X-Git-Url: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_api.c;h=177300aeb9adc870ab2a15bd406184a818caacdf;hp=99e25f1b17a3e2da3b0993d8249565529f1aa818;hb=e5d34919b;hpb=c87b66c86201458c0475d50c6e93f1497f9eec2e diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index 99e25f1b17a..177300aeb9a 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -24,7 +24,9 @@ #include #include #include +#include #include +#include #include @@ -114,6 +116,7 @@ static void vl_api_ipsec_tunnel_protect_update_t_handler vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main (); vl_api_ipsec_tunnel_protect_update_reply_t *rmp; u32 sw_if_index, ii, *sa_ins = NULL; + ip_address_t nh; int rv; sw_if_index = ntohl (mp->tunnel.sw_if_index); @@ -125,7 +128,9 @@ static void vl_api_ipsec_tunnel_protect_update_t_handler for (ii = 0; ii < mp->tunnel.n_sa_in; ii++) vec_add1 (sa_ins, ntohl (mp->tunnel.sa_in[ii])); - rv = ipsec_tun_protect_update (sw_if_index, + ip_address_decode2 (&mp->tunnel.nh, &nh); + + rv = ipsec_tun_protect_update (sw_if_index, &nh, ntohl (mp->tunnel.sa_out), sa_ins); #else rv = VNET_API_ERROR_UNIMPLEMENTED; @@ -141,15 +146,17 @@ static void vl_api_ipsec_tunnel_protect_del_t_handler { vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main (); vl_api_ipsec_tunnel_protect_del_reply_t *rmp; - int rv; + ip_address_t nh; u32 sw_if_index; + int rv; sw_if_index = ntohl (mp->sw_if_index); VALIDATE_SW_IF_INDEX (mp); #if WITH_LIBSSL > 0 - rv = ipsec_tun_protect_del (sw_if_index); + ip_address_decode2 (&mp->nh, &nh); + rv = ipsec_tun_protect_del (sw_if_index, &nh); #else rv = VNET_API_ERROR_UNIMPLEMENTED; #endif @@ -159,29 +166,29 @@ static void vl_api_ipsec_tunnel_protect_del_t_handler REPLY_MACRO (VL_API_IPSEC_TUNNEL_PROTECT_DEL_REPLY); } -typedef struct ipsec_tunnel_protect_walk_ctx_t_ +typedef struct ipsec_dump_walk_ctx_t_ { vl_api_registration_t *reg; u32 context; -} ipsec_tunnel_protect_walk_ctx_t; +} ipsec_dump_walk_ctx_t; static walk_rc_t send_ipsec_tunnel_protect_details (index_t itpi, void *arg) { - ipsec_tunnel_protect_walk_ctx_t *ctx = arg; + ipsec_dump_walk_ctx_t *ctx = arg; vl_api_ipsec_tunnel_protect_details_t *mp; ipsec_tun_protect_t *itp; u32 sai, ii = 0; itp = ipsec_tun_protect_get (itpi); - mp = vl_msg_api_alloc (sizeof (*mp) + (sizeof (u32) * itp->itp_n_sa_in)); clib_memset (mp, 0, sizeof (*mp)); mp->_vl_msg_id = ntohs (VL_API_IPSEC_TUNNEL_PROTECT_DETAILS); mp->context = ctx->context; mp->tun.sw_if_index = htonl (itp->itp_sw_if_index); + ip_address_encode2 (itp->itp_key, &mp->tun.nh); mp->tun.sa_out = htonl (itp->itp_out_sa); mp->tun.n_sa_in = itp->itp_n_sa_in; @@ -209,7 +216,7 @@ vl_api_ipsec_tunnel_protect_dump_t_handler (vl_api_ipsec_tunnel_protect_dump_t if (!reg) return; - ipsec_tunnel_protect_walk_ctx_t ctx = { + ipsec_dump_walk_ctx_t ctx = { .reg = reg, .context = mp->context, }; @@ -222,12 +229,8 @@ vl_api_ipsec_tunnel_protect_dump_t_handler (vl_api_ipsec_tunnel_protect_dump_t } else { - index_t itpi; - - itpi = ipsec_tun_protect_find (sw_if_index); - - if (INDEX_INVALID != itpi) - send_ipsec_tunnel_protect_details (itpi, &ctx); + ipsec_tun_protect_walk_itf (sw_if_index, + send_ipsec_tunnel_protect_details, &ctx); } #else clib_warning ("unimplemented"); @@ -278,11 +281,10 @@ static void vl_api_ipsec_spd_entry_add_del_t_handler p.is_ipv6 = (itype == IP46_TYPE_IP6); p.protocol = mp->entry.protocol; - /* leave the ports in network order */ - p.rport.start = mp->entry.remote_port_start; - p.rport.stop = mp->entry.remote_port_stop; - p.lport.start = mp->entry.local_port_start; - p.lport.stop = mp->entry.local_port_stop; + p.rport.start = ntohs (mp->entry.remote_port_start); + p.rport.stop = ntohs (mp->entry.remote_port_stop); + p.lport.start = ntohs (mp->entry.local_port_start); + p.lport.stop = ntohs (mp->entry.local_port_stop); rv = ipsec_spd_action_decode (mp->entry.policy, &p.policy); @@ -321,154 +323,6 @@ out: /* *INDENT-ON* */ } -static int -ipsec_proto_decode (vl_api_ipsec_proto_t in, ipsec_protocol_t * out) -{ - in = clib_net_to_host_u32 (in); - - switch (in) - { - case IPSEC_API_PROTO_ESP: - *out = IPSEC_PROTOCOL_ESP; - return (0); - case IPSEC_API_PROTO_AH: - *out = IPSEC_PROTOCOL_AH; - return (0); - } - return (VNET_API_ERROR_INVALID_PROTOCOL); -} - -static vl_api_ipsec_proto_t -ipsec_proto_encode (ipsec_protocol_t p) -{ - switch (p) - { - case IPSEC_PROTOCOL_ESP: - return clib_host_to_net_u32 (IPSEC_API_PROTO_ESP); - case IPSEC_PROTOCOL_AH: - return clib_host_to_net_u32 (IPSEC_API_PROTO_AH); - } - return (VNET_API_ERROR_UNIMPLEMENTED); -} - -static int -ipsec_crypto_algo_decode (vl_api_ipsec_crypto_alg_t in, - ipsec_crypto_alg_t * out) -{ - in = clib_net_to_host_u32 (in); - - switch (in) - { -#define _(v,f,s) case IPSEC_API_CRYPTO_ALG_##f: \ - *out = IPSEC_CRYPTO_ALG_##f; \ - return (0); - foreach_ipsec_crypto_alg -#undef _ - } - return (VNET_API_ERROR_INVALID_ALGORITHM); -} - -static vl_api_ipsec_crypto_alg_t -ipsec_crypto_algo_encode (ipsec_crypto_alg_t c) -{ - switch (c) - { -#define _(v,f,s) case IPSEC_CRYPTO_ALG_##f: \ - return clib_host_to_net_u32(IPSEC_API_CRYPTO_ALG_##f); - foreach_ipsec_crypto_alg -#undef _ - case IPSEC_CRYPTO_N_ALG: - break; - } - ASSERT (0); - return (VNET_API_ERROR_UNIMPLEMENTED); -} - - -static int -ipsec_integ_algo_decode (vl_api_ipsec_integ_alg_t in, ipsec_integ_alg_t * out) -{ - in = clib_net_to_host_u32 (in); - - switch (in) - { -#define _(v,f,s) case IPSEC_API_INTEG_ALG_##f: \ - *out = IPSEC_INTEG_ALG_##f; \ - return (0); - foreach_ipsec_integ_alg -#undef _ - } - return (VNET_API_ERROR_INVALID_ALGORITHM); -} - -static vl_api_ipsec_integ_alg_t -ipsec_integ_algo_encode (ipsec_integ_alg_t i) -{ - switch (i) - { -#define _(v,f,s) case IPSEC_INTEG_ALG_##f: \ - return (clib_host_to_net_u32(IPSEC_API_INTEG_ALG_##f)); - foreach_ipsec_integ_alg -#undef _ - case IPSEC_INTEG_N_ALG: - break; - } - ASSERT (0); - return (VNET_API_ERROR_UNIMPLEMENTED); -} - -static void -ipsec_key_decode (const vl_api_key_t * key, ipsec_key_t * out) -{ - ipsec_mk_key (out, key->data, key->length); -} - -static void -ipsec_key_encode (const ipsec_key_t * in, vl_api_key_t * out) -{ - out->length = in->len; - clib_memcpy (out->data, in->data, out->length); -} - -static ipsec_sa_flags_t -ipsec_sa_flags_decode (vl_api_ipsec_sad_flags_t in) -{ - ipsec_sa_flags_t flags = IPSEC_SA_FLAG_NONE; - in = clib_net_to_host_u32 (in); - - if (in & IPSEC_API_SAD_FLAG_USE_ESN) - flags |= IPSEC_SA_FLAG_USE_ESN; - if (in & IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY) - flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY; - if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL) - flags |= IPSEC_SA_FLAG_IS_TUNNEL; - if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL_V6) - flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6; - if (in & IPSEC_API_SAD_FLAG_UDP_ENCAP) - flags |= IPSEC_SA_FLAG_UDP_ENCAP; - - return (flags); -} - -static vl_api_ipsec_sad_flags_t -ipsec_sad_flags_encode (const ipsec_sa_t * sa) -{ - vl_api_ipsec_sad_flags_t flags = IPSEC_API_SAD_FLAG_NONE; - - if (ipsec_sa_is_set_USE_ESN (sa)) - flags |= IPSEC_API_SAD_FLAG_USE_ESN; - if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa)) - flags |= IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY; - if (ipsec_sa_is_set_IS_TUNNEL (sa)) - flags |= IPSEC_API_SAD_FLAG_IS_TUNNEL; - if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa)) - flags |= IPSEC_API_SAD_FLAG_IS_TUNNEL_V6; - if (ipsec_sa_is_set_UDP_ENCAP (sa)) - flags |= IPSEC_API_SAD_FLAG_UDP_ENCAP; - - return clib_host_to_net_u32 (flags); -} - static void vl_api_ipsec_sad_entry_add_del_t_handler (vl_api_ipsec_sad_entry_add_del_t * mp) { @@ -514,12 +368,13 @@ static void vl_api_ipsec_sad_entry_add_del_t_handler ip_address_decode (&mp->entry.tunnel_dst, &tun_dst); if (mp->is_add) - rv = ipsec_sa_add (id, spi, proto, - crypto_alg, &crypto_key, - integ_alg, &integ_key, flags, - 0, mp->entry.salt, &tun_src, &tun_dst, &sa_index); + rv = ipsec_sa_add_and_lock (id, spi, proto, + crypto_alg, &crypto_key, + integ_alg, &integ_key, flags, + 0, mp->entry.salt, &tun_src, &tun_dst, + &sa_index, IPSEC_UDP_PORT_NONE); else - rv = ipsec_sa_del (id); + rv = ipsec_sa_unlock_id (id); #else rv = VNET_API_ERROR_UNIMPLEMENTED; @@ -616,10 +471,10 @@ send_ipsec_spd_details (ipsec_policy_t * p, vl_api_registration_t * reg, &mp->entry.remote_address_start); ip_address_encode (&p->raddr.stop, IP46_TYPE_ANY, &mp->entry.remote_address_stop); - mp->entry.local_port_start = p->lport.start; - mp->entry.local_port_stop = p->lport.stop; - mp->entry.remote_port_start = p->rport.start; - mp->entry.remote_port_stop = p->rport.stop; + mp->entry.local_port_start = htons (p->lport.start); + mp->entry.local_port_stop = htons (p->lport.stop); + mp->entry.remote_port_start = htons (p->rport.start); + mp->entry.remote_port_stop = htons (p->rport.stop); mp->entry.protocol = p->protocol; mp->entry.policy = ipsec_spd_action_encode (p->policy); mp->entry.sa_id = htonl (p->sa_id); @@ -719,56 +574,157 @@ vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t * #endif } +static u32 +ipsec_tun_mk_input_sa_id (u32 ti) +{ + return (0x80000000 | ti); +} + +static u32 +ipsec_tun_mk_output_sa_id (u32 ti) +{ + return (0xc0000000 | ti); +} + static void vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * mp) { vl_api_ipsec_tunnel_if_add_del_reply_t *rmp; - ipsec_main_t *im = &ipsec_main; - vnet_main_t *vnm = im->vnet_main; u32 sw_if_index = ~0; - ip46_type_t itype; int rv; #if WITH_LIBSSL > 0 - ipsec_add_del_tunnel_args_t tun; - - clib_memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t)); - - tun.is_add = mp->is_add; - tun.esn = mp->esn; - tun.anti_replay = mp->anti_replay; - tun.local_spi = ntohl (mp->local_spi); - tun.remote_spi = ntohl (mp->remote_spi); - tun.crypto_alg = mp->crypto_alg; - tun.local_crypto_key_len = mp->local_crypto_key_len; - tun.remote_crypto_key_len = mp->remote_crypto_key_len; - tun.integ_alg = mp->integ_alg; - tun.local_integ_key_len = mp->local_integ_key_len; - tun.remote_integ_key_len = mp->remote_integ_key_len; - tun.udp_encap = mp->udp_encap; - tun.tx_table_id = ntohl (mp->tx_table_id); - tun.salt = mp->salt; - itype = ip_address_decode (&mp->local_ip, &tun.local_ip); - itype = ip_address_decode (&mp->remote_ip, &tun.remote_ip); - tun.is_ip6 = (IP46_TYPE_IP6 == itype); - memcpy (&tun.local_crypto_key, &mp->local_crypto_key, - mp->local_crypto_key_len); - memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key, - mp->remote_crypto_key_len); - memcpy (&tun.local_integ_key, &mp->local_integ_key, - mp->local_integ_key_len); - memcpy (&tun.remote_integ_key, &mp->remote_integ_key, - mp->remote_integ_key_len); - tun.renumber = mp->renumber; - tun.show_instance = ntohl (mp->show_instance); - - rv = ipsec_add_del_tunnel_if_internal (vnm, &tun, &sw_if_index); + ip46_address_t local_ip = ip46_address_initializer; + ip46_address_t remote_ip = ip46_address_initializer; + ipsec_key_t crypto_key, integ_key; + ipsec_sa_flags_t flags; + ip46_type_t local_ip_type, remote_ip_type; + ipip_transport_t transport; + u32 fib_index; + + local_ip_type = ip_address_decode (&mp->local_ip, &local_ip); + remote_ip_type = ip_address_decode (&mp->remote_ip, &remote_ip); + transport = (IP46_TYPE_IP6 == local_ip_type ? + IPIP_TRANSPORT_IP6 : IPIP_TRANSPORT_IP4); + + if (local_ip_type != remote_ip_type) + { + rv = VNET_API_ERROR_INVALID_VALUE; + goto done; + } + + flags = IPSEC_SA_FLAG_NONE; + + if (mp->udp_encap) + flags |= IPSEC_SA_FLAG_UDP_ENCAP; + if (mp->esn) + flags |= IPSEC_SA_FLAG_USE_ESN; + if (mp->anti_replay) + flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY; + + ipsec_mk_key (&crypto_key, mp->remote_crypto_key, + mp->remote_crypto_key_len); + ipsec_mk_key (&integ_key, mp->remote_integ_key, mp->remote_integ_key_len); + ipsec_mk_key (&crypto_key, mp->local_crypto_key, mp->local_crypto_key_len); + ipsec_mk_key (&integ_key, mp->local_integ_key, mp->local_integ_key_len); + + fib_index = + fib_table_find (fib_proto_from_ip46 (local_ip_type), + ntohl (mp->tx_table_id)); + + if (~0 == fib_index) + { + rv = VNET_API_ERROR_NO_SUCH_FIB; + goto done; + } + + if (mp->is_add) + { + // remote = input, local = output + /* create an ip-ip tunnel, then the two SA, then bind them */ + rv = ipip_add_tunnel (transport, + (mp->renumber ? ntohl (mp->show_instance) : ~0), + &local_ip, + &remote_ip, fib_index, + TUNNEL_ENCAP_DECAP_FLAG_NONE, IP_DSCP_CS0, + TUNNEL_MODE_P2P, &sw_if_index); + + if (rv) + goto done; + + rv = ipsec_sa_add_and_lock (ipsec_tun_mk_input_sa_id (sw_if_index), + ntohl (mp->remote_spi), + IPSEC_PROTOCOL_ESP, + mp->crypto_alg, + &crypto_key, + mp->integ_alg, + &integ_key, + (flags | IPSEC_SA_FLAG_IS_INBOUND), + ntohl (mp->tx_table_id), + mp->salt, &remote_ip, &local_ip, NULL, + IPSEC_UDP_PORT_NONE); + + if (rv) + goto done; + + rv = ipsec_sa_add_and_lock (ipsec_tun_mk_output_sa_id (sw_if_index), + ntohl (mp->local_spi), + IPSEC_PROTOCOL_ESP, + mp->crypto_alg, + &crypto_key, + mp->integ_alg, + &integ_key, + flags, + ntohl (mp->tx_table_id), + mp->salt, &local_ip, &remote_ip, NULL, + IPSEC_UDP_PORT_NONE); + + if (rv) + goto done; + + rv = ipsec_tun_protect_update_one (sw_if_index, NULL, + ipsec_tun_mk_output_sa_id + (sw_if_index), + ipsec_tun_mk_input_sa_id + (sw_if_index)); + if (rv) + goto done; + + /* the SAs are locked as a result of being used for proection, + * they cannot be removed from the API, since they cannot be refered + * to by the API. unlock them now, so that if the tunnel is rekeyed + * they-ll disapper + */ + ipsec_sa_unlock_id (ipsec_tun_mk_input_sa_id (sw_if_index)); + ipsec_sa_unlock_id (ipsec_tun_mk_output_sa_id (sw_if_index)); + } + else + { + /* *INDENT-OFF* */ + ipip_tunnel_key_t key = { + .transport = transport, + .fib_index = fib_index, + .src = local_ip, + .dst = remote_ip + }; + /* *INDENT-ON* */ + + ipip_tunnel_t *t = ipip_tunnel_db_find (&key); + + if (NULL != t) + { + rv = ipsec_tun_protect_del (t->sw_if_index, NULL); + ipip_del_tunnel (t->sw_if_index); + } + else + rv = VNET_API_ERROR_NO_SUCH_ENTRY; + } #else rv = VNET_API_ERROR_UNIMPLEMENTED; #endif - +done: /* *INDENT-OFF* */ REPLY_MACRO2 (VL_API_IPSEC_TUNNEL_IF_ADD_DEL_REPLY, ({ @@ -777,16 +733,51 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * /* *INDENT-ON* */ } -static void -send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg, - u32 context, u32 sw_if_index) +typedef struct ipsec_sa_dump_match_ctx_t_ +{ + index_t sai; + u32 sw_if_index; +} ipsec_sa_dump_match_ctx_t; + +static walk_rc_t +ipsec_sa_dump_match_sa (index_t itpi, void *arg) { + ipsec_sa_dump_match_ctx_t *ctx = arg; + ipsec_tun_protect_t *itp; + index_t sai; + + itp = ipsec_tun_protect_get (itpi); + + if (itp->itp_out_sa == ctx->sai) + { + ctx->sw_if_index = itp->itp_sw_if_index; + return (WALK_STOP); + } + /* *INDENT-OFF* */ + FOR_EACH_IPSEC_PROTECT_INPUT_SAI (itp, sai, + ({ + if (sai == ctx->sai) + { + ctx->sw_if_index = itp->itp_sw_if_index; + return (WALK_STOP); + } + })); + /* *INDENT-OFF* */ + + return (WALK_CONTINUE); +} + +static walk_rc_t +send_ipsec_sa_details (ipsec_sa_t * sa, void *arg) +{ + ipsec_dump_walk_ctx_t *ctx = arg; vl_api_ipsec_sa_details_t *mp; + ipsec_main_t *im = &ipsec_main; mp = vl_msg_api_alloc (sizeof (*mp)); clib_memset (mp, 0, sizeof (*mp)); mp->_vl_msg_id = ntohs (VL_API_IPSEC_SA_DETAILS); - mp->context = context; + mp->context = ctx->context; mp->entry.sad_id = htonl (sa->id); mp->entry.spi = htonl (sa->spi); @@ -801,6 +792,20 @@ send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg, ipsec_key_encode (&sa->integ_key, &mp->entry.integrity_key); mp->entry.flags = ipsec_sad_flags_encode (sa); + mp->entry.salt = clib_host_to_net_u32 (sa->salt); + + if (ipsec_sa_is_set_IS_PROTECT (sa)) + { + ipsec_sa_dump_match_ctx_t ctx = { + .sai = sa - im->sad, + .sw_if_index = ~0, + }; + ipsec_tun_protect_walk (ipsec_sa_dump_match_sa, &ctx); + + mp->sw_if_index = htonl (ctx.sw_if_index); + } + else + mp->sw_if_index = ~0; if (ipsec_sa_is_set_IS_TUNNEL (sa)) { @@ -810,8 +815,6 @@ send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg, &mp->entry.tunnel_dst); } - mp->sw_if_index = htonl (sw_if_index); - mp->salt = clib_host_to_net_u32 (sa->salt); mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq)); mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq)); if (ipsec_sa_is_set_USE_ESN (sa)) @@ -822,49 +825,28 @@ send_ipsec_sa_details (ipsec_sa_t * sa, vl_api_registration_t * reg, if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa)) mp->replay_window = clib_host_to_net_u64 (sa->replay_window); - vl_api_send_msg (reg, (u8 *) mp); -} + vl_api_send_msg (ctx->reg, (u8 *) mp); + return (WALK_CONTINUE); +} static void vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp) { vl_api_registration_t *reg; - ipsec_main_t *im = &ipsec_main; - vnet_main_t *vnm = im->vnet_main; - ipsec_sa_t *sa; - ipsec_tunnel_if_t *t; - u32 *sa_index_to_tun_if_index = 0; #if WITH_LIBSSL > 0 reg = vl_api_client_index_to_registration (mp->client_index); - if (!reg || pool_elts (im->sad) == 0) + if (!reg) return; - vec_validate_init_empty (sa_index_to_tun_if_index, vec_len (im->sad) - 1, - ~0); - - /* *INDENT-OFF* */ - pool_foreach (t, im->tunnel_interfaces, - ({ - vnet_hw_interface_t *hi; - u32 sw_if_index = ~0; - - hi = vnet_get_hw_interface (vnm, t->hw_if_index); - sw_if_index = hi->sw_if_index; - sa_index_to_tun_if_index[t->input_sa_index] = sw_if_index; - sa_index_to_tun_if_index[t->output_sa_index] = sw_if_index; - })); + ipsec_dump_walk_ctx_t ctx = { + .reg = reg, + .context = mp->context, + }; - pool_foreach (sa, im->sad, - ({ - if (mp->sa_id == ~(0) || ntohl (mp->sa_id) == sa->id) - send_ipsec_sa_details (sa, reg, mp->context, - sa_index_to_tun_if_index[sa - im->sad]); - })); - /* *INDENT-ON* */ + ipsec_sa_walk (send_ipsec_sa_details, &ctx); - vec_free (sa_index_to_tun_if_index); #else clib_warning ("unimplemented"); #endif @@ -874,20 +856,24 @@ static void vl_api_ipsec_tunnel_if_set_sa_t_handler (vl_api_ipsec_tunnel_if_set_sa_t * mp) { vl_api_ipsec_tunnel_if_set_sa_reply_t *rmp; - ipsec_main_t *im = &ipsec_main; - vnet_main_t *vnm = im->vnet_main; - vnet_sw_interface_t *sw; int rv; #if WITH_LIBSSL > 0 - sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index)); + VALIDATE_SW_IF_INDEX(mp); + + if (mp->is_outbound) + rv = ipsec_tun_protect_update_out (ntohl (mp->sw_if_index), NULL, + ntohl (mp->sa_id)); + else + rv = ipsec_tun_protect_update_in (ntohl (mp->sw_if_index), NULL, + ntohl (mp->sa_id)); - rv = ipsec_set_interface_sa (vnm, sw->hw_if_index, ntohl (mp->sa_id), - mp->is_outbound); #else clib_warning ("unimplemented"); #endif + BAD_SW_IF_INDEX_LABEL; + REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_SA_REPLY); } @@ -996,7 +982,7 @@ setup_message_id_table (api_main_t * am) static clib_error_t * ipsec_api_hookup (vlib_main_t * vm) { - api_main_t *am = &api_main; + api_main_t *am = vlibapi_get_main (); #define _(N,n) \ vl_msg_api_set_handlers(VL_API_##N, #n, \