Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
| 15 | |
| 16 | #include <vnet/ipsec/ipsec.h> |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 17 | #include <vnet/ipsec/esp.h> |
Florin Coras | b040f98 | 2020-10-20 14:59:43 -0700 | [diff] [blame] | 18 | #include <vnet/udp/udp_local.h> |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 19 | #include <vnet/fib/fib_table.h> |
Neale Ranns | 1f50bf8 | 2019-07-16 15:28:52 +0000 | [diff] [blame] | 20 | #include <vnet/fib/fib_entry_track.h> |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 21 | #include <vnet/ipsec/ipsec_tun.h> |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 22 | |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 23 | /** |
| 24 | * @brief |
| 25 | * SA packet & bytes counters |
| 26 | */ |
| 27 | vlib_combined_counter_main_t ipsec_sa_counters = { |
| 28 | .name = "SA", |
| 29 | .stat_segment_name = "/net/ipsec/sa", |
| 30 | }; |
Neale Ranns | e11203e | 2021-09-21 12:34:19 +0000 | [diff] [blame] | 31 | vlib_simple_counter_main_t ipsec_sa_lost_counters = { |
| 32 | .name = "SA-lost", |
| 33 | .stat_segment_name = "/net/ipsec/sa/lost", |
| 34 | }; |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 35 | |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 36 | ipsec_sa_t *ipsec_sa_pool; |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 37 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 38 | static clib_error_t * |
| 39 | ipsec_call_add_del_callbacks (ipsec_main_t * im, ipsec_sa_t * sa, |
| 40 | u32 sa_index, int is_add) |
| 41 | { |
| 42 | ipsec_ah_backend_t *ab; |
| 43 | ipsec_esp_backend_t *eb; |
| 44 | switch (sa->protocol) |
| 45 | { |
| 46 | case IPSEC_PROTOCOL_AH: |
| 47 | ab = pool_elt_at_index (im->ah_backends, im->ah_current_backend); |
| 48 | if (ab->add_del_sa_sess_cb) |
| 49 | return ab->add_del_sa_sess_cb (sa_index, is_add); |
| 50 | break; |
| 51 | case IPSEC_PROTOCOL_ESP: |
| 52 | eb = pool_elt_at_index (im->esp_backends, im->esp_current_backend); |
| 53 | if (eb->add_del_sa_sess_cb) |
| 54 | return eb->add_del_sa_sess_cb (sa_index, is_add); |
| 55 | break; |
| 56 | } |
| 57 | return 0; |
| 58 | } |
| 59 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 60 | void |
| 61 | ipsec_mk_key (ipsec_key_t * key, const u8 * data, u8 len) |
| 62 | { |
| 63 | memset (key, 0, sizeof (*key)); |
| 64 | |
| 65 | if (len > sizeof (key->data)) |
| 66 | key->len = sizeof (key->data); |
| 67 | else |
| 68 | key->len = len; |
| 69 | |
| 70 | memcpy (key->data, data, key->len); |
| 71 | } |
| 72 | |
| 73 | /** |
| 74 | * 'stack' (resolve the recursion for) the SA tunnel destination |
| 75 | */ |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 76 | static void |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 77 | ipsec_sa_stack (ipsec_sa_t * sa) |
| 78 | { |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 79 | ipsec_main_t *im = &ipsec_main; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 80 | dpo_id_t tmp = DPO_INVALID; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 81 | |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 82 | tunnel_contribute_forwarding (&sa->tunnel, &tmp); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 83 | |
Neale Ranns | 72f2a3a | 2019-06-17 15:43:38 +0000 | [diff] [blame] | 84 | if (IPSEC_PROTOCOL_AH == sa->protocol) |
| 85 | dpo_stack_from_node ((ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? |
| 86 | im->ah6_encrypt_node_index : |
| 87 | im->ah4_encrypt_node_index), &sa->dpo, &tmp); |
| 88 | else |
| 89 | dpo_stack_from_node ((ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? |
| 90 | im->esp6_encrypt_node_index : |
| 91 | im->esp4_encrypt_node_index), &sa->dpo, &tmp); |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 92 | dpo_reset (&tmp); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 93 | } |
