Add API support to dump IPsec SAs

Add an API request message type to dump IPsec SAs. Either
all IPsec SAs can be dumped or it can be limited to a single
SA ID (numeric ID set at creation time - not an index).
Add a handler for incoming messages with the new request type.
Add an API response message type containing the data
for an IPsec SA.
Add VAT support for new message type.

Change-Id: Id7828d000efc637dee7f988a87d3f707a8b466b7
Signed-off-by: Matthew Smith <mgsmith@netgate.com>

1 files changed, 106 insertions, 0 deletions

diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index 3a5b89feb7d..ae62ade35fb 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -53,6 +53,7 @@ _(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd)             \
 _(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry)                     \
 _(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry)                     \
 _(IPSEC_SA_SET_KEY, ipsec_sa_set_key)                                   \
+_(IPSEC_SA_DUMP, ipsec_sa_dump)                                         \
 _(IPSEC_SPD_DUMP, ipsec_spd_dump)                                       \
 _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del)                     \
 _(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del)                         \
@@ -402,6 +403,111 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t *
 							}));
 }
 
+static void
+send_ipsec_sa_details (ipsec_sa_t * sa, unix_shared_memory_queue_t * q,
+		       u32 context, u32 sw_if_index)
+{
+  vl_api_ipsec_sa_details_t *mp;
+
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS);
+  mp->context = context;
+
+  mp->sa_id = htonl (sa->id);
+  mp->sw_if_index = htonl (sw_if_index);
+
+  mp->spi = htonl (sa->spi);
+  mp->protocol = sa->protocol;
+
+  mp->crypto_alg = sa->crypto_alg;
+  mp->crypto_key_len = sa->crypto_key_len;
+  memcpy (mp->crypto_key, sa->crypto_key, sa->crypto_key_len);
+
+  mp->integ_alg = sa->integ_alg;
+  mp->integ_key_len = sa->integ_key_len;
+  memcpy (mp->integ_key, sa->integ_key, sa->integ_key_len);
+
+  mp->use_esn = sa->use_esn;
+  mp->use_anti_replay = sa->use_anti_replay;
+
+  mp->is_tunnel = sa->is_tunnel;
+  mp->is_tunnel_ip6 = sa->is_tunnel_ip6;
+
+  if (sa->is_tunnel)
+    {
+      if (sa->is_tunnel_ip6)
+	{
+	  memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip6, 16);
+	  memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip6, 16);
+	}
+      else
+	{
+	  memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip4, 4);
+	  memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip4, 4);
+	}
+    }
+
+  mp->salt = clib_host_to_net_u32 (sa->salt);
+  mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq));
+  mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq));
+  if (sa->use_esn)
+    {
+      mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi));
+      mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi));
+    }
+  if (sa->use_anti_replay)
+    mp->replay_window = clib_host_to_net_u64 (sa->replay_window);
+  mp->total_data_size = clib_host_to_net_u64 (sa->total_data_size);
+
+  vl_msg_api_send_shmem (q, (u8 *) & mp);
+}
+
+
+static void
+vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp)
+{
+  unix_shared_memory_queue_t *q;
+  ipsec_main_t *im = &ipsec_main;
+  vnet_main_t *vnm = im->vnet_main;
+  ipsec_sa_t *sa;
+  ipsec_tunnel_if_t *t;
+  u32 *sa_index_to_tun_if_index = 0;
+
+#if WITH_LIBSSL > 0
+  q = vl_api_client_index_to_input_queue (mp->client_index);
+  if (q == 0 || pool_elts (im->sad) == 0)
+    return;
+
+  vec_validate_init_empty (sa_index_to_tun_if_index, vec_len (im->sad) - 1,
+			   ~0);
+
+  /* *INDENT-OFF* */
+  pool_foreach (t, im->tunnel_interfaces,
+  ({
+    vnet_hw_interface_t *hi;
+    u32 sw_if_index = ~0;
+
+    hi = vnet_get_hw_interface (vnm, t->hw_if_index);
+    sw_if_index = hi->sw_if_index;
+    sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index;
+    sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index;
+  }));
+
+  pool_foreach (sa, im->sad,
+  ({
+    if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id)
+      send_ipsec_sa_details (sa, q, mp->context,
+			     sa_index_to_tun_if_index[sa - im->sad]);
+  }));
+  /* *INDENT-ON* */
+
+  vec_free (sa_index_to_tun_if_index);
+#else
+  clib_warning ("unimplemented");
+#endif
+}
+
 
 static void
 vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp)