1 /*- 2 * BSD LICENSE 3 * 4 * Copyright(c) 2016 Intel Corporation. All rights reserved. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * * Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * * Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in 15 * the documentation and/or other materials provided with the 16 * distribution. 17 * * Neither the name of Intel Corporation nor the names of its 18 * contributors may be used to endorse or promote products derived 19 * from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 24 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 25 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 26 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 27 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 31 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 #ifndef __IPSEC_H__ 35 #define __IPSEC_H__ 36 37 #include <stdint.h> 38 39 #include <rte_byteorder.h> 40 #include <rte_crypto.h> 41 42 #define RTE_LOGTYPE_IPSEC RTE_LOGTYPE_USER1 43 #define RTE_LOGTYPE_IPSEC_ESP RTE_LOGTYPE_USER2 44 #define RTE_LOGTYPE_IPSEC_IPIP RTE_LOGTYPE_USER3 45 46 #define MAX_PKT_BURST 32 47 #define MAX_QP_PER_LCORE 256 48 49 #define MAX_DIGEST_SIZE 32 /* Bytes -- 256 bits */ 50 51 #define uint32_t_to_char(ip, a, b, c, d) do {\ 52 *a = (uint8_t)(ip >> 24 & 0xff);\ 53 *b = (uint8_t)(ip >> 16 & 0xff);\ 54 *c = (uint8_t)(ip >> 8 & 0xff);\ 55 *d = (uint8_t)(ip & 0xff);\ 56 } while (0) 57 58 #define DEFAULT_MAX_CATEGORIES 1 59 60 #define IPSEC_SA_MAX_ENTRIES (128) /* must be power of 2, max 2 power 30 */ 61 #define SPI2IDX(spi) (spi & (IPSEC_SA_MAX_ENTRIES - 1)) 62 #define INVALID_SPI (0) 63 64 #define DISCARD (0x80000000) 65 #define BYPASS (0x40000000) 66 #define PROTECT_MASK (0x3fffffff) 67 #define PROTECT(sa_idx) (SPI2IDX(sa_idx) & PROTECT_MASK) /* SA idx 30 bits */ 68 69 #define IPSEC_XFORM_MAX 2 70 71 #define IP6_VERSION (6) 72 73 struct rte_crypto_xform; 74 struct ipsec_xform; 75 struct rte_cryptodev_session; 76 struct rte_mbuf; 77 78 struct ipsec_sa; 79 80 typedef int32_t (*ipsec_xform_fn)(struct rte_mbuf *m, struct ipsec_sa *sa, 81 struct rte_crypto_op *cop); 82 83 struct ip_addr { 84 union { 85 uint32_t ip4; 86 union { 87 uint64_t ip6[2]; 88 uint8_t ip6_b[16]; 89 } ip6; 90 } ip; 91 }; 92 93 struct ipsec_sa { 94 uint32_t spi; 95 uint32_t cdev_id_qp; 96 struct rte_cryptodev_sym_session *crypto_session; 97 uint32_t seq; 98 enum rte_crypto_cipher_algorithm cipher_algo; 99 enum rte_crypto_auth_algorithm auth_algo; 100 uint16_t digest_len; 101 uint16_t iv_len; 102 uint16_t block_size; 103 uint16_t flags; 104 #define IP4_TUNNEL (1 << 0) 105 #define IP6_TUNNEL (1 << 1) 106 #define TRANSPORT (1 << 2) 107 struct ip_addr src; 108 struct ip_addr dst; 109 struct rte_crypto_sym_xform *xforms; 110 } __rte_cache_aligned; 111 112 struct ipsec_mbuf_metadata { 113 struct ipsec_sa *sa; 114 struct rte_crypto_op cop; 115 struct rte_crypto_sym_op sym_cop; 116 }; 117 118 struct cdev_qp { 119 uint16_t id; 120 uint16_t qp; 121 uint16_t in_flight; 122 uint16_t len; 123 struct rte_crypto_op *buf[MAX_PKT_BURST] __rte_aligned(sizeof(void *)); 124 }; 125 126 struct ipsec_ctx { 127 struct rte_hash *cdev_map; 128 struct sp_ctx *sp4_ctx; 129 struct sp_ctx *sp6_ctx; 130 struct sa_ctx *sa_ctx; 131 uint16_t nb_qps; 132 uint16_t last_qp; 133 struct cdev_qp tbl[MAX_QP_PER_LCORE]; 134 }; 135 136 struct cdev_key { 137 uint16_t lcore_id; 138 uint8_t cipher_algo; 139 uint8_t auth_algo; 140 }; 141 142 struct socket_ctx { 143 struct sa_ctx *sa_in; 144 struct sa_ctx *sa_out; 145 struct sp_ctx *sp_ip4_in; 146 struct sp_ctx *sp_ip4_out; 147 struct sp_ctx *sp_ip6_in; 148 struct sp_ctx *sp_ip6_out; 149 struct rt_ctx *rt_ip4; 150 struct rt_ctx *rt_ip6; 151 struct rte_mempool *mbuf_pool; 152 }; 153 154 uint16_t 155 ipsec_inbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], 156 uint16_t nb_pkts, uint16_t len); 157 158 uint16_t 159 ipsec_outbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], 160 uint32_t sa_idx[], uint16_t nb_pkts, uint16_t len); 161 162 static inline uint16_t 163 ipsec_metadata_size(void) 164 { 165 return sizeof(struct ipsec_mbuf_metadata); 166 } 167 168 static inline struct ipsec_mbuf_metadata * 169 get_priv(struct rte_mbuf *m) 170 { 171 return RTE_PTR_ADD(m, sizeof(struct rte_mbuf)); 172 } 173 174 int 175 inbound_sa_check(struct sa_ctx *sa_ctx, struct rte_mbuf *m, uint32_t sa_idx); 176 177 void 178 inbound_sa_lookup(struct sa_ctx *sa_ctx, struct rte_mbuf *pkts[], 179 struct ipsec_sa *sa[], uint16_t nb_pkts); 180 181 void 182 outbound_sa_lookup(struct sa_ctx *sa_ctx, uint32_t sa_idx[], 183 struct ipsec_sa *sa[], uint16_t nb_pkts); 184 185 void 186 sp4_init(struct socket_ctx *ctx, int32_t socket_id, uint32_t ep); 187 188 void 189 sp6_init(struct socket_ctx *ctx, int32_t socket_id, uint32_t ep); 190 191 void 192 sa_init(struct socket_ctx *ctx, int32_t socket_id, uint32_t ep); 193 194 void 195 rt_init(struct socket_ctx *ctx, int32_t socket_id, uint32_t ep); 196 197 #endif /* __IPSEC_H__ */ 198