FD.io VPP  v18.10-34-gcce845e
Vector Packet Processing
ipsec_api.c
Go to the documentation of this file.
1 /*
2  *------------------------------------------------------------------
3  * ipsec_api.c - ipsec api
4  *
5  * Copyright (c) 2016 Cisco and/or its affiliates.
6  * Licensed under the Apache License, Version 2.0 (the "License");
7  * you may not use this file except in compliance with the License.
8  * You may obtain a copy of the License at:
9  *
10  * http://www.apache.org/licenses/LICENSE-2.0
11  *
12  * Unless required by applicable law or agreed to in writing, software
13  * distributed under the License is distributed on an "AS IS" BASIS,
14  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15  * See the License for the specific language governing permissions and
16  * limitations under the License.
17  *------------------------------------------------------------------
18  */
19 
20 #include <vnet/vnet.h>
21 #include <vlibmemory/api.h>
22 
23 #include <vnet/interface.h>
24 #include <vnet/api_errno.h>
25 #include <vnet/ip/ip.h>
26 
27 #include <vnet/vnet_msg_enum.h>
28 
29 #if WITH_LIBSSL > 0
30 #include <vnet/ipsec/ipsec.h>
31 #include <vnet/ipsec/ikev2.h>
32 #endif /* IPSEC */
33 
34 #define vl_typedefs /* define message structures */
35 #include <vnet/vnet_all_api_h.h>
36 #undef vl_typedefs
37 
38 #define vl_endianfun /* define message structures */
39 #include <vnet/vnet_all_api_h.h>
40 #undef vl_endianfun
41 
42 /* instantiate all the print functions we know about */
43 #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
44 #define vl_printfun
45 #include <vnet/vnet_all_api_h.h>
46 #undef vl_printfun
47 
49 
50 #define foreach_vpe_api_msg \
51 _(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
52 _(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
53 _(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \
54 _(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \
55 _(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \
56 _(IPSEC_SA_DUMP, ipsec_sa_dump) \
57 _(IPSEC_SPDS_DUMP, ipsec_spds_dump) \
58 _(IPSEC_SPD_DUMP, ipsec_spd_dump) \
59 _(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \
60 _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \
61 _(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \
62 _(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \
63 _(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \
64 _(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \
65 _(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \
66 _(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \
67 _(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \
68 _(IKEV2_SET_RESPONDER, ikev2_set_responder) \
69 _(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \
70 _(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \
71 _(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \
72 _(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \
73 _(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \
74 _(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \
75 _(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa)
76 
79 {
80 #if WITH_LIBSSL == 0
81  clib_warning ("unimplemented");
82 #else
83 
84  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
85  vl_api_ipsec_spd_add_del_reply_t *rmp;
86  int rv;
87 
88  rv = ipsec_add_del_spd (vm, ntohl (mp->spd_id), mp->is_add);
89 
90  REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_REPLY);
91 #endif
92 }
93 
96 {
97  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
98  vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
99  int rv;
100  u32 sw_if_index __attribute__ ((unused));
101  u32 spd_id __attribute__ ((unused));
102 
103  sw_if_index = ntohl (mp->sw_if_index);
104  spd_id = ntohl (mp->spd_id);
105 
107 
108 #if WITH_LIBSSL > 0
109  rv = ipsec_set_interface_spd (vm, sw_if_index, spd_id, mp->is_add);
110 #else
111  rv = VNET_API_ERROR_UNIMPLEMENTED;
112 #endif
113 
115 
116  REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
117 }
118 
121 {
122  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
123  vl_api_ipsec_spd_add_del_entry_reply_t *rmp;
124  int rv;
125 
126 #if WITH_LIBSSL > 0
127  ipsec_policy_t p;
128 
129  memset (&p, 0, sizeof (p));
130 
131  p.id = ntohl (mp->spd_id);
132  p.priority = ntohl (mp->priority);
133  p.is_outbound = mp->is_outbound;
134  p.is_ipv6 = mp->is_ipv6;
135 
136  if (mp->is_ipv6 || mp->is_ip_any)
137  {
142  }
143  else
144  {
145  clib_memcpy (&p.raddr.start.ip4.data, mp->remote_address_start, 4);
146  clib_memcpy (&p.raddr.stop.ip4.data, mp->remote_address_stop, 4);
147  clib_memcpy (&p.laddr.start.ip4.data, mp->local_address_start, 4);
148  clib_memcpy (&p.laddr.stop.ip4.data, mp->local_address_stop, 4);
149  }
150  p.protocol = mp->protocol;
151  p.rport.start = ntohs (mp->remote_port_start);
152  p.rport.stop = ntohs (mp->remote_port_stop);
153  p.lport.start = ntohs (mp->local_port_start);
154  p.lport.stop = ntohs (mp->local_port_stop);
155  /* policy action resolve unsupported */
156  if (mp->policy == IPSEC_POLICY_ACTION_RESOLVE)
157  {
158  clib_warning ("unsupported action: 'resolve'");
159  rv = VNET_API_ERROR_UNIMPLEMENTED;
160  goto out;
161  }
162  p.policy = mp->policy;
163  p.sa_id = ntohl (mp->sa_id);
164 
165  rv = ipsec_add_del_policy (vm, &p, mp->is_add);
166  if (rv)
167  goto out;
168 
169  if (mp->is_ip_any)
170  {
171  p.is_ipv6 = 1;
172  rv = ipsec_add_del_policy (vm, &p, mp->is_add);
173  }
174 #else
175  rv = VNET_API_ERROR_UNIMPLEMENTED;
176  goto out;
177 #endif
178 
179 out:
180  REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_ENTRY_REPLY);
181 }
182 
185 {
186  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
187  vl_api_ipsec_sad_add_del_entry_reply_t *rmp;
188  int rv;
189 #if WITH_LIBSSL > 0
190  ipsec_main_t *im = &ipsec_main;
191  ipsec_sa_t sa;
192 
193  memset (&sa, 0, sizeof (sa));
194 
195  sa.id = ntohl (mp->sad_id);
196  sa.spi = ntohl (mp->spi);
197  sa.protocol = mp->protocol;
198  /* check for unsupported crypto-alg */
200  {
201  clib_warning ("unsupported crypto-alg: '%U'", format_ipsec_crypto_alg,
202  mp->crypto_algorithm);
203  rv = VNET_API_ERROR_UNIMPLEMENTED;
204  goto out;
205  }
206  sa.crypto_alg = mp->crypto_algorithm;
208  clib_memcpy (&sa.crypto_key, mp->crypto_key, sizeof (sa.crypto_key));
209  /* check for unsupported integ-alg */
211  {
212  clib_warning ("unsupported integ-alg: '%U'", format_ipsec_integ_alg,
213  mp->integrity_algorithm);
214  rv = VNET_API_ERROR_UNIMPLEMENTED;
215  goto out;
216  }
217 
220  clib_memcpy (&sa.integ_key, mp->integrity_key, sizeof (sa.integ_key));
222  sa.is_tunnel = mp->is_tunnel;
223  sa.is_tunnel_ip6 = mp->is_tunnel_ipv6;
224  sa.udp_encap = mp->udp_encap;
225  if (sa.is_tunnel_ip6)
226  {
229  }
230  else
231  {
232  clib_memcpy (&sa.tunnel_src_addr.ip4.data, mp->tunnel_src_address, 4);
233  clib_memcpy (&sa.tunnel_dst_addr.ip4.data, mp->tunnel_dst_address, 4);
234  }
236 
237  ASSERT (im->cb.check_support_cb);
238  clib_error_t *err = im->cb.check_support_cb (&sa);
239  if (err)
240  {
241  clib_warning ("%s", err->what);
242  rv = VNET_API_ERROR_UNIMPLEMENTED;
243  goto out;
244  }
245 
246  rv = ipsec_add_del_sa (vm, &sa, mp->is_add);
247 #else
248  rv = VNET_API_ERROR_UNIMPLEMENTED;
249  goto out;
250 #endif
251 
252 out:
253  REPLY_MACRO (VL_API_IPSEC_SAD_ADD_DEL_ENTRY_REPLY);
254 }
255 
256 static void
258  u32 context)
259 {
261 
262  mp = vl_msg_api_alloc (sizeof (*mp));
263  memset (mp, 0, sizeof (*mp));
264  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
265  mp->context = context;
266 
267  mp->spd_id = htonl (spd->id);
268  mp->npolicies = htonl (pool_len (spd->policies));
269 
270  vl_api_send_msg (reg, (u8 *) mp);
271 }
272 
273 static void
275 {
277  ipsec_main_t *im = &ipsec_main;
278  ipsec_spd_t *spd;
279 #if WITH_LIBSSL > 0
281  if (!reg)
282  return;
283 
284  /* *INDENT-OFF* */
285  pool_foreach (spd, im->spds, ({
286  send_ipsec_spds_details (spd, reg, mp->context);
287  }));
288  /* *INDENT-ON* */
289 #else
290  clib_warning ("unimplemented");
291 #endif
292 }
293 
294 static void
296  u32 context)
297 {
299 
300  mp = vl_msg_api_alloc (sizeof (*mp));
301  memset (mp, 0, sizeof (*mp));
302  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
303  mp->context = context;
304 
305  mp->spd_id = htonl (p->id);
306  mp->priority = htonl (p->priority);
307  mp->is_outbound = p->is_outbound;
308  mp->is_ipv6 = p->is_ipv6;
309  if (p->is_ipv6)
310  {
311  memcpy (mp->local_start_addr, &p->laddr.start.ip6, 16);
312  memcpy (mp->local_stop_addr, &p->laddr.stop.ip6, 16);
313  memcpy (mp->remote_start_addr, &p->raddr.start.ip6, 16);
314  memcpy (mp->remote_stop_addr, &p->raddr.stop.ip6, 16);
315  }
316  else
317  {
318  memcpy (mp->local_start_addr, &p->laddr.start.ip4, 4);
319  memcpy (mp->local_stop_addr, &p->laddr.stop.ip4, 4);
320  memcpy (mp->remote_start_addr, &p->raddr.start.ip4, 4);
321  memcpy (mp->remote_stop_addr, &p->raddr.stop.ip4, 4);
322  }
323  mp->local_start_port = htons (p->lport.start);
324  mp->local_stop_port = htons (p->lport.stop);
325  mp->remote_start_port = htons (p->rport.start);
326  mp->remote_stop_port = htons (p->rport.stop);
327  mp->protocol = p->protocol;
328  mp->policy = p->policy;
329  mp->sa_id = htonl (p->sa_id);
330  mp->bytes = clib_host_to_net_u64 (p->counter.bytes);
331  mp->packets = clib_host_to_net_u64 (p->counter.packets);
332 
333  vl_api_send_msg (reg, (u8 *) mp);
334 }
335 
336 static void
338 {
340  ipsec_main_t *im = &ipsec_main;
341  ipsec_policy_t *policy;
342  ipsec_spd_t *spd;
343  uword *p;
344  u32 spd_index;
345 #if WITH_LIBSSL > 0
347  if (!reg)
348  return;
349 
350  p = hash_get (im->spd_index_by_spd_id, ntohl (mp->spd_id));
351  if (!p)
352  return;
353 
354  spd_index = p[0];
355  spd = pool_elt_at_index (im->spds, spd_index);
356 
357  /* *INDENT-OFF* */
358  pool_foreach (policy, spd->policies,
359  ({
360  if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == policy->sa_id)
361  send_ipsec_spd_details (policy, reg,
362  mp->context);}
363  ));
364  /* *INDENT-ON* */
365 #else
366  clib_warning ("unimplemented");
367 #endif
368 }
369 
370 static void
372  u32 sw_if_index, u32 context)
373 {
375 
376  mp = vl_msg_api_alloc (sizeof (*mp));
377  memset (mp, 0, sizeof (*mp));
378  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
379  mp->context = context;
380 
381  mp->spd_index = htonl (spd_index);
382  mp->sw_if_index = htonl (sw_if_index);
383 
384  vl_api_send_msg (reg, (u8 *) mp);
385 }
386 
387 static void
389  mp)
390 {
391  ipsec_main_t *im = &ipsec_main;
393  u32 k, v, spd_index;
394 
395 #if WITH_LIBSSL > 0
397  if (!reg)
398  return;
399 
400  if (mp->spd_index_valid)
401  {
402  spd_index = ntohl (mp->spd_index);
403  /* *INDENT-OFF* */
405  if (v == spd_index)
406  send_ipsec_spd_interface_details(reg, v, k, mp->context);
407  }));
408  /* *INDENT-ON* */
409  }
410  else
411  {
412  /* *INDENT-OFF* */
414  send_ipsec_spd_interface_details(reg, v, k, mp->context);
415  }));
416  /* *INDENT-ON* */
417  }
418 
419 #else
420  clib_warning ("unimplemented");
421 #endif
422 }
423 
424 static void
426 {
427  vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
428  vl_api_ipsec_sa_set_key_reply_t *rmp;
429  int rv;
430 #if WITH_LIBSSL > 0
431  ipsec_sa_t sa;
432  sa.id = ntohl (mp->sa_id);
434  clib_memcpy (&sa.crypto_key, mp->crypto_key, sizeof (sa.crypto_key));
436  clib_memcpy (&sa.integ_key, mp->integrity_key, sizeof (sa.integ_key));
437 
438  rv = ipsec_set_sa_key (vm, &sa);
439 #else
440  rv = VNET_API_ERROR_UNIMPLEMENTED;
441 #endif
442 
443  REPLY_MACRO (VL_API_IPSEC_SA_SET_KEY_REPLY);
444 }
445 
446 static void
448  mp)
449 {
451  ipsec_main_t *im = &ipsec_main;
452  vnet_main_t *vnm = im->vnet_main;
453  u32 sw_if_index = ~0;
454  int rv;
455 
456 #if WITH_LIBSSL > 0
458 
459  memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
460 
461  tun.is_add = mp->is_add;
462  tun.esn = mp->esn;
463  tun.anti_replay = mp->anti_replay;
464  tun.local_spi = ntohl (mp->local_spi);
465  tun.remote_spi = ntohl (mp->remote_spi);
466  tun.crypto_alg = mp->crypto_alg;
469  tun.integ_alg = mp->integ_alg;
472  tun.udp_encap = mp->udp_encap;
473  memcpy (&tun.local_ip, mp->local_ip, 4);
474  memcpy (&tun.remote_ip, mp->remote_ip, 4);
475  memcpy (&tun.local_crypto_key, &mp->local_crypto_key,
477  memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key,
479  memcpy (&tun.local_integ_key, &mp->local_integ_key,
480  mp->local_integ_key_len);
481  memcpy (&tun.remote_integ_key, &mp->remote_integ_key,
483  tun.renumber = mp->renumber;
484  tun.show_instance = ntohl (mp->show_instance);
485 
486  rv = ipsec_add_del_tunnel_if_internal (vnm, &tun, &sw_if_index);
487 
488 #else
489  rv = VNET_API_ERROR_UNIMPLEMENTED;
490 #endif
491 
492  REPLY_MACRO2 (VL_API_IPSEC_TUNNEL_IF_ADD_DEL_REPLY, (
493  {
494  rmp->sw_if_index =
495  htonl (sw_if_index);
496  }));
497 }
498 
499 static void
501  u32 context, u32 sw_if_index)
502 {
504 
505  mp = vl_msg_api_alloc (sizeof (*mp));
506  memset (mp, 0, sizeof (*mp));
507  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
508  mp->context = context;
509 
510  mp->sa_id = htonl (sa->id);
511  mp->sw_if_index = htonl (sw_if_index);
512 
513  mp->spi = htonl (sa->spi);
514  mp->protocol = sa->protocol;
515 
516  mp->crypto_alg = sa->crypto_alg;
517  mp->crypto_key_len = sa->crypto_key_len;
518  memcpy (mp->crypto_key, sa->crypto_key, sa->crypto_key_len);
519 
520  mp->integ_alg = sa->integ_alg;
521  mp->integ_key_len = sa->integ_key_len;
522  memcpy (mp->integ_key, sa->integ_key, sa->integ_key_len);
523 
524  mp->use_esn = sa->use_esn;
526 
527  mp->is_tunnel = sa->is_tunnel;
528  mp->is_tunnel_ip6 = sa->is_tunnel_ip6;
529 
530  if (sa->is_tunnel)
531  {
532  if (sa->is_tunnel_ip6)
533  {
534  memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip6, 16);
535  memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip6, 16);
536  }
537  else
538  {
539  memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip4, 4);
540  memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip4, 4);
541  }
542  }
543 
544  mp->salt = clib_host_to_net_u32 (sa->salt);
545  mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
546  mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
547  if (sa->use_esn)
548  {
549  mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
550  mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
551  }
552  if (sa->use_anti_replay)
553  mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
554  mp->total_data_size = clib_host_to_net_u64 (sa->total_data_size);
555  mp->udp_encap = sa->udp_encap;
556 
557  vl_api_send_msg (reg, (u8 *) mp);
558 }
559 
560 
561 static void
563 {
565  ipsec_main_t *im = &ipsec_main;
566  vnet_main_t *vnm = im->vnet_main;
567  ipsec_sa_t *sa;
569  u32 *sa_index_to_tun_if_index = 0;
570 
571 #if WITH_LIBSSL > 0
573  if (!reg || pool_elts (im->sad) == 0)
574  return;
575 
576  vec_validate_init_empty (sa_index_to_tun_if_index, vec_len (im->sad) - 1,
577  ~0);
578 
579  /* *INDENT-OFF* */
581  ({
582  vnet_hw_interface_t *hi;
583  u32 sw_if_index = ~0;
584 
585  hi = vnet_get_hw_interface (vnm, t->hw_if_index);
586  sw_if_index = hi->sw_if_index;
587  sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index;
588  sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index;
589  }));
590 
591  pool_foreach (sa, im->sad,
592  ({
593  if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id)
594  send_ipsec_sa_details (sa, reg, mp->context,
595  sa_index_to_tun_if_index[sa - im->sad]);
596  }));
597  /* *INDENT-ON* */
598 
599  vec_free (sa_index_to_tun_if_index);
600 #else
601  clib_warning ("unimplemented");
602 #endif
603 }
604 
605 
606 static void
608  mp)
609 {
610  vl_api_ipsec_tunnel_if_set_key_reply_t *rmp;
611  ipsec_main_t *im = &ipsec_main;
612  vnet_main_t *vnm = im->vnet_main;
614  u8 *key = 0;
615  int rv;
616 
617 #if WITH_LIBSSL > 0
618  sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index));
619 
620  switch (mp->key_type)
621  {
624  if (mp->alg < IPSEC_CRYPTO_ALG_AES_CBC_128 ||
625  mp->alg >= IPSEC_CRYPTO_N_ALG)
626  {
627  rv = VNET_API_ERROR_UNIMPLEMENTED;
628  goto out;
629  }
630  break;
633  if (mp->alg >= IPSEC_INTEG_N_ALG)
634  {
635  rv = VNET_API_ERROR_UNIMPLEMENTED;
636  goto out;
637  }
638  break;
640  default:
641  rv = VNET_API_ERROR_UNIMPLEMENTED;
642  goto out;
643  break;
644  }
645 
646  key = vec_new (u8, mp->key_len);
647  clib_memcpy (key, mp->key, mp->key_len);
648 
649  rv = ipsec_set_interface_key (vnm, sw->hw_if_index, mp->key_type, mp->alg,
650  key);
651  vec_free (key);
652 #else
653  clib_warning ("unimplemented");
654 #endif
655 
656 out:
657  REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_KEY_REPLY);
658 }
659 
660 
661 static void
663 {
664  vl_api_ipsec_tunnel_if_set_sa_reply_t *rmp;
665  ipsec_main_t *im = &ipsec_main;
666  vnet_main_t *vnm = im->vnet_main;
668  int rv;
669 
670 #if WITH_LIBSSL > 0
671  sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index));
672 
673  rv = ipsec_set_interface_sa (vnm, sw->hw_if_index, ntohl (mp->sa_id),
674  mp->is_outbound);
675 #else
676  clib_warning ("unimplemented");
677 #endif
678 
679  REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_SA_REPLY);
680 }
681 
682 
683 static void
685 {
686  vl_api_ikev2_profile_add_del_reply_t *rmp;
687  int rv = 0;
688 
689 #if WITH_LIBSSL > 0
691  clib_error_t *error;
692  u8 *tmp = format (0, "%s", mp->name);
693  error = ikev2_add_del_profile (vm, tmp, mp->is_add);
694  vec_free (tmp);
695  if (error)
696  rv = VNET_API_ERROR_UNSPECIFIED;
697 #else
698  rv = VNET_API_ERROR_UNIMPLEMENTED;
699 #endif
700 
701  REPLY_MACRO (VL_API_IKEV2_PROFILE_ADD_DEL_REPLY);
702 }
703 
704 static void
707 {
708  vl_api_ikev2_profile_set_auth_reply_t *rmp;
709  int rv = 0;
710 
711 #if WITH_LIBSSL > 0
713  clib_error_t *error;
714  u8 *tmp = format (0, "%s", mp->name);
715  u8 *data = vec_new (u8, mp->data_len);
716  clib_memcpy (data, mp->data, mp->data_len);
717  error = ikev2_set_profile_auth (vm, tmp, mp->auth_method, data, mp->is_hex);
718  vec_free (tmp);
719  vec_free (data);
720  if (error)
721  rv = VNET_API_ERROR_UNSPECIFIED;
722 #else
723  rv = VNET_API_ERROR_UNIMPLEMENTED;
724 #endif
725 
726  REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_AUTH_REPLY);
727 }
728 
729 static void
731 {
732  vl_api_ikev2_profile_add_del_reply_t *rmp;
733  int rv = 0;
734 
735 #if WITH_LIBSSL > 0
737  clib_error_t *error;
738  u8 *tmp = format (0, "%s", mp->name);
739  u8 *data = vec_new (u8, mp->data_len);
740  clib_memcpy (data, mp->data, mp->data_len);
741  error = ikev2_set_profile_id (vm, tmp, mp->id_type, data, mp->is_local);
742  vec_free (tmp);
743  vec_free (data);
744  if (error)
745  rv = VNET_API_ERROR_UNSPECIFIED;
746 #else
747  rv = VNET_API_ERROR_UNIMPLEMENTED;
748 #endif
749 
750  REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_ID_REPLY);
751 }
752 
753 static void
755 {
756  vl_api_ikev2_profile_set_ts_reply_t *rmp;
757  int rv = 0;
758 
759 #if WITH_LIBSSL > 0
761  clib_error_t *error;
762  u8 *tmp = format (0, "%s", mp->name);
763  error = ikev2_set_profile_ts (vm, tmp, mp->proto, mp->start_port,
764  mp->end_port, (ip4_address_t) mp->start_addr,
765  (ip4_address_t) mp->end_addr, mp->is_local);
766  vec_free (tmp);
767  if (error)
768  rv = VNET_API_ERROR_UNSPECIFIED;
769 #else
770  rv = VNET_API_ERROR_UNIMPLEMENTED;
771 #endif
772 
773  REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_TS_REPLY);
774 }
775 
776 static void
778 {
779  vl_api_ikev2_profile_set_ts_reply_t *rmp;
780  int rv = 0;
781 
782 #if WITH_LIBSSL > 0
784  clib_error_t *error;
785 
786  error = ikev2_set_local_key (vm, mp->key_file);
787  if (error)
788  rv = VNET_API_ERROR_UNSPECIFIED;
789 #else
790  rv = VNET_API_ERROR_UNIMPLEMENTED;
791 #endif
792 
793  REPLY_MACRO (VL_API_IKEV2_SET_LOCAL_KEY_REPLY);
794 }
795 
796 static void
798 {
799  vl_api_ikev2_set_responder_reply_t *rmp;
800  int rv = 0;
801 
802 #if WITH_LIBSSL > 0
804  clib_error_t *error;
805 
806  u8 *tmp = format (0, "%s", mp->name);
807  ip4_address_t ip4;
808  clib_memcpy (&ip4, mp->address, sizeof (ip4));
809 
810  error = ikev2_set_profile_responder (vm, tmp, mp->sw_if_index, ip4);
811  vec_free (tmp);
812  if (error)
813  rv = VNET_API_ERROR_UNSPECIFIED;
814 #else
815  rv = VNET_API_ERROR_UNIMPLEMENTED;
816 #endif
817 
818  REPLY_MACRO (VL_API_IKEV2_SET_RESPONDER_REPLY);
819 }
820 
821 static void
823  mp)
824 {
825  vl_api_ikev2_set_ike_transforms_reply_t *rmp;
826  int rv = 0;
827 
828 #if WITH_LIBSSL > 0
830  clib_error_t *error;
831 
832  u8 *tmp = format (0, "%s", mp->name);
833 
834  error =
836  mp->dh_group, mp->crypto_key_size);
837  vec_free (tmp);
838  if (error)
839  rv = VNET_API_ERROR_UNSPECIFIED;
840 #else
841  rv = VNET_API_ERROR_UNIMPLEMENTED;
842 #endif
843 
844  REPLY_MACRO (VL_API_IKEV2_SET_IKE_TRANSFORMS_REPLY);
845 }
846 
847 static void
849  mp)
850 {
851  vl_api_ikev2_set_esp_transforms_reply_t *rmp;
852  int rv = 0;
853 
854 #if WITH_LIBSSL > 0
856  clib_error_t *error;
857 
858  u8 *tmp = format (0, "%s", mp->name);
859 
860  error =
862  mp->dh_group, mp->crypto_key_size);
863  vec_free (tmp);
864  if (error)
865  rv = VNET_API_ERROR_UNSPECIFIED;
866 #else
867  rv = VNET_API_ERROR_UNIMPLEMENTED;
868 #endif
869 
870  REPLY_MACRO (VL_API_IKEV2_SET_ESP_TRANSFORMS_REPLY);
871 }
872 
873 static void
875 {
876  vl_api_ikev2_set_sa_lifetime_reply_t *rmp;
877  int rv = 0;
878 
879 #if WITH_LIBSSL > 0
881  clib_error_t *error;
882 
883  u8 *tmp = format (0, "%s", mp->name);
884 
885  error =
887  mp->handover, mp->lifetime_maxdata);
888  vec_free (tmp);
889  if (error)
890  rv = VNET_API_ERROR_UNSPECIFIED;
891 #else
892  rv = VNET_API_ERROR_UNIMPLEMENTED;
893 #endif
894 
895  REPLY_MACRO (VL_API_IKEV2_SET_SA_LIFETIME_REPLY);
896 }
897 
898 static void
900 {
901  vl_api_ikev2_initiate_sa_init_reply_t *rmp;
902  int rv = 0;
903 
904 #if WITH_LIBSSL > 0
906  clib_error_t *error;
907 
908  u8 *tmp = format (0, "%s", mp->name);
909 
910  error = ikev2_initiate_sa_init (vm, tmp);
911  vec_free (tmp);
912  if (error)
913  rv = VNET_API_ERROR_UNSPECIFIED;
914 #else
915  rv = VNET_API_ERROR_UNIMPLEMENTED;
916 #endif
917 
918  REPLY_MACRO (VL_API_IKEV2_INITIATE_SA_INIT_REPLY);
919 }
920 
921 static void
923  * mp)
924 {
925  vl_api_ikev2_initiate_del_ike_sa_reply_t *rmp;
926  int rv = 0;
927 
928 #if WITH_LIBSSL > 0
930  clib_error_t *error;
931 
932  error = ikev2_initiate_delete_ike_sa (vm, mp->ispi);
933  if (error)
934  rv = VNET_API_ERROR_UNSPECIFIED;
935 #else
936  rv = VNET_API_ERROR_UNIMPLEMENTED;
937 #endif
938 
939  REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_IKE_SA_REPLY);
940 }
941 
942 static void
945 {
946  vl_api_ikev2_initiate_del_child_sa_reply_t *rmp;
947  int rv = 0;
948 
949 #if WITH_LIBSSL > 0
951  clib_error_t *error;
952 
953  error = ikev2_initiate_delete_child_sa (vm, mp->ispi);
954  if (error)
955  rv = VNET_API_ERROR_UNSPECIFIED;
956 #else
957  rv = VNET_API_ERROR_UNIMPLEMENTED;
958 #endif
959 
960  REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_CHILD_SA_REPLY);
961 }
962 
963 static void
966 {
967  vl_api_ikev2_initiate_rekey_child_sa_reply_t *rmp;
968  int rv = 0;
969 
970 #if WITH_LIBSSL > 0
972  clib_error_t *error;
973 
974  error = ikev2_initiate_rekey_child_sa (vm, mp->ispi);
975  if (error)
976  rv = VNET_API_ERROR_UNSPECIFIED;
977 #else
978  rv = VNET_API_ERROR_UNIMPLEMENTED;
979 #endif
980 
981  REPLY_MACRO (VL_API_IKEV2_INITIATE_REKEY_CHILD_SA_REPLY);
982 }
983 
984 /*
985  * ipsec_api_hookup
986  * Add vpe's API message handlers to the table.
987  * vlib has already mapped shared memory and
988  * added the client registration handlers.
989  * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
990  */
991 #define vl_msg_name_crc_list
992 #include <vnet/vnet_all_api_h.h>
993 #undef vl_msg_name_crc_list
994 
995 static void
997 {
998 #define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id);
999  foreach_vl_msg_name_crc_ipsec;
1000 #undef _
1001 }
1002 
1003 static clib_error_t *
1005 {
1006  api_main_t *am = &api_main;
1007 
1008 #define _(N,n) \
1009  vl_msg_api_set_handlers(VL_API_##N, #n, \
1010  vl_api_##n##_t_handler, \
1011  vl_noop_handler, \
1012  vl_api_##n##_t_endian, \
1013  vl_api_##n##_t_print, \
1014  sizeof(vl_api_##n##_t), 1);
1016 #undef _
1017 
1018  /*
1019  * Set up the (msg_name, crc, message-id) table
1020  */
1022 
1023  return 0;
1024 }
1025 
1027 
1028 /*
1029  * fd.io coding-style-patch-verification: ON
1030  *
1031  * Local Variables:
1032  * eval: (c-set-style "gnu")
1033  * End:
1034  */
ip46_address_t stop
Definition: ipsec.h:149
int ipsec_set_interface_key(vnet_main_t *vnm, u32 hw_if_index, ipsec_if_set_key_type_t type, u8 alg, u8 *key)
Definition: ipsec_if.c:486
static void vl_api_ikev2_profile_set_auth_t_handler(vl_api_ikev2_profile_set_auth_t *mp)
Definition: ipsec_api.c:706
static void vl_api_ipsec_sa_set_key_t_handler(vl_api_ipsec_sa_set_key_t *mp)
Definition: ipsec_api.c:425
static void vl_api_ikev2_set_local_key_t_handler(vl_api_ikev2_set_local_key_t *mp)
Definition: ipsec_api.c:777
ipsec_spd_t * spds
Definition: ipsec.h:264
int ipsec_set_interface_sa(vnet_main_t *vnm, u32 hw_if_index, u32 sa_id, u8 is_outbound)
Definition: ipsec_if.c:536
u8 crypto_algorithm
Definition: ipsec.api:152
u8 use_extended_sequence_number
Definition: ipsec.api:160
u32 sa_id
Definition: ipsec.api:105
u8 integrity_key_length
Definition: ipsec.api:157
clib_error_t * ikev2_set_profile_responder(vlib_main_t *vm, u8 *name, u32 sw_if_index, ip4_address_t ip4)
Definition: ikev2.c:2824
ipsec_tunnel_if_t * tunnel_interfaces
Definition: ipsec.h:268
u16 stop
Definition: ipsec.h:154
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
Definition: ipsec.c:154
ip46_address_t tunnel_src_addr
Definition: ipsec.h:131
IKEv2: Set Child SA lifetime, limited by time and/or data.
Definition: ipsec.api:372
u32 id
Definition: ipsec.h:113
IPsec: SPD interface response.
Definition: ipsec.api:537
clib_error_t * ikev2_add_del_profile(vlib_main_t *vm, u8 *name, int is_add)
Definition: ikev2.c:2683
static void vl_api_ikev2_initiate_rekey_child_sa_t_handler(vl_api_ikev2_initiate_rekey_child_sa_t *mp)
Definition: ipsec_api.c:965
static void vl_api_ipsec_tunnel_if_set_key_t_handler(vl_api_ipsec_tunnel_if_set_key_t *mp)
Definition: ipsec_api.c:607
u8 tunnel_dst_address[16]
Definition: ipsec.api:166
IKEv2: Add/delete profile.
Definition: ipsec.api:204
u16 local_port_start
Definition: ipsec.api:100
VLIB_API_INIT_FUNCTION(ipsec_api_hookup)
i32 priority
Definition: ipsec.h:201
IPsec: Update Security Association keys.
Definition: ipsec.api:183
unsigned long u64
Definition: types.h:89
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Definition: ipsec.c:44
clib_error_t * ikev2_initiate_delete_ike_sa(vlib_main_t *vm, u64 ispi)
Definition: ikev2.c:3142
u8 is_add
Definition: ipsec.api:82
#define REPLY_MACRO2(t, body)
static void vl_api_send_msg(vl_api_registration_t *rp, u8 *elem)
Definition: api.h:34
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:121
IPsec: Add/delete Security Policy Database entry.
Definition: ipsec.api:78
static void setup_message_id_table(api_main_t *am)
Definition: ipsec_api.c:996
u8 is_tunnel
Definition: ipsec.h:128
static void vl_api_ipsec_sa_dump_t_handler(vl_api_ipsec_sa_dump_t *mp)
Definition: ipsec_api.c:562
static vnet_sw_interface_t * vnet_get_sw_interface(vnet_main_t *vnm, u32 sw_if_index)
static void vl_api_ipsec_spd_add_del_entry_t_handler(vl_api_ipsec_spd_add_del_entry_t *mp)
Definition: ipsec_api.c:120
clib_error_t * ikev2_set_profile_sa_lifetime(vlib_main_t *vm, u8 *name, u64 lifetime, u32 jitter, u32 handover, u64 maxdata)
Definition: ikev2.c:2895
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
u8 policy
Definition: ipsec.api:104
u16 remote_port_stop
Definition: ipsec.api:99
void * vl_msg_api_alloc(int nbytes)
u8 crypto_key[128]
Definition: ipsec.api:154
unsigned char u8
Definition: types.h:56
#define foreach_vpe_api_msg
Definition: ipsec_api.c:50
#define pool_len(p)
Number of elements in pool vector.
Definition: pool.h:140
u8 crypto_key[128]
Definition: ipsec.h:119
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Definition: ipsec.c:93
u8 protocol
Definition: ipsec.api:96
u32 spi
Definition: ipsec.h:114
port_range_t lport
Definition: ipsec.h:209
u32 seq_hi
Definition: ipsec.h:138
uword * spd_index_by_sw_if_index
Definition: ipsec.h:284
static void vl_api_ipsec_interface_add_del_spd_t_handler(vl_api_ipsec_interface_add_del_spd_t *mp)
Definition: ipsec_api.c:95
u8 udp_encap
Definition: ipsec.api:167
IKEv2: Set IKEv2 IKE transforms in SA_INIT proposal (RFC 7296)
Definition: ipsec.api:326
u64 replay_window
Definition: ipsec.h:141
u32 spd_id
Definition: ipsec.api:84
u8 local_address_start[16]
Definition: ipsec.api:93
memset(h->entries, 0, sizeof(h->entries[0])*entries)
u8 integ_key[128]
Definition: ipsec.h:123
u8 is_tunnel
Definition: ipsec.api:163
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:443
u8 crypto_key_length
Definition: ipsec.api:153
u32 sad_id
Definition: ipsec.api:146
ipsec_main_t ipsec_main
Definition: ipsec.c:30
u32 sw_if_index
Definition: vxlan_gbp.api:39
clib_error_t * ikev2_initiate_sa_init(vlib_main_t *vm, u8 *name)
Definition: ikev2.c:2918
#define vec_new(T, N)
Create new vector of given type and length (unspecified alignment, no header).
Definition: vec.h:309
clib_error_t * ikev2_set_profile_auth(vlib_main_t *vm, u8 *name, u8 auth_method, u8 *auth_data, u8 data_hex_format)
Definition: ikev2.c:2714
static void vl_api_ipsec_tunnel_if_add_del_t_handler(vl_api_ipsec_tunnel_if_add_del_t *mp)
Definition: ipsec_api.c:447
static void vl_api_ikev2_set_responder_t_handler(vl_api_ikev2_set_responder_t *mp)
Definition: ipsec_api.c:797
u8 use_esn
Definition: ipsec.h:125
Set key on IPsec interface.
Definition: ipsec.api:683
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:442
ip4_address_t remote_ip
Definition: ipsec.h:162
static void vl_api_ipsec_spd_dump_t_handler(vl_api_ipsec_spd_dump_t *mp)
Definition: ipsec_api.c:337
static void vl_api_ipsec_spd_interface_dump_t_handler(vl_api_ipsec_spd_interface_dump_t *mp)
Definition: ipsec_api.c:388
u16 start
Definition: ipsec.h:154
static void vl_api_ikev2_profile_set_ts_t_handler(vl_api_ikev2_profile_set_ts_t *mp)
Definition: ipsec_api.c:754
ipsec_main_callbacks_t cb
Definition: ipsec.h:302
IKEv2: Initiate the delete Child SA exchange.
Definition: ipsec.api:421
clib_error_t * ikev2_set_profile_esp_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
Definition: ikev2.c:2870
unsigned int u32
Definition: types.h:88
IKEv2: Set IKEv2 profile local/remote identification.
Definition: ipsec.api:245
IKEv2: Set IKEv2 profile traffic selector parameters.
Definition: ipsec.api:269
static void vl_api_ikev2_initiate_del_child_sa_t_handler(vl_api_ikev2_initiate_del_child_sa_t *mp)
Definition: ipsec_api.c:944
u8 * format_ipsec_crypto_alg(u8 *s, va_list *args)
Definition: ipsec_format.c:58
ipsec_policy_t * policies
Definition: ipsec.h:225
i32 priority
Definition: ipsec.api:85
u8 udp_encap
Definition: ipsec.h:130
static void vl_api_ipsec_spd_add_del_t_handler(vl_api_ipsec_spd_add_del_t *mp)
Definition: ipsec_api.c:78
u8 local_address_stop[16]
Definition: ipsec.api:94
u32 last_seq
Definition: ipsec.h:139
#define hash_get(h, key)
Definition: hash.h:249
clib_error_t * ikev2_set_profile_id(vlib_main_t *vm, u8 *name, u8 id_type, u8 *data, int is_local)
Definition: ikev2.c:2746
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:464
counter_t packets
packet counter
Definition: counter_types.h:28
Dump IPsec all SPD IDs response.
Definition: ipsec.api:458
Add/delete IPsec tunnel interface response.
Definition: ipsec.api:597
u8 is_tunnel_ip6
Definition: ipsec.h:129
IKEv2: Initiate the rekey Child SA exchange.
Definition: ipsec.api:436
clib_error_t *(* check_support_cb)(ipsec_sa_t *sa)
Definition: ipsec.h:258
IPsec: Add/delete Security Policy Database.
Definition: ipsec.api:25
u32 salt
Definition: ipsec.h:134
vnet_main_t * vnet_main
Definition: ipsec.h:277
#define v
Definition: acl.c:496
u32 last_seq_hi
Definition: ipsec.h:140
clib_error_t * ikev2_initiate_delete_child_sa(vlib_main_t *vm, u32 ispi)
Definition: ikev2.c:3102
static void vl_api_ikev2_initiate_sa_init_t_handler(vl_api_ikev2_initiate_sa_init_t *mp)
Definition: ipsec_api.c:899
#define REPLY_MACRO(t)
static void vl_api_ikev2_set_sa_lifetime_t_handler(vl_api_ikev2_set_sa_lifetime_t *mp)
Definition: ipsec_api.c:874
ip46_address_range_t laddr
Definition: ipsec.h:206
u8 is_add
Definition: ipsec.api:144
static void send_ipsec_sa_details(ipsec_sa_t *sa, vl_api_registration_t *reg, u32 context, u32 sw_if_index)
Definition: ipsec_api.c:500
u16 local_port_stop
Definition: ipsec.api:101
static void vl_api_ikev2_set_ike_transforms_t_handler(vl_api_ikev2_set_ike_transforms_t *mp)
Definition: ipsec_api.c:822
uword * spd_index_by_spd_id
Definition: ipsec.h:283
clib_error_t * ikev2_set_local_key(vlib_main_t *vm, u8 *file)
Definition: ikev2.c:2671
clib_error_t * ikev2_set_profile_ts(vlib_main_t *vm, u8 *name, u8 protocol_id, u16 start_port, u16 end_port, ip4_address_t start_addr, ip4_address_t end_addr, int is_local)
Definition: ikev2.c:2785
static void vl_api_ipsec_tunnel_if_set_sa_t_handler(vl_api_ipsec_tunnel_if_set_sa_t *mp)
Definition: ipsec_api.c:662
API main structure, used by both vpp and binary API clients.
Definition: api_common.h:201
ip46_address_t tunnel_dst_addr
Definition: ipsec.h:132
An API client registration, only in vpp/vlib.
Definition: api_common.h:44
#define BAD_SW_IF_INDEX_LABEL
IPsec: Add/delete SPD from interface.
Definition: ipsec.api:43
clib_error_t * ikev2_initiate_rekey_child_sa(vlib_main_t *vm, u32 ispi)
Definition: ikev2.c:3252
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:165
u16 remote_port_start
Definition: ipsec.api:98
static void vl_api_ikev2_set_esp_transforms_t_handler(vl_api_ikev2_set_esp_transforms_t *mp)
Definition: ipsec_api.c:848
vlib_main_t * vm
Definition: buffer.c:294
u8 remote_address_stop[16]
Definition: ipsec.api:92
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add)
Definition: ipsec.c:416
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:339
IPsec: Add/delete Security Association Database entry.
Definition: ipsec.api:140
Dump IPsec all SPD IDs.
Definition: ipsec.api:448
ip46_address_t start
Definition: ipsec.h:149
#define clib_warning(format, args...)
Definition: error.h:59
#define clib_memcpy(a, b, c)
Definition: string.h:75
u8 remote_address_start[16]
Definition: ipsec.api:91
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
Definition: ipsec.c:467
u8 tunnel_src_address[16]
Definition: ipsec.api:165
Set new SA on IPsec interface.
Definition: ipsec.api:700
IKEv2: Initiate the SA_INIT exchange.
Definition: ipsec.api:391
static vl_api_registration_t * vl_api_client_index_to_registration(u32 index)
Definition: api.h:56
static void vl_api_ipsec_sad_add_del_entry_t_handler(vl_api_ipsec_sad_add_del_entry_t *mp)
Definition: ipsec_api.c:184
static void vl_api_ipsec_spds_dump_t_handler(vl_api_ipsec_spds_dump_t *mp)
Definition: ipsec_api.c:274
static void send_ipsec_spd_interface_details(vl_api_registration_t *reg, u32 spd_index, u32 sw_if_index, u32 context)
Definition: ipsec_api.c:371
port_range_t rport
Definition: ipsec.h:210
ip46_address_range_t raddr
Definition: ipsec.h:207
static void send_ipsec_spd_details(ipsec_policy_t *p, vl_api_registration_t *reg, u32 context)
Definition: ipsec_api.c:295
#define ASSERT(truth)
Dump IPsec security association.
Definition: ipsec.api:608
IKEv2: Set IKEv2 responder interface and IP address.
Definition: ipsec.api:305
u32 spi
Definition: ipsec.api:148
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:170
ip4_address_t local_ip
Definition: ipsec.h:162
ipsec_sa_t * sad
Definition: ipsec.h:265
IKEv2: Initiate the delete IKE SA exchange.
Definition: ipsec.api:406
u64 total_data_size
Definition: ipsec.h:144
IKEv2: Set IKEv2 profile authentication method.
Definition: ipsec.api:223
u8 integ_key_len
Definition: ipsec.h:122
Dump ipsec policy database data.
Definition: ipsec.api:470
u8 use_anti_replay
Definition: ipsec.api:161
ipsec_protocol_t protocol
Definition: ipsec.h:115
static void send_ipsec_spds_details(ipsec_spd_t *spd, vl_api_registration_t *reg, u32 context)
Definition: ipsec_api.c:257
static vlib_main_t * vlib_get_main(void)
Definition: global_funcs.h:23
u32 seq
Definition: ipsec.h:137
IPsec policy database response.
Definition: ipsec.api:497
u8 * format_ipsec_integ_alg(u8 *s, va_list *args)
Definition: ipsec_format.c:90
IPsec: Get SPD interfaces.
Definition: ipsec.api:525
u8 crypto_key_len
Definition: ipsec.h:118
counter_t bytes
byte counter
Definition: counter_types.h:29
static void vl_api_ikev2_profile_set_id_t_handler(vl_api_ikev2_profile_set_id_t *mp)
Definition: ipsec_api.c:730
int ipsec_add_del_tunnel_if_internal(vnet_main_t *vnm, ipsec_add_del_tunnel_args_t *args, u32 *sw_if_index)
Definition: ipsec_if.c:271
IKEv2: Set IKEv2 local RSA private key.
Definition: ipsec.api:289
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
vlib_counter_t counter
Definition: ipsec.h:218
u8 is_outbound
Definition: ipsec.h:202
u8 integrity_algorithm
Definition: ipsec.api:156
u8 integrity_key[128]
Definition: ipsec.api:158
u8 is_tunnel_ipv6
Definition: ipsec.api:164
u64 uword
Definition: types.h:112
clib_error_t * ikev2_set_profile_ike_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
Definition: ikev2.c:2845
IKEv2: Set IKEv2 ESP transforms in SA_INIT proposal (RFC 7296)
Definition: ipsec.api:349
u32 id
Definition: ipsec.h:223
static void vl_api_ikev2_profile_add_del_t_handler(vl_api_ikev2_profile_add_del_t *mp)
Definition: ipsec_api.c:684
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:117
static void vl_api_ikev2_initiate_del_ike_sa_t_handler(vl_api_ikev2_initiate_del_ike_sa_t *mp)
Definition: ipsec_api.c:922
static clib_error_t * ipsec_api_hookup(vlib_main_t *vm)
Definition: ipsec_api.c:1004
u8 is_outbound
Definition: ipsec.api:86
u8 is_ipv6
Definition: ipsec.api:89
IPsec security association database response.
Definition: ipsec.api:641
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
Definition: vec.h:486
u8 use_anti_replay
Definition: ipsec.h:126
api_main_t api_main
Definition: api_shared.c:35
Add or delete IPsec tunnel interface.
Definition: ipsec.api:567
#define VALIDATE_SW_IF_INDEX(mp)
u8 protocol
Definition: ipsec.api:150
u8 is_ip_any
Definition: ipsec.api:90
static uword pool_elts(void *v)
Number of active elements in a pool.
Definition: pool.h:128