33 u32 dev_instance = va_arg (*args,
u32);
41 #define foreach_ipsec_if_tx_error \ 42 _(TX, "good packets transmitted") 53 sw_if_index = adj->rewrite_header.sw_if_index;
75 .fp_len = (ipsec_sa_is_set_IS_TUNNEL_V6(sa) ? 128 : 32),
76 .fp_proto = (ipsec_sa_is_set_IS_TUNNEL_V6(sa) ?
217 (
u8 *) args,
sizeof (*args));
224 return (0x80000000 | ti);
230 return (0xc0000000 | ti);
263 u32 hw_if_index = ~0;
269 int is_ip6 = args->
is_ip6;
270 ipsec4_tunnel_key_t key4;
271 ipsec6_tunnel_key_t key6;
275 key4.remote_ip = args->
remote_ip.ip4.as_u32;
276 key4.spi = clib_host_to_net_u32 (args->
remote_spi);
282 key6.spi = clib_host_to_net_u32 (args->
remote_spi);
290 return VNET_API_ERROR_INVALID_VALUE;
303 return VNET_API_ERROR_INSTANCE_IN_USE;
309 flags = IPSEC_SA_FLAG_IS_TUNNEL;
311 flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
313 flags |= IPSEC_SA_FLAG_UDP_ENCAP;
315 flags |= IPSEC_SA_FLAG_USE_ESN;
317 flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
331 (flags | IPSEC_SA_FLAG_IS_INBOUND),
338 return VNET_API_ERROR_INVALID_SRC_ADDRESS;
359 return VNET_API_ERROR_INVALID_DST_ADDRESS;
371 ipsec_hw_class.index,
405 return VNET_API_ERROR_INVALID_VALUE;
444 ipsec4_tunnel_key_t
key;
449 return VNET_API_ERROR_INVALID_VALUE;
452 ipsec_sa_set_IS_GRE (sa);
456 return VNET_API_ERROR_INVALID_VALUE;
459 ipsec_sa_set_IS_GRE (sa);
463 if (ipsec_sa_is_set_IS_TUNNEL (sa))
466 key.spi = clib_host_to_net_u32 (sa->
spi);
471 key.spi = clib_host_to_net_u32 (sa->
spi);
480 return VNET_API_ERROR_INVALID_VALUE;
507 return VNET_API_ERROR_INVALID_VALUE;
529 return VNET_API_ERROR_SYSCALL_ERROR_1;
556 return VNET_API_ERROR_INVALID_VALUE;
570 u32 sa_index, old_sa_index;
580 return VNET_API_ERROR_INVALID_VALUE;
585 clib_warning (
"SA with ID %u is already in use", sa_id);
586 return VNET_API_ERROR_INVALID_VALUE;
596 if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ^
597 ipsec_sa_is_set_IS_TUNNEL_V6 (old_sa))
599 clib_warning (
"IPsec interface SA endpoints type can't be changed");
600 return VNET_API_ERROR_INVALID_VALUE;
603 if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa))
605 ipsec6_tunnel_key_t
key;
609 key.spi = clib_host_to_net_u32 (old_sa->
spi);
618 key.spi = clib_host_to_net_u32 (sa->
spi);
625 ipsec4_tunnel_key_t
key;
629 key.spi = clib_host_to_net_u32 (old_sa->
spi);
638 key.spi = clib_host_to_net_u32 (sa->
spi);
649 if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ^
650 ipsec_sa_is_set_IS_TUNNEL_V6 (old_sa))
652 clib_warning (
"IPsec interface SA endpoints type can't be changed");
653 return VNET_API_ERROR_INVALID_VALUE;
671 clib_warning (
"IPsec backend add/del callback returned error");
672 return VNET_API_ERROR_SYSCALL_ERROR_1;
690 (ipsec6_tunnel_key_t),
static u32 ipsec_tun_mk_output_sa_id(u32 ti)
#define hash_set(h, key, value)
ipsec_tunnel_if_t * tunnel_interfaces
ip46_address_t tunnel_src_addr
#define hash_unset(h, key)
u8 vnet_get_feature_arc_index(const char *s)
void ip6_register_protocol(u32 protocol, u32 node_index)
vnet_main_t * vnet_get_main(void)
uword * ipsec4_if_pool_index_by_key
void adj_midchain_delegate_stack(adj_index_t ai, u32 fib_index, const fib_prefix_t *pfx)
create/attach a midchain delegate and stack it on the prefix passed
vnet_link_t adj_get_link_type(adj_index_t ai)
Return the link type of the adjacency.
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
int ipsec_set_interface_sa(vnet_main_t *vnm, u32 hw_if_index, u32 sa_id, u8 is_outbound)
static vnet_hw_interface_t * vnet_get_hw_interface(vnet_main_t *vnm, u32 hw_if_index)
static void ipsec_if_update_adj(vnet_main_t *vnm, u32 sw_if_index, adj_index_t ai)
u8 remote_crypto_key[128]
int ipsec_add_del_tunnel_if(ipsec_add_del_tunnel_args_t *args)
static adj_walk_rc_t ipsec_if_adj_walk_cb(adj_index_t ai, void *ctx)
Call back when restacking all adjacencies on a GRE interface.
VNET_DEVICE_CLASS(ipsec_device_class)
void ip4_register_protocol(u32 protocol, u32 node_index)
void ipsec_mk_key(ipsec_key_t *key, const u8 *data, u8 len)
enum fib_protocol_t_ fib_protocol_t
Protocol Type.
clib_error_t * ipsec_tunnel_if_init(vlib_main_t *vm)
static ip_adjacency_t * adj_get(adj_index_t adj_index)
Get a pointer to an adjacency object from its index.
uword * ipsec6_if_pool_index_by_key
#define VLIB_INIT_FUNCTION(x)
enum adj_walk_rc_t_ adj_walk_rc_t
return codes from a adjacency walker callback function
int vnet_feature_enable_disable_with_index(u8 arc_index, u32 feature_index, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
vnet_hw_interface_flags_t flags
uword * ipsec_if_by_sw_if_index
static void ipsec_if_tunnel_stack(adj_index_t ai)
Aggregrate type for a prefix.
int ipsec_set_interface_key(vnet_main_t *vnm, u32 hw_if_index, ipsec_if_set_key_type_t type, u8 alg, u8 *key)
u32 esp6_encrypt_tun_feature_index
u32 vnet_register_interface(vnet_main_t *vnm, u32 dev_class_index, u32 dev_instance, u32 hw_class_index, u32 hw_instance)
static clib_error_t * ipsec_admin_up_down_function(vnet_main_t *vnm, u32 hw_if_index, u32 flags)
int ipsec_add_del_ipsec_gre_tunnel(vnet_main_t *vnm, const ipsec_gre_tunnel_add_del_args_t *args)
#define hash_create_mem(elts, key_bytes, value_bytes)
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
ip46_address_t fp_addr
The address type is not deriveable from the fp_addr member.
clib_error_t * ipsec_check_support_cb(ipsec_main_t *im, ipsec_sa_t *sa)
#define pool_put(P, E)
Free an object E in pool P.
u8 ipsec_is_sa_used(u32 sa_index)
static u8 * ipsec_if_build_rewrite(vnet_main_t *vnm, u32 sw_if_index, vnet_link_t link_type, const void *dst_address)
#define pool_get_aligned_zero(P, E, A)
Allocate an object E from a pool P with alignment A and zero it.
static ipsec_sa_t * ipsec_sa_get(u32 sa_index)
ip46_address_t tunnel_dst_addr
#define pool_get_aligned(P, E, A)
Allocate an object E from a pool P with alignment A.
