blob: 1a419e5c21aa9961244bfe52e5c6341c267c8131 [file] [log] [blame]
Pavel Kotucek9c7ef032016-12-21 07:46:45 +01001/*
2 *------------------------------------------------------------------
3 * ipsec_api.c - ipsec api
4 *
5 * Copyright (c) 2016 Cisco and/or its affiliates.
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at:
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
17 *------------------------------------------------------------------
18 */
19
20#include <vnet/vnet.h>
21#include <vlibmemory/api.h>
22
23#include <vnet/interface.h>
24#include <vnet/api_errno.h>
25#include <vnet/ip/ip.h>
Neale Ranns17dcec02019-01-09 21:22:20 -080026#include <vnet/ip/ip_types_api.h>
Prashant Maheshwaridbf68c92019-11-14 12:42:59 +053027#include <vnet/ipsec/ipsec_types_api.h>
Neale Rannsdd4ccf22020-06-30 07:47:14 +000028#include <vnet/tunnel/tunnel_types_api.h>
Pierre Pfister4c422f92018-12-10 11:19:08 +010029#include <vnet/fib/fib.h>
Neale Ranns12989b52019-09-26 16:20:19 +000030#include <vnet/ipip/ipip.h>
Neale Ranns041add72020-01-02 04:06:10 +000031#include <vnet/tunnel/tunnel_types_api.h>
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010032
33#include <vnet/vnet_msg_enum.h>
34
Damjan Mariona9a951f2017-01-16 22:06:10 +010035#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010036#include <vnet/ipsec/ipsec.h>
Neale Rannsc87b66c2019-02-07 07:26:12 -080037#include <vnet/ipsec/ipsec_tun.h>
Neale Rannsdd4ccf22020-06-30 07:47:14 +000038#include <vnet/ipsec/ipsec_itf.h>
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010039#endif /* IPSEC */
40
41#define vl_typedefs /* define message structures */
42#include <vnet/vnet_all_api_h.h>
43#undef vl_typedefs
44
45#define vl_endianfun /* define message structures */
46#include <vnet/vnet_all_api_h.h>
47#undef vl_endianfun
48
49/* instantiate all the print functions we know about */
50#define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
51#define vl_printfun
52#include <vnet/vnet_all_api_h.h>
53#undef vl_printfun
54
55#include <vlibapi/api_helper_macros.h>
56
Matthew Smith751bb132021-02-08 22:13:59 +000057#define foreach_vpe_api_msg \
58_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
59_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
60_(IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \
61_(IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \
62_(IPSEC_SAD_ENTRY_ADD_DEL_V2, ipsec_sad_entry_add_del_v2) \
63_(IPSEC_SA_DUMP, ipsec_sa_dump) \
64_(IPSEC_SA_V2_DUMP, ipsec_sa_v2_dump) \
65_(IPSEC_SPDS_DUMP, ipsec_spds_dump) \
66_(IPSEC_SPD_DUMP, ipsec_spd_dump) \
67_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \
68_(IPSEC_ITF_CREATE, ipsec_itf_create) \
69_(IPSEC_ITF_DELETE, ipsec_itf_delete) \
70_(IPSEC_ITF_DUMP, ipsec_itf_dump) \
71_(IPSEC_SELECT_BACKEND, ipsec_select_backend) \
72_(IPSEC_BACKEND_DUMP, ipsec_backend_dump) \
73_(IPSEC_TUNNEL_PROTECT_UPDATE, ipsec_tunnel_protect_update) \
74_(IPSEC_TUNNEL_PROTECT_DEL, ipsec_tunnel_protect_del) \
75_(IPSEC_TUNNEL_PROTECT_DUMP, ipsec_tunnel_protect_dump) \
76_(IPSEC_SET_ASYNC_MODE, ipsec_set_async_mode)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010077
Klement Sekerab4d30532018-11-08 13:00:02 +010078static void
79vl_api_ipsec_spd_add_del_t_handler (vl_api_ipsec_spd_add_del_t * mp)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010080{
Damjan Mariona9a951f2017-01-16 22:06:10 +010081#if WITH_LIBSSL == 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010082 clib_warning ("unimplemented");
83#else
84
85 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
86 vl_api_ipsec_spd_add_del_reply_t *rmp;
87 int rv;
88
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010089 rv = ipsec_add_del_spd (vm, ntohl (mp->spd_id), mp->is_add);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010090
91 REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_REPLY);
92#endif
93}
94
95static void vl_api_ipsec_interface_add_del_spd_t_handler
96 (vl_api_ipsec_interface_add_del_spd_t * mp)
97{
98 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
99 vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
100 int rv;
101 u32 sw_if_index __attribute__ ((unused));
102 u32 spd_id __attribute__ ((unused));
103
104 sw_if_index = ntohl (mp->sw_if_index);
105 spd_id = ntohl (mp->spd_id);
106
107 VALIDATE_SW_IF_INDEX (mp);
108
Damjan Mariona9a951f2017-01-16 22:06:10 +0100109#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100110 rv = ipsec_set_interface_spd (vm, sw_if_index, spd_id, mp->is_add);
111#else
112 rv = VNET_API_ERROR_UNIMPLEMENTED;
113#endif
114
115 BAD_SW_IF_INDEX_LABEL;
116
117 REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
118}
119
Neale Rannsc87b66c2019-02-07 07:26:12 -0800120static void vl_api_ipsec_tunnel_protect_update_t_handler
121 (vl_api_ipsec_tunnel_protect_update_t * mp)
122{
123 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
124 vl_api_ipsec_tunnel_protect_update_reply_t *rmp;
125 u32 sw_if_index, ii, *sa_ins = NULL;
Neale Ranns28287212019-12-16 00:53:11 +0000126 ip_address_t nh;
Neale Rannsc87b66c2019-02-07 07:26:12 -0800127 int rv;
128
129 sw_if_index = ntohl (mp->tunnel.sw_if_index);
130
131 VALIDATE_SW_IF_INDEX (&(mp->tunnel));
132
133#if WITH_LIBSSL > 0
134
135 for (ii = 0; ii < mp->tunnel.n_sa_in; ii++)
136 vec_add1 (sa_ins, ntohl (mp->tunnel.sa_in[ii]));
137
Neale Ranns28287212019-12-16 00:53:11 +0000138 ip_address_decode2 (&mp->tunnel.nh, &nh);
139
140 rv = ipsec_tun_protect_update (sw_if_index, &nh,
Neale Rannsc87b66c2019-02-07 07:26:12 -0800141 ntohl (mp->tunnel.sa_out), sa_ins);
142#else
143 rv = VNET_API_ERROR_UNIMPLEMENTED;
144#endif
145
146 BAD_SW_IF_INDEX_LABEL;
147
148 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_UPDATE_REPLY);
149}
150
151static void vl_api_ipsec_tunnel_protect_del_t_handler
152 (vl_api_ipsec_tunnel_protect_del_t * mp)
153{
154 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
155 vl_api_ipsec_tunnel_protect_del_reply_t *rmp;
Neale Ranns28287212019-12-16 00:53:11 +0000156 ip_address_t nh;
Neale Rannsc87b66c2019-02-07 07:26:12 -0800157 u32 sw_if_index;
Neale Ranns28287212019-12-16 00:53:11 +0000158 int rv;
Neale Rannsc87b66c2019-02-07 07:26:12 -0800159
160 sw_if_index = ntohl (mp->sw_if_index);
161
162 VALIDATE_SW_IF_INDEX (mp);
163
164#if WITH_LIBSSL > 0
Neale Ranns28287212019-12-16 00:53:11 +0000165 ip_address_decode2 (&mp->nh, &nh);
166 rv = ipsec_tun_protect_del (sw_if_index, &nh);
Neale Rannsc87b66c2019-02-07 07:26:12 -0800167#else
168 rv = VNET_API_ERROR_UNIMPLEMENTED;
169#endif
170
171 BAD_SW_IF_INDEX_LABEL;
172
173 REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_DEL_REPLY);
174}
175
Neale Ranns12989b52019-09-26 16:20:19 +0000176typedef struct ipsec_dump_walk_ctx_t_
Neale Rannsc87b66c2019-02-07 07:26:12 -0800177{
178 vl_api_registration_t *reg;
179 u32 context;
Neale Ranns12989b52019-09-26 16:20:19 +0000180} ipsec_dump_walk_ctx_t;
Neale Rannsc87b66c2019-02-07 07:26:12 -0800181
182static walk_rc_t
183send_ipsec_tunnel_protect_details (index_t itpi, void *arg)
184{
Neale Ranns12989b52019-09-26 16:20:19 +0000185 ipsec_dump_walk_ctx_t *ctx = arg;
Neale Rannsc87b66c2019-02-07 07:26:12 -0800186 vl_api_ipsec_tunnel_protect_details_t *mp;
187 ipsec_tun_protect_t *itp;
Matthew Smith5cee0bc2020-03-31 09:52:17 -0500188 u32 ii = 0;
189 ipsec_sa_t *sa;
Neale Rannsc87b66c2019-02-07 07:26:12 -0800190
191 itp = ipsec_tun_protect_get (itpi);
192
Neale Rannsc87b66c2019-02-07 07:26:12 -0800193 mp = vl_msg_api_alloc (sizeof (*mp) + (sizeof (u32) * itp->itp_n_sa_in));
194 clib_memset (mp, 0, sizeof (*mp));
195 mp->_vl_msg_id = ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS);
196 mp->context = ctx->context;
197
198 mp->tun.sw_if_index = htonl (itp->itp_sw_if_index);
Neale Ranns28287212019-12-16 00:53:11 +0000199 ip_address_encode2 (itp->itp_key, &mp->tun.nh);
Neale Rannsc87b66c2019-02-07 07:26:12 -0800200
Matthew Smith5cee0bc2020-03-31 09:52:17 -0500201 sa = ipsec_sa_get (itp->itp_out_sa);
202 mp->tun.sa_out = htonl (sa->id);
Neale Rannsc87b66c2019-02-07 07:26:12 -0800203 mp->tun.n_sa_in = itp->itp_n_sa_in;
204 /* *INDENT-OFF* */
Matthew Smith5cee0bc2020-03-31 09:52:17 -0500205 FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
Neale Rannsc87b66c2019-02-07 07:26:12 -0800206 ({
Matthew Smith5cee0bc2020-03-31 09:52:17 -0500207 mp->tun.sa_in[ii++] = htonl (sa->id);
Neale Rannsc87b66c2019-02-07 07:26:12 -0800208 }));
209 /* *INDENT-ON* */
210
211 vl_api_send_msg (ctx->reg, (u8 *) mp);
212
213 return (WALK_CONTINUE);
214}
215
216static void
217vl_api_ipsec_tunnel_protect_dump_t_handler (vl_api_ipsec_tunnel_protect_dump_t
218 * mp)
219{
220 vl_api_registration_t *reg;
221 u32 sw_if_index;
222
223#if WITH_LIBSSL > 0
224 reg = vl_api_client_index_to_registration (mp->client_index);
225 if (!reg)
226 return;
227
Neale Ranns12989b52019-09-26 16:20:19 +0000228 ipsec_dump_walk_ctx_t ctx = {
Neale Rannsc87b66c2019-02-07 07:26:12 -0800229 .reg = reg,
230 .context = mp->context,
231 };
232
233 sw_if_index = ntohl (mp->sw_if_index);
234
235 if (~0 == sw_if_index)
236 {
237 ipsec_tun_protect_walk (send_ipsec_tunnel_protect_details, &ctx);
238 }
239 else
240 {
Neale Ranns28287212019-12-16 00:53:11 +0000241 ipsec_tun_protect_walk_itf (sw_if_index,
242 send_ipsec_tunnel_protect_details, &ctx);
Neale Rannsc87b66c2019-02-07 07:26:12 -0800243 }
244#else
245 clib_warning ("unimplemented");
246#endif
247}
248
Neale Ranns17dcec02019-01-09 21:22:20 -0800249static int
250ipsec_spd_action_decode (vl_api_ipsec_spd_action_t in,
251 ipsec_policy_action_t * out)
252{
253 in = clib_net_to_host_u32 (in);
254
255 switch (in)
256 {
257#define _(v,f,s) case IPSEC_API_SPD_ACTION_##f: \
258 *out = IPSEC_POLICY_ACTION_##f; \
259 return (0);
260 foreach_ipsec_policy_action
261#undef _
262 }
263 return (VNET_API_ERROR_UNIMPLEMENTED);
264}
265
266static void vl_api_ipsec_spd_entry_add_del_t_handler
267 (vl_api_ipsec_spd_entry_add_del_t * mp)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100268{
269 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
