1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(c) 2016 Intel Corporation
3 */
4
5 /*
6 * Security Policies
7 */
8 #include <sys/types.h>
9 #include <netinet/in.h>
10 #include <netinet/ip6.h>
11
12 #include <rte_acl.h>
13 #include <rte_ip.h>
14
15 #include "ipsec.h"
16 #include "parser.h"
17
18 #define INIT_ACL_RULE_NUM 128
19
20 #define IPV6_FROM_SP(acr, fidx_low, fidx_high) \
21 (((uint64_t)(acr).field[(fidx_high)].value.u32 << 32) | \
22 (acr).field[(fidx_low)].value.u32)
23
24 #define IPV6_DST_FROM_SP(addr, acr) do {\
25 (addr).ip.ip6.ip6[0] = rte_cpu_to_be_64(IPV6_FROM_SP((acr), \
26 IP6_DST1, IP6_DST0));\
27 (addr).ip.ip6.ip6[1] = rte_cpu_to_be_64(IPV6_FROM_SP((acr), \
28 IP6_DST3, IP6_DST2));\
29 } while (0)
30
31 #define IPV6_SRC_FROM_SP(addr, acr) do {\
32 (addr).ip.ip6.ip6[0] = rte_cpu_to_be_64(IPV6_FROM_SP((acr), \
33 IP6_SRC1, IP6_SRC0));\
34 (addr).ip.ip6.ip6[1] = rte_cpu_to_be_64(IPV6_FROM_SP((acr), \
35 IP6_SRC3, IP6_SRC2));\
36 } while (0)
37
38 #define IPV6_DST_MASK_FROM_SP(mask, acr) \
39 ((mask) = (acr).field[IP6_DST0].mask_range.u32 + \
40 (acr).field[IP6_DST1].mask_range.u32 + \
41 (acr).field[IP6_DST2].mask_range.u32 + \
42 (acr).field[IP6_DST3].mask_range.u32)
43
44 #define IPV6_SRC_MASK_FROM_SP(mask, acr) \
45 ((mask) = (acr).field[IP6_SRC0].mask_range.u32 + \
46 (acr).field[IP6_SRC1].mask_range.u32 + \
47 (acr).field[IP6_SRC2].mask_range.u32 + \
48 (acr).field[IP6_SRC3].mask_range.u32)
49
50 enum {
51 IP6_PROTO,
52 IP6_SRC0,
53 IP6_SRC1,
54 IP6_SRC2,
55 IP6_SRC3,
56 IP6_DST0,
57 IP6_DST1,
58 IP6_DST2,
59 IP6_DST3,
60 IP6_SRCP,
61 IP6_DSTP,
62 IP6_NUM
63 };
64
65 #define IP6_ADDR_SIZE 16
66
67 static struct rte_acl_field_def ip6_defs[IP6_NUM] = {
68 {
69 .type = RTE_ACL_FIELD_TYPE_BITMASK,
70 .size = sizeof(uint8_t),
71 .field_index = IP6_PROTO,
72 .input_index = IP6_PROTO,
73 .offset = 0,
74 },
75 {
76 .type = RTE_ACL_FIELD_TYPE_MASK,
77 .size = 4,
78 .field_index = IP6_SRC0,
79 .input_index = IP6_SRC0,
80 .offset = 2
81 },
82 {
83 .type = RTE_ACL_FIELD_TYPE_MASK,
84 .size = 4,
85 .field_index = IP6_SRC1,
86 .input_index = IP6_SRC1,
87 .offset = 6
88 },
89 {
90 .type = RTE_ACL_FIELD_TYPE_MASK,
91 .size = 4,
92 .field_index = IP6_SRC2,
93 .input_index = IP6_SRC2,
94 .offset = 10
95 },
96 {
97 .type = RTE_ACL_FIELD_TYPE_MASK,
98 .size = 4,
99 .field_index = IP6_SRC3,
100 .input_index = IP6_SRC3,
101 .offset = 14
102 },
103 {
104 .type = RTE_ACL_FIELD_TYPE_MASK,
105 .size = 4,
106 .field_index = IP6_DST0,
107 .input_index = IP6_DST0,
108 .offset = 18
109 },
110 {
111 .type = RTE_ACL_FIELD_TYPE_MASK,
112 .size = 4,
113 .field_index = IP6_DST1,
114 .input_index = IP6_DST1,
115 .offset = 22
116 },
117 {
118 .type = RTE_ACL_FIELD_TYPE_MASK,
119 .size = 4,
120 .field_index = IP6_DST2,
121 .input_index = IP6_DST2,
122 .offset = 26
123 },
124 {
125 .type = RTE_ACL_FIELD_TYPE_MASK,
126 .size = 4,
127 .field_index = IP6_DST3,
128 .input_index = IP6_DST3,
129 .offset = 30
130 },
131 {
132 .type = RTE_ACL_FIELD_TYPE_RANGE,
133 .size = sizeof(uint16_t),
134 .field_index = IP6_SRCP,
135 .input_index = IP6_SRCP,
136 .offset = 34
137 },
138 {
139 .type = RTE_ACL_FIELD_TYPE_RANGE,
140 .size = sizeof(uint16_t),
141 .field_index = IP6_DSTP,
142 .input_index = IP6_SRCP,
143 .offset = 36
144 }
145 };
146
147 RTE_ACL_RULE_DEF(acl6_rules, RTE_DIM(ip6_defs));
148
149 static struct acl6_rules *acl6_rules_out;
150 static uint32_t nb_acl6_rules_out;
151 static uint32_t sp_out_sz;
152
153 static struct acl6_rules *acl6_rules_in;
154 static uint32_t nb_acl6_rules_in;
155 static uint32_t sp_in_sz;
156
157 static int
extend_sp_arr(struct acl6_rules ** sp_tbl,uint32_t cur_cnt,uint32_t * cur_sz)158 extend_sp_arr(struct acl6_rules **sp_tbl, uint32_t cur_cnt, uint32_t *cur_sz)
159 {
160 if (*sp_tbl == NULL) {
161 *sp_tbl = calloc(INIT_ACL_RULE_NUM, sizeof(struct acl6_rules));
162 if (*sp_tbl == NULL)
163 return -1;
164 *cur_sz = INIT_ACL_RULE_NUM;
165 return 0;
166 }
167
168 if (cur_cnt >= *cur_sz) {
169 *sp_tbl = realloc(*sp_tbl,
170 *cur_sz * sizeof(struct acl6_rules) * 2);
171 if (*sp_tbl == NULL)
172 return -1;
173 /* clean reallocated extra space */
174 memset(&(*sp_tbl)[*cur_sz], 0,
175 *cur_sz * sizeof(struct acl6_rules));
176 *cur_sz *= 2;
177 }
178
179 return 0;
180 }
181
182 void
parse_sp6_tokens(char ** tokens,uint32_t n_tokens,struct parse_status * status)183 parse_sp6_tokens(char **tokens, uint32_t n_tokens,
184 struct parse_status *status)
185 {
186 struct acl6_rules *rule_ipv6 = NULL;
187
188 uint32_t *ri = NULL; /* rule index */
189 uint32_t ti = 0; /* token index */
190 uint32_t tv;
191
192 uint32_t esp_p = 0;
193 uint32_t protect_p = 0;
194 uint32_t bypass_p = 0;
195 uint32_t discard_p = 0;
196 uint32_t pri_p = 0;
197 uint32_t src_p = 0;
198 uint32_t dst_p = 0;
199 uint32_t proto_p = 0;
200 uint32_t sport_p = 0;
201 uint32_t dport_p = 0;
202
203 if (strcmp(tokens[1], "in") == 0) {
204 ri = &nb_acl6_rules_in;
205
206 if (extend_sp_arr(&acl6_rules_in, nb_acl6_rules_in,
207 &sp_in_sz) < 0)
208 return;
209
210 rule_ipv6 = &acl6_rules_in[*ri];
211
212 } else if (strcmp(tokens[1], "out") == 0) {
213 ri = &nb_acl6_rules_out;
214
215 if (extend_sp_arr(&acl6_rules_out, nb_acl6_rules_out,
216 &sp_out_sz) < 0)
217 return;
218
219 rule_ipv6 = &acl6_rules_out[*ri];
220
221 } else {
222 APP_CHECK(0, status, "unrecognized input \"%s\", expect"
223 " \"in\" or \"out\"\n", tokens[ti]);
224 return;
225 }
226
227 rule_ipv6->data.category_mask = 1;
228
229
230 for (ti = 2; ti < n_tokens; ti++) {
231 if (strcmp(tokens[ti], "esp") == 0) {
232 /* currently do nothing */
233 APP_CHECK_PRESENCE(esp_p, tokens[ti], status);
234 if (status->status < 0)
235 return;
236 esp_p = 1;
237 continue;
238 }
239
240 if (strcmp(tokens[ti], "protect") == 0) {
241 APP_CHECK_PRESENCE(protect_p, tokens[ti], status);
242 if (status->status < 0)
243 return;
244 APP_CHECK(bypass_p == 0, status, "conflict item "
245 "between \"%s\" and \"%s\"", tokens[ti],
246 "bypass");
247 if (status->status < 0)
248 return;
249 APP_CHECK(discard_p == 0, status, "conflict item "
250 "between \"%s\" and \"%s\"", tokens[ti],
251 "discard");