u32 ipsec_get_sa_index_by_sa_id(u32 sa_id)
ipsec_crypto_alg_t crypto_alg
clib_error_t * ipsec_add_del_sa_sess_cb(ipsec_main_t *im, u32 sa_index, u8 is_add)
void ipsec_sa_set_integ_alg(ipsec_sa_t *sa, ipsec_integ_alg_t integ_alg)
static_always_inline uword vlib_get_thread_index(void)
void vl_api_rpc_call_main_thread(void *fp, u8 *data, u32 data_length)
#define clib_warning(format, args...)
void adj_nbr_midchain_update_rewrite(adj_index_t adj_index, adj_midchain_fixup_t fixup, const void *fixup_data, adj_flags_t flags, u8 *rewrite)
adj_nbr_midchain_update_rewrite
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
uword * sa_index_by_sa_id
u32 adj_index_t
An index for adjacencies.
uword * ipsec_if_real_dev_by_show_dev
void adj_nbr_walk(u32 sw_if_index, fib_protocol_t adj_nh_proto, adj_walk_cb_t cb, void *ctx)
Walk the neighbour Adjacencies on a given interface.
static void ipsec_if_tunnel_restack(ipsec_tunnel_if_t *it)
u8 * default_build_rewrite(vnet_main_t *vnm, u32 sw_if_index, vnet_link_t link_type, const void *dst_address)
Return a complete, zero-length (aka dummy) rewrite.
void adj_midchain_delegate_unstack(adj_index_t ai)
unstack a midchain delegate (this stacks it on a drop)
#define hash_create(elts, value_bytes)
void ipsec_sa_set_crypto_alg(ipsec_sa_t *sa, ipsec_crypto_alg_t crypto_alg)
static int ipsec_add_del_tunnel_if_rpc_callback(ipsec_add_del_tunnel_args_t *a)
vnet_hw_interface_flags_t flags
ipsec_integ_alg_t integ_alg
enum vnet_link_t_ vnet_link_t
Link Type: A description of the protocol of packets on the link.
int ipsec_add_del_tunnel_if_internal(vnet_main_t *vnm, ipsec_add_del_tunnel_args_t *args, u32 *sw_if_index)
vlib_node_registration_t ipsec4_if_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_if_input_node)
static void ipsec_tunnel_feature_set(ipsec_main_t *im, ipsec_tunnel_if_t *t, u8 enable)
void vnet_delete_hw_interface(vnet_main_t *vnm, u32 hw_if_index)
int ipsec_sa_add(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 tx_table_id, u32 salt, const ip46_address_t *tun_src, const ip46_address_t *tun_dst, u32 *sa_out_index)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
VNET_HW_INTERFACE_CLASS(ipsec_hw_class)
clib_error_t * vnet_hw_interface_set_flags(vnet_main_t *vnm, u32 hw_if_index, vnet_hw_interface_flags_t flags)
static void hash_set_mem_alloc(uword **h, void *key, uword v)
a point 2 point interface
vlib_node_registration_t ipsec6_if_input_node
(constructor) VLIB_REGISTER_NODE (ipsec6_if_input_node)
void vnet_sw_interface_set_mtu(vnet_main_t *vnm, u32 sw_if_index, u32 mtu)
#define FOR_EACH_FIB_IP_PROTOCOL(_item)
#define hash_get_mem(h, key)
static void hash_unset_mem_free(uword **h, void *key)
static u8 * format_ipsec_name(u8 *s, va_list *args)
clib_error_t * vnet_sw_interface_set_flags(vnet_main_t *vnm, u32 sw_if_index, vnet_sw_interface_flags_t flags)
u32 esp4_encrypt_tun_feature_index
static u32 ipsec_tun_mk_input_sa_id(u32 ti)
void udp_register_dst_port(vlib_main_t *vm, udp_dst_port_t dst_port, u32 node_index, u8 is_ip4)
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
#define CLIB_CACHE_LINE_BYTES
static uword vnet_hw_interface_is_link_up(vnet_main_t *vnm, u32 hw_if_index)
static uword pool_elts(void *v)
Number of active elements in a pool.