diff options
| -rw-r--r-- | src/vat/api_format.c | 131 | ||||
| -rw-r--r-- | src/vnet/crypto/crypto.c | 22 | ||||
| -rw-r--r-- | src/vnet/crypto/crypto.h | 2 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec.api | 40 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_api.c | 81 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_cli.c | 131 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_if.c | 59 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_if.h | 12 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_sa.c | 46 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_sa.h | 2 |
10 files changed, 0 insertions, 526 deletions
diff --git a/src/vat/api_format.c b/src/vat/api_format.c index fe8e6ecbb6e..5836e3c307d 100644 --- a/src/vat/api_format.c +++ b/src/vat/api_format.c @@ -5210,9 +5210,7 @@ _(ipsec_spd_add_del_reply) \ _(ipsec_interface_add_del_spd_reply) \ _(ipsec_spd_entry_add_del_reply) \ _(ipsec_sad_entry_add_del_reply) \ -_(ipsec_sa_set_key_reply) \ _(ipsec_tunnel_if_add_del_reply) \ -_(ipsec_tunnel_if_set_key_reply) \ _(ipsec_tunnel_if_set_sa_reply) \ _(delete_loopback_reply) \ _(bd_ip_mac_add_del_reply) \ @@ -5452,9 +5450,7 @@ _(IPSEC_INTERFACE_ADD_DEL_SPD_REPLY, ipsec_interface_add_del_spd_reply) \ _(IPSEC_SPD_ENTRY_ADD_DEL_REPLY, ipsec_spd_entry_add_del_reply) \ _(IPSEC_SAD_ENTRY_ADD_DEL_REPLY, ipsec_sad_entry_add_del_reply) \ _(IPSEC_SA_DETAILS, ipsec_sa_details) \ -_(IPSEC_SA_SET_KEY_REPLY, ipsec_sa_set_key_reply) \ _(IPSEC_TUNNEL_IF_ADD_DEL_REPLY, ipsec_tunnel_if_add_del_reply) \ -_(IPSEC_TUNNEL_IF_SET_KEY_REPLY, ipsec_tunnel_if_set_key_reply) \ _(IPSEC_TUNNEL_IF_SET_SA_REPLY, ipsec_tunnel_if_set_sa_reply) \ _(DELETE_LOOPBACK_REPLY, delete_loopback_reply) \ _(BD_IP_MAC_ADD_DEL_REPLY, bd_ip_mac_add_del_reply) \ @@ -14905,52 +14901,6 @@ api_ipsec_sad_entry_add_del (vat_main_t * vam) } static int -api_ipsec_sa_set_key (vat_main_t * vam) -{ - unformat_input_t *i = vam->input; - vl_api_ipsec_sa_set_key_t *mp; - u32 sa_id; - u8 *ck = 0, *ik = 0; - int ret; - - while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT) - { - if (unformat (i, "sa_id %d", &sa_id)) - ; - else if (unformat (i, "crypto_key %U", unformat_hex_string, &ck)) - ; - else if (unformat (i, "integ_key %U", unformat_hex_string, &ik)) - ; - else - { - clib_warning ("parse error '%U'", format_unformat_error, i); - return -99; - } - } - - M (IPSEC_SA_SET_KEY, mp); - - mp->sa_id = ntohl (sa_id); - mp->crypto_key.length = vec_len (ck); - mp->integrity_key.length = vec_len (ik); - - if (mp->crypto_key.length > sizeof (mp->crypto_key.data)) - mp->crypto_key.length = sizeof (mp->crypto_key.data); - - if (mp->integrity_key.length > sizeof (mp->integrity_key.data)) - mp->integrity_key.length = sizeof (mp->integrity_key.data); - - if (ck) - clib_memcpy (mp->crypto_key.data, ck, mp->crypto_key.length); - if (ik) - clib_memcpy (mp->integrity_key.data, ik, mp->integrity_key.length); - - S (mp); - W (ret); - return ret; -} - -static int api_ipsec_tunnel_if_add_del (vat_main_t * vam) { unformat_input_t *i = vam->input; @@ -15258,84 +15208,6 @@ api_ipsec_sa_dump (vat_main_t * vam) } static int -api_ipsec_tunnel_if_set_key (vat_main_t * vam) -{ - unformat_input_t *i = vam->input; - vl_api_ipsec_tunnel_if_set_key_t *mp; - u32 sw_if_index = ~0; - u8 key_type = IPSEC_IF_SET_KEY_TYPE_NONE; - u8 *key = 0; - u32 alg = ~0; - int ret; - - while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT) - { - if (unformat (i, "%U", api_unformat_sw_if_index, vam, &sw_if_index)) - ; - else - if (unformat - (i, "local crypto %U", unformat_ipsec_api_crypto_alg, &alg)) - key_type = IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO; - else - if (unformat - (i, "remote crypto %U", unformat_ipsec_api_crypto_alg, &alg)) - key_type = IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO; - else - if (unformat - (i, "local integ %U", unformat_ipsec_api_integ_alg, &alg)) - key_type = IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG; - else - if (unformat - (i, "remote integ %U", unformat_ipsec_api_integ_alg, &alg)) - key_type = IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG; - else if (unformat (i, "%U", unformat_hex_string, &key)) - ; - else - { - clib_warning ("parse error '%U'", format_unformat_error, i); - return -99; - } - } - - if (sw_if_index == ~0) - { - errmsg ("interface must be specified"); - return -99; - } - - if (key_type == IPSEC_IF_SET_KEY_TYPE_NONE) - { - errmsg ("key type must be specified"); - return -99; - } - - if (alg == ~0) - { - errmsg ("algorithm must be specified"); - return -99; - } - - if (vec_len (key) == 0) - { - errmsg ("key must be specified"); - return -99; - } - - M (IPSEC_TUNNEL_IF_SET_KEY, mp); - - mp->sw_if_index = htonl (sw_if_index); - mp->alg = alg; - mp->key_type = key_type; - mp->key_len = vec_len (key); - clib_memcpy (mp->key, key, vec_len (key)); - - S (mp); - W (ret); - - return ret; -} - -static int api_ipsec_tunnel_if_set_sa (vat_main_t * vam) { unformat_input_t *i = vam->input; @@ -22464,15 +22336,12 @@ _(ipsec_spd_entry_add_del, "spd_id <n> priority <n> action <action>\n" \ " (inbound|outbound) [sa_id <n>] laddr_start <ip4|ip6>\n" \ " laddr_stop <ip4|ip6> raddr_start <ip4|ip6> raddr_stop <ip4|ip6>\n" \ " [lport_start <n> lport_stop <n>] [rport_start <n> rport_stop <n>]" ) \ -_(ipsec_sa_set_key, "sa_id <n> crypto_key <hex> integ_key <hex>") \ _(ipsec_tunnel_if_add_del, "local_spi <n> remote_spi <n>\n" \ " crypto_alg <alg> local_crypto_key <hex> remote_crypto_key <hex>\n" \ " integ_alg <alg> local_integ_key <hex> remote_integ_key <hex>\n" \ " local_ip <addr> remote_ip <addr> [esn] [anti_replay] [del]\n" \ " [instance <n>]") \ _(ipsec_sa_dump, "[sa_id <n>]") \ -_(ipsec_tunnel_if_set_key, "<intfc> <local|remote> <crypto|integ>\n" \ - " <alg> <hex>\n") \ _(ipsec_tunnel_if_set_sa, "<intfc> sa_id <n> <inbound|outbound>\n") \ _(delete_loopback,"sw_if_index <nn>") \ _(bd_ip_mac_add_del, "bd_id <bridge-domain-id> <ip4/6-addr> <mac-addr> [del]") \ diff --git a/src/vnet/crypto/crypto.c b/src/vnet/crypto/crypto.c index b447ffbfd5e..bad3970f419 100644 --- a/src/vnet/crypto/crypto.c +++ b/src/vnet/crypto/crypto.c @@ -239,28 +239,6 @@ vnet_crypto_key_del (vlib_main_t * vm, vnet_crypto_key_index_t index) pool_put (cm->keys, key); } -void -vnet_crypto_key_modify (vlib_main_t * vm, vnet_crypto_key_index_t index, - vnet_crypto_alg_t alg, u8 * data, u16 length) -{ - vnet_crypto_main_t *cm = &crypto_main; - vnet_crypto_engine_t *engine; - vnet_crypto_key_t *key = pool_elt_at_index (cm->keys, index); - - if (vec_len (key->data)) - clib_memset (key->data, 0, vec_len (key->data)); - vec_free (key->data); - vec_validate_aligned (key->data, length - 1, CLIB_CACHE_LINE_BYTES); - clib_memcpy (key->data, data, length); - key->alg = alg; - - /* *INDENT-OFF* */ - vec_foreach (engine, cm->engines) - if (engine->key_op_handler) - engine->key_op_handler (vm, VNET_CRYPTO_KEY_OP_MODIFY, index); - /* *INDENT-ON* */ -} - static