45 #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__) 52 #define foreach_vpe_api_msg \ 53 _(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \ 54 _(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ 55 _(IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \ 56 _(IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \ 57 _(IPSEC_SA_DUMP, ipsec_sa_dump) \ 58 _(IPSEC_SPDS_DUMP, ipsec_spds_dump) \ 59 _(IPSEC_SPD_DUMP, ipsec_spd_dump) \ 60 _(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ 61 _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ 62 _(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \ 63 _(IPSEC_SELECT_BACKEND, ipsec_select_backend) \ 64 _(IPSEC_BACKEND_DUMP, ipsec_backend_dump) \ 65 _(IPSEC_TUNNEL_PROTECT_UPDATE, ipsec_tunnel_protect_update) \ 66 _(IPSEC_TUNNEL_PROTECT_DEL, ipsec_tunnel_protect_del) \ 67 _(IPSEC_TUNNEL_PROTECT_DUMP, ipsec_tunnel_protect_dump) 77 vl_api_ipsec_spd_add_del_reply_t *rmp;
90 vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
93 u32 spd_id __attribute__ ((unused));
96 spd_id = ntohl (mp->
spd_id);
103 rv = VNET_API_ERROR_UNIMPLEMENTED;
108 REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
115 vl_api_ipsec_tunnel_protect_update_reply_t *rmp;
119 sw_if_index = ntohl (mp->
tunnel.sw_if_index);
125 for (ii = 0; ii < mp->
tunnel.n_sa_in; ii++)
129 ntohl (mp->
tunnel.sa_out), sa_ins);
131 rv = VNET_API_ERROR_UNIMPLEMENTED;
136 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_UPDATE_REPLY);
143 vl_api_ipsec_tunnel_protect_del_reply_t *rmp;
154 rv = VNET_API_ERROR_UNIMPLEMENTED;
159 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_DEL_REPLY);
181 mp->_vl_msg_id = ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS);
191 mp->
tun.sa_in[ii++] = htonl (sai);
219 if (~0 == sw_if_index)
241 in = clib_net_to_host_u32 (in);
245 #define _(v,f,s) case IPSEC_API_SPD_ACTION_##f: \ 246 *out = IPSEC_POLICY_ACTION_##f; \ 251 return (VNET_API_ERROR_UNIMPLEMENTED);
270 p.
id = ntohl (mp->
entry.spd_id);
292 if (p.
policy == IPSEC_POLICY_ACTION_RESOLVE)
295 rv = VNET_API_ERROR_UNIMPLEMENTED;
310 rv = VNET_API_ERROR_UNIMPLEMENTED;
326 in = clib_net_to_host_u32 (in);
337 return (VNET_API_ERROR_INVALID_PROTOCOL);
340 static vl_api_ipsec_proto_t
350 return (VNET_API_ERROR_UNIMPLEMENTED);
357 in = clib_net_to_host_u32 (in);
361 #define _(v,f,s) case IPSEC_API_CRYPTO_ALG_##f: \ 362 *out = IPSEC_CRYPTO_ALG_##f; \ 367 return (VNET_API_ERROR_INVALID_ALGORITHM);
370 static vl_api_ipsec_crypto_alg_t
375 #define _(v,f,s) case IPSEC_CRYPTO_ALG_##f: \ 376 return clib_host_to_net_u32(IPSEC_API_CRYPTO_ALG_##f); 383 return (VNET_API_ERROR_UNIMPLEMENTED);
390 in = clib_net_to_host_u32 (in);
394 #define _(v,f,s) case IPSEC_API_INTEG_ALG_##f: \ 395 *out = IPSEC_INTEG_ALG_##f; \ 400 return (VNET_API_ERROR_INVALID_ALGORITHM);
403 static vl_api_ipsec_integ_alg_t
408 #define _(v,f,s) case IPSEC_INTEG_ALG_##f: \ 409 return (clib_host_to_net_u32(IPSEC_API_INTEG_ALG_##f)); 416 return (VNET_API_ERROR_UNIMPLEMENTED);
428 out->length = in->
len;
436 in = clib_net_to_host_u32 (in);
439 flags |= IPSEC_SA_FLAG_USE_ESN;
441 flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
443 flags |= IPSEC_SA_FLAG_IS_TUNNEL;
445 flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
447 flags |= IPSEC_SA_FLAG_UDP_ENCAP;
452 static vl_api_ipsec_sad_flags_t
457 if (ipsec_sa_is_set_USE_ESN (sa))
459 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
461 if (ipsec_sa_is_set_IS_TUNNEL (sa))
463 if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa))
465 if (ipsec_sa_is_set_UDP_ENCAP (sa))
468 return clib_host_to_net_u32 (flags);
476 ip46_address_t tun_src = { }, tun_dst =
489 id = ntohl (mp->
entry.sad_id);
490 spi = ntohl (mp->
entry.spi);
517 crypto_alg, &crypto_key,
518 integ_alg, &integ_key, flags,
519 0, mp->
entry.salt, &tun_src, &tun_dst,
525 rv = VNET_API_ERROR_UNIMPLEMENTED;
546 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
550 #define _(s, n) n_policies += vec_len (spd->policies[IPSEC_SPD_POLICY_##s]); 571 send_ipsec_spds_details (spd, reg, mp->context);
579 vl_api_ipsec_spd_action_t
586 #define _(v,f,s) case IPSEC_POLICY_ACTION_##f: \ 587 out = IPSEC_API_SPD_ACTION_##f; \ 592 return (clib_host_to_net_u32 (out));
603 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
606 mp->
entry.spd_id = htonl (p->
id);
608 mp->
entry.is_outbound = ((p->
type == IPSEC_SPD_POLICY_IP6_OUTBOUND) ||
609 (p->
type == IPSEC_SPD_POLICY_IP4_OUTBOUND));
612 &mp->
entry.local_address_start);
614 &mp->
entry.local_address_stop);
616 &mp->
entry.remote_address_start);
618 &mp->
entry.remote_address_stop);
676 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
704 send_ipsec_spd_interface_details(reg, v, k, mp->context);
712 send_ipsec_spd_interface_details(reg, v, k, mp->context);
769 rv = VNET_API_ERROR_UNIMPLEMENTED;
788 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
791 mp->
entry.sad_id = htonl (sa->
id);
794 mp->
entry.tx_table_id =
805 if (ipsec_sa_is_set_IS_TUNNEL (sa))
808 &mp->
entry.tunnel_src);
810 &mp->
entry.tunnel_dst);
814 mp->
salt = clib_host_to_net_u32 (sa->
salt);
817 if (ipsec_sa_is_set_USE_ESN (sa))
822 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
837 u32 *sa_index_to_tun_if_index = 0;
850 vnet_hw_interface_t *hi;
851 u32 sw_if_index = ~0;
853 hi = vnet_get_hw_interface (vnm, t->hw_if_index);
854 sw_if_index = hi->sw_if_index;
855 sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index;
856 sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index;
861 if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id)
862 send_ipsec_sa_details (sa, reg, mp->context,
863 sa_index_to_tun_if_index[sa - im->sad]);
867 vec_free (sa_index_to_tun_if_index);
876 vl_api_ipsec_tunnel_if_set_sa_reply_t *rmp;
913 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
914 clib_memset (mp, 0, sizeof (*mp));
915 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
916 mp->context = context;
917 snprintf ((char *)mp->name, sizeof (mp->name),
"%.*s", vec_len (ab->name),
919 mp->protocol = ntohl (IPSEC_API_PROTO_AH);
920 mp->index = ab - im->ah_backends;
921 mp->active = mp->index == im->ah_current_backend ? 1 : 0;
922 vl_api_send_msg (rp, (u8 *)mp);
925 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
926 clib_memset (mp, 0, sizeof (*mp));
927 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
928 mp->context = context;
929 snprintf ((char *)mp->name, sizeof (mp->name),
"%.*s", vec_len (eb->name),
931 mp->protocol = ntohl (IPSEC_API_PROTO_ESP);
932 mp->index = eb - im->esp_backends;
933 mp->active = mp->index == im->esp_current_backend ? 1 : 0;
934 vl_api_send_msg (rp, (u8 *)mp);
943 vl_api_ipsec_select_backend_reply_t *rmp;
948 rv = VNET_API_ERROR_INSTANCE_IN_USE;
967 rv = VNET_API_ERROR_INVALID_PROTOCOL;
984 #define vl_msg_name_crc_list 986 #undef vl_msg_name_crc_list 991 #define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id); 992 foreach_vl_msg_name_crc_ipsec;
1002 vl_msg_api_set_handlers(VL_API_##N, #n, \ 1003 vl_api_##n##_t_handler, \ 1005 vl_api_##n##_t_endian, \ 1006 vl_api_##n##_t_print, \ 1007 sizeof(vl_api_##n##_t), 1); 1015 am->
is_mp_safe[VL_API_IPSEC_SAD_ENTRY_ADD_DEL] = 1;
1016 am->
is_mp_safe[VL_API_IPSEC_SAD_ENTRY_ADD_DEL_REPLY] = 1;
IPsec: Add/delete Security Policy Database entry.
vl_api_ipsec_spd_action_t ipsec_spd_action_encode(ipsec_policy_action_t in)
ipsec_tunnel_if_t * tunnel_interfaces
ip46_address_t tunnel_src_addr
enum ipsec_spd_policy_t_ ipsec_spd_policy_type_t
IPsec: SPD interface response.
