blob: 4a15beb66313b0b5b68358b192b6e8ca83ade6e7 [file] [log] [blame]
Pavel Kotucek9c7ef032016-12-21 07:46:45 +01001/*
2 *------------------------------------------------------------------
3 * ipsec_api.c - ipsec api
4 *
5 * Copyright (c) 2016 Cisco and/or its affiliates.
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at:
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
17 *------------------------------------------------------------------
18 */
19
20#include <vnet/vnet.h>
21#include <vlibmemory/api.h>
22
23#include <vnet/interface.h>
24#include <vnet/api_errno.h>
25#include <vnet/ip/ip.h>
Neale Ranns17dcec02019-01-09 21:22:20 -080026#include <vnet/ip/ip_types_api.h>
Pierre Pfister4c422f92018-12-10 11:19:08 +010027#include <vnet/fib/fib.h>
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010028
29#include <vnet/vnet_msg_enum.h>
30
Damjan Mariona9a951f2017-01-16 22:06:10 +010031#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010032#include <vnet/ipsec/ipsec.h>
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010033#endif /* IPSEC */
34
35#define vl_typedefs /* define message structures */
36#include <vnet/vnet_all_api_h.h>
37#undef vl_typedefs
38
39#define vl_endianfun /* define message structures */
40#include <vnet/vnet_all_api_h.h>
41#undef vl_endianfun
42
43/* instantiate all the print functions we know about */
44#define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
45#define vl_printfun
46#include <vnet/vnet_all_api_h.h>
47#undef vl_printfun
48
49#include <vlibapi/api_helper_macros.h>
50
Klement Sekerab4d30532018-11-08 13:00:02 +010051#define foreach_vpe_api_msg \
52_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
53_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
Neale Ranns17dcec02019-01-09 21:22:20 -080054_(IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \
55_(IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \
Klement Sekerab4d30532018-11-08 13:00:02 +010056_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \
57_(IPSEC_SA_DUMP, ipsec_sa_dump) \
58_(IPSEC_SPDS_DUMP, ipsec_spds_dump) \
59_(IPSEC_SPD_DUMP, ipsec_spd_dump) \
60_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \
61_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \
62_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \
63_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \
Klement Sekerab4d30532018-11-08 13:00:02 +010064_(IPSEC_SELECT_BACKEND, ipsec_select_backend) \
65_(IPSEC_BACKEND_DUMP, ipsec_backend_dump)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010066
Klement Sekerab4d30532018-11-08 13:00:02 +010067static void
68vl_api_ipsec_spd_add_del_t_handler (vl_api_ipsec_spd_add_del_t * mp)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010069{
Damjan Mariona9a951f2017-01-16 22:06:10 +010070#if WITH_LIBSSL == 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010071 clib_warning ("unimplemented");
72#else
73
74 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
75 vl_api_ipsec_spd_add_del_reply_t *rmp;
76 int rv;
77
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010078 rv = ipsec_add_del_spd (vm, ntohl (mp->spd_id), mp->is_add);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010079
80 REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_REPLY);
81#endif
82}
83
84static void vl_api_ipsec_interface_add_del_spd_t_handler
85 (vl_api_ipsec_interface_add_del_spd_t * mp)
86{
87 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
88 vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
89 int rv;
90 u32 sw_if_index __attribute__ ((unused));
91 u32 spd_id __attribute__ ((unused));
92
93 sw_if_index = ntohl (mp->sw_if_index);
94 spd_id = ntohl (mp->spd_id);
95
96 VALIDATE_SW_IF_INDEX (mp);
97
Damjan Mariona9a951f2017-01-16 22:06:10 +010098#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010099 rv = ipsec_set_interface_spd (vm, sw_if_index, spd_id, mp->is_add);
100#else
101 rv = VNET_API_ERROR_UNIMPLEMENTED;
102#endif
103
104 BAD_SW_IF_INDEX_LABEL;
105
106 REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
107}
108
Neale Ranns17dcec02019-01-09 21:22:20 -0800109static int
110ipsec_spd_action_decode (vl_api_ipsec_spd_action_t in,
111 ipsec_policy_action_t * out)
112{
113 in = clib_net_to_host_u32 (in);
114
115 switch (in)
116 {
117#define _(v,f,s) case IPSEC_API_SPD_ACTION_##f: \
118 *out = IPSEC_POLICY_ACTION_##f; \
119 return (0);
120 foreach_ipsec_policy_action
121#undef _
122 }
123 return (VNET_API_ERROR_UNIMPLEMENTED);
124}
125
126static void vl_api_ipsec_spd_entry_add_del_t_handler
127 (vl_api_ipsec_spd_entry_add_del_t * mp)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100128{
