blob: f80c3400a6f6d56556d383de73925b607039235a [file] [log] [blame]
Pavel Kotucek9c7ef032016-12-21 07:46:45 +01001/*
2 *------------------------------------------------------------------
3 * ipsec_api.c - ipsec api
4 *
5 * Copyright (c) 2016 Cisco and/or its affiliates.
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at:
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
17 *------------------------------------------------------------------
18 */
19
20#include <vnet/vnet.h>
21#include <vlibmemory/api.h>
22
23#include <vnet/interface.h>
24#include <vnet/api_errno.h>
25#include <vnet/ip/ip.h>
26
27#include <vnet/vnet_msg_enum.h>
28
Damjan Mariona9a951f2017-01-16 22:06:10 +010029#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010030#include <vnet/ipsec/ipsec.h>
31#include <vnet/ipsec/ikev2.h>
32#endif /* IPSEC */
33
34#define vl_typedefs /* define message structures */
35#include <vnet/vnet_all_api_h.h>
36#undef vl_typedefs
37
38#define vl_endianfun /* define message structures */
39#include <vnet/vnet_all_api_h.h>
40#undef vl_endianfun
41
42/* instantiate all the print functions we know about */
43#define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
44#define vl_printfun
45#include <vnet/vnet_all_api_h.h>
46#undef vl_printfun
47
48#include <vlibapi/api_helper_macros.h>
49
50#define foreach_vpe_api_msg \
51_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \
52_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \
53_(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \
54_(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \
55_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \
Matthew Smith28029532017-09-26 13:33:44 -050056_(IPSEC_SA_DUMP, ipsec_sa_dump) \
Matus Fabiana9a0b2c2018-10-02 01:13:25 -070057_(IPSEC_SPDS_DUMP, ipsec_spds_dump) \
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010058_(IPSEC_SPD_DUMP, ipsec_spd_dump) \
Matthew Smithb0972cb2017-05-02 16:20:41 -050059_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \
Matthew Smith75d85602017-10-05 19:03:05 -050060_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \
Matthew Smithca514fd2017-10-12 12:06:59 -050061_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010062_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \
63_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \
64_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \
65_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \
Radu Nicolaucb33dc22017-02-16 16:49:46 +000066_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \
67_(IKEV2_SET_RESPONDER, ikev2_set_responder) \
68_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \
69_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \
70_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \
71_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \
72_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \
73_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \
74_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010075
76static void vl_api_ipsec_spd_add_del_t_handler
77 (vl_api_ipsec_spd_add_del_t * mp)
78{
Damjan Mariona9a951f2017-01-16 22:06:10 +010079#if WITH_LIBSSL == 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010080 clib_warning ("unimplemented");
81#else
82
83 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
84 vl_api_ipsec_spd_add_del_reply_t *rmp;
85 int rv;
86
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010087 rv = ipsec_add_del_spd (vm, ntohl (mp->spd_id), mp->is_add);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +010088
89 REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_REPLY);
90#endif
91}
92
93static void vl_api_ipsec_interface_add_del_spd_t_handler
94 (vl_api_ipsec_interface_add_del_spd_t * mp)
95{
96 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
97 vl_api_ipsec_interface_add_del_spd_reply_t *rmp;
98 int rv;
99 u32 sw_if_index __attribute__ ((unused));
100 u32 spd_id __attribute__ ((unused));
101
102 sw_if_index = ntohl (mp->sw_if_index);
103 spd_id = ntohl (mp->spd_id);
104
105 VALIDATE_SW_IF_INDEX (mp);
