FD.io VPP  v16.09
Vector Packet Processing
ipsec.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel support
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 #include <vnet/ipsec/ikev2.h>
26 
27 u32
29 {
30  ipsec_main_t *im = &ipsec_main;
31  uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
32  if (!p)
33  return ~0;
34 
35  return p[0];
36 }
37 
38 int
39 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
40  int is_add)
41 {
42  ipsec_main_t *im = &ipsec_main;
43  ip_lookup_main_t *lm;
44  ip_config_main_t *rx_cm;
45  ip4_ipsec_config_t config;
46 
47  u32 spd_index, ci;
48  uword *p;
49 
50  p = hash_get (im->spd_index_by_spd_id, spd_id);
51  if (!p)
52  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
53 
54  spd_index = p[0];
55 
56  p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
57  if (p && is_add)
58  return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
59 
60  if (is_add)
61  {
62  hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
63  }
64  else
65  {
66  hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
67  }
68 
69  clib_warning ("sw_if_index %u spd_id %u spd_index %u",
70  sw_if_index, spd_id, spd_index);
71 
72  /* enable IPsec on TX */
73  vnet_interface_add_del_feature (im->vnet_main, vm, sw_if_index,
74  INTF_OUTPUT_FEAT_IPSEC, is_add);
75 
76  /* enable IPsec on RX */
77  config.spd_index = spd_index;
78 
79  /* IPv4 */
80  lm = &ip4_main.lookup_main;
81  rx_cm = &lm->rx_config_mains[VNET_UNICAST];
82 
83  ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
84 
86  (vm, &rx_cm->config_main,
87  ci, ip4_main.ip4_unicast_rx_feature_ipsec, &config, sizeof (config));
88  rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
89 
90  /* IPv6 */
91  lm = &ip6_main.lookup_main;
92  rx_cm = &lm->rx_config_mains[VNET_UNICAST];
93 
94  ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
95 
97  (vm, &rx_cm->config_main,
98  ci, ip6_main.ip6_unicast_rx_feature_ipsec, &config, sizeof (config));
99  rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
100 
101  return 0;
102 }
103 
104 int
105 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
106 {
107  ipsec_main_t *im = &ipsec_main;
108  ipsec_spd_t *spd = 0;
109  uword *p;
110  u32 spd_index, k, v;
111 
112  p = hash_get (im->spd_index_by_spd_id, spd_id);
113  if (p && is_add)
114  return VNET_API_ERROR_INVALID_VALUE;
115  if (!p && !is_add)
116  return VNET_API_ERROR_INVALID_VALUE;
117 
118  if (!is_add) /* delete */
119  {
120  spd_index = p[0];
121  spd = pool_elt_at_index (im->spds, spd_index);
122  if (!spd)
123  return VNET_API_ERROR_INVALID_VALUE;
124  /* *INDENT-OFF* */
126  if (v == spd_index)
127  ipsec_set_interface_spd(vm, k, spd_id, 0);
128  }));
129  /* *INDENT-ON* */
130  hash_unset (im->spd_index_by_spd_id, spd_id);
131  pool_free (spd->policies);
136  pool_put (im->spds, spd);
137  }
138  else /* create new SPD */
139  {
140  pool_get (im->spds, spd);
141  memset (spd, 0, sizeof (*spd));
142  spd_index = spd - im->spds;
143  spd->id = spd_id;
144  hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
145  }
146  return 0;
147 }
148 
149 static int
150 ipsec_spd_entry_sort (void *a1, void *a2)
151 {
152  ipsec_main_t *im = &ipsec_main;
153  u32 *id1 = a1;
154  u32 *id2 = a2;
155  ipsec_spd_t *spd;
156  ipsec_policy_t *p1, *p2;
157 
158  /* *INDENT-OFF* */
159  pool_foreach (spd, im->spds, ({
160  p1 = pool_elt_at_index(spd->policies, *id1);
161  p2 = pool_elt_at_index(spd->policies, *id2);
162  if (p1 && p2)
163  return p2->priority - p1->priority;
164  }));
165  /* *INDENT-ON* */
166 
167  return 0;
168 }
169 
170 int
171 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
172 {
173  ipsec_main_t *im = &ipsec_main;
174  ipsec_spd_t *spd = 0;
175  ipsec_policy_t *vp;
176  uword *p;
177  u32 spd_index;
178 
179  clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
180  policy->priority, policy->is_outbound);
181 
182  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
183  {
184  p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
185  if (!p)
186  return VNET_API_ERROR_SYSCALL_ERROR_1;
187  policy->sa_index = p[0];
188  }
189 
190  p = hash_get (im->spd_index_by_spd_id, policy->id);
191 
192  if (!p)
193  return VNET_API_ERROR_SYSCALL_ERROR_1;
194 
195  spd_index = p[0];
196  spd = pool_elt_at_index (im->spds, spd_index);
197  if (!spd)
198  return VNET_API_ERROR_SYSCALL_ERROR_1;
199 
200  if (is_add)
201  {
202  u32 policy_index;
203 
204  pool_get (spd->policies, vp);
205  clib_memcpy (vp, policy, sizeof (*vp));
206  policy_index = vp - spd->policies;
207 
208  if (policy->is_outbound)
209  {
210  if (policy->is_ipv6)