129 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
Neale Ranns17dcec02019-01-09 21:22:20 -0800130 vl_api_ipsec_spd_entry_add_del_reply_t *rmp;
131 ip46_type_t itype;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800132 u32 stat_index;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100133 int rv;
134
Neale Ranns8c2dd1b2019-02-19 08:27:34 -0800135 stat_index = ~0;
136
Damjan Mariona9a951f2017-01-16 22:06:10 +0100137#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100138 ipsec_policy_t p;
139
Dave Barachb7b92992018-10-17 10:38:51 -0400140 clib_memset (&p, 0, sizeof (p));
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100141
Neale Ranns17dcec02019-01-09 21:22:20 -0800142 p.id = ntohl (mp->entry.spd_id);
143 p.priority = ntohl (mp->entry.priority);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100144
Neale Ranns17dcec02019-01-09 21:22:20 -0800145 itype = ip_address_decode (&mp->entry.remote_address_start, &p.raddr.start);
146 ip_address_decode (&mp->entry.remote_address_stop, &p.raddr.stop);
147 ip_address_decode (&mp->entry.local_address_start, &p.laddr.start);
148 ip_address_decode (&mp->entry.local_address_stop, &p.laddr.stop);
149
150 p.is_ipv6 = (itype == IP46_TYPE_IP6);
151
152 p.protocol = mp->entry.protocol;
Neale Ranns231c4692019-03-18 17:11:28 +0000153 /* leave the ports in network order */
154 p.rport.start = mp->entry.remote_port_start;
155 p.rport.stop = mp->entry.remote_port_stop;
156 p.lport.start = mp->entry.local_port_start;
157 p.lport.stop = mp->entry.local_port_stop;
Neale Ranns17dcec02019-01-09 21:22:20 -0800158
159 rv = ipsec_spd_action_decode (mp->entry.policy, &p.policy);
160
161 if (rv)
162 goto out;
163
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100164 /* policy action resolve unsupported */
Neale Ranns17dcec02019-01-09 21:22:20 -0800165 if (p.policy == IPSEC_POLICY_ACTION_RESOLVE)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100166 {
167 clib_warning ("unsupported action: 'resolve'");
168 rv = VNET_API_ERROR_UNIMPLEMENTED;
169 goto out;
170 }
Neale Ranns17dcec02019-01-09 21:22:20 -0800171 p.sa_id = ntohl (mp->entry.sa_id);
Neale Ranns9f231d42019-03-19 10:06:00 +0000172 rv =
173 ipsec_policy_mk_type (mp->entry.is_outbound, p.is_ipv6, p.policy,
174 &p.type);
175 if (rv)
176 goto out;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100177
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800178 rv = ipsec_add_del_policy (vm, &p, mp->is_add, &stat_index);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100179 if (rv)
180 goto out;
181
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100182#else
183 rv = VNET_API_ERROR_UNIMPLEMENTED;
184 goto out;
185#endif
186
187out:
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800188 /* *INDENT-OFF* */
189 REPLY_MACRO2 (VL_API_IPSEC_SPD_ENTRY_ADD_DEL_REPLY,
190 ({
191 rmp->stat_index = ntohl(stat_index);
192 }));
193 /* *INDENT-ON* */
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100194}
195
Neale Ranns17dcec02019-01-09 21:22:20 -0800196static int
197ipsec_proto_decode (vl_api_ipsec_proto_t in, ipsec_protocol_t * out)
198{
199 in = clib_net_to_host_u32 (in);
200
201 switch (in)
202 {
203 case IPSEC_API_PROTO_ESP:
204 *out = IPSEC_PROTOCOL_ESP;
205 return (0);
206 case IPSEC_API_PROTO_AH:
207 *out = IPSEC_PROTOCOL_AH;
208 return (0);
209 }
Neale Rannsaf3f0782019-03-26 08:21:25 +0000210 return (VNET_API_ERROR_INVALID_PROTOCOL);
Neale Ranns17dcec02019-01-09 21:22:20 -0800211}
212
Neale Ranns8d7c5022019-02-06 01:41:05 -0800213static vl_api_ipsec_proto_t
214ipsec_proto_encode (ipsec_protocol_t p)
215{
216 switch (p)
217 {
218 case IPSEC_PROTOCOL_ESP:
219 return clib_host_to_net_u32 (IPSEC_API_PROTO_ESP);
220 case IPSEC_PROTOCOL_AH:
221 return clib_host_to_net_u32 (IPSEC_API_PROTO_AH);
222 }
223 return (VNET_API_ERROR_UNIMPLEMENTED);
224}
225
Neale Ranns17dcec02019-01-09 21:22:20 -0800226static int
227ipsec_crypto_algo_decode (vl_api_ipsec_crypto_alg_t in,
228 ipsec_crypto_alg_t * out)
229{
230 in = clib_net_to_host_u32 (in);
231
232 switch (in)
233 {
234#define _(v,f,s) case IPSEC_API_CRYPTO_ALG_##f: \
235 *out = IPSEC_CRYPTO_ALG_##f; \
236 return (0);
237 foreach_ipsec_crypto_alg
238#undef _
239 }
Neale Rannsaf3f0782019-03-26 08:21:25 +0000240 return (VNET_API_ERROR_INVALID_ALGORITHM);
Neale Ranns17dcec02019-01-09 21:22:20 -0800241}
242
Neale Ranns8d7c5022019-02-06 01:41:05 -0800243static vl_api_ipsec_crypto_alg_t
244ipsec_crypto_algo_encode (ipsec_crypto_alg_t c)
245{
246 switch (c)
247 {
248#define _(v,f,s) case IPSEC_CRYPTO_ALG_##f: \
249 return clib_host_to_net_u32(IPSEC_API_CRYPTO_ALG_##f);
250 foreach_ipsec_crypto_alg
251#undef _
252 case IPSEC_CRYPTO_N_ALG:
