API refactoring : lisp

[vpp.git] / vnet / vnet / ipsec / ipsec.c

diff --git a/vnet/vnet/ipsec/ipsec.c b/vnet/vnet/ipsec/ipsec.c
index 3e34383..ee85c40 100644 (file)
--- a/vnet/vnet/ipsec/ipsec.c
+++ b/vnet/vnet/ipsec/ipsec.c
@@ -21,9 +21,25 @@
 #include <vnet/interface.h>
 
 #include <vnet/ipsec/ipsec.h>
-#include <vnet/ipsec/esp.h>
 #include <vnet/ipsec/ikev2.h>
 
+#if DPDK_CRYPTO==1
+#include <vnet/devices/dpdk/ipsec/esp.h>
+#define ESP_NODE "dpdk-esp-encrypt"
+#else
+#include <vnet/ipsec/esp.h>
+#define ESP_NODE "esp-encrypt"
+#endif
+
+#if DPDK_CRYPTO==0
+/* dummy function */
+static int
+add_del_sa_sess (u32 sa_index, u8 is_add)
+{
+  return 0;
+}
+#endif
+
 u32
 ipsec_get_sa_index_by_sa_id (u32 sa_id)
 {
@@ -40,11 +56,9 @@ ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
                         int is_add)
 {
   ipsec_main_t *im = &ipsec_main;
-  ip_lookup_main_t *lm;
-  ip_config_main_t *rx_cm;
   ip4_ipsec_config_t config;
 
-  u32 spd_index, ci;
+  u32 spd_index;
   uword *p;
 
   p = hash_get (im->spd_index_by_spd_id, spd_id);
@@ -70,33 +84,16 @@ ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
                sw_if_index, spd_id, spd_index);
 
   /* enable IPsec on TX */
-  vnet_interface_add_del_feature (im->vnet_main, vm, sw_if_index,
-                                 INTF_OUTPUT_FEAT_IPSEC, is_add);
+  vnet_feature_enable_disable ("ip4-output", "ipsec-output-ip4", sw_if_index,
+                              is_add, 0, 0);
+  vnet_feature_enable_disable ("ip6-output", "ipsec-output-ip6", sw_if_index,
+                              is_add, 0, 0);
 
   /* enable IPsec on RX */
-  config.spd_index = spd_index;
-
-  /* IPv4 */
-  lm = &ip4_main.lookup_main;
-  rx_cm = &lm->feature_config_mains[VNET_IP_RX_UNICAST_FEAT];
-
-  ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
-
-  ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
-    (vm, &rx_cm->config_main,
-     ci, ip4_main.ip4_unicast_rx_feature_ipsec, &config, sizeof (config));
-  rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
-
-  /* IPv6 */
-  lm = &ip6_main.lookup_main;
-  rx_cm = &lm->feature_config_mains[VNET_IP_RX_UNICAST_FEAT];
-
-  ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
-
-  ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
-    (vm, &rx_cm->config_main,
-     ci, ip6_main.ip6_unicast_rx_feature_ipsec, &config, sizeof (config));
-  rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
+  vnet_feature_enable_disable ("ip4-unicast", "ipsec-input-ip4", sw_if_index,
+                              is_add, &config, sizeof (config));
+  vnet_feature_enable_disable ("ip6-unicast", "ipsec-input-ip6", sw_if_index,
+                              is_add, &config, sizeof (config));
 
   return 0;
 }
@@ -452,6 +449,7 @@ ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
          return VNET_API_ERROR_SYSCALL_ERROR_1;        /* sa used in policy */
        }
       hash_unset (im->sa_index_by_sa_id, sa->id);
+      add_del_sa_sess (sa_index, is_add);
       pool_put (im->sad, sa);
     }
   else                         /* create new SA */
@@ -460,6 +458,8 @@ ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
       clib_memcpy (sa, new_sa, sizeof (*sa));
       sa_index = sa - im->sad;
       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
+      if (add_del_sa_sess (sa_index, is_add) < 0)
+       return VNET_API_ERROR_SYSCALL_ERROR_1;
     }
   return 0;
 }
@@ -495,6 +495,12 @@ ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
       sa->integ_key_len = sa_update->integ_key_len;
     }
 
+  if (sa->crypto_key_len + sa->integ_key_len > 0)
+    {
+      if (add_del_sa_sess (sa_index, 0) < 0)
+       return VNET_API_ERROR_SYSCALL_ERROR_1;
+    }
+
   return 0;
 }
 
@@ -541,7 +547,8 @@ ipsec_init (vlib_main_t * vm)
   ASSERT (node);
   im->error_drop_node_index = node->index;
 
-  node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
+  node = vlib_get_node_by_name (vm, (u8 *) ESP_NODE);
+
   ASSERT (node);
   im->esp_encrypt_node_index = node->index;
 
@@ -549,7 +556,6 @@ ipsec_init (vlib_main_t * vm)
   ASSERT (node);
   im->ip4_lookup_node_index = node->index;
 
-
   if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
     return error;