FD.io VPP  v18.01.2-1-g9b554f3
Vector Packet Processing
ipsec.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel support
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/ikev2.h>
25 #include <vnet/ipsec/esp.h>
26 #include <vnet/ipsec/ah.h>
27 
29 
30 u32
32 {
33  ipsec_main_t *im = &ipsec_main;
34  uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
35  if (!p)
36  return ~0;
37 
38  return p[0];
39 }
40 
41 int
42 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
43  int is_add)
44 {
45  ipsec_main_t *im = &ipsec_main;
46  ip4_ipsec_config_t config;
47 
48  u32 spd_index;
49  uword *p;
50 
51  p = hash_get (im->spd_index_by_spd_id, spd_id);
52  if (!p)
53  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
54 
55  spd_index = p[0];
56 
57  p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
58  if (p && is_add)
59  return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
60 
61  if (is_add)
62  {
63  hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
64  }
65  else
66  {
67  hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
68  }
69 
70  clib_warning ("sw_if_index %u spd_id %u spd_index %u",
71  sw_if_index, spd_id, spd_index);
72 
73  /* enable IPsec on TX */
74  vnet_feature_enable_disable ("ip4-output", "ipsec-output-ip4", sw_if_index,
75  is_add, 0, 0);
76  vnet_feature_enable_disable ("ip6-output", "ipsec-output-ip6", sw_if_index,
77  is_add, 0, 0);
78 
79  /* enable IPsec on RX */
80  vnet_feature_enable_disable ("ip4-unicast", "ipsec-input-ip4", sw_if_index,
81  is_add, &config, sizeof (config));
82  vnet_feature_enable_disable ("ip6-unicast", "ipsec-input-ip6", sw_if_index,
83  is_add, &config, sizeof (config));
84 
85  return 0;
86 }
87 
88 int
89 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
90 {
91  ipsec_main_t *im = &ipsec_main;
92  ipsec_spd_t *spd = 0;
93  uword *p;
94  u32 spd_index, k, v;
95 
96  p = hash_get (im->spd_index_by_spd_id, spd_id);
97  if (p && is_add)
98  return VNET_API_ERROR_INVALID_VALUE;
99  if (!p && !is_add)
100  return VNET_API_ERROR_INVALID_VALUE;
101 
102  if (!is_add) /* delete */
103  {
104  spd_index = p[0];
105  spd = pool_elt_at_index (im->spds, spd_index);
106  if (!spd)
107  return VNET_API_ERROR_INVALID_VALUE;
108  /* *INDENT-OFF* */
110  if (v == spd_index)
111  ipsec_set_interface_spd(vm, k, spd_id, 0);
112  }));
113  /* *INDENT-ON* */
114  hash_unset (im->spd_index_by_spd_id, spd_id);
115  pool_free (spd->policies);
120  pool_put (im->spds, spd);
121  }
122  else /* create new SPD */
123  {
124  pool_get (im->spds, spd);
125  memset (spd, 0, sizeof (*spd));
126  spd_index = spd - im->spds;
127  spd->id = spd_id;
128  hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
129  }
130  return 0;
131 }
132 
133 static int
134 ipsec_spd_entry_sort (void *a1, void *a2)
135 {
136  ipsec_main_t *im = &ipsec_main;
137  u32 *id1 = a1;
138  u32 *id2 = a2;
139  ipsec_spd_t *spd;
140  ipsec_policy_t *p1, *p2;
141 
142  /* *INDENT-OFF* */
143  pool_foreach (spd, im->spds, ({
144  p1 = pool_elt_at_index(spd->policies, *id1);
145  p2 = pool_elt_at_index(spd->policies, *id2);
146  if (p1 && p2)
147  return p2->priority - p1->priority;
148  }));
149  /* *INDENT-ON* */
150 
151  return 0;
152 }
153 
154 int
156 {
157  ipsec_main_t *im = &ipsec_main;
158  ipsec_spd_t *spd = 0;
159  ipsec_policy_t *vp;
160  uword *p;
161  u32 spd_index;
162 
163  clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
164  policy->priority, policy->is_outbound);
165 
166  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
167  {
168  p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
169  if (!p)
170  return VNET_API_ERROR_SYSCALL_ERROR_1;
171  policy->sa_index = p[0];
172  }
173 
174  p = hash_get (im->spd_index_by_spd_id, policy->id);
175 
176  if (!p)
177  return VNET_API_ERROR_SYSCALL_ERROR_1;
178 
179  spd_index = p[0];
180  spd = pool_elt_at_index (im->spds, spd_index);
181  if (!spd)
182  return VNET_API_ERROR_SYSCALL_ERROR_1;
183 
184  if (is_add)
185  {
186  u32 policy_index;
187 
188  pool_get (spd->policies, vp);
189  clib_memcpy (vp, policy, sizeof (*vp));
190  policy_index = vp - spd->policies;
191 
192  if (policy->is_outbound)
193  {
194  if (policy->is_ipv6)
195  {
196  vec_add1 (spd->ipv6_outbound_policies, policy_index);
197  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
200  }
201  else
202  {
203  vec_add1 (spd->ipv4_outbound_policies, policy_index);
204  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
207  }
208  }
209  else
210  {
211  if (policy->is_ipv6)
212  {
213  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
214  {
216  policy_index);
217  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
221  }
222  else
223  {
224  vec_add1
226  policy_index);
