X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_if.c;h=8e0fba28badb643b26297e4b4e5a6622d0ee7053;hb=f2922422d972644e67d1ca989e40cd0100ecb06d;hp=bfdc2bb6814f6ced2d20c5a12380551d339cb757;hpb=e524d45eff40c773049e03ea5063216b469bbfcc;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index bfdc2bb6814..8e0fba28bad 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -230,6 +230,28 @@ ipsec_tun_mk_output_sa_id (u32 ti)
   return (0xc0000000 | ti);
 }
 
+static void
+ipsec_tunnel_feature_set (ipsec_main_t * im, ipsec_tunnel_if_t * t, u8 enable)
+{
+  u8 arc;
+
+  arc = vnet_get_feature_arc_index ("ip4-output");
+
+  vnet_feature_enable_disable_with_index (arc,
+					  im->esp4_encrypt_tun_feature_index,
+					  t->sw_if_index, enable,
+					  &t->output_sa_index,
+					  sizeof (t->output_sa_index));
+
+  arc = vnet_get_feature_arc_index ("ip6-output");
+
+  vnet_feature_enable_disable_with_index (arc,
+					  im->esp6_encrypt_tun_feature_index,
+					  t->sw_if_index, enable,
+					  &t->output_sa_index,
+					  sizeof (t->output_sa_index));
+}
+
 int
 ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 				  ipsec_add_del_tunnel_args_t * args,
@@ -306,8 +328,9 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 			 &crypto_key,
 			 args->integ_alg,
 			 &integ_key,
-			 flags,
+			 (flags | IPSEC_SA_FLAG_IS_INBOUND),
 			 args->tx_table_id,
+			 args->salt,
 			 &args->remote_ip,
 			 &args->local_ip, &t->input_sa_index);
 
@@ -328,6 +351,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 			 &integ_key,
 			 flags,
 			 args->tx_table_id,
+			 args->salt,
 			 &args->local_ip,
 			 &args->remote_ip, &t->output_sa_index);
 
@@ -360,16 +384,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 			       ~0);
       im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance;
 
-      vnet_feature_enable_disable ("ip4-output",
-				   "esp4-encrypt-tun",
-				   t->sw_if_index, 1,
-				   &t->output_sa_index,
-				   sizeof (t->output_sa_index));
-      vnet_feature_enable_disable ("ip6-output",
-				   "esp6-encrypt-tun",
-				   t->sw_if_index, 1,
-				   &t->output_sa_index,
-				   sizeof (t->output_sa_index));
+      ipsec_tunnel_feature_set (im, t, 1);
 
       /*1st interface, register protocol */
       if (pool_elts (im->tunnel_interfaces) == 1)
@@ -394,16 +409,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
       hi = vnet_get_hw_interface (vnm, t->hw_if_index);
       vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0);	/* admin down */
 
-      vnet_feature_enable_disable ("ip4-output",
-				   "esp4-encrypt-tun",
-				   hi->sw_if_index, 0,
-				   &t->output_sa_index,
-				   sizeof (t->output_sa_index));
-      vnet_feature_enable_disable ("ip6-output",
-				   "esp6-encrypt-tun",
-				   hi->sw_if_index, 0,
-				   &t->output_sa_index,
-				   sizeof (t->output_sa_index));
+      ipsec_tunnel_feature_set (im, t, 0);
       vnet_delete_hw_interface (vnm, t->hw_if_index);
 
       if (is_ip6)
@@ -507,52 +513,6 @@ ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm,
   return 0;
 }
 
-int
-ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index,
-			 ipsec_if_set_key_type_t type, u8 alg, u8 * key)
-{
-  ipsec_main_t *im = &ipsec_main;
-  vnet_hw_interface_t *hi;
-  ipsec_tunnel_if_t *t;
-  ipsec_sa_t *sa;
-
-  hi = vnet_get_hw_interface (vnm, hw_if_index);
-  t = pool_elt_at_index (im->tunnel_interfaces, hi->dev_instance);
-
-  if (hi->flags & VNET_HW_INTERFACE_FLAG_LINK_UP)
-    return VNET_API_ERROR_SYSCALL_ERROR_1;
-
-  if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO)
-    {
-      sa = pool_elt_at_index (im->sad, t->output_sa_index);
-      ipsec_sa_set_crypto_alg (sa, alg);
-      ipsec_mk_key (&sa->crypto_key, key, vec_len (key));
-    }
-  else if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG)
-    {
-      sa = pool_elt_at_index (im->sad, t->output_sa_index);
-      ipsec_sa_set_integ_alg (sa, alg);
-      ipsec_mk_key (&sa->integ_key, key, vec_len (key));
-    }
-  else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO)
-    {
-      sa = pool_elt_at_index (im->sad, t->input_sa_index);
-      ipsec_sa_set_crypto_alg (sa, alg);
-      ipsec_mk_key (&sa->crypto_key, key, vec_len (key));
-    }
-  else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG)
-    {
-      sa = pool_elt_at_index (im->sad, t->input_sa_index);
-      ipsec_sa_set_integ_alg (sa, alg);
-      ipsec_mk_key (&sa->integ_key, key, vec_len (key));
-    }
-  else
-    return VNET_API_ERROR_INVALID_VALUE;
-
-  return 0;
-}
-
-
 int
 ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
 			u8 is_outbound)
@@ -647,7 +607,13 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
 	  return VNET_API_ERROR_INVALID_VALUE;
 	}
 
+      /*
+       * re-enable the feature to get the new SA in
+       * the workers are stopped so no packets are sent in the clear
+       */
+      ipsec_tunnel_feature_set (im, t, 0);
       t->output_sa_index = sa_index;
+      ipsec_tunnel_feature_set (im, t, 1);
     }
 
   /* remove sa_id to sa_index mapping on old SA */
@@ -659,12 +625,11 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
       clib_warning ("IPsec backend add/del callback returned error");
       return VNET_API_ERROR_SYSCALL_ERROR_1;
     }
-  pool_put (im->sad, old_sa);
+  ipsec_sa_del (old_sa->id);
 
   return 0;
 }
 
-
 clib_error_t *
 ipsec_tunnel_if_init (vlib_main_t * vm)
 {