| 94 | |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 95 | void |
| 96 | ipsec_sa_set_crypto_alg (ipsec_sa_t * sa, ipsec_crypto_alg_t crypto_alg) |
| 97 | { |
| 98 | ipsec_main_t *im = &ipsec_main; |
| 99 | sa->crypto_alg = crypto_alg; |
| 100 | sa->crypto_iv_size = im->crypto_algs[crypto_alg].iv_size; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 101 | sa->esp_block_align = clib_max (4, im->crypto_algs[crypto_alg].block_align); |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 102 | sa->sync_op_data.crypto_enc_op_id = im->crypto_algs[crypto_alg].enc_op_id; |
| 103 | sa->sync_op_data.crypto_dec_op_id = im->crypto_algs[crypto_alg].dec_op_id; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 104 | sa->crypto_calg = im->crypto_algs[crypto_alg].alg; |
Damjan Marion | b4fff3a | 2019-03-25 15:54:40 +0100 | [diff] [blame] | 105 | ASSERT (sa->crypto_iv_size <= ESP_MAX_IV_SIZE); |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 106 | ASSERT (sa->esp_block_align <= ESP_MAX_BLOCK_SIZE); |
Vladimir Ratnikov | d7c030d | 2022-09-13 13:09:53 +0000 | [diff] [blame] | 107 | if (IPSEC_CRYPTO_ALG_IS_GCM (crypto_alg) || |
| 108 | IPSEC_CRYPTO_ALG_CTR_AEAD_OTHERS (crypto_alg)) |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 109 | { |
| 110 | sa->integ_icv_size = im->crypto_algs[crypto_alg].icv_size; |
Benoît Ganne | 490b927 | 2021-01-22 18:03:09 +0100 | [diff] [blame] | 111 | ipsec_sa_set_IS_CTR (sa); |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 112 | ipsec_sa_set_IS_AEAD (sa); |
| 113 | } |
Benoît Ganne | 490b927 | 2021-01-22 18:03:09 +0100 | [diff] [blame] | 114 | else if (IPSEC_CRYPTO_ALG_IS_CTR (crypto_alg)) |
| 115 | { |
| 116 | ipsec_sa_set_IS_CTR (sa); |
| 117 | } |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 118 | } |
| 119 | |
| 120 | void |
| 121 | ipsec_sa_set_integ_alg (ipsec_sa_t * sa, ipsec_integ_alg_t integ_alg) |
| 122 | { |
| 123 | ipsec_main_t *im = &ipsec_main; |
| 124 | sa->integ_alg = integ_alg; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 125 | sa->integ_icv_size = im->integ_algs[integ_alg].icv_size; |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 126 | sa->sync_op_data.integ_op_id = im->integ_algs[integ_alg].op_id; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 127 | sa->integ_calg = im->integ_algs[integ_alg].alg; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 128 | ASSERT (sa->integ_icv_size <= ESP_MAX_ICV_SIZE); |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 129 | } |
| 130 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 131 | void |
| 132 | ipsec_sa_set_async_op_ids (ipsec_sa_t * sa) |
| 133 | { |
| 134 | /* *INDENT-OFF* */ |
| 135 | if (ipsec_sa_is_set_USE_ESN (sa)) |
| 136 | { |
| 137 | #define _(n, s, k) \ |
| 138 | if( sa->sync_op_data.crypto_enc_op_id == VNET_CRYPTO_OP_##n##_ENC ) \ |
| 139 | sa->async_op_data.crypto_async_enc_op_id = \ |
| 140 | VNET_CRYPTO_OP_##n##_TAG16_AAD12_ENC; \ |
| 141 | if( sa->sync_op_data.crypto_dec_op_id == VNET_CRYPTO_OP_##n##_DEC ) \ |
| 142 | sa->async_op_data.crypto_async_dec_op_id = \ |
| 143 | VNET_CRYPTO_OP_##n##_TAG16_AAD12_DEC; |
| 144 | foreach_crypto_aead_alg |
| 145 | #undef _ |
| 146 | } |
| 147 | else |
| 148 | { |
| 149 | #define _(n, s, k) \ |
| 150 | if( sa->sync_op_data.crypto_enc_op_id == VNET_CRYPTO_OP_##n##_ENC ) \ |
| 151 | sa->async_op_data.crypto_async_enc_op_id = \ |
| 152 | VNET_CRYPTO_OP_##n##_TAG16_AAD8_ENC; \ |
| 153 | if( sa->sync_op_data.crypto_dec_op_id == VNET_CRYPTO_OP_##n##_DEC ) \ |
| 154 | sa->async_op_data.crypto_async_dec_op_id = \ |
| 155 | VNET_CRYPTO_OP_##n##_TAG16_AAD8_DEC; |
| 156 | foreach_crypto_aead_alg |
| 157 | #undef _ |
| 158 | } |
| 159 | |
| 160 | #define _(c, h, s, k ,d) \ |
| 161 | if( sa->sync_op_data.crypto_enc_op_id == VNET_CRYPTO_OP_##c##_ENC && \ |
| 162 | sa->sync_op_data.integ_op_id == VNET_CRYPTO_OP_##h##_HMAC) \ |
| 163 | sa->async_op_data.crypto_async_enc_op_id = \ |
| 164 | VNET_CRYPTO_OP_##c##_##h##_TAG##d##_ENC; \ |
| 165 | if( sa->sync_op_data.crypto_dec_op_id == VNET_CRYPTO_OP_##c##_DEC && \ |
| 166 | sa->sync_op_data.integ_op_id == VNET_CRYPTO_OP_##h##_HMAC) \ |
| 167 | sa->async_op_data.crypto_async_dec_op_id = \ |
| 168 | VNET_CRYPTO_OP_##c##_##h##_TAG##d##_DEC; |
| 169 | foreach_crypto_link_async_alg |
| 170 | #undef _ |
| 171 | /* *INDENT-ON* */ |
| 172 | } |
| 173 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 174 | int |
Arthur de Kerhor | 4117b24 | 2022-08-31 19:13:03 +0200 | [diff] [blame] | 175 | ipsec_sa_update (u32 id, u16 src_port, u16 dst_port, const tunnel_t *tun, |
| 176 | bool is_tun) |
| 177 | { |
| 178 | ipsec_main_t *im = &ipsec_main; |
| 179 | ipsec_sa_t *sa; |
| 180 | u32 sa_index; |
| 181 | uword *p; |
| 182 | int rv; |
| 183 | |
| 184 | p = hash_get (im->sa_index_by_sa_id, id); |
| 185 | if (!p) |
| 186 | return VNET_API_ERROR_NO_SUCH_ENTRY; |
| 187 | |
| 188 | sa = ipsec_sa_get (p[0]); |
| 189 | sa_index = sa - ipsec_sa_pool; |
| 190 | |
| 191 | if (is_tun && ipsec_sa_is_set_IS_TUNNEL (sa) && |
| 192 | (ip_address_cmp (&tun->t_src, &sa->tunnel.t_src) != 0 || |
| 193 | ip_address_cmp (&tun->t_dst, &sa->tunnel.t_dst) != 0)) |
| 194 | { |
| 195 | /* if the source IP is updated for an inbound SA under a tunnel protect, |
| 196 | we need to update the tun_protect DB with the new src IP */ |
| 197 | if (ipsec_sa_is_set_IS_INBOUND (sa) && |
| 198 | ip_address_cmp (&tun->t_src, &sa->tunnel.t_src) != 0 && |
| 199 | !ip46_address_is_zero (&tun->t_src.ip)) |
| 200 | { |
| 201 | if (ip46_address_is_ip4 (&sa->tunnel.t_src.ip)) |
| 202 | { |
| 203 | ipsec4_tunnel_kv_t old_key, new_key; |
| 204 | clib_bihash_kv_8_16_t res, |
| 205 | *bkey = (clib_bihash_kv_8_16_t *) &old_key; |
| 206 | |
| 207 | ipsec4_tunnel_mk_key (&old_key, &sa->tunnel.t_src.ip.ip4, |
| 208 | clib_host_to_net_u32 (sa->spi)); |
| 209 | ipsec4_tunnel_mk_key (&new_key, &tun->t_src.ip.ip4, |
| 210 | clib_host_to_net_u32 (sa->spi)); |
| 211 | |
| 212 | if (!clib_bihash_search_8_16 (&im->tun4_protect_by_key, bkey, |
| 213 | &res)) |
| 214 | { |
| 215 | clib_bihash_add_del_8_16 (&im->tun4_protect_by_key, &res, 0); |
| 216 | res.key = new_key.key; |
| 217 | clib_bihash_add_del_8_16 (&im->tun4_protect_by_key, &res, 1); |
| 218 | } |
| 219 | } |
| 220 | else |
| 221 | { |
| 222 | ipsec6_tunnel_kv_t old_key = { |
| 223 | .key = { |
| 224 | .remote_ip = sa->tunnel.t_src.ip.ip6, |
| 225 | .spi = clib_host_to_net_u32 (sa->spi), |
| 226 | }, |
| 227 | }, new_key = { |
| 228 | .key = { |
| 229 | .remote_ip = tun->t_src.ip.ip6, |
| 230 | .spi = clib_host_to_net_u32 (sa->spi), |
| 231 | }}; |
| 232 | clib_bihash_kv_24_16_t res, |
| 233 | *bkey = (clib_bihash_kv_24_16_t *) &old_key; |
| 234 | |
| 235 | if (!clib_bihash_search_24_16 (&im->tun6_protect_by_key, bkey, |
| 236 | &res)) |
| 237 | { |
| 238 | clib_bihash_add_del_24_16 (&im->tun6_protect_by_key, &res, |
| 239 | 0); |
| 240 | clib_memcpy (&res.key, &new_key.key, 3); |
| 241 | clib_bihash_add_del_24_16 (&im->tun6_protect_by_key, &res, |
| 242 | 1); |
| 243 | } |
| 244 | } |
| 245 | } |
| 246 | tunnel_unresolve (&sa->tunnel); |
| 247 | tunnel_copy (tun, &sa->tunnel); |
| 248 | if (!ipsec_sa_is_set_IS_INBOUND (sa)) |
| 249 | { |
| 250 | dpo_reset (&sa->dpo); |
| 251 | |
| 252 | sa->tunnel_flags = sa->tunnel.t_encap_decap_flags; |
| 253 | |
| 254 | rv = tunnel_resolve (&sa->tunnel, FIB_NODE_TYPE_IPSEC_SA, sa_index); |
| 255 | |
| 256 | if (rv) |
| 257 | { |
| 258 | hash_unset (im->sa_index_by_sa_id, sa->id); |
| 259 | pool_put (ipsec_sa_pool, sa); |
| 260 | return rv; |
