/* * Copyright (c) 2018 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include vnet_crypto_main_t crypto_main; static_always_inline void crypto_set_op_status (vnet_crypto_op_t * ops[], u32 n_ops, int status) { while (n_ops--) { ops[0]->status = status; ops++; } } static_always_inline u32 vnet_crypto_process_ops_call_handler (vlib_main_t * vm, vnet_crypto_main_t * cm, vnet_crypto_op_id_t opt, vnet_crypto_op_t * ops[], vnet_crypto_op_chunk_t * chunks, u32 n_ops) { u32 rv = 0; if (n_ops == 0) return 0; if (chunks) { if (cm->chained_ops_handlers[opt] == 0) crypto_set_op_status (ops, n_ops, VNET_CRYPTO_OP_STATUS_FAIL_NO_HANDLER); else rv = (cm->chained_ops_handlers[opt]) (vm, ops, chunks, n_ops); } else { if (cm->ops_handlers[opt] == 0) crypto_set_op_status (ops, n_ops, VNET_CRYPTO_OP_STATUS_FAIL_NO_HANDLER); else rv = (cm->ops_handlers[opt]) (vm, ops, n_ops); } return rv; } static_always_inline u32 vnet_crypto_process_ops_inline (vlib_main_t * vm, vnet_crypto_op_t ops[], vnet_crypto_op_chunk_t * chunks, u32 n_ops) { vnet_crypto_main_t *cm = &crypto_main; const int op_q_size = VLIB_FRAME_SIZE; vnet_crypto_op_t *op_queue[op_q_size]; vnet_crypto_op_id_t opt, current_op_type = ~0; u32 n_op_queue = 0; u32 rv = 0, i; ASSERT (n_ops >= 1); for (i = 0; i < n_ops; i++) { opt = ops[i].op; if (current_op_type != opt || n_op_queue >= op_q_size) { rv += vnet_crypto_process_ops_call_handler (vm, cm, current_op_type, op_queue, chunks, n_op_queue); n_op_queue = 0; current_op_type = opt; } op_queue[n_op_queue++] = &ops[i]; } rv += vnet_crypto_process_ops_call_handler (vm, cm, current_op_type, op_queue, chunks, n_op_queue); return rv; } u32 vnet_crypto_process_ops (vlib_main_t * vm, vnet_crypto_op_t ops[], u32 n_ops) { return vnet_crypto_process_ops_inline (vm, ops, 0, n_ops); } u32 vnet_crypto_process_chained_ops (vlib_main_t * vm, vnet_crypto_op_t ops[], vnet_crypto_op_chunk_t * chunks, u32 n_ops) { return vnet_crypto_process_ops_inline (vm, ops, chunks, n_ops); } u32 vnet_crypto_register_engine (vlib_main_t * vm, char *name, int prio, char *desc) { vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_engine_t *p; vec_add2 (cm->engines, p, 1); p->name = name; p->desc = desc; p->priority = prio; hash_set_mem (cm->engine_index_by_name, p->name, p - cm->engines); return p - cm->engines; } static_always_inline void crypto_set_active_engine (vnet_crypto_op_data_t * od, vnet_crypto_op_id_t id, u32 ei, crypto_op_class_type_t oct) { vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_engine_t *ce = vec_elt_at_index (cm->engines, ei); if (oct == CRYPTO_OP_BOTH || oct == CRYPTO_OP_CHAINED) { if (ce->chained_ops_handlers[id]) { od->active_engine_index_chained = ei; cm->chained_ops_handlers[id] = ce->chained_ops_handlers[id]; } } if (oct == CRYPTO_OP_BOTH || oct == CRYPTO_OP_SIMPLE) { if (ce->ops_handlers[id]) { od->active_engine_index_simple = ei; cm->ops_handlers[id] = ce->ops_handlers[id]; } } } int vnet_crypto_set_handler2 (char *alg_name, char *engine, crypto_op_class_type_t oct) { uword *p; vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_alg_data_t *ad; int i; p = hash_get_mem (cm->alg_index_by_name, alg_name); if (!p) return -1; ad = vec_elt_at_index (cm->algs, p[0]); p = hash_get_mem (cm->engine_index_by_name, engine); if (!p) return -1; for (i = 0; i < VNET_CRYPTO_OP_N_TYPES; i++) { vnet_crypto_op_data_t *od; vnet_crypto_op_id_t id = ad->op_by_type[i]; if (id == 0) continue; od = cm->opt_data + id; crypto_set_active_engine (od, id, p[0], oct); } return 