vpp - Vector Packet Processing

Age	Commit message (Expand)	Author	Files	Lines
2016-04-12	Added a LICENSE file	Ed Warnicke	1	-0/+202

/* * Copyright (c) 2016 Intel and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #ifndef __DPDK_ESP_H__ #define __DPDK_ESP_H__ #include <vnet/devices/dpdk/ipsec/ipsec.h> #include <vnet/ipsec/ipsec.h> #include <vnet/ipsec/esp.h> typedef struct { enum rte_crypto_cipher_algorithm algo; u8 key_len; u8 iv_len; } dpdk_esp_crypto_alg_t; typedef struct { enum rte_crypto_auth_algorithm algo; u8 trunc_size; } dpdk_esp_integ_alg_t; typedef struct { dpdk_esp_crypto_alg_t *esp_crypto_algs; dpdk_esp_integ_alg_t *esp_integ_algs; } dpdk_esp_main_t; dpdk_esp_main_t dpdk_esp_main; static_always_inline void dpdk_esp_init () { dpdk_esp_main_t *em = &dpdk_esp_main; dpdk_esp_integ_alg_t *i; dpdk_esp_crypto_alg_t *c; vec_validate (em->esp_crypto_algs, IPSEC_CRYPTO_N_ALG - 1); c = &em->esp_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_128]; c->algo = RTE_CRYPTO_CIPHER_AES_CBC; c->key_len = 16; c->iv_len = 16; c = &em->esp_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_192]; c->algo = RTE_CRYPTO_CIPHER_AES_CBC; c->key_len = 24; c->iv_len = 16; c = &em->esp_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_256]; c->algo = RTE_CRYPTO_CIPHER_AES_CBC; c->key_len = 32; c->iv_len = 16; c = &em->esp_crypto_algs[IPSEC_CRYPTO_ALG_AES_GCM_128]; c->algo = RTE_CRYPTO_CIPHER_AES_GCM; c->key_len = 16; c->iv_len = 8; vec_validate (em->esp_integ_algs, IPSEC_INTEG_N_ALG - 1); i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA1_96]; i->algo = RTE_CRYPTO_AUTH_SHA1_HMAC; i->trunc_size = 12; i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA_256_96]; i->algo = RTE_CRYPTO_AUTH_SHA256_HMAC; i->trunc_size = 12; i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA_256_128]; i->algo = RTE_CRYPTO_AUTH_SHA256_HMAC; i->trunc_size = 16; i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA_384_192]; i->algo = RTE_CRYPTO_AUTH_SHA384_HMAC; i->trunc_size = 24; i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA_512_256]; i->algo = RTE_CRYPTO_AUTH_SHA512_HMAC; i->trunc_size = 32; i = &em->esp_integ_algs[IPSEC_INTEG_ALG_AES_GCM_128]; i->algo = RTE_CRYPTO_AUTH_AES_GCM; i->trunc_size = 16; } static_always_inline int add_del_sa_sess (u32 sa_index, u8 is_add) { dpdk_crypto_main_t *dcm = &dpdk_crypto_main; crypto_worker_main_t *cwm; u8 skip_master = vlib_num_workers () > 0; /* *INDENT-OFF* */ vec_foreach (cwm, dcm->workers_main) { crypto_sa_session_t *sa_sess; u8 is_outbound; if (skip_master) { skip_master = 0; continue; } for (is_outbound = 0; is_outbound < 2; is_outbound++) { if (is_add) { pool_get (cwm->sa_sess_d[is_outbound], sa_sess); } else { u8 dev_id; sa_sess = pool_elt_at_index (cwm->sa_sess_d[is_outbound], sa_index); dev_id = cwm->qp_data[sa_sess->qp_index].dev_id; if (!sa_sess->sess) continue; if (rte_cryptodev_sym_session_free(dev_id, sa_sess->sess)) { clib_warning("failed to free session"); return -1; } memset(sa_sess, 0, sizeof(sa_sess[0])); } } } /* *INDENT-OFF* */ return 0; } static_always_inline int translate_crypto_algo(ipsec_crypto_alg_t crypto_algo, struct rte_crypto_sym_xform *cipher_xform) { switch (crypto_algo) { case IPSEC_CRYPTO_ALG_NONE: cipher_xform->cipher.algo = RTE_CRYPTO_CIPHER_NULL; break; case IPSEC_CRYPTO_ALG_AES_CBC_128: case IPSEC_CRYPTO_ALG_AES_CBC_192: case IPSEC_CRYPTO_ALG_AES_CBC_256: cipher_xform->cipher.algo = RTE_CRYPTO_CIPHER_AES_CBC; break; case IPSEC_CRYPTO_ALG_AES_GCM_128: cipher_xform->cipher.algo = RTE_CRYPTO_CIPHER_AES_GCM; break; default: return -1; } cipher_xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER; return 0; } static_always_inline int translate_integ_algo(ipsec_integ_alg_t integ_alg, struct rte_crypto_sym_xform *auth_xform, int use_esn) { switch (integ_alg) { case IPSEC_INTEG_ALG_NONE: auth_xform->auth.algo = RTE_CRYPTO_AUTH_NULL; auth_xform->auth.digest_length = 0; break; case IPSEC_INTEG_ALG_SHA1_96: auth_xform->auth.algo = RTE_CRYPTO_AUTH_SHA1_HMAC; auth_xform->auth.digest_length = 12; break; case IPSEC_INTEG_ALG_SHA_256_96: auth_xform->auth.algo = RTE_CRYPTO_AUTH_SHA256_HMAC; auth_xform->auth.digest_length = 12; break; case IPSEC_INTEG_ALG_SHA_256_128: auth_xform->auth.algo = RTE_CRYPTO_AUTH_SHA256_HMAC; auth_xform->auth.digest_length = 16; break; case IPSEC_INTEG_ALG_SHA_384_192: auth_xform->auth.algo = RTE_CRYPTO_AUTH_SHA384_HMAC; auth_xform->auth.digest_length = 24; break; case IPSEC_INTEG_ALG_SHA_512_256: auth_xform->auth.algo = RTE_CRYPTO_AUTH_SHA512_HMAC; auth_xform->auth.digest_length = 32; break; case IPSEC_INTEG_ALG_AES_GCM_128: auth_xform->auth.algo = RTE_CRYPTO_AUTH_AES_GCM; auth_xform->auth.digest_length = 16; auth_xform->auth.add_auth_data_length = use_esn? 12 : 8; break; default: return -1; } auth_xform->type = RTE_CRYPTO_SYM_XFORM_AUTH; return 0; } static_always_inline int create_sym_sess(ipsec_sa_t *sa, crypto_sa_session_t *sa_sess, u8 is_outbound) { u32 cpu_index = os_get_cpu_number(); dpdk_crypto_main_t * dcm = &dpdk_crypto_main; crypto_worker_main_t *cwm = &dcm->workers_main[cpu_index]; struct rte_crypto_sym_xform cipher_xform = {0}; struct rte_crypto_sym_xform auth_xform = {0}; struct rte_crypto_sym_xform *xfs; uword key = 0, *data; crypto_worker_qp_key_t *p_key = (crypto_worker_qp_key_t *)&key; if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128) { sa->crypto_key_len -= 4; clib_memcpy(&sa->salt, &sa->crypto_key[sa->crypto_key_len], 4); } else { sa->salt = (u32) rand(); } cipher_xform.type = RTE_CRYPTO_SYM_XFORM_CIPHER; cipher_xform.cipher.key.data = sa->crypto_key; cipher_xform.cipher.key.length = sa->crypto_key_len; auth_xform.type = RTE_CRYPTO_SYM_XFORM_AUTH; auth_xform.auth.key.data = sa->integ_key; auth_xform.auth.key.length = sa->integ_key_len; if (translate_crypto_algo(sa->crypto_alg, &cipher_xform) < 0) return -1; p_key->cipher_algo = cipher_xform.cipher.algo; if (translate_integ_algo(sa->integ_alg, &auth_xform, sa->use_esn) < 0) return -1; p_key->auth_algo = auth_xform.auth.algo; if (is_outbound) { cipher_xform.cipher.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT; auth_xform.auth.op = RTE_CRYPTO_AUTH_OP_GENERATE; cipher_xform.next = &auth_xform; xfs = &cipher_xform; } else { cipher_xform.cipher.op = RTE_CRYPTO_CIPHER_OP_DECRYPT; auth_xform.auth.op = RTE_CRYPTO_AUTH_OP_VERIFY; auth_xform.next = &cipher_xform; xfs = &auth_xform; } p_key->is_outbound = is_outbound; data = hash_get(cwm->algo_qp_map, key); if (!data) return -1; sa_sess->sess = rte_cryptodev_sym_session_create(cwm->qp_data[*data].dev_id, xfs); if (!sa_sess->sess) return -1; sa_sess->qp_index = (u8)*data; return 0; } #endif /* __DPDK_ESP_H__ */ /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */