48 #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__) 55 #define foreach_vpe_api_msg \ 56 _ (IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \ 57 _ (IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ 58 _ (IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \ 59 _ (IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \ 60 _ (IPSEC_SAD_ENTRY_ADD_DEL_V2, ipsec_sad_entry_add_del_v2) \ 61 _ (IPSEC_SAD_ENTRY_ADD_DEL_V3, ipsec_sad_entry_add_del_v3) \ 62 _ (IPSEC_SA_DUMP, ipsec_sa_dump) \ 63 _ (IPSEC_SA_V2_DUMP, ipsec_sa_v2_dump) \ 64 _ (IPSEC_SA_V3_DUMP, ipsec_sa_v3_dump) \ 65 _ (IPSEC_SPDS_DUMP, ipsec_spds_dump) \ 66 _ (IPSEC_SPD_DUMP, ipsec_spd_dump) \ 67 _ (IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ 68 _ (IPSEC_ITF_CREATE, ipsec_itf_create) \ 69 _ (IPSEC_ITF_DELETE, ipsec_itf_delete) \ 70 _ (IPSEC_ITF_DUMP, ipsec_itf_dump) \ 71 _ (IPSEC_SELECT_BACKEND, ipsec_select_backend) \ 72 _ (IPSEC_BACKEND_DUMP, ipsec_backend_dump) \ 73 _ (IPSEC_TUNNEL_PROTECT_UPDATE, ipsec_tunnel_protect_update) \ 74 _ (IPSEC_TUNNEL_PROTECT_DEL, ipsec_tunnel_protect_del) \ 75 _ (IPSEC_TUNNEL_PROTECT_DUMP, ipsec_tunnel_protect_dump) \ 76 _ (IPSEC_SET_ASYNC_MODE, ipsec_set_async_mode) 82 vl_api_ipsec_spd_add_del_reply_t *rmp;
94 vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
97 u32 spd_id __attribute__ ((unused));
100 spd_id = ntohl (mp->
spd_id);
108 REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
115 vl_api_ipsec_tunnel_protect_update_reply_t *rmp;
120 sw_if_index = ntohl (mp->
tunnel.sw_if_index);
124 for (ii = 0; ii < mp->
tunnel.n_sa_in; ii++)
130 ntohl (mp->
tunnel.sa_out), sa_ins);
134 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_UPDATE_REPLY);
141 vl_api_ipsec_tunnel_protect_del_reply_t *rmp;
155 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_DEL_REPLY);
177 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS);
184 mp->
tun.sa_out = htonl (sa->
id);
189 mp->
tun.sa_in[ii++] = htonl (sa->
id);
216 if (~0 == sw_if_index)
231 in = clib_net_to_host_u32 (in);
235 #define _(v,f,s) case IPSEC_API_SPD_ACTION_##f: \ 236 *out = IPSEC_POLICY_ACTION_##f; \ 241 return (VNET_API_ERROR_UNIMPLEMENTED);
259 p.
id = ntohl (mp->
entry.spd_id);
281 if (p.
policy == IPSEC_POLICY_ACTION_RESOLVE)
284 rv = VNET_API_ERROR_UNIMPLEMENTED;
312 ipsec_crypto_alg_t crypto_alg;
314 ipsec_protocol_t
proto;
319 .t_encap_decap_flags = TUNNEL_ENCAP_DECAP_FLAG_NONE,
321 .t_mode = TUNNEL_MODE_P2P,
327 id = ntohl (mp->
entry.sad_id);
328 spi = ntohl (mp->
entry.spi);
355 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
356 mp->
entry.salt, htons (mp->
entry.udp_src_port),
357 htons (mp->
entry.udp_dst_port), &tun, &sa_index);
376 ipsec_crypto_alg_t crypto_alg;
378 ipsec_protocol_t
proto;
384 .t_encap_decap_flags = TUNNEL_ENCAP_DECAP_FLAG_NONE,
386 .t_mode = TUNNEL_MODE_P2P,
387 .t_table_id = htonl (mp->
entry.tx_table_id),
391 id = ntohl (mp->
entry.sad_id);
392 spi = ntohl (mp->
entry.spi);
426 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
427 mp->
entry.salt, htons (mp->
entry.udp_src_port),
428 htons (mp->
entry.udp_dst_port), &tun, &sa_index);
447 ipsec_crypto_alg_t crypto_alg;
449 ipsec_protocol_t
proto;
455 id = ntohl (mp->
entry.sad_id);
456 spi = ntohl (mp->
entry.spi);
475 if (flags & IPSEC_SA_FLAG_IS_TUNNEL)
488 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
489 mp->
entry.salt, htons (mp->
entry.udp_src_port),
490 htons (mp->
entry.udp_dst_port), &tun, &sa_index);
508 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_SPDS_DETAILS);
512 #define _(s, n) n_policies += vec_len (spd->policies[IPSEC_SPD_POLICY_##s]); 536 vl_api_ipsec_spd_action_t
543 #define _(v,f,s) case IPSEC_POLICY_ACTION_##f: \ 544 out = IPSEC_API_SPD_ACTION_##f; \ 549 return (clib_host_to_net_u32 (out));
560 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_SPD_DETAILS);
563 mp->
entry.spd_id = htonl (p->
id);
565 mp->
entry.is_outbound = ((p->
type == IPSEC_SPD_POLICY_IP6_OUTBOUND) ||
566 (p->
type == IPSEC_SPD_POLICY_IP4_OUTBOUND));
569 &mp->
entry.local_address_start);
571 &mp->
entry.local_address_stop);
573 &mp->
entry.remote_address_start);
575 &mp->
entry.remote_address_stop);
628 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
655 send_ipsec_spd_interface_details(reg, v, k, mp->context);
662 send_ipsec_spd_interface_details(reg, v, k, mp->context);
691 vl_api_ipsec_itf_delete_reply_t *rmp;
729 ctx->sw_if_index = itp->itp_sw_if_index;
745 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_SA_DETAILS);
748 mp->
entry.sad_id = htonl (sa->
id);
760 mp->
entry.salt = clib_host_to_net_u32 (sa->
salt);
762 if (ipsec_sa_is_set_IS_PROTECT (sa))
775 if (ipsec_sa_is_set_IS_TUNNEL (sa))
780 if (ipsec_sa_is_set_UDP_ENCAP (sa))
788 if (ipsec_sa_is_set_USE_ESN (sa))
793 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
828 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_SA_V2_DETAILS);
831 mp->
entry.sad_id = htonl (sa->
id);
843 mp->
entry.salt = clib_host_to_net_u32 (sa->
salt);
845 if (ipsec_sa_is_set_IS_PROTECT (sa))
858 if (ipsec_sa_is_set_IS_TUNNEL (sa))
863 if (ipsec_sa_is_set_UDP_ENCAP (sa))
869 mp->
entry.tunnel_flags =
875 if (ipsec_sa_is_set_USE_ESN (sa))
880 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
915 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_SA_V3_DETAILS);
918 mp->
entry.sad_id = htonl (sa->
id);
929 mp->
entry.salt = clib_host_to_net_u32 (sa->
salt);
931 if (ipsec_sa_is_set_IS_PROTECT (sa))
944 if (ipsec_sa_is_set_IS_TUNNEL (sa))
947 if (ipsec_sa_is_set_UDP_ENCAP (sa))
955 if (ipsec_sa_is_set_USE_ESN (sa))
960 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
1008 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_BACKEND_DETAILS);
1020 mp->_vl_msg_id =
ntohs (VL_API_IPSEC_BACKEND_DETAILS);
1036 vl_api_ipsec_select_backend_reply_t *rmp;
1041 rv = VNET_API_ERROR_INSTANCE_IN_USE;
1059 rv = VNET_API_ERROR_INVALID_PROTOCOL;
1069 vl_api_ipsec_set_async_mode_reply_t *rmp;
1084 #define vl_msg_name_crc_list 1086 #undef vl_msg_name_crc_list 1091 #define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id); 1092 foreach_vl_msg_name_crc_ipsec;
1102 vl_msg_api_set_handlers(VL_API_##N, #n, \ 1103 vl_api_##n##_t_handler, \ 1105 vl_api_##n##_t_endian, \ 1106 vl_api_##n##_t_print, \ 1107 sizeof(vl_api_##n##_t), 1);
IPsec: Add/delete Security Policy Database entry.
vl_api_ipsec_spd_action_t ipsec_spd_action_encode(ipsec_policy_action_t in)
static void vl_api_ipsec_sad_entry_add_del_v2_t_handler(vl_api_ipsec_sad_entry_add_del_v2_t *mp)
void ipsec_key_decode(const vl_api_key_t *key, ipsec_key_t *out)
void ip_address_encode2(const ip_address_t *in, vl_api_address_t *out)
vl_api_wireguard_peer_flags_t flags
enum ipsec_spd_policy_t_ ipsec_spd_policy_type_t
static void vl_api_ipsec_itf_create_t_handler(vl_api_ipsec_itf_create_t *mp)
IPsec: SPD interface response.
Add IPsec interface interface response.
#define pool_foreach(VAR, POOL)
Iterate through pool.
VLIB_API_INIT_FUNCTION(ipsec_api_hookup)
ip46_address_range_t laddr
vl_api_ip_proto_t protocol
#define REPLY_MACRO2(t, body)
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
#define FOR_EACH_IPSEC_SPD_POLICY_TYPE(_t)
vl_api_ipsec_proto_t protocol
int ipsec_policy_mk_type(bool is_outbound, bool is_ipv6, ipsec_policy_action_t action, ipsec_spd_policy_type_t *type)
static void vl_api_send_msg(vl_api_registration_t *rp, u8 *elem)
vl_api_ipsec_sad_entry_v2_t entry
ipsec_integ_alg_t integ_alg
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
A representation of an IP tunnel config.
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
void ipsec_tun_protect_walk_itf(u32 sw_if_index, ipsec_tun_protect_walk_cb_t fn, void *ctx)
static void setup_message_id_table(api_main_t *am)
static walk_rc_t send_ipsec_sa_v2_details(ipsec_sa_t *sa, void *arg)
int ipsec_integ_algo_decode(vl_api_ipsec_integ_alg_t in, ipsec_integ_alg_t *out)
ipsec_sa_t * ipsec_sa_pool
Pool of IPSec SAs.
vl_api_ipsec_spd_action_t policy
static void vl_api_ipsec_sa_dump_t_handler(vl_api_ipsec_sa_dump_t *mp)
#define FOR_EACH_IPSEC_PROTECT_INPUT_SA(_itp, _sa, body)
vl_api_tunnel_encap_decap_flags_t tunnel_encap_decap_flags_encode(tunnel_encap_decap_flags_t f)
A Secruity Policy Database.
void * vl_msg_api_alloc(int nbytes)
void ipsec_tun_protect_walk(ipsec_tun_protect_walk_cb_t fn, void *ctx)
void tunnel_encode(const tunnel_t *in, vl_api_tunnel_t *out)
int tunnel_decode(const vl_api_tunnel_t *in, tunnel_t *out)
#define foreach_vpe_api_msg
vl_api_interface_index_t sw_if_index
ip_dscp_t ip_dscp_decode(vl_api_ip_dscp_t in)
struct ipsec_sa_dump_match_ctx_t_ ipsec_sa_dump_match_ctx_t
uword * spd_index_by_sw_if_index
static void vl_api_ipsec_interface_add_del_spd_t_handler(vl_api_ipsec_interface_add_del_spd_t *mp)
enum walk_rc_t_ walk_rc_t
Walk return code.
vl_api_interface_index_t sw_if_index
void ipsec_sa_walk(ipsec_sa_walk_cb_t cb, void *ctx)
int ipsec_tun_protect_del(u32 sw_if_index, const ip_address_t *nh)
static void vl_api_ipsec_backend_dump_t_handler(vl_api_ipsec_backend_dump_t *mp)
#define hash_foreach(key_var, value_var, h, body)
static void vl_api_ipsec_spd_dump_t_handler(vl_api_ipsec_spd_dump_t *mp)
static void vl_api_ipsec_spd_interface_dump_t_handler(vl_api_ipsec_spd_interface_dump_t *mp)
int ipsec_sa_unlock_id(u32 id)
Dump all tunnel protections.
vl_api_ipsec_crypto_alg_t ipsec_crypto_algo_encode(ipsec_crypto_alg_t c)
IPsec: Reply Add/delete Security Policy Database entry.
ip46_type_t ip_address_decode(const vl_api_address_t *in, ip46_address_t *out)
Decode/Encode for struct/union types.
static void vl_api_ipsec_spd_add_del_t_handler(vl_api_ipsec_spd_add_del_t *mp)
IPsec: Add/delete Security Association Database entry.
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
vl_api_interface_index_t sw_if_index
Dump IPsec all SPD IDs response.
IPsec: Add/delete Security Policy Database.
vl_api_ipsec_tunnel_protect_t tun
vl_api_ipsec_proto_t ipsec_proto_encode(ipsec_protocol_t p)
int ipsec_sa_add_and_lock(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 salt, u16 src_port, u16 dst_port, const tunnel_t *tun, u32 *sa_out_index)
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add, u32 *stat_index)
Add/Delete a SPD.
static int ipsec_spd_action_decode(vl_api_ipsec_spd_action_t in, ipsec_policy_action_t *out)
vl_api_interface_index_t sw_if_index
vl_api_interface_index_t sw_if_index
vl_api_ipsec_tunnel_protect_t tunnel
ipsec_spd_policy_type_t type
static walk_rc_t send_ipsec_sa_v3_details(ipsec_sa_t *sa, void *arg)
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
int tunnel_mode_decode(vl_api_tunnel_mode_t in, tunnel_mode_t *out)
vl_api_interface_index_t sw_if_index
vl_api_tunnel_mode_t mode
uword * spd_index_by_spd_id
API main structure, used by both vpp and binary API clients.
void ip_address_decode2(const vl_api_address_t *in, ip_address_t *out)
An API client registration, only in vpp/vlib.
static void vl_api_ipsec_set_async_mode_t_handler(vl_api_ipsec_set_async_mode_t *mp)
#define BAD_SW_IF_INDEX_LABEL
IPsec: Add/delete SPD from interface.
static walk_rc_t ipsec_sa_dump_match_sa(index_t itpi, void *arg)
ipsec_ah_backend_t * ah_backends
vl_api_ipsec_sad_flags_t ipsec_sad_flags_encode(const ipsec_sa_t *sa)
vl_api_ipsec_sad_entry_t entry
ipsec_policy_action_t policy
#define clib_warning(format, args...)
vnet_interface_main_t * im
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
vl_api_ipsec_proto_t protocol
#define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body)
tunnel_encap_decap_flags_t t_encap_decap_flags
static void vl_api_ipsec_sad_entry_add_del_v3_t_handler(vl_api_ipsec_sad_entry_add_del_v3_t *mp)
static vl_api_registration_t * vl_api_client_index_to_registration(u32 index)
static void vl_api_ipsec_spds_dump_t_handler(vl_api_ipsec_spds_dump_t *mp)
static void vl_api_ipsec_tunnel_protect_dump_t_handler(vl_api_ipsec_tunnel_protect_dump_t *mp)
static void send_ipsec_spd_interface_details(vl_api_registration_t *reg, u32 spd_index, u32 sw_if_index, u32 context)
vl_api_ipsec_sad_entry_t entry
static void send_ipsec_spd_details(ipsec_policy_t *p, vl_api_registration_t *reg, u32 context)
static void vl_api_ipsec_itf_dump_t_handler(vl_api_ipsec_itf_dump_t *mp)
vl_api_interface_index_t sw_if_index
static void vl_api_ipsec_spd_entry_add_del_t_handler(vl_api_ipsec_spd_entry_add_del_t *mp)
ipsec_policy_t * policies
vl_api_ip_dscp_t ip_dscp_encode(ip_dscp_t dscp)
Dump IPsec security association.