252 if (status->status < 0)
253 return;
254 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
255 if (status->status < 0)
256 return;
257 APP_CHECK_TOKEN_IS_NUM(tokens, ti, status);
258 if (status->status < 0)
259 return;
260
261 tv = atoi(tokens[ti]);
262 APP_CHECK(tv != DISCARD && tv != BYPASS, status,
263 "invalid SPI: %s", tokens[ti]);
264 if (status->status < 0)
265 return;
266 rule_ipv6->data.userdata = tv;
267
268 protect_p = 1;
269 continue;
270 }
271
272 if (strcmp(tokens[ti], "bypass") == 0) {
273 APP_CHECK_PRESENCE(bypass_p, tokens[ti], status);
274 if (status->status < 0)
275 return;
276 APP_CHECK(protect_p == 0, status, "conflict item "
277 "between \"%s\" and \"%s\"", tokens[ti],
278 "protect");
279 if (status->status < 0)
280 return;
281 APP_CHECK(discard_p == 0, status, "conflict item "
282 "between \"%s\" and \"%s\"", tokens[ti],
283 "discard");
284 if (status->status < 0)
285 return;
286
287 rule_ipv6->data.userdata = BYPASS;
288
289 bypass_p = 1;
290 continue;
291 }
292
293 if (strcmp(tokens[ti], "discard") == 0) {
294 APP_CHECK_PRESENCE(discard_p, tokens[ti], status);
295 if (status->status < 0)
296 return;
297 APP_CHECK(protect_p == 0, status, "conflict item "
298 "between \"%s\" and \"%s\"", tokens[ti],
299 "protect");
300 if (status->status < 0)
301 return;
302 APP_CHECK(bypass_p == 0, status, "conflict item "
303 "between \"%s\" and \"%s\"", tokens[ti],
304 "discard");
305 if (status->status < 0)
306 return;
307
308 rule_ipv6->data.userdata = DISCARD;
309
310 discard_p = 1;
311 continue;
312 }
313
314 if (strcmp(tokens[ti], "pri") == 0) {
315 APP_CHECK_PRESENCE(pri_p, tokens[ti], status);
316 if (status->status < 0)
317 return;
318 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
319 if (status->status < 0)
320 return;
321 APP_CHECK_TOKEN_IS_NUM(tokens, ti, status);
322 if (status->status < 0)
323 return;
324
325 rule_ipv6->data.priority = atoi(tokens[ti]);
326
327 pri_p = 1;
328 continue;
329 }
330
331 if (strcmp(tokens[ti], "src") == 0) {
332 struct in6_addr ip;
333 uint32_t depth;
334
335 APP_CHECK_PRESENCE(src_p, tokens[ti], status);
336 if (status->status < 0)
337 return;
338 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
339 if (status->status < 0)
340 return;
341
342 APP_CHECK(parse_ipv6_addr(tokens[ti], &ip,
343 &depth) == 0, status, "unrecognized "
344 "input \"%s\", expect valid ipv6 "
345 "addr", tokens[ti]);
346 if (status->status < 0)
347 return;
348
349 rule_ipv6->field[1].value.u32 =
350 (uint32_t)ip.s6_addr[0] << 24 |
351 (uint32_t)ip.s6_addr[1] << 16 |
352 (uint32_t)ip.s6_addr[2] << 8 |
353 (uint32_t)ip.s6_addr[3];
354 rule_ipv6->field[1].mask_range.u32 =
355 (depth > 32) ? 32 : depth;
356 depth = (depth > 32) ? (depth - 32) : 0;
357 rule_ipv6->field[2].value.u32 =
358 (uint32_t)ip.s6_addr[4] << 24 |
359 (uint32_t)ip.s6_addr[5] << 16 |
360 (uint32_t)ip.s6_addr[6] << 8 |
361 (uint32_t)ip.s6_addr[7];
362 rule_ipv6->field[2].mask_range.u32 =
363 (depth > 32) ? 32 : depth;
364 depth = (depth > 32) ? (depth - 32) : 0;
365 rule_ipv6->field[3].value.u32 =
