FD.io VPP  v20.09-64-g4f7b92f0a
Vector Packet Processing
ipsec.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef __IPSEC_H__
16 #define __IPSEC_H__
17 
18 #include <vnet/ip/ip.h>
19 #include <vnet/crypto/crypto.h>
20 #include <vnet/feature/feature.h>
21 
22 #include <vppinfra/types.h>
23 #include <vppinfra/cache.h>
24 
25 #include <vnet/ipsec/ipsec_spd.h>
27 #include <vnet/ipsec/ipsec_sa.h>
28 
29 typedef clib_error_t *(*add_del_sa_sess_cb_t) (u32 sa_index, u8 is_add);
30 typedef clib_error_t *(*check_support_cb_t) (ipsec_sa_t * sa);
31 typedef clib_error_t *(*enable_disable_cb_t) (int is_enable);
32 
33 typedef struct
34 {
35  u8 *name;
36  /* add/del callback */
38  /* check support function */
49 
50 typedef struct
51 {
52  u8 *name;
53  /* add/del callback */
55  /* check support function */
57  /* enable or disable function */
74 
75 typedef struct
76 {
84 
85 typedef struct
86 {
91 
92 typedef struct
93 {
94  CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
101 
102 typedef struct
103 {
104  /* pool of tunnel instances */
106  /* Pool of security associations */
108  /* pool of policies */
110 
111  /* hash tables of UDP port registrations */
113 
115 
116  /* convenience */
119 
120  /* hashes */
130 
131  /* node indices */
145  /* next node indices */
156 
157  /* tun nodes to drop packets when no crypto alg set on outbound SA */
160 
161  /* tun nodes for encrypt on L2 interfaces */
164 
165  /* pool of ah backends */
167  /* pool of esp backends */
169  /* index of current ah backend */
171  /* index of current esp backend */
173  /* index of default ah backend */
175  /* index of default esp backend */
177 
178  /* crypto alg data */
180 
181  /* crypto integ data */
183 
184  /* per-thread data */
186 
187  /** Worker handoff */
192 
201 
203 } ipsec_main_t;
204 
206 {
211 
212 extern ipsec_main_t ipsec_main;
213 
215  u8 is_add);
216 
218 
233 
234 /*
235  * functions
236  */
237 u8 *format_ipsec_replay_window (u8 * s, va_list * args);
238 
239 /*
240  * inline functions
241  */
242 
245  vlib_node_runtime_t * nr)
246 {
247  u32 next;
248  vlib_main_t *vm = vlib_get_main ();
250 
251  vnet_feature_next (&next, b);
252  return node->next_nodes[next];
253 }
254 
256  const char *name,
257  const char *ah4_encrypt_node_name,
258  const char *ah4_decrypt_node_name,
259  const char *ah6_encrypt_node_name,
260  const char *ah6_decrypt_node_name,
261  check_support_cb_t ah_check_support_cb,
262  add_del_sa_sess_cb_t ah_add_del_sa_sess_cb);
263 
265  const char *name,
266  const char *esp4_encrypt_node_name,
267  const char *esp4_encrypt_tun_node_name,
268  const char *esp4_decrypt_node_name,
269  const char *esp4_decrypt_tun_node_name,
270  const char *esp6_encrypt_node_name,
271  const char *esp6_encrypt_tun_node_name,
272  const char *esp6_decrypt_node_name,
273  const char *esp6_decrypt_tun_node_name,
274  check_support_cb_t esp_check_support_cb,
275  add_del_sa_sess_cb_t esp_add_del_sa_sess_cb,
276  enable_disable_cb_t enable_disable_cb);
277 
278 int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx);
279 int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx);
280 
282 void ipsec_set_async_mode (u32 is_enabled);
283 
285 ipsec_sa_get (u32 sa_index)
286 {
287  return (pool_elt_at_index (ipsec_main.sad, sa_index));
288 }
289 
290 void ipsec_add_feature (const char *arc_name, const char *node_name,
291  u32 * out_feature_index);
292 
293 void ipsec_set_async_mode (u32 is_enabled);
294 extern void ipsec_register_udp_port (u16 udp_port);
295 extern void ipsec_unregister_udp_port (u16 udp_port);
296 
297 #endif /* __IPSEC_H__ */
298 
299 /*
300  * fd.io coding-style-patch-verification: ON