static void vl_api_ipsec_itf_delete_t_handler(vl_api_ipsec_itf_delete_t *mp)
static ipsec_tun_protect_t * ipsec_tun_protect_get(u32 index)
vl_api_ipsec_integ_alg_t ipsec_integ_algo_encode(ipsec_integ_alg_t i)
u32 * policies[IPSEC_SPD_POLICY_N_TYPES]
vectors for each of the policy types
ipsec_sa_flags_t ipsec_sa_flags_decode(vl_api_ipsec_sad_flags_t in)
Dump ipsec policy database data.
ipsec_protocol_t protocol
static void vl_api_ipsec_tunnel_protect_update_t_handler(vl_api_ipsec_tunnel_protect_update_t *mp)
int ipsec_itf_delete(u32 sw_if_index)
static void send_ipsec_spds_details(ipsec_spd_t *spd, vl_api_registration_t *reg, u32 context)
static vlib_main_t * vlib_get_main(void)
IPsec policy database response.
IPsec: Get SPD interfaces.
vl_api_ipsec_spd_entry_t entry
vl_api_ipsec_spd_entry_t entry
struct ipsec_dump_walk_ctx_t_ ipsec_dump_walk_ctx_t
static walk_rc_t send_ipsec_sa_details(ipsec_sa_t *sa, void *arg)
int ipsec_select_ah_backend(ipsec_main_t *im, u32 backend_idx)
static void vl_api_ipsec_sa_v3_dump_t_handler(vl_api_ipsec_sa_v3_dump_t *mp)
static ipsec_sa_t * ipsec_sa_get(u32 sa_index)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
ip46_address_range_t raddr
int ipsec_select_esp_backend(ipsec_main_t *im, u32 backend_idx)
Create an IPSec interface.
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Bind/attach a SPD to an interface.
vl_api_gbp_endpoint_tun_t tun
void ip_address_encode(const ip46_address_t *in, ip46_type_t type, vl_api_address_t *out)
u32 id
the User's ID for this policy
static api_main_t * vlibapi_get_main(void)
int ipsec_itf_create(u32 user_instance, tunnel_mode_t mode, u32 *sw_if_indexp)
vl_api_registration_t * reg
vl_api_ipsec_sad_entry_v2_t entry
ipsec_crypto_alg_t crypto_alg
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Add/Delete a SPD.
vl_api_interface_index_t sw_if_index
static clib_error_t * ipsec_api_hookup(vlib_main_t *vm)
#define foreach_ipsec_spd_policy_type
static void vl_api_ipsec_tunnel_protect_del_t_handler(vl_api_ipsec_tunnel_protect_del_t *mp)
#define vec_foreach(var, vec)
Vector iterator.
int tunnel_encap_decap_flags_decode(vl_api_tunnel_encap_decap_flags_t f, tunnel_encap_decap_flags_t *o)
Conversion functions to/from (decode/encode) API types to VPP internal types.
static walk_rc_t send_ipsec_tunnel_protect_details(index_t itpi, void *arg)
static void vl_api_ipsec_sa_v2_dump_t_handler(vl_api_ipsec_sa_v2_dump_t *mp)
static void vl_api_ipsec_select_backend_t_handler(vl_api_ipsec_select_backend_t *mp)
void ipsec_set_async_mode(u32 is_enabled)
IPsec security association database response.
ipsec_esp_backend_t * esp_backends
vl_api_ipsec_sad_entry_v3_t entry
int ipsec_crypto_algo_decode(vl_api_ipsec_crypto_alg_t in, ipsec_crypto_alg_t *out)
vl_api_interface_index_t sw_if_index
enum tunnel_mode_t_ tunnel_mode_t
vl_api_ipsec_sad_entry_v3_t entry
int ipsec_proto_decode(vl_api_ipsec_proto_t in, ipsec_protocol_t *out)
Encode/decode function from/to API to internal types.
#define VALIDATE_SW_IF_INDEX(mp)
vl_api_interface_index_t sw_if_index
int ipsec_tun_protect_update(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 *sas_in)
static void vl_api_ipsec_sad_entry_add_del_t_handler(vl_api_ipsec_sad_entry_add_del_t *mp)
void ipsec_key_encode(const ipsec_key_t *in, vl_api_key_t *out)
static uword pool_elts(void *v)
Number of active elements in a pool.