211  {
212  vec_add1 (spd->ipv6_outbound_policies, policy_index);
213  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
216  }
217  else
218  {
219  vec_add1 (spd->ipv4_outbound_policies, policy_index);
220  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
223  }
224  }
225  else
226  {
227  if (policy->is_ipv6)
228  {
229  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
230  {
232  policy_index);
233  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
237  }
238  else
239  {
240  vec_add1
242  policy_index);
243  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
247  }
248  }
249  else
250  {
251  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
252  {
254  policy_index);
255  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
259  }
260  else
261  {
262  vec_add1
264  policy_index);
265  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
269  }
270  }
271  }
272 
273  }
274  else
275  {
276  u32 i, j;
277  /* *INDENT-OFF* */
278  pool_foreach_index(i, spd->policies, ({
279  vp = pool_elt_at_index(spd->policies, i);
280  if (vp->priority != policy->priority)
281  continue;
282  if (vp->is_outbound != policy->is_outbound)
283  continue;
284  if (vp->policy != policy->policy)
285  continue;
286  if (vp->sa_id != policy->sa_id)
287  continue;
288  if (vp->protocol != policy->protocol)
289  continue;
290  if (vp->lport.start != policy->lport.start)
291  continue;
292  if (vp->lport.stop != policy->lport.stop)
293  continue;
294  if (vp->rport.start != policy->rport.start)
295  continue;
296  if (vp->rport.stop != policy->rport.stop)
297  continue;
298  if (vp->is_ipv6 != policy->is_ipv6)
299  continue;
300  if (policy->is_ipv6)
301  {
302  if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
303  continue;
304  if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
305  continue;
306  if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
307  continue;
308  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
309  continue;
310  if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
311  continue;
312  if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
313  continue;
314  if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
315  continue;
316  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
317  continue;
318  if (policy->is_outbound)
319  {
320  vec_foreach_index(j, spd->ipv6_outbound_policies) {
321  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
322  vec_del1 (spd->ipv6_outbound_policies, j);
323  break;
324  }
325  }
326  }
327  else
328  {
329  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
330  {
331  vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
332  if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
333  vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
334  break;
335  }
336  }
337  }
338  else
339  {
340  vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
341  if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
342  vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
343  break;
344  }
345  }
346  }
347  }
348  }
349  else
350  {
351  if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
352  continue;
353  if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
354  continue;
355  if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
356  continue;
357  if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
358  continue;
359  if (policy->is_outbound)
360  {
361  vec_foreach_index(j, spd->ipv4_outbound_policies) {
362  if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
363  vec_del1 (spd->ipv4_outbound_policies, j);
364  break;
365  }
366  }
367  }
368  else
369  {
370  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
371  {
372  vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
373  if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
374  vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
375  break;
376  }
377  }
378  }
379  else
380  {
381  vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
382  if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
383  vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
384  break;
385  }
386  }
387  }
388  }
389  pool_put (spd->policies, vp);
390  break;
391  }
392  }));
393  /* *INDENT-ON* */
394  }
395 
396  return 0;
397 }
398 
399 static u8
401 {
402  ipsec_main_t *im = &ipsec_main;
403  ipsec_spd_t *spd;
404  ipsec_policy_t *p;
406 
407  /* *INDENT-OFF* */
408  pool_foreach(spd, im->spds, ({
409  pool_foreach(p, spd->policies, ({
410  if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
411  {
412  if (p->sa_index == sa_index)
413  return 1;
414  }
415  }));
416  }));
417 
418  pool_foreach(t, im->tunnel_interfaces, ({
419  if (t->input_sa_index == sa_index)
420  return 1;
421  if (t->output_sa_index == sa_index)
422  return 1;
423  }));
424  /* *INDENT-ON* */
425 
426  return 0;
427 }
428 
429 int
430 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
431 {
432  ipsec_main_t *im = &ipsec_main;
433  ipsec_sa_t *sa = 0;
434  uword *p;
435  u32 sa_index;
436 
437  clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
438 
439  p = hash_get (im->sa_index_by_sa_id, new_sa->id);
440  if (p && is_add)
441  return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
442  if (!p && !is_add)
443  return VNET_API_ERROR_SYSCALL_ERROR_1;
444 
445  if (!is_add) /* delete */
446  {
447  sa_index = p[0];
448  sa = pool_elt_at_index (im->sad, sa_index);
449  if (ipsec_is_sa_used (sa_index))
450  {
451  clib_warning ("sa_id %u used in policy", sa->id);
452  return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
453  }
454  hash_unset (im->sa_index_by_sa_id, sa->id);
455  pool_put (im->sad, sa);
456  }
457  else /* create new SA */
458  {
459  pool_get (im->sad, sa);
460  clib_memcpy (sa, new_sa, sizeof (*sa));
461  sa_index = sa - im->sad;
462  hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
463  }
464  return 0;
465 }
466 
467 int
469 {
470  ipsec_main_t *im = &ipsec_main;
471  uword *p;
472  u32 sa_index;
473  ipsec_sa_t *sa = 0;
474 
475  p = hash_get (im->sa_index_by_sa_id, sa_update->id);
476  if (!p)
477  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
478 
479  sa_index = p[0];
480  sa = pool_elt_at_index (im->sad, sa_index);
481 
482  /* new crypto key */
483  if (0 < sa_update->crypto_key_len)
484  {
485  clib_memcpy (sa->crypto_key, sa_update->crypto_key,
486  sa_update->crypto_key_len);
487  sa->crypto_key_len = sa_update->crypto_key_len;
488  }
489 
490  /* new integ key */
491  if (0 < sa_update->integ_key_len)
492  {
493  clib_memcpy (sa->integ_key, sa_update->integ_key,
494  sa_update->integ_key_len);
495  sa->integ_key_len = sa_update->integ_key_len;
496  }
497 
498  return 0;
499 }
500 
501 static void
503 {
504  struct
505  {
506  time_t time;
507  pid_t pid;
508  void *p;
509  } seed_data;
510 
511  seed_data.time = time (NULL);
512  seed_data.pid = getpid ();
513  seed_data.p = (void *) &seed_data;
514 
515  RAND_seed ((const void *) &seed_data, sizeof (seed_data));
516 }
517 
518 static clib_error_t *
520 {
521  clib_error_t *error;
522  ipsec_main_t *im = &ipsec_main;
524  vlib_node_t *node;
525 
526  ipsec_rand_seed ();
527 
528  memset (im, 0, sizeof (im[0]));
529 
530  im->vnet_main = vnet_get_main ();
531  im->vlib_main = vm;
532 
533  im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
534  im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
535  im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
536 
539 
540  node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
541  ASSERT (node);
542  im->error_drop_node_index = node->index;
543 
544  node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
545  ASSERT (node);
546  im->esp_encrypt_node_index = node->index;
547 
548  node = vlib_get_node_by_name (vm, (u8 *) "ip4-lookup");
549  ASSERT (node);
550  im->ip4_lookup_node_index = node->index;
551 
552 
553  if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
554  return error;
555 
556  if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
557  return error;
558 
559  esp_init ();
560 
561  if ((error = ikev2_init (vm)))
562  return error;
563 
564  return 0;
565 }
566 
568 
569 /*
570  * fd.io coding-style-patch-verification: ON
571  *
572  * Local Variables:
573  * eval: (c-set-style "gnu")
574  * End:
575  */
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:183
ipsec_spd_t * spds
Definition: ipsec.h:207
#define hash_set(h, key, value)
Definition: hash.h:254
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:181
sll srl srl sll sra u16x4 i
Definition: vector_sse2.h:343
u32 * config_index_by_sw_if_index
Definition: lookup.h:369
#define hash_unset(h, key)
Definition: hash.h:260
u32 id
Definition: ipsec.h:74
i32 priority
Definition: ipsec.h:153
int vnet_interface_add_del_feature(vnet_main_t *vnm, vlib_main_t *vm, u32 sw_if_index, intf_output_feat_t feature, int is_add)
Definition: interface.c:1180
#define NULL
Definition: clib.h:55
u32 index
Definition: node.h:237
u32 vnet_config_del_feature(vlib_main_t *vm, vnet_config_main_t *cm, u32 config_string_heap_index, u32 feature_index, void *feature_config, u32 n_feature_config_bytes)
Definition: config.c:300
ip_config_main_t rx_config_mains[VNET_N_CAST]
rx/tx interface/feature configuration.