VLIB_API_INIT_FUNCTION(ipsec_api_hookup)
static vl_api_ipsec_crypto_alg_t ipsec_crypto_algo_encode(ipsec_crypto_alg_t c)
ip46_address_range_t laddr
#define REPLY_MACRO2(t, body)
#define foreach_ipsec_crypto_alg
#define FOR_EACH_IPSEC_SPD_POLICY_TYPE(_t)
int ipsec_set_interface_sa(vnet_main_t *vnm, u32 hw_if_index, u32 sa_id, u8 is_outbound)
int ipsec_policy_mk_type(bool is_outbound, bool is_ipv6, ipsec_policy_action_t action, ipsec_spd_policy_type_t *type)
static void vl_api_send_msg(vl_api_registration_t *rp, u8 *elem)
ipsec_integ_alg_t integ_alg
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
u8 remote_crypto_key[128]
static void setup_message_id_table(api_main_t *am)
#define foreach_ipsec_integ_alg
vl_api_ipsec_spd_action_t policy
clib_memset(h->entries, 0, sizeof(h->entries[0])*entries)
static void vl_api_ipsec_sa_dump_t_handler(vl_api_ipsec_sa_dump_t *mp)
static vnet_sw_interface_t * vnet_get_sw_interface(vnet_main_t *vnm, u32 sw_if_index)
int ipsec_select_ah_backend(ipsec_main_t *im, u32 backend_idx)
A Secruity Policy Database.
static ipsec_sa_flags_t ipsec_sa_flags_decode(vl_api_ipsec_sad_flags_t in)
void * vl_msg_api_alloc(int nbytes)
void ipsec_tun_protect_walk(ipsec_tun_protect_walk_cb_t fn, void *ctx)
void ipsec_mk_key(ipsec_key_t *key, const u8 *data, u8 len)
#define foreach_vpe_api_msg
vl_api_interface_index_t sw_if_index
vl_api_address_t remote_ip
uword * spd_index_by_sw_if_index
static void vl_api_ipsec_interface_add_del_spd_t_handler(vl_api_ipsec_interface_add_del_spd_t *mp)
#define clib_memcpy(d, s, n)
enum walk_rc_t_ walk_rc_t
Walk return code.
vl_api_interface_index_t sw_if_index
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
vl_api_interface_index_t sw_if_index
static int ipsec_proto_decode(vl_api_ipsec_proto_t in, ipsec_protocol_t *out)
static void vl_api_ipsec_tunnel_if_add_del_t_handler(vl_api_ipsec_tunnel_if_add_del_t *mp)
static void vl_api_ipsec_backend_dump_t_handler(vl_api_ipsec_backend_dump_t *mp)
int ipsec_select_esp_backend(ipsec_main_t *im, u32 backend_idx)
#define hash_foreach(key_var, value_var, h, body)
static void vl_api_ipsec_spd_dump_t_handler(vl_api_ipsec_spd_dump_t *mp)
static void vl_api_ipsec_spd_interface_dump_t_handler(vl_api_ipsec_spd_interface_dump_t *mp)
vl_api_address_t local_ip
int ipsec_sa_unlock_id(u32 id)
IPsec: Reply Add/delete Security Policy Database entry.
ip46_type_t ip_address_decode(const vl_api_address_t *in, ip46_address_t *out)
static void vl_api_ipsec_spd_add_del_t_handler(vl_api_ipsec_spd_add_del_t *mp)
IPsec: Add/delete Security Association Database entry.
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
u8 remote_crypto_key[128]
Dump IPsec all SPD IDs response.
Add/delete IPsec tunnel interface response.
vl_api_ip_proto_t protocol
IPsec: Add/delete Security Policy Database.
vl_api_ipsec_tunnel_protect_t tun
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add, u32 *stat_index)
Add/Delete a SPD.
static int ipsec_spd_action_decode(vl_api_ipsec_spd_action_t in, ipsec_policy_action_t *out)
vl_api_ipsec_tunnel_protect_t tunnel
ipsec_spd_policy_type_t type
static vl_api_ipsec_sad_flags_t ipsec_sad_flags_encode(const ipsec_sa_t *sa)
int ipsec_tun_protect_del(u32 sw_if_index)
static void send_ipsec_sa_details(ipsec_sa_t *sa, vl_api_registration_t *reg, u32 context, u32 sw_if_index)
uword * spd_index_by_spd_id
static void vl_api_ipsec_tunnel_if_set_sa_t_handler(vl_api_ipsec_tunnel_if_set_sa_t *mp)
API main structure, used by both vpp and binary API clients.
ip46_address_t tunnel_dst_addr
An API client registration, only in vpp/vlib.
