summaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec/ipsec.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/vnet/ipsec/ipsec.c')
-rw-r--r--src/vnet/ipsec/ipsec.c83
1 files changed, 81 insertions, 2 deletions
diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c
index e7cb615f957..6b31926be4f 100644
--- a/src/vnet/ipsec/ipsec.c
+++ b/src/vnet/ipsec/ipsec.c
@@ -26,6 +26,8 @@
#include <vnet/ipsec/ah.h>
ipsec_main_t ipsec_main;
+esp_async_post_next_t esp_encrypt_async_next;
+esp_async_post_next_t esp_decrypt_async_next;
static clib_error_t *
ipsec_check_ah_support (ipsec_sa_t * sa)
@@ -173,7 +175,8 @@ ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
const char *esp6_decrypt_node_name,
const char *esp6_decrypt_tun_node_name,
check_support_cb_t esp_check_support_cb,
- add_del_sa_sess_cb_t esp_add_del_sa_sess_cb)
+ add_del_sa_sess_cb_t esp_add_del_sa_sess_cb,
+ enable_disable_cb_t enable_disable_cb)
{
ipsec_esp_backend_t *b;
@@ -206,6 +209,8 @@ ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
b->check_support_cb = esp_check_support_cb;
b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb;
+ b->enable_disable_cb = enable_disable_cb;
+
return b - im->esp_backends;
}
@@ -253,6 +258,18 @@ ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
if (pool_is_free_index (im->esp_backends, backend_idx))
return VNET_API_ERROR_INVALID_VALUE;
+ /* disable current backend */
+ if (im->esp_current_backend != ~0)
+ {
+ ipsec_esp_backend_t *cb = pool_elt_at_index (im->esp_backends,
+ im->esp_current_backend);
+ if (cb->enable_disable_cb)
+ {
+ if ((cb->enable_disable_cb) (0) != 0)
+ return -1;
+ }
+ }
+
ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx);
im->esp_current_backend = backend_idx;
im->esp4_encrypt_node_index = b->esp4_encrypt_node_index;
@@ -273,9 +290,64 @@ ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
im->esp46_encrypt_tun_feature_index = b->esp46_encrypt_tun_feature_index;
im->esp66_encrypt_tun_feature_index = b->esp66_encrypt_tun_feature_index;
+ if (b->enable_disable_cb)
+ {
+ if ((b->enable_disable_cb) (1) != 0)
+ return -1;
+ }
return 0;
}
+void
+ipsec_set_async_mode (u32 is_enabled)
+{
+ ipsec_main_t *im = &ipsec_main;
+ ipsec_sa_t *sa;
+
+ /* lock all SAs before change im->async_mode */
+ pool_foreach (sa, im->sad, (
+ {
+ fib_node_lock (&sa->node);
+ }));
+
+ im->async_mode = is_enabled;
+
+ /* change SA crypto op data before unlock them */
+ pool_foreach (sa, im->sad, (
+ {
+ sa->crypto_op_data = is_enabled ?
+ sa->async_op_data.data : sa->sync_op_data.data;
+ fib_node_unlock (&sa->node);
+ }));
+}
+
+static void
+crypto_engine_backend_register_post_node (vlib_main_t * vm)
+{
+ esp_async_post_next_t *eit;
+ esp_async_post_next_t *dit;
+
+ eit = &esp_encrypt_async_next;
+ eit->esp4_post_next =
+ vnet_crypto_register_post_node (vm, "esp4-encrypt-post");
+ eit->esp6_post_next =
+ vnet_crypto_register_post_node (vm, "esp6-encrypt-post");
+ eit->esp4_tun_post_next =
+ vnet_crypto_register_post_node (vm, "esp4-encrypt-tun-post");
+ eit->esp6_tun_post_next =
+ vnet_crypto_register_post_node (vm, "esp6-encrypt-tun-post");
+
+ dit = &esp_decrypt_async_next;
+ dit->esp4_post_next =
+ vnet_crypto_register_post_node (vm, "esp4-decrypt-post");
+ dit->esp6_post_next =
+ vnet_crypto_register_post_node (vm, "esp6-decrypt-post");
+ dit->esp4_tun_post_next =
+ vnet_crypto_register_post_node (vm, "esp4-decrypt-tun-post");
+ dit->esp6_tun_post_next =
+ vnet_crypto_register_post_node (vm, "esp6-decrypt-tun-post");
+}
+
static clib_error_t *
ipsec_init (vlib_main_t * vm)
{
@@ -298,6 +370,9 @@ ipsec_init (vlib_main_t * vm)
ASSERT (node);
im->error_drop_node_index = node->index;
+ im->ah_current_backend = ~0;
+ im->esp_current_backend = ~0;
+
u32 idx = ipsec_register_ah_backend (vm, im, "crypto engine backend",
"ah4-encrypt",
"ah4-decrypt",
@@ -320,7 +395,8 @@ ipsec_init (vlib_main_t * vm)
"esp6-encrypt-tun",
"esp6-decrypt",
"esp6-decrypt-tun",
- ipsec_check_esp_support, NULL);
+ ipsec_check_esp_support,
+ NULL, crypto_dispatch_enable_disable);
im->esp_default_backend = idx;
rv = ipsec_select_esp_backend (im, idx);
@@ -454,6 +530,9 @@ ipsec_init (vlib_main_t * vm)
im->esp6_dec_tun_fq_index =
vlib_frame_queue_main_init (esp6_decrypt_tun_node.index, 0);
+ im->async_mode = 0;
+ crypto_engine_backend_register_post_node (vm);
+
return 0;
}