ipsec: Deprecated the old IPsec Tunnel interface

Type: fix

it's been 2 releases since it was marked deprecated.

Signed-off-by: Neale Ranns <nranns@cisco.com>
Change-Id: I0eba7ed607826ed0d00e7d2d8f9b27d09e8e9a6e

1 files changed, 0 insertions, 195 deletions

diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index 1486bbd89fd..0b0ed6c4f12 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -784,201 +784,6 @@ VLIB_CLI_COMMAND (clear_ipsec_counters_command, static) = {
 };
 /* *INDENT-ON* */
 
-static u32
-ipsec_tun_mk_local_sa_id (u32 ti)
-{
-  return (0x80000000 | ti);
-}
-
-static u32
-ipsec_tun_mk_remote_sa_id (u32 ti)
-{
-  return (0xc0000000 | ti);
-}
-
-static clib_error_t *
-create_ipsec_tunnel_command_fn (vlib_main_t * vm,
-				unformat_input_t * input,
-				vlib_cli_command_t * cmd)
-{
-  unformat_input_t _line_input, *line_input = &_line_input;
-  ip46_address_t local_ip = ip46_address_initializer;
-  ip46_address_t remote_ip = ip46_address_initializer;
-  ip_address_t nh = IP_ADDRESS_V4_ALL_0S;
-  ipsec_crypto_alg_t crypto_alg = IPSEC_CRYPTO_ALG_NONE;
-  ipsec_integ_alg_t integ_alg = IPSEC_INTEG_ALG_NONE;
-  ipsec_sa_flags_t flags;
-  u32 local_spi, remote_spi, salt = 0, table_id, fib_index;
-  u32 instance = ~0;
-  int rv;
-  u32 m_args = 0;
-  u8 ipv4_set = 0;
-  u8 ipv6_set = 0;
-  u8 is_add = 1;
-  clib_error_t *error = NULL;
-  ipsec_key_t rck = { 0 };
-  ipsec_key_t lck = { 0 };
-  ipsec_key_t lik = { 0 };
-  ipsec_key_t rik = { 0 };
-
-  table_id = 0;
-  flags = IPSEC_SA_FLAG_NONE;
-
-  /* Get a line of input. */
-  if (!unformat_user (input, unformat_line_input, line_input))
-    return 0;
-
-  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat
-	  (line_input, "local-ip %U", unformat_ip46_address, &local_ip,
-	   IP46_TYPE_ANY))
-	{
-	  ip46_address_is_ip4 (&local_ip) ? (ipv4_set = 1) : (ipv6_set = 1);
-	  m_args |= 1 << 0;
-	}
-      else
-	if (unformat
-	    (line_input, "remote-ip %U", unformat_ip46_address, &remote_ip,
-	     IP46_TYPE_ANY))
-	{
-	  ip46_address_is_ip4 (&remote_ip) ? (ipv4_set = 1) : (ipv6_set = 1);
-	  m_args |= 1 << 1;
-	}
-      else if (unformat (line_input, "local-spi %u", &local_spi))
-	m_args |= 1 << 2;
-      else if (unformat (line_input, "remote-spi %u", &remote_spi))
-	m_args |= 1 << 3;
-      else if (unformat (line_input, "salt 0x%x", &salt))
-	;
-      else if (unformat (line_input, "udp-encap"))
-	flags |= IPSEC_SA_FLAG_UDP_ENCAP;
-      else if (unformat (line_input, "use-esn"))
-	flags |= IPSEC_SA_FLAG_USE_ESN;
-      else if (unformat (line_input, "use-anti-replay"))
-	flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
-      else if (unformat (line_input, "instance %u", &instance))
-	;
-      else if (unformat (line_input, "tx-table %u", &table_id))
-	;
-      else
-	if (unformat
-	    (line_input, "local-crypto-key %U", unformat_ipsec_key, &lck))
-	;
-      else
-	if (unformat
-	    (line_input, "remote-crypto-key %U", unformat_ipsec_key, &rck))
-	;
-      else if (unformat (line_input, "crypto-alg %U",
-			 unformat_ipsec_crypto_alg, &crypto_alg))
-	;
-      else
-	if (unformat
-	    (line_input, "local-integ-key %U", unformat_ipsec_key, &lik))
-	;
-      else
-	if (unformat
-	    (line_input, "remote-integ-key %U", unformat_ipsec_key, &rik))
-	;
-      else if (unformat (line_input, "integ-alg %U",
-			 unformat_ipsec_integ_alg, &integ_alg))
-	;
-      else if (unformat (line_input, "del"))
-	is_add = 0;
-      else if (unformat (line_input, "nh %U", unformat_ip_address, &nh))
-	;
-      else
-	{
-	  error = clib_error_return (0, "unknown input `%U'",
-				     format_unformat_error, line_input);
-	  goto done;
-	}
-    }
-
-  if (0xf != m_args)
-    {
-      error = clib_error_return (0, "mandatory argument(s) missing");
-      goto done;
-    }
-
-  if (ipv4_set && ipv6_set)
-    return clib_error_return (0, "both IPv4 and IPv6 addresses specified");
-
-  fib_index = fib_table_find (fib_ip_proto (ipv6_set), table_id);
-
-  if (~0 == fib_index)
-    {
-      rv = VNET_API_ERROR_NO_SUCH_FIB;
-      goto done;
-    }
-
-  if (is_add)
-    {
-      // remote = input, local = output
-      u32 sw_if_index;
-
-      /* create an ip-ip tunnel, then the two SA, then bind them */
-      rv =
-	ipip_add_tunnel (ipv6_set ? IPIP_TRANSPORT_IP6 : IPIP_TRANSPORT_IP4,
-			 instance, &local_ip, &remote_ip, fib_index,
-			 TUNNEL_ENCAP_DECAP_FLAG_NONE, IP_DSCP_CS0,
-			 TUNNEL_MODE_P2P, &sw_if_index);
-      rv |=
-	ipsec_sa_add_and_lock (ipsec_tun_mk_local_sa_id (sw_if_index),
-			       local_spi, IPSEC_PROTOCOL_ESP, crypto_alg,
-			       &lck, integ_alg, &lik, flags, table_id,
-			       clib_host_to_net_u32 (salt), &local_ip,
-			       &remote_ip, TUNNEL_ENCAP_DECAP_FLAG_NONE,
-			       IP_DSCP_CS0, NULL,
-			       IPSEC_UDP_PORT_NONE, IPSEC_UDP_PORT_NONE);
-      rv |=
-	ipsec_sa_add_and_lock (ipsec_tun_mk_remote_sa_id (sw_if_index),
-			       remote_spi, IPSEC_PROTOCOL_ESP, crypto_alg,
-			       &rck, integ_alg, &rik,
-			       (flags | IPSEC_SA_FLAG_IS_INBOUND), table_id,
-			       clib_host_to_net_u32 (salt), &remote_ip,
-			       &local_ip, TUNNEL_ENCAP_DECAP_FLAG_NONE,
-			       IP_DSCP_CS0, NULL,
-			       IPSEC_UDP_PORT_NONE, IPSEC_UDP_PORT_NONE);
-      rv |=
-	ipsec_tun_protect_update_one (sw_if_index, &nh,
-				      ipsec_tun_mk_local_sa_id (sw_if_index),
-				      ipsec_tun_mk_remote_sa_id
-				      (sw_if_index));
-    }
-  else
-    rv = 0;
-
-  switch (rv)
-    {
-    case 0:
-      break;
-    case VNET_API_ERROR_INVALID_VALUE:
-      error = clib_error_return (0,
-				 "IPSec tunnel interface already exists...");
-      goto done;
-    default:
-      error = clib_error_return (0, "ipsec_register_interface returned %d",
-				 rv);
-      goto done;
-    }
-
-done:
-  unformat_free (line_input);
-
-  return error;
-}
-
-/* *INDENT-OFF* */
-VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = {
-  .path = "create ipsec tunnel",
-  .short_help = "create ipsec tunnel local-ip <addr> local-spi <spi> "
-      "remote-ip <addr> remote-spi <spi> [instance <inst_num>] [udp-encap] [use-esn] [use-anti-replay] "
-      "[tx-table <table-id>]",
-  .function = create_ipsec_tunnel_command_fn,
-};
-/* *INDENT-ON* */
-
 static clib_error_t *
 ipsec_tun_protect_cmd (vlib_main_t * vm,
 		       unformat_input_t * input, vlib_cli_command_t * cmd)