X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_tun.c;h=ea60ab44a8c786ff379790f9c3d3557f4361491f;hb=4a58e49cf;hp=9116df5d7e347418c7baf047f87f61e9737899aa;hpb=6ba4e41d33ffda2596d9d4b3a1d7fdd3c9a6b870;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_tun.c b/src/vnet/ipsec/ipsec_tun.c
index 9116df5d7e3..ea60ab44a8c 100644
--- a/src/vnet/ipsec/ipsec_tun.c
+++ b/src/vnet/ipsec/ipsec_tun.c
@@ -141,33 +141,48 @@ ipsec_tun_protect_get_adj_next (vnet_link_t linkt,
 {
   ipsec_main_t *im;
   ipsec_sa_t *sa;
-  bool is_ip4;
   u32 next;
 
-
-  if (itp->itp_flags & IPSEC_PROTECT_ITF)
-    is_ip4 = linkt == VNET_LINK_IP4;
-  else
-    is_ip4 = ip46_address_is_ip4 (&itp->itp_tun.src);
+  if (!(itp->itp_flags & IPSEC_PROTECT_ITF))
+    {
+      if (ip46_address_is_ip4 (&itp->itp_tun.src))
+	linkt = VNET_LINK_IP4;
+      else
+	linkt = VNET_LINK_IP6;
+    }
 
   sa = ipsec_sa_get (itp->itp_out_sa);
   im = &ipsec_main;
+  next = 0;
 
   if ((sa->crypto_alg == IPSEC_CRYPTO_ALG_NONE &&
        sa->integ_alg == IPSEC_INTEG_ALG_NONE) &&
       !(itp->itp_flags & IPSEC_PROTECT_ITF))
-    next = (is_ip4 ?
-	    im->esp4_no_crypto_tun_node_index :
-	    im->esp6_no_crypto_tun_node_index);
+    next = (VNET_LINK_IP4 == linkt ? im->esp4_no_crypto_tun_node_index :
+				     im->esp6_no_crypto_tun_node_index);
   else if (itp->itp_flags & IPSEC_PROTECT_L2)
-    next = (is_ip4 ?
-	    im->esp4_encrypt_l2_tun_node_index :
-	    im->esp6_encrypt_l2_tun_node_index);
+    next = (VNET_LINK_IP4 == linkt ? im->esp4_encrypt_l2_tun_node_index :
+				     im->esp6_encrypt_l2_tun_node_index);
   else
-    next = (is_ip4 ?
-	    im->esp4_encrypt_tun_node_index :
-	    im->esp6_encrypt_tun_node_index);
-
+    {
+      switch (linkt)
+	{
+	case VNET_LINK_IP4:
+	  next = im->esp4_encrypt_tun_node_index;
+	  break;
+	case VNET_LINK_IP6:
+	  next = im->esp6_encrypt_tun_node_index;
+	  break;
+	case VNET_LINK_MPLS:
+	  next = im->esp_mpls_encrypt_tun_node_index;
+	  break;
+	case VNET_LINK_ARP:
+	case VNET_LINK_NSH:
+	case VNET_LINK_ETHERNET:
+	  ASSERT (0);
+	  break;
+	}
+    }
   return (next);
 }
 
@@ -529,111 +544,6 @@ ipsec_tun_protect_unconfig (ipsec_main_t * im, ipsec_tun_protect_t * itp)
   ITP_DBG (itp, "unconfigured");
 }
 