253 break;
254 }
255 ASSERT (0);
256 return (VNET_API_ERROR_UNIMPLEMENTED);
257}
258
259
Neale Ranns17dcec02019-01-09 21:22:20 -0800260static int
261ipsec_integ_algo_decode (vl_api_ipsec_integ_alg_t in, ipsec_integ_alg_t * out)
262{
263 in = clib_net_to_host_u32 (in);
264
265 switch (in)
266 {
267#define _(v,f,s) case IPSEC_API_INTEG_ALG_##f: \
268 *out = IPSEC_INTEG_ALG_##f; \
269 return (0);
270 foreach_ipsec_integ_alg
271#undef _
272 }
Neale Rannsaf3f0782019-03-26 08:21:25 +0000273 return (VNET_API_ERROR_INVALID_ALGORITHM);
Neale Ranns17dcec02019-01-09 21:22:20 -0800274}
275
Neale Ranns8d7c5022019-02-06 01:41:05 -0800276static vl_api_ipsec_integ_alg_t
277ipsec_integ_algo_encode (ipsec_integ_alg_t i)
Neale Ranns17dcec02019-01-09 21:22:20 -0800278{
Neale Ranns8d7c5022019-02-06 01:41:05 -0800279 switch (i)
280 {
281#define _(v,f,s) case IPSEC_INTEG_ALG_##f: \
282 return (clib_host_to_net_u32(IPSEC_API_INTEG_ALG_##f));
283 foreach_ipsec_integ_alg
284#undef _
285 case IPSEC_INTEG_N_ALG:
286 break;
287 }
288 ASSERT (0);
289 return (VNET_API_ERROR_UNIMPLEMENTED);
Neale Ranns17dcec02019-01-09 21:22:20 -0800290}
291
292static void
Neale Ranns8d7c5022019-02-06 01:41:05 -0800293ipsec_key_decode (const vl_api_key_t * key, ipsec_key_t * out)
Neale Ranns17dcec02019-01-09 21:22:20 -0800294{
Neale Ranns8d7c5022019-02-06 01:41:05 -0800295 ipsec_mk_key (out, key->data, key->length);
296}
297
298static void
299ipsec_key_encode (const ipsec_key_t * in, vl_api_key_t * out)
300{
301 out->length = in->len;
302 clib_memcpy (out->data, in->data, out->length);
303}
304
305static ipsec_sa_flags_t
306ipsec_sa_flags_decode (vl_api_ipsec_sad_flags_t in)
307{
308 ipsec_sa_flags_t flags = IPSEC_SA_FLAG_NONE;
Neale Ranns17dcec02019-01-09 21:22:20 -0800309 in = clib_net_to_host_u32 (in);
310
Neale Rannse524d452019-02-19 15:22:46 +0000311 if (in & IPSEC_API_SAD_FLAG_USE_ESN)
312 flags |= IPSEC_SA_FLAG_USE_ESN;
313 if (in & IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
314 flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
315 if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL)
316 flags |= IPSEC_SA_FLAG_IS_TUNNEL;
317 if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL_V6)
318 flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
319 if (in & IPSEC_API_SAD_FLAG_UDP_ENCAP)
320 flags |= IPSEC_SA_FLAG_UDP_ENCAP;
321
322 return (flags);
Neale Ranns17dcec02019-01-09 21:22:20 -0800323}
324
Neale Ranns8d7c5022019-02-06 01:41:05 -0800325static vl_api_ipsec_sad_flags_t
326ipsec_sad_flags_encode (const ipsec_sa_t * sa)
327{
328 vl_api_ipsec_sad_flags_t flags = IPSEC_API_SAD_FLAG_NONE;
329
Damjan Marion1e3aa5e2019-03-28 10:58:59 +0100330 if (ipsec_sa_is_set_USE_ESN (sa))
331 flags |= IPSEC_API_SAD_FLAG_USE_ESN;
Damjan Mariond709cbc2019-03-26 13:16:42 +0100332 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800333 flags |= IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY;
Damjan Mariond709cbc2019-03-26 13:16:42 +0100334 if (ipsec_sa_is_set_IS_TUNNEL (sa))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800335 flags |= IPSEC_API_SAD_FLAG_IS_TUNNEL;
Damjan Mariond709cbc2019-03-26 13:16:42 +0100336 if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800337 flags |= IPSEC_API_SAD_FLAG_IS_TUNNEL_V6;
Damjan Mariond709cbc2019-03-26 13:16:42 +0100338 if (ipsec_sa_is_set_UDP_ENCAP (sa))
Neale Ranns8d7c5022019-02-06 01:41:05 -0800339 flags |= IPSEC_API_SAD_FLAG_UDP_ENCAP;
340
341 return clib_host_to_net_u32 (flags);
342}
Neale Ranns17dcec02019-01-09 21:22:20 -0800343
344static void vl_api_ipsec_sad_entry_add_del_t_handler
345 (vl_api_ipsec_sad_entry_add_del_t * mp)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100346{
347 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
Neale Ranns17dcec02019-01-09 21:22:20 -0800348 vl_api_ipsec_sad_entry_add_del_reply_t *rmp;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800349 ip46_address_t tun_src = { }, tun_dst =
350 {
351 };
352 ipsec_key_t crypto_key, integ_key;
353 ipsec_crypto_alg_t crypto_alg;
354 ipsec_integ_alg_t integ_alg;
355 ipsec_protocol_t proto;
356 ipsec_sa_flags_t flags;
Dave Baracha5160d72019-03-13 15:29:15 -0400357 u32 id, spi, sa_index = ~0;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100358 int rv;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800359
Damjan Mariona9a951f2017-01-16 22:06:10 +0100360#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100361
Neale Ranns8d7c5022019-02-06 01:41:05 -0800362 id = ntohl (mp->entry.sad_id);
363 spi = ntohl (mp->entry.spi);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100364
Neale Ranns8d7c5022019-02-06 01:41:05 -0800365 rv = ipsec_proto_decode (mp->entry.protocol, &proto);
