diff options
| author |   Matthew Smith <mgsmith@netgate.com> | 2017-10-05 19:03:05 -0500 |
|---|---|---|
| committer |   Damjan Marion <dmarion.lists@gmail.com> | 2017-10-14 09:11:52 +0000 |
| commit | 75d856096f644837e0da9fda011f0c419fa9414e (patch) | |
| tree | daa2add2b1973f0f66379d2ccb63848c8fc43b40 /src/vnet/ipsec/ipsec_api.c | |
| parent | 054c03ac9c20a5e38121590b83f01fd91f82acf0 (diff) | |
Add API call to set keys on IPsec tunnel intf
There was already a CLI command and a libvnet function
to set the keys on an existing IPsec tunnel interface.
Expose this via the API.
Change-Id: I226a9616f680fc022f04447177a2e8232690657f
Signed-off-by: Matthew Smith <mgsmith@netgate.com>
Diffstat (limited to 'src/vnet/ipsec/ipsec_api.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec_api.c | 56 |
1 files changed, 56 insertions, 0 deletions
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index ae62ade35fb..c3f5745b85f 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -56,6 +56,7 @@ _(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \ _(IPSEC_SA_DUMP, ipsec_sa_dump) \ _(IPSEC_SPD_DUMP, ipsec_spd_dump) \ _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ +_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \ _(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del) \ _(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth) \ _(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id) \ @@ -510,6 +511,61 @@ vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp) static void +vl_api_ipsec_tunnel_if_set_key_t_handler (vl_api_ipsec_tunnel_if_set_key_t * + mp) +{ + vl_api_ipsec_tunnel_if_set_key_reply_t *rmp; + ipsec_main_t *im = &ipsec_main; + vnet_main_t *vnm = im->vnet_main; + vnet_sw_interface_t *sw; + u8 *key = 0; + int rv; + +#if WITH_LIBSSL > 0 + sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index)); + + switch (mp->key_type) + { + case IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO: + case IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO: + if (mp->alg < IPSEC_CRYPTO_ALG_AES_CBC_128 || + mp->alg > IPSEC_CRYPTO_N_ALG) + { + rv = VNET_API_ERROR_UNIMPLEMENTED; + goto out; + } + break; + case IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG: + case IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG: + if (mp->alg > IPSEC_INTEG_N_ALG) + { + rv = VNET_API_ERROR_UNIMPLEMENTED; + goto out; + } + break; + case IPSEC_IF_SET_KEY_TYPE_NONE: + default: + rv = VNET_API_ERROR_UNIMPLEMENTED; + goto out; + break; + } + + key = vec_new (u8, mp->key_len); + clib_memcpy (key, mp->key, mp->key_len); + + rv = ipsec_set_interface_key (vnm, sw->hw_if_index, mp->key_type, mp->alg, + key); + vec_free (key); +#else + clib_warning ("unimplemented"); +#endif + +out: + REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_KEY_REPLY); +} + + +static void vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp) { vl_api_ikev2_profile_add_del_reply_t *rmp; |