301  *
302  * Local Variables:
303  * eval: (c-set-style "gnu")
304  * End:
305  */
u32 * next_nodes
Definition: node.h:334
u32 esp4_decrypt_tun_node_index
Definition: ipsec.h:135
ipsec_spd_t * spds
Definition: ipsec.h:105
void ipsec_add_feature(const char *arc_name, const char *node_name, u32 *out_feature_index)
Definition: ipsec.c:128
u32 ipsec_register_esp_backend(vlib_main_t *vm, ipsec_main_t *im, const char *name, const char *esp4_encrypt_node_name, const char *esp4_encrypt_tun_node_name, const char *esp4_decrypt_node_name, const char *esp4_decrypt_tun_node_name, const char *esp6_encrypt_node_name, const char *esp6_encrypt_tun_node_name, const char *esp6_decrypt_node_name, const char *esp6_decrypt_tun_node_name, check_support_cb_t esp_check_support_cb, add_del_sa_sess_cb_t esp_add_del_sa_sess_cb, enable_disable_cb_t enable_disable_cb)
Definition: ipsec.c:211
u32 esp_default_backend
Definition: ipsec.h:176
#define CLIB_CACHE_LINE_ALIGN_MARK(mark)
Definition: cache.h:60
u32 esp4_encrypt_next_index
Definition: ipsec.h:61
ipsec_main_crypto_alg_t * crypto_algs
Definition: ipsec.h:179
uword * tun6_protect_by_key
Definition: ipsec.h:129
ipsec_per_thread_data_t * ptd
Definition: ipsec.h:185
u32 esp6_decrypt_node_index
Definition: ipsec.h:140
vnet_crypto_op_t * integ_ops
Definition: ipsec.h:96
uword * tunnel_index_by_key
Definition: ipsec.h:114
enable_disable_cb_t enable_disable_cb
Definition: ipsec.h:58
u32 ah4_decrypt_next_index
Definition: ipsec.h:150
uword * ipsec4_if_pool_index_by_key
Definition: ipsec.h:124
u32 esp6_encrypt_tun_node_index
Definition: ipsec.h:72
u32 esp4_decrypt_node_index
Definition: ipsec.h:60
clib_error_t * ipsec_check_support_cb(ipsec_main_t *im, ipsec_sa_t *sa)
Definition: ipsec.c:91
enum ipsec_format_flags_t_ ipsec_format_flags_t
u32 ah6_decrypt_next_index
Definition: ipsec.h:47
u32 esp6_decrypt_tun_node_index
Definition: ipsec.h:141
u32 esp6_decrypt_next_index
Definition: ipsec.h:66
vnet_crypto_op_t * crypto_ops
Definition: ipsec.h:95
u32 ah4_encrypt_next_index
Definition: ipsec.h:149
u32 ah4_encrypt_node_index
Definition: ipsec.h:40
u32 esp6_encrypt_node_index
Definition: ipsec.h:63
void ipsec_register_udp_port(u16 udp_port)
Definition: ipsec.c:164
u32 ah_current_backend
Definition: ipsec.h:170
u32 esp6_decrypt_tun_next_index
Definition: ipsec.h:71
A Secruity Policy Database.
Definition: ipsec_spd.h:46
vnet_crypto_op_chunk_t * chunks
Definition: ipsec.h:99
u32 esp_current_backend
Definition: ipsec.h:172
u32 esp6_encrypt_l2_tun_node_index
Definition: ipsec.h:163
u32 ah6_decrypt_node_index
Definition: ipsec.h:45
unsigned char u8
Definition: types.h:56
vlib_node_registration_t esp6_decrypt_node
(constructor) VLIB_REGISTER_NODE (esp6_decrypt_node)
Definition: esp_decrypt.c:1479
ipsec_format_flags_t_
Definition: ipsec.h:205
uword * spd_index_by_sw_if_index
Definition: ipsec.h:122
int ipsec_select_esp_backend(ipsec_main_t *im, u32 esp_backend_idx)
Definition: ipsec.c:293
u32 esp4_decrypt_tun_next_index
Definition: ipsec.h:148
vnet_crypto_alg_t alg
Definition: ipsec.h:88
u32 esp4_enc_tun_fq_index
Definition: ipsec.h:197
u32 esp6_encrypt_next_index
Definition: ipsec.h:65
uword * ipsec6_if_pool_index_by_key
Definition: ipsec.h:125
u32 ah6_encrypt_node_index
Definition: ipsec.h:44
#define static_always_inline
Definition: clib.h:108
vlib_node_registration_t esp4_encrypt_node
(constructor) VLIB_REGISTER_NODE (esp4_encrypt_node)
Definition: esp_encrypt.c:1055
uword * udp_port_registrations
Definition: ipsec.h:112
u32 ah_default_backend
Definition: ipsec.h:174
vlib_node_registration_t esp4_decrypt_node
(constructor) VLIB_REGISTER_NODE (esp4_decrypt_node)
Definition: esp_decrypt.c:1447
ipsec_main_t ipsec_main
Definition: ipsec.c:28
u32 esp6_encrypt_node_index
Definition: ipsec.h:139
u32 esp4_decrypt_next_index
Definition: ipsec.h:147
void ipsec_unregister_udp_port(u16 udp_port)
Definition: ipsec.c:139
u32 ah6_encrypt_next_index
Definition: ipsec.h:46
uword * ipsec_if_by_sw_if_index
Definition: ipsec.h:127
u32 esp4_dec_tun_fq_index
Definition: ipsec.h:199
check_support_cb_t check_support_cb
Definition: ipsec.h:56
u32 ah6_dec_fq_index
Definition: ipsec.h:191
u32 esp4_dec_fq_index
Definition: ipsec.h:194
unsigned int u32
Definition: types.h:88
clib_error_t *(* add_del_sa_sess_cb_t)(u32 sa_index, u8 is_add)
Definition: ipsec.h:29
u32 esp6_decrypt_node_index
Definition: ipsec.h:64
vnet_crypto_alg_t
Definition: crypto.h:124
void ipsec_set_async_mode(u32 is_enabled)
Definition: ipsec.c:339
u32 ah4_decrypt_node_index
Definition: ipsec.h:138
u32 esp4_encrypt_l2_tun_node_index
Definition: ipsec.h:162
u32 error_drop_node_index
Definition: ipsec.h:132
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:534
u32 esp4_encrypt_node_index
Definition: ipsec.h:133
vnet_main_t * vnet_main
Definition: ipsec.h:118
vnet_crypto_op_id_t enc_op_id
Definition: ipsec.h:77
unsigned short u16
Definition: types.h:57
u32 esp6_no_crypto_tun_node_index
Definition: ipsec.h:159
u32 ah4_decrypt_next_index
Definition: ipsec.h:43
u32 esp6_dec_tun_fq_index
Definition: ipsec.h:200
vlib_node_registration_t ah6_decrypt_node
(constructor) VLIB_REGISTER_NODE (ah6_decrypt_node)
Definition: ah_decrypt.c:456
u32 esp4_decrypt_tun_next_index
Definition: ipsec.h:68
#define always_inline
Definition: ipsec.h:28
vlib_node_registration_t ah4_encrypt_node
(constructor) VLIB_REGISTER_NODE (ah4_encrypt_node)
Definition: ah_encrypt.c:426
u32 ah4_enc_fq_index
Worker handoff.
Definition: ipsec.h:188
u32 esp6_decrypt_tun_node_index
Definition: ipsec.h:70
vlib_node_registration_t esp6_encrypt_node
(constructor) VLIB_REGISTER_NODE (esp6_encrypt_node)
Definition: esp_encrypt.c:1105
u32 node_index
Node index.
Definition: node.h:487
u32 ah4_dec_fq_index
Definition: ipsec.h:189
u32 esp4_encrypt_node_index
Definition: ipsec.h:59
static ipsec_sa_t * ipsec_sa_get(u32 sa_index)
Definition: ipsec.h:285
vlib_node_registration_t esp4_decrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp4_decrypt_tun_node)
Definition: esp_decrypt.c:1511
vlib_node_registration_t ipsec6_tun_input_node
(constructor) VLIB_REGISTER_NODE (ipsec6_tun_input_node)
Definition: ipsec_tun_in.c:390
uword * spd_index_by_spd_id
Definition: ipsec.h:121
vnet_crypto_op_t * chained_crypto_ops
Definition: ipsec.h:97
vlib_node_registration_t esp6_encrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp6_encrypt_tun_node)
Definition: esp_encrypt.c:1195
u32 ah6_enc_fq_index
Definition: ipsec.h:190
u32 ah4_decrypt_node_index
Definition: ipsec.h:41
u32 ah6_encrypt_next_index
Definition: ipsec.h:154
clib_error_t *(* enable_disable_cb_t)(int is_enable)
Definition: ipsec.h:31
u32 esp6_decrypt_tun_next_index
Definition: ipsec.h:153
ipsec_ah_backend_t * ah_backends
Definition: ipsec.h:166
static_always_inline void vnet_feature_next(u32 *next0, vlib_buffer_t *b0)
Definition: feature.h:322
u32 esp6_enc_tun_fq_index
Definition: ipsec.h:198
u32 esp4_encrypt_next_index
Definition: ipsec.h:146
vlib_node_registration_t ah6_encrypt_node
(constructor) VLIB_REGISTER_NODE (ah6_encrypt_node)
Definition: ah_encrypt.c:452
u32 ah4_encrypt_next_index
Definition: ipsec.h:42
uword * sa_index_by_sa_id
Definition: ipsec.h:123
u32 esp6_decrypt_next_index
Definition: ipsec.h:152
clib_error_t * ipsec_add_del_sa_sess_cb(ipsec_main_t *im, u32 sa_index, u8 is_add)
Definition: ipsec.c:69
u32 esp4_encrypt_tun_node_index
Definition: ipsec.h:136
A Secruity Policy.
static_always_inline u32 get_next_output_feature_node_index(vlib_buffer_t *b, vlib_node_runtime_t *nr)
Definition: ipsec.h:244
vlib_main_t * vlib_main
Definition: ipsec.h:117
uword * ipsec_if_real_dev_by_show_dev
Definition: ipsec.h:126
u32 esp4_no_crypto_tun_node_index
Definition: ipsec.h:158
u32 ipsec_register_ah_backend(vlib_main_t *vm, ipsec_main_t *im, const char *name, const char *ah4_encrypt_node_name, const char *ah4_decrypt_node_name, const char *ah6_encrypt_node_name, const char *ah6_decrypt_node_name, check_support_cb_t ah_check_support_cb, add_del_sa_sess_cb_t ah_add_del_sa_sess_cb)
Definition: ipsec.c:183
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1582
u32 esp6_encrypt_next_index
Definition: ipsec.h:151
clib_error_t *(* check_support_cb_t)(ipsec_sa_t *sa)
Definition: ipsec.h:30
vnet_crypto_op_id_t op_id
Definition: ipsec.h:87
vlib_node_registration_t esp6_decrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp6_decrypt_tun_node)
Definition: esp_decrypt.c:1541
vlib_node_registration_t esp4_encrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp4_encrypt_tun_node)
Definition: esp_encrypt.c:1146
u32 ah4_encrypt_node_index
Definition: ipsec.h:137
ipsec_main_integ_alg_t * integ_algs
Definition: ipsec.h:182
u32 esp6_dec_fq_index
Definition: ipsec.h:196
ipsec_policy_t * policies
Definition: ipsec.h:109
u8 * format_ipsec_replay_window(u8 *s, va_list *args)
Definition: ipsec_format.c:142
u32 esp6_enc_fq_index
Definition: ipsec.h:195
ipsec_sa_t * sad
Definition: ipsec.h:107
u32 esp4_decrypt_node_index
Definition: ipsec.h:134
add_del_sa_sess_cb_t add_del_sa_sess_cb
Definition: ipsec.h:54
vnet_crypto_op_id_t dec_op_id
Definition: ipsec.h:78
vlib_node_registration_t ipsec4_tun_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_tun_input_node)
Definition: ipsec_tun_in.c:367
u32 ah6_decrypt_node_index
Definition: ipsec.h:144
static vlib_main_t * vlib_get_main(void)
Definition: global_funcs.h:23
struct _vlib_node_registration vlib_node_registration_t
u32 esp4_enc_fq_index
Definition: ipsec.h:193
u32 ah6_encrypt_node_index
Definition: ipsec.h:143
u32 ah6_decrypt_next_index
Definition: ipsec.h:155
check_support_cb_t check_support_cb
Definition: ipsec.h:39
u32 esp4_decrypt_tun_node_index
Definition: ipsec.h:67
VLIB buffer representation.
Definition: buffer.h:102
u64 uword
Definition: types.h:112
u32 esp4_encrypt_tun_node_index
Definition: ipsec.h:69
vnet_crypto_op_t * chained_integ_ops
Definition: ipsec.h:98
u32 esp4_decrypt_next_index
Definition: ipsec.h:62
vlib_node_registration_t ah4_decrypt_node
(constructor) VLIB_REGISTER_NODE (ah4_decrypt_node)
Definition: ah_decrypt.c:429
vnet_crypto_op_id_t
Definition: crypto.h:196
int ipsec_select_ah_backend(ipsec_main_t *im, u32 ah_backend_idx)
Definition: ipsec.c:270
static vlib_node_t * vlib_get_node(vlib_main_t *vm, u32 i)
Get vlib node by index.
Definition: node_funcs.h:85
clib_error_t * ipsec_rsc_in_use(ipsec_main_t *im)
Definition: ipsec.c:258
vnet_crypto_alg_t alg
Definition: ipsec.h:79
add_del_sa_sess_cb_t add_del_sa_sess_cb
Definition: ipsec.h:37
ipsec_esp_backend_t * esp_backends
Definition: ipsec.h:168
u8 async_mode
Definition: ipsec.h:202
u32 esp6_encrypt_tun_node_index
Definition: ipsec.h:142
uword * tun4_protect_by_key
Definition: ipsec.h:128