Neale Ranns17dcec02019-01-09 21:22:20 -0800366
367 if (rv)
368 goto out;
369
Neale Ranns8d7c5022019-02-06 01:41:05 -0800370 rv = ipsec_crypto_algo_decode (mp->entry.crypto_algorithm, &crypto_alg);
Neale Ranns17dcec02019-01-09 21:22:20 -0800371
372 if (rv)
373 goto out;
374
Neale Ranns8d7c5022019-02-06 01:41:05 -0800375 rv = ipsec_integ_algo_decode (mp->entry.integrity_algorithm, &integ_alg);
Neale Ranns17dcec02019-01-09 21:22:20 -0800376
377 if (rv)
378 goto out;
379
Neale Ranns8d7c5022019-02-06 01:41:05 -0800380 ipsec_key_decode (&mp->entry.crypto_key, &crypto_key);
381 ipsec_key_decode (&mp->entry.integrity_key, &integ_key);
Neale Ranns17dcec02019-01-09 21:22:20 -0800382
Neale Ranns8d7c5022019-02-06 01:41:05 -0800383 flags = ipsec_sa_flags_decode (mp->entry.flags);
Neale Ranns17dcec02019-01-09 21:22:20 -0800384
Neale Ranns8d7c5022019-02-06 01:41:05 -0800385 ip_address_decode (&mp->entry.tunnel_src, &tun_src);
386 ip_address_decode (&mp->entry.tunnel_dst, &tun_dst);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100387
Neale Ranns8d7c5022019-02-06 01:41:05 -0800388 if (mp->is_add)
389 rv = ipsec_sa_add (id, spi, proto,
390 crypto_alg, &crypto_key,
391 integ_alg, &integ_key, flags,
Neale Ranns80f6fd52019-04-16 02:41:34 +0000392 0, mp->entry.salt, &tun_src, &tun_dst, &sa_index);
Neale Ranns8d7c5022019-02-06 01:41:05 -0800393 else
394 rv = ipsec_sa_del (id);
395
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100396#else
397 rv = VNET_API_ERROR_UNIMPLEMENTED;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100398#endif
399
400out:
Neale Rannseba31ec2019-02-17 18:04:27 +0000401 /* *INDENT-OFF* */
402 REPLY_MACRO2 (VL_API_IPSEC_SAD_ENTRY_ADD_DEL_REPLY,
403 {
404 rmp->stat_index = htonl (sa_index);
405 });
406 /* *INDENT-ON* */
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100407}
408
409static void
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700410send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg,
411 u32 context)
412{
413 vl_api_ipsec_spds_details_t *mp;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800414 u32 n_policies = 0;
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700415
416 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400417 clib_memset (mp, 0, sizeof (*mp));
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700418 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
419 mp->context = context;
420
421 mp->spd_id = htonl (spd->id);
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800422#define _(s, n) n_policies += vec_len (spd->policies[IPSEC_SPD_POLICY_##s]);
423 foreach_ipsec_spd_policy_type
424#undef _
425 mp->npolicies = htonl (n_policies);
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700426
427 vl_api_send_msg (reg, (u8 *) mp);
428}
429
430static void
431vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp)
432{
433 vl_api_registration_t *reg;
434 ipsec_main_t *im = &ipsec_main;
435 ipsec_spd_t *spd;
436#if WITH_LIBSSL > 0
437 reg = vl_api_client_index_to_registration (mp->client_index);
438 if (!reg)
439 return;
440
441 /* *INDENT-OFF* */
442 pool_foreach (spd, im->spds, ({
443 send_ipsec_spds_details (spd, reg, mp->context);
444 }));
445 /* *INDENT-ON* */
446#else
447 clib_warning ("unimplemented");
448#endif
449}
450
Neale Ranns17dcec02019-01-09 21:22:20 -0800451vl_api_ipsec_spd_action_t
452ipsec_spd_action_encode (ipsec_policy_action_t in)
453{
454 vl_api_ipsec_spd_action_t out = IPSEC_API_SPD_ACTION_BYPASS;
455
456 switch (in)
457 {
458#define _(v,f,s) case IPSEC_POLICY_ACTION_##f: \
459 out = IPSEC_API_SPD_ACTION_##f; \
460 break;
461 foreach_ipsec_policy_action
462#undef _
463 }
464 return (clib_host_to_net_u32 (out));
465}
466
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700467static void
Florin Coras6c4dae22018-01-09 06:39:23 -0800468send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
469 u32 context)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100470{
471 vl_api_ipsec_spd_details_t *mp;
472
473 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400474 clib_memset (mp, 0, sizeof (*mp));
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100475 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
476 mp->context = context;
477
Neale Ranns17dcec02019-01-09 21:22:20 -0800478 mp->entry.spd_id = htonl (p->id);
479 mp->entry.priority = htonl (p->priority);
Neale Ranns9f231d42019-03-19 10:06:00 +0000480 mp->entry.is_outbound = ((p->type == IPSEC_SPD_POLICY_IP6_OUTBOUND) ||
481 (p->type == IPSEC_SPD_POLICY_IP4_OUTBOUND));
Neale Ranns17dcec02019-01-09 21:22:20 -0800482
483 ip_address_encode (&p->laddr.start, IP46_TYPE_ANY,
