ipsec: infra for selecting backends

Change-Id: Ifa6d8391b1b2413a88b7720fc434e0bc849a149a
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>

1 files changed, 118 insertions, 31 deletions

diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index ced2c9ce6cd..f2333646cd0 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -47,35 +47,37 @@
 
 #include <vlibapi/api_helper_macros.h>
 
-#define foreach_vpe_api_msg                                             \
-_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del)                                 \
-_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd)             \
-_(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry)                     \
-_(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry)                     \
-_(IPSEC_SA_SET_KEY, ipsec_sa_set_key)                                   \
-_(IPSEC_SA_DUMP, ipsec_sa_dump)                                         \
-_(IPSEC_SPDS_DUMP, ipsec_spds_dump)                                     \
-_(IPSEC_SPD_DUMP, ipsec_spd_dump)                                       \
-_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump)			\
-_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del)                     \
-_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key)                     \
-_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa)                       \
-_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del)                         \
-_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth)                       \
-_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id)                           \
-_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts)                           \
-_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key)                             \
-_(IKEV2_SET_RESPONDER, ikev2_set_responder)                             \
-_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms)                   \
-_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms)                   \
-_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime)                         \
-_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init)                       \
-_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa)                 \
-_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa)             \
-_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa)
-
-static void vl_api_ipsec_spd_add_del_t_handler
-  (vl_api_ipsec_spd_add_del_t * mp)
+#define foreach_vpe_api_msg                                     \
+_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del)                         \
+_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd)     \
+_(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry)             \
+_(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry)             \
+_(IPSEC_SA_SET_KEY, ipsec_sa_set_key)                           \
+_(IPSEC_SA_DUMP, ipsec_sa_dump)                                 \
+_(IPSEC_SPDS_DUMP, ipsec_spds_dump)                             \
+_(IPSEC_SPD_DUMP, ipsec_spd_dump)                               \
+_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump)		\
+_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del)             \
+_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key)             \
+_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa)               \
+_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del)                 \
+_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth)               \
+_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id)                   \
+_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts)                   \
+_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key)                     \
+_(IKEV2_SET_RESPONDER, ikev2_set_responder)                     \
+_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms)           \
+_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms)           \
+_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime)                 \
+_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init)               \
+_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa)         \
+_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa)     \
+_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa) \
+_(IPSEC_SELECT_BACKEND, ipsec_select_backend)                   \
+_(IPSEC_BACKEND_DUMP, ipsec_backend_dump)
+
+static void
+vl_api_ipsec_spd_add_del_t_handler (vl_api_ipsec_spd_add_del_t * mp)
 {
 #if WITH_LIBSSL == 0
   clib_warning ("unimplemented");
@@ -234,8 +236,7 @@ static void vl_api_ipsec_sad_add_del_entry_t_handler
     }
   sa.use_anti_replay = mp->use_anti_replay;
 
-  ASSERT (im->cb.check_support_cb);
-  clib_error_t *err = im->cb.check_support_cb (&sa);
+  clib_error_t *err = ipsec_check_support_cb (im, &sa);
   if (err)
     {
       clib_warning ("%s", err->what);
@@ -999,6 +1000,92 @@ setup_message_id_table (api_main_t * am)
 #undef _
 }
 
+static void
+vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp)
+{
+  vl_api_registration_t *rp;
+  ipsec_main_t *im = &ipsec_main;
+  u32 context = mp->context;
+
+  rp = vl_api_client_index_to_registration (mp->client_index);
+
+  if (rp == 0)
+    {
+      clib_warning ("Client %d AWOL", mp->client_index);
+      return;
+    }
+
+  ipsec_ah_backend_t *ab;
+  ipsec_esp_backend_t *eb;
+  /* *INDENT-OFF* */
+  pool_foreach (ab, im->ah_backends, {
+    vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
+    clib_memset (mp, 0, sizeof (*mp));
+    mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
+    mp->context = context;
+    snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (ab->name),
+              ab->name);
+    mp->protocol = IPSEC_PROTOCOL_AH;
+    mp->index = ab - im->ah_backends;
+    mp->active = mp->index == im->ah_current_backend ? 1 : 0;
+    vl_api_send_msg (rp, (u8 *)mp);
+  });
+  pool_foreach (eb, im->esp_backends, {
+    vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp));
+    clib_memset (mp, 0, sizeof (*mp));
+    mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS);
+    mp->context = context;
+    snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (eb->name),
+              eb->name);
+    mp->protocol = IPSEC_PROTOCOL_ESP;
+    mp->index = eb - im->esp_backends;
+    mp->active = mp->index == im->esp_current_backend ? 1 : 0;
+    vl_api_send_msg (rp, (u8 *)mp);
+  });
+  /* *INDENT-ON* */
+}
+
+static void
+vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp)
+{
+  ipsec_main_t *im = &ipsec_main;
+  vl_api_ipsec_select_backend_reply_t *rmp;
+  int rv = 0;
+  if (pool_elts (im->sad) > 0)
+    {
+      rv = VNET_API_ERROR_INSTANCE_IN_USE;
+      goto done;
+    }
+#if WITH_LIBSSL > 0
+  switch (mp->protocol)
+    {
+    case IPSEC_PROTOCOL_ESP:
+      if (pool_is_free_index (im->esp_backends, mp->index))
+	{
+	  rv = VNET_API_ERROR_INVALID_VALUE;
+	  break;
+	}
+      ipsec_select_esp_backend (im, mp->index);
+      break;
+    case IPSEC_PROTOCOL_AH:
+      if (pool_is_free_index (im->ah_backends, mp->index))
+	{
+	  rv = VNET_API_ERROR_INVALID_VALUE;
+	  break;
+	}
+      ipsec_select_ah_backend (im, mp->index);
+      break;
+    default:
+      rv = VNET_API_ERROR_INVALID_VALUE;
+      break;
+    }
+#else
+  clib_warning ("unimplemented");	/* FIXME */
+#endif
+done:
+  REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY);
+}
+
 static clib_error_t *
 ipsec_api_hookup (vlib_main_t * vm)
 {