227  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
231  }
232  }
233  else
234  {
235  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
236  {
238  policy_index);
239  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
243  }
244  else
245  {
246  vec_add1
248  policy_index);
249  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
253  }
254  }
255  }
256 
257  }
258  else
259  {
260  u32 i, j;
261  /* *INDENT-OFF* */
262  pool_foreach_index(i, spd->policies, ({
263  vp = pool_elt_at_index(spd->policies, i);
264  if (vp->priority != policy->priority)
265  continue;
266  if (vp->is_outbound != policy->is_outbound)
267  continue;
268  if (vp->policy != policy->policy)
269  continue;
270  if (vp->sa_id != policy->sa_id)
271  continue;
272  if (vp->protocol != policy->protocol)
273  continue;
274  if (vp->lport.start != policy->lport.start)
275  continue;
276  if (vp->lport.stop != policy->lport.stop)
277  continue;
278  if (vp->rport.start != policy->rport.start)
279  continue;
280  if (vp->rport.stop != policy->rport.stop)
281  continue;
282  if (vp->is_ipv6 != policy->is_ipv6)
283  continue;
284  if (policy->is_ipv6)
285  {
286  if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
287  continue;
288  if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
289  continue;
290  if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
291  continue;
292  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
293  continue;
294  if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
295  continue;
296  if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
297  continue;
298  if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
299  continue;
300  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
301  continue;
302  if (policy->is_outbound)
303  {
304  vec_foreach_index(j, spd->ipv6_outbound_policies) {
305  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
306  vec_del1 (spd->ipv6_outbound_policies, j);
307  break;
308  }
309  }
310  }
311  else
312  {
313  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
314  {
315  vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
316  if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
317  vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
318  break;
319  }
320  }
321  }
322  else
323  {
324  vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
325  if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
326  vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
327  break;
328  }
329  }
330  }
331  }
332  }
333  else
334  {
335  if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
336  continue;
337  if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
338  continue;
339  if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
340  continue;
341  if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
342  continue;
343  if (policy->is_outbound)
344  {
345  vec_foreach_index(j, spd->ipv4_outbound_policies) {
346  if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
347  vec_del1 (spd->ipv4_outbound_policies, j);
348  break;
349  }
350  }
351  }
352  else
353  {
354  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
355  {
356  vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
357  if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
358  vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
359  break;
360  }
361  }
362  }
363  else
364  {
365  vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
366  if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
367  vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
368  break;
369  }
370  }
371  }
372  }
373  pool_put (spd->policies, vp);
374  break;
375  }
376  }));
377  /* *INDENT-ON* */
378  }
379 
380  return 0;
381 }
382 
383 u8
385 {
386  ipsec_main_t *im = &ipsec_main;
387  ipsec_spd_t *spd;
388  ipsec_policy_t *p;
390 
391  /* *INDENT-OFF* */
392  pool_foreach(spd, im->spds, ({
393  pool_foreach(p, spd->policies, ({
394  if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
395  {
396  if (p->sa_index == sa_index)
397  return 1;
398  }
399  }));
400  }));
401 
402  pool_foreach(t, im->tunnel_interfaces, ({
403  if (t->input_sa_index == sa_index)
404  return 1;
405  if (t->output_sa_index == sa_index)
406  return 1;
407  }));
408  /* *INDENT-ON* */
409 
410  return 0;
411 }
412 
413 int
414 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
415 {
416  ipsec_main_t *im = &ipsec_main;
417  ipsec_sa_t *sa = 0;
418  uword *p;
419  u32 sa_index;
420  clib_error_t *err;
421 
422  clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
423 
424  p = hash_get (im->sa_index_by_sa_id, new_sa->id);
425  if (p && is_add)
426  return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
427  if (!p && !is_add)