#define BAD_SW_IF_INDEX_LABEL
IPsec: Add/delete SPD from interface.
ipsec_crypto_alg_t crypto_alg
int ipsec_tun_protect_update(u32 sw_if_index, u32 sa_out, u32 *sas_in)
ipsec_ah_backend_t * ah_backends
#define vec_free(V)
Free vector's memory (no header).
vl_api_ipsec_sad_entry_t entry
ipsec_policy_action_t policy
#define clib_warning(format, args...)
static int ipsec_crypto_algo_decode(vl_api_ipsec_crypto_alg_t in, ipsec_crypto_alg_t *out)
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
vl_api_ipsec_proto_t protocol
vl_api_registration_t * reg
#define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body)
Set new SA on IPsec interface.
static vl_api_registration_t * vl_api_client_index_to_registration(u32 index)
static void vl_api_ipsec_spds_dump_t_handler(vl_api_ipsec_spds_dump_t *mp)
static void vl_api_ipsec_tunnel_protect_dump_t_handler(vl_api_ipsec_tunnel_protect_dump_t *mp)
static void send_ipsec_spd_interface_details(vl_api_registration_t *reg, u32 spd_index, u32 sw_if_index, u32 context)
vl_api_ipsec_sad_entry_t entry
static void send_ipsec_spd_details(ipsec_policy_t *p, vl_api_registration_t *reg, u32 context)
u8 data[IPSEC_KEY_MAX_LEN]
static void vl_api_ipsec_spd_entry_add_del_t_handler(vl_api_ipsec_spd_entry_add_del_t *mp)
ipsec_policy_t * policies
Dump IPsec security association.
ipsec_integ_alg_t integ_alg
u32 fib_table_get_table_id(u32 fib_index, fib_protocol_t proto)
Get the Table-ID of the FIB from protocol and index.
static ipsec_tun_protect_t * ipsec_tun_protect_get(u32 index)
u32 * policies[IPSEC_SPD_POLICY_N_TYPES]
vectors for each of the policy types
Dump ipsec policy database data.
int ipsec_add_del_tunnel_if_internal(vnet_main_t *vnm, ipsec_add_del_tunnel_args_t *args, u32 *sw_if_index)
ipsec_protocol_t protocol
static void vl_api_ipsec_tunnel_protect_update_t_handler(vl_api_ipsec_tunnel_protect_update_t *mp)
static void send_ipsec_spds_details(ipsec_spd_t *spd, vl_api_registration_t *reg, u32 context)
static vl_api_ipsec_proto_t ipsec_proto_encode(ipsec_protocol_t p)
static vlib_main_t * vlib_get_main(void)
IPsec policy database response.
IPsec: Get SPD interfaces.
vl_api_ipsec_spd_entry_t entry
vl_api_ipsec_spd_entry_t entry
int ipsec_sa_add_and_lock(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 tx_table_id, u32 salt, const ip46_address_t *tun_src, const ip46_address_t *tun_dst, u32 *sa_out_index)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
ip46_address_range_t raddr
#define INDEX_INVALID
Invalid index - used when no index is known blazoned capitals INVALID speak volumes where ~0 does not...
static int ipsec_integ_algo_decode(vl_api_ipsec_integ_alg_t in, ipsec_integ_alg_t *out)
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Bind/attach a SPD to an interface.
static vl_api_ipsec_integ_alg_t ipsec_integ_algo_encode(ipsec_integ_alg_t i)
vl_api_gbp_endpoint_tun_t tun
void ip_address_encode(const ip46_address_t *in, ip46_type_t type, vl_api_address_t *out)
static void ipsec_key_decode(const vl_api_key_t *key, ipsec_key_t *out)
u32 id
the User's ID for this policy
static void ipsec_key_encode(const ipsec_key_t *in, vl_api_key_t *out)
struct ipsec_tunnel_protect_walk_ctx_t_ ipsec_tunnel_protect_walk_ctx_t
u8 * is_mp_safe
Message is mp safe vector.
ipsec_crypto_alg_t crypto_alg
index_t ipsec_tun_protect_find(u32 sw_if_index)
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Add/Delete a SPD.
static clib_error_t * ipsec_api_hookup(vlib_main_t *vm)
#define foreach_ipsec_spd_policy_type
static void vl_api_ipsec_tunnel_protect_del_t_handler(vl_api_ipsec_tunnel_protect_del_t *mp)
#define vec_foreach(var, vec)
Vector iterator.
static walk_rc_t send_ipsec_tunnel_protect_details(index_t itpi, void *arg)
static void vl_api_ipsec_select_backend_t_handler(vl_api_ipsec_select_backend_t *mp)
IPsec security association database response.
ipsec_esp_backend_t * esp_backends
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
Add or delete IPsec tunnel interface.
vl_api_fib_path_nh_proto_t proto
#define VALIDATE_SW_IF_INDEX(mp)
static void vl_api_ipsec_sad_entry_add_del_t_handler(vl_api_ipsec_sad_entry_add_del_t *mp)
static uword pool_elts(void *v)
Number of active elements in a pool.