484 &mp->entry.local_address_start);
485 ip_address_encode (&p->laddr.stop, IP46_TYPE_ANY,
486 &mp->entry.local_address_stop);
487 ip_address_encode (&p->raddr.start, IP46_TYPE_ANY,
488 &mp->entry.remote_address_start);
489 ip_address_encode (&p->raddr.stop, IP46_TYPE_ANY,
490 &mp->entry.remote_address_stop);
Neale Ranns231c4692019-03-18 17:11:28 +0000491 mp->entry.local_port_start = p->lport.start;
492 mp->entry.local_port_stop = p->lport.stop;
493 mp->entry.remote_port_start = p->rport.start;
494 mp->entry.remote_port_stop = p->rport.stop;
Neale Ranns17dcec02019-01-09 21:22:20 -0800495 mp->entry.protocol = p->protocol;
496 mp->entry.policy = ipsec_spd_action_encode (p->policy);
497 mp->entry.sa_id = htonl (p->sa_id);
498
Florin Coras6c4dae22018-01-09 06:39:23 -0800499 vl_api_send_msg (reg, (u8 *) mp);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100500}
501
502static void
503vl_api_ipsec_spd_dump_t_handler (vl_api_ipsec_spd_dump_t * mp)
504{
Florin Coras6c4dae22018-01-09 06:39:23 -0800505 vl_api_registration_t *reg;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100506 ipsec_main_t *im = &ipsec_main;
Neale Ranns9f231d42019-03-19 10:06:00 +0000507 ipsec_spd_policy_type_t ptype;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100508 ipsec_policy_t *policy;
509 ipsec_spd_t *spd;
510 uword *p;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800511 u32 spd_index, *ii;
Damjan Mariona9a951f2017-01-16 22:06:10 +0100512#if WITH_LIBSSL > 0
Florin Coras6c4dae22018-01-09 06:39:23 -0800513 reg = vl_api_client_index_to_registration (mp->client_index);
514 if (!reg)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100515 return;
516
517 p = hash_get (im->spd_index_by_spd_id, ntohl (mp->spd_id));
518 if (!p)
519 return;
520
521 spd_index = p[0];
522 spd = pool_elt_at_index (im->spds, spd_index);
523
524 /* *INDENT-OFF* */
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800525 FOR_EACH_IPSEC_SPD_POLICY_TYPE(ptype) {
526 vec_foreach(ii, spd->policies[ptype])
527 {
528 policy = pool_elt_at_index(im->policies, *ii);
529
530 if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == policy->sa_id)
531 send_ipsec_spd_details (policy, reg, mp->context);
532 }
533 }
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100534 /* *INDENT-ON* */
535#else
536 clib_warning ("unimplemented");
537#endif
538}
539
540static void
Filip Varga871bca92018-11-02 13:51:44 +0100541send_ipsec_spd_interface_details (vl_api_registration_t * reg, u32 spd_index,
542 u32 sw_if_index, u32 context)
543{
544 vl_api_ipsec_spd_interface_details_t *mp;
545
546 mp = vl_msg_api_alloc (sizeof (*mp));
547 clib_memset (mp, 0, sizeof (*mp));
548 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_INTERFACE_DETAILS);
549 mp->context = context;
550
551 mp->spd_index = htonl (spd_index);
552 mp->sw_if_index = htonl (sw_if_index);
553
554 vl_api_send_msg (reg, (u8 *) mp);
555}
556
557static void
558vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t *
559 mp)
560{
561 ipsec_main_t *im = &ipsec_main;
562 vl_api_registration_t *reg;
563 u32 k, v, spd_index;
564
565#if WITH_LIBSSL > 0
566 reg = vl_api_client_index_to_registration (mp->client_index);
567 if (!reg)
568 return;
569
570 if (mp->spd_index_valid)
571 {
572 spd_index = ntohl (mp->spd_index);
573 /* *INDENT-OFF* */
574 hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
575 if (v == spd_index)
576 send_ipsec_spd_interface_details(reg, v, k, mp->context);
577 }));
578 /* *INDENT-ON* */
579 }
580 else
581 {
582 /* *INDENT-OFF* */
583 hash_foreach(k, v, im->spd_index_by_sw_if_index, ({
584 send_ipsec_spd_interface_details(reg, v, k, mp->context);
585 }));
586 /* *INDENT-ON* */
587 }
588
589#else
590 clib_warning ("unimplemented");
591#endif
592}
593
594static void
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100595vl_api_ipsec_sa_set_key_t_handler (vl_api_ipsec_sa_set_key_t * mp)
596{
597 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
598 vl_api_ipsec_sa_set_key_reply_t *rmp;
Neale Ranns8d7c5022019-02-06 01:41:05 -0800599 ipsec_key_t ck, ik;
600 u32 id;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100601 int rv;
Damjan Mariona9a951f2017-01-16 22:06:10 +0100602#if WITH_LIBSSL > 0
Neale Ranns17dcec02019-01-09 21:22:20 -0800603
Neale Ranns8d7c5022019-02-06 01:41:05 -0800604 id = ntohl (mp->sa_id);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100605
Neale Ranns8d7c5022019-02-06 01:41:05 -0800606 ipsec_key_decode (&mp->crypto_key, &ck);
607 ipsec_key_decode (&mp->integrity_key, &ik);
608
609 rv = ipsec_set_sa_key (id, &ck, &ik);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100610#else
