FD.io VPP  v18.10-34-gcce845e
Vector Packet Processing
ipsec.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel support
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 #include <vnet/udp/udp.h>
23 
24 #include <vnet/ipsec/ipsec.h>
25 #include <vnet/ipsec/ikev2.h>
26 #include <vnet/ipsec/esp.h>
27 #include <vnet/ipsec/ah.h>
28 
29 
31 
32 u32
34 {
35  ipsec_main_t *im = &ipsec_main;
36  uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
37  if (!p)
38  return ~0;
39 
40  return p[0];
41 }
42 
43 int
45  int is_add)
46 {
47  ipsec_main_t *im = &ipsec_main;
48  ip4_ipsec_config_t config;
49 
50  u32 spd_index;
51  uword *p;
52 
53  p = hash_get (im->spd_index_by_spd_id, spd_id);
54  if (!p)
55  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
56 
57  spd_index = p[0];
58 
59  p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
60  if (p && is_add)
61  return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
62 
63  if (is_add)
64  {
65  hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
66  }
67  else
68  {
69  hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
70  }
71 
72  clib_warning ("sw_if_index %u spd_id %u spd_index %u",
73  sw_if_index, spd_id, spd_index);
74 
75  /* enable IPsec on TX */
76  vnet_feature_enable_disable ("ip4-output", "ipsec-output-ip4", sw_if_index,
77  is_add, 0, 0);
78  vnet_feature_enable_disable ("ip6-output", "ipsec-output-ip6", sw_if_index,
79  is_add, 0, 0);
80 
81  config.spd_index = spd_index;
82 
83  /* enable IPsec on RX */
84  vnet_feature_enable_disable ("ip4-unicast", "ipsec-input-ip4", sw_if_index,
85  is_add, &config, sizeof (config));
86  vnet_feature_enable_disable ("ip6-unicast", "ipsec-input-ip6", sw_if_index,
87  is_add, &config, sizeof (config));
88 
89  return 0;
90 }
91 
92 int
93 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
94 {
95  ipsec_main_t *im = &ipsec_main;
96  ipsec_spd_t *spd = 0;
97  uword *p;
98  u32 spd_index, k, v;
99 
100  p = hash_get (im->spd_index_by_spd_id, spd_id);
101  if (p && is_add)
102  return VNET_API_ERROR_INVALID_VALUE;
103  if (!p && !is_add)
104  return VNET_API_ERROR_INVALID_VALUE;
105 
106  if (!is_add) /* delete */
107  {
108  spd_index = p[0];
109  spd = pool_elt_at_index (im->spds, spd_index);
110  if (!spd)
111  return VNET_API_ERROR_INVALID_VALUE;
112  /* *INDENT-OFF* */
114  if (v == spd_index)
115  ipsec_set_interface_spd(vm, k, spd_id, 0);
116  }));
117  /* *INDENT-ON* */
118  hash_unset (im->spd_index_by_spd_id, spd_id);
119  pool_free (spd->policies);
124  pool_put (im->spds, spd);
125  }
126  else /* create new SPD */
127  {
128  pool_get (im->spds, spd);
129  memset (spd, 0, sizeof (*spd));
130  spd_index = spd - im->spds;
131  spd->id = spd_id;
132  hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
133  }
134  return 0;
135 }
136 
137 static int
138 ipsec_spd_entry_sort (void *a1, void *a2)
139 {
140  u32 *id1 = a1;
141  u32 *id2 = a2;
142  ipsec_spd_t *spd = ipsec_main.spd_to_sort;
143  ipsec_policy_t *p1, *p2;
144 
145  p1 = pool_elt_at_index (spd->policies, *id1);
146  p2 = pool_elt_at_index (spd->policies, *id2);
147  if (p1 && p2)
148  return p2->priority - p1->priority;
149 
150  return 0;
151 }
152 
153 int
155 {
156  ipsec_main_t *im = &ipsec_main;
157  ipsec_spd_t *spd = 0;
158  ipsec_policy_t *vp;
159  uword *p;
160  u32 spd_index;
161 
162  clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
163  policy->priority, policy->is_outbound);
164 
165  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
166  {
167  p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
168  if (!p)
169  return VNET_API_ERROR_SYSCALL_ERROR_1;
170  policy->sa_index = p[0];
171  }
172 
173  p = hash_get (im->spd_index_by_spd_id, policy->id);
174 
175  if (!p)
176  return VNET_API_ERROR_SYSCALL_ERROR_1;
177 
178  spd_index = p[0];
179  spd = pool_elt_at_index (im->spds, spd_index);
180  if (!spd)
181  return VNET_API_ERROR_SYSCALL_ERROR_1;
182 
183  if (is_add)
184  {
185  u32 policy_index;
186 
187  pool_get (spd->policies, vp);
188  clib_memcpy (vp, policy, sizeof (*vp));
189  policy_index = vp - spd->policies;
190 
191  ipsec_main.spd_to_sort = spd;
192 
193  if (policy->is_outbound)
194  {
195  if (policy->is_ipv6)
196  {
197  vec_add1 (spd->ipv6_outbound_policies, policy_index);
198  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
201  }
202  else
203  {
204  vec_add1 (spd->ipv4_outbound_policies, policy_index);
205  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
208  }
209  }
210  else
211  {
212  if (policy->is_ipv6)
213  {
214  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
215  {
217  policy_index);
218  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
222  }
223  else
224  {
225  vec_add1
227  policy_index);
228  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
232  }
233  }
234  else
235  {
236  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
237  {
239  policy_index);
240  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
244  }
245  else
246  {
247  vec_add1
249  policy_index);
250  clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
254  }
255  }
256  }
257 
258  ipsec_main.spd_to_sort = NULL;
259  }
260  else
261  {
262  u32 i, j;
263  /* *INDENT-OFF* */
264  pool_foreach_index(i, spd->policies, ({
265  vp = pool_elt_at_index(spd->policies, i);
266  if (vp->priority != policy->priority)
267  continue;
268  if (vp->is_outbound != policy->is_outbound)
269  continue;
270  if (vp->policy != policy->policy)
271  continue;
272  if (vp->sa_id != policy->sa_id)
273  continue;
274  if (vp->protocol != policy->protocol)
275  continue;
276  if (vp->lport.start != policy->lport.start)
277  continue;
278  if (vp->lport.stop != policy->lport.stop)
279  continue;
280  if (vp->rport.start != policy->rport.start)
281  continue;
282  if (vp->rport.stop != policy->rport.stop)
283  continue;
284  if (vp->is_ipv6 != policy->is_ipv6)
285  continue;
286  if (policy->is_ipv6)
287  {
288  if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
289  continue;
290  if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
291  continue;
292  if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
293  continue;
294  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
295  continue;
296  if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
297  continue;
298  if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
299  continue;
300  if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
301  continue;
302  if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
303  continue;
304  if (policy->is_outbound)
305  {
306  vec_foreach_index(j, spd->ipv6_outbound_policies) {
307  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
308  vec_del1 (spd->ipv6_outbound_policies, j);
309  break;
310  }
311  }
312  }
313  else
314  {
315  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
316  {
317  vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
318  if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
319  vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
320  break;
321  }
322  }
323  }
324  else
325  {
326  vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
327  if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
328  vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
329  break;
330  }
331  }
332  }
333  }
334  }
335  else
336  {
337  if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
338  continue;
339  if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
340  continue;
341  if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
342  continue;
343  if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
344  continue;
345  if (policy->is_outbound)
346  {
347  vec_foreach_index(j, spd->ipv4_outbound_policies) {
348  if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
349  vec_del1 (spd->ipv4_outbound_policies, j);
350  break;
351  }
352  }
353  }
354  else
355  {
356  if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
357  {
358  vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
359  if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
360  vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
361  break;
362  }
363  }
364  }
365  else
366  {
367  vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
368  if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
369  vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
370  break;
371  }
372  }
373  }
374  }
375  }
376  pool_put (spd->policies, vp);
377  break;
378  }));
379  /* *INDENT-ON* */
380  }
381 
382  return 0;
383 }
384 
385 u8
387 {
388  ipsec_main_t *im = &ipsec_main;
389  ipsec_spd_t *spd;
390  ipsec_policy_t *p;
392 
393  /* *INDENT-OFF* */
394  pool_foreach(spd, im->spds, ({
395  pool_foreach(p, spd->policies, ({
396  if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
397  {
398  if (p->sa_index == sa_index)
399  return 1;
400  }
401  }));
402  }));
403 
404  pool_foreach(t, im->tunnel_interfaces, ({
405  if (t->input_sa_index == sa_index)
406  return 1;
407  if (t->output_sa_index == sa_index)
408  return 1;
409  }));
410  /* *INDENT-ON* */
411 
412  return 0;
413 }
414 
415 int
416 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
417 {
418  ipsec_main_t *im = &ipsec_main;
419  ipsec_sa_t *sa = 0;
420  uword *p;
421  u32 sa_index;
422  clib_error_t *err;
423 
424  clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
425 
426  p = hash_get (im->sa_index_by_sa_id, new_sa->id);
427  if (p && is_add)
428  return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
429  if (!p && !is_add)
430  return VNET_API_ERROR_SYSCALL_ERROR_1;
431 
432  if (!is_add) /* delete */
433  {
434  sa_index = p[0];
435  sa = pool_elt_at_index (im->sad, sa_index);
436  if (ipsec_is_sa_used (sa_index))
437  {
438  clib_warning ("sa_id %u used in policy", sa->id);
439  return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
440  }
441  hash_unset (im->sa_index_by_sa_id, sa->id);
442  if (im->cb.add_del_sa_sess_cb)
443  {
444  err = im->cb.add_del_sa_sess_cb (sa_index, 0);
445  if (err)
446  return VNET_API_ERROR_SYSCALL_ERROR_1;
447  }
448  pool_put (im->sad, sa);
449  }
450  else /* create new SA */
451  {
452  pool_get (im->sad, sa);
453  clib_memcpy (sa, new_sa, sizeof (*sa));
454  sa_index = sa - im->sad;
455  hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
456  if (im->cb.add_del_sa_sess_cb)
457  {
458  err = im->cb.add_del_sa_sess_cb (sa_index, 1);
459  if (err)
460  return VNET_API_ERROR_SYSCALL_ERROR_1;
461  }
462  }
463  return 0;
464 }
465 
466 int
468 {
469  ipsec_main_t *im = &ipsec_main;
470  uword *p;
471  u32 sa_index;
472  ipsec_sa_t *sa = 0;
473  clib_error_t *err;
474 
475  p = hash_get (im->sa_index_by_sa_id, sa_update->id);
476  if (!p)
477  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
478 
479  sa_index = p[0];
480  sa = pool_elt_at_index (im->sad, sa_index);
481 
482  /* new crypto key */
483  if (0 < sa_update->crypto_key_len)
484  {
485  clib_memcpy (sa->crypto_key, sa_update->crypto_key,
486  sa_update->crypto_key_len);
487  sa->crypto_key_len = sa_update->crypto_key_len;
488  }
489 
490  /* new integ key */
491  if (0 < sa_update->integ_key_len)
492  {
493  clib_memcpy (sa->integ_key, sa_update->integ_key,
494  sa_update->integ_key_len);
495  sa->integ_key_len = sa_update->integ_key_len;
496  }
497 
498  if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
499  {
500  if (im->cb.add_del_sa_sess_cb)
501  {
502  err = im->cb.add_del_sa_sess_cb (sa_index, 0);
503  if (err)
504  return VNET_API_ERROR_SYSCALL_ERROR_1;
505  }
506  }
507 
508  return 0;
509 }
510 
511 static void
513 {
514  struct
515  {
516  time_t time;
517  pid_t pid;
518  void *p;
519  } seed_data;
520 
521  seed_data.time = time (NULL);
522  seed_data.pid = getpid ();
523  seed_data.p = (void *) &seed_data;
524 
525  RAND_seed ((const void *) &seed_data, sizeof (seed_data));
526 }
527 
528 static clib_error_t *
530 {
531  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
532  return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
533  if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
534  return clib_error_return (0, "unsupported none integ-alg");
535 
536  return 0;
537 }
538 
539 static clib_error_t *
541 {
542  clib_error_t *error;
543  ipsec_main_t *im = &ipsec_main;
545  vlib_node_t *node;
546 
547  ipsec_rand_seed ();
548 
549  memset (im, 0, sizeof (im[0]));
550 
551  im->vnet_main = vnet_get_main ();
552  im->vlib_main = vm;
553 
554  im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
555  im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
556  im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
557 
560 
561  node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
562  ASSERT (node);
563  im->error_drop_node_index = node->index;
564 
565  node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
566  ASSERT (node);
567  im->esp_encrypt_node_index = node->index;
568 
569  node = vlib_get_node_by_name (vm, (u8 *) "esp-decrypt");
570  ASSERT (node);
571  im->esp_decrypt_node_index = node->index;
572 
573  node = vlib_get_node_by_name (vm, (u8 *) "ah-encrypt");
574  ASSERT (node);
575  im->ah_encrypt_node_index = node->index;
576 
577  node = vlib_get_node_by_name (vm, (u8 *) "ah-decrypt");
578  ASSERT (node);
579  im->ah_decrypt_node_index = node->index;
580 
581  im->esp_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP_ENCRYPT;
582  im->esp_decrypt_next_index = IPSEC_INPUT_NEXT_ESP_DECRYPT;
583  im->ah_encrypt_next_index = IPSEC_OUTPUT_NEXT_AH_ENCRYPT;
584  im->ah_decrypt_next_index = IPSEC_INPUT_NEXT_AH_DECRYPT;
585 
587 
588  if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
589  return error;
590 
591  if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
592  return error;
593 
594  ipsec_proto_init ();
595 
596  if ((error = ikev2_init (vm)))
597  return error;
598 
599  return 0;
600 }
601 
603 
604 /*
605  * fd.io coding-style-patch-verification: ON
606  *
607  * Local Variables:
608  * eval: (c-set-style "gnu")
609  * End:
610  */
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:231
ipsec_spd_t * spds
Definition: ipsec.h:264
#define hash_set(h, key, value)
Definition: hash.h:255
u32 ah_decrypt_next_index
Definition: ipsec.h:299
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:229
u32 ah_decrypt_node_index
Definition: ipsec.h:294
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
Definition: ipsec.c:154
#define hash_unset(h, key)
Definition: hash.h:261
u32 id
Definition: ipsec.h:113
vnet_main_t * vnet_get_main(void)
Definition: misc.c:47
i32 priority
Definition: ipsec.h:201
static void ipsec_rand_seed(void)
Definition: ipsec.c:512
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Definition: ipsec.c:44
#define NULL
Definition: clib.h:57
u32 index
Definition: node.h:288
u32 ah_encrypt_node_index
Definition: ipsec.h:293
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:121
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:523
int i
u32 * ipv4_outbound_policies
Definition: ipsec.h:227
u32 ipsec_get_sa_index_by_sa_id(u32 sa_id)
Definition: ipsec.c:33
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
Definition: vec.h:448
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:228
unsigned char u8
Definition: types.h:56
u8 crypto_key[128]
Definition: ipsec.h:119
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Definition: ipsec.c:93
u32 spi
Definition: ipsec.h:114
uword * spd_index_by_sw_if_index
Definition: ipsec.h:284
clib_error_t * ipsec_tunnel_if_init(vlib_main_t *vm)
Definition: ipsec_if.c:615
memset(h->entries, 0, sizeof(h->entries[0])*entries)
u8 integ_key[128]
Definition: ipsec.h:123
u32 esp_encrypt_next_index
Definition: ipsec.h:296
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:443
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:163
ipsec_main_t ipsec_main
Definition: ipsec.c:30
u32 sw_if_index
Definition: vxlan_gbp.api:39
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:442
#define clib_error_return(e, args...)
Definition: error.h:99
ipsec_spd_t * spd_to_sort
Definition: ipsec.h:305
ipsec_main_callbacks_t cb
Definition: ipsec.h:302
u32 ah_encrypt_next_index
Definition: ipsec.h:298
unsigned int u32
Definition: types.h:88
#define vlib_call_init_function(vm, x)
Definition: init.h:260
ipsec_policy_t * policies
Definition: ipsec.h:225
u32 error_drop_node_index
Definition: ipsec.h:290
#define hash_get(h, key)
Definition: hash.h:249
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:464
clib_error_t *(* check_support_cb)(ipsec_sa_t *sa)
Definition: ipsec.h:258
vnet_main_t * vnet_main
Definition: ipsec.h:277
#define v
Definition: acl.c:496
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:274
uword * spd_index_by_spd_id
Definition: ipsec.h:283
#define pool_free(p)
Free a pool.
Definition: pool.h:357
vlib_main_t * vm
Definition: buffer.c:294
u32 esp_encrypt_node_index
Definition: ipsec.h:291
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add)
Definition: ipsec.c:416
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
Definition: ipsec_cli.c:906
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:339
u32 sa_index
Definition: ipsec.h:215
u32 esp_decrypt_next_index
Definition: ipsec.h:297
#define clib_warning(format, args...)
Definition: error.h:59
#define clib_memcpy(a, b, c)
Definition: string.h:75
uword * sa_index_by_sa_id
Definition: ipsec.h:285
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
Definition: ipsec.c:467
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
Definition: node.c:45
vlib_main_t * vlib_main
Definition: ipsec.h:276
static clib_error_t * ipsec_init(vlib_main_t *vm)
Definition: ipsec.c:540
#define hash_create(elts, value_bytes)
Definition: hash.h:696
u8 ipsec_is_sa_used(u32 sa_index)
Definition: ipsec.c:386
#define ASSERT(truth)
ipsec_sa_t * sad
Definition: ipsec.h:265
u8 integ_key_len
Definition: ipsec.h:122
u8 crypto_key_len
Definition: ipsec.h:118
u32 * ipv4_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:230
u8 is_outbound
Definition: ipsec.h:202
u32 * ipv6_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:232
u64 uword
Definition: types.h:112
#define vec_sort_with_function(vec, f)
Sort a vector using the supplied element comparison function.
Definition: vec.h:982
static void ipsec_proto_init()
Definition: esp.h:257
u32 * ipv6_outbound_policies
Definition: ipsec.h:228
static clib_error_t * ipsec_check_support(ipsec_sa_t *sa)
Definition: ipsec.c:529
u32 id
Definition: ipsec.h:223
clib_error_t * ikev2_init(vlib_main_t *vm)
Definition: ikev2.c:3292
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:117
static vlib_thread_main_t * vlib_get_thread_main()
Definition: global_funcs.h:32
clib_error_t *(* add_del_sa_sess_cb)(u32 sa_index, u8 is_add)
Definition: ipsec.h:257
static int ipsec_spd_entry_sort(void *a1, void *a2)
Definition: ipsec.c:138
#define pool_foreach_index(i, v, body)
Iterate pool by index.
Definition: pool.h:488
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
u32 ** empty_buffers
Definition: ipsec.h:271
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
Definition: feature.c:233
u32 esp_decrypt_node_index
Definition: ipsec.h:292