| 261 | } |
| 262 | ipsec_sa_stack (sa); |
| 263 | /* generate header templates */ |
| 264 | if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa)) |
| 265 | { |
| 266 | tunnel_build_v6_hdr (&sa->tunnel, |
| 267 | (ipsec_sa_is_set_UDP_ENCAP (sa) ? |
| 268 | IP_PROTOCOL_UDP : |
| 269 | IP_PROTOCOL_IPSEC_ESP), |
| 270 | &sa->ip6_hdr); |
| 271 | } |
| 272 | else |
| 273 | { |
| 274 | tunnel_build_v4_hdr (&sa->tunnel, |
| 275 | (ipsec_sa_is_set_UDP_ENCAP (sa) ? |
| 276 | IP_PROTOCOL_UDP : |
| 277 | IP_PROTOCOL_IPSEC_ESP), |
| 278 | &sa->ip4_hdr); |
| 279 | } |
| 280 | } |
| 281 | } |
| 282 | |
| 283 | if (ipsec_sa_is_set_UDP_ENCAP (sa)) |
| 284 | { |
| 285 | if (dst_port != IPSEC_UDP_PORT_NONE && |
| 286 | dst_port != clib_net_to_host_u16 (sa->udp_hdr.dst_port)) |
| 287 | { |
| 288 | if (ipsec_sa_is_set_IS_INBOUND (sa)) |
| 289 | { |
| 290 | ipsec_unregister_udp_port ( |
| 291 | clib_net_to_host_u16 (sa->udp_hdr.dst_port), |
| 292 | !ipsec_sa_is_set_IS_TUNNEL_V6 (sa)); |
| 293 | ipsec_register_udp_port (dst_port, |
| 294 | !ipsec_sa_is_set_IS_TUNNEL_V6 (sa)); |
| 295 | } |
| 296 | sa->udp_hdr.dst_port = clib_host_to_net_u16 (dst_port); |
| 297 | } |
| 298 | if (src_port != IPSEC_UDP_PORT_NONE && |
| 299 | src_port != clib_net_to_host_u16 (sa->udp_hdr.src_port)) |
| 300 | sa->udp_hdr.src_port = clib_host_to_net_u16 (src_port); |
| 301 | } |
| 302 | return (0); |
| 303 | } |
| 304 | |
| 305 | int |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 306 | ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, |
| 307 | ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, |
| 308 | ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, |
| 309 | ipsec_sa_flags_t flags, u32 salt, u16 src_port, |
| 310 | u16 dst_port, const tunnel_t *tun, u32 *sa_out_index) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 311 | { |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 312 | vlib_main_t *vm = vlib_get_main (); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 313 | ipsec_main_t *im = &ipsec_main; |
| 314 | clib_error_t *err; |
| 315 | ipsec_sa_t *sa; |
| 316 | u32 sa_index; |
| 317 | uword *p; |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 318 | int rv; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 319 | |
| 320 | p = hash_get (im->sa_index_by_sa_id, id); |
| 321 | if (p) |
| 322 | return VNET_API_ERROR_ENTRY_ALREADY_EXISTS; |
| 323 | |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 324 | pool_get_aligned_zero (ipsec_sa_pool, sa, CLIB_CACHE_LINE_BYTES); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 325 | |
| 326 | fib_node_init (&sa->node, FIB_NODE_TYPE_IPSEC_SA); |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 327 | fib_node_lock (&sa->node); |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 328 | sa_index = sa - ipsec_sa_pool; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 329 | |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 330 | vlib_validate_combined_counter (&ipsec_sa_counters, sa_index); |
| 331 | vlib_zero_combined_counter (&ipsec_sa_counters, sa_index); |
Neale Ranns | e11203e | 2021-09-21 12:34:19 +0000 | [diff] [blame] | 332 | vlib_validate_simple_counter (&ipsec_sa_lost_counters, sa_index); |
| 333 | vlib_zero_simple_counter (&ipsec_sa_lost_counters, sa_index); |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 334 | |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 335 | tunnel_copy (tun, &sa->tunnel); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 336 | sa->id = id; |
| 337 | sa->spi = spi; |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 338 | sa->stat_index = sa_index; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 339 | sa->protocol = proto; |
Neale Ranns | 2b5ba95 | 2019-04-02 10:15:40 +0000 | [diff] [blame] | 340 | sa->flags = flags; |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 341 | sa->salt = salt; |
Neale Ranns | 1a52d37 | 2021-02-04 11:33:32 +0000 | [diff] [blame] | 342 | sa->thread_index = (vlib_num_workers ()) ? ~0 : 0; |
Filip Tehlar | c41217a | 2019-10-18 17:51:06 +0000 | [diff] [blame] | 343 | if (integ_alg != IPSEC_INTEG_ALG_NONE) |
| 344 | { |
| 345 | ipsec_sa_set_integ_alg (sa, integ_alg); |
| 346 | clib_memcpy (&sa->integ_key, ik, sizeof (sa->integ_key)); |
| 347 | } |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 348 | ipsec_sa_set_crypto_alg (sa, crypto_alg); |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 349 | ipsec_sa_set_async_op_ids (sa); |
| 350 | |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 351 | clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key)); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 352 | |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 353 | sa->crypto_key_index = vnet_crypto_key_add (vm, |
| 354 | im->crypto_algs[crypto_alg].alg, |
| 355 | (u8 *) ck->data, ck->len); |
Benoît Ganne | be95444 | 2019-04-29 16:05:46 +0200 | [diff] [blame] | 356 | if (~0 == sa->crypto_key_index) |
Neale Ranns | e6be702 | 2019-06-04 15:37:34 +0000 | [diff] [blame] | 357 | { |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 358 | pool_put (ipsec_sa_pool, sa); |
Neale Ranns | e6be702 | 2019-06-04 15:37:34 +0000 | [diff] [blame] | 359 | return VNET_API_ERROR_KEY_LENGTH; |
| 360 | } |
Benoît Ganne | be95444 | 2019-04-29 16:05:46 +0200 | [diff] [blame] | 361 | |
Filip Tehlar | c41217a | 2019-10-18 17:51:06 +0000 | [diff] [blame] | 362 | if (integ_alg != IPSEC_INTEG_ALG_NONE) |
Neale Ranns | e6be702 | 2019-06-04 15:37:34 +0000 | [diff] [blame] | 363 | { |
Filip Tehlar | c41217a | 2019-10-18 17:51:06 +0000 | [diff] [blame] | 364 | sa->integ_key_index = vnet_crypto_key_add (vm, |
| 365 | im-> |
| 366 | integ_algs[integ_alg].alg, |
| 367 | (u8 *) ik->data, ik->len); |
| 368 | if (~0 == sa->integ_key_index) |
| 369 | { |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 370 | pool_put (ipsec_sa_pool, sa); |
Filip Tehlar | c41217a | 2019-10-18 17:51:06 +0000 | [diff] [blame] | 371 | return VNET_API_ERROR_KEY_LENGTH; |
| 372 | } |
Neale Ranns | e6be702 | 2019-06-04 15:37:34 +0000 | [diff] [blame] | 373 | } |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 374 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 375 | if (sa->async_op_data.crypto_async_enc_op_id && |
| 376 | !ipsec_sa_is_set_IS_AEAD (sa)) |
| 377 | { //AES-CBC & HMAC |
| 378 | sa->async_op_data.linked_key_index = |
| 379 | vnet_crypto_key_add_linked (vm, sa->crypto_key_index, |
| 380 | sa->integ_key_index); |
| 381 | } |
| 382 | |
| 383 | if (im->async_mode) |
| 384 | sa->crypto_op_data = sa->async_op_data.data; |
| 385 | else |
Neale Ranns | f16e9a5 | 2021-02-25 19:09:24 +0000 | [diff] [blame] | 386 | { |
| 387 | if (ipsec_sa_is_set_IS_ASYNC (sa)) |
| 388 | { |
| 389 | vnet_crypto_request_async_mode (1); |
| 390 | sa->crypto_op_data = sa->async_op_data.data; |
| 391 | } |
| 392 | else |
| 393 | sa->crypto_op_data = sa->sync_op_data.data; |
| 394 | } |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 395 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 396 | err = ipsec_check_support_cb (im, sa); |
| 397 | if (err) |
| 398 | { |
| 399 | clib_warning ("%s", err->what); |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 400 | pool_put (ipsec_sa_pool, sa); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 401 | return VNET_API_ERROR_UNIMPLEMENTED; |
| 402 | } |
| 403 | |
| 404 | err = ipsec_call_add_del_callbacks (im, sa, sa_index, 1); |
| 405 | if (err) |
| 406 | { |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 407 | pool_put (ipsec_sa_pool, sa); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 408 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
| 409 | } |
| 410 | |
Neale Ranns | 53dd08c | 2021-06-24 15:41:03 +0000 | [diff] [blame] | 411 | if (ipsec_sa_is_set_IS_TUNNEL (sa) && |
| 412 | AF_IP6 == ip_addr_version (&tun->t_src)) |
| 413 | ipsec_sa_set_IS_TUNNEL_V6 (sa); |
| 414 | |
Neale Ranns | 2b5ba95 | 2019-04-02 10:15:40 +0000 | [diff] [blame] | 415 | if (ipsec_sa_is_set_IS_TUNNEL (sa) && !ipsec_sa_is_set_IS_INBOUND (sa)) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 416 | { |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 417 | sa->tunnel_flags = sa->tunnel.t_encap_decap_flags; |
| 418 | |
| 419 | rv = tunnel_resolve (&sa->tunnel, FIB_NODE_TYPE_IPSEC_SA, sa_index); |
| 420 | |
| 421 | if (rv) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 422 | { |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 423 | pool_put (ipsec_sa_pool, sa); |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 424 | return rv; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 425 | } |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 426 | ipsec_sa_stack (sa); |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 427 | |
| 428 | /* generate header templates */ |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 429 | if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa)) |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 430 | { |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 431 | tunnel_build_v6_hdr (&sa->tunnel, |
| 432 | (ipsec_sa_is_set_UDP_ENCAP (sa) ? |
| 433 | IP_PROTOCOL_UDP : |
| 434 | IP_PROTOCOL_IPSEC_ESP), |
| 435 | &sa->ip6_hdr); |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 436 | } |
| 437 | else |
| 438 | { |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 439 | tunnel_build_v4_hdr (&sa->tunnel, |
| 440 | (ipsec_sa_is_set_UDP_ENCAP (sa) ? |
| 441 | IP_PROTOCOL_UDP : |
| 442 | IP_PROTOCOL_IPSEC_ESP), |
| 443 | &sa->ip4_hdr); |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 444 | } |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 445 | } |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 446 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 447 | if (ipsec_sa_is_set_UDP_ENCAP (sa)) |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 448 | { |
Filip Tehlar | e5d3491 | 2020-03-02 15:17:37 +0000 | [diff] [blame] | 449 | if (dst_port == IPSEC_UDP_PORT_NONE) |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 450 | sa->udp_hdr.dst_port = clib_host_to_net_u16 (UDP_DST_PORT_ipsec); |
Filip Tehlar | e5d3491 | 2020-03-02 15:17:37 +0000 | [diff] [blame] | 451 | else |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 452 | sa->udp_hdr.dst_port = clib_host_to_net_u16 (dst_port); |
| 453 | |
| 454 | if (src_port == IPSEC_UDP_PORT_NONE) |
| 455 | sa->udp_hdr.src_port = clib_host_to_net_u16 (UDP_DST_PORT_ipsec); |
| 456 | else |
| 457 | sa->udp_hdr.src_port = clib_host_to_net_u16 (src_port); |
| 458 | |
| 459 | if (ipsec_sa_is_set_IS_INBOUND (sa)) |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame] | 460 | ipsec_register_udp_port (clib_host_to_net_u16 (sa->udp_hdr.dst_port), |
| 461 | !ipsec_sa_is_set_IS_TUNNEL_V6 (sa)); |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 462 | } |
| 463 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 464 | hash_set (im->sa_index_by_sa_id, sa->id, sa_index); |
| 465 | |
| 466 | if (sa_out_index) |
| 467 | *sa_out_index = sa_index; |
| 468 | |
| 469 | return (0); |
| 470 | } |
| 471 | |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 472 | static void |
| 473 | ipsec_sa_del (ipsec_sa_t * sa) |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 474 | { |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 475 | vlib_main_t *vm = vlib_get_main (); |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 476 | ipsec_main_t *im = &ipsec_main; |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 477 | u32 sa_index; |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 478 | |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 479 | sa_index = sa - ipsec_sa_pool; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 480 | hash_unset (im->sa_index_by_sa_id, sa->id); |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 481 | tunnel_unresolve (&sa->tunnel); |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 482 | |
| 483 | /* no recovery possible when deleting an SA */ |
| 484 | (void) ipsec_call_add_del_callbacks (im, sa, sa_index, 0); |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 485 | |
Neale Ranns | f16e9a5 | 2021-02-25 19:09:24 +0000 | [diff] [blame] | 486 | if (ipsec_sa_is_set_IS_ASYNC (sa)) |
| 487 | vnet_crypto_request_async_mode (0); |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 488 | if (ipsec_sa_is_set_UDP_ENCAP (sa) && ipsec_sa_is_set_IS_INBOUND (sa)) |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame] | 489 | ipsec_unregister_udp_port (clib_net_to_host_u16 (sa->udp_hdr.dst_port), |
| 490 | !ipsec_sa_is_set_IS_TUNNEL_V6 (sa)); |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 491 | |
Neale Ranns | 2b5ba95 | 2019-04-02 10:15:40 +0000 | [diff] [blame] | 492 | if (ipsec_sa_is_set_IS_TUNNEL (sa) && !ipsec_sa_is_set_IS_INBOUND (sa)) |
Neale Ranns | 9ec846c | 2021-02-09 14:04:02 +0000 | [diff] [blame] | 493 | dpo_reset (&sa->dpo); |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 494 | vnet_crypto_key_del (vm, sa->crypto_key_index); |
Filip Tehlar | c41217a | 2019-10-18 17:51:06 +0000 | [diff] [blame] | 495 | if (sa->integ_alg != IPSEC_INTEG_ALG_NONE) |
| 496 | vnet_crypto_key_del (vm, sa->integ_key_index); |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 497 | pool_put (ipsec_sa_pool, sa); |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 498 | } |
| 499 | |
| 500 | void |
| 501 | ipsec_sa_unlock (index_t sai) |
| 502 | { |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 503 | ipsec_sa_t *sa; |
| 504 | |
| 505 | if (INDEX_INVALID == sai) |
| 506 | return; |
| 507 | |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 508 | sa = ipsec_sa_get (sai); |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 509 | |
| 510 | fib_node_unlock (&sa->node); |
| 511 | } |
| 512 | |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 513 | void |
| 514 | ipsec_sa_lock (index_t sai) |
| 515 | { |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 516 | ipsec_sa_t *sa; |
| 517 | |
| 518 | if (INDEX_INVALID == sai) |
| 519 | return; |
| 520 | |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 521 | sa = ipsec_sa_get (sai); |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 522 | |
| 523 | fib_node_lock (&sa->node); |
| 524 | } |
| 525 | |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 526 | index_t |
| 527 | ipsec_sa_find_and_lock (u32 id) |
| 528 | { |
| 529 | ipsec_main_t *im = &ipsec_main; |
| 530 | ipsec_sa_t *sa; |
| 531 | uword *p; |
| 532 | |
| 533 | p = hash_get (im->sa_index_by_sa_id, id); |
| 534 | |
| 535 | if (!p) |
| 536 | return INDEX_INVALID; |
| 537 | |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 538 | sa = ipsec_sa_get (p[0]); |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 539 | |
| 540 | fib_node_lock (&sa->node); |
| 541 | |
| 542 | return (p[0]); |
| 543 | } |
| 544 | |
| 545 | int |
| 546 | ipsec_sa_unlock_id (u32 id) |
| 547 | { |
| 548 | ipsec_main_t *im = &ipsec_main; |
| 549 | uword *p; |
| 550 | |
| 551 | p = hash_get (im->sa_index_by_sa_id, id); |
| 552 | |
| 553 | if (!p) |
| 554 | return VNET_API_ERROR_NO_SUCH_ENTRY; |
| 555 | |
| 556 | ipsec_sa_unlock (p[0]); |
| 557 | |