611 rv = VNET_API_ERROR_UNIMPLEMENTED;
612#endif
613
614 REPLY_MACRO (VL_API_IPSEC_SA_SET_KEY_REPLY);
615}
616
617static void
Matthew Smithb0972cb2017-05-02 16:20:41 -0500618vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t *
619 mp)
620{
621 vl_api_ipsec_tunnel_if_add_del_reply_t *rmp;
Matthew Smithe04d09d2017-05-14 21:47:18 -0500622 ipsec_main_t *im = &ipsec_main;
623 vnet_main_t *vnm = im->vnet_main;
624 u32 sw_if_index = ~0;
Kingwel Xie1ba5bc82019-03-20 07:21:58 -0400625 ip46_type_t itype;
Matthew Smithb0972cb2017-05-02 16:20:41 -0500626 int rv;
627
628#if WITH_LIBSSL > 0
629 ipsec_add_del_tunnel_args_t tun;
630
Dave Barachb7b92992018-10-17 10:38:51 -0400631 clib_memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
Matthew Smithb0972cb2017-05-02 16:20:41 -0500632
633 tun.is_add = mp->is_add;
634 tun.esn = mp->esn;
635 tun.anti_replay = mp->anti_replay;
636 tun.local_spi = ntohl (mp->local_spi);
637 tun.remote_spi = ntohl (mp->remote_spi);
638 tun.crypto_alg = mp->crypto_alg;
639 tun.local_crypto_key_len = mp->local_crypto_key_len;
640 tun.remote_crypto_key_len = mp->remote_crypto_key_len;
641 tun.integ_alg = mp->integ_alg;
642 tun.local_integ_key_len = mp->local_integ_key_len;
643 tun.remote_integ_key_len = mp->remote_integ_key_len;
Filip Tehlarb4a7a7d2018-11-30 07:27:27 -0800644 tun.udp_encap = mp->udp_encap;
Pierre Pfister4c422f92018-12-10 11:19:08 +0100645 tun.tx_table_id = ntohl (mp->tx_table_id);
Neale Ranns80f6fd52019-04-16 02:41:34 +0000646 tun.salt = mp->salt;
Kingwel Xie1ba5bc82019-03-20 07:21:58 -0400647 itype = ip_address_decode (&mp->local_ip, &tun.local_ip);
648 itype = ip_address_decode (&mp->remote_ip, &tun.remote_ip);
649 tun.is_ip6 = (IP46_TYPE_IP6 == itype);
Matthew Smithb0972cb2017-05-02 16:20:41 -0500650 memcpy (&tun.local_crypto_key, &mp->local_crypto_key,
651 mp->local_crypto_key_len);
652 memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key,
653 mp->remote_crypto_key_len);
654 memcpy (&tun.local_integ_key, &mp->local_integ_key,
655 mp->local_integ_key_len);
656 memcpy (&tun.remote_integ_key, &mp->remote_integ_key,
657 mp->remote_integ_key_len);
Matthew Smith8e1039a2018-04-12 07:32:56 -0500658 tun.renumber = mp->renumber;
659 tun.show_instance = ntohl (mp->show_instance);
Matthew Smithb0972cb2017-05-02 16:20:41 -0500660
Matthew Smithe04d09d2017-05-14 21:47:18 -0500661 rv = ipsec_add_del_tunnel_if_internal (vnm, &tun, &sw_if_index);
Matthew Smithb0972cb2017-05-02 16:20:41 -0500662
663#else
664 rv = VNET_API_ERROR_UNIMPLEMENTED;
665#endif
666
Neale Ranns8d7c5022019-02-06 01:41:05 -0800667 /* *INDENT-OFF* */
668 REPLY_MACRO2 (VL_API_IPSEC_TUNNEL_IF_ADD_DEL_REPLY,
669 ({
670 rmp->sw_if_index = htonl (sw_if_index);
671 }));
672 /* *INDENT-ON* */
Matthew Smithb0972cb2017-05-02 16:20:41 -0500673}
674
Matthew Smith28029532017-09-26 13:33:44 -0500675static void
Florin Coras6c4dae22018-01-09 06:39:23 -0800676send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg,
Matthew Smith28029532017-09-26 13:33:44 -0500677 u32 context, u32 sw_if_index)
678{
679 vl_api_ipsec_sa_details_t *mp;
680
681 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400682 clib_memset (mp, 0, sizeof (*mp));
Matthew Smith28029532017-09-26 13:33:44 -0500683 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
684 mp->context = context;
685
Neale Ranns8d7c5022019-02-06 01:41:05 -0800686 mp->entry.sad_id = htonl (sa->id);
687 mp->entry.spi = htonl (sa->spi);
688 mp->entry.protocol = ipsec_proto_encode (sa->protocol);
689 mp->entry.tx_table_id =
690 htonl (fib_table_get_table_id (sa->tx_fib_index, FIB_PROTOCOL_IP4));
Matthew Smith28029532017-09-26 13:33:44 -0500691
Neale Ranns8d7c5022019-02-06 01:41:05 -0800692 mp->entry.crypto_algorithm = ipsec_crypto_algo_encode (sa->crypto_alg);
693 ipsec_key_encode (&sa->crypto_key, &mp->entry.crypto_key);
Matthew Smith28029532017-09-26 13:33:44 -0500694
Neale Ranns8d7c5022019-02-06 01:41:05 -0800695 mp->entry.integrity_algorithm = ipsec_integ_algo_encode (sa->integ_alg);
696 ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key);
Matthew Smith28029532017-09-26 13:33:44 -0500697
Neale Ranns8d7c5022019-02-06 01:41:05 -0800698 mp->entry.flags = ipsec_sad_flags_encode (sa);
Matthew Smith28029532017-09-26 13:33:44 -0500699
Damjan Mariond709cbc2019-03-26 13:16:42 +0100700 if (ipsec_sa_is_set_IS_TUNNEL (sa))
Matthew Smith28029532017-09-26 13:33:44 -0500701 {
Neale Ranns8d7c5022019-02-06 01:41:05 -0800702 ip_address_encode (&sa->tunnel_src_addr, IP46_TYPE_ANY,
703 &mp->entry.tunnel_src);
704 ip_address_encode (&sa->tunnel_dst_addr, IP46_TYPE_ANY,
705 &mp->entry.tunnel_dst);
Matthew Smith28029532017-09-26 13:33:44 -0500706 }
707
Neale Ranns8d7c5022019-02-06 01:41:05 -0800708 mp->sw_if_index = htonl (sw_if_index);
Matthew Smith28029532017-09-26 13:33:44 -0500709 mp->salt = clib_host_to_net_u32 (sa->salt);
710 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
711 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
Damjan Marion1e3aa5e2019-03-28 10:58:59 +0100712 if (ipsec_sa_is_set_USE_ESN (sa))
Matthew Smith28029532017-09-26 13:33:44 -0500713 {
714 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
715 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
716 }
Damjan Mariond709cbc2019-03-26 13:16:42 +0100717 if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
Matthew Smith28029532017-09-26 13:33:44 -0500718 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
Pierre Pfister4c422f92018-12-10 11:19:08 +0100719
Florin Coras6c4dae22018-01-09 06:39:23 -0800720 vl_api_send_msg (reg, (u8 *) mp);
Matthew Smith28029532017-09-26 13:33:44 -0500721}
722
723
724static void
725vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp)
726{
Florin Coras6c4dae22018-01-09 06:39:23 -0800727 vl_api_registration_t *reg;
Matthew Smith28029532017-09-26 13:33:44 -0500728 ipsec_main_t *im = &ipsec_main;
729 vnet_main_t *vnm = im->vnet_main;
730 ipsec_sa_t *sa;
731 ipsec_tunnel_if_t *t;
732 u32 *sa_index_to_tun_if_index = 0;
733
734#if WITH_LIBSSL > 0
Florin Coras6c4dae22018-01-09 06:39:23 -0800735 reg = vl_api_client_index_to_registration (mp->client_index);
736 if (!reg || pool_elts (im->sad) == 0)
Matthew Smith28029532017-09-26 13:33:44 -0500737 return;
738
739 vec_validate_init_empty (sa_index_to_tun_if_index, vec_len (im->sad) - 1,
740 ~0);
741
742 /* *INDENT-OFF* */
743 pool_foreach (t, im->tunnel_interfaces,
744 ({
745 vnet_hw_interface_t *hi;
746 u32 sw_if_index = ~0;
747
748 hi = vnet_get_hw_interface (vnm, t->hw_if_index);
749 sw_if_index = hi->sw_if_index;
750 sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index;
751 sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index;
752 }));
753
754 pool_foreach (sa, im->sad,
755 ({
756 if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id)
Florin Coras6c4dae22018-01-09 06:39:23 -0800757 send_ipsec_sa_details (sa, reg, mp->context,
Matthew Smith28029532017-09-26 13:33:44 -0500758 sa_index_to_tun_if_index[sa - im->sad]);
759 }));
760 /* *INDENT-ON* */
761
762 vec_free (sa_index_to_tun_if_index);
763#else
764 clib_warning ("unimplemented");
765#endif
766}
767
Matthew Smithe04d09d2017-05-14 21:47:18 -0500768
Matthew Smithb0972cb2017-05-02 16:20:41 -0500769static void
Matthew Smith75d85602017-10-05 19:03:05 -0500770vl_api_ipsec_tunnel_if_set_key_t_handler (vl_api_ipsec_tunnel_if_set_key_t *
771 mp)
772{
773 vl_api_ipsec_tunnel_if_set_key_reply_t *rmp;
774 ipsec_main_t *im = &ipsec_main;
775 vnet_main_t *vnm = im->vnet_main;
776 vnet_sw_interface_t *sw;
777 u8 *key = 0;
778 int rv;
779
780#if WITH_LIBSSL > 0
781 sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index));
782
783 switch (mp->key_type)
784 {
785 case IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO:
786 case IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO:
787 if (mp->alg < IPSEC_CRYPTO_ALG_AES_CBC_128 ||
Dave Baracha8d47642018-07-13 11:22:23 -0400788 mp->alg >= IPSEC_CRYPTO_N_ALG)
Matthew Smith75d85602017-10-05 19:03:05 -0500789 {
Neale Rannsaf3f0782019-03-26 08:21:25 +0000790 rv = VNET_API_ERROR_INVALID_ALGORITHM;
Matthew Smith75d85602017-10-05 19:03:05 -0500791 goto out;
792 }
793 break;
794 case IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG:
795 case IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG:
Dave Baracha8d47642018-07-13 11:22:23 -0400796 if (mp->alg >= IPSEC_INTEG_N_ALG)
Matthew Smith75d85602017-10-05 19:03:05 -0500797 {
Neale Rannsaf3f0782019-03-26 08:21:25 +0000798 rv = VNET_API_ERROR_INVALID_ALGORITHM;
Matthew Smith75d85602017-10-05 19:03:05 -0500799 goto out;
800 }
801 break;
802 case IPSEC_IF_SET_KEY_TYPE_NONE:
803 default:
804 rv = VNET_API_ERROR_UNIMPLEMENTED;
805 goto out;
806 break;
807 }
808
809 key = vec_new (u8, mp->key_len);
810 clib_memcpy (key, mp->key, mp->key_len);
811
812 rv = ipsec_set_interface_key (vnm, sw->hw_if_index, mp->key_type, mp->alg,
813 key);
814 vec_free (key);
815#else
816 clib_warning ("unimplemented");
817#endif
818
819out:
820 REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_KEY_REPLY);
821}
822
823
824static void
Matthew Smithca514fd2017-10-12 12:06:59 -0500825vl_api_ipsec_tunnel_if_set_sa_t_handler (vl_api_ipsec_tunnel_if_set_sa_t * mp)
826{
827 vl_api_ipsec_tunnel_if_set_sa_reply_t *rmp;
828 ipsec_main_t *im = &ipsec_main;
829 vnet_main_t *vnm = im->vnet_main;
830 vnet_sw_interface_t *sw;
831 int rv;
832