428  return VNET_API_ERROR_SYSCALL_ERROR_1;
429 
430  if (!is_add) /* delete */
431  {
432  sa_index = p[0];
433  sa = pool_elt_at_index (im->sad, sa_index);
434  if (ipsec_is_sa_used (sa_index))
435  {
436  clib_warning ("sa_id %u used in policy", sa->id);
437  return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
438  }
439  hash_unset (im->sa_index_by_sa_id, sa->id);
440  if (im->cb.add_del_sa_sess_cb)
441  {
442  err = im->cb.add_del_sa_sess_cb (sa_index, 0);
443  if (err)
444  return VNET_API_ERROR_SYSCALL_ERROR_1;
445  }
446  pool_put (im->sad, sa);
447  }
448  else /* create new SA */
449  {
450  pool_get (im->sad, sa);
451  clib_memcpy (sa, new_sa, sizeof (*sa));
452  sa_index = sa - im->sad;
453  hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
454  if (im->cb.add_del_sa_sess_cb)
455  {
456  err = im->cb.add_del_sa_sess_cb (sa_index, 1);
457  if (err)
458  return VNET_API_ERROR_SYSCALL_ERROR_1;
459  }
460  }
461  return 0;
462 }
463 
464 int
466 {
467  ipsec_main_t *im = &ipsec_main;
468  uword *p;
469  u32 sa_index;
470  ipsec_sa_t *sa = 0;
471  clib_error_t *err;
472 
473  p = hash_get (im->sa_index_by_sa_id, sa_update->id);
474  if (!p)
475  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
476 
477  sa_index = p[0];
478  sa = pool_elt_at_index (im->sad, sa_index);
479 
480  /* new crypto key */
481  if (0 < sa_update->crypto_key_len)
482  {
483  clib_memcpy (sa->crypto_key, sa_update->crypto_key,
484  sa_update->crypto_key_len);
485  sa->crypto_key_len = sa_update->crypto_key_len;
486  }
487 
488  /* new integ key */
489  if (0 < sa_update->integ_key_len)
490  {
491  clib_memcpy (sa->integ_key, sa_update->integ_key,
492  sa_update->integ_key_len);
493  sa->integ_key_len = sa_update->integ_key_len;
494  }
495 
496  if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
497  {
498  if (im->cb.add_del_sa_sess_cb)
499  {
500  err = im->cb.add_del_sa_sess_cb (sa_index, 0);
501  if (err)
502  return VNET_API_ERROR_SYSCALL_ERROR_1;
503  }
504  }
505 
506  return 0;
507 }
508 
509 static void
511 {
512  struct
513  {
514  time_t time;
515  pid_t pid;
516  void *p;
517  } seed_data;
518 
519  seed_data.time = time (NULL);
520  seed_data.pid = getpid ();
521  seed_data.p = (void *) &seed_data;
522 
523  RAND_seed ((const void *) &seed_data, sizeof (seed_data));
524 }
525 
526 static clib_error_t *
528 {
529  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
530  return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
531  if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
532  return clib_error_return (0, "unsupported none integ-alg");
533 
534  return 0;
535 }
536 
537 static clib_error_t *
539 {
540  clib_error_t *error;
541  ipsec_main_t *im = &ipsec_main;
543  vlib_node_t *node;
544 
545  ipsec_rand_seed ();
546 
547  memset (im, 0, sizeof (im[0]));
548 
549  im->vnet_main = vnet_get_main ();
550  im->vlib_main = vm;
551 
552  im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
553  im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
554  im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
555 
558 
559  node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
560  ASSERT (node);
561  im->error_drop_node_index = node->index;
562 
563  node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
564  ASSERT (node);
565  im->esp_encrypt_node_index = node->index;
566 
567  node = vlib_get_node_by_name (vm, (u8 *) "esp-decrypt");
568  ASSERT (node);
569  im->esp_decrypt_node_index = node->index;
570 
571  node = vlib_get_node_by_name (vm, (u8 *) "ah-encrypt");
572  ASSERT (node);
573  im->ah_encrypt_node_index = node->index;
574 
575  node = vlib_get_node_by_name (vm, (u8 *) "ah-decrypt");
576  ASSERT (node);
577  im->ah_decrypt_node_index = node->index;
578 
579  im->esp_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP_ENCRYPT;
580  im->esp_decrypt_next_index = IPSEC_INPUT_NEXT_ESP_DECRYPT;
581  im->ah_encrypt_next_index = IPSEC_OUTPUT_NEXT_AH_ENCRYPT;
582  im->ah_decrypt_next_index = IPSEC_INPUT_NEXT_AH_DECRYPT;
583 
585 
586  if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
587  return error;
588 
589  if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
590  return error;
591 
592  ipsec_proto_init ();
593 
594  if ((error = ikev2_init (vm)))
595  return error;
596 
597  return 0;
598 }
599 
601 
602 /*
603  * fd.io coding-style-patch-verification: ON
604  *
605  * Local Variables:
606  * eval: (c-set-style "gnu")
607  * End:
608  */
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:227
ipsec_spd_t * spds
Definition: ipsec.h:257
#define hash_set(h, key, value)
Definition: hash.h:254
u32 ah_decrypt_next_index
Definition: ipsec.h:291
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:225
