:59
u32 ah4_encrypt_next_index
Definition: ipsec.h:277
uword * sa_index_by_sa_id
Definition: ipsec.h:373
clib_error_t * ipsec_call_add_del_callbacks(ipsec_main_t *im, ipsec_sa_t *sa, u32 sa_index, int is_add)
Definition: ipsec.c:410
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
Definition: ipsec.c:477
u32 esp6_decrypt_next_index
Definition: ipsec.h:393
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
Definition: pool.h:283
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
Definition: node.c:45
vlib_main_t * vlib_main
Definition: ipsec.h:364
static clib_error_t * ipsec_init(vlib_main_t *vm)
Definition: ipsec.c:714
u32 esp6_encrypt_next_index
Definition: ipsec.h:392
static clib_error_t * ipsec_check_esp_support(ipsec_sa_t *sa)
Definition: ipsec.c:544
clib_error_t *(* check_support_cb_t)(ipsec_sa_t *sa)
Definition: ipsec.h:266
#define hash_create(elts, value_bytes)
Definition: hash.h:696
u8 ipsec_is_sa_used(u32 sa_index)
Definition: ipsec.c:380
u32 ipsec_register_esp_backend(vlib_main_t *vm, ipsec_main_t *im, const char *name, const char *esp4_encrypt_node_name, const char *esp4_decrypt_node_name, const char *esp6_encrypt_node_name, const char *esp6_decrypt_node_name, check_support_cb_t esp_check_support_cb, add_del_sa_sess_cb_t esp_add_del_sa_sess_cb)
Definition: ipsec.c:644
#define ASSERT(truth)
u32 ah4_encrypt_node_index
Definition: ipsec.h:381
ipsec_sa_t * sad
Definition: ipsec.h:353
u32 esp4_decrypt_node_index
Definition: ipsec.h:380
u8 integ_key_len
Definition: ipsec.h:130
ipsec_protocol_t protocol
Definition: ipsec.h:123
add_del_sa_sess_cb_t add_del_sa_sess_cb
Definition: ipsec.h:289
u32 ah6_decrypt_node_index
Definition: ipsec.h:386
u8 crypto_key_len
Definition: ipsec.h:126
u32 ah6_encrypt_node_index
Definition: ipsec.h:385
u32 ah6_decrypt_next_index
Definition: ipsec.h:395
check_support_cb_t check_support_cb
Definition: ipsec.h:274
u32 * ipv4_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:240
u8 is_outbound
Definition: ipsec.h:212
u32 * ipv6_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:242
u64 uword
Definition: types.h:112
#define vec_sort_with_function(vec, f)
Sort a vector using the supplied element comparison function.
Definition: vec.h:984
static void ipsec_proto_init()
Definition: esp.h:206
u32 * ipv6_outbound_policies
Definition: ipsec.h:238
u32 esp4_decrypt_next_index
Definition: ipsec.h:295
u32 id
Definition: ipsec.h:233
clib_error_t * ikev2_init(vlib_main_t *vm)
Definition: ikev2.c:3293
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:125
static vlib_thread_main_t * vlib_get_thread_main()
Definition: global_funcs.h:32
static int ipsec_spd_entry_sort(void *a1, void *a2)
Definition: ipsec.c:138
add_del_sa_sess_cb_t add_del_sa_sess_cb
Definition: ipsec.h:272
#define pool_foreach_index(i, v, body)
Iterate pool by index.
Definition: pool.h:535
ipsec_esp_backend_t * esp_backends
Definition: ipsec.h:400
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
u32 ** empty_buffers
Definition: ipsec.h:359
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
Definition: feature.c:274
static uword pool_elts(void *v)
Number of active elements in a pool.
Definition: pool.h:128