| 558 | return (0); |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 559 | } |
| 560 | |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 561 | void |
| 562 | ipsec_sa_clear (index_t sai) |
| 563 | { |
| 564 | vlib_zero_combined_counter (&ipsec_sa_counters, sai); |
Neale Ranns | e11203e | 2021-09-21 12:34:19 +0000 | [diff] [blame] | 565 | vlib_zero_simple_counter (&ipsec_sa_lost_counters, sai); |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 566 | } |
| 567 | |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 568 | void |
| 569 | ipsec_sa_walk (ipsec_sa_walk_cb_t cb, void *ctx) |
| 570 | { |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 571 | ipsec_sa_t *sa; |
| 572 | |
| 573 | /* *INDENT-OFF* */ |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 574 | pool_foreach (sa, ipsec_sa_pool) |
| 575 | { |
| 576 | if (WALK_CONTINUE != cb (sa, ctx)) |
| 577 | break; |
| 578 | } |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 579 | /* *INDENT-ON* */ |
| 580 | } |
| 581 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 582 | /** |
| 583 | * Function definition to get a FIB node from its index |
| 584 | */ |
| 585 | static fib_node_t * |
| 586 | ipsec_sa_fib_node_get (fib_node_index_t index) |
| 587 | { |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 588 | ipsec_sa_t *sa; |
| 589 | |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 590 | sa = ipsec_sa_get (index); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 591 | |
| 592 | return (&sa->node); |
| 593 | } |
| 594 | |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 595 | static ipsec_sa_t * |
| 596 | ipsec_sa_from_fib_node (fib_node_t * node) |
| 597 | { |
| 598 | ASSERT (FIB_NODE_TYPE_IPSEC_SA == node->fn_type); |
| 599 | return ((ipsec_sa_t *) (((char *) node) - |
| 600 | STRUCT_OFFSET_OF (ipsec_sa_t, node))); |
| 601 | |
| 602 | } |
| 603 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 604 | /** |
| 605 | * Function definition to inform the FIB node that its last lock has gone. |
| 606 | */ |
| 607 | static void |
| 608 | ipsec_sa_last_lock_gone (fib_node_t * node) |
| 609 | { |
| 610 | /* |
| 611 | * The ipsec SA is a root of the graph. As such |
| 612 | * it never has children and thus is never locked. |
| 613 | */ |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 614 | ipsec_sa_del (ipsec_sa_from_fib_node (node)); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 615 | } |
| 616 | |
| 617 | /** |
| 618 | * Function definition to backwalk a FIB node |
| 619 | */ |
| 620 | static fib_node_back_walk_rc_t |
| 621 | ipsec_sa_back_walk (fib_node_t * node, fib_node_back_walk_ctx_t * ctx) |
| 622 | { |
| 623 | ipsec_sa_stack (ipsec_sa_from_fib_node (node)); |
| 624 | |
| 625 | return (FIB_NODE_BACK_WALK_CONTINUE); |
| 626 | } |
| 627 | |
| 628 | /* |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 629 | * Virtual function table registered by SAs |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 630 | * for participation in the FIB object graph. |
| 631 | */ |
| 632 | const static fib_node_vft_t ipsec_sa_vft = { |
| 633 | .fnv_get = ipsec_sa_fib_node_get, |
| 634 | .fnv_last_lock = ipsec_sa_last_lock_gone, |
| 635 | .fnv_back_walk = ipsec_sa_back_walk, |
| 636 | }; |
| 637 | |
| 638 | /* force inclusion from application's main.c */ |
| 639 | clib_error_t * |
| 640 | ipsec_sa_interface_init (vlib_main_t * vm) |
| 641 | { |
| 642 | fib_node_register_type (FIB_NODE_TYPE_IPSEC_SA, &ipsec_sa_vft); |
| 643 | |
| 644 | return 0; |
| 645 | } |
| 646 | |
| 647 | VLIB_INIT_FUNCTION (ipsec_sa_interface_init); |
| 648 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 649 | /* |
| 650 | * fd.io coding-style-patch-verification: ON |
| 651 | * |
| 652 | * Local Variables: |
| 653 | * eval: (c-set-style "gnu") |
| 654 | * End: |
| 655 | */ |