sll srl srl sll sra u16x4 i
Definition: vector_sse2.h:337
u32 ah_decrypt_node_index
Definition: ipsec.h:286
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
Definition: ipsec.c:155
#define hash_unset(h, key)
Definition: hash.h:260
u32 id
Definition: ipsec.h:113
vnet_main_t * vnet_get_main(void)
Definition: misc.c:47
i32 priority
Definition: ipsec.h:197
static void ipsec_rand_seed(void)
Definition: ipsec.c:510
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Definition: ipsec.c:42
#define NULL
Definition: clib.h:55
u32 index
Definition: node.h:237
u32 ah_encrypt_node_index
Definition: ipsec.h:285
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:121
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:518
u32 * ipv4_outbound_policies
Definition: ipsec.h:223
u32 ipsec_get_sa_index_by_sa_id(u32 sa_id)
Definition: ipsec.c:31
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
Definition: vec.h:443
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:225
u8 crypto_key[128]
Definition: ipsec.h:119
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Definition: ipsec.c:89
u32 spi
Definition: ipsec.h:114
uword * spd_index_by_sw_if_index
Definition: ipsec.h:277
clib_error_t * ipsec_tunnel_if_init(vlib_main_t *vm)
Definition: ipsec_if.c:482
u8 integ_key[128]
Definition: ipsec.h:123
u32 esp_encrypt_next_index
Definition: ipsec.h:288
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:438
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:111
ipsec_main_t ipsec_main
Definition: ipsec.c:28
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:441
#define clib_error_return(e, args...)
Definition: error.h:99
ipsec_main_callbacks_t cb
Definition: ipsec.h:294
u32 ah_encrypt_next_index
Definition: ipsec.h:290
#define vlib_call_init_function(vm, x)
Definition: init.h:162
ipsec_policy_t * policies
Definition: ipsec.h:221
u32 error_drop_node_index
Definition: ipsec.h:282
#define hash_get(h, key)
Definition: hash.h:248
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:459
clib_error_t *(* check_support_cb)(ipsec_sa_t *sa)
Definition: ipsec.h:251
vnet_main_t * vnet_main
Definition: ipsec.h:270
#define v
Definition: acl.c:341
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:271
uword * spd_index_by_spd_id
Definition: ipsec.h:276
#define pool_free(p)
Free a pool.
Definition: pool.h:352
vlib_main_t * vm
Definition: buffer.c:283
u32 esp_encrypt_node_index
Definition: ipsec.h:283
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add)
Definition: ipsec.c:414
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
Definition: ipsec_cli.c:862
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:336
u32 sa_index
Definition: ipsec.h:211
u32 esp_decrypt_next_index
Definition: ipsec.h:289
#define clib_warning(format, args...)
Definition: error.h:59
#define clib_memcpy(a, b, c)
Definition: string.h:75
uword * sa_index_by_sa_id
Definition: ipsec.h:278
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
Definition: ipsec.c:465
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
Definition: node.c:45
vlib_main_t * vlib_main
Definition: ipsec.h:269
static clib_error_t * ipsec_init(vlib_main_t *vm)
Definition: ipsec.c:538
#define hash_create(elts, value_bytes)
Definition: hash.h:681
u8 ipsec_is_sa_used(u32 sa_index)
Definition: ipsec.c:384
#define ASSERT(truth)
unsigned int u32
Definition: types.h:88
ipsec_sa_t * sad
Definition: ipsec.h:258
u8 integ_key_len
Definition: ipsec.h:122
u64 uword
Definition: types.h:112
u8 crypto_key_len
Definition: ipsec.h:118
u32 * ipv4_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:226
unsigned char u8
Definition: types.h:56
u8 is_outbound
Definition: ipsec.h:198
u32 * ipv6_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:228
#define vec_sort_with_function(vec, f)
Sort a vector using the supplied element comparison function.
Definition: vec.h:956
static void ipsec_proto_init()
Definition: esp.h:249
u32 * ipv6_outbound_policies
Definition: ipsec.h:224
static clib_error_t * ipsec_check_support(ipsec_sa_t *sa)
Definition: ipsec.c:527
u32 id
Definition: ipsec.h:219
clib_error_t * ikev2_init(vlib_main_t *vm)
Definition: ikev2.c:3275
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:117
static vlib_thread_main_t * vlib_get_thread_main()
Definition: global_funcs.h:32
clib_error_t *(* add_del_sa_sess_cb)(u32 sa_index, u8 is_add)
Definition: ipsec.h:250
static int ipsec_spd_entry_sort(void *a1, void *a2)
Definition: ipsec.c:134
#define pool_foreach_index(i, v, body)
Iterate pool by index.
Definition: pool.h:480
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:67
u32 ** empty_buffers
Definition: ipsec.h:264
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
Definition: feature.c:229
u32 esp_decrypt_node_index
Definition: ipsec.h:284