#include <vnet/interface.h>
#include <vnet/ipsec/ipsec.h>
-#include <vnet/ipsec/esp.h>
#include <vnet/ipsec/ikev2.h>
+#if DPDK_CRYPTO==1
+#include <vnet/devices/dpdk/ipsec/esp.h>
+#define ESP_NODE "dpdk-esp-encrypt"
+#else
+#include <vnet/ipsec/esp.h>
+#define ESP_NODE "esp-encrypt"
+#endif
+
+#if DPDK_CRYPTO==0
+/* dummy function */
+static int
+add_del_sa_sess (u32 sa_index, u8 is_add)
+{
+ return 0;
+}
+#endif
+
+u32
+ipsec_get_sa_index_by_sa_id (u32 sa_id)
+{
+ ipsec_main_t *im = &ipsec_main;
+ uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
+ if (!p)
+ return ~0;
+
+ return p[0];
+}
+
int
ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
int is_add)
{
ipsec_main_t *im = &ipsec_main;
- ip_lookup_main_t *lm;
- ip_config_main_t *rx_cm;
ip4_ipsec_config_t config;
- u32 spd_index, ci;
+ u32 spd_index;
uword *p;
p = hash_get (im->spd_index_by_spd_id, spd_id);
sw_if_index, spd_id, spd_index);
/* enable IPsec on TX */
- vnet_interface_add_del_feature (im->vnet_main, vm, sw_if_index,
- INTF_OUTPUT_FEAT_IPSEC, is_add);
+ vnet_feature_enable_disable ("ip4-output", "ipsec-output-ip4", sw_if_index,
+ is_add, 0, 0);
+ vnet_feature_enable_disable ("ip6-output", "ipsec-output-ip6", sw_if_index,
+ is_add, 0, 0);
/* enable IPsec on RX */
- config.spd_index = spd_index;
-
- /* IPv4 */
- lm = &ip4_main.lookup_main;
- rx_cm = &lm->rx_config_mains[VNET_UNICAST];
-
- ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
-
- ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
- (vm, &rx_cm->config_main,
- ci, ip4_main.ip4_unicast_rx_feature_ipsec, &config, sizeof (config));
- rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
-
- /* IPv6 */
- lm = &ip6_main.lookup_main;
- rx_cm = &lm->rx_config_mains[VNET_UNICAST];
-
- ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
-
- ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
- (vm, &rx_cm->config_main,
- ci, ip6_main.ip6_unicast_rx_feature_ipsec, &config, sizeof (config));
- rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
+ vnet_feature_enable_disable ("ip4-unicast", "ipsec-input-ip4", sw_if_index,
+ is_add, &config, sizeof (config));
+ vnet_feature_enable_disable ("ip6-unicast", "ipsec-input-ip6", sw_if_index,
+ is_add, &config, sizeof (config));
return 0;
}
vec_add1 (spd->ipv6_inbound_protect_policy_indices,
policy_index);
clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
- vec_sort_with_function (spd->
- ipv6_inbound_protect_policy_indices,
- ipsec_spd_entry_sort);
+ vec_sort_with_function
+ (spd->ipv6_inbound_protect_policy_indices,
+ ipsec_spd_entry_sort);
}
else
{
- vec_add1 (spd->
- ipv6_inbound_policy_discard_and_bypass_indices,
- policy_index);
+ vec_add1
+ (spd->ipv6_inbound_policy_discard_and_bypass_indices,
+ policy_index);
clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
- vec_sort_with_function (spd->
- ipv6_inbound_policy_discard_and_bypass_indices,
- ipsec_spd_entry_sort);
+ vec_sort_with_function
+ (spd->ipv6_inbound_policy_discard_and_bypass_indices,
+ ipsec_spd_entry_sort);
}
}
else
vec_add1 (spd->ipv4_inbound_protect_policy_indices,
policy_index);
clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
- vec_sort_with_function (spd->
- ipv4_inbound_protect_policy_indices,
- ipsec_spd_entry_sort);
+ vec_sort_with_function
+ (spd->ipv4_inbound_protect_policy_indices,
+ ipsec_spd_entry_sort);
}
else
{
- vec_add1 (spd->
- ipv4_inbound_policy_discard_and_bypass_indices,
- policy_index);
+ vec_add1
+ (spd->ipv4_inbound_policy_discard_and_bypass_indices,
+ policy_index);
clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
- vec_sort_with_function (spd->
- ipv4_inbound_policy_discard_and_bypass_indices,
- ipsec_spd_entry_sort);
+ vec_sort_with_function
+ (spd->ipv4_inbound_policy_discard_and_bypass_indices,
+ ipsec_spd_entry_sort);
}
}
}
u32 i, j;
/* *INDENT-OFF* */
pool_foreach_index(i, spd->policies, ({
- vp = pool_elt_at_index(spd->policies, i);
+ vp = pool_elt_at_index(spd->policies, i);
if (vp->priority != policy->priority)
continue;
if (vp->is_outbound != policy->is_outbound)
vec_del1 (spd->ipv4_outbound_policies, j);
break;
}
- }
+ }
}
else
{
ipsec_main_t *im = &ipsec_main;
ipsec_spd_t *spd;
ipsec_policy_t *p;
+ ipsec_tunnel_if_t *t;
/* *INDENT-OFF* */
pool_foreach(spd, im->spds, ({
}
}));
}));
+
+ pool_foreach(t, im->tunnel_interfaces, ({
+ if (t->input_sa_index == sa_index)
+ return 1;
+ if (t->output_sa_index == sa_index)
+ return 1;
+ }));
/* *INDENT-ON* */
return 0;
return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
}
hash_unset (im->sa_index_by_sa_id, sa->id);
+ add_del_sa_sess (sa_index, is_add);
pool_put (im->sad, sa);
}
else /* create new SA */
clib_memcpy (sa, new_sa, sizeof (*sa));
sa_index = sa - im->sad;
hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
+ if (add_del_sa_sess (sa_index, is_add) < 0)
+ return VNET_API_ERROR_SYSCALL_ERROR_1;
}
return 0;
}
sa->integ_key_len = sa_update->integ_key_len;
}
+ if (sa->crypto_key_len + sa->integ_key_len > 0)
+ {
+ if (add_del_sa_sess (sa_index, 0) < 0)
+ return VNET_API_ERROR_SYSCALL_ERROR_1;
+ }
+
return 0;
}
ASSERT (node);
im->error_drop_node_index = node->index;
- node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
+ node = vlib_get_node_by_name (vm, (u8 *) ESP_NODE);
+
ASSERT (node);
im->esp_encrypt_node_index = node->index;
ASSERT (node);
im->ip4_lookup_node_index = node->index;
-
if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
return error;
Code Review / vpp.git / blobdiff