-int
-ipsec_tun_protect_update_one (u32 sw_if_index,
-			      const ip_address_t * nh, u32 sa_out, u32 sa_in)
-{
-  u32 *sas_in = NULL;
-  int rv;
-
-  vec_add1 (sas_in, sa_in);
-  rv = ipsec_tun_protect_update (sw_if_index, nh, sa_out, sas_in);
-
-  return (rv);
-}
-
-int
-ipsec_tun_protect_update_out (u32 sw_if_index,
-			      const ip_address_t * nh, u32 sa_out)
-{
-  u32 itpi, *sas_in, sai, *saip;
-  ipsec_tun_protect_t *itp;
-  ipsec_main_t *im;
-  int rv;
-
-  sas_in = NULL;
-  rv = 0;
-  im = &ipsec_main;
-
-  itpi = ipsec_tun_protect_find (sw_if_index, nh);
-
-  if (INDEX_INVALID == itpi)
-    {
-      return (VNET_API_ERROR_INVALID_INTERFACE);
-    }
-
-  itp = pool_elt_at_index (ipsec_tun_protect_pool, itpi);
-
-  /* *INDENT-OFF* */
-  FOR_EACH_IPSEC_PROTECT_INPUT_SAI (itp, sai,
-  ({
-    ipsec_sa_lock (sai);
-    vec_add1 (sas_in, sai);
-  }));
-  /* *INDENT-ON* */
-
-  sa_out = ipsec_sa_find_and_lock (sa_out);
-
-  if (~0 == sa_out)
-    {
-      rv = VNET_API_ERROR_INVALID_VALUE;
-      goto out;
-    }
-
-  ipsec_tun_protect_unconfig (im, itp);
-  ipsec_tun_protect_config (im, itp, sa_out, sas_in);
-
-  ipsec_sa_unlock (sa_out);
-  vec_foreach (saip, sas_in) ipsec_sa_unlock (*saip);
-
-out:
-  vec_free (sas_in);
-  return (rv);
-}
-
-int
-ipsec_tun_protect_update_in (u32 sw_if_index,
-			     const ip_address_t * nh, u32 sa_in)
-{
-  u32 itpi, *sas_in, sa_out;
-  ipsec_tun_protect_t *itp;
-  ipsec_main_t *im;
-  int rv;
-
-  sas_in = NULL;
-  rv = 0;
-  im = &ipsec_main;
-  itpi = ipsec_tun_protect_find (sw_if_index, nh);
-
-  if (INDEX_INVALID == itpi)
-    {
-      return (VNET_API_ERROR_INVALID_INTERFACE);
-    }
-
-  sa_in = ipsec_sa_find_and_lock (sa_in);
-
-  if (~0 == sa_in)
-    {
-      rv = VNET_API_ERROR_INVALID_VALUE;
-      goto out;
-    }
-  vec_add1 (sas_in, sa_in);
-
-  itp = pool_elt_at_index (ipsec_tun_protect_pool, itpi);
-  sa_out = itp->itp_out_sa;
-
-  ipsec_sa_lock (sa_out);
-
-  ipsec_tun_protect_unconfig (im, itp);
-  ipsec_tun_protect_config (im, itp, sa_out, sas_in);
-
-  ipsec_sa_unlock (sa_out);
-  ipsec_sa_unlock (sa_in);
-out:
-  vec_free (sas_in);
-  return (rv);
-}
-
 static void
 ipsec_tun_protect_update_from_teib (ipsec_tun_protect_t * itp,
 				    const teib_entry_t * ne)
@@ -838,10 +748,10 @@ ipsec_tun_protect_walk (ipsec_tun_protect_walk_cb_t fn, void *ctx)
   index_t itpi;
 
   /* *INDENT-OFF* */
-  pool_foreach_index(itpi, ipsec_tun_protect_pool,
-  ({
+  pool_foreach_index (itpi, ipsec_tun_protect_pool)
+   {
     fn (itpi, ctx);
-  }));
+  }
   /* *INDENT-ON* */
 }
 
@@ -972,7 +882,7 @@ const static teib_vft_t ipsec_tun_teib_vft = {
   .nv_deleted = ipsec_tun_teib_entry_deleted,
 };
 
-void
+static void
 ipsec_tun_table_init (ip_address_family_t af, uword table_size, u32 n_buckets)
 {
   ipsec_main_t *im;
@@ -987,8 +897,8 @@ ipsec_tun_table_init (ip_address_family_t af, uword table_size, u32 n_buckets)
 			    "IPSec IPv6 tunnels", n_buckets, table_size);
 }
 
-clib_error_t *
-ipsec_tunnel_protect_init (vlib_main_t * vm)
+static clib_error_t *
+ipsec_tunnel_protect_init (vlib_main_t *vm)
 {
   ipsec_main_t *im;