Neale Ranns17dcec02019-01-09 21:22:20 -0800270 vl_api_ipsec_spd_entry_add_del_reply_t *rmp;
271 ip46_type_t itype;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800272 u32 stat_index;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100273 int rv;
274
Neale Ranns8c2dd1b2019-02-19 08:27:34 -0800275 stat_index = ~0;
276
Damjan Mariona9a951f2017-01-16 22:06:10 +0100277#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100278 ipsec_policy_t p;
279
Dave Barachb7b92992018-10-17 10:38:51 -0400280 clib_memset (&p, 0, sizeof (p));
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100281
Neale Ranns17dcec02019-01-09 21:22:20 -0800282 p.id = ntohl (mp->entry.spd_id);
283 p.priority = ntohl (mp->entry.priority);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100284
Neale Ranns17dcec02019-01-09 21:22:20 -0800285 itype = ip_address_decode (&mp->entry.remote_address_start, &p.raddr.start);
286 ip_address_decode (&mp->entry.remote_address_stop, &p.raddr.stop);
287 ip_address_decode (&mp->entry.local_address_start, &p.laddr.start);
288 ip_address_decode (&mp->entry.local_address_stop, &p.laddr.stop);
289
290 p.is_ipv6 = (itype == IP46_TYPE_IP6);
291
292 p.protocol = mp->entry.protocol;
Neale Rannsa4d24312019-07-10 13:46:21 +0000293 p.rport.start = ntohs (mp->entry.remote_port_start);
294 p.rport.stop = ntohs (mp->entry.remote_port_stop);
295 p.lport.start = ntohs (mp->entry.local_port_start);
296 p.lport.stop = ntohs (mp->entry.local_port_stop);
Neale Ranns17dcec02019-01-09 21:22:20 -0800297
298 rv = ipsec_spd_action_decode (mp->entry.policy, &p.policy);
299
300 if (rv)
301 goto out;
302
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100303 /* policy action resolve unsupported */
Neale Ranns17dcec02019-01-09 21:22:20 -0800304 if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100305 {
306 clib_warning ("unsupported action: 'resolve'");
307 rv = VNET_API_ERROR_UNIMPLEMENTED;
308 goto out;
309 }
Neale Ranns17dcec02019-01-09 21:22:20 -0800310 p.sa_id = ntohl (mp->entry.sa_id);
Neale Ranns9f231d42019-03-19 10:06:00 +0000311 rv =
312 ipsec_policy_mk_type (mp->entry.is_outbound, p.is_ipv6, p.policy,
313 &p.type);
314 if (rv)
315 goto out;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100316
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800317 rv = ipsec_add_del_policy (vm, &p, mp->is_add, &stat_index);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100318 if (rv)
319 goto out;
320
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100321#else
322 rv = VNET_API_ERROR_UNIMPLEMENTED;
323 goto out;
324#endif
325
326out:
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800327 /* *INDENT-OFF* */
328 REPLY_MACRO2 (VL_API_IPSEC_SPD_ENTRY_ADD_DEL_REPLY,
329 ({
330 rmp->stat_index = ntohl(stat_index);
331 }));
332 /* *INDENT-ON* */
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100333}
334
Neale Ranns17dcec02019-01-09 21:22:20 -0800335static void vl_api_ipsec_sad_entry_add_del_t_handler
336 (vl_api_ipsec_sad_entry_add_del_t * mp)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100337{
Matthew Smith751bb132021-02-08 22:13:59 +0000338 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
Neale Ranns17dcec02019-01-09 21:22:20 -0800339 vl_api_ipsec_sad_entry_add_del_reply_t *rmp;
Matthew Smith751bb132021-02-08 22:13:59 +0000340 ip46_address_t tun_src = { }, tun_dst =
341 {
342 };
Neale Ranns8d7c5022019-02-06 01:41:05 -0800343 ipsec_key_t crypto_key, integ_key;
344 ipsec_crypto_alg_t crypto_alg;
345 ipsec_integ_alg_t integ_alg;
346 ipsec_protocol_t proto;
347 ipsec_sa_flags_t flags;
Dave Baracha5160d72019-03-13 15:29:15 -0400348 u32 id, spi, sa_index = ~0;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100349 int rv;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800350
Damjan Mariona9a951f2017-01-16 22:06:10 +0100351#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100352
Neale Ranns8d7c5022019-02-06 01:41:05 -0800353 id = ntohl (mp->entry.sad_id);
354 spi = ntohl (mp->entry.spi);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100355
Neale Ranns8d7c5022019-02-06 01:41:05 -0800356 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
Neale Ranns17dcec02019-01-09 21:22:20 -0800357
358 if (rv)
359 goto out;
360
Neale Ranns8d7c5022019-02-06 01:41:05 -0800361 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
Neale Ranns17dcec02019-01-09 21:22:20 -0800362
363 if (rv)
364 goto out;
365
Neale Ranns8d7c5022019-02-06 01:41:05 -0800366 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
Neale Ranns17dcec02019-01-09 21:22:20 -0800367
368 if (rv)
369 goto out;
370
Neale Ranns8d7c5022019-02-06 01:41:05 -0800371 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
372 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
Neale Ranns17dcec02019-01-09 21:22:20 -0800373
Neale Ranns8d7c5022019-02-06 01:41:05 -0800374 flags = ipsec_sa_flags_decode (mp->entry.flags);
Neale Ranns17dcec02019-01-09 21:22:20 -0800375
Matthew Smith751bb132021-02-08 22:13:59 +0000376 ip_address_decode (&mp->entry.tunnel_src, &tun_src);
