1 /* SPDX-License-Identifier: BSD-3-Clause 2 * Copyright(c) 2016-2017 Intel Corporation 3 */ 4 5 #ifndef __IPSEC_H__ 6 #define __IPSEC_H__ 7 8 #include <stdint.h> 9 10 #include <rte_byteorder.h> 11 #include <rte_crypto.h> 12 #include <rte_ip_frag.h> 13 #include <rte_security.h> 14 #include <rte_flow.h> 15 #include <rte_ipsec.h> 16 17 #include "event_helper.h" 18 #include "ipsec-secgw.h" 19 20 #define RTE_LOGTYPE_IPSEC_ESP RTE_LOGTYPE_USER2 21 #define RTE_LOGTYPE_IPSEC_IPIP RTE_LOGTYPE_USER3 22 23 #define MAX_INFLIGHT 128 24 #define MAX_QP_PER_LCORE 256 25 26 #define MAX_DIGEST_SIZE 32 /* Bytes -- 256 bits */ 27 28 #define IV_OFFSET (sizeof(struct rte_crypto_op) + \ 29 sizeof(struct rte_crypto_sym_op)) 30 31 #define DEFAULT_MAX_CATEGORIES 1 32 33 #define INVALID_SPI (0) 34 35 #define DISCARD INVALID_SPI 36 #define BYPASS UINT32_MAX 37 38 #define IPSEC_XFORM_MAX 2 39 40 #define IP6_VERSION (6) 41 42 #define SATP_OUT_IPV4(t) \ 43 ((((t) & RTE_IPSEC_SATP_MODE_MASK) == RTE_IPSEC_SATP_MODE_TRANS && \ 44 (((t) & RTE_IPSEC_SATP_IPV_MASK) == RTE_IPSEC_SATP_IPV4)) || \ 45 ((t) & RTE_IPSEC_SATP_MODE_MASK) == RTE_IPSEC_SATP_MODE_TUNLV4) 46 47 #define BAD_PORT ((uint16_t)-1) 48 49 struct rte_crypto_xform; 50 struct ipsec_xform; 51 struct rte_mbuf; 52 53 struct ipsec_sa; 54 /* 55 * Keeps number of configured SA's for each address family: 56 */ 57 struct ipsec_sa_cnt { 58 uint32_t nb_v4; 59 uint32_t nb_v6; 60 }; 61 62 typedef int32_t (*ipsec_xform_fn)(struct rte_mbuf *m, struct ipsec_sa *sa, 63 struct rte_crypto_op *cop); 64 65 struct ip_addr { 66 union { 67 uint32_t ip4; 68 struct rte_ipv6_addr ip6; 69 } ip; 70 }; 71 72 #define MAX_KEY_SIZE 64 73 /* 74 * application wide SA parameters 75 */ 76 struct app_sa_prm { 77 uint32_t enable; /* use librte_ipsec API for ipsec pkt processing */ 78 uint32_t window_size; /* replay window size */ 79 uint32_t enable_esn; /* enable/disable ESN support */ 80 uint32_t cache_sz; /* per lcore SA cache size */ 81 uint32_t udp_encap; /* enable/disable UDP Encapsulation */ 82 uint64_t flags; /* rte_ipsec_sa_prm.flags */ 83 }; 84 85 extern struct app_sa_prm app_sa_prm; 86 87 struct flow_info { 88 struct rte_flow *rx_def_flow; 89 }; 90 91 extern struct flow_info flow_info_tbl[RTE_MAX_ETHPORTS]; 92 93 enum { 94 IPSEC_SESSION_PRIMARY = 0, 95 IPSEC_SESSION_FALLBACK = 1, 96 IPSEC_SESSION_MAX 97 }; 98 99 #define IPSEC_SA_OFFLOAD_FALLBACK_FLAG (1) 100 101 static inline struct ipsec_sa * 102 ipsec_mask_saptr(void *ptr) 103 { 104 uintptr_t i = (uintptr_t)ptr; 105 static const uintptr_t mask = IPSEC_SA_OFFLOAD_FALLBACK_FLAG; 106 107 i &= ~mask; 108 109 return (struct ipsec_sa *)i; 110 } 111 112 struct __rte_cache_aligned ipsec_sa { 113 struct rte_ipsec_session sessions[IPSEC_SESSION_MAX]; 114 uint32_t spi; 115 struct cdev_qp *cqp[RTE_MAX_LCORE]; 116 uint64_t seq; 117 rte_be32_t salt; 118 uint32_t fallback_sessions; 119 enum rte_crypto_cipher_algorithm cipher_algo; 120 enum rte_crypto_auth_algorithm auth_algo; 121 enum rte_crypto_aead_algorithm aead_algo; 122 uint16_t digest_len; 123 uint16_t iv_len; 124 uint16_t block_size; 125 uint16_t flags; 126 #define IP4_TUNNEL (1 << 0) 127 #define IP6_TUNNEL (1 << 1) 128 #define TRANSPORT (1 << 2) 129 #define IP4_TRANSPORT (1 << 3) 130 #define IP6_TRANSPORT (1 << 4) 131 #define SA_TELEMETRY_ENABLE (1 << 5) 132 #define SA_REASSEMBLY_ENABLE (1 << 6) 133 134 struct ip_addr src; 135 struct ip_addr dst; 136 struct { 137 uint16_t sport; 138 uint16_t dport; 139 } udp; 140 uint8_t cipher_key[MAX_KEY_SIZE]; 141 uint16_t cipher_key_len; 142 uint8_t auth_key[MAX_KEY_SIZE]; 143 uint16_t auth_key_len; 144 uint16_t aad_len; 145 union { 146 struct rte_crypto_sym_xform *xforms; 147 struct rte_security_ipsec_xform *sec_xform; 148 }; 149 enum rte_security_ipsec_sa_direction direction; 150 uint8_t udp_encap; 151 uint16_t portid; 152 uint64_t esn; 153 uint16_t mss; 154 uint8_t fdir_qid; 155 uint8_t fdir_flag; 156 157 #define MAX_RTE_FLOW_PATTERN (5) 158 #define MAX_RTE_FLOW_ACTIONS (3) 159 struct rte_flow_item pattern[MAX_RTE_FLOW_PATTERN]; 160 struct rte_flow_action action[MAX_RTE_FLOW_ACTIONS]; 161 struct rte_flow_attr attr; 162 union { 163 struct rte_flow_item_ipv4 ipv4_spec; 164 struct rte_flow_item_ipv6 ipv6_spec; 165 }; 166 struct rte_flow_item_udp udp_spec; 167 struct rte_flow_item_esp esp_spec; 168 struct rte_flow *flow; 169 struct rte_security_session_conf sess_conf; 170 }; 171 172 struct ipsec_xf { 173 struct rte_crypto_sym_xform a; 174 struct rte_crypto_sym_xform b; 175 }; 176 177 struct ipsec_sad { 178 struct rte_ipsec_sad *sad_v4; 179 struct rte_ipsec_sad *sad_v6; 180 }; 181 182 struct sa_ctx { 183 void *satbl; /* pointer to array of rte_ipsec_sa objects*/ 184 struct ipsec_sad sad; 185 struct ipsec_xf *xf; 186 uint32_t nb_sa; 187 struct ipsec_sa sa[]; 188 }; 189 190 struct __rte_cache_aligned ipsec_mbuf_metadata { 191 struct ipsec_sa *sa; 192 struct rte_crypto_op cop; 193 struct rte_crypto_sym_op sym_cop; 194 uint8_t buf[32]; 195 }; 196 197 #define IS_TRANSPORT(flags) ((flags) & TRANSPORT) 198 199 #define IS_TUNNEL(flags) ((flags) & (IP4_TUNNEL | IP6_TUNNEL)) 200 201 #define IS_IP4(flags) ((flags) & (IP4_TUNNEL | IP4_TRANSPORT)) 202 203 #define IS_IP6(flags) ((flags) & (IP6_TUNNEL | IP6_TRANSPORT)) 204 205 #define IS_IP4_TUNNEL(flags) ((flags) & IP4_TUNNEL) 206 207 #define IS_IP6_TUNNEL(flags) ((flags) & IP6_TUNNEL) 208 209 #define IS_HW_REASSEMBLY_EN(flags) ((flags) & SA_REASSEMBLY_ENABLE) 210 /* 211 * Macro for getting ipsec_sa flags statuses without version of protocol 212 * used for transport (IP4_TRANSPORT and IP6_TRANSPORT flags). 213 */ 214 #define WITHOUT_TRANSPORT_VERSION(flags) \ 215 ((flags) & (IP4_TUNNEL | \ 216 IP6_TUNNEL | \ 217 TRANSPORT)) 218 219 struct cdev_qp { 220 uint16_t id; 221 uint16_t qp; 222 uint16_t in_flight; 223 uint16_t len; 224 struct rte_crypto_op *buf[MAX_PKT_BURST]; 225 }; 226 227 struct ipsec_ctx { 228 struct rte_hash *cdev_map; 229 struct sp_ctx *sp4_ctx; 230 struct sp_ctx *sp6_ctx; 231 struct sa_ctx *sa_ctx; 232 uint16_t nb_qps; 233 uint16_t last_qp; 234 struct cdev_qp tbl[MAX_QP_PER_LCORE]; 235 struct rte_mbuf *ol_pkts[MAX_PKT_BURST]; 236 uint16_t ol_pkts_cnt; 237 uint64_t ipv4_offloads; 238 uint64_t ipv6_offloads; 239 uint32_t lcore_id; 240 }; 241 242 struct offloads { 243 uint64_t ipv4_offloads; 244 uint64_t ipv6_offloads; 245 }; 246 247 extern struct offloads tx_offloads; 248 249 /* 250 * This structure is used for the key in hash table. 251 * Padding is to force the struct to use 8 bytes, 252 * to ensure memory is not read past this structs boundary 253 * (hash key calculation reads 8 bytes if this struct is size 5 bytes). 254 */ 255 struct cdev_key { 256 uint32_t lcore_id; 257 uint8_t cipher_algo; 258 uint8_t auth_algo; 259 uint8_t aead_algo; 260 uint8_t padding; /* padding to 8-byte size should be zeroed */ 261 }; 262 263 struct socket_ctx { 264 struct sa_ctx *sa_in; 265 struct sa_ctx *sa_out; 266 struct sp_ctx *sp_ip4_in; 267 struct sp_ctx *sp_ip4_out; 268 struct sp_ctx *sp_ip6_in; 269 struct sp_ctx *sp_ip6_out; 270 struct rt_ctx *rt_ip4; 271 struct rt_ctx *rt_ip6; 272 struct rte_mempool *mbuf_pool[RTE_MAX_ETHPORTS]; 273 struct rte_mempool *mbuf_pool_indir; 274 struct rte_mempool *session_pool; 275 }; 276 277 struct __rte_packed_begin cnt_blk { 278 uint32_t salt; 279 uint64_t iv; 280 uint32_t cnt; 281 } __rte_packed_end; 282 283 struct __rte_cache_aligned lcore_rx_queue { 284 uint16_t port_id; 285 uint16_t queue_id; 286 void *sec_ctx; 287 }; 288 289 struct buffer { 290 uint16_t len; 291 struct rte_mbuf *m_table[MAX_PKT_BURST]; 292 }; 293 294 struct __rte_cache_aligned lcore_conf { 295 uint16_t nb_rx_queue; 296 struct lcore_rx_queue rx_queue_list[MAX_RX_QUEUE_PER_LCORE]; 297 uint16_t tx_queue_id[RTE_MAX_ETHPORTS]; 298 struct buffer tx_mbufs[RTE_MAX_ETHPORTS]; 299 struct ipsec_ctx inbound; 300 struct ipsec_ctx outbound; 301 struct rt_ctx *rt4_ctx; 302 struct rt_ctx *rt6_ctx; 303 struct { 304 struct rte_ip_frag_tbl *tbl; 305 struct rte_mempool *pool_indir; 306 struct rte_ip_frag_death_row dr; 307 } frag; 308 }; 309 310 extern struct lcore_conf lcore_conf[RTE_MAX_LCORE]; 311 312 /* Socket ctx */ 313 extern struct socket_ctx socket_ctx[NB_SOCKETS]; 314 315 void 316 ipsec_poll_mode_worker(void); 317 318 int 319 ipsec_launch_one_lcore(void *args); 320 321 extern struct ipsec_sa *sa_out; 322 extern uint32_t nb_sa_out; 323 324 extern struct ipsec_sa *sa_in; 325 extern uint32_t nb_sa_in; 326 327 uint16_t 328 ipsec_inbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], 329 uint16_t nb_pkts, uint16_t len); 330 331 uint16_t 332 ipsec_outbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], 333 uint32_t sa_idx[], uint16_t nb_pkts, uint16_t len); 334 335 uint16_t 336 ipsec_inbound_cqp_dequeue(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], 337 uint16_t len); 338 339 uint16_t 340 ipsec_outbound_cqp_dequeue(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], 341 uint16_t len); 342 343 void 344 ipsec_process(struct ipsec_ctx *ctx, struct ipsec_traffic *trf); 345 346 void 347 ipsec_cqp_process(struct ipsec_ctx *ctx, struct ipsec_traffic *trf); 348 349 static inline uint16_t 350 ipsec_metadata_size(void) 351 { 352 return sizeof(struct ipsec_mbuf_metadata); 353 } 354 355 static inline struct ipsec_mbuf_metadata * 356 get_priv(struct rte_mbuf *m) 357 { 358 return rte_mbuf_to_priv(m); 359 } 360 361 static inline void * 362 get_cnt_blk(struct rte_mbuf *m) 363 { 364 struct ipsec_mbuf_metadata *priv = get_priv(m); 365 366 return &priv->buf[0]; 367 } 368 369 static inline void * 370 get_aad(struct rte_mbuf *m) 371 { 372 struct ipsec_mbuf_metadata *priv = get_priv(m); 373 374 return &priv->buf[16]; 375 } 376 377 static inline void * 378 get_sym_cop(struct rte_crypto_op *cop) 379 { 380 return (cop + 1); 381 } 382 383 static inline struct rte_ipsec_session * 384 ipsec_get_primary_session(struct ipsec_sa *sa) 385 { 386 return &sa->sessions[IPSEC_SESSION_PRIMARY]; 387 } 388 389 static inline struct rte_ipsec_session * 390 ipsec_get_fallback_session(struct ipsec_sa *sa) 391 { 392 return &sa->sessions[IPSEC_SESSION_FALLBACK]; 393 } 394 395 static inline enum rte_security_session_action_type 396 ipsec_get_action_type(struct ipsec_sa *sa) 397 { 398 struct rte_ipsec_session *ips; 399 ips = ipsec_get_primary_session(sa); 400 return ips->type; 401 } 402 403 int 404 inbound_sa_check(struct sa_ctx *sa_ctx, struct rte_mbuf *m, uint32_t sa_idx); 405 406 void 407 inbound_sa_lookup(struct sa_ctx *sa_ctx, struct rte_mbuf *pkts[], 408 void *sa[], uint16_t nb_pkts); 409 410 void 411 outbound_sa_lookup(struct sa_ctx *sa_ctx, uint32_t sa_idx[], 412 void *sa[], uint16_t nb_pkts); 413 414 void 415 sp4_init(struct socket_ctx *ctx, int32_t socket_id); 416 417 void 418 sp6_init(struct socket_ctx *ctx, int32_t socket_id); 419 420 /* 421 * Search through SP rules for given SPI. 422 * Returns first rule index if found(greater or equal then zero), 423 * or -ENOENT otherwise. 424 */ 425 int 426 sp4_spi_present(uint32_t spi, int inbound, struct ip_addr ip_addr[2], 427 uint32_t mask[2]); 428 int 429 sp6_spi_present(uint32_t spi, int inbound, struct ip_addr ip_addr[2], 430 uint32_t mask[2]); 431 432 /* 433 * Search through SA entries for given SPI. 434 * Returns first entry index if found(greater or equal then zero), 435 * or -ENOENT otherwise. 436 */ 437 int 438 sa_spi_present(struct sa_ctx *sa_ctx, uint32_t spi, int inbound); 439 440 void 441 sa_init(struct socket_ctx *ctx, int32_t socket_id, 442 struct lcore_conf *lcore_conf, 443 const struct eventmode_conf *em_conf); 444 445 void 446 rt_init(struct socket_ctx *ctx, int32_t socket_id); 447 448 int 449 sa_check_offloads(uint16_t port_id, uint64_t *rx_offloads, 450 uint64_t *tx_offloads, uint8_t *hw_reassembly); 451 452 int 453 add_dst_ethaddr(uint16_t port, const struct rte_ether_addr *addr); 454 455 void 456 enqueue_cop_burst(struct cdev_qp *cqp); 457 458 int 459 create_lookaside_session(struct ipsec_ctx *ipsec_ctx[], 460 struct socket_ctx *skt_ctx, const struct eventmode_conf *em_conf, 461 struct ipsec_sa *sa, struct rte_ipsec_session *ips); 462 463 int 464 create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa, 465 struct rte_ipsec_session *ips); 466 int 467 check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid); 468 469 int 470 create_ipsec_esp_flow(struct ipsec_sa *sa); 471 472 uint32_t 473 get_nb_crypto_sessions(void); 474 475 #endif /* __IPSEC_H__ */ 476