106
Damjan Mariona9a951f2017-01-16 22:06:10 +0100107#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100108 rv = ipsec_set_interface_spd (vm, sw_if_index, spd_id, mp->is_add);
109#else
110 rv = VNET_API_ERROR_UNIMPLEMENTED;
111#endif
112
113 BAD_SW_IF_INDEX_LABEL;
114
115 REPLY_MACRO (VL_API_IPSEC_INTERFACE_ADD_DEL_SPD_REPLY);
116}
117
118static void vl_api_ipsec_spd_add_del_entry_t_handler
119 (vl_api_ipsec_spd_add_del_entry_t * mp)
120{
121 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
122 vl_api_ipsec_spd_add_del_entry_reply_t *rmp;
123 int rv;
124
Damjan Mariona9a951f2017-01-16 22:06:10 +0100125#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100126 ipsec_policy_t p;
127
Dave Barachb7b92992018-10-17 10:38:51 -0400128 clib_memset (&p, 0, sizeof (p));
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100129
130 p.id = ntohl (mp->spd_id);
131 p.priority = ntohl (mp->priority);
132 p.is_outbound = mp->is_outbound;
133 p.is_ipv6 = mp->is_ipv6;
134
135 if (mp->is_ipv6 || mp->is_ip_any)
136 {
137 clib_memcpy (&p.raddr.start, mp->remote_address_start, 16);
138 clib_memcpy (&p.raddr.stop, mp->remote_address_stop, 16);
139 clib_memcpy (&p.laddr.start, mp->local_address_start, 16);
140 clib_memcpy (&p.laddr.stop, mp->local_address_stop, 16);
141 }
142 else
143 {
144 clib_memcpy (&p.raddr.start.ip4.data, mp->remote_address_start, 4);
145 clib_memcpy (&p.raddr.stop.ip4.data, mp->remote_address_stop, 4);
146 clib_memcpy (&p.laddr.start.ip4.data, mp->local_address_start, 4);
147 clib_memcpy (&p.laddr.stop.ip4.data, mp->local_address_stop, 4);
148 }
149 p.protocol = mp->protocol;
150 p.rport.start = ntohs (mp->remote_port_start);
151 p.rport.stop = ntohs (mp->remote_port_stop);
152 p.lport.start = ntohs (mp->local_port_start);
153 p.lport.stop = ntohs (mp->local_port_stop);
154 /* policy action resolve unsupported */
155 if (mp->policy == IPSEC_POLICY_ACTION_RESOLVE)
156 {
157 clib_warning ("unsupported action: 'resolve'");
158 rv = VNET_API_ERROR_UNIMPLEMENTED;
159 goto out;
160 }
161 p.policy = mp->policy;
162 p.sa_id = ntohl (mp->sa_id);
163
164 rv = ipsec_add_del_policy (vm, &p, mp->is_add);
165 if (rv)
166 goto out;
167
168 if (mp->is_ip_any)
169 {
170 p.is_ipv6 = 1;
171 rv = ipsec_add_del_policy (vm, &p, mp->is_add);
172 }
173#else
174 rv = VNET_API_ERROR_UNIMPLEMENTED;
175 goto out;
176#endif
177
178out:
179 REPLY_MACRO (VL_API_IPSEC_SPD_ADD_DEL_ENTRY_REPLY);
180}
181
182static void vl_api_ipsec_sad_add_del_entry_t_handler
183 (vl_api_ipsec_sad_add_del_entry_t * mp)
184{
185 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
186 vl_api_ipsec_sad_add_del_entry_reply_t *rmp;
187 int rv;
Damjan Mariona9a951f2017-01-16 22:06:10 +0100188#if WITH_LIBSSL > 0
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000189 ipsec_main_t *im = &ipsec_main;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100190 ipsec_sa_t sa;
191
Dave Barachb7b92992018-10-17 10:38:51 -0400192 clib_memset (&sa, 0, sizeof (sa));
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100193
194 sa.id = ntohl (mp->sad_id);
195 sa.spi = ntohl (mp->spi);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100196 sa.protocol = mp->protocol;
197 /* check for unsupported crypto-alg */
Dave Baracha8d47642018-07-13 11:22:23 -0400198 if (mp->crypto_algorithm >= IPSEC_CRYPTO_N_ALG)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100199 {
200 clib_warning ("unsupported crypto-alg: '%U'", format_ipsec_crypto_alg,
201 mp->crypto_algorithm);
202 rv = VNET_API_ERROR_UNIMPLEMENTED;
203 goto out;
204 }
205 sa.crypto_alg = mp->crypto_algorithm;
206 sa.crypto_key_len = mp->crypto_key_length;
207 clib_memcpy (&sa.crypto_key, mp->crypto_key, sizeof (sa.crypto_key));
208 /* check for unsupported integ-alg */
Pavel Kotucek78053e12017-03-10 10:03:59 +0100209 if (mp->integrity_algorithm >= IPSEC_INTEG_N_ALG)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100210 {
211 clib_warning ("unsupported integ-alg: '%U'", format_ipsec_integ_alg,
212 mp->integrity_algorithm);
213 rv = VNET_API_ERROR_UNIMPLEMENTED;
214 goto out;
215 }
216
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100217 sa.integ_alg = mp->integrity_algorithm;
218 sa.integ_key_len = mp->integrity_key_length;
219 clib_memcpy (&sa.integ_key, mp->integrity_key, sizeof (sa.integ_key));
220 sa.use_esn = mp->use_extended_sequence_number;
221 sa.is_tunnel = mp->is_tunnel;
222 sa.is_tunnel_ip6 = mp->is_tunnel_ipv6;
Radu Nicolau717de092018-08-03 10:37:24 +0100223 sa.udp_encap = mp->udp_encap;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100224 if (sa.is_tunnel_ip6)
225 {
226 clib_memcpy (&sa.tunnel_src_addr, mp->tunnel_src_address, 16);
227 clib_memcpy (&sa.tunnel_dst_addr, mp->tunnel_dst_address, 16);
228 }
229 else
230 {
231 clib_memcpy (&sa.tunnel_src_addr.ip4.data, mp->tunnel_src_address, 4);
232 clib_memcpy (&sa.tunnel_dst_addr.ip4.data, mp->tunnel_dst_address, 4);
233 }
Matthew Smithca514fd2017-10-12 12:06:59 -0500234 sa.use_anti_replay = mp->use_anti_replay;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100235
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000236 ASSERT (im->cb.check_support_cb);
237 clib_error_t *err = im->cb.check_support_cb (&sa);
238 if (err)
239 {
240 clib_warning ("%s", err->what);
241 rv = VNET_API_ERROR_UNIMPLEMENTED;
242 goto out;
243 }
244
Radu Nicolau717de092018-08-03 10:37:24 +0100245 rv = ipsec_add_del_sa (vm, &sa, mp->is_add);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100246#else
247 rv = VNET_API_ERROR_UNIMPLEMENTED;
248 goto out;
249#endif
250
251out:
252 REPLY_MACRO (VL_API_IPSEC_SAD_ADD_DEL_ENTRY_REPLY);
253}
254
255static void
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700256send_ipsec_spds_details (ipsec_spd_t * spd, vl_api_registration_t * reg,
257 u32 context)
258{
259 vl_api_ipsec_spds_details_t *mp;
260
261 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400262 clib_memset (mp, 0, sizeof (*mp));
Matus Fabiana9a0b2c2018-10-02 01:13:25 -0700263 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPDS_DETAILS);
264 mp->context = context;
265
266 mp->spd_id = htonl (spd->id);
267 mp->npolicies = htonl (pool_len (spd->policies));
268
269 vl_api_send_msg (reg, (u8 *) mp);
270}
271
272static void
273vl_api_ipsec_spds_dump_t_handler (vl_api_ipsec_spds_dump_t * mp)
274{
275 vl_api_registration_t *reg;
276 ipsec_main_t *im = &ipsec_main;
277 ipsec_spd_t *spd;
278#if WITH_LIBSSL > 0
279 reg = vl_api_client_index_to_registration (mp->client_index);
280 if (!reg)
281 return;
282
283 /* *INDENT-OFF* */
284 pool_foreach (spd, im->spds, ({
285 send_ipsec_spds_details (spd, reg, mp->context);
286 }));
287 /* *INDENT-ON* */
288#else
289 clib_warning ("unimplemented");
290#endif
291}
292
293static void
Florin Coras6c4dae22018-01-09 06:39:23 -0800294send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg,
295 u32 context)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100296{
297 vl_api_ipsec_spd_details_t *mp;
298
299 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400300 clib_memset (mp, 0, sizeof (*mp));
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100301 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SPD_DETAILS);
302 mp->context = context;
303
304 mp->spd_id = htonl (p->id);
305 mp->priority = htonl (p->priority);
306 mp->is_outbound = p->is_outbound;
307 mp->is_ipv6 = p->is_ipv6;
308 if (p->is_ipv6)
309 {
310 memcpy (mp->local_start_addr, &p->laddr.start.ip6, 16);
311 memcpy (mp->local_stop_addr, &p->laddr.stop.ip6, 16);
312 memcpy (mp->remote_start_addr, &p->raddr.start.ip6, 16);
313 memcpy (mp->remote_stop_addr, &p->raddr.stop.ip6, 16);
314 }
315 else
316 {
317 memcpy (mp->local_start_addr, &p->laddr.start.ip4, 4);
318 memcpy (mp->local_stop_addr, &p->laddr.stop.ip4, 4);
319 memcpy (mp->remote_start_addr, &p->raddr.start.ip4, 4);
320 memcpy (mp->remote_stop_addr, &p->raddr.stop.ip4, 4);
321 }
322 mp->local_start_port = htons (p->lport.start);
323 mp->local_stop_port = htons (p->lport.stop);
324 mp->remote_start_port = htons (p->rport.start);
325 mp->remote_stop_port = htons (p->rport.stop);
326 mp->protocol = p->protocol;
327 mp->policy = p->policy;
328 mp->sa_id = htonl (p->sa_id);
329 mp->bytes = clib_host_to_net_u64 (p->counter.bytes);
330 mp->packets = clib_host_to_net_u64 (p->counter.packets);
331
Florin Coras6c4dae22018-01-09 06:39:23 -0800332 vl_api_send_msg (reg, (u8 *) mp);
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100333}
334
335static void
336vl_api_ipsec_spd_dump_t_handler (vl_api_ipsec_spd_dump_t * mp)
337{
Florin Coras6c4dae22018-01-09 06:39:23 -0800338 vl_api_registration_t *reg;
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100339 ipsec_main_t *im = &ipsec_main;
340 ipsec_policy_t *policy;
341 ipsec_spd_t *spd;
342 uword *p;
343 u32 spd_index;
Damjan Mariona9a951f2017-01-16 22:06:10 +0100344#if WITH_LIBSSL > 0
Florin Coras6c4dae22018-01-09 06:39:23 -0800345 reg = vl_api_client_index_to_registration (mp->client_index);
346 if (!reg)
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100347 return;
348
349 p = hash_get (im->spd_index_by_spd_id, ntohl (mp->spd_id));
350 if (!p)
351 return;
352
353 spd_index = p[0];
354 spd = pool_elt_at_index (im->spds, spd_index);
355
356 /* *INDENT-OFF* */
357 pool_foreach (policy, spd->policies,
358 ({
359 if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == policy->sa_id)
Florin Coras6c4dae22018-01-09 06:39:23 -0800360 send_ipsec_spd_details (policy, reg,
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100361 mp->context);}
362 ));
363 /* *INDENT-ON* */
364#else
365 clib_warning ("unimplemented");
366#endif
367}
368
369static void
370vl_api_ipsec_sa_set_key_t_handler (vl_api_ipsec_sa_set_key_t * mp)
371{
372 vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main ();
373 vl_api_ipsec_sa_set_key_reply_t *rmp;
374 int rv;
Damjan Mariona9a951f2017-01-16 22:06:10 +0100375#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100376 ipsec_sa_t sa;
377 sa.id = ntohl (mp->sa_id);
378 sa.crypto_key_len = mp->crypto_key_length;
379 clib_memcpy (&sa.crypto_key, mp->crypto_key, sizeof (sa.crypto_key));
380 sa.integ_key_len = mp->integrity_key_length;
381 clib_memcpy (&sa.integ_key, mp->integrity_key, sizeof (sa.integ_key));
382
383 rv = ipsec_set_sa_key (vm, &sa);
384#else
385 rv = VNET_API_ERROR_UNIMPLEMENTED;
386#endif
387
388 REPLY_MACRO (VL_API_IPSEC_SA_SET_KEY_REPLY);
389}
390
391static void
Matthew Smithb0972cb2017-05-02 16:20:41 -0500392vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t *
393 mp)
394{
395 vl_api_ipsec_tunnel_if_add_del_reply_t *rmp;
Matthew Smithe04d09d2017-05-14 21:47:18 -0500396 ipsec_main_t *im = &ipsec_main;
397 vnet_main_t *vnm = im->vnet_main;
398 u32 sw_if_index = ~0;
Matthew Smithb0972cb2017-05-02 16:20:41 -0500399 int rv;
400
401#if WITH_LIBSSL > 0
402 ipsec_add_del_tunnel_args_t tun;
403
Dave Barachb7b92992018-10-17 10:38:51 -0400404 clib_memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
Matthew Smithb0972cb2017-05-02 16:20:41 -0500405
406 tun.is_add = mp->is_add;
407 tun.esn = mp->esn;
408 tun.anti_replay = mp->anti_replay;
409 tun.local_spi = ntohl (mp->local_spi);
410 tun.remote_spi = ntohl (mp->remote_spi);
411 tun.crypto_alg = mp->crypto_alg;
412 tun.local_crypto_key_len = mp->local_crypto_key_len;
413 tun.remote_crypto_key_len = mp->remote_crypto_key_len;
414 tun.integ_alg = mp->integ_alg;
415 tun.local_integ_key_len = mp->local_integ_key_len;
416 tun.remote_integ_key_len = mp->remote_integ_key_len;
417 memcpy (&tun.local_ip, mp->local_ip, 4);
418 memcpy (&tun.remote_ip, mp->remote_ip, 4);
419 memcpy (&tun.local_crypto_key, &mp->local_crypto_key,
420 mp->local_crypto_key_len);
421 memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key,
422 mp->remote_crypto_key_len);
423 memcpy (&tun.local_integ_key, &mp->local_integ_key,
424 mp->local_integ_key_len);
425 memcpy (&tun.remote_integ_key, &mp->remote_integ_key,
426 mp->remote_integ_key_len);
Matthew Smith8e1039a2018-04-12 07:32:56 -0500427 tun.renumber = mp->renumber;
428 tun.show_instance = ntohl (mp->show_instance);
Matthew Smithb0972cb2017-05-02 16:20:41 -0500429
Matthew Smithe04d09d2017-05-14 21:47:18 -0500430 rv = ipsec_add_del_tunnel_if_internal (vnm, &tun, &sw_if_index);
Matthew Smithb0972cb2017-05-02 16:20:41 -0500431
432#else
433 rv = VNET_API_ERROR_UNIMPLEMENTED;
434#endif
435
Matthew Smithe04d09d2017-05-14 21:47:18 -0500436 REPLY_MACRO2 (VL_API_IPSEC_TUNNEL_IF_ADD_DEL_REPLY, (
437 {
438 rmp->sw_if_index =
439 htonl (sw_if_index);
440 }));
Matthew Smithb0972cb2017-05-02 16:20:41 -0500441}
442
Matthew Smith28029532017-09-26 13:33:44 -0500443static void
Florin Coras6c4dae22018-01-09 06:39:23 -0800444send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg,
Matthew Smith28029532017-09-26 13:33:44 -0500445 u32 context, u32 sw_if_index)
446{
447 vl_api_ipsec_sa_details_t *mp;
448
449 mp = vl_msg_api_alloc (sizeof (*mp));
Dave Barachb7b92992018-10-17 10:38:51 -0400450 clib_memset (mp, 0, sizeof (*mp));
Matthew Smith28029532017-09-26 13:33:44 -0500451 mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
452 mp->context = context;
453
454 mp->sa_id = htonl (sa->id);
455 mp->sw_if_index = htonl (sw_if_index);
456
457 mp->spi = htonl (sa->spi);
458 mp->protocol = sa->protocol;
459
460 mp->crypto_alg = sa->crypto_alg;
461 mp->crypto_key_len = sa->crypto_key_len;
462 memcpy (mp->crypto_key, sa->crypto_key, sa->crypto_key_len);
463
464 mp->integ_alg = sa->integ_alg;
465 mp->integ_key_len = sa->integ_key_len;
466 memcpy (mp->integ_key, sa->integ_key, sa->integ_key_len);
467
468 mp->use_esn = sa->use_esn;
469 mp->use_anti_replay = sa->use_anti_replay;
470
471 mp->is_tunnel = sa->is_tunnel;
472 mp->is_tunnel_ip6 = sa->is_tunnel_ip6;
473
474 if (sa->is_tunnel)
475 {
476 if (sa->is_tunnel_ip6)
477 {
478 memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip6, 16);
479 memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip6, 16);
480 }
481 else
482 {
483 memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip4, 4);
484 memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip4, 4);
485 }
486 }
487
488 mp->salt = clib_host_to_net_u32 (sa->salt);
489 mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
490 mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
491 if (sa->use_esn)
492 {
493 mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
494 mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
495 }
496 if (sa->use_anti_replay)
497 mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
498 mp->total_data_size = clib_host_to_net_u64 (sa->total_data_size);
Klement Sekera4b089f22018-04-17 18:04:57 +0200499 mp->udp_encap = sa->udp_encap;
Matthew Smith28029532017-09-26 13:33:44 -0500500
Florin Coras6c4dae22018-01-09 06:39:23 -0800501 vl_api_send_msg (reg, (u8 *) mp);
Matthew Smith28029532017-09-26 13:33:44 -0500502}
503
504
505static void
506vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp)
507{
Florin Coras6c4dae22018-01-09 06:39:23 -0800508 vl_api_registration_t *reg;
Matthew Smith28029532017-09-26 13:33:44 -0500509 ipsec_main_t *im = &ipsec_main;
510 vnet_main_t *vnm = im->vnet_main;
511 ipsec_sa_t *sa;
512 ipsec_tunnel_if_t *t;
513 u32 *sa_index_to_tun_if_index = 0;
514
515#if WITH_LIBSSL > 0
Florin Coras6c4dae22018-01-09 06:39:23 -0800516 reg = vl_api_client_index_to_registration (mp->client_index);
517 if (!reg || pool_elts (im->sad) == 0)
Matthew Smith28029532017-09-26 13:33:44 -0500518 return;
519
520 vec_validate_init_empty (sa_index_to_tun_if_index, vec_len (im->sad) - 1,
521 ~0);
522
523 /* *INDENT-OFF* */
524 pool_foreach (t, im->tunnel_interfaces,
525 ({
526 vnet_hw_interface_t *hi;
527 u32 sw_if_index = ~0;
528
529 hi = vnet_get_hw_interface (vnm, t->hw_if_index);
530 sw_if_index = hi->sw_if_index;
531 sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index;
532 sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index;
533 }));
534
535 pool_foreach (sa, im->sad,
536 ({
537 if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id)
Florin Coras6c4dae22018-01-09 06:39:23 -0800538 send_ipsec_sa_details (sa, reg, mp->context,
Matthew Smith28029532017-09-26 13:33:44 -0500539 sa_index_to_tun_if_index[sa - im->sad]);
540 }));
541 /* *INDENT-ON* */
542