377 ip_address_decode (&mp->entry.tunnel_dst, &tun_dst);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100378
Neale Ranns8d7c5022019-02-06 01:41:05 -0800379 if (mp->is_add)
Matthew Smith751bb132021-02-08 22:13:59 +0000380 rv = ipsec_sa_add_and_lock (id, spi, proto,
381 crypto_alg, &crypto_key,
382 integ_alg, &integ_key, flags,
383 0, mp->entry.salt, &tun_src, &tun_dst,
384 TUNNEL_ENCAP_DECAP_FLAG_NONE,
385 IP_DSCP_CS0,
386 &sa_index,
387 htons (mp->entry.udp_src_port),
388 htons (mp->entry.udp_dst_port));
Neale Ranns8d7c5022019-02-06 01:41:05 -0800389 else
Neale Ranns495d7ff2019-07-12 09:15:26 +0000390 rv = ipsec_sa_unlock_id (id);
Neale Ranns8d7c5022019-02-06 01:41:05 -0800391
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100392#else
393 rv = VNET_API_ERROR_UNIMPLEMENTED;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100394#endif
395
396out:
Neale Rannseba31ec2019-02-17 18:04:27 +0000397 /* *INDENT-OFF* */
398 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_REPLY,
399 {
400 rmp->stat_index = htonl (sa_index);
401 });
402 /* *INDENT-ON* */
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100403}
404
Neale Ranns041add72020-01-02 04:06:10 +0000405static void vl_api_ipsec_sad_entry_add_del_v2_t_handler
406 (vl_api_ipsec_sad_entry_add_del_v2_t * mp)
407{
408 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
409 vl_api_ipsec_sad_entry_add_del_v2_reply_t *rmp;
Matthew Smith751bb132021-02-08 22:13:59 +0000410 ip46_address_t tun_src = { }, tun_dst =
411 {
412 };
413 tunnel_encap_decap_flags_t tunnel_flags;
Neale Ranns041add72020-01-02 04:06:10 +0000414 ipsec_key_t crypto_key, integ_key;
415 ipsec_crypto_alg_t crypto_alg;
416 ipsec_integ_alg_t integ_alg;
417 ipsec_protocol_t proto;
418 ipsec_sa_flags_t flags;
419 u32 id, spi, sa_index = ~0;
420 int rv;
Neale Rannsc7eaa712021-02-04 11:09:33 +0000421
422#if WITH_LIBSSL > 0
423
424 id = ntohl (mp->entry.sad_id);
425 spi = ntohl (mp->entry.spi);
426
427 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
428
429 if (rv)
430 goto out;
431
432 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
433
434 if (rv)
435 goto out;
436
437 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
438
439 if (rv)
440 goto out;
441
Matthew Smith751bb132021-02-08 22:13:59 +0000442 rv =
443 tunnel_encap_decap_flags_decode (mp->entry.tunnel_flags, &tunnel_flags);
Neale Rannsc7eaa712021-02-04 11:09:33 +0000444
445 if (rv)
446 goto out;
447
448 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
449 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
450
451 flags = ipsec_sa_flags_decode (mp->entry.flags);
Neale Rannsc7eaa712021-02-04 11:09:33 +0000452
Matthew Smith751bb132021-02-08 22:13:59 +0000453 ip_address_decode (&mp->entry.tunnel_src, &tun_src);
454 ip_address_decode (&mp->entry.tunnel_dst, &tun_dst);
Neale Rannsc7eaa712021-02-04 11:09:33 +0000455
456 if (mp->is_add)
457 rv = ipsec_sa_add_and_lock (
458 id, spi, proto, crypto_alg, &crypto_key, integ_alg, &integ_key, flags,
Matthew Smith751bb132021-02-08 22:13:59 +0000459 htonl (mp->entry.tx_table_id), mp->entry.salt, &tun_src, &tun_dst,
460 tunnel_flags, ip_dscp_decode (mp->entry.dscp), &sa_index,
461 htons (mp->entry.udp_src_port), htons (mp->entry.udp_dst_port));
Neale Rannsc7eaa712021-02-04 11:09:33 +0000462 else
463 rv = ipsec_sa_unlock_id (id);
464
465#else
466 rv = VNET_API_ERROR_UNIMPLEMENTED;
467#endif
468
469out:
470 /* *INDENT-OFF* */
471 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_V2_REPLY,
472 {
473 rmp->stat_index = htonl (sa_index);
474 });
475 /* *INDENT-ON* */
476}
477
478static void
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700479send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg,
480 u32 context)
481{
482 vl_api_ipsec_spds_details_t *mp;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800483 u32 n_policies = 0;
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700484
485 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400486 clib_memset (mp, 0, sizeof (*mp));
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700487 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
488 mp->context = context;
489
490 mp->spd_id = htonl (spd->id);
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800491#define _(s, n) n_policies += vec_len (spd->policies[IPSEC_SPD_POLICY_##s]);
492 foreach_ipsec_spd_policy_type
493#undef _
494 mp->npolicies = htonl (n_policies);
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700495
496 vl_api_send_msg (reg, (u8 *) mp);
497}
498
499static void
500vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp)
501{
502 vl_api_registration_t *reg;
503 ipsec_main_t *im = &ipsec_main;
504 ipsec_spd_t *spd;
505#if WITH_LIBSSL > 0
506 reg = vl_api_client_index_to_registration (mp->client_index);
507 if (!reg)
508 return;
509
510 /* *INDENT-OFF* */
Damjan Marionb2c31b62020-12-13 21:47:40 +0100511 pool_foreach (spd, im->spds) {
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700512 send_ipsec_spds_details (spd, reg, mp->context);
