ipsec.h revision 02950406
1/*
2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
6 *
7 *     http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15#ifndef __IPSEC_H__
16#define __IPSEC_H__
17
18#include <vnet/ip/ip.h>
19#include <vnet/crypto/crypto.h>
20#include <vnet/feature/feature.h>
21
22#include <vppinfra/types.h>
23#include <vppinfra/cache.h>
24
25#include <vnet/ipsec/ipsec_spd.h>
26#include <vnet/ipsec/ipsec_spd_policy.h>
27#include <vnet/ipsec/ipsec_sa.h>
28
29typedef clib_error_t *(*add_del_sa_sess_cb_t) (u32 sa_index, u8 is_add);
30typedef clib_error_t *(*check_support_cb_t) (ipsec_sa_t * sa);
31
32typedef struct
33{
34  u8 *name;
35  /* add/del callback */
36  add_del_sa_sess_cb_t add_del_sa_sess_cb;
37  /* check support function */
38  check_support_cb_t check_support_cb;
39  u32 ah4_encrypt_node_index;
40  u32 ah4_decrypt_node_index;
41  u32 ah4_encrypt_next_index;
42  u32 ah4_decrypt_next_index;
43  u32 ah6_encrypt_node_index;
44  u32 ah6_decrypt_node_index;
45  u32 ah6_encrypt_next_index;
46  u32 ah6_decrypt_next_index;
47} ipsec_ah_backend_t;
48
49typedef struct
50{
51  u8 *name;
52  /* add/del callback */
53  add_del_sa_sess_cb_t add_del_sa_sess_cb;
54  /* check support function */
55  check_support_cb_t check_support_cb;
56  u32 esp4_encrypt_node_index;
57  u32 esp4_decrypt_node_index;
58  u32 esp4_encrypt_next_index;
59  u32 esp4_decrypt_next_index;
60  u32 esp6_encrypt_node_index;
61  u32 esp6_decrypt_node_index;
62  u32 esp6_encrypt_next_index;
63  u32 esp6_decrypt_next_index;
64  u32 esp44_encrypt_tun_feature_index;
65  u32 esp46_encrypt_tun_feature_index;
66  u32 esp66_encrypt_tun_feature_index;
67  u32 esp64_encrypt_tun_feature_index;
68} ipsec_esp_backend_t;
69
70typedef struct
71{
72  vnet_crypto_op_id_t enc_op_id;
73  vnet_crypto_op_id_t dec_op_id;
74  vnet_crypto_alg_t alg;
75  u8 iv_size;
76  u8 block_size;
77  u8 icv_size;
78} ipsec_main_crypto_alg_t;
79
80typedef struct
81{
82  vnet_crypto_op_id_t op_id;
83  vnet_crypto_alg_t alg;
84  u8 icv_size;
85} ipsec_main_integ_alg_t;
86
87typedef struct
88{
89  vnet_crypto_op_t *crypto_ops;
90  vnet_crypto_op_t *integ_ops;
91} ipsec_per_thread_data_t;
92
93typedef struct
94{
95  /* pool of tunnel instances */
96  ipsec_spd_t *spds;
97  /* Pool of security associations */
98  ipsec_sa_t *sad;
99  /* pool of policies */
100  ipsec_policy_t *policies;
101
102  uword *tunnel_index_by_key;
103
104  /* convenience */
105  vlib_main_t *vlib_main;
106  vnet_main_t *vnet_main;
107
108  /* hashes */
109  uword *spd_index_by_spd_id;
110  uword *spd_index_by_sw_if_index;
111  uword *sa_index_by_sa_id;
112  uword *ipsec4_if_pool_index_by_key;
113  uword *ipsec6_if_pool_index_by_key;
114  uword *ipsec_if_real_dev_by_show_dev;
115  uword *ipsec_if_by_sw_if_index;
116  uword *tun4_protect_by_key;
117  uword *tun6_protect_by_key;
118
119  /* node indices */
120  u32 error_drop_node_index;
121  u32 esp4_encrypt_node_index;
122  u32 esp4_decrypt_node_index;
123  u32 ah4_encrypt_node_index;
124  u32 ah4_decrypt_node_index;
125  u32 esp6_encrypt_node_index;
126  u32 esp6_decrypt_node_index;
127  u32 ah6_encrypt_node_index;
128  u32 ah6_decrypt_node_index;
129  /* next node indices */
130  u32 esp4_encrypt_next_index;
131  u32 esp4_decrypt_next_index;
132  u32 ah4_encrypt_next_index;
133  u32 ah4_decrypt_next_index;
134  u32 esp6_encrypt_next_index;
135  u32 esp6_decrypt_next_index;
136  u32 ah6_encrypt_next_index;
137  u32 ah6_decrypt_next_index;
138
139  /* tun encrypt arcs and feature nodes */
140  u32 esp44_encrypt_tun_feature_index;
141  u32 esp64_encrypt_tun_feature_index;
142  u32 esp46_encrypt_tun_feature_index;
143  u32 esp66_encrypt_tun_feature_index;
144
145  /* tun nodes to drop packets when no crypto alg set on outbound SA */
146  u32 esp4_no_crypto_tun_feature_index;
147  u32 esp6_no_crypto_tun_feature_index;
148
149  /* pool of ah backends */
150  ipsec_ah_backend_t *ah_backends;
151  /* pool of esp backends */
152  ipsec_esp_backend_t *esp_backends;
153  /* index of current ah backend */
154  u32 ah_current_backend;
155  /* index of current esp backend */
156  u32 esp_current_backend;
157  /* index of default ah backend */
158  u32 ah_default_backend;
159  /* index of default esp backend */
160  u32 esp_default_backend;
161
162  /* crypto alg data */
163  ipsec_main_crypto_alg_t *crypto_algs;
164
165  /* crypto integ data */
166  ipsec_main_integ_alg_t *integ_algs;
167
168  /* per-thread data */
169  ipsec_per_thread_data_t *ptd;
170
171  /** Worker handoff */
172  u32 ah4_enc_fq_index;
173  u32 ah4_dec_fq_index;
174  u32 ah6_enc_fq_index;
175  u32 ah6_dec_fq_index;
176
177  u32 esp4_enc_fq_index;
178  u32 esp4_dec_fq_index;
179  u32 esp6_enc_fq_index;
180  u32 esp6_dec_fq_index;
181  u32 esp4_enc_tun_fq_index;
182  u32 esp6_enc_tun_fq_index;
183  u32 esp4_dec_tun_fq_index;
184  u32 esp6_dec_tun_fq_index;
185} ipsec_main_t;
186
187typedef enum ipsec_format_flags_t_
188{
189  IPSEC_FORMAT_BRIEF = 0,
190  IPSEC_FORMAT_DETAIL = (1 << 0),
191  IPSEC_FORMAT_INSECURE = (1 << 1),
192} ipsec_format_flags_t;
193
194extern ipsec_main_t ipsec_main;
195
196clib_error_t *ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index,
197					u8 is_add);
198
199clib_error_t *ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa);
200
201extern vlib_node_registration_t ah4_encrypt_node;
202extern vlib_node_registration_t ah4_decrypt_node;
203extern vlib_node_registration_t ah6_encrypt_node;
204extern vlib_node_registration_t ah6_decrypt_node;
205extern vlib_node_registration_t esp4_encrypt_node;
206extern vlib_node_registration_t esp4_decrypt_node;
207extern vlib_node_registration_t esp6_encrypt_node;
208extern vlib_node_registration_t esp6_decrypt_node;
209extern vlib_node_registration_t esp4_encrypt_tun_node;
210extern vlib_node_registration_t esp6_encrypt_tun_node;
211extern vlib_node_registration_t esp4_decrypt_tun_node;
212extern vlib_node_registration_t esp6_decrypt_tun_node;
213extern vlib_node_registration_t ipsec4_if_input_node;
214extern vlib_node_registration_t ipsec6_if_input_node;
215
216/*
217 * functions
218 */
219u8 *format_ipsec_replay_window (u8 * s, va_list * args);
220
221/*
222 *  inline functions
223 */
224
225static_always_inline u32
226get_next_output_feature_node_index (vlib_buffer_t * b,
227				    vlib_node_runtime_t * nr)
228{
229  u32 next;
230  vlib_main_t *vm = vlib_get_main ();
231  vlib_node_t *node = vlib_get_node (vm, nr->node_index);
232
233  vnet_feature_next (&next, b);
234  return node->next_nodes[next];
235}
236
237u32 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im,
238			       const char *name,
239			       const char *ah4_encrypt_node_name,
240			       const char *ah4_decrypt_node_name,
241			       const char *ah6_encrypt_node_name,
242			       const char *ah6_decrypt_node_name,
243			       check_support_cb_t ah_check_support_cb,
244			       add_del_sa_sess_cb_t ah_add_del_sa_sess_cb);
245
246u32 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
247				const char *name,
248				const char *esp4_encrypt_node_name,
249				const char *esp4_encrypt_tun_node_name,
250				const char *esp4_decrypt_node_name,
251				const char *esp6_encrypt_node_name,
252				const char *esp6_encrypt_tun_node_name,
253				const char *esp6_decrypt_node_name,
254				check_support_cb_t esp_check_support_cb,
255				add_del_sa_sess_cb_t esp_add_del_sa_sess_cb);
256
257int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx);
258int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx);
259
260clib_error_t *ipsec_rsc_in_use (ipsec_main_t * im);
261
262always_inline ipsec_sa_t *
263ipsec_sa_get (u32 sa_index)
264{
265  return (pool_elt_at_index (ipsec_main.sad, sa_index));
266}
267
268void ipsec_add_feature (const char *arc_name, const char *node_name,
269			u32 * out_feature_index);
270
271
272#endif /* __IPSEC_H__ */
273
274/*
275 * fd.io coding-style-patch-verification: ON
276 *
277 * Local Variables:
278 * eval: (c-set-style "gnu")
279 * End:
280 */
281