71 #define ITP_DBG(_itp, _fmt, _args...) \ 73 vlib_log_debug(ipsec_tun_protect_logger, \ 75 format_ipsec_tun_protect, \ 79 #define ITP_DBG2(_fmt, _args...) \ 81 vlib_log_debug(ipsec_tun_protect_logger, \ 140 if (sa->
crypto_alg == IPSEC_CRYPTO_ALG_NONE &&
224 ipsec4_tunnel_key_t
key = {
226 .spi = clib_host_to_net_u32 (sa->
spi),
233 ipsec6_tunnel_key_t
key = {
235 .spi = clib_host_to_net_u32 (sa->
spi),
249 itp - ipsec_tun_protect_pool);
267 IPSEC_TUN_PROTECT_DEFAULT_DB_ENTRY);
323 ipsec4_tunnel_key_t key = {
324 .remote_ip = itp->itp_crypto.dst.ip4,
325 .spi = clib_host_to_net_u32 (sa->spi),
329 hash_unset (im->tun4_protect_by_key, key.as_u64);
330 ipsec_tun_unregister_nodes(AF_IP4);
335 ipsec6_tunnel_key_t
key = {
337 .spi = clib_host_to_net_u32 (sa->
spi),
403 if (ipsec_sa_is_set_IS_TUNNEL (sa))
407 ipsec_sa_set_IS_PROTECT (sa);
460 ipsec_sa_unset_IS_PROTECT (sa);
493 u32 itpi, *sas_in, sai, *saip;
506 return (VNET_API_ERROR_INVALID_INTERFACE);
523 rv = VNET_API_ERROR_INVALID_VALUE;
554 return (VNET_API_ERROR_INVALID_INTERFACE);
561 rv = VNET_API_ERROR_INVALID_VALUE;
612 rv = VNET_API_ERROR_LIMIT_EXCEEDED;
625 if (~0 == sas_in[ii])
627 rv = VNET_API_ERROR_INVALID_VALUE;
636 rv = VNET_API_ERROR_INVALID_VALUE;
651 if (NULL == dev_class->ip_tun_desc)
653 rv = VNET_API_ERROR_INVALID_SW_IF_INDEX;
669 rv = dev_class->ip_tun_desc (sw_if_index,
750 return (VNET_API_ERROR_NO_SUCH_ENTRY);
756 pool_put (ipsec_tun_protect_pool, itp);
854 const ip46_address_t *peer46;
881 const ip46_address_t *peer46;
927 sizeof (ipsec6_tunnel_key_t),
vlib_log_class_t vlib_log_register_class(char *class, char *subclass)
void adj_nbr_walk_nh(u32 sw_if_index, fib_protocol_t adj_nh_proto, const ip46_address_t *nh, adj_walk_cb_t cb, void *ctx)
Walk adjacencies on a link with a given next-hop.
#define vec_foreach_index(var, v)
Iterate over vector indices.
walk_rc_t(* ipsec_tun_protect_walk_cb_t)(index_t itpi, void *arg)
#define hash_set(h, key, value)
static adj_walk_rc_t ipsec_tun_protect_adj_add(adj_index_t ai, void *arg)
ip46_address_t tunnel_src_addr
uword * tun6_protect_by_key
adj_delegate_adj_deleted_t adv_adj_deleted
void ip6_register_protocol(u32 protocol, u32 node_index)
vnet_main_t * vnet_get_main(void)
static vnet_hw_interface_t * vnet_get_sup_hw_interface(vnet_main_t *vnm, u32 sw_if_index)
void ipsec_unregister_udp_port(u16 port)
#define pool_get_zero(P, E)
Allocate an object E from a pool P and zero it.
void ip6_unregister_protocol(u32 protocol)
static void ipsec_tun_protect_adj_delegate_adj_modified(adj_delegate_t *ad)
static void ipsec_tun_teib_entry_added(const teib_entry_t *ne)
struct ipsec_tun_protect_db_t_ ipsec_tun_protect_db_t
static void ipsec_tun_protect_add_adj(adj_index_t ai, const ipsec_tun_protect_t *itp)
ipsec_integ_alg_t integ_alg
static void ipsec_tun_protect_update_from_teib(ipsec_tun_protect_t *itp, const teib_entry_t *ne)
void ipsec_sa_lock(index_t sai)
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
void ipsec_tun_protect_walk_itf(u32 sw_if_index, ipsec_tun_protect_walk_cb_t fn, void *ctx)
static void ipsec_tun_protect_adj_delegate_adj_created(adj_index_t ai)
#define hash_set_mem(h, key, value)
union ip_adjacency_t_::@137 sub_type
#define FOR_EACH_IPSEC_PROTECT_INPUT_SA(_itp, _sa, body)
struct _vnet_device_class vnet_device_class_t
void ip4_register_protocol(u32 protocol, u32 node_index)
static u8 ip46_address_is_ip4(const ip46_address_t *ip46)
u32 esp6_encrypt_l2_tun_node_index
void ipsec_tun_protect_walk(ipsec_tun_protect_walk_cb_t fn, void *ctx)
const ip46_address_t * teib_entry_get_peer(const teib_entry_t *te)
format_function_t format_vnet_sw_if_index_name
enum fib_protocol_t_ fib_protocol_t
Protocol Type.
static const ipsec_tun_protect_t * ipsec_tun_protect_from_const_base(const adj_delegate_t *ad)
const ip_address_t IP_ADDR_ALL_0
static void ip46_address_reset(ip46_address_t *ip46)
static ip_adjacency_t * adj_get(adj_index_t adj_index)
Get a pointer to an adjacency object from its index.
vl_api_interface_index_t sw_if_index
#define VLIB_INIT_FUNCTION(x)
static vnet_device_class_t * vnet_get_device_class(vnet_main_t *vnm, u32 dev_class_index)
int ipsec_tun_protect_del(u32 sw_if_index, const ip_address_t *nh)
static void ipsec_tun_protect_unconfig(ipsec_main_t *im, ipsec_tun_protect_t *itp)
void ipsec_register_udp_port(u16 port)
teib_entry_added_t nv_added
enum adj_walk_rc_t_ adj_walk_rc_t
return codes from a adjacency walker callback function
#define hash_foreach(key_var, value_var, h, body)
void adj_nbr_midchain_update_next_node(adj_index_t adj_index, u32 next_node)
Update the VLIB node to which packets are sent post processing.
Aggregate type for a prefix.
index_t * ipsec_tun_protect_sa_by_adj_index
Adj index to TX SA mapping.
static void ipsec_tun_protect_rx_db_add(ipsec_main_t *im, const ipsec_tun_protect_t *itp)
struct ip_adjacency_t_::@137::@139 midchain
IP_LOOKUP_NEXT_MIDCHAIN.
u32 esp4_encrypt_l2_tun_node_index
#define hash_create_mem(elts, key_bytes, value_bytes)
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
#define hash_unset_mem(h, key)
int adj_delegate_add(ip_adjacency_t *adj, adj_delegate_type_t adt, index_t adi)
Add a delegate to an adjacency.
static_always_inline void ip46_address_copy(ip46_address_t *dst, const ip46_address_t *src)
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
index_t ipsec_sa_find_and_lock(u32 id)
ipsec_tun_protect_t * ipsec_tun_protect_pool
Pool of tunnel protection objects.
void ip_address_from_46(const ip46_address_t *nh, fib_protocol_t fproto, ip_address_t *ip)
vlib_log_class_t ipsec_tun_protect_logger
The logger.
ip46_address_t fp_addr
The address type is not deriveable from the fp_addr member.
u32 teib_entry_get_sw_if_index(const teib_entry_t *te)
accessors for the opaque struct
static void ipsec_tun_protect_config(ipsec_main_t *im, ipsec_tun_protect_t *itp, u32 sa_out, u32 *sas_in)
int vnet_sw_interface_is_p2p(vnet_main_t *vnm, u32 sw_if_index)
static u8 ip46_address_is_zero(const ip46_address_t *ip46)
enum adj_delegate_type_t_ adj_delegate_type_t
A Delagate is a means to implement the Delagation design pattern; the extension of an object's functi...
u32 esp6_no_crypto_tun_node_index
static u32 ipsec_tun_protect_get_adj_next(const ipsec_tun_protect_t *itp)
adj_index_t ad_adj_index
The ADJ entry object to which the delagate is attached.
#define pool_put(P, E)
Free an object E in pool P.
static void ipsec_tun_teib_entry_deleted(const teib_entry_t *ne)
fib_protocol_t ip_address_to_46(const ip_address_t *addr, ip46_address_t *a)
void ipsec_tun_register_nodes(ip_address_family_t af)
static ipsec_sa_t * ipsec_sa_get(u32 sa_index)
vlib_node_registration_t ipsec6_tun_input_node
(constructor) VLIB_REGISTER_NODE (ipsec6_tun_input_node)
#define IP_ADDRESS_V4_ALL_0S
ip46_address_t tunnel_dst_addr
int ipsec_tun_protect_update_one(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 sa_in)
static adj_delegate_type_t ipsec_tun_adj_delegate_type
Adj delegate registered type.
index_t itp_in_sas[ITP_MAX_N_SA_IN]
index_t ad_index
The index passed by the provider to identify its delegate instance.
static ipsec_tun_protect_db_t itp_db
#define vec_free(V)
Free vector's memory (no header).
clib_error_t * ipsec_tunnel_protect_init(vlib_main_t *vm)
u8 * format_ip_address(u8 *s, va_list *args)
int ipsec_tun_protect_update_out(u32 sw_if_index, const ip_address_t *nh, u32 sa_out)
#define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body)
#define ITP_DBG2(_fmt, _args...)
u32 esp4_encrypt_tun_node_index
u32 adj_index_t
An index for adjacencies.
uword * id_hash
A hash table key'd on IP (4 or 6) address.
u32 esp4_no_crypto_tun_node_index
void adj_nbr_walk(u32 sw_if_index, fib_protocol_t adj_nh_proto, adj_walk_cb_t cb, void *ctx)
Walk all adjacencies on a link for a given next-hop protocol.
void ipsec_sa_unlock(index_t sai)
struct ipsec_tun_protect_itf_db_t_ ipsec_tun_protect_itf_db_t
The DB of all added per-nh tunnel protectiond.
index_t id_itp
If the interface is P2P then there is only one protect object associated with the auto-adj for each N...
#define hash_create(elts, value_bytes)
static uword hash_elts(void *v)
adj_delegate_type_t adj_delegate_register_new_type(const adj_delegate_vft_t *vft)
adj_delegate_register_new_type
static void ipsec_tun_protect_tx_db_remove(ipsec_tun_protect_t *itp)
static ipsec_tun_protect_t * ipsec_tun_protect_get(u32 index)
static void ipsec_tun_protect_adj_delegate_adj_deleted(adj_delegate_t *ad)
static void ipsec_tun_protect_rx_db_remove(ipsec_main_t *im, const ipsec_tun_protect_t *itp)
int ipsec_tun_protect_update_in(u32 sw_if_index, const ip_address_t *nh, u32 sa_in)
static void clib_mem_free(void *p)
static void hash_unset_mem_free(uword **h, const void *key)
static void * clib_mem_alloc(uword size)
vlib_node_registration_t ipsec4_tun_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_tun_input_node)
enum ip_address_family_t_ ip_address_family_t
fib_protocol_t ia_nh_proto
The protocol of the neighbor/peer.
u8 adj_is_midchain(adj_index_t ai)
teib_entry_t * teib_entry_find(u32 sw_if_index, const ip46_address_t *peer)
#define ITP_DBG(_itp, _fmt, _args...)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
#define INDEX_INVALID
Invalid index - used when no index is known blazoned capitals INVALID speak volumes where ~0 does not...
static adj_walk_rc_t ipsec_tun_protect_adj_remove(adj_index_t ai, void *arg)
ipsec_protect_flags_t itp_flags
An ADJ delegate virtual function table.
#define FOR_EACH_FIB_IP_PROTOCOL(_item)
#define hash_get_mem(h, key)
The DB of all added per-nh tunnel protectiond.
void ip_address_copy(ip_address_t *dst, const ip_address_t *src)
ipsec_crypto_alg_t crypto_alg
void adj_nbr_midchain_reset_next_node(adj_index_t adj_index)
Return the adjacency's next node to its default value.
static u8 * ipsec_tun_protect_adj_delegate_format(const adj_delegate_t *aed, u8 *s)
static void ipsec_tun_protect_tx_db_add(ipsec_tun_protect_t *itp)
static void ipsec_tun_protect_set_crypto_addr(ipsec_tun_protect_t *itp)
#define vec_foreach(var, vec)
Vector iterator.
void ipsec_tun_unregister_nodes(ip_address_family_t af)
static void hash_set_mem_alloc(uword **h, const void *key, uword v)
ipsec_tun_protect_itf_db_t * id_itf
Per-interface vector.
#define pool_foreach_index(i, v, body)
Iterate pool by index.
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
static u32 ipsec_tun_node_regs[N_AF]
void teib_register(const teib_vft_t *vft)
static index_t ipsec_tun_protect_find(u32 sw_if_index, const ip_address_t *nh)
void ip4_unregister_protocol(u32 protocolx)
u32 esp6_encrypt_tun_node_index
void adj_delegate_remove(adj_index_t ai, adj_delegate_type_t type)
Remove a delegate from an adjacency.
uword * tun4_protect_by_key
const fib_prefix_t * teib_entry_get_nh(const teib_entry_t *te)
int ipsec_tun_protect_update(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 *sas_in)