diff options
Diffstat (limited to 'src/vnet/ipsec/ipsec_api.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec_api.c | 106 |
1 files changed, 106 insertions, 0 deletions
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index 3a5b89feb7d..ae62ade35fb 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -53,6 +53,7 @@ _(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ _(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \ _(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \ _(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \ +_(IPSEC_SA_DUMP, ipsec_sa_dump) \ _(IPSEC_SPD_DUMP, ipsec_spd_dump) \ _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ _(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \ @@ -402,6 +403,111 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * })); } +static void +send_ipsec_sa_details (ipsec_sa_t * sa, unix_shared_memory_queue_t * q, + u32 context, u32 sw_if_index) +{ + vl_api_ipsec_sa_details_t *mp; + + mp = vl_msg_api_alloc (sizeof (*mp)); + memset (mp, 0, sizeof (*mp)); + mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS); + mp->context = context; + + mp->sa_id = htonl (sa->id); + mp->sw_if_index = htonl (sw_if_index); + + mp->spi = htonl (sa->spi); + mp->protocol = sa->protocol; + + mp->crypto_alg = sa->crypto_alg; + mp->crypto_key_len = sa->crypto_key_len; + memcpy (mp->crypto_key, sa->crypto_key, sa->crypto_key_len); + + mp->integ_alg = sa->integ_alg; + mp->integ_key_len = sa->integ_key_len; + memcpy (mp->integ_key, sa->integ_key, sa->integ_key_len); + + mp->use_esn = sa->use_esn; + mp->use_anti_replay = sa->use_anti_replay; + + mp->is_tunnel = sa->is_tunnel; + mp->is_tunnel_ip6 = sa->is_tunnel_ip6; + + if (sa->is_tunnel) + { + if (sa->is_tunnel_ip6) + { + memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip6, 16); + memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip6, 16); + } + else + { + memcpy (mp->tunnel_src_addr, &sa->tunnel_src_addr.ip4, 4); + memcpy (mp->tunnel_dst_addr, &sa->tunnel_dst_addr.ip4, 4); + } + } + + mp->salt = clib_host_to_net_u32 (sa->salt); + mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq)); + mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq)); + if (sa->use_esn) + { + mp->seq_outbound |= (u64) (clib_host_to_net_u32 (sa->seq_hi)); + mp->last_seq_inbound |= (u64) (clib_host_to_net_u32 (sa->last_seq_hi)); + } + if (sa->use_anti_replay) + mp->replay_window = clib_host_to_net_u64 (sa->replay_window); + mp->total_data_size = clib_host_to_net_u64 (sa->total_data_size); + + vl_msg_api_send_shmem (q, (u8 *) & mp); +} + + +static void +vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp) +{ + unix_shared_memory_queue_t *q; + ipsec_main_t *im = &ipsec_main; + vnet_main_t *vnm = im->vnet_main; + ipsec_sa_t *sa; + ipsec_tunnel_if_t *t; + u32 *sa_index_to_tun_if_index = 0; + +#if WITH_LIBSSL > 0 + q = vl_api_client_index_to_input_queue (mp->client_index); + if (q == 0 || pool_elts (im->sad) == 0) + return; + + vec_validate_init_empty (sa_index_to_tun_if_index, vec_len (im->sad) - 1, + ~0); + + /* *INDENT-OFF* */ + pool_foreach (t, im->tunnel_interfaces, + ({ + vnet_hw_interface_t *hi; + u32 sw_if_index = ~0; + + hi = vnet_get_hw_interface (vnm, t->hw_if_index); + sw_if_index = hi->sw_if_index; + sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index; + sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index; + })); + + pool_foreach (sa, im->sad, + ({ + if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id) + send_ipsec_sa_details (sa, q, mp->context, + sa_index_to_tun_if_index[sa - im->sad]); + })); + /* *INDENT-ON* */ + + vec_free (sa_index_to_tun_if_index); +#else + clib_warning ("unimplemented"); +#endif +} + static void vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp) |