IPSEC: minor refactor

No function change. Only breaking the monster ipsec.[hc]
into smaller constituent parts

Change-Id: I3fd4d2d041673db5865d46a4002f6bd383f378af
Signed-off-by: Neale Ranns <nranns@cisco.com>

1 files changed, 5 insertions, 266 deletions

diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index 93369fe9f8c..fd709675b8e 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -25,244 +25,11 @@
 #include <vppinfra/types.h>
 #include <vppinfra/cache.h>
 
-#define IPSEC_FLAG_IPSEC_GRE_TUNNEL (1 << 0)
-
-#define foreach_ipsec_output_next  \
-  _ (DROP, "error-drop")           \
-  _ (ESP4_ENCRYPT, "esp4-encrypt") \
-  _ (AH4_ENCRYPT, "ah4-encrypt")   \
-  _ (ESP6_ENCRYPT, "esp6-encrypt") \
-  _ (AH6_ENCRYPT, "ah6-encrypt")
-
-#define _(v, s) IPSEC_OUTPUT_NEXT_##v,
-typedef enum
-{
-  foreach_ipsec_output_next
-#undef _
-    IPSEC_OUTPUT_N_NEXT,
-} ipsec_output_next_t;
-
-#define foreach_ipsec_input_next   \
-  _ (DROP, "error-drop")           \
-  _ (ESP4_DECRYPT, "esp4-decrypt") \
-  _ (AH4_DECRYPT, "ah4-decrypt")   \
-  _ (ESP6_DECRYPT, "esp6-decrypt") \
-  _ (AH6_DECRYPT, "ah6-decrypt")
-
-#define _(v, s) IPSEC_INPUT_NEXT_##v,
-typedef enum
-{
-  foreach_ipsec_input_next
-#undef _
-    IPSEC_INPUT_N_NEXT,
-} ipsec_input_next_t;
-
-#define foreach_ipsec_policy_action \
-  _ (0, BYPASS, "bypass")           \
-  _ (1, DISCARD, "discard")         \
-  _ (2, RESOLVE, "resolve")         \
-  _ (3, PROTECT, "protect")
-
-typedef enum
-{
-#define _(v, f, s) IPSEC_POLICY_ACTION_##f = v,
-  foreach_ipsec_policy_action
-#undef _
-} ipsec_policy_action_t;
-
-#define IPSEC_POLICY_N_ACTION (IPSEC_POLICY_ACTION_PROTECT + 1)
-
-
-#define foreach_ipsec_crypto_alg    \
-  _ (0, NONE, "none")               \
-  _ (1, AES_CBC_128, "aes-cbc-128") \
-  _ (2, AES_CBC_192, "aes-cbc-192") \
-  _ (3, AES_CBC_256, "aes-cbc-256") \
-  _ (4, AES_CTR_128, "aes-ctr-128") \
-  _ (5, AES_CTR_192, "aes-ctr-192") \
-  _ (6, AES_CTR_256, "aes-ctr-256") \
-  _ (7, AES_GCM_128, "aes-gcm-128") \
-  _ (8, AES_GCM_192, "aes-gcm-192") \
-  _ (9, AES_GCM_256, "aes-gcm-256") \
-  _ (10, DES_CBC, "des-cbc")        \
-  _ (11, 3DES_CBC, "3des-cbc")
-
-typedef enum
-{
-#define _(v, f, s) IPSEC_CRYPTO_ALG_##f = v,
-  foreach_ipsec_crypto_alg
-#undef _
-    IPSEC_CRYPTO_N_ALG,
-} ipsec_crypto_alg_t;
-
-#define foreach_ipsec_integ_alg                                            \
-  _ (0, NONE, "none")                                                      \
-  _ (1, MD5_96, "md5-96")           /* RFC2403 */                          \
-  _ (2, SHA1_96, "sha1-96")         /* RFC2404 */                          \
-  _ (3, SHA_256_96, "sha-256-96")   /* draft-ietf-ipsec-ciph-sha-256-00 */ \
-  _ (4, SHA_256_128, "sha-256-128") /* RFC4868 */                          \
-  _ (5, SHA_384_192, "sha-384-192") /* RFC4868 */                          \
-  _ (6, SHA_512_256, "sha-512-256")	/* RFC4868 */
-
-typedef enum
-{
-#define _(v, f, s) IPSEC_INTEG_ALG_##f = v,
-  foreach_ipsec_integ_alg
-#undef _
-    IPSEC_INTEG_N_ALG,
-} ipsec_integ_alg_t;
-
-typedef enum
-{
-  IPSEC_PROTOCOL_AH = 0,
-  IPSEC_PROTOCOL_ESP = 1
-} ipsec_protocol_t;
-
-typedef struct
-{
-  u32 id;
-  u32 spi;
-  ipsec_protocol_t protocol;
-
-  ipsec_crypto_alg_t crypto_alg;
-  u8 crypto_key_len;
-  u8 crypto_key[128];
-
-  ipsec_integ_alg_t integ_alg;
-  u8 integ_key_len;
-  u8 integ_key[128];
-
-  u8 use_esn;
-  u8 use_anti_replay;
-
-  u8 is_tunnel;
-  u8 is_tunnel_ip6;
-  u8 udp_encap;
-  ip46_address_t tunnel_src_addr;
-  ip46_address_t tunnel_dst_addr;
-
-  u32 tx_fib_index;
-  u32 salt;
-
-  /* runtime */
-  u32 seq;
-  u32 seq_hi;
-  u32 last_seq;
-  u32 last_seq_hi;
-  u64 replay_window;
-
-  /* lifetime data */
-  u64 total_data_size;
-} ipsec_sa_t;
-
-typedef struct
-{
-  ip46_address_t start, stop;
-} ip46_address_range_t;
-
-typedef struct
-{
-  u16 start, stop;
-} port_range_t;
-
-typedef struct
-{
-  u8 is_add;
-  u8 esn;
-  u8 anti_replay;
-  ip4_address_t local_ip, remote_ip;
-  u32 local_spi;
-  u32 remote_spi;
-  ipsec_crypto_alg_t crypto_alg;
-  u8 local_crypto_key_len;
-  u8 local_crypto_key[128];
-  u8 remote_crypto_key_len;
-  u8 remote_crypto_key[128];
-  ipsec_integ_alg_t integ_alg;
-  u8 local_integ_key_len;
-  u8 local_integ_key[128];
-  u8 remote_integ_key_len;
-  u8 remote_integ_key[128];
-  u8 renumber;
-  u32 show_instance;
-  u8 udp_encap;
-  u32 tx_table_id;
-} ipsec_add_del_tunnel_args_t;
-
-typedef struct
-{
-  u8 is_add;
-  u32 local_sa_id;
-  u32 remote_sa_id;
-  ip4_address_t local_ip;
-  ip4_address_t remote_ip;
-} ipsec_add_del_ipsec_gre_tunnel_args_t;
-
-typedef enum
-{
-  IPSEC_IF_SET_KEY_TYPE_NONE,
-  IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO,
-  IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO,
-  IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG,
-  IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG,
-} ipsec_if_set_key_type_t;
-
-typedef struct
-{
-  u32 id;
-  i32 priority;
-  u8 is_outbound;
-
-  // Selector
-  u8 is_ipv6;
-  ip46_address_range_t laddr;
-  ip46_address_range_t raddr;
-  u8 protocol;
-  port_range_t lport;
-  port_range_t rport;
-
-  // Policy
-  ipsec_policy_action_t policy;
-  u32 sa_id;
-  u32 sa_index;
-
-  // Counter
-  vlib_counter_t counter;
-} ipsec_policy_t;
-
-typedef struct
-{
-  u32 id;
-  /* pool of policies */
-  ipsec_policy_t *policies;
-  /* vectors of policy indices */
-  u32 *ipv4_outbound_policies;
-  u32 *ipv6_outbound_policies;
-  u32 *ipv4_inbound_protect_policy_indices;
-  u32 *ipv4_inbound_policy_discard_and_bypass_indices;
-  u32 *ipv6_inbound_protect_policy_indices;
-  u32 *ipv6_inbound_policy_discard_and_bypass_indices;
-} ipsec_spd_t;
-
-typedef struct
-{
-  u32 spd_index;
-} ip4_ipsec_config_t;
-
-typedef struct
-{
-  u32 spd_index;
-} ip6_ipsec_config_t;
-
-typedef struct
-{
-  /* Required for pool_get_aligned */
-  CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
-  u32 input_sa_index;
-  u32 output_sa_index;
-  u32 hw_if_index;
-  u32 show_instance;
-} ipsec_tunnel_if_t;
+#include <vnet/ipsec/ipsec_spd.h>
+#include <vnet/ipsec/ipsec_spd_policy.h>
+#include <vnet/ipsec/ipsec_sa.h>
+#include <vnet/ipsec/ipsec_if.h>
+#include <vnet/ipsec/ipsec_io.h>
 
 typedef clib_error_t *(*add_del_sa_sess_cb_t) (u32 sa_index, u8 is_add);
 typedef clib_error_t *(*check_support_cb_t) (ipsec_sa_t * sa);
@@ -433,35 +200,7 @@ extern vlib_node_registration_t ipsec_if_input_node;
 /*
  * functions
  */
-int ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
-			     int is_add);
-int ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add);
-int ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy,
-			  int is_add);
-int ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add);
-int ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update);
-
-u32 ipsec_get_sa_index_by_sa_id (u32 sa_id);
-u8 ipsec_is_sa_used (u32 sa_index);
-u8 *format_ipsec_policy_action (u8 * s, va_list * args);
-u8 *format_ipsec_crypto_alg (u8 * s, va_list * args);
-u8 *format_ipsec_integ_alg (u8 * s, va_list * args);
 u8 *format_ipsec_replay_window (u8 * s, va_list * args);
-uword unformat_ipsec_policy_action (unformat_input_t * input, va_list * args);
-uword unformat_ipsec_crypto_alg (unformat_input_t * input, va_list * args);
-uword unformat_ipsec_integ_alg (unformat_input_t * input, va_list * args);
-
-int ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
-				      ipsec_add_del_tunnel_args_t * args,
-				      u32 * sw_if_index);
-int ipsec_add_del_tunnel_if (ipsec_add_del_tunnel_args_t * args);
-int ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm,
-				    ipsec_add_del_ipsec_gre_tunnel_args_t *
-				    args);
-int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index,
-			     ipsec_if_set_key_type_t type, u8 alg, u8 * key);
-int ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id,
-			    u8 is_outbound);
 
 /*
  *  inline functions