ipsec: remove dedicated IPSec tunnels

APIs for dedicated IPSec tunnels will remain in this release and are
used to programme the IPIP tunnel protect. APIs will be removed in a
future release.

see:
 https://wiki.fd.io/view/VPP/IPSec

Type: feature

Change-Id: I0f01f597946fdd15dfa5cae3643104d5a9c83089
Signed-off-by: Neale Ranns <nranns@cisco.com>

1 files changed, 90 insertions, 65 deletions

diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index 1bff6086741..630e60a43ec 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -20,6 +20,7 @@
 #include <vnet/ip/ip.h>
 #include <vnet/interface.h>
 #include <vnet/fib/fib.h>
+#include <vnet/ipip/ipip.h>
 
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/ipsec_tun.h>
@@ -386,17 +387,18 @@ ipsec_spd_bindings_show_all (vlib_main_t * vm, ipsec_main_t * im)
   /* *INDENT-ON* */
 }
 
-static void
-ipsec_tunnel_show_all (vlib_main_t * vm, ipsec_main_t * im)
+static walk_rc_t
+ipsec_tun_protect_show_one (index_t itpi, void *ctx)
 {
-  u32 ti;
+  vlib_cli_output (ctx, "%U", format_ipsec_tun_protect, itpi);
 
-  vlib_cli_output (vm, "Tunnel interfaces");
-  /* *INDENT-OFF* */
-  pool_foreach_index (ti, im->tunnel_interfaces, ({
-    vlib_cli_output(vm, "  %U", format_ipsec_tunnel, ti);
-  }));
-  /* *INDENT-ON* */
+  return (WALK_CONTINUE);
+}
+
+static void
+ipsec_tunnel_show_all (vlib_main_t * vm)
+{
+  ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm);
 }
 
 static clib_error_t *
@@ -408,7 +410,7 @@ show_ipsec_command_fn (vlib_main_t * vm,
   ipsec_sa_show_all (vm, im, 0);
   ipsec_spd_show_all (vm, im);
   ipsec_spd_bindings_show_all (vm, im);
-  ipsec_tunnel_show_all (vm, im);
+  ipsec_tun_protect_walk (ipsec_tun_protect_show_one, vm);
 
   return 0;
 }
@@ -537,21 +539,7 @@ show_ipsec_tunnel_command_fn (vlib_main_t * vm,
 			      unformat_input_t * input,
 			      vlib_cli_command_t * cmd)
 {
-  ipsec_main_t *im = &ipsec_main;
-  u32 ti = ~0;
-
-  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat (input, "%u", &ti))
-	;
-      else
-	break;
-    }
-
-  if (~0 != ti)
-    vlib_cli_output (vm, "%U", format_ipsec_tunnel, ti);
-  else
-    ipsec_tunnel_show_all (vm, im);
+  ipsec_tunnel_show_all (vm);
 
   return 0;
 }
@@ -559,7 +547,7 @@ show_ipsec_tunnel_command_fn (vlib_main_t * vm,
 /* *INDENT-OFF* */
 VLIB_CLI_COMMAND (show_ipsec_tunnel_command, static) = {
     .path = "show ipsec tunnel",
-    .short_help = "show ipsec tunnel [index]",
+    .short_help = "show ipsec tunnel",
     .function = show_ipsec_tunnel_command_fn,
 };
 /* *INDENT-ON* */
@@ -719,25 +707,44 @@ VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = {
 };
 /* *INDENT-ON* */
 
+static u32
+ipsec_tun_mk_local_sa_id (u32 ti)
+{
+  return (0x80000000 | ti);
+}
+
+static u32
+ipsec_tun_mk_remote_sa_id (u32 ti)
+{
+  return (0xc0000000 | ti);
+}
+
 static clib_error_t *
 create_ipsec_tunnel_command_fn (vlib_main_t * vm,
 				unformat_input_t * input,
 				vlib_cli_command_t * cmd)
 {
   unformat_input_t _line_input, *line_input = &_line_input;
-  ipsec_add_del_tunnel_args_t a;
+  ip46_address_t local_ip = ip46_address_initializer;
+  ip46_address_t remote_ip = ip46_address_initializer;
+  ipsec_crypto_alg_t crypto_alg;
+  ipsec_integ_alg_t integ_alg;
+  ipsec_sa_flags_t flags;
+  u32 local_spi, remote_spi, salt, table_id, fib_index;
+  u32 instance = ~0;
   int rv;
   u32 num_m_args = 0;
   u8 ipv4_set = 0;
   u8 ipv6_set = 0;
+  u8 is_add = 1;
   clib_error_t *error = NULL;
   ipsec_key_t rck = { 0 };
   ipsec_key_t lck = { 0 };
   ipsec_key_t lik = { 0 };
   ipsec_key_t rik = { 0 };
 
-  clib_memset (&a, 0, sizeof (a));
-  a.is_add = 1;
+  table_id = 0;
+  flags = IPSEC_SA_FLAG_NONE;
 
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
@@ -746,36 +753,35 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
     {
       if (unformat
-	  (line_input, "local-ip %U", unformat_ip46_address, &a.local_ip,
+	  (line_input, "local-ip %U", unformat_ip46_address, &local_ip,
 	   IP46_TYPE_ANY))
 	{
-	  ip46_address_is_ip4 (&a.local_ip) ? (ipv4_set = 1) : (ipv6_set = 1);
+	  ip46_address_is_ip4 (&local_ip) ? (ipv4_set = 1) : (ipv6_set = 1);
 	  num_m_args++;
 	}
       else
 	if (unformat
-	    (line_input, "remote-ip %U", unformat_ip46_address, &a.remote_ip,
+	    (line_input, "remote-ip %U", unformat_ip46_address, &remote_ip,
 	     IP46_TYPE_ANY))
 	{
-	  ip46_address_is_ip4 (&a.remote_ip) ? (ipv4_set = 1) : (ipv6_set =
-								 1);
+	  ip46_address_is_ip4 (&remote_ip) ? (ipv4_set = 1) : (ipv6_set = 1);
 	  num_m_args++;
 	}
-      else if (unformat (line_input, "local-spi %u", &a.local_spi))
+      else if (unformat (line_input, "local-spi %u", &local_spi))
 	num_m_args++;
-      else if (unformat (line_input, "remote-spi %u", &a.remote_spi))
+      else if (unformat (line_input, "remote-spi %u", &remote_spi))
 	num_m_args++;
-      else if (unformat (line_input, "instance %u", &a.show_instance))
-	a.renumber = 1;
-      else if (unformat (line_input, "salt 0x%x", &a.salt))
+      else if (unformat (line_input, "salt 0x%x", &salt))
 	;
       else if (unformat (line_input, "udp-encap"))
-	a.udp_encap = 1;
+	flags |= IPSEC_SA_FLAG_UDP_ENCAP;
       else if (unformat (line_input, "use-esn"))
-	a.esn = 1;
+	flags |= IPSEC_SA_FLAG_USE_ESN;
       else if (unformat (line_input, "use-anti-replay"))
-	a.anti_replay = 1;
-      else if (unformat (line_input, "tx-table %u", &a.tx_table_id))
+	flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
+      else if (unformat (line_input, "instance %u", &instance))
+	;
+      else if (unformat (line_input, "tx-table %u", &table_id))
 	;
       else
 	if (unformat
@@ -786,7 +792,7 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
 	    (line_input, "remote-crypto-key %U", unformat_ipsec_key, &rck))
 	;
       else if (unformat (line_input, "crypto-alg %U",
-			 unformat_ipsec_crypto_alg, &a.crypto_alg))
+			 unformat_ipsec_crypto_alg, &crypto_alg))
 	;
       else
 	if (unformat
@@ -797,10 +803,10 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
 	    (line_input, "remote-integ-key %U", unformat_ipsec_key, &rik))
 	;
       else if (unformat (line_input, "integ-alg %U",
-			 unformat_ipsec_integ_alg, &a.integ_alg))
+			 unformat_ipsec_integ_alg, &integ_alg))
 	;
       else if (unformat (line_input, "del"))
-	a.is_add = 0;
+	is_add = 0;
       else
 	{
 	  error = clib_error_return (0, "unknown input `%U'",
@@ -818,26 +824,52 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
   if (ipv4_set && ipv6_set)
     return clib_error_return (0, "both IPv4 and IPv6 addresses specified");
 
-  a.is_ip6 = ipv6_set;
-
-  clib_memcpy (a.local_crypto_key, lck.data, lck.len);
-  a.local_crypto_key_len = lck.len;
-  clib_memcpy (a.remote_crypto_key, rck.data, rck.len);
-  a.remote_crypto_key_len = rck.len;
+  fib_index = fib_table_find (fib_ip_proto (ipv6_set), table_id);
 
-  clib_memcpy (a.local_integ_key, lik.data, lik.len);
-  a.local_integ_key_len = lck.len;
-  clib_memcpy (a.remote_integ_key, rik.data, rik.len);
-  a.remote_integ_key_len = rck.len;
+  if (~0 == fib_index)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_FIB;
+      goto done;
+    }
 
-  rv = ipsec_add_del_tunnel_if (&a);
+  if (is_add)
+    {
+      // remote = input, local = output
+      u32 sw_if_index;
+
+      /* create an ip-ip tunnel, then the two SA, then bind them */
+      rv =
+	ipip_add_tunnel (ipv6_set ? IPIP_TRANSPORT_IP6 : IPIP_TRANSPORT_IP4,
+			 instance, &local_ip, &remote_ip, fib_index, 0,
+			 &sw_if_index);
+      rv |=
+	ipsec_sa_add_and_lock (ipsec_tun_mk_local_sa_id (sw_if_index),
+			       local_spi, IPSEC_PROTOCOL_ESP, crypto_alg,
+			       &lck, integ_alg, &lik, flags, table_id,
+			       clib_host_to_net_u32 (salt), &local_ip,
+			       &remote_ip, NULL);
+      rv |=
+	ipsec_sa_add_and_lock (ipsec_tun_mk_remote_sa_id (sw_if_index),
+			       remote_spi, IPSEC_PROTOCOL_ESP, crypto_alg,
+			       &rck, integ_alg, &rik,
+			       (flags | IPSEC_SA_FLAG_IS_INBOUND), table_id,
+			       clib_host_to_net_u32 (salt), &remote_ip,
+			       &local_ip, NULL);
+      rv |=
+	ipsec_tun_protect_update_one (sw_if_index,
+				      ipsec_tun_mk_local_sa_id (sw_if_index),
+				      ipsec_tun_mk_remote_sa_id
+				      (sw_if_index));
+    }
+  else
+    rv = 0;
 
   switch (rv)
     {
     case 0:
       break;
     case VNET_API_ERROR_INVALID_VALUE:
-      if (a.is_add)
+      if (is_add)
 	error = clib_error_return (0,
 				   "IPSec tunnel interface already exists...");
       else
@@ -918,13 +950,6 @@ VLIB_CLI_COMMAND (ipsec_tun_protect_cmd_node, static) =
 };
 /* *INDENT-ON* */
 
-static walk_rc_t
-ipsec_tun_protect_show_one (index_t itpi, void *ctx)
-{
-  vlib_cli_output (ctx, "%U", format_ipsec_tun_protect, itpi);
-
-  return (WALK_CONTINUE);
-}
 
 static clib_error_t *
 ipsec_tun_protect_show (vlib_main_t * vm,