833#if WITH_LIBSSL > 0
834 sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index));
835
836 rv = ipsec_set_interface_sa (vnm, sw->hw_if_index, ntohl (mp->sa_id),
837 mp->is_outbound);
838#else
839 clib_warning ("unimplemented");
840#endif
841
842 REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_SA_REPLY);
843}
844
Klement Sekerab4d30532018-11-08 13:00:02 +0100845static void
846vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp)
847{
848 vl_api_registration_t *rp;
849 ipsec_main_t *im = &ipsec_main;
850 u32 context = mp->context;
851
852 rp = vl_api_client_index_to_registration (mp->client_index);
853
854 if (rp == 0)
855 {
856 clib_warning ("Client %d AWOL", mp->client_index);
857 return;
858 }
859
860 ipsec_ah_backend_t *ab;
861 ipsec_esp_backend_t *eb;
862 /* *INDENT-OFF* */
863 pool_foreach (ab, im->ah_backends, {
864 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
865 clib_memset (mp, 0, sizeof (*mp));
866 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
867 mp->context = context;
868 snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (ab->name),
869 ab->name);
Neale Ranns17dcec02019-01-09 21:22:20 -0800870 mp->protocol = ntohl (IPSEC_API_PROTO_AH);
Klement Sekerab4d30532018-11-08 13:00:02 +0100871 mp->index = ab - im->ah_backends;
872 mp->active = mp->index == im->ah_current_backend ? 1 : 0;
873 vl_api_send_msg (rp, (u8 *)mp);
874 });
875 pool_foreach (eb, im->esp_backends, {
876 vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
877 clib_memset (mp, 0, sizeof (*mp));
878 mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
879 mp->context = context;
880 snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (eb->name),
881 eb->name);
Neale Ranns17dcec02019-01-09 21:22:20 -0800882 mp->protocol = ntohl (IPSEC_API_PROTO_ESP);
Klement Sekerab4d30532018-11-08 13:00:02 +0100883 mp->index = eb - im->esp_backends;
884 mp->active = mp->index == im->esp_current_backend ? 1 : 0;
885 vl_api_send_msg (rp, (u8 *)mp);
886 });
887 /* *INDENT-ON* */
888}
889
890static void
891vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp)
892{
893 ipsec_main_t *im = &ipsec_main;
894 vl_api_ipsec_select_backend_reply_t *rmp;
Neale Ranns17dcec02019-01-09 21:22:20 -0800895 ipsec_protocol_t protocol;
Klement Sekerab4d30532018-11-08 13:00:02 +0100896 int rv = 0;
897 if (pool_elts (im->sad) > 0)
898 {
899 rv = VNET_API_ERROR_INSTANCE_IN_USE;
900 goto done;
901 }
Neale Ranns17dcec02019-01-09 21:22:20 -0800902
903 rv = ipsec_proto_decode (mp->protocol, &protocol);
904
905 if (rv)
906 goto done;
907
Klement Sekerab4d30532018-11-08 13:00:02 +0100908#if WITH_LIBSSL > 0
Neale Ranns17dcec02019-01-09 21:22:20 -0800909 switch (protocol)
Klement Sekerab4d30532018-11-08 13:00:02 +0100910 {
911 case IPSEC_PROTOCOL_ESP:
912 if (pool_is_free_index (im->esp_backends, mp->index))
913 {
914 rv = VNET_API_ERROR_INVALID_VALUE;
915 break;
916 }
917 ipsec_select_esp_backend (im, mp->index);
918 break;
919 case IPSEC_PROTOCOL_AH:
920 if (pool_is_free_index (im->ah_backends, mp->index))
921 {
922 rv = VNET_API_ERROR_INVALID_VALUE;
923 break;
924 }
925 ipsec_select_ah_backend (im, mp->index);
926 break;
927 default:
928 rv = VNET_API_ERROR_INVALID_VALUE;
929 break;
930 }
931#else
932 clib_warning ("unimplemented"); /* FIXME */
933#endif
934done:
935 REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY);
936}
937
Neale Ranns7c44d782019-02-25 10:28:29 +0000938/*
939 * ipsec_api_hookup
940 * Add vpe's API message handlers to the table.
941 * vlib has already mapped shared memory and
942 * added the client registration handlers.
943 * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
944 */
945#define vl_msg_name_crc_list
946#include <vnet/vnet_all_api_h.h>
947#undef vl_msg_name_crc_list
948
949static void
950setup_message_id_table (api_main_t * am)
951{
952#define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id);
953 foreach_vl_msg_name_crc_ipsec;
954#undef _
955}
956
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100957static clib_error_t *
958ipsec_api_hookup (vlib_main_t * vm)
959{
960 api_main_t *am = &api_main;
961
962#define _(N,n) \
963 vl_msg_api_set_handlers(VL_API_##N, #n, \
964 vl_api_##n##_t_handler, \
965 vl_noop_handler, \
966 vl_api_##n##_t_endian, \
967 vl_api_##n##_t_print, \
968 sizeof(vl_api_##n##_t), 1);
969 foreach_vpe_api_msg;
970#undef _
971
972 /*
973 * Set up the (msg_name, crc, message-id) table
974 */
975 setup_message_id_table (am);
976
977 return 0;
978}
979
980VLIB_API_INIT_FUNCTION (ipsec_api_hookup);
981
982/*
983 * fd.io coding-style-patch-verification: ON
984 *
985 * Local Variables:
986 * eval: (c-set-style "gnu")
987 * End:
988 */