366 (uint32_t)ip.s6_addr[8] << 24 |
367 (uint32_t)ip.s6_addr[9] << 16 |
368 (uint32_t)ip.s6_addr[10] << 8 |
369 (uint32_t)ip.s6_addr[11];
370 rule_ipv6->field[3].mask_range.u32 =
371 (depth > 32) ? 32 : depth;
372 depth = (depth > 32) ? (depth - 32) : 0;
373 rule_ipv6->field[4].value.u32 =
374 (uint32_t)ip.s6_addr[12] << 24 |
375 (uint32_t)ip.s6_addr[13] << 16 |
376 (uint32_t)ip.s6_addr[14] << 8 |
377 (uint32_t)ip.s6_addr[15];
378 rule_ipv6->field[4].mask_range.u32 =
379 (depth > 32) ? 32 : depth;
380
381 src_p = 1;
382 continue;
383 }
384
385 if (strcmp(tokens[ti], "dst") == 0) {
386 struct in6_addr ip;
387 uint32_t depth;
388
389 APP_CHECK_PRESENCE(dst_p, tokens[ti], status);
390 if (status->status < 0)
391 return;
392 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
393 if (status->status < 0)
394 return;
395
396 APP_CHECK(parse_ipv6_addr(tokens[ti], &ip,
397 &depth) == 0, status, "unrecognized "
398 "input \"%s\", expect valid ipv6 "
399 "addr", tokens[ti]);
400 if (status->status < 0)
401 return;
402
403 rule_ipv6->field[5].value.u32 =
404 (uint32_t)ip.s6_addr[0] << 24 |
405 (uint32_t)ip.s6_addr[1] << 16 |
406 (uint32_t)ip.s6_addr[2] << 8 |
407 (uint32_t)ip.s6_addr[3];
408 rule_ipv6->field[5].mask_range.u32 =
409 (depth > 32) ? 32 : depth;
410 depth = (depth > 32) ? (depth - 32) : 0;
411 rule_ipv6->field[6].value.u32 =
412 (uint32_t)ip.s6_addr[4] << 24 |
413 (uint32_t)ip.s6_addr[5] << 16 |
414 (uint32_t)ip.s6_addr[6] << 8 |
415 (uint32_t)ip.s6_addr[7];
416 rule_ipv6->field[6].mask_range.u32 =
417 (depth > 32) ? 32 : depth;
418 depth = (depth > 32) ? (depth - 32) : 0;
419 rule_ipv6->field[7].value.u32 =
420 (uint32_t)ip.s6_addr[8] << 24 |
421 (uint32_t)ip.s6_addr[9] << 16 |
422 (uint32_t)ip.s6_addr[10] << 8 |
423 (uint32_t)ip.s6_addr[11];
424 rule_ipv6->field[7].mask_range.u32 =
425 (depth > 32) ? 32 : depth;
426 depth = (depth > 32) ? (depth - 32) : 0;
427 rule_ipv6->field[8].value.u32 =
428 (uint32_t)ip.s6_addr[12] << 24 |
429 (uint32_t)ip.s6_addr[13] << 16 |
430 (uint32_t)ip.s6_addr[14] << 8 |
431 (uint32_t)ip.s6_addr[15];
432 rule_ipv6->field[8].mask_range.u32 =
433 (depth > 32) ? 32 : depth;
434
435 dst_p = 1;
436 continue;
437 }
438
439 if (strcmp(tokens[ti], "proto") == 0) {
440 uint16_t low, high;
441
442 APP_CHECK_PRESENCE(proto_p, tokens[ti], status);
443 if (status->status < 0)
444 return;
445 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
446 if (status->status < 0)
447 return;
448
449 APP_CHECK(parse_range(tokens[ti], &low, &high)
450 == 0, status, "unrecognized input \"%s\""
451 ", expect \"from:to\"", tokens[ti]);
452 if (status->status < 0)
453 return;
454 APP_CHECK(low <= 0xff, status, "proto low "
455 "over-limit");
456 if (status->status < 0)
457 return;
458 APP_CHECK(high <= 0xff, status, "proto high "
459 "over-limit");
460 if (status->status < 0)
461 return;
462
463 rule_ipv6->field[0].value.u8 = (uint8_t)low;
464 rule_ipv6->field[0].mask_range.u8 = (uint8_t)high;
465
466 proto_p = 1;
467 continue;
468 }
469
470 if (strcmp(tokens[ti], "sport") == 0) {
471 uint16_t port_low, port_high;
472
473 APP_CHECK_PRESENCE(sport_p, tokens[ti], status);
474 if (status->status < 0)
475 return;
476 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
477 if (status->status < 0)
478 return;
479
480 APP_CHECK(parse_range(tokens[ti], &port_low,
481 &port_high) == 0, status, "unrecognized "
482 "input \"%s\", expect \"port_from:"
483 "port_to\"", tokens[ti]);
484 if (status->status < 0)
485 return;
486
487 rule_ipv6->field[9].value.u16 = port_low;
488 rule_ipv6->field[9].mask_range.u16 = port_high;
489
490 sport_p = 1;
491 continue;
492 }
493
494 if (strcmp(tokens[ti], "dport") == 0) {
495 uint16_t port_low, port_high;
496
497 APP_CHECK_PRESENCE(dport_p, tokens[ti], status);
498 if (status->status < 0)
499 return;
500 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
501 if (status->status < 0)
502 return;
503
504 APP_CHECK(parse_range(tokens[ti], &port_low,
505 &port_high) == 0, status, "unrecognized "
506 "input \"%s\", expect \"port_from:"
507 "port_to\"", tokens[ti]);
508 if (status->status < 0)
509 return;
510
511 rule_ipv6->field[10].value.u16 = port_low;
512 rule_ipv6->field[10].mask_range.u16 = port_high;
513
514 dport_p = 1;
515 continue;
516 }
517
518 /* unrecognizeable input */
519 APP_CHECK(0, status, "unrecognized input \"%s\"",
520 tokens[ti]);
521 return;
522 }
523
524 /* check if argument(s) are missing */
525 APP_CHECK(esp_p == 1, status, "missing argument \"esp\"");
526 if (status->status < 0)
527 return;
528
529 APP_CHECK(protect_p | bypass_p | discard_p, status, "missing "
530 "argument \"protect\", \"bypass\", or \"discard\"");
531 if (status->status < 0)
532 return;
533
534 *ri = *ri + 1;
535 }
536
537 static inline void
print_one_ip6_rule(const struct acl6_rules * rule,int32_t extra)538 print_one_ip6_rule(const struct acl6_rules *rule, int32_t extra)
539 {
540 uint8_t a, b, c, d;
541
542 uint32_t_to_char(rule->field[IP6_SRC0].value.u32,
543 &a, &b, &c, &d);
544 printf("%.2x%.2x:%.2x%.2x", a, b, c, d);
545 uint32_t_to_char(rule->field[IP6_SRC1].value.u32,
546 &a, &b, &c, &d);
547 printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
548 uint32_t_to_char(rule->field[IP6_SRC2].value.u32,
549 &a, &b, &c, &d);
550 printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
551 uint32_t_to_char(rule->field[IP6_SRC3].value.u32,
552 &a, &b, &c, &d);
553 printf(":%.2x%.2x:%.2x%.2x/%u ", a, b, c, d,
554 rule->field[IP6_SRC0].mask_range.u32
555 + rule->field[IP6_SRC1].mask_range.u32
556 + rule->field[IP6_SRC2].mask_range.u32
557 + rule->field[IP6_SRC3].mask_range.u32);
558
559 uint32_t_to_char(rule->field[IP6_DST0].value.u32,
560 &a, &b, &c, &d);
561 printf("%.2x%.2x:%.2x%.2x", a, b, c, d);
562 uint32_t_to_char(rule->field[IP6_DST1].value.u32,
563 &a, &b, &c, &d);
564 printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
565 uint32_t_to_char(rule->field[IP6_DST2].value.u32,
566 &a, &b, &c, &d);
567 printf(":%.2x%.2x:%.2x%.2x", a, b, c, d);
568 uint32_t_to_char(rule->field[IP6_DST3].value.u32,
569 &a, &b, &c, &d);
570 printf(":%.2x%.2x:%.2x%.2x/%u ", a, b, c, d,
