diff options
Diffstat (limited to 'src/vnet/ipsec/ipsec.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec.c | 83 |
1 files changed, 81 insertions, 2 deletions
diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c index e7cb615f957..6b31926be4f 100644 --- a/src/vnet/ipsec/ipsec.c +++ b/src/vnet/ipsec/ipsec.c @@ -26,6 +26,8 @@ #include <vnet/ipsec/ah.h> ipsec_main_t ipsec_main; +esp_async_post_next_t esp_encrypt_async_next; +esp_async_post_next_t esp_decrypt_async_next; static clib_error_t * ipsec_check_ah_support (ipsec_sa_t * sa) @@ -173,7 +175,8 @@ ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im, const char *esp6_decrypt_node_name, const char *esp6_decrypt_tun_node_name, check_support_cb_t esp_check_support_cb, - add_del_sa_sess_cb_t esp_add_del_sa_sess_cb) + add_del_sa_sess_cb_t esp_add_del_sa_sess_cb, + enable_disable_cb_t enable_disable_cb) { ipsec_esp_backend_t *b; @@ -206,6 +209,8 @@ ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im, b->check_support_cb = esp_check_support_cb; b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb; + b->enable_disable_cb = enable_disable_cb; + return b - im->esp_backends; } @@ -253,6 +258,18 @@ ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx) if (pool_is_free_index (im->esp_backends, backend_idx)) return VNET_API_ERROR_INVALID_VALUE; + /* disable current backend */ + if (im->esp_current_backend != ~0) + { + ipsec_esp_backend_t *cb = pool_elt_at_index (im->esp_backends, + im->esp_current_backend); + if (cb->enable_disable_cb) + { + if ((cb->enable_disable_cb) (0) != 0) + return -1; + } + } + ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx); im->esp_current_backend = backend_idx; im->esp4_encrypt_node_index = b->esp4_encrypt_node_index; @@ -273,9 +290,64 @@ ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx) im->esp46_encrypt_tun_feature_index = b->esp46_encrypt_tun_feature_index; im->esp66_encrypt_tun_feature_index = b->esp66_encrypt_tun_feature_index; + if (b->enable_disable_cb) + { + if ((b->enable_disable_cb) (1) != 0) + return -1; + } return 0; } +void +ipsec_set_async_mode (u32 is_enabled) +{ + ipsec_main_t *im = &ipsec_main; + ipsec_sa_t *sa; + + /* lock all SAs before change im->async_mode */ + pool_foreach (sa, im->sad, ( + { + fib_node_lock (&sa->node); + })); + + im->async_mode = is_enabled; + + /* change SA crypto op data before unlock them */ + pool_foreach (sa, im->sad, ( + { + sa->crypto_op_data = is_enabled ? + sa->async_op_data.data : sa->sync_op_data.data; + fib_node_unlock (&sa->node); + })); +} + +static void +crypto_engine_backend_register_post_node (vlib_main_t * vm) +{ + esp_async_post_next_t *eit; + esp_async_post_next_t *dit; + + eit = &esp_encrypt_async_next; + eit->esp4_post_next = + vnet_crypto_register_post_node (vm, "esp4-encrypt-post"); + eit->esp6_post_next = + vnet_crypto_register_post_node (vm, "esp6-encrypt-post"); + eit->esp4_tun_post_next = + vnet_crypto_register_post_node (vm, "esp4-encrypt-tun-post"); + eit->esp6_tun_post_next = + vnet_crypto_register_post_node (vm, "esp6-encrypt-tun-post"); + + dit = &esp_decrypt_async_next; + dit->esp4_post_next = + vnet_crypto_register_post_node (vm, "esp4-decrypt-post"); + dit->esp6_post_next = + vnet_crypto_register_post_node (vm, "esp6-decrypt-post"); + dit->esp4_tun_post_next = + vnet_crypto_register_post_node (vm, "esp4-decrypt-tun-post"); + dit->esp6_tun_post_next = + vnet_crypto_register_post_node (vm, "esp6-decrypt-tun-post"); +} + static clib_error_t * ipsec_init (vlib_main_t * vm) { @@ -298,6 +370,9 @@ ipsec_init (vlib_main_t * vm) ASSERT (node); im->error_drop_node_index = node->index; + im->ah_current_backend = ~0; + im->esp_current_backend = ~0; + u32 idx = ipsec_register_ah_backend (vm, im, "crypto engine backend", "ah4-encrypt", "ah4-decrypt", @@ -320,7 +395,8 @@ ipsec_init (vlib_main_t * vm) "esp6-encrypt-tun", "esp6-decrypt", "esp6-decrypt-tun", - ipsec_check_esp_support, NULL); + ipsec_check_esp_support, + NULL, crypto_dispatch_enable_disable); im->esp_default_backend = idx; rv = ipsec_select_esp_backend (im, idx); @@ -454,6 +530,9 @@ ipsec_init (vlib_main_t * vm) im->esp6_dec_tun_fq_index = vlib_frame_queue_main_init (esp6_decrypt_tun_node.index, 0); + im->async_mode = 0; + crypto_engine_backend_register_post_node (vm); + return 0; } |