API support for IPsec tunnel interface creation

Change-Id: I8c9f886cb95e92adbe1c646844789ca0a6bb6140
Signed-off-by: Matthew Smith <mgsmith@netgate.com>

2 files changed, 87 insertions, 1 deletions

diff --git a/src/vnet/ipsec/ipsec.api b/src/vnet/ipsec/ipsec.api
index 203c5272432..f3b5993700b 100644
--- a/src/vnet/ipsec/ipsec.api
+++ b/src/vnet/ipsec/ipsec.api
@@ -469,7 +469,6 @@ define ipsec_spd_dump {
     @param bytes - byte count of packets matching this policy
     @param packets - count of packets matching this policy
 */
-
 define ipsec_spd_details {
     u32 context;
     u32 spd_id;
@@ -491,6 +490,49 @@ define ipsec_spd_details {
     u64 packets;
 };
 
+/** \brief Add or delete IPsec tunnel interface
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_add - add IPsec tunnel interface if nonzero, else delete
+    @param esn - enable extended sequence numbers if nonzero, else disable
+    @param anti_replay - enable anti replay check if nonzero, else disable
+    @param local_ip - local IP address
+    @param remote_ip - IP address of remote IPsec peer
+    @param local_spi - SPI of outbound IPsec SA
+    @param remote_spi - SPI of inbound IPsec SA
+    @param crypto_alg - encryption algorithm ID
+    @param local_crypto_key_len - length of local crypto key in bytes
+    @param local_crypto_key - crypto key for outbound IPsec SA
+    @param remote_crypto_key_len - length of remote crypto key in bytes
+    @param remote_crypto_key - crypto key for inbound IPsec SA
+    @param integ_alg - integrity algorithm ID
+    @param local_integ_key_len - length of local integrity key in bytes
+    @param local_integ_key - integrity key for outbound IPsec SA
+    @param remote_integ_key_len - length of remote integrity key in bytes
+    @param remote_integ_key - integrity key for inbound IPsec SA
+*/
+autoreply define ipsec_tunnel_if_add_del {
+  u32 client_index;
+  u32 context;
+  u8 is_add;
+  u8 esn;
+  u8 anti_replay;
+  u8 local_ip[4];
+  u8 remote_ip[4];
+  u32 local_spi;
+  u32 remote_spi;
+  u8 crypto_alg;
+  u8 local_crypto_key_len;
+  u8 local_crypto_key[128];
+  u8 remote_crypto_key_len;
+  u8 remote_crypto_key[128];
+  u8 integ_alg;
+  u8 local_integ_key_len;
+  u8 local_integ_key[128];
+  u8 remote_integ_key_len;
+  u8 remote_integ_key[128];
+};
+
 /*
  * Local Variables:
  * eval: (c-set-style "gnu")
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index 9c4ba526319..04dff4d0fd0 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -54,6 +54,7 @@ _(IPSEC_SPD_ADD_DEL_ENTRY, ipsec_spd_add_del_entry)                     \
 _(IPSEC_SAD_ADD_DEL_ENTRY, ipsec_sad_add_del_entry)                     \
 _(IPSEC_SA_SET_KEY, ipsec_sa_set_key)                                   \
 _(IPSEC_SPD_DUMP, ipsec_spd_dump)                                       \
+_(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del)                     \
 _(IKEV2_PROFILE_ADD_DEL, ikev2_profile_add_del)                         \
 _(IKEV2_PROFILE_SET_AUTH, ikev2_profile_set_auth)                       \
 _(IKEV2_PROFILE_SET_ID, ikev2_profile_set_id)                           \
@@ -352,6 +353,49 @@ vl_api_ipsec_sa_set_key_t_handler (vl_api_ipsec_sa_set_key_t * mp)
 }
 
 static void
+vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t *
+					  mp)
+{
+  vl_api_ipsec_tunnel_if_add_del_reply_t *rmp;
+  int rv;
+
+#if WITH_LIBSSL > 0
+  ipsec_add_del_tunnel_args_t tun;
+
+  memset (&tun, 0, sizeof (ipsec_add_del_tunnel_args_t));
+
+  tun.is_add = mp->is_add;
+  tun.esn = mp->esn;
+  tun.anti_replay = mp->anti_replay;
+  tun.local_spi = ntohl (mp->local_spi);
+  tun.remote_spi = ntohl (mp->remote_spi);
+  tun.crypto_alg = mp->crypto_alg;
+  tun.local_crypto_key_len = mp->local_crypto_key_len;
+  tun.remote_crypto_key_len = mp->remote_crypto_key_len;
+  tun.integ_alg = mp->integ_alg;
+  tun.local_integ_key_len = mp->local_integ_key_len;
+  tun.remote_integ_key_len = mp->remote_integ_key_len;
+  memcpy (&tun.local_ip, mp->local_ip, 4);
+  memcpy (&tun.remote_ip, mp->remote_ip, 4);
+  memcpy (&tun.local_crypto_key, &mp->local_crypto_key,
+	  mp->local_crypto_key_len);
+  memcpy (&tun.remote_crypto_key, &mp->remote_crypto_key,
+	  mp->remote_crypto_key_len);
+  memcpy (&tun.local_integ_key, &mp->local_integ_key,
+	  mp->local_integ_key_len);
+  memcpy (&tun.remote_integ_key, &mp->remote_integ_key,
+	  mp->remote_integ_key_len);
+
+  rv = ipsec_add_del_tunnel_if (&tun);
+
+#else
+  rv = VNET_API_ERROR_UNIMPLEMENTED;
+#endif
+
+  REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_ADD_DEL_REPLY);
+}
+
+static void
 vl_api_ikev2_profile_add_del_t_handler (vl_api_ikev2_profile_add_del_t * mp)
 {
   vl_api_ikev2_profile_add_del_reply_t *rmp;