571 rule->field[IP6_DST0].mask_range.u32
572 + rule->field[IP6_DST1].mask_range.u32
573 + rule->field[IP6_DST2].mask_range.u32
574 + rule->field[IP6_DST3].mask_range.u32);
575
576 printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
577 rule->field[IP6_SRCP].value.u16,
578 rule->field[IP6_SRCP].mask_range.u16,
579 rule->field[IP6_DSTP].value.u16,
580 rule->field[IP6_DSTP].mask_range.u16,
581 rule->field[IP6_PROTO].value.u8,
582 rule->field[IP6_PROTO].mask_range.u8);
583 if (extra)
584 printf("0x%x-0x%x-0x%x ",
585 rule->data.category_mask,
586 rule->data.priority,
587 rule->data.userdata);
588 }
589
590 static inline void
dump_ip6_rules(const struct acl6_rules * rule,int32_t num,int32_t extra)591 dump_ip6_rules(const struct acl6_rules *rule, int32_t num, int32_t extra)
592 {
593 int32_t i;
594
595 for (i = 0; i < num; i++, rule++) {
596 printf("\t%d:", i + 1);
597 print_one_ip6_rule(rule, extra);
598 printf("\n");
599 }
600 }
601
602 static struct rte_acl_ctx *
acl6_init(const char * name,int32_t socketid,const struct acl6_rules * rules,uint32_t rules_nb)603 acl6_init(const char *name, int32_t socketid, const struct acl6_rules *rules,
604 uint32_t rules_nb)
605 {
606 char s[PATH_MAX];
607 struct rte_acl_param acl_param;
608 struct rte_acl_config acl_build_param;
609 struct rte_acl_ctx *ctx;
610
611 printf("Creating SP context with %u rules\n", rules_nb);
612
613 memset(&acl_param, 0, sizeof(acl_param));
614
615 /* Create ACL contexts */
616 snprintf(s, sizeof(s), "%s_%d", name, socketid);
617
618 printf("IPv4 %s entries [%u]:\n", s, rules_nb);
619 dump_ip6_rules(rules, rules_nb, 1);
620
621 acl_param.name = s;
622 acl_param.socket_id = socketid;
623 acl_param.rule_size = RTE_ACL_RULE_SZ(RTE_DIM(ip6_defs));
624 acl_param.max_rule_num = rules_nb;
625
626 ctx = rte_acl_create(&acl_param);
627 if (ctx == NULL)
628 rte_exit(EXIT_FAILURE, "Failed to create ACL context\n");
629
630 if (rte_acl_add_rules(ctx, (const struct rte_acl_rule *)rules,
631 rules_nb) < 0)
632 rte_exit(EXIT_FAILURE, "add rules failed\n");
633
634 /* Perform builds */
635 memset(&acl_build_param, 0, sizeof(acl_build_param));
636
637 acl_build_param.num_categories = DEFAULT_MAX_CATEGORIES;
638 acl_build_param.num_fields = RTE_DIM(ip6_defs);
639 memcpy(&acl_build_param.defs, ip6_defs, sizeof(ip6_defs));
640
641 if (rte_acl_build(ctx, &acl_build_param) != 0)
642 rte_exit(EXIT_FAILURE, "Failed to build ACL trie\n");
643
644 rte_acl_dump(ctx);
645
646 return ctx;
647 }
648
649 /*
650 * check that for each rule it's SPI has a correspondent entry in SAD
651 */
652 static int
check_spi_value(struct sa_ctx * sa_ctx,int inbound)653 check_spi_value(struct sa_ctx *sa_ctx, int inbound)
654 {
655 uint32_t i, num, spi;
656 int32_t spi_idx;
657 struct acl6_rules *acr;
658
659 if (inbound != 0) {
660 acr = acl6_rules_in;
661 num = nb_acl6_rules_in;
662 } else {
663 acr = acl6_rules_out;
664 num = nb_acl6_rules_out;
665 }
666
667 for (i = 0; i != num; i++) {
668 spi = acr[i].data.userdata;
669 if (spi != DISCARD && spi != BYPASS) {
670 spi_idx = sa_spi_present(sa_ctx, spi, inbound);
671 if (spi_idx < 0) {
672 RTE_LOG(ERR, IPSEC,
673 "SPI %u is not present in SAD\n",
674 spi);
675 return -ENOENT;
676 }
677 /* Update userdata with spi index */
678 acr[i].data.userdata = spi_idx + 1;
679 }
680 }
681
682 return 0;
683 }
684
685 void
sp6_init(struct socket_ctx * ctx,int32_t socket_id)686 sp6_init(struct socket_ctx *ctx, int32_t socket_id)
687 {
688 const char *name;
689
690 if (ctx == NULL)
691 rte_exit(EXIT_FAILURE, "NULL context.\n");
692
693 if (ctx->sp_ip6_in != NULL)
694 rte_exit(EXIT_FAILURE, "Inbound IPv6 SP DB for socket %u "
695 "already initialized\n", socket_id);
696
697 if (ctx->sp_ip6_out != NULL)
698 rte_exit(EXIT_FAILURE, "Outbound IPv6 SP DB for socket %u "
699 "already initialized\n", socket_id);
700
701 if (check_spi_value(ctx->sa_in, 1) < 0)
702 rte_exit(EXIT_FAILURE,
703 "Inbound IPv6 SP DB has unmatched in SAD SPIs\n");
704
705 if (check_spi_value(ctx->sa_out, 0) < 0)
706 rte_exit(EXIT_FAILURE,
707 "Outbound IPv6 SP DB has unmatched in SAD SPIs\n");
708
709 if (nb_acl6_rules_in > 0) {
710 name = "sp_ip6_in";
711 ctx->sp_ip6_in = (struct sp_ctx *)acl6_init(name,
712 socket_id, acl6_rules_in, nb_acl6_rules_in);
713 } else
714 RTE_LOG(WARNING, IPSEC, "No IPv6 SP Inbound rule "
715 "specified\n");
716
717 if (nb_acl6_rules_out > 0) {
718 name = "sp_ip6_out";
719 ctx->sp_ip6_out = (struct sp_ctx *)acl6_init(name,
720 socket_id, acl6_rules_out, nb_acl6_rules_out);
721 } else
722 RTE_LOG(WARNING, IPSEC, "No IPv6 SP Outbound rule "
723 "specified\n");
724 }
725
726 static int
sp_cmp(const void * p,const void * q)727 sp_cmp(const void *p, const void *q)
728 {
729 uint32_t spi1 = ((const struct acl6_rules *)p)->data.userdata;
730 uint32_t spi2 = ((const struct acl6_rules *)q)->data.userdata;
731
732 return (int)(spi1 - spi2);
733 }
734
735 /*
736 * Search though SP rules for given SPI.
737 */
738 int
sp6_spi_present(uint32_t spi,int inbound,struct ip_addr ip_addr[2],uint32_t mask[2])739 sp6_spi_present(uint32_t spi, int inbound, struct ip_addr ip_addr[2],
740 uint32_t mask[2])
741 {
742 uint32_t num;
743 struct acl6_rules *rule;
744 const struct acl6_rules *acr;
745 struct acl6_rules tmpl;
746
747 if (inbound != 0) {
748 acr = acl6_rules_in;
749 num = nb_acl6_rules_in;
750 } else {
751 acr = acl6_rules_out;
752 num = nb_acl6_rules_out;
753 }
754
755 tmpl.data.userdata = spi;
756
757 rule = bsearch(&tmpl, acr, num, sizeof(struct acl6_rules), sp_cmp);
758 if (rule != NULL) {
759 if (NULL != ip_addr && NULL != mask) {
760 IPV6_SRC_FROM_SP(ip_addr[0], *rule);
761 IPV6_DST_FROM_SP(ip_addr[1], *rule);
762 IPV6_SRC_MASK_FROM_SP(mask[0], *rule);
763 IPV6_DST_MASK_FROM_SP(mask[1], *rule);
764 }
765 return RTE_PTR_DIFF(rule, acr) / sizeof(struct acl6_rules);
766 }
767
768 return -ENOENT;
769 }
770
771 void
sp6_sort_arr(void)772 sp6_sort_arr(void)
773 {
774 qsort(acl6_rules_in, nb_acl6_rules_in, sizeof(struct acl6_rules),
775 sp_cmp);
776 qsort(acl6_rules_out, nb_acl6_rules_out, sizeof(struct acl6_rules),
777 sp_cmp);
778 }
779