Damjan Marionb2c31b62020-12-13 21:47:40 +0100513 }
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700514 /* *INDENT-ON* */
515#else
516 clib_warning ("unimplemented");
517#endif
518}
519
Neale Ranns17dcec02019-01-09 21:22:20 -0800520vl_api_ipsec_spd_action_t
521ipsec_spd_action_encode (ipsec_policy_action_t in)
522{
523 vl_api_ipsec_spd_action_t out = IPSEC_API_SPD_ACTION_BYPASS;
524
525 switch (in)
526 {
527#define _(v,f,s) case IPSEC_POLICY_ACTION_##f: \
528 out = IPSEC_API_SPD_ACTION_##f; \
529 break;
530 foreach_ipsec_policy_action
531#undef _
532 }
533 return (clib_host_to_net_u32 (out));
534}
535
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700536static void
Florin Coras6c4dae22018-01-09 06:39:23 -0800537send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
538 u32 context)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100539{
540 vl_api_ipsec_spd_details_t *mp;
541
542 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400543 clib_memset (mp, 0, sizeof (*mp));
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100544 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
545 mp->context = context;
546
Neale Ranns17dcec02019-01-09 21:22:20 -0800547 mp->entry.spd_id = htonl (p->id);
548 mp->entry.priority = htonl (p->priority);
Neale Ranns9f231d42019-03-19 10:06:00 +0000549 mp->entry.is_outbound = ((p->type == IPSEC_SPD_POLICY_IP6_OUTBOUND) ||
550 (p->type == IPSEC_SPD_POLICY_IP4_OUTBOUND));
Neale Ranns17dcec02019-01-09 21:22:20 -0800551
552 ip_address_encode (&p->laddr.start, IP46_TYPE_ANY,
553 &mp->entry.local_address_start);
554 ip_address_encode (&p->laddr.stop, IP46_TYPE_ANY,
555 &mp->entry.local_address_stop);
556 ip_address_encode (&p->raddr.start, IP46_TYPE_ANY,
557 &mp->entry.remote_address_start);
558 ip_address_encode (&p->raddr.stop, IP46_TYPE_ANY,
559 &mp->entry.remote_address_stop);
Neale Rannsa4d24312019-07-10 13:46:21 +0000560 mp->entry.local_port_start = htons (p->lport.start);
561 mp->entry.local_port_stop = htons (p->lport.stop);
562 mp->entry.remote_port_start = htons (p->rport.start);
563 mp->entry.remote_port_stop = htons (p->rport.stop);
Neale Ranns17dcec02019-01-09 21:22:20 -0800564 mp->entry.protocol = p->protocol;
565 mp->entry.policy = ipsec_spd_action_encode (p->policy);
566 mp->entry.sa_id = htonl (p->sa_id);
567
Florin Coras6c4dae22018-01-09 06:39:23 -0800568 vl_api_send_msg (reg, (u8 *) mp);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100569}
570
571static void
572vl_api_ipsec_spd_dump_t_handler (vl_api_ipsec_spd_dump_t * mp)
573{
Florin Coras6c4dae22018-01-09 06:39:23 -0800574 vl_api_registration_t *reg;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100575 ipsec_main_t *im = &ipsec_main;
Neale Ranns9f231d42019-03-19 10:06:00 +0000576 ipsec_spd_policy_type_t ptype;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100577 ipsec_policy_t *policy;
578 ipsec_spd_t *spd;
579 uword *p;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800580 u32 spd_index, *ii;
Damjan Mariona9a951f2017-01-16 22:06:10 +0100581#if WITH_LIBSSL > 0
Florin Coras6c4dae22018-01-09 06:39:23 -0800582 reg = vl_api_client_index_to_registration (mp->client_index);
583 if (!reg)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100584 return;
585
586 p = hash_get (im->spd_index_by_spd_id, ntohl (mp->spd_id));
587 if (!p)
588 return;
589
590 spd_index = p[0];
591 spd = pool_elt_at_index (im->spds, spd_index);
592
593 /* *INDENT-OFF* */
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800594 FOR_EACH_IPSEC_SPD_POLICY_TYPE(ptype) {
595 vec_foreach(ii, spd->policies[ptype])
596 {
597 policy = pool_elt_at_index(im->policies, *ii);
598
599 if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == policy->sa_id)
600 send_ipsec_spd_details (policy, reg, mp->context);
601 }
602 }
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100603 /* *INDENT-ON* */
604#else
605 clib_warning ("unimplemented");
606#endif
607}
608
609static void
Filip Varga871bca92018-11-02 13:51:44 +0100610send_ipsec_spd_interface_details (vl_api_registration_t * reg, u32 spd_index,
611 u32 sw_if_index, u32 context)
612{
613 vl_api_ipsec_spd_interface_details_t *mp;
614
615 mp = vl_msg_api_alloc (sizeof (*mp));
616 clib_memset (mp, 0, sizeof (*mp));
617 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
618 mp->context = context;
619
620 mp->spd_index = htonl (spd_index);
621 mp->sw_if_index = htonl (sw_if_index);
622
623 vl_api_send_msg (reg, (u8 *) mp);
624}
625
626static void
627vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t *
628 mp)
629{
630 ipsec_main_t *im = &ipsec_main;
631 vl_api_registration_t *reg;
632 u32 k, v, spd_index;
633
634#if WITH_LIBSSL > 0
635 reg = vl_api_client_index_to_registration (mp->client_index);
636 if (!reg)
637 return;
638
639 if (mp->spd_index_valid)
640 {
641 spd_index = ntohl (mp->spd_index);
642 /* *INDENT-OFF* */
643 hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
644 if (v == spd_index)
645 send_ipsec_spd_interface_details(reg, v, k, mp->context);
646 }));
647 /* *INDENT-ON* */
648 }
649 else
650 {
651 /* *INDENT-OFF* */
652 hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
653 send_ipsec_spd_interface_details(reg, v, k, mp->context);
654 }));
655 /* *INDENT-ON* */
656 }
657
658#else
659 clib_warning ("unimplemented");
660#endif
661}
662
Neale Rannsdd4ccf22020-06-30 07:47:14 +0000663static void
664vl_api_ipsec_itf_create_t_handler (vl_api_ipsec_itf_create_t * mp)
665{
666 vl_api_ipsec_itf_create_reply_t *rmp;
667 tunnel_mode_t mode;
668 u32 sw_if_index = ~0;
669 int rv;
670
671 rv = tunnel_mode_decode (mp->itf.mode, &mode);
672
673 if (!rv)
674 rv = ipsec_itf_create (ntohl (mp->itf.user_instance), mode, &sw_if_index);
675
676 /* *INDENT-OFF* */
677 REPLY_MACRO2 (VL_API_IPSEC_ITF_CREATE_REPLY,
678 ({
679 rmp->sw_if_index = htonl (sw_if_index);
680 }));
681 /* *INDENT-ON* */
682}
683
684static void
685vl_api_ipsec_itf_delete_t_handler (vl_api_ipsec_itf_delete_t * mp)
686{
687 vl_api_ipsec_itf_delete_reply_t *rmp;
688 int rv;
689
690 rv = ipsec_itf_delete (ntohl (mp->sw_if_index));
691
692 REPLY_MACRO (VL_API_IPSEC_ITF_DELETE_REPLY);
693}
694
695static void
696vl_api_ipsec_itf_dump_t_handler (vl_api_ipsec_itf_dump_t * mp)
697{
698}
699
Neale Ranns12989b52019-09-26 16:20:19 +0000700typedef struct ipsec_sa_dump_match_ctx_t_
Matthew Smith28029532017-09-26 13:33:44 -0500701{
Neale Ranns12989b52019-09-26 16:20:19 +0000702 index_t sai;
703 u32 sw_if_index;
704} ipsec_sa_dump_match_ctx_t;
705
706static walk_rc_t
707ipsec_sa_dump_match_sa (index_t itpi, void *arg)
708{
709 ipsec_sa_dump_match_ctx_t *ctx = arg;
710 ipsec_tun_protect_t *itp;
711 index_t sai;
712
713 itp = ipsec_tun_protect_get (itpi);
714
715 if (itp->itp_out_sa == ctx->sai)
716 {
717 ctx->sw_if_index = itp->itp_sw_if_index;
718 return (WALK_STOP);
719 }
720 /* *INDENT-OFF* */
721 FOR_EACH_IPSEC_PROTECT_INPUT_SAI (itp, sai,
722 ({
723 if (sai == ctx->sai)
724 {
725 ctx->sw_if_index = itp->itp_sw_if_index;
726 return (WALK_STOP);
727 }
728 }));
729 /* *INDENT-OFF* */
730
731 return (WALK_CONTINUE);
732}
733
734static walk_rc_t
735send_ipsec_sa_details (ipsec_sa_t * sa, void *arg)
736{
737 ipsec_dump_walk_ctx_t *ctx = arg;
Matthew Smith28029532017-09-26 13:33:44 -0500738 vl_api_ipsec_sa_details_t *mp;
Neale Ranns12989b52019-09-26 16:20:19 +0000739 ipsec_main_t *im = &ipsec_main;
Matthew Smith28029532017-09-26 13:33:44 -0500740
741 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400742 clib_memset (mp, 0, sizeof (*mp));
Matthew Smith28029532017-09-26 13:33:44 -0500743 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
Neale Ranns12989b52019-09-26 16:20:19 +0000744 mp->context = ctx->context;
Matthew Smith28029532017-09-26 13:33:44 -0500745
Neale Ranns8d7c5022019-02-06 01:41:05 -0800746 mp->entry.sad_id = htonl (sa->id);
747 mp->entry.spi = htonl (sa->spi);
748 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
Matthew Smith751bb132021-02-08 22:13:59 +0000749 mp->entry.tx_table_id =
750 htonl (fib_table_get_table_id (sa->tx_fib_index, FIB_PROTOCOL_IP4));
Matthew Smith28029532017-09-26 13:33:44 -0500751
Neale Ranns8d7c5022019-02-06 01:41:05 -0800752 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
753 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
Matthew Smith28029532017-09-26 13:33:44 -0500754
Neale Ranns8d7c5022019-02-06 01:41:05 -0800755 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
756 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
Matthew Smith28029532017-09-26 13:33:44 -0500757
Neale Ranns8d7c5022019-02-06 01:41:05 -0800758 mp->entry.flags = ipsec_sad_flags_encode (sa);
Neale Ranns12989b52019-09-26 16:20:19 +0000759 mp->entry.salt = clib_host_to_net_u32 (sa->salt);
760
761 if (ipsec_sa_is_set_IS_PROTECT (sa))
762 {
763 ipsec_sa_dump_match_ctx_t ctx = {
764 .sai = sa - im->sad,
765 .sw_if_index = ~0,
766 };
767 ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
768
769 mp->sw_if_index = htonl (ctx.sw_if_index);
770 }
771 else
772 mp->sw_if_index = ~0;
Matthew Smith28029532017-09-26 13:33:44 -0500773
Damjan Mariond709cbc2019-03-26 13:16:42 +0100774 if (ipsec_sa_is_set_IS_TUNNEL (sa))
Matthew Smith28029532017-09-26 13:33:44 -0500775 {
Matthew Smith751bb132021-02-08 22:13:59 +0000776 ip_address_encode (&sa->tunnel_src_addr, IP46_TYPE_ANY,
777 &mp->entry.tunnel_src);
778 ip_address_encode (&sa->tunnel_dst_addr, IP46_TYPE_ANY,
779 &mp->entry.tunnel_dst);
Matthew Smith28029532017-09-26 13:33:44 -0500780 }
Neale Rannsabc56602020-04-01 09:45:23 +0000781 if (ipsec_sa_is_set_UDP_ENCAP (sa))
782 {
783 mp->entry.udp_src_port = sa->udp_hdr.src_port;
784 mp->entry.udp_dst_port = sa->udp_hdr.dst_port;
785 }
Matthew Smith28029532017-09-26 13:33:44 -0500786
Matthew Smith28029532017-09-26 13:33:44 -0500787 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
788 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
Damjan Marion1e3aa5e2019-03-28 10:58:59 +0100789 if (ipsec_sa_is_set_USE_ESN (sa))
Matthew Smith28029532017-09-26 13:33:44 -0500790 {
791 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
792 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
793 }
Damjan Mariond709cbc2019-03-26 13:16:42 +0100794 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
Matthew Smith28029532017-09-26 13:33:44 -0500795 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
Pierre Pfister4c422f92018-12-10 11:19:08 +0100796
Matthew Smith48d32b42020-04-02 07:45:49 -0500797 mp->stat_index = clib_host_to_net_u32 (sa->stat_index);
798
Neale Ranns12989b52019-09-26 16:20:19 +0000799 vl_api_send_msg (ctx->reg, (u8 *) mp);
Matthew Smith28029532017-09-26 13:33:44 -0500800
Neale Ranns12989b52019-09-26 16:20:19 +0000801 return (WALK_CONTINUE);
802}
Matthew Smith28029532017-09-26 13:33:44 -0500803
804static void
805vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp)
806{
Florin Coras6c4dae22018-01-09 06:39:23 -0800807 vl_api_registration_t *reg;
Matthew Smith28029532017-09-26 13:33:44 -0500808
809#if WITH_LIBSSL > 0
Florin Coras6c4dae22018-01-09 06:39:23 -0800810 reg = vl_api_client_index_to_registration (mp->client_index);
Neale Ranns12989b52019-09-26 16:20:19 +0000811 if (!reg)
Matthew Smith28029532017-09-26 13:33:44 -0500812 return;
813
Neale Ranns12989b52019-09-26 16:20:19 +0000814 ipsec_dump_walk_ctx_t ctx = {
815 .reg = reg,
816 .context = mp->context,
817 };
Matthew Smith28029532017-09-26 13:33:44 -0500818
Neale Ranns12989b52019-09-26 16:20:19 +0000819 ipsec_sa_walk (send_ipsec_sa_details, &ctx);
Matthew Smith28029532017-09-26 13:33:44 -0500820
Matthew Smith28029532017-09-26 13:33:44 -0500821#else
822 clib_warning ("unimplemented");
823#endif
824}
825
Neale Ranns041add72020-01-02 04:06:10 +0000826static walk_rc_t
827send_ipsec_sa_v2_details (ipsec_sa_t * sa, void *arg)
828{
829 ipsec_dump_walk_ctx_t *ctx = arg;
830 vl_api_ipsec_sa_v2_details_t *mp;
831 ipsec_main_t *im = &ipsec_main;
832
833 mp = vl_msg_api_alloc (sizeof (*mp));
834 clib_memset (mp, 0, sizeof (*mp));
835 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_V2_DETAILS);
836 mp->context = ctx->context;
837
838 mp->entry.sad_id = htonl (sa->id);
839 mp->entry.spi = htonl (sa->spi);
840 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
Matthew Smith751bb132021-02-08 22:13:59 +0000841 mp->entry.tx_table_id =
842 htonl (fib_table_get_table_id (sa->tx_fib_index, FIB_PROTOCOL_IP4));
Neale Ranns041add72020-01-02 04:06:10 +0000843
844 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
845 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
846
847 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
848 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
849
850 mp->entry.flags = ipsec_sad_flags_encode (sa);
851 mp->entry.salt = clib_host_to_net_u32 (sa->salt);
852
853 if (ipsec_sa_is_set_IS_PROTECT (sa))
854 {
855 ipsec_sa_dump_match_ctx_t ctx = {
856 .sai = sa - im->sad,
857 .sw_if_index = ~0,
858 };
859 ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx);
860
861 mp->sw_if_index = htonl (ctx.sw_if_index);
862 }
863 else
864 mp->sw_if_index = ~0;
865
866 if (ipsec_sa_is_set_IS_TUNNEL (sa))
867 {
Matthew Smith751bb132021-02-08 22:13:59 +0000868 ip_address_encode (&sa->tunnel_src_addr, IP46_TYPE_ANY,
869 &mp->entry.tunnel_src);
870 ip_address_encode (&sa->tunnel_dst_addr, IP46_TYPE_ANY,
871 &mp->entry.tunnel_dst);
Neale Ranns041add72020-01-02 04:06:10 +0000872 }
873 if (ipsec_sa_is_set_UDP_ENCAP (sa))
874 {
875 mp->entry.udp_src_port = sa->udp_hdr.src_port;
876 mp->entry.udp_dst_port = sa->udp_hdr.dst_port;
877 }
878
Matthew Smith751bb132021-02-08 22:13:59 +0000879 mp->entry.tunnel_flags = tunnel_encap_decap_flags_encode (sa->tunnel_flags);
880 mp->entry.dscp = ip_dscp_encode (sa->dscp);
Neale Ranns041add72020-01-02 04:06:10 +0000881
882 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
883 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
884 if (ipsec_sa_is_set_USE_ESN (sa))
885 {
886 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
887 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
888 }
889 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
890 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
891
892 mp->stat_index = clib_host_to_net_u32 (sa->stat_index);
893
894 vl_api_send_msg (ctx->reg, (u8 *) mp);
895
896 return (WALK_CONTINUE);
897}
898
899static void
Matthew Smith751bb132021-02-08 22:13:59 +0000900vl_api_ipsec_sa_v2_dump_t_handler (vl_api_ipsec_sa_dump_t * mp)
Neale Ranns041add72020-01-02 04:06:10 +0000901{
902 vl_api_registration_t *reg;
903
904#if WITH_LIBSSL > 0
905 reg = vl_api_client_index_to_registration (mp->client_index);
906 if (!reg)
907 return;
908
909 ipsec_dump_walk_ctx_t ctx = {
910 .reg = reg,
911 .context = mp->context,
912 };
913
914 ipsec_sa_walk (send_ipsec_sa_v2_details, &ctx);
915
916#else
917 clib_warning ("unimplemented");
918#endif
919}
920
Matthew Smith75d85602017-10-05 19:03:05 -0500921static void
Klement Sekerab4d30532018-11-08 13:00:02 +0100922vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp)
923{
924 vl_api_registration_t *rp;
925 ipsec_main_t *im = &ipsec_main;
926 u32 context = mp->context;
927
928 rp = vl_api_client_index_to_registration (mp->client_index);
929
930 if (rp == 0)
931 {
932 clib_warning ("Client %d AWOL", mp->client_index);
933 return;
934 }
935
936 ipsec_ah_backend_t *ab;
937 ipsec_esp_backend_t *eb;
938 /* *INDENT-OFF* */
Damjan Marionb2c31b62020-12-13 21:47:40 +0100939 pool_foreach (ab, im->ah_backends) {
Klement Sekerab4d30532018-11-08 13:00:02 +0100940 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
941 clib_memset (mp, 0, sizeof (*mp));
942 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
943 mp->context = context;
944 snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (ab->name),
945 ab->name);
Neale Ranns17dcec02019-01-09 21:22:20 -0800946 mp->protocol = ntohl (IPSEC_API_PROTO_AH);
Klement Sekerab4d30532018-11-08 13:00:02 +0100947 mp->index = ab - im->ah_backends;
948 mp->active = mp->index == im->ah_current_backend ? 1 : 0;
949 vl_api_send_msg (rp, (u8 *)mp);
Damjan Marionb2c31b62020-12-13 21:47:40 +0100950 }
951 pool_foreach (eb, im->esp_backends) {
Klement Sekerab4d30532018-11-08 13:00:02 +0100952 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
953 clib_memset (mp, 0, sizeof (*mp));
954 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
955 mp->context = context;
956 snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (eb->name),
957 eb->name);
Neale Ranns17dcec02019-01-09 21:22:20 -0800958 mp->protocol = ntohl (IPSEC_API_PROTO_ESP);
Klement Sekerab4d30532018-11-08 13:00:02 +0100959 mp->index = eb - im->esp_backends;
960 mp->active = mp->index == im->esp_current_backend ? 1 : 0;
961 vl_api_send_msg (rp, (u8 *)mp);
Damjan Marionb2c31b62020-12-13 21:47:40 +0100962 }
Klement Sekerab4d30532018-11-08 13:00:02 +0100963 /* *INDENT-ON* */
964}
965
966static void
967vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp)
968{
969 ipsec_main_t *im = &ipsec_main;
970 vl_api_ipsec_select_backend_reply_t *rmp;
Neale Ranns17dcec02019-01-09 21:22:20 -0800971 ipsec_protocol_t protocol;
Klement Sekerab4d30532018-11-08 13:00:02 +0100972 int rv = 0;
973 if (pool_elts (im->sad) > 0)
974 {
975 rv = VNET_API_ERROR_INSTANCE_IN_USE;
976 goto done;
977 }
Neale Ranns17dcec02019-01-09 21:22:20 -0800978
979 rv = ipsec_proto_decode (mp->protocol, &protocol);
980
981 if (rv)
982 goto done;
983
Klement Sekerab4d30532018-11-08 13:00:02 +0100984#if WITH_LIBSSL > 0
Neale Ranns17dcec02019-01-09 21:22:20 -0800985 switch (protocol)
Klement Sekerab4d30532018-11-08 13:00:02 +0100986 {
987 case IPSEC_PROTOCOL_ESP:
Neale Rannse8915fc2019-04-23 20:57:55 -0400988 rv = ipsec_select_esp_backend (im, mp->index);
Klement Sekerab4d30532018-11-08 13:00:02 +0100989 break;
990 case IPSEC_PROTOCOL_AH:
Neale Rannse8915fc2019-04-23 20:57:55 -0400991 rv = ipsec_select_ah_backend (im, mp->index);
Klement Sekerab4d30532018-11-08 13:00:02 +0100992 break;
993 default:
Neale Rannse8915fc2019-04-23 20:57:55 -0400994 rv = VNET_API_ERROR_INVALID_PROTOCOL;
Klement Sekerab4d30532018-11-08 13:00:02 +0100995 break;
996 }
997#else
998 clib_warning ("unimplemented"); /* FIXME */
999#endif
1000done:
1001 REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY);
1002}
1003
Yulong Pei2e84d662020-08-14 18:21:08 +08001004static void
1005vl_api_ipsec_set_async_mode_t_handler (vl_api_ipsec_set_async_mode_t * mp)
1006{
1007 vl_api_ipsec_set_async_mode_reply_t *rmp;
1008 int rv = 0;
1009
1010 vnet_crypto_request_async_mode (mp->async_enable);
1011 ipsec_set_async_mode (mp->async_enable);
1012
1013 REPLY_MACRO (VL_API_IPSEC_SET_ASYNC_MODE_REPLY);
1014}
1015
Neale Ranns7c44d782019-02-25 10:28:29 +00001016/*
1017 * ipsec_api_hookup
1018 * Add vpe's API message handlers to the table.
1019 * vlib has already mapped shared memory and
1020 * added the client registration handlers.
1021 * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
1022 */
1023#define vl_msg_name_crc_list
1024#include <vnet/vnet_all_api_h.h>
1025#undef vl_msg_name_crc_list
1026
1027static void
1028setup_message_id_table (api_main_t * am)
1029{
1030#define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id);
1031 foreach_vl_msg_name_crc_ipsec;
1032#undef _
1033}
1034
Pavel Kotucek9c7ef032016-12-21 07:46:45 +01001035static clib_error_t *
1036ipsec_api_hookup (vlib_main_t * vm)
1037{
Dave Barach39d69112019-11-27 11:42:13 -05001038 api_main_t *am = vlibapi_get_main ();
Pavel Kotucek9c7ef032016-12-21 07:46:45 +01001039
1040#define _(N,n) \
1041 vl_msg_api_set_handlers(VL_API_##N, #n, \
1042 vl_api_##n##_t_handler, \
1043 vl_noop_handler, \
1044 vl_api_##n##_t_endian, \
1045 vl_api_##n##_t_print, \
1046 sizeof(vl_api_##n##_t), 1);
1047 foreach_vpe_api_msg;
1048#undef _
1049
1050 /*
Pavel Kotucek9c7ef032016-12-21 07:46:45 +01001051 * Set up the (msg_name, crc, message-id) table
1052 */
1053 setup_message_id_table (am);
1054
1055 return 0;
1056}
1057
1058VLIB_API_INIT_FUNCTION (ipsec_api_hookup);
1059
1060/*
1061 * fd.io coding-style-patch-verification: ON
1062 *
1063 * Local Variables:
1064 * eval: (c-set-style "gnu")
1065 * End:
1066 */