0; } int vnet_crypto_is_set_handler (vnet_crypto_alg_t alg) { vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_op_id_t opt = 0; int i; if (alg > vec_len (cm->algs)) return 0; for (i = 0; i < VNET_CRYPTO_OP_N_TYPES; i++) if ((opt = cm->algs[alg].op_by_type[i]) != 0) break; return NULL != cm->ops_handlers[opt]; } void vnet_crypto_register_ops_handler_inline (vlib_main_t * vm, u32 engine_index, vnet_crypto_op_id_t opt, vnet_crypto_ops_handler_t * fn, vnet_crypto_chained_ops_handler_t * cfn) { vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_engine_t *ae, *e = vec_elt_at_index (cm->engines, engine_index); vnet_crypto_op_data_t *otd = cm->opt_data + opt; vec_validate_aligned (cm->ops_handlers, VNET_CRYPTO_N_OP_IDS - 1, CLIB_CACHE_LINE_BYTES); vec_validate_aligned (cm->chained_ops_handlers, VNET_CRYPTO_N_OP_IDS - 1, CLIB_CACHE_LINE_BYTES); if (fn) { e->ops_handlers[opt] = fn; if (otd->active_engine_index_simple == ~0) { otd->active_engine_index_simple = engine_index; cm->ops_handlers[opt] = fn; } ae = vec_elt_at_index (cm->engines, otd->active_engine_index_simple); if (ae->priority < e->priority) crypto_set_active_engine (otd, opt, engine_index, CRYPTO_OP_SIMPLE); } if (cfn) { e->chained_ops_handlers[opt] = cfn; if (otd->active_engine_index_chained == ~0) { otd->active_engine_index_chained = engine_index; cm->chained_ops_handlers[opt] = cfn; } ae = vec_elt_at_index (cm->engines, otd->active_engine_index_chained); if (ae->priority < e->priority) crypto_set_active_engine (otd, opt, engine_index, CRYPTO_OP_CHAINED); } return; } void vnet_crypto_register_ops_handler (vlib_main_t * vm, u32 engine_index, vnet_crypto_op_id_t opt, vnet_crypto_ops_handler_t * fn) { vnet_crypto_register_ops_handler_inline (vm, engine_index, opt, fn, 0); } void vnet_crypto_register_chained_ops_handler (vlib_main_t * vm, u32 engine_index, vnet_crypto_op_id_t opt, vnet_crypto_chained_ops_handler_t * fn) { vnet_crypto_register_ops_handler_inline (vm, engine_index, opt, 0, fn); } void vnet_crypto_register_ops_handlers (vlib_main_t * vm, u32 engine_index, vnet_crypto_op_id_t opt, vnet_crypto_ops_handler_t * fn, vnet_crypto_chained_ops_handler_t * cfn) { vnet_crypto_register_ops_handler_inline (vm, engine_index, opt, fn, cfn); } void vnet_crypto_register_async_handler (vlib_main_t * vm, u32 engine_index, vnet_crypto_async_op_id_t opt, vnet_crypto_frame_enqueue_t * enqueue_hdl, vnet_crypto_frame_dequeue_t * dequeue_hdl) { vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_engine_t *ae, *e = vec_elt_at_index (cm->engines, engine_index); vnet_crypto_async_op_data_t *otd = cm->async_opt_data + opt; vec_validate_aligned (cm->enqueue_handlers, VNET_CRYPTO_ASYNC_OP_N_IDS - 1, CLIB_CACHE_LINE_BYTES); vec_validate_aligned (cm->dequeue_handlers, VNET_CRYPTO_ASYNC_OP_N_IDS - 1, CLIB_CACHE_LINE_BYTES); /* both enqueue hdl and dequeue hdl should present */ if (!enqueue_hdl && !dequeue_hdl) return; e->enqueue_handlers[opt] = enqueue_hdl; e->dequeue_handlers[opt] = dequeue_hdl; if (otd->active_engine_index_async == ~0) { otd->active_engine_index_async = engine_index; cm->enqueue_handlers[opt] = enqueue_hdl; cm->dequeue_handlers[opt] = dequeue_hdl; } ae = vec_elt_at_index (cm->engines, otd->active_engine_index_async); if (ae->priority < e->priority) { otd->active_engine_index_async = engine_index; cm->enqueue_handlers[opt] = enqueue_hdl; cm->dequeue_handlers[opt] = dequeue_hdl; } return; } void vnet_crypto_register_key_handler (vlib_main_t * vm, u32 engine_index, vnet_crypto_key_handler_t * key_handler) { vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_engine_t *e = vec_elt_at_index (cm->engines, engine_index); e->key_op_handler = key_handler; return; } static int vnet_crypto_key_len_check (vnet_crypto_alg_t alg, u16 length) { switch (alg) { case VNET_CRYPTO_N_ALGS: return 0; case VNET_CRYPTO_ALG_NONE: return 1; #define _(n, s, l) \ case VNET_CRYPTO_ALG_##n: \ if ((l) == length) \ return 1; \ break; foreach_crypto_cipher_alg foreach_crypto_aead_alg #undef _ /* HMAC allows any key length */ #define _(n, s) \ case VNET_CRYPTO_ALG_HMAC_##n: \ return 1; foreach_crypto_hmac_alg #undef _ } return 0; } u32 vnet_crypto_key_add (vlib_main_t * vm, vnet_crypto_alg_t alg, u8 * data, u16 length) { u32 index; vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_engine_t *engine; vnet_crypto_key_t *key; if (!vnet_crypto_key_len_check (alg, length)) return ~0; pool_get_zero (cm->keys, key); index = key - cm->keys; key->type = VNET_CRYPTO_KEY_TYPE_DATA; key->alg = alg; vec_validate_aligned (key->data, length - 1, CLIB_CACHE_LINE_BYTES); clib_memcpy (key->data, data, length); /* *INDENT-OFF* */ vec_foreach (engine, cm->engines) if (engine->key_op_handler) engine->key_op_handler (vm, VNET_CRYPTO_KEY_OP_ADD, index); /* *INDENT-ON* */ return index; } void vnet_crypto_key_del (vlib_main_t * vm, vnet_crypto_key_index_t index) { vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_engine_t *engine; vnet_crypto_key_t *key = pool_elt_at_index (cm->keys, index); /* *INDENT-OFF* */ vec_foreach (engine, cm->engines) if (engine->key_op_handler) engine->key_op_handler (vm, VNET_CRYPTO_KEY_OP_DEL, index); /* *INDENT-ON* */ if (key->type == VNET_CRYPTO_KEY_TYPE_DATA) { clib_memset (key->data, 0, vec_len (key->data)); vec_free (key->data); } else if (key->type == VNET_CRYPTO_KEY_TYPE_LINK) { key->index_crypto = key->index_integ = 0; } pool_put (cm->keys, key); } vnet_crypto_async_alg_t vnet_crypto_link_algs (vnet_crypto_alg_t crypto_alg, vnet_crypto_alg_t integ_alg) { #define _(c, h, s, k ,d) \ if (crypto_alg == VNET_CRYPTO_ALG_##c && \ integ_alg == VNET_CRYPTO_ALG_HMAC_##h) \ return VNET_CRYPTO_ALG_##c##_##h##_TAG##d; foreach_crypto_link_async_alg #undef _ return ~0; } u32 vnet_crypto_key_add_linked (vlib_main_t * vm, vnet_crypto_key_index_t index_crypto, vnet_crypto_key_index_t index_integ) { u32 index; vnet_crypto_main_t *cm = &crypto_main; vnet_crypto_engine_t *engine; vnet_crypto_key_t *key_crypto, *key_integ, *key; vnet_crypto_async_alg_t linked_alg; key_crypto = pool_elt_at_index (cm->keys, index_crypto); key_integ = pool_elt_at_index (cm->keys, index_integ); if (!key_crypto || !key_integ) return ~0; linked_alg = vnet_crypto_link_algs (key_crypto->alg, key_integ->alg); if (linked_alg == ~0) return ~0; pool_get_zero (cm->keys, key); index = key - cm->keys; key->type = VNET_CRYPTO_KEY_TYPE_LINK; key->index_crypto = index_crypto; key->index_integ = index_integ; key->async_alg = linked_alg; /* *INDENT-OFF* */ vec_foreach (engine, cm->engines) if (engine->key_op_handler) engine->key_op_handler (vm, VNET_CRYPTO_KEY_OP_ADD, index); /* *INDENT-ON* */ return index; } clib_error_t * crypto_dispatch_enable_disable (int is_enable) { vnet_crypto_main_t *cm = &crypto_main; vlib_thread_main_t *tm = vlib_get_thread_main (); u32 skip_master = vlib_num_workers () > 0, i; vlib_node_state_t state = VLIB_NODE_STATE_DISABLED; u8 state_change = 0; CLIB_MEMORY_STORE_BARRIER (); if (is_enable && cm->async_refcnt > 0) 
# Copyright (c) 2022 Cisco and/or its affi