47 #define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__) 54 #define foreach_vpe_api_msg \ 55 _(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \ 56 _(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ 57 _(IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \ 58 _(IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \ 59 _(IPSEC_SA_DUMP, ipsec_sa_dump) \ 60 _(IPSEC_SPDS_DUMP, ipsec_spds_dump) \ 61 _(IPSEC_SPD_DUMP, ipsec_spd_dump) \ 62 _(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ 63 _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ 64 _(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \ 65 _(IPSEC_SELECT_BACKEND, ipsec_select_backend) \ 66 _(IPSEC_BACKEND_DUMP, ipsec_backend_dump) \ 67 _(IPSEC_TUNNEL_PROTECT_UPDATE, ipsec_tunnel_protect_update) \ 68 _(IPSEC_TUNNEL_PROTECT_DEL, ipsec_tunnel_protect_del) \ 69 _(IPSEC_TUNNEL_PROTECT_DUMP, ipsec_tunnel_protect_dump) 79 vl_api_ipsec_spd_add_del_reply_t *rmp;
92 vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
95 u32 spd_id __attribute__ ((unused));
98 spd_id = ntohl (mp->
spd_id);
105 rv = VNET_API_ERROR_UNIMPLEMENTED;
110 REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
117 vl_api_ipsec_tunnel_protect_update_reply_t *rmp;
122 sw_if_index = ntohl (mp->
tunnel.sw_if_index);
128 for (ii = 0; ii < mp->
tunnel.n_sa_in; ii++)
134 ntohl (mp->
tunnel.sa_out), sa_ins);
136 rv = VNET_API_ERROR_UNIMPLEMENTED;
141 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_UPDATE_REPLY);
148 vl_api_ipsec_tunnel_protect_del_reply_t *rmp;
161 rv = VNET_API_ERROR_UNIMPLEMENTED;
166 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_DEL_REPLY);
188 mp->_vl_msg_id = ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS);
195 mp->
tun.sa_out = htonl (sa->
id);
200 mp->
tun.sa_in[ii++] = htonl (sa->
id);
228 if (~0 == sw_if_index)
246 in = clib_net_to_host_u32 (in);
250 #define _(v,f,s) case IPSEC_API_SPD_ACTION_##f: \ 251 *out = IPSEC_POLICY_ACTION_##f; \ 256 return (VNET_API_ERROR_UNIMPLEMENTED);
275 p.
id = ntohl (mp->
entry.spd_id);
297 if (p.
policy == IPSEC_POLICY_ACTION_RESOLVE)
300 rv = VNET_API_ERROR_UNIMPLEMENTED;
315 rv = VNET_API_ERROR_UNIMPLEMENTED;
333 ip46_address_t tun_src = { }, tun_dst =
346 id = ntohl (mp->
entry.sad_id);
347 spi = ntohl (mp->
entry.spi);
374 crypto_alg, &crypto_key,
375 integ_alg, &integ_key, flags,
376 0, mp->
entry.salt, &tun_src, &tun_dst,
377 &sa_index, htons (mp->
entry.udp_src_port),
378 htons (mp->
entry.udp_dst_port));
383 rv = VNET_API_ERROR_UNIMPLEMENTED;
404 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
408 #define _(s, n) n_policies += vec_len (spd->policies[IPSEC_SPD_POLICY_##s]); 429 send_ipsec_spds_details (spd, reg, mp->context);
437 vl_api_ipsec_spd_action_t
444 #define _(v,f,s) case IPSEC_POLICY_ACTION_##f: \ 445 out = IPSEC_API_SPD_ACTION_##f; \ 450 return (clib_host_to_net_u32 (out));
461 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
464 mp->
entry.spd_id = htonl (p->
id);
466 mp->
entry.is_outbound = ((p->
type == IPSEC_SPD_POLICY_IP6_OUTBOUND) ||
467 (p->
type == IPSEC_SPD_POLICY_IP4_OUTBOUND));
470 &mp->
entry.local_address_start);
472 &mp->
entry.local_address_stop);
474 &mp->
entry.remote_address_start);
476 &mp->
entry.remote_address_stop);
534 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
562 send_ipsec_spd_interface_details(reg, v, k, mp->context);
570 send_ipsec_spd_interface_details(reg, v, k, mp->context);
583 return (0x80000000 | ti);
589 return (0xc0000000 | ti);
606 ipip_transport_t transport;
614 if (local_ip_type != remote_ip_type)
616 rv = VNET_API_ERROR_INVALID_VALUE;
620 flags = IPSEC_SA_FLAG_NONE;
623 flags |= IPSEC_SA_FLAG_UDP_ENCAP;
625 flags |= IPSEC_SA_FLAG_USE_ESN;
627 flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
641 rv = VNET_API_ERROR_NO_SUCH_FIB;
652 &remote_ip, fib_index,
653 TUNNEL_ENCAP_DECAP_FLAG_NONE, IP_DSCP_CS0,
654 TUNNEL_MODE_P2P, &sw_if_index);
666 (flags | IPSEC_SA_FLAG_IS_INBOUND),
668 mp->
salt, &remote_ip, &local_ip, NULL,
683 mp->
salt, &local_ip, &remote_ip, NULL,
708 ipip_tunnel_key_t
key = {
709 .transport = transport,
710 .fib_index = fib_index,
724 rv = VNET_API_ERROR_NO_SUCH_ENTRY;
728 rv = VNET_API_ERROR_UNIMPLEMENTED;
764 ctx->sw_if_index = itp->itp_sw_if_index;
782 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
785 mp->
entry.sad_id = htonl (sa->
id);
788 mp->
entry.tx_table_id =
798 mp->
entry.salt = clib_host_to_net_u32 (sa->
salt);
800 if (ipsec_sa_is_set_IS_PROTECT (sa))
813 if (ipsec_sa_is_set_IS_TUNNEL (sa))
816 &mp->
entry.tunnel_src);
818 &mp->
entry.tunnel_dst);
820 if (ipsec_sa_is_set_UDP_ENCAP (sa))
828 if (ipsec_sa_is_set_USE_ESN (sa))
833 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
868 vl_api_ipsec_tunnel_if_set_sa_reply_t *rmp;
909 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
910 clib_memset (mp, 0, sizeof (*mp));
911 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
912 mp->context = context;
913 snprintf ((char *)mp->name, sizeof (mp->name),
"%.*s", vec_len (ab->name),
915 mp->protocol = ntohl (IPSEC_API_PROTO_AH);
916 mp->index = ab - im->ah_backends;
917 mp->active = mp->index == im->ah_current_backend ? 1 : 0;
918 vl_api_send_msg (rp, (u8 *)mp);
921 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
922 clib_memset (mp, 0, sizeof (*mp));
923 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
924 mp->context = context;
925 snprintf ((char *)mp->name, sizeof (mp->name),
"%.*s", vec_len (eb->name),
927 mp->protocol = ntohl (IPSEC_API_PROTO_ESP);
928 mp->index = eb - im->esp_backends;
929 mp->active = mp->index == im->esp_current_backend ? 1 : 0;
930 vl_api_send_msg (rp, (u8 *)mp);
939 vl_api_ipsec_select_backend_reply_t *rmp;
944 rv = VNET_API_ERROR_INSTANCE_IN_USE;
963 rv = VNET_API_ERROR_INVALID_PROTOCOL;
980 #define vl_msg_name_crc_list 982 #undef vl_msg_name_crc_list 987 #define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id); 988 foreach_vl_msg_name_crc_ipsec;
998 vl_msg_api_set_handlers(VL_API_##N, #n, \ 999 vl_api_##n##_t_handler, \ 1001 vl_api_##n##_t_endian, \ 1002 vl_api_##n##_t_print, \ 1003 sizeof(vl_api_##n##_t), 1); ipip_tunnel_t * ipip_tunnel_db_find(const ipip_tunnel_key_t *key)
IPsec: Add/delete Security Policy Database entry.
vl_api_ipsec_spd_action_t ipsec_spd_action_encode(ipsec_policy_action_t in)
void ipsec_key_decode(const vl_api_key_t *key, ipsec_key_t *out)
ip46_address_t tunnel_src_addr
void ip_address_encode2(const ip_address_t *in, vl_api_address_t *out)
enum ipsec_spd_policy_t_ ipsec_spd_policy_type_t
IPsec: SPD interface response.
A representation of a IPIP tunnel.
VLIB_API_INIT_FUNCTION(ipsec_api_hookup)
ip46_address_range_t laddr
#define REPLY_MACRO2(t, body)
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
#define FOR_EACH_IPSEC_SPD_POLICY_TYPE(_t)
int ipsec_policy_mk_type(bool is_outbound, bool is_ipv6, ipsec_policy_action_t action, ipsec_spd_policy_type_t *type)
static void vl_api_send_msg(vl_api_registration_t *rp, u8 *elem)
vl_api_interface_index_t sw_if_index
ipsec_integ_alg_t integ_alg
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
void ipsec_tun_protect_walk_itf(u32 sw_if_index, ipsec_tun_protect_walk_cb_t fn, void *ctx)
static void setup_message_id_table(api_main_t *am)
int ipsec_integ_algo_decode(vl_api_ipsec_integ_alg_t in, ipsec_integ_alg_t *out)
vl_api_ipsec_spd_action_t policy
static void vl_api_ipsec_sa_dump_t_handler(vl_api_ipsec_sa_dump_t *mp)
int ipsec_select_ah_backend(ipsec_main_t *im, u32 backend_idx)
#define FOR_EACH_IPSEC_PROTECT_INPUT_SA(_itp, _sa, body)
A Secruity Policy Database.
int ipsec_sa_add_and_lock(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 tx_table_id, u32 salt, const ip46_address_t *tun_src, const ip46_address_t *tun_dst, u32 *sa_out_index, u16 src_port, u16 dst_port)
int ipip_add_tunnel(ipip_transport_t transport, u32 instance, ip46_address_t *src, ip46_address_t *dst, u32 fib_index, tunnel_encap_decap_flags_t flags, ip_dscp_t dscp, tunnel_mode_t tmode, u32 *sw_if_indexp)
void * vl_msg_api_alloc(int nbytes)
void ipsec_tun_protect_walk(ipsec_tun_protect_walk_cb_t fn, void *ctx)
void ipsec_mk_key(ipsec_key_t *key, const u8 *data, u8 len)
#define foreach_vpe_api_msg
vl_api_interface_index_t sw_if_index
vl_api_address_t remote_ip
struct ipsec_sa_dump_match_ctx_t_ ipsec_sa_dump_match_ctx_t
uword * spd_index_by_sw_if_index
static void vl_api_ipsec_interface_add_del_spd_t_handler(vl_api_ipsec_interface_add_del_spd_t *mp)
enum walk_rc_t_ walk_rc_t
Walk return code.
vl_api_interface_index_t sw_if_index
vl_api_ip_proto_t protocol
void ipsec_sa_walk(ipsec_sa_walk_cb_t cb, void *ctx)
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
vl_api_interface_index_t sw_if_index
int ipsec_tun_protect_del(u32 sw_if_index, const ip_address_t *nh)
static void vl_api_ipsec_tunnel_if_add_del_t_handler(vl_api_ipsec_tunnel_if_add_del_t *mp)
static void vl_api_ipsec_backend_dump_t_handler(vl_api_ipsec_backend_dump_t *mp)
int ipsec_select_esp_backend(ipsec_main_t *im, u32 backend_idx)
#define hash_foreach(key_var, value_var, h, body)
static void vl_api_ipsec_spd_dump_t_handler(vl_api_ipsec_spd_dump_t *mp)
static void vl_api_ipsec_spd_interface_dump_t_handler(vl_api_ipsec_spd_interface_dump_t *mp)
vl_api_address_t local_ip
int ipsec_sa_unlock_id(u32 id)
Dump all tunnel protections.
vl_api_ipsec_crypto_alg_t ipsec_crypto_algo_encode(ipsec_crypto_alg_t c)
u32 fib_table_find(fib_protocol_t proto, u32 table_id)
Get the index of the FIB for a Table-ID.
IPsec: Reply Add/delete Security Policy Database entry.
ip46_type_t ip_address_decode(const vl_api_address_t *in, ip46_address_t *out)
Decode/Encode for struct/union types.
static void vl_api_ipsec_spd_add_del_t_handler(vl_api_ipsec_spd_add_del_t *mp)
fib_protocol_t fib_proto_from_ip46(ip46_type_t iproto)
Convert from ip46_type to fib_protocol.
IPsec: Add/delete Security Association Database entry.
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
u8 remote_crypto_key[128]
Dump IPsec all SPD IDs response.
Add/delete IPsec tunnel interface response.
IPsec: Add/delete Security Policy Database.
vl_api_ipsec_tunnel_protect_t tun
vl_api_ipsec_proto_t ipsec_proto_encode(ipsec_protocol_t p)
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add, u32 *stat_index)
Add/Delete a SPD.
static int ipsec_spd_action_decode(vl_api_ipsec_spd_action_t in, ipsec_policy_action_t *out)
vl_api_ipsec_tunnel_protect_t tunnel
ipsec_spd_policy_type_t type
vl_api_interface_index_t sw_if_index
static ipsec_sa_t * ipsec_sa_get(u32 sa_index)
uword * spd_index_by_spd_id
static void vl_api_ipsec_tunnel_if_set_sa_t_handler(vl_api_ipsec_tunnel_if_set_sa_t *mp)
API main structure, used by both vpp and binary API clients.
ip46_address_t tunnel_dst_addr
void ip_address_decode2(const vl_api_address_t *in, ip_address_t *out)
An API client registration, only in vpp/vlib.
int ipsec_tun_protect_update_one(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 sa_in)
#define BAD_SW_IF_INDEX_LABEL
IPsec: Add/delete SPD from interface.
static walk_rc_t ipsec_sa_dump_match_sa(index_t itpi, void *arg)
ipsec_ah_backend_t * ah_backends
vl_api_ipsec_sad_flags_t ipsec_sad_flags_encode(const ipsec_sa_t *sa)
vl_api_ipsec_sad_entry_t entry
ipsec_policy_action_t policy
#define clib_warning(format, args...)
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
vl_api_ipsec_proto_t protocol
int ipsec_tun_protect_update_out(u32 sw_if_index, const ip_address_t *nh, u32 sa_out)
#define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body)
static u32 ipsec_tun_mk_input_sa_id(u32 ti)
Set new SA on IPsec interface.
static vl_api_registration_t * vl_api_client_index_to_registration(u32 index)
static void vl_api_ipsec_spds_dump_t_handler(vl_api_ipsec_spds_dump_t *mp)
static void vl_api_ipsec_tunnel_protect_dump_t_handler(vl_api_ipsec_tunnel_protect_dump_t *mp)
static void send_ipsec_spd_interface_details(vl_api_registration_t *reg, u32 spd_index, u32 sw_if_index, u32 context)
vl_api_ipsec_sad_entry_t entry
static void send_ipsec_spd_details(ipsec_policy_t *p, vl_api_registration_t *reg, u32 context)
vl_api_interface_index_t sw_if_index
static void vl_api_ipsec_spd_entry_add_del_t_handler(vl_api_ipsec_spd_entry_add_del_t *mp)
ipsec_policy_t * policies
Dump IPsec security association.
u32 fib_table_get_table_id(u32 fib_index, fib_protocol_t proto)
Get the Table-ID of the FIB from protocol and index.
static ipsec_tun_protect_t * ipsec_tun_protect_get(u32 index)
int ipsec_tun_protect_update_in(u32 sw_if_index, const ip_address_t *nh, u32 sa_in)
vl_api_ipsec_integ_alg_t ipsec_integ_algo_encode(ipsec_integ_alg_t i)
u32 * policies[IPSEC_SPD_POLICY_N_TYPES]
vectors for each of the policy types
ipsec_sa_flags_t ipsec_sa_flags_decode(vl_api_ipsec_sad_flags_t in)
vl_api_interface_index_t sw_if_index
Dump ipsec policy database data.
ipsec_protocol_t protocol
static void vl_api_ipsec_tunnel_protect_update_t_handler(vl_api_ipsec_tunnel_protect_update_t *mp)
static void send_ipsec_spds_details(ipsec_spd_t *spd, vl_api_registration_t *reg, u32 context)
static vlib_main_t * vlib_get_main(void)
IPsec policy database response.
IPsec: Get SPD interfaces.
vl_api_ipsec_spd_entry_t entry
vl_api_ipsec_spd_entry_t entry
struct ipsec_dump_walk_ctx_t_ ipsec_dump_walk_ctx_t
static walk_rc_t send_ipsec_sa_details(ipsec_sa_t *sa, void *arg)
static u32 ipsec_tun_mk_output_sa_id(u32 ti)
ip46_address_range_t raddr
int ipip_del_tunnel(u32 sw_if_index)
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Bind/attach a SPD to an interface.
void ip_address_encode(const ip46_address_t *in, ip46_type_t type, vl_api_address_t *out)
u32 id
the User's ID for this policy
static api_main_t * vlibapi_get_main(void)
vl_api_registration_t * reg
ipsec_crypto_alg_t crypto_alg
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Add/Delete a SPD.
static clib_error_t * ipsec_api_hookup(vlib_main_t *vm)
#define foreach_ipsec_spd_policy_type
static void vl_api_ipsec_tunnel_protect_del_t_handler(vl_api_ipsec_tunnel_protect_del_t *mp)
#define vec_foreach(var, vec)
Vector iterator.
static walk_rc_t send_ipsec_tunnel_protect_details(index_t itpi, void *arg)
static void vl_api_ipsec_select_backend_t_handler(vl_api_ipsec_select_backend_t *mp)
IPsec security association database response.
ipsec_esp_backend_t * esp_backends
int ipsec_crypto_algo_decode(vl_api_ipsec_crypto_alg_t in, ipsec_crypto_alg_t *out)
#define IPSEC_UDP_PORT_NONE
Add or delete IPsec tunnel interface.
#define ip46_address_initializer
int ipsec_proto_decode(vl_api_ipsec_proto_t in, ipsec_protocol_t *out)
Encode/decode function from/to API to internal types.
#define VALIDATE_SW_IF_INDEX(mp)
vl_api_interface_index_t sw_if_index
int ipsec_tun_protect_update(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 *sas_in)
static void vl_api_ipsec_sad_entry_add_del_t_handler(vl_api_ipsec_sad_entry_add_del_t *mp)
void ipsec_key_encode(const ipsec_key_t *in, vl_api_key_t *out)
static uword pool_elts(void *v)
Number of active elements in a pool.