Definition: lookup.h:452
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:482
ipsec_main_t ipsec_main
Definition: ipsec.h:238
u32 * ipv4_outbound_policies
Definition: ipsec.h:179
ip_lookup_main_t lookup_main
Definition: ip4.h:115
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
Definition: vec.h:407
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:200
u8 crypto_key[128]
Definition: ipsec.h:80
u32 spi
Definition: ipsec.h:75
uword * spd_index_by_sw_if_index
Definition: ipsec.h:227
clib_error_t * ipsec_tunnel_if_init(vlib_main_t *vm)
Definition: ipsec_if.c:307
vnet_main_t * vnet_get_main(void)
Definition: misc.c:45
u8 integ_key[128]
Definition: ipsec.h:84
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:348
u32 ip4_unicast_rx_feature_ipsec
Built-in unicast feature path indice, see ip_feature_init_cast()
Definition: ip4.h:154
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:111
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:407
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
Definition: ipsec.c:171
#define clib_warning(format, args...)
Definition: error.h:59
#define vlib_call_init_function(vm, x)
Definition: init.h:161
ipsec_policy_t * policies
Definition: ipsec.h:177
u32 ip4_lookup_node_index
Definition: ipsec.h:233
u32 error_drop_node_index
Definition: ipsec.h:232
#define hash_get(h, key)
Definition: hash.h:248
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:369
vnet_main_t * vnet_main
Definition: ipsec.h:220
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add)
Definition: ipsec.c:430
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:214
uword * spd_index_by_spd_id
Definition: ipsec.h:226
#define pool_free(p)
Free a pool.
Definition: pool.h:263
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
Definition: ipsec.c:468
u32 esp_encrypt_node_index
Definition: ipsec.h:234
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
Definition: ipsec_cli.c:773
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:300
u32 sa_index
Definition: ipsec.h:167
static vlib_thread_main_t * vlib_get_thread_main()
Definition: global_funcs.h:32
#define clib_memcpy(a, b, c)
Definition: string.h:63
uword * sa_index_by_sa_id
Definition: ipsec.h:228
static void ipsec_rand_seed(void)
Definition: ipsec.c:502
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Definition: ipsec.c:105
static clib_error_t * ipsec_init(vlib_main_t *vm)
Definition: ipsec.c:519
static u8 ipsec_is_sa_used(u32 sa_index)
Definition: ipsec.c:400
vlib_main_t * vlib_main
Definition: ipsec.h:219
#define hash_create(elts, value_bytes)
Definition: hash.h:647
#define ASSERT(truth)
unsigned int u32
Definition: types.h:88
ip6_main_t ip6_main
Definition: ip6_forward.c:2955
ip_lookup_main_t lookup_main
Definition: ip6.h:110
ipsec_sa_t * sad
Definition: ipsec.h:208
u8 integ_key_len
Definition: ipsec.h:83
static void esp_init()
Definition: esp.h:84
u32 vnet_config_add_feature(vlib_main_t *vm, vnet_config_main_t *cm, u32 config_string_heap_index, u32 feature_index, void *feature_config, u32 n_feature_config_bytes)
Definition: config.c:239
u64 uword
Definition: types.h:112
u8 crypto_key_len
Definition: ipsec.h:79
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
Definition: node.c:45
static int ipsec_spd_entry_sort(void *a1, void *a2)
Definition: ipsec.c:150
u32 * ipv4_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:182
unsigned char u8
Definition: types.h:56
u8 is_outbound
Definition: ipsec.h:154
u32 * ipv6_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:184
#define vec_sort_with_function(vec, f)
Sort a vector using the supplied element comparison function.
Definition: vec.h:900
u32 ip6_unicast_rx_feature_ipsec
Definition: ip6.h:152
u32 ipsec_get_sa_index_by_sa_id(u32 sa_id)
Definition: ipsec.c:28
u32 * ipv6_outbound_policies
Definition: ipsec.h:180
u32 id
Definition: ipsec.h:175
clib_error_t * ikev2_init(vlib_main_t *vm)
Definition: ikev2.c:2147
ip4_main_t ip4_main
Global ip4 main structure.
Definition: ip4_forward.c:1578
#define pool_foreach_index(i, v, body)
Iterate pool by index.
Definition: pool.h:390
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:67
u32 ** empty_buffers
Definition: ipsec.h:214
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Definition: ipsec.c:39
vnet_config_main_t config_main
Definition: lookup.h:367