FD.io VPP  v21.06-3-gbb25fbf28
Vector Packet Processing
ipsec_spd.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <vnet/ipsec/ipsec.h>
17 #include <vnet/ipsec/ipsec_io.h>
18 
19 int
20 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
21 {
23  ipsec_spd_t *spd = 0;
24  uword *p;
25  u32 spd_index, k, v;
26 
27  p = hash_get (im->spd_index_by_spd_id, spd_id);
28  if (p && is_add)
29  return VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
30  if (!p && !is_add)
31  return VNET_API_ERROR_NO_SUCH_ENTRY;
32 
33  if (!is_add) /* delete */
34  {
35  spd_index = p[0];
36  spd = pool_elt_at_index (im->spds, spd_index);
37  if (!spd)
38  return VNET_API_ERROR_INVALID_VALUE;
39  /* *INDENT-OFF* */
40  hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
41  if (v == spd_index)
42  ipsec_set_interface_spd(vm, k, spd_id, 0);
43  }));
44  /* *INDENT-ON* */
45  hash_unset (im->spd_index_by_spd_id, spd_id);
46 #define _(s,v) vec_free(spd->policies[IPSEC_SPD_POLICY_##s]);
48 #undef _
49  pool_put (im->spds, spd);
50  }
51  else /* create new SPD */
52  {
53  pool_get (im->spds, spd);
54  clib_memset (spd, 0, sizeof (*spd));
55  spd_index = spd - im->spds;
56  spd->id = spd_id;
57  hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
58  }
59  return 0;
60 }
61 
62 int
64  int is_add)
65 {
67  ip4_ipsec_config_t config;
68 
69  u32 spd_index;
70  uword *p;
71 
72  p = hash_get (im->spd_index_by_spd_id, spd_id);
73  if (!p)
74  return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
75 
76  spd_index = p[0];
77 
78  p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
79  if (p && is_add)
80  return VNET_API_ERROR_SYSCALL_ERROR_2; /* spd already assigned */
81 
82  if (is_add)
83  {
84  hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
85  }
86  else
87  {
88  hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
89  }
90 
91  /* enable IPsec on TX */
92  vnet_feature_enable_disable ("ip4-output", "ipsec4-output-feature",
93  sw_if_index, is_add, 0, 0);
94  vnet_feature_enable_disable ("ip6-output", "ipsec6-output-feature",
95  sw_if_index, is_add, 0, 0);
96 
97  config.spd_index = spd_index;
98 
99  /* enable IPsec on RX */
100  vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input-feature",
101  sw_if_index, is_add, &config, sizeof (config));
102  vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input-feature",
103  sw_if_index, is_add, &config, sizeof (config));
104 
105  return 0;
106 }
107 
108 /*
109  * fd.io coding-style-patch-verification: ON
110  *
111  * Local Variables:
112  * eval: (c-set-style "gnu")
113  * End:
114  */
ipsec.h
im
vnet_interface_main_t * im
Definition: interface_output.c:395
ipsec_add_del_spd
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Add/Delete a SPD.
Definition: ipsec_spd.c:20
ip4_ipsec_config_t::spd_index
u32 spd_index
Definition: ipsec_io.h:44
foreach_ipsec_spd_policy_type
#define foreach_ipsec_spd_policy_type
Definition: ipsec_spd.h:20
pool_elt_at_index
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:553
pool_put
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:305
vm
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
Definition: nat44_ei.c:3047
ipsec_set_interface_spd
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Bind/attach a SPD to an interface.
Definition: ipsec_spd.c:63
ipsec_spd_t::id
u32 id
the User's ID for this policy
Definition: ipsec_spd.h:49
hash_set
#define hash_set(h, key, value)
Definition: hash.h:255
ipsec_main_t
Definition: ipsec.h:108
uword
u64 uword
Definition: types.h:112
hash_get
#define hash_get(h, key)
Definition: hash.h:249
ipsec_main
ipsec_main_t ipsec_main
Definition: ipsec.c:28
hash_foreach
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:441
pool_get
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:255
u32
unsigned int u32
Definition: types.h:88
ipsec_spd_t
A Secruity Policy Database.
Definition: ipsec_spd.h:46
ip4_ipsec_config_t
Definition: ipsec_io.h:42
vnet_feature_enable_disable
int vnet_feature_enable_disable(const char *arc_name, const char *node_name, u32 sw_if_index, int enable_disable, void *feature_config, u32 n_feature_config_bytes)
Definition: pnat_test_stubs.h:50
hash_unset
#define hash_unset(h, key)
Definition: hash.h:261
clib_memset
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
vlib_main_t
Definition: main.h:102
sw_if_index
vl_api_interface_index_t sw_if_index
Definition: wireguard.api:34
ipsec_io.h