FD.io VPP  v18.07.1-19-g511ce25
Vector Packet Processing
ipsec.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel support
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 #include <vnet/udp/udp.h>
23 
24 #include <vnet/ipsec/ipsec.h>
25 #include <vnet/ipsec/ikev2.h>
26 #include <vnet/ipsec/esp.h>
27 #include <vnet/ipsec/ah.h>
28 
29 
31 
32 u32
34 {
35  ipsec_main_t *im = &ipsec_main;
36  uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
37  if (!p)
38  return ~0;
39 
40  return p[0];
41 }
42 
43 int
44 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
45  int is_add)
46 {
47  ipsec_main_t *im = &ipsec_main;
48  ip4_ipsec_config_t config;
49 
50  u32 spd_index;
51  uword *p;
52 
53  p = hash_get (im->spd_index_by_spd_id, spd_id);
54  if (!p)
55  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
56 
57  spd_index = p[0];
58 
59  p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
60  if (p && is_add)
61  return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
62 
63  if (is_add)
64  {
65  hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
66  }
67  else
68  {
69  hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
70  }
71 
72  clib_warning ("sw_if_index %u spd_id %u spd_index %u",
73  sw_if_index, spd_id, spd_index);
74 
75  /* enable IPsec on TX */
76  vnet_feature_enable_disable ("ip4-output", "ipsec-output-ip4", sw_if_index,
77  is_add, 0, 0);
78  vnet_feature_enable_disable ("ip6-output", "ipsec-output-ip6", sw_if_index,
79  is_add, 0, 0);
80 
81  /* enable IPsec on RX */
82  vnet_feature_enable_disable ("ip4-unicast", "ipsec-input-ip4", sw_if_index,
83  is_add, &config, sizeof (config));
84  vnet_feature_enable_disable ("ip6-unicast", "ipsec-input-ip6", sw_if_index,
85  is_add, &config, sizeof (config));
86 
87  return 0;
88 }
89 
90 int
91 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
92 {
93  ipsec_main_t *im = &ipsec_main;
94  ipsec_spd_t *spd = 0;
95  uword *p;
96  u32 spd_index, k, v;
97 
98  p = hash_get (im->spd_index_by_spd_id, spd_id);
99  if (p && is_add)
100  return VNET_API_ERROR_INVALID_VALUE;
101  if (!p && !is_add)
102  return VNET_API_ERROR_INVALID_VALUE;
103 
104  if (!is_add) /* delete */
105  {
106  spd_index = p[0];
107  spd = pool_elt_at_index (im->spds, spd_index);
108  if (!spd)
109  return VNET_API_ERROR_INVALID_VALUE;
110  /* *INDENT-OFF* */
112  if (v == spd_index)
113  ipsec_set_interface_spd(vm, k, spd_id, 0);
114  }));
115  /* *INDENT-ON* */
116  hash_unset (im->spd_index_by_spd_id, spd_id);
117  pool_free (spd->policies);
122  pool_put (im->spds, spd);
123  }
124  else /* create new SPD */
125  {
126  pool_get (im->spds, spd);
127  memset (spd, 0, sizeof (*spd));
128  spd_index = spd - im->spds;
129  spd->id = spd_id;
130  hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
131  }
132  return 0;
133 }
134 
135 static int
136 ipsec_spd_entry_sort (void *a1, void *a2)
137 {
138  u32 *id1 = a1;
139  u32 *id2 = a2;
140  ipsec_spd_t *spd = ipsec_main.spd_to_sort;
141  ipsec_policy_t *p1, *p2;
142 
143  p1 = pool_elt_at_index (spd->policies, *id1);
144  p2 = pool_elt_at_index (spd->policies, *id2);
145  if (p1 && p2)
146  return p2->priority - p1->priority;
147 
148  return 0;
149 }
150 
151 int
153 {
154  ipsec_main_t *im = &ipsec_main;
155  ipsec_spd_t *spd = 0;
156  ipsec_policy_t *vp;
157  uword *p;
158  u32 spd_index;
159 
160  clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
161  policy->priority, policy->is_outbound);
162 
163  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
164  {
165  p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
166  if (!p)
167  return VNET_API_ERROR_SYSCALL_ERROR_1;
168  policy->sa_index = p[0];
169  }
170 
171  p = hash_get (im->spd_index_by_spd_id, policy->id);
172 
173  if (!p)
174  return VNET_API_ERROR_SYSCALL_ERROR_1;
175 
176  spd_index = p[0];
177  spd = pool_elt_at_index (im->spds, spd_index);
178  if (!spd)
179  return VNET_API_ERROR_SYSCALL_ERROR_1;
180 
181  if (is_add)
182  {
183  u32 policy_index;
184 
185  pool_get (spd->policies, vp);
186  clib_memcpy (vp, policy, sizeof (*vp));
187  policy_index = vp - spd->policies;
188 
189  ipsec_main.spd_to_sort = spd;
190 
191  if (policy->is_outbound)
192  {
193  if (policy->is_ipv6)
194  {
195  vec_add1 (spd->ipv6_outbound_policies, policy_index);
196  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
199  }
200  else
201  {
202  vec_add1 (spd->ipv4_outbound_policies, policy_index);
203  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
206  }
207  }
208  else
209  {
210  if (policy->is_ipv6)
211  {
212  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
213  {
215  policy_index);
216  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
220  }
221  else
222  {
223  vec_add1
225  policy_index);
226  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
230  }
231  }
232  else
233  {
234  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
235  {
237  policy_index);
238  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
242  }
243  else
244  {
245  vec_add1
247  policy_index);
248  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
252  }
253  }
254  }
255 
256  ipsec_main.spd_to_sort = NULL;
257  }
258  else
259  {
260  u32 i, j;
261  /* *INDENT-OFF* */
262  pool_foreach_index(i, spd->policies, ({
263  vp = pool_elt_at_index(spd->policies, i);
264  if (vp->priority != policy->priority)
265  continue;
266  if (vp->is_outbound != policy->is_outbound)
267  continue;
268  if (vp->policy != policy->policy)
269  continue;
270  if (vp->sa_id != policy->sa_id)
271  continue;
272  if (vp->protocol != policy->protocol)
273  continue;
274  if (vp->lport.start != policy->lport.start)
275  continue;
276  if (vp->lport.stop != policy->lport.stop)
277  continue;
278  if (vp->rport.start != policy->rport.start)
279  continue;
280  if (vp->rport.stop != policy->rport.stop)
281  continue;
282  if (vp->is_ipv6 != policy->is_ipv6)
283  continue;
284  if (policy->is_ipv6)
285  {
286  if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
287  continue;
288  if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
289  continue;
290  if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
291  continue;
292  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
293  continue;
294  if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
295  continue;
296  if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
297  continue;
298  if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
299  continue;
300  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
301  continue;
302  if (policy->is_outbound)
303  {
304  vec_foreach_index(j, spd->ipv6_outbound_policies) {
305  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
306  vec_del1 (spd->ipv6_outbound_policies, j);
307  break;
308  }
309  }
310  }
311  else
312  {
313  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
314  {
315  vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
316  if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
317  vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
318  break;
319  }
320  }
321  }
322  else
323  {
324  vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
325  if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
326  vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
327  break;
328  }
329  }
330  }
331  }
332  }
333  else
334  {
335  if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
336  continue;
337  if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
338  continue;
339  if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
340  continue;
341  if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
342  continue;
343  if (policy->is_outbound)
344  {
345  vec_foreach_index(j, spd->ipv4_outbound_policies) {
346  if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
347  vec_del1 (spd->ipv4_outbound_policies, j);
348  break;
349  }
350  }
351  }
352  else
353  {
354  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
355  {
356  vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
357  if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
358  vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
359  break;
360  }
361  }
362  }
363  else
364  {
365  vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
366  if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
367  vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
368  break;
369  }
370  }
371  }
372  }
373  }
374  pool_put (spd->policies, vp);
375  break;
376  }));
377  /* *INDENT-ON* */
378  }
379 
380  return 0;
381 }
382 
383 u8
385 {
386  ipsec_main_t *im = &ipsec_main;
387  ipsec_spd_t *spd;
388  ipsec_policy_t *p;
390 
391  /* *INDENT-OFF* */
392  pool_foreach(spd, im->spds, ({
393  pool_foreach(p, spd->policies, ({
394  if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
395  {
396  if (p->sa_index == sa_index)
397  return 1;
398  }
399  }));
400  }));
401 
402  pool_foreach(t, im->tunnel_interfaces, ({
403  if (t->input_sa_index == sa_index)
404  return 1;
405  if (t->output_sa_index == sa_index)
406  return 1;
407  }));
408  /* *INDENT-ON* */
409 
410  return 0;
411 }
412 
413 int
414 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add,
415  u8 udp_encap)
416 {
417  ipsec_main_t *im = &ipsec_main;
418  ipsec_sa_t *sa = 0;
419  uword *p;
420  u32 sa_index;
421  clib_error_t *err;
422 
423  clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
424 
425  p = hash_get (im->sa_index_by_sa_id, new_sa->id);
426  if (p && is_add)
427  return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
428  if (!p && !is_add)
429  return VNET_API_ERROR_SYSCALL_ERROR_1;
430 
431  if (!is_add) /* delete */
432  {
433  sa_index = p[0];
434  sa = pool_elt_at_index (im->sad, sa_index);
435  if (ipsec_is_sa_used (sa_index))
436  {
437  clib_warning ("sa_id %u used in policy", sa->id);
438  return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
439  }
440  hash_unset (im->sa_index_by_sa_id, sa->id);
441  if (im->cb.add_del_sa_sess_cb)
442  {
443  err = im->cb.add_del_sa_sess_cb (sa_index, 0);
444  if (err)
445  return VNET_API_ERROR_SYSCALL_ERROR_1;
446  }
447  pool_put (im->sad, sa);
448  }
449  else /* create new SA */
450  {
451  pool_get (im->sad, sa);
452  clib_memcpy (sa, new_sa, sizeof (*sa));
453  sa_index = sa - im->sad;
454  sa->udp_encap = udp_encap ? 1 : 0;
455  hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
456  if (im->cb.add_del_sa_sess_cb)
457  {
458  err = im->cb.add_del_sa_sess_cb (sa_index, 1);
459  if (err)
460  return VNET_API_ERROR_SYSCALL_ERROR_1;
461  }
462  }
463  return 0;
464 }
465 
466 int
468 {
469  ipsec_main_t *im = &ipsec_main;
470  uword *p;
471  u32 sa_index;
472  ipsec_sa_t *sa = 0;
473  clib_error_t *err;
474 
475  p = hash_get (im->sa_index_by_sa_id, sa_update->id);
476  if (!p)
477  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
478 
479  sa_index = p[0];
480  sa = pool_elt_at_index (im->sad, sa_index);
481 
482  /* new crypto key */
483  if (0 < sa_update->crypto_key_len)
484  {
485  clib_memcpy (sa->crypto_key, sa_update->crypto_key,
486  sa_update->crypto_key_len);
487  sa->crypto_key_len = sa_update->crypto_key_len;
488  }
489 
490  /* new integ key */
491  if (0 < sa_update->integ_key_len)
492  {
493  clib_memcpy (sa->integ_key, sa_update->integ_key,
494  sa_update->integ_key_len);
495  sa->integ_key_len = sa_update->integ_key_len;
496  }
497 
498  if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
499  {
500  if (im->cb.add_del_sa_sess_cb)
501  {
502  err = im->cb.add_del_sa_sess_cb (sa_index, 0);
503  if (err)
504  return VNET_API_ERROR_SYSCALL_ERROR_1;
505  }
506  }
507 
508  return 0;
509 }
510 
511 static void
513 {
514  struct
515  {
516  time_t time;
517  pid_t pid;
518  void *p;
519  } seed_data;
520 
521  seed_data.time = time (NULL);
522  seed_data.pid = getpid ();
523  seed_data.p = (void *) &seed_data;
524 
525  RAND_seed ((const void *) &seed_data, sizeof (seed_data));
526 }
527 
528 static clib_error_t *
530 {
531  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
532  return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
533  if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
534  return clib_error_return (0, "unsupported none integ-alg");
535 
536  return 0;
537 }
538 
539 static clib_error_t *
541 {
542  clib_error_t *error;
543  ipsec_main_t *im = &ipsec_main;
545  vlib_node_t *node;
546 
547  ipsec_rand_seed ();
548 
549  memset (im, 0, sizeof (im[0]));
550 
551  im->vnet_main = vnet_get_main ();
552  im->vlib_main = vm;
553 
554  im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
555  im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
556  im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
557 
560 
561  node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
562  ASSERT (node);
563  im->error_drop_node_index = node->index;
564 
565  node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
566  ASSERT (node);
567  im->esp_encrypt_node_index = node->index;
568 
569  node = vlib_get_node_by_name (vm, (u8 *) "esp-decrypt");
570  ASSERT (node);
571  im->esp_decrypt_node_index = node->index;
572 
573  node = vlib_get_node_by_name (vm, (u8 *) "ah-encrypt");
574  ASSERT (node);
575  im->ah_encrypt_node_index = node->index;
576 
577  node = vlib_get_node_by_name (vm, (u8 *) "ah-decrypt");
578  ASSERT (node);
579  im->ah_decrypt_node_index = node->index;
580 
581  im->esp_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP_ENCRYPT;
582  im->esp_decrypt_next_index = IPSEC_INPUT_NEXT_ESP_DECRYPT;
583  im->ah_encrypt_next_index = IPSEC_OUTPUT_NEXT_AH_ENCRYPT;
584  im->ah_decrypt_next_index = IPSEC_INPUT_NEXT_AH_DECRYPT;
585 
587 
588  if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
589  return error;
590 
591  if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
592  return error;
593 
594  ipsec_proto_init ();
595 
596  if ((error = ikev2_init (vm)))
597  return error;
598 
599  return 0;
600 }
601 
603 
604 /*
605  * fd.io coding-style-patch-verification: ON
606  *
607  * Local Variables:
608  * eval: (c-set-style "gnu")
609  * End:
610  */
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:230
ipsec_spd_t * spds
Definition: ipsec.h:263
#define hash_set(h, key, value)
Definition: hash.h:255
u32 ah_decrypt_next_index
Definition: ipsec.h:298
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:228
u32 ah_decrypt_node_index
Definition: ipsec.h:293
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
Definition: ipsec.c:152
#define hash_unset(h, key)
Definition: hash.h:261
u32 id
Definition: ipsec.h:113
vnet_main_t * vnet_get_main(void)
Definition: misc.c:47
i32 priority
Definition: ipsec.h:200
static void ipsec_rand_seed(void)
Definition: ipsec.c:512
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Definition: ipsec.c:44
#define NULL
Definition: clib.h:55
u32 index
Definition: node.h:273
u32 ah_encrypt_node_index
Definition: ipsec.h:292
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:121
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:523
int i
u32 * ipv4_outbound_policies
Definition: ipsec.h:226
u32 ipsec_get_sa_index_by_sa_id(u32 sa_id)
Definition: ipsec.c:33
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
Definition: vec.h:448
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:228
unsigned char u8
Definition: types.h:56
u8 crypto_key[128]
Definition: ipsec.h:119
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Definition: ipsec.c:91
u32 spi
Definition: ipsec.h:114
uword * spd_index_by_sw_if_index
Definition: ipsec.h:283
clib_error_t * ipsec_tunnel_if_init(vlib_main_t *vm)
Definition: ipsec_if.c:613
u8 integ_key[128]
Definition: ipsec.h:123
u32 esp_encrypt_next_index
Definition: ipsec.h:295
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:443
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:156
ipsec_main_t ipsec_main
Definition: ipsec.c:30
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:442
#define clib_error_return(e, args...)
Definition: error.h:99
ipsec_spd_t * spd_to_sort
Definition: ipsec.h:304
ipsec_main_callbacks_t cb
Definition: ipsec.h:301
u32 ah_encrypt_next_index
Definition: ipsec.h:297
unsigned int u32
Definition: types.h:88
#define vlib_call_init_function(vm, x)
Definition: init.h:227
ipsec_policy_t * policies
Definition: ipsec.h:224
u8 udp_encap
Definition: ipsec.h:130
u32 error_drop_node_index
Definition: ipsec.h:289
#define hash_get(h, key)
Definition: hash.h:249
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:464
clib_error_t *(* check_support_cb)(ipsec_sa_t *sa)
Definition: ipsec.h:257
vnet_main_t * vnet_main
Definition: ipsec.h:276
#define v
Definition: acl.c:491
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:274
uword * spd_index_by_spd_id
Definition: ipsec.h:282
#define pool_free(p)
Free a pool.
Definition: pool.h:357
vlib_main_t * vm
Definition: buffer.c:294
u32 esp_encrypt_node_index
Definition: ipsec.h:290
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
Definition: ipsec_cli.c:900
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:339
u32 sa_index
Definition: ipsec.h:214
u32 esp_decrypt_next_index
Definition: ipsec.h:296
#define clib_warning(format, args...)
Definition: error.h:59
#define clib_memcpy(a, b, c)
Definition: string.h:75
uword * sa_index_by_sa_id
Definition: ipsec.h:284
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
Definition: ipsec.c:467
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
Definition: node.c:45
vlib_main_t * vlib_main
Definition: ipsec.h:275
static clib_error_t * ipsec_init(vlib_main_t *vm)
Definition: ipsec.c:540
#define hash_create(elts, value_bytes)
Definition: hash.h:696
u8 ipsec_is_sa_used(u32 sa_index)
Definition: ipsec.c:384
#define ASSERT(truth)
ipsec_sa_t * sad
Definition: ipsec.h:264
u8 integ_key_len
Definition: ipsec.h:122
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add, u8 udp_encap)
Definition: ipsec.c:414
u8 crypto_key_len
Definition: ipsec.h:118
u32 * ipv4_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:229
u8 is_outbound
Definition: ipsec.h:201
u32 * ipv6_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:231
u64 uword
Definition: types.h:112
#define vec_sort_with_function(vec, f)
Sort a vector using the supplied element comparison function.
Definition: vec.h:982
static void ipsec_proto_init()
Definition: esp.h:257
u32 * ipv6_outbound_policies
Definition: ipsec.h:227
static clib_error_t * ipsec_check_support(ipsec_sa_t *sa)
Definition: ipsec.c:529
u32 id
Definition: ipsec.h:222
clib_error_t * ikev2_init(vlib_main_t *vm)
Definition: ikev2.c:3275
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:117
static vlib_thread_main_t * vlib_get_thread_main()
Definition: global_funcs.h:32
clib_error_t *(* add_del_sa_sess_cb)(u32 sa_index, u8 is_add)
Definition: ipsec.h:256
static int ipsec_spd_entry_sort(void *a1, void *a2)
Definition: ipsec.c:136
#define pool_foreach_index(i, v, body)
Iterate pool by index.
Definition: pool.h:488
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:62
u32 ** empty_buffers
Definition: ipsec.h:270
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
Definition: feature.c:233
u32 esp_decrypt_node_index
Definition: ipsec.h:291