1 /*- 2 * BSD LICENSE 3 * 4 * Copyright(c) 2016 Intel Corporation. All rights reserved. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * * Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * * Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in 15 * the documentation and/or other materials provided with the 16 * distribution. 17 * * Neither the name of Intel Corporation nor the names of its 18 * contributors may be used to endorse or promote products derived 19 * from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 24 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 25 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 26 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 27 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 31 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 #ifndef __IPSEC_H__ 35 #define __IPSEC_H__ 36 37 #include <stdint.h> 38 #include <netinet/in.h> 39 #include <netinet/ip.h> 40 41 #include <rte_byteorder.h> 42 #include <rte_ip.h> 43 #include <rte_crypto.h> 44 45 #define RTE_LOGTYPE_IPSEC RTE_LOGTYPE_USER1 46 #define RTE_LOGTYPE_IPSEC_ESP RTE_LOGTYPE_USER2 47 #define RTE_LOGTYPE_IPSEC_IPIP RTE_LOGTYPE_USER3 48 49 #define MAX_PKT_BURST 32 50 #define MAX_QP_PER_LCORE 256 51 52 #ifdef IPSEC_DEBUG 53 #define IPSEC_ASSERT(exp) \ 54 if (!(exp)) { \ 55 rte_panic("line%d\tassert \"" #exp "\" failed\n", __LINE__); \ 56 } 57 58 #define IPSEC_LOG RTE_LOG 59 #else 60 #define IPSEC_ASSERT(exp) do {} while (0) 61 #define IPSEC_LOG(...) do {} while (0) 62 #endif /* IPSEC_DEBUG */ 63 64 #define MAX_DIGEST_SIZE 32 /* Bytes -- 256 bits */ 65 66 #define uint32_t_to_char(ip, a, b, c, d) do {\ 67 *a = (unsigned char)(ip >> 24 & 0xff);\ 68 *b = (unsigned char)(ip >> 16 & 0xff);\ 69 *c = (unsigned char)(ip >> 8 & 0xff);\ 70 *d = (unsigned char)(ip & 0xff);\ 71 } while (0) 72 73 #define DEFAULT_MAX_CATEGORIES 1 74 75 #define IPSEC_SA_MAX_ENTRIES (64) /* must be power of 2, max 2 power 30 */ 76 #define SPI2IDX(spi) (spi & (IPSEC_SA_MAX_ENTRIES - 1)) 77 #define INVALID_SPI (0) 78 79 #define DISCARD (0x80000000) 80 #define BYPASS (0x40000000) 81 #define PROTECT_MASK (0x3fffffff) 82 #define PROTECT(sa_idx) (SPI2IDX(sa_idx) & PROTECT_MASK) /* SA idx 30 bits */ 83 84 #define IPSEC_XFORM_MAX 2 85 86 struct rte_crypto_xform; 87 struct ipsec_xform; 88 struct rte_cryptodev_session; 89 struct rte_mbuf; 90 91 struct ipsec_sa; 92 93 typedef int (*ipsec_xform_fn)(struct rte_mbuf *m, struct ipsec_sa *sa, 94 struct rte_crypto_op *cop); 95 96 struct ipsec_sa { 97 uint32_t spi; 98 uint32_t cdev_id_qp; 99 uint32_t src; 100 uint32_t dst; 101 struct rte_cryptodev_sym_session *crypto_session; 102 struct rte_crypto_sym_xform *xforms; 103 ipsec_xform_fn pre_crypto; 104 ipsec_xform_fn post_crypto; 105 enum rte_crypto_cipher_algorithm cipher_algo; 106 enum rte_crypto_auth_algorithm auth_algo; 107 uint16_t digest_len; 108 uint16_t iv_len; 109 uint16_t block_size; 110 uint16_t flags; 111 uint32_t seq; 112 } __rte_cache_aligned; 113 114 struct ipsec_mbuf_metadata { 115 struct ipsec_sa *sa; 116 struct rte_crypto_op cop; 117 struct rte_crypto_sym_op sym_cop; 118 }; 119 120 struct cdev_qp { 121 uint16_t id; 122 uint16_t qp; 123 uint16_t in_flight; 124 uint16_t len; 125 struct rte_crypto_op *buf[MAX_PKT_BURST] __rte_aligned(sizeof(void *)); 126 }; 127 128 struct ipsec_ctx { 129 struct rte_hash *cdev_map; 130 struct sp_ctx *sp_ctx; 131 struct sa_ctx *sa_ctx; 132 uint16_t nb_qps; 133 uint16_t last_qp; 134 struct cdev_qp tbl[MAX_QP_PER_LCORE]; 135 }; 136 137 struct cdev_key { 138 uint16_t lcore_id; 139 uint8_t cipher_algo; 140 uint8_t auth_algo; 141 }; 142 143 struct socket_ctx { 144 struct sa_ctx *sa_ipv4_in; 145 struct sa_ctx *sa_ipv4_out; 146 struct sp_ctx *sp_ipv4_in; 147 struct sp_ctx *sp_ipv4_out; 148 struct rt_ctx *rt_ipv4; 149 struct rte_mempool *mbuf_pool; 150 }; 151 152 uint16_t 153 ipsec_inbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], 154 uint16_t nb_pkts, uint16_t len); 155 156 uint16_t 157 ipsec_outbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], 158 uint32_t sa_idx[], uint16_t nb_pkts, uint16_t len); 159 160 static inline uint16_t 161 ipsec_metadata_size(void) 162 { 163 return sizeof(struct ipsec_mbuf_metadata); 164 } 165 166 static inline struct ipsec_mbuf_metadata * 167 get_priv(struct rte_mbuf *m) 168 { 169 return RTE_PTR_ADD(m, sizeof(struct rte_mbuf)); 170 } 171 172 int 173 inbound_sa_check(struct sa_ctx *sa_ctx, struct rte_mbuf *m, uint32_t sa_idx); 174 175 void 176 inbound_sa_lookup(struct sa_ctx *sa_ctx, struct rte_mbuf *pkts[], 177 struct ipsec_sa *sa[], uint16_t nb_pkts); 178 179 void 180 outbound_sa_lookup(struct sa_ctx *sa_ctx, uint32_t sa_idx[], 181 struct ipsec_sa *sa[], uint16_t nb_pkts); 182 183 void 184 sp_init(struct socket_ctx *ctx, int socket_id, unsigned ep); 185 186 void 187 sa_init(struct socket_ctx *ctx, int socket_id, unsigned ep); 188 189 void 190 rt_init(struct socket_ctx *ctx, int socket_id, unsigned ep); 191 192 #endif /* __IPSEC_H__ */ 193