/* * ipsec_if.c : IPSec interface support * * Copyright (c) 2015 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include #include #include #include #include #include void vl_api_rpc_call_main_thread (void *fp, u8 * data, u32 data_length); static u8 * format_ipsec_name (u8 * s, va_list * args) { u32 dev_instance = va_arg (*args, u32); ipsec_main_t *im = &ipsec_main; ipsec_tunnel_if_t *t = im->tunnel_interfaces + dev_instance; return format (s, "ipsec%d", t->show_instance); } /* Statistics (not really errors) */ #define foreach_ipsec_if_tx_error \ _(TX, "good packets transmitted") static void ipsec_if_tunnel_stack (adj_index_t ai) { ipsec_main_t *ipm = &ipsec_main; ipsec_tunnel_if_t *it; ip_adjacency_t *adj; u32 sw_if_index; adj = adj_get (ai); sw_if_index = adj->rewrite_header.sw_if_index; if ((vec_len (ipm->ipsec_if_by_sw_if_index) <= sw_if_index) || (~0 == ipm->ipsec_if_by_sw_if_index[sw_if_index])) return; it = pool_elt_at_index (ipm->tunnel_interfaces, ipm->ipsec_if_by_sw_if_index[sw_if_index]); if (!vnet_hw_interface_is_link_up (vnet_get_main (), it->hw_if_index)) { adj_midchain_delegate_unstack (ai); } else { ipsec_sa_t *sa; sa = ipsec_sa_get (it->output_sa_index); /* *INDENT-OFF* */ fib_prefix_t pfx = { .fp_addr = sa->tunnel_dst_addr, .fp_len = (ipsec_sa_is_set_IS_TUNNEL_V6(sa) ? 128 : 32), .fp_proto = (ipsec_sa_is_set_IS_TUNNEL_V6(sa) ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4), }; /* *INDENT-ON* */ adj_midchain_delegate_stack (ai, sa->tx_fib_index, &pfx); } } /** * @brief Call back when restacking all adjacencies on a GRE interface */ static adj_walk_rc_t ipsec_if_adj_walk_cb (adj_index_t ai, void *ctx) { ipsec_if_tunnel_stack (ai); return (ADJ_WALK_RC_CONTINUE); } static void ipsec_if_tunnel_restack (ipsec_tunnel_if_t * it) { fib_protocol_t proto; /* * walk all the adjacencies on th GRE interface and restack them */ FOR_EACH_FIB_IP_PROTOCOL (proto) { adj_nbr_walk (it->sw_if_index, proto, ipsec_if_adj_walk_cb, NULL); } } static clib_error_t * ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags) { ipsec_main_t *im = &ipsec_main; clib_error_t *err = 0; ipsec_tunnel_if_t *t; vnet_hw_interface_t *hi; ipsec_sa_t *sa; hi = vnet_get_hw_interface (vnm, hw_if_index); t = pool_elt_at_index (im->tunnel_interfaces, hi->hw_instance); t->flags = flags; if (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP) { sa = pool_elt_at_index (im->sad, t->input_sa_index); err = ipsec_check_support_cb (im, sa); if (err) return err; err = ipsec_add_del_sa_sess_cb (im, t->input_sa_index, 1); if (err) return err; sa = pool_elt_at_index (im->sad, t->output_sa_index); err = ipsec_check_support_cb (im, sa); if (err) return err; err = ipsec_add_del_sa_sess_cb (im, t->output_sa_index, 1); if (err) return err; vnet_hw_interface_set_flags (vnm, hw_if_index, VNET_HW_INTERFACE_FLAG_LINK_UP); } else { vnet_hw_interface_set_flags (vnm, hw_if_index, 0 /* down */ ); sa = pool_elt_at_index (im->sad, t->input_sa_index); err = ipsec_add_del_sa_sess_cb (im, t->input_sa_index, 0); if (err) return err; sa = pool_elt_at_index (im->sad, t->output_sa_index); err = ipsec_add_del_sa_sess_cb (im, t->output_sa_index, 0); if (err) return err; } ipsec_if_tunnel_restack (t); return (NULL); } static u8 * ipsec_if_build_rewrite (vnet_main_t * vnm, u32 sw_if_index, vnet_link_t link_type, const void *dst_address) { return (NULL); } static void ipsec_if_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai) { adj_nbr_midchain_update_rewrite (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK, ipsec_if_build_rewrite (vnm, sw_if_index, adj_get_link_type (ai), NULL)); ipsec_if_tunnel_stack (ai); } /* *INDENT-OFF* */ VNET_DEVICE_CLASS (ipsec_device_class) = { .name = "IPSec", .format_device_name = format_ipsec_name, .admin_up_down_function = ipsec_admin_up_down_function, }; /* *INDENT-ON* */ /* *INDENT-OFF* */ VNET_HW_INTERFACE_CLASS (ipsec_hw_class) = { .name = "IPSec", .build_rewrite = default_build_rewrite, .update_adjacency = ipsec_if_update_adj, .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P, }; /* *INDENT-ON* */ static int ipsec_add_del_tunnel_if_rpc_callback (ipsec_add_del_tunnel_args_t * a) { vnet_main_t *vnm = vnet_get_main (); ASSERT (vlib_get_thread_index () == 0); return ipsec_add_del_tunnel_if_internal (vnm, a, NULL); } int ipsec_add_del_tunnel_if (ipsec_add_del_tunnel_args_t * args) { vl_api_rpc_call_main_thread (ipsec_add_del_tunnel_if_rpc_callback, (u8 *) args, sizeof (*args)); return 0; } static u32 ipsec_tun_mk_input_sa_id (u32 ti) { return (0x80000000 | ti); } static u32 ipsec_tun_mk_output_sa_id (u32 ti) { return (0xc0000000 | ti); } static void ipsec_tunnel_feature_set (ipsec_main_t * im, ipsec_tunnel_if_t * t, u8 enable) { u8 arc; arc = vnet_get_feature_arc_index 
/*
 * Copyright (c) 2016 Cisco and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifndef included_clib_ptclosure_h
#define included_clib_ptclosure_h

#include <vppinfra/vec.h>
#include <vppinfra/format.h>
#include <vppinfra/error.h>

/*
 * set r[i][j] if item i "bears the relation to" item j
 *
 */

u8 **clib_ptclosure_alloc (int n);
void clib_ptclosure_free (u8 ** ptc);
void clib_ptclosure_copy (u8 ** dst, u8 ** src);
u8 **clib_ptclosure (u8 ** orig);

#endif /* included_clib_ptclosure_h */

/*
 * fd.io coding-style-patch-verification: ON
 *
 * Local Variables:
 * eval: (c-set-style "gnu")
 * End:
 */
x_by_sa_id, old_sa->id); if (ipsec_add_del_sa_sess_cb (im, old_sa_index, 0)) { clib_warning ("IPsec backend add/del callback returned error"); return VNET_API_ERROR_SYSCALL_ERROR_1; } ipsec_sa_del (old_sa->id); return 0; } clib_error_t * ipsec_tunnel_if_init (vlib_main_t * vm) { ipsec_main_t *im = &ipsec_main; /* initialize the ipsec-if ip4 hash */ im->ipsec4_if_pool_index_by_key = hash_create (0, sizeof (ipsec4_tunnel_key_t)); /* initialize the ipsec-if ip6 hash */ im->ipsec6_if_pool_index_by_key = hash_create_mem (0, sizeof (ipsec6_tunnel_key_t), sizeof (uword)); im->ipsec_if_real_dev_by_show_dev = hash_create (0, sizeof (uword)); udp_register_dst_port (vm, UDP_DST_PORT_ipsec, ipsec4_if_input_node.index, 1); return 0; } VLIB_INIT_FUNCTION (ipsec_tunnel_if_init); /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */