diff options
Diffstat (limited to 'src/vnet/ipsec/ipsec_api.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec_api.c | 149 |
1 files changed, 118 insertions, 31 deletions
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index ced2c9ce6cd..f2333646cd0 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -47,35 +47,37 @@ #include <vlibapi/api_helper_macros.h> -#define foreach_vpe_api_msg \ -_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \ -_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ -_(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \ -_(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \ -_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \ -_(IPSEC_SA_DUMP, ipsec_sa_dump) \ -_(IPSEC_SPDS_DUMP, ipsec_spds_dump) \ -_(IPSEC_SPD_DUMP, ipsec_spd_dump) \ -_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ -_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ -_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \ -_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \ -_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \ -_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \ -_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \ -_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \ -_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \ -_(IKEV2_SET_RESPONDER, ikev2_set_responder) \ -_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \ -_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \ -_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \ -_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \ -_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \ -_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \ -_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa) - -static void vl_api_ipsec_spd_add_del_t_handler - (vl_api_ipsec_spd_add_del_t * mp) +#define foreach_vpe_api_msg \ +_(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \ +_(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ +_(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry) \ +_(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry) \ +_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \ +_(IPSEC_SA_DUMP, ipsec_sa_dump) \ +_(IPSEC_SPDS_DUMP, ipsec_spds_dump) \ +_(IPSEC_SPD_DUMP, ipsec_spd_dump) \ +_(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ +_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ +_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \ +_(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \ +_(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \ +_(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \ +_(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \ +_(IKEV2_PROFILE_SET_TS, ikev2_profile_set_ts) \ +_(IKEV2_SET_LOCAL_KEY, ikev2_set_local_key) \ +_(IKEV2_SET_RESPONDER, ikev2_set_responder) \ +_(IKEV2_SET_IKE_TRANSFORMS, ikev2_set_ike_transforms) \ +_(IKEV2_SET_ESP_TRANSFORMS, ikev2_set_esp_transforms) \ +_(IKEV2_SET_SA_LIFETIME, ikev2_set_sa_lifetime) \ +_(IKEV2_INITIATE_SA_INIT, ikev2_initiate_sa_init) \ +_(IKEV2_INITIATE_DEL_IKE_SA, ikev2_initiate_del_ike_sa) \ +_(IKEV2_INITIATE_DEL_CHILD_SA, ikev2_initiate_del_child_sa) \ +_(IKEV2_INITIATE_REKEY_CHILD_SA, ikev2_initiate_rekey_child_sa) \ +_(IPSEC_SELECT_BACKEND, ipsec_select_backend) \ +_(IPSEC_BACKEND_DUMP, ipsec_backend_dump) + +static void +vl_api_ipsec_spd_add_del_t_handler (vl_api_ipsec_spd_add_del_t * mp) { #if WITH_LIBSSL == 0 clib_warning ("unimplemented"); @@ -234,8 +236,7 @@ static void vl_api_ipsec_sad_add_del_entry_t_handler } sa.use_anti_replay = mp->use_anti_replay; - ASSERT (im->cb.check_support_cb); - clib_error_t *err = im->cb.check_support_cb (&sa); + clib_error_t *err = ipsec_check_support_cb (im, &sa); if (err) { clib_warning ("%s", err->what); @@ -999,6 +1000,92 @@ setup_message_id_table (api_main_t * am) #undef _ } +static void +vl_api_ipsec_backend_dump_t_handler (vl_api_ipsec_backend_dump_t * mp) +{ + vl_api_registration_t *rp; + ipsec_main_t *im = &ipsec_main; + u32 context = mp->context; + + rp = vl_api_client_index_to_registration (mp->client_index); + + if (rp == 0) + { + clib_warning ("Client %d AWOL", mp->client_index); + return; + } + + ipsec_ah_backend_t *ab; + ipsec_esp_backend_t *eb; + /* *INDENT-OFF* */ + pool_foreach (ab, im->ah_backends, { + vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp)); + clib_memset (mp, 0, sizeof (*mp)); + mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS); + mp->context = context; + snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (ab->name), + ab->name); + mp->protocol = IPSEC_PROTOCOL_AH; + mp->index = ab - im->ah_backends; + mp->active = mp->index == im->ah_current_backend ? 1 : 0; + vl_api_send_msg (rp, (u8 *)mp); + }); + pool_foreach (eb, im->esp_backends, { + vl_api_ipsec_backend_details_t *mp = vl_msg_api_alloc (sizeof (*mp)); + clib_memset (mp, 0, sizeof (*mp)); + mp->_vl_msg_id = ntohs (VL_API_IPSEC_BACKEND_DETAILS); + mp->context = context; + snprintf ((char *)mp->name, sizeof (mp->name), "%.*s", vec_len (eb->name), + eb->name); + mp->protocol = IPSEC_PROTOCOL_ESP; + mp->index = eb - im->esp_backends; + mp->active = mp->index == im->esp_current_backend ? 1 : 0; + vl_api_send_msg (rp, (u8 *)mp); + }); + /* *INDENT-ON* */ +} + +static void +vl_api_ipsec_select_backend_t_handler (vl_api_ipsec_select_backend_t * mp) +{ + ipsec_main_t *im = &ipsec_main; + vl_api_ipsec_select_backend_reply_t *rmp; + int rv = 0; + if (pool_elts (im->sad) > 0) + { + rv = VNET_API_ERROR_INSTANCE_IN_USE; + goto done; + } +#if WITH_LIBSSL > 0 + switch (mp->protocol) + { + case IPSEC_PROTOCOL_ESP: + if (pool_is_free_index (im->esp_backends, mp->index)) + { + rv = VNET_API_ERROR_INVALID_VALUE; + break; + } + ipsec_select_esp_backend (im, mp->index); + break; + case IPSEC_PROTOCOL_AH: + if (pool_is_free_index (im->ah_backends, mp->index)) + { + rv = VNET_API_ERROR_INVALID_VALUE; + break; + } + ipsec_select_ah_backend (im, mp->index); + break; + default: + rv = VNET_API_ERROR_INVALID_VALUE; + break; + } +#else + clib_warning ("unimplemented"); /* FIXME */ +#endif +done: + REPLY_MACRO (VL_API_IPSEC_SELECT_BACKEND_REPLY); +} + static clib_error_t * ipsec_api_hookup (vlib_main_t * vm) { |