void vnet_crypto_init_cipher_data (vnet_crypto_alg_t alg, vnet_crypto_op_id_t eid, vnet_crypto_op_id_t did, char *name, u8 is_aead) diff --git a/src/vnet/crypto/crypto.h b/src/vnet/crypto/crypto.h index 7267e06aaa0..89af8535c52 100644 --- a/src/vnet/crypto/crypto.h +++ b/src/vnet/crypto/crypto.h @@ -209,8 +209,6 @@ int vnet_crypto_set_handler (char *ops_handler_name, char *engine); u32 vnet_crypto_key_add (vlib_main_t * vm, vnet_crypto_alg_t alg, u8 * data, u16 length); void vnet_crypto_key_del (vlib_main_t * vm, vnet_crypto_key_index_t index); -void vnet_crypto_key_modify (vlib_main_t * vm, vnet_crypto_key_index_t index, - vnet_crypto_alg_t alg, u8 * data, u16 len); format_function_t format_vnet_crypto_alg; format_function_t format_vnet_crypto_engine; diff --git a/src/vnet/ipsec/ipsec.api b/src/vnet/ipsec/ipsec.api index 3a2c993f99c..bb9e8056251 100644 --- a/src/vnet/ipsec/ipsec.api +++ b/src/vnet/ipsec/ipsec.api @@ -305,27 +305,6 @@ define ipsec_sad_entry_add_del_reply u32 stat_index; }; -/** \brief IPsec: Update Security Association keys - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - - @param sa_id - sa id - - @param crypto_key - crypto keying material - @param integrity_key - integrity keying material -*/ - -autoreply define ipsec_sa_set_key -{ - u32 client_index; - u32 context; - - u32 sa_id; - - vl_api_key_t crypto_key; - vl_api_key_t integrity_key; -}; - /** \brief IPsec: Get SPD interfaces @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request @@ -467,25 +446,6 @@ define ipsec_sa_details { u64 total_data_size; }; -/** \brief Set key on IPsec interface - @param client_index - opaque cookie to identify the sender - @param context - sender context, to match reply w/ request - @param sw_if_index - index of tunnel interface - @param key_type - type of key being set - @param alg - algorithm used with key - @param key_len - length key in bytes - @param key - key -*/ -autoreply define ipsec_tunnel_if_set_key { - u32 client_index; - u32 context; - u32 sw_if_index; - u8 key_type; - u8 alg; - u8 key_len; - u8 key[128]; -}; - /** \brief Set new SA on IPsec interface @param client_index - opaque cookie to identify the sender @param context - sender context, to match reply w/ request diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index 5683b6c1f25..2c7c0d9626d 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -53,13 +53,11 @@ _(IPSEC_SPD_ADD_DEL, ipsec_spd_add_del) \ _(IPSEC_INTERFACE_ADD_DEL_SPD, ipsec_interface_add_del_spd) \ _(IPSEC_SPD_ENTRY_ADD_DEL, ipsec_spd_entry_add_del) \ _(IPSEC_SAD_ENTRY_ADD_DEL, ipsec_sad_entry_add_del) \ -_(IPSEC_SA_SET_KEY, ipsec_sa_set_key) \ _(IPSEC_SA_DUMP, ipsec_sa_dump) \ _(IPSEC_SPDS_DUMP, ipsec_spds_dump) \ _(IPSEC_SPD_DUMP, ipsec_spd_dump) \ _(IPSEC_SPD_INTERFACE_DUMP, ipsec_spd_interface_dump) \ _(IPSEC_TUNNEL_IF_ADD_DEL, ipsec_tunnel_if_add_del) \ -_(IPSEC_TUNNEL_IF_SET_KEY, ipsec_tunnel_if_set_key) \ _(IPSEC_TUNNEL_IF_SET_SA, ipsec_tunnel_if_set_sa) \ _(IPSEC_SELECT_BACKEND, ipsec_select_backend) \ _(IPSEC_BACKEND_DUMP, ipsec_backend_dump) @@ -592,29 +590,6 @@ vl_api_ipsec_spd_interface_dump_t_handler (vl_api_ipsec_spd_interface_dump_t * } static void -vl_api_ipsec_sa_set_key_t_handler (vl_api_ipsec_sa_set_key_t * mp) -{ - vlib_main_t *vm __attribute__ ((unused)) = vlib_get_main (); - vl_api_ipsec_sa_set_key_reply_t *rmp; - ipsec_key_t ck, ik; - u32 id; - int rv; -#if WITH_LIBSSL > 0 - - id = ntohl (mp->sa_id); - - ipsec_key_decode (&mp->crypto_key, &ck); - ipsec_key_decode (&mp->integrity_key, &ik); - - rv = ipsec_set_sa_key (id, &ck, &ik); -#else - rv = VNET_API_ERROR_UNIMPLEMENTED; -#endif - - REPLY_MACRO (VL_API_IPSEC_SA_SET_KEY_REPLY); -} - -static void vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * mp) { @@ -765,62 +740,6 @@ vl_api_ipsec_sa_dump_t_handler (vl_api_ipsec_sa_dump_t * mp) #endif } - -static void -vl_api_ipsec_tunnel_if_set_key_t_handler (vl_api_ipsec_tunnel_if_set_key_t * - mp) -{ - vl_api_ipsec_tunnel_if_set_key_reply_t *rmp; - ipsec_main_t *im = &ipsec_main; - vnet_main_t *vnm = im->vnet_main; - vnet_sw_interface_t *sw; - u8 *key = 0; - int rv; - -#if WITH_LIBSSL > 0 - sw = vnet_get_sw_interface (vnm, ntohl (mp->sw_if_index)); - - switch (mp->key_type) - { - case IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO: - case IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO: - if (mp->alg < IPSEC_CRYPTO_ALG_AES_CBC_128 || - mp->alg >= IPSEC_CRYPTO_N_ALG) - { - rv = VNET_API_ERROR_INVALID_ALGORITHM; - goto out; - } - break; - case IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG: - case IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG: - if (mp->alg >= IPSEC_INTEG_N_ALG) - { - rv = VNET_API_ERROR_INVALID_ALGORITHM; - goto out; - } - break; - case IPSEC_IF_SET_KEY_TYPE_NONE: - default: - rv = VNET_API_ERROR_UNIMPLEMENTED; - goto out; - break; - } - - key = vec_new (u8, mp->key_len); - clib_memcpy (key, mp->key, mp->key_len); - - rv = ipsec_set_interface_key (vnm, sw->hw_if_index, mp->key_type, mp->alg, - key); - vec_free (key); -#else - clib_warning ("unimplemented"); -#endif - -out: - REPLY_MACRO (VL_API_IPSEC_TUNNEL_IF_SET_KEY_REPLY); -} - - static void vl_api_ipsec_tunnel_if_set_sa_t_handler (vl_api_ipsec_tunnel_if_set_sa_t * mp) { diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c index 36ea6145993..312289ae7d8 100644 --- a/src/vnet/ipsec/ipsec_cli.c +++ b/src/vnet/ipsec/ipsec_cli.c @@ -346,54 +346,6 @@ VLIB_CLI_COMMAND (ipsec_policy_add_del_command, static) = { }; /* *INDENT-ON* */ -static clib_error_t * -set_ipsec_sa_key_command_fn (vlib_main_t * vm, - unformat_input_t * input, - vlib_cli_command_t * cmd) -{ - unformat_input_t _line_input, *line_input = &_line_input; - ipsec_key_t ck = { }, ik = - { - }; - clib_error_t *error = NULL; - u32 id; - - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (line_input, "%u", &id)) - ; - else - if (unformat (line_input, "crypto-key %U", unformat_ipsec_key, &ck)) - ; - else if (unformat (line_input, "integ-key %U", unformat_ipsec_key, &ik)) - ; - else - { - error = clib_error_return (0, "parse error: '%U'", - format_unformat_error, line_input); - goto done; - } - } - - ipsec_set_sa_key (id, &ck, &ik); - -done: - unformat_free (line_input); - - return error; -} - -/* *INDENT-OFF* */ -VLIB_CLI_COMMAND (set_ipsec_sa_key_command, static) = { - .path = "set ipsec sa", - .short_help = "set ipsec sa <id> crypto-key <key> integ-key <key>", - .function = set_ipsec_sa_key_command_fn, -}; -/* *INDENT-ON* */ - static void ipsec_sa_show_all (vlib_main_t * vm, ipsec_main_t * im) { @@ -869,89 +821,6 @@ VLIB_CLI_COMMAND (create_ipsec_tunnel_command, static) = { }; /* *INDENT-ON* */ -static clib_error_t * -set_interface_key_command_fn (vlib_main_t * vm, - unformat_input_t * input, - vlib_cli_command_t * cmd) -{ - unformat_input_t _line_input, *line_input = &_line_input; - ipsec_main_t *im = &ipsec_main; - ipsec_if_set_key_type_t type = IPSEC_IF_SET_KEY_TYPE_NONE; - u32 hw_if_index = (u32) ~ 0; - u32 alg; - u8 *key = 0; - clib_error_t *error = NULL; - - if (!unformat_user (input, unformat_line_input, line_input)) - return 0; - - while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) - { - if (unformat (line_input, "%U", - unformat_vnet_hw_interface, im->vnet_main, &hw_if_index)) - ; - else - if (unformat - (line_input, "local crypto %U", unformat_ipsec_crypto_alg, &alg)) - type = IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO; - else - if (unformat - (line_input, "remote crypto %U", unformat_ipsec_crypto_alg, &alg)) - type = IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO; - else - if (unformat - (line_input, "local integ %U", unformat_ipsec_integ_alg, &alg)) - type = IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG; - else - if (unformat - (line_input, "remote integ %U", unformat_ipsec_integ_alg, &alg)) - type = IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG; - else if (unformat (line_input, "%U", unformat_hex_string, &key)) - ; - else - { - error = clib_error_return (0, "parse error: '%U'", - format_unformat_error, line_input); - goto done; - } - } - - if (type == IPSEC_IF_SET_KEY_TYPE_NONE) - { - error = clib_error_return (0, "unknown key type"); - goto done; - } - - if (alg > 0 && vec_len (key) == 0) - { - error = clib_error_return (0, "key is not specified"); - goto done; - } - - if (hw_if_index == (u32) ~ 0) - { - error = clib_error_return (0, "interface not specified"); - goto done; - } - - ipsec_set_interface_key (im->vnet_main, hw_if_index, type, alg, key); - -done: - vec_free (key); - unformat_free (line_input); - - return error; -} - -/* *INDENT-OFF* */ -VLIB_CLI_COMMAND (set_interface_key_command, static) = { - .path = "set interface ipsec key", - .short_help = - "set interface ipsec key <int> <local|remote> <crypto|integ> <key type> <key>", - .function = set_interface_key_command_fn, -}; -/* *INDENT-ON* */ - clib_error_t * ipsec_cli_init (vlib_main_t * vm) { diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c index 8e2b4b5be1b..8e0fba28bad 100644 --- a/src/vnet/ipsec/ipsec_if.c +++ b/src/vnet/ipsec/ipsec_if.c @@ -514,65 +514,6 @@ ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm, } int -ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index, - ipsec_if_set_key_type_t type, u8 alg, u8 * key) -{ - vlib_main_t *vm = vlib_get_main (); - ipsec_main_t *im = &ipsec_main; - vnet_hw_interface_t *hi; - ipsec_tunnel_if_t *t; - ipsec_sa_t *sa; - - hi = vnet_get_hw_interface (vnm, hw_if_index); - t = pool_elt_at_index (im->tunnel_interfaces, hi->dev_instance); - - if (hi->flags & VNET_HW_INTERFACE_FLAG_LINK_UP) - return VNET_API_ERROR_SYSCALL_ERROR_1; - - if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO) - { - sa = pool_elt_at_index (im->sad, t->output_sa_index); - ipsec_sa_set_crypto_alg (sa, alg); - ipsec_mk_key (&sa->crypto_key, key, vec_len (key)); - sa->crypto_calg = im->crypto_algs[alg].alg; - vnet_crypto_key_modify (vm, sa->crypto_key_index, sa->crypto_calg, - key, vec_len (key)); - } - else if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG) - { - sa = pool_elt_at_index (im->sad, t->output_sa_index); - ipsec_sa_set_integ_alg (sa, alg); - ipsec_mk_key (&sa->integ_key, key, vec_len (key)); - sa->integ_calg = im->integ_algs[alg].alg; - vnet_crypto_key_modify (vm, sa->integ_key_index, sa->integ_calg, - key, vec_len (key)); - } - else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO) - { - sa = pool_elt_at_index (im->sad, t->input_sa_index); - ipsec_sa_set_crypto_alg (sa, alg); - ipsec_mk_key (&sa->crypto_key, key, vec_len (key)); - sa->crypto_calg = im->crypto_algs[alg].alg; - vnet_crypto_key_modify (vm, sa->crypto_key_index, sa->crypto_calg, - key, vec_len (key)); - } - else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG) - { - sa = pool_elt_at_index (im->sad, t->input_sa_index); - ipsec_sa_set_integ_alg (sa, alg); - ipsec_mk_key (&sa->integ_key, key, vec_len (key)); - sa->integ_calg = im->integ_algs[alg].alg; - vnet_crypto_key_modify (vm, sa->integ_key_index, sa->integ_calg, - key, vec_len (key)); - } - else - return VNET_API_ERROR_INVALID_VALUE; - - return 0; -} - - -int ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, u8 is_outbound) { diff --git a/src/vnet/ipsec/ipsec_if.h b/src/vnet/ipsec/ipsec_if.h index d1fa9bd4a91..40867108293 100644 --- a/src/vnet/ipsec/ipsec_if.h +++ b/src/vnet/ipsec/ipsec_if.h @@ -17,15 +17,6 @@ #include <vnet/ipsec/ipsec_sa.h> -typedef enum -{ - IPSEC_IF_SET_KEY_TYPE_NONE, - IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO, - IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO, - IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG, - IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG, -} ipsec_if_set_key_type_t; - typedef struct { /* Required for pool_get_aligned */ @@ -111,9 +102,6 @@ extern int ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm, ipsec_gre_tunnel_add_del_args_t * args); -extern int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index, - ipsec_if_set_key_type_t type, - u8 alg, u8 * key); extern int ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, u8 is_outbound); diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c index 8e8546985ec..633f640ced2 100644 --- a/src/vnet/ipsec/ipsec_sa.c +++ b/src/vnet/ipsec/ipsec_sa.c @@ -341,52 +341,6 @@ ipsec_is_sa_used (u32 sa_index) return 0; } -int -ipsec_set_sa_key (u32 id, const ipsec_key_t * ck, const ipsec_key_t * ik) -{ - vlib_main_t *vm = vlib_get_main (); - ipsec_main_t *im = &ipsec_main; - uword *p; - u32 sa_index; - ipsec_sa_t *sa = 0; - clib_error_t *err; - - p = hash_get (im->sa_index_by_sa_id, id); - if (!p) - return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */ - - sa_index = p[0]; - sa = pool_elt_at_index (im->sad, sa_index); - - /* new crypto key */ - if (ck) - { - clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key)); - vnet_crypto_key_modify (vm, sa->crypto_key_index, sa->crypto_calg, - (u8 *) ck->data, ck->len); - } - - /* new integ key */ - if (ik) - { - clib_memcpy (&sa->integ_key, ik, sizeof (sa->integ_key)); - vnet_crypto_key_modify (vm, sa->integ_key_index, sa->integ_calg, - (u8 *) ik->data, ik->len); - } - - if (ck || ik) - { - err = ipsec_call_add_del_callbacks (im, sa, sa_index, 0); - if (err) - { - clib_error_free (err); - return VNET_API_ERROR_SYSCALL_ERROR_1; - } - } - - return 0; -} - u32 ipsec_get_sa_index_by_sa_id (u32 sa_id) { diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h index e09b5391df3..969b5d142ee 100644 --- a/src/vnet/ipsec/ipsec_sa.h +++ b/src/vnet/ipsec/ipsec_sa.h @@ -214,8 +214,6 @@ extern void ipsec_sa_set_integ_alg (ipsec_sa_t * sa, ipsec_integ_alg_t integ_alg); extern u8 ipsec_is_sa_used (u32 sa_index); -extern int ipsec_set_sa_key (u32 id, - const ipsec_key_t * ck, const ipsec_key_t * ik); extern u32 ipsec_get_sa_index_by_sa_id (u32 sa_id); typedef walk_rc_t (*ipsec_sa_walk_cb_t) (ipsec_sa_t * sa, void *ctx); |