543 vec_free (sa_index_to_tun_if_index);
544#else
545 clib_warning ("unimplemented");
546#endif
547}
548
Matthew Smithe04d09d2017-05-14 21:47:18 -0500549
Matthew Smithb0972cb2017-05-02 16:20:41 -0500550static void
Matthew Smith75d85602017-10-05 19:03:05 -0500551vl_api_ipsec_tunnel_if_set_key_t_handler (vl_api_ipsec_tunnel_if_set_key_t *
552 mp)
553{
554 vl_api_ipsec_tunnel_if_set_key_reply_t *rmp;
555 ipsec_main_t *im = &ipsec_main;
556 vnet_main_t *vnm = im->vnet_main;
557 vnet_sw_interface_t *sw;
558 u8 *key = 0;
559 int rv;
560
561#if WITH_LIBSSL > 0
562 sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index));
563
564 switch (mp->key_type)
565 {
566 case IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO:
567 case IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO:
568 if (mp->alg < IPSEC_CRYPTO_ALG_AES_CBC_128 ||
Dave Baracha8d47642018-07-13 11:22:23 -0400569 mp->alg >= IPSEC_CRYPTO_N_ALG)
Matthew Smith75d85602017-10-05 19:03:05 -0500570 {
571 rv = VNET_API_ERROR_UNIMPLEMENTED;
572 goto out;
573 }
574 break;
575 case IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG:
576 case IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG:
Dave Baracha8d47642018-07-13 11:22:23 -0400577 if (mp->alg >= IPSEC_INTEG_N_ALG)
Matthew Smith75d85602017-10-05 19:03:05 -0500578 {
579 rv = VNET_API_ERROR_UNIMPLEMENTED;
580 goto out;
581 }
582 break;
583 case IPSEC_IF_SET_KEY_TYPE_NONE:
584 default:
585 rv = VNET_API_ERROR_UNIMPLEMENTED;
586 goto out;
587 break;
588 }
589
590 key = vec_new (u8, mp->key_len);
591 clib_memcpy (key, mp->key, mp->key_len);
592
593 rv = ipsec_set_interface_key (vnm, sw->hw_if_index, mp->key_type, mp->alg,
594 key);
595 vec_free (key);
596#else
597 clib_warning ("unimplemented");
598#endif
599
600out:
601 REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_KEY_REPLY);
602}
603
604
605static void
Matthew Smithca514fd2017-10-12 12:06:59 -0500606vl_api_ipsec_tunnel_if_set_sa_t_handler (vl_api_ipsec_tunnel_if_set_sa_t * mp)
607{
608 vl_api_ipsec_tunnel_if_set_sa_reply_t *rmp;
609 ipsec_main_t *im = &ipsec_main;
610 vnet_main_t *vnm = im->vnet_main;
611 vnet_sw_interface_t *sw;
612 int rv;
613
614#if WITH_LIBSSL > 0
615 sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index));
616
617 rv = ipsec_set_interface_sa (vnm, sw->hw_if_index, ntohl (mp->sa_id),
618 mp->is_outbound);
619#else
620 clib_warning ("unimplemented");
621#endif
622
623 REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_SA_REPLY);
624}
625
626
627static void
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100628vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp)
629{
630 vl_api_ikev2_profile_add_del_reply_t *rmp;
631 int rv = 0;
632
Damjan Mariona9a951f2017-01-16 22:06:10 +0100633#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100634 vlib_main_t *vm = vlib_get_main ();
635 clib_error_t *error;
636 u8 *tmp = format (0, "%s", mp->name);
637 error = ikev2_add_del_profile (vm, tmp, mp->is_add);
638 vec_free (tmp);
639 if (error)
640 rv = VNET_API_ERROR_UNSPECIFIED;
641#else
642 rv = VNET_API_ERROR_UNIMPLEMENTED;
643#endif
644
645 REPLY_MACRO (VL_API_IKEV2_PROFILE_ADD_DEL_REPLY);
646}
647
648static void
649 vl_api_ikev2_profile_set_auth_t_handler
650 (vl_api_ikev2_profile_set_auth_t * mp)
651{
652 vl_api_ikev2_profile_set_auth_reply_t *rmp;
653 int rv = 0;
654
Damjan Mariona9a951f2017-01-16 22:06:10 +0100655#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100656 vlib_main_t *vm = vlib_get_main ();
657 clib_error_t *error;
658 u8 *tmp = format (0, "%s", mp->name);
659 u8 *data = vec_new (u8, mp->data_len);
660 clib_memcpy (data, mp->data, mp->data_len);
661 error = ikev2_set_profile_auth (vm, tmp, mp->auth_method, data, mp->is_hex);
662 vec_free (tmp);
663 vec_free (data);
664 if (error)
665 rv = VNET_API_ERROR_UNSPECIFIED;
666#else
667 rv = VNET_API_ERROR_UNIMPLEMENTED;
668#endif
669
670 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_AUTH_REPLY);
671}
672
673static void
674vl_api_ikev2_profile_set_id_t_handler (vl_api_ikev2_profile_set_id_t * mp)
675{
676 vl_api_ikev2_profile_add_del_reply_t *rmp;
677 int rv = 0;
678
Damjan Mariona9a951f2017-01-16 22:06:10 +0100679#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100680 vlib_main_t *vm = vlib_get_main ();
681 clib_error_t *error;
682 u8 *tmp = format (0, "%s", mp->name);
683 u8 *data = vec_new (u8, mp->data_len);
684 clib_memcpy (data, mp->data, mp->data_len);
685 error = ikev2_set_profile_id (vm, tmp, mp->id_type, data, mp->is_local);
686 vec_free (tmp);
687 vec_free (data);
688 if (error)
689 rv = VNET_API_ERROR_UNSPECIFIED;
690#else
691 rv = VNET_API_ERROR_UNIMPLEMENTED;
692#endif
693
694 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_ID_REPLY);
695}
696
697static void
698vl_api_ikev2_profile_set_ts_t_handler (vl_api_ikev2_profile_set_ts_t * mp)
699{
700 vl_api_ikev2_profile_set_ts_reply_t *rmp;
701 int rv = 0;
702
Damjan Mariona9a951f2017-01-16 22:06:10 +0100703#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100704 vlib_main_t *vm = vlib_get_main ();
705 clib_error_t *error;
706 u8 *tmp = format (0, "%s", mp->name);
707 error = ikev2_set_profile_ts (vm, tmp, mp->proto, mp->start_port,
708 mp->end_port, (ip4_address_t) mp->start_addr,
709 (ip4_address_t) mp->end_addr, mp->is_local);
710 vec_free (tmp);
711 if (error)
712 rv = VNET_API_ERROR_UNSPECIFIED;
713#else
714 rv = VNET_API_ERROR_UNIMPLEMENTED;
715#endif
716
717 REPLY_MACRO (VL_API_IKEV2_PROFILE_SET_TS_REPLY);
718}
719
720static void
721vl_api_ikev2_set_local_key_t_handler (vl_api_ikev2_set_local_key_t * mp)
722{
723 vl_api_ikev2_profile_set_ts_reply_t *rmp;
724 int rv = 0;
725
Damjan Mariona9a951f2017-01-16 22:06:10 +0100726#if WITH_LIBSSL > 0
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100727 vlib_main_t *vm = vlib_get_main ();
728 clib_error_t *error;
729
730 error = ikev2_set_local_key (vm, mp->key_file);
731 if (error)
732 rv = VNET_API_ERROR_UNSPECIFIED;
733#else
734 rv = VNET_API_ERROR_UNIMPLEMENTED;
735#endif
736
737 REPLY_MACRO (VL_API_IKEV2_SET_LOCAL_KEY_REPLY);
738}
739
Radu Nicolaucb33dc22017-02-16 16:49:46 +0000740static void
741vl_api_ikev2_set_responder_t_handler (vl_api_ikev2_set_responder_t * mp)
742{
743 vl_api_ikev2_set_responder_reply_t *rmp;
744 int rv = 0;
745
746#if WITH_LIBSSL > 0
747 vlib_main_t *vm = vlib_get_main ();
748 clib_error_t *error;
749
750 u8 *tmp = format (0, "%s", mp->name);
751 ip4_address_t ip4;
752 clib_memcpy (&ip4, mp->address, sizeof (ip4));
753
754 error = ikev2_set_profile_responder (vm, tmp, mp->sw_if_index, ip4);
755 vec_free (tmp);
756 if (error)
757 rv = VNET_API_ERROR_UNSPECIFIED;
758#else
759 rv = VNET_API_ERROR_UNIMPLEMENTED;
760#endif
761
762 REPLY_MACRO (VL_API_IKEV2_SET_RESPONDER_REPLY);
763}
764
765static void
766vl_api_ikev2_set_ike_transforms_t_handler (vl_api_ikev2_set_ike_transforms_t *
767 mp)
768{
769 vl_api_ikev2_set_ike_transforms_reply_t *rmp;
770 int rv = 0;
771
772#if WITH_LIBSSL > 0
773 vlib_main_t *vm = vlib_get_main ();
774 clib_error_t *error;
775
776 u8 *tmp = format (0, "%s", mp->name);
777
778 error =
779 ikev2_set_profile_ike_transforms (vm, tmp, mp->crypto_alg, mp->integ_alg,
780 mp->dh_group, mp->crypto_key_size);
781 vec_free (tmp);
782 if (error)
783 rv = VNET_API_ERROR_UNSPECIFIED;
784#else
785 rv = VNET_API_ERROR_UNIMPLEMENTED;
786#endif
787
788 REPLY_MACRO (VL_API_IKEV2_SET_IKE_TRANSFORMS_REPLY);
789}
790
791static void
792vl_api_ikev2_set_esp_transforms_t_handler (vl_api_ikev2_set_esp_transforms_t *
793 mp)
794{
795 vl_api_ikev2_set_esp_transforms_reply_t *rmp;
796 int rv = 0;
797
798#if WITH_LIBSSL > 0
799 vlib_main_t *vm = vlib_get_main ();
800 clib_error_t *error;
801
802 u8 *tmp = format (0, "%s", mp->name);
803
804 error =
805 ikev2_set_profile_esp_transforms (vm, tmp, mp->crypto_alg, mp->integ_alg,
806 mp->dh_group, mp->crypto_key_size);
807 vec_free (tmp);
808 if (error)
809 rv = VNET_API_ERROR_UNSPECIFIED;
810#else
811 rv = VNET_API_ERROR_UNIMPLEMENTED;
812#endif
813
814 REPLY_MACRO (VL_API_IKEV2_SET_ESP_TRANSFORMS_REPLY);
815}
816
817static void
818vl_api_ikev2_set_sa_lifetime_t_handler (vl_api_ikev2_set_sa_lifetime_t * mp)
819{
820 vl_api_ikev2_set_sa_lifetime_reply_t *rmp;
821 int rv = 0;
822
823#if WITH_LIBSSL > 0
824 vlib_main_t *vm = vlib_get_main ();
825 clib_error_t *error;
826
827 u8 *tmp = format (0, "%s", mp->name);
828
829 error =
830 ikev2_set_profile_sa_lifetime (vm, tmp, mp->lifetime, mp->lifetime_jitter,
831 mp->handover, mp->lifetime_maxdata);
832 vec_free (tmp);
833 if (error)
834 rv = VNET_API_ERROR_UNSPECIFIED;
835#else
836 rv = VNET_API_ERROR_UNIMPLEMENTED;
837#endif
838
839 REPLY_MACRO (VL_API_IKEV2_SET_SA_LIFETIME_REPLY);
840}
841
842static void
843vl_api_ikev2_initiate_sa_init_t_handler (vl_api_ikev2_initiate_sa_init_t * mp)
844{
845 vl_api_ikev2_initiate_sa_init_reply_t *rmp;
846 int rv = 0;
847
848#if WITH_LIBSSL > 0
849 vlib_main_t *vm = vlib_get_main ();
850 clib_error_t *error;
851
852 u8 *tmp = format (0, "%s", mp->name);
853
854 error = ikev2_initiate_sa_init (vm, tmp);
855 vec_free (tmp);
856 if (error)
857 rv = VNET_API_ERROR_UNSPECIFIED;
858#else
859 rv = VNET_API_ERROR_UNIMPLEMENTED;
860#endif
861
862 REPLY_MACRO (VL_API_IKEV2_INITIATE_SA_INIT_REPLY);
863}
864
865static void
866vl_api_ikev2_initiate_del_ike_sa_t_handler (vl_api_ikev2_initiate_del_ike_sa_t
867 * mp)
868{
869 vl_api_ikev2_initiate_del_ike_sa_reply_t *rmp;
870 int rv = 0;
871
872#if WITH_LIBSSL > 0
873 vlib_main_t *vm = vlib_get_main ();
874 clib_error_t *error;
875
876 error = ikev2_initiate_delete_ike_sa (vm, mp->ispi);
877 if (error)
878 rv = VNET_API_ERROR_UNSPECIFIED;
879#else
880 rv = VNET_API_ERROR_UNIMPLEMENTED;
881#endif
882
883 REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_IKE_SA_REPLY);
884}
885
886static void
887 vl_api_ikev2_initiate_del_child_sa_t_handler
888 (vl_api_ikev2_initiate_del_child_sa_t * mp)
889{
890 vl_api_ikev2_initiate_del_child_sa_reply_t *rmp;
891 int rv = 0;
892
893#if WITH_LIBSSL > 0
894 vlib_main_t *vm = vlib_get_main ();
895 clib_error_t *error;
896
897 error = ikev2_initiate_delete_child_sa (vm, mp->ispi);
898 if (error)
899 rv = VNET_API_ERROR_UNSPECIFIED;
900#else
901 rv = VNET_API_ERROR_UNIMPLEMENTED;
902#endif
903
904 REPLY_MACRO (VL_API_IKEV2_INITIATE_DEL_CHILD_SA_REPLY);
905}
906
907static void
908 vl_api_ikev2_initiate_rekey_child_sa_t_handler
909 (vl_api_ikev2_initiate_rekey_child_sa_t * mp)
910{
911 vl_api_ikev2_initiate_rekey_child_sa_reply_t *rmp;
912 int rv = 0;
913
914#if WITH_LIBSSL > 0
915 vlib_main_t *vm = vlib_get_main ();
916 clib_error_t *error;
917
918 error = ikev2_initiate_rekey_child_sa (vm, mp->ispi);
919 if (error)
920 rv = VNET_API_ERROR_UNSPECIFIED;
921#else
922 rv = VNET_API_ERROR_UNIMPLEMENTED;
923#endif
924
925 REPLY_MACRO (VL_API_IKEV2_INITIATE_REKEY_CHILD_SA_REPLY);
926}
927
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100928/*
929 * ipsec_api_hookup
930 * Add vpe's API message handlers to the table.
Paul Vinciguerrabdc0e6b2018-09-22 05:32:50 -0700931 * vlib has already mapped shared memory and
Pavel Kotucek9c7ef032016-12-21 07:46:45 +0100932 * added the client registration handlers.
933 * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
934 */
935#define vl_msg_name_crc_list
936#include <vnet/vnet_all_api_h.h>
937#undef vl_msg_name_crc_list
938
939static void
940setup_message_id_table (api_main_t * am)
941{
942#define _(id,n,crc) vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id);
943 foreach_vl_msg_name_crc_ipsec;
944#undef _
945}
946
947static clib_error_t *
948ipsec_api_hookup (vlib_main_t * vm)
949{
950 api_main_t *am = &api_main;
951
952#define _(N,n) \
953 vl_msg_api_set_handlers(VL_API_##N, #n, \
954 vl_api_##n##_t_handler, \
955 vl_noop_handler, \
956 vl_api_##n##_t_endian, \
957 vl_api_##n##_t_print, \
958 sizeof(vl_api_##n##_t), 1);
959 foreach_vpe_api_msg;
960#undef _
961
962 /*
963 * Set up the (msg_name, crc, message-id) table
964 */
965 setup_message_id_table (am);
966
967 return 0;
968}
969
970VLIB_API_INIT_FUNCTION (ipsec_api_hookup);
971
972/*
973 * fd.io coding-style-patch-verification: ON
974 *
975 * Local Variables:
976 * eval: (c-set-style "gnu")
977 * End:
978 */