1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
|
/*
* ipsec_tun.h : IPSEC tunnel protection
*
* Copyright (c) 2015 Cisco and/or its affiliates.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at:
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <vnet/ipsec/ipsec.h>
/**
* result of a lookup in the protection bihash
*/
typedef struct ipsec_tun_lkup_result_t_
{
union
{
struct
{
u32 tun_index;
u32 sa_index;
};
u64 as_u64;
};
} ipsec_tun_lkup_result_t;
typedef struct ipsec4_tunnel_kv_t
{
/*
* Key fields: remote ip and spi on incoming packet
* all fields in NET byte order
*/
u64 key;
ipsec_tun_lkup_result_t value;
} __clib_packed ipsec4_tunnel_kv_t;
STATIC_ASSERT_SIZEOF (ipsec4_tunnel_kv_t, sizeof (clib_bihash_kv_8_8_t));
STATIC_ASSERT_OFFSET_OF (ipsec4_tunnel_kv_t, value,
STRUCT_OFFSET_OF (clib_bihash_kv_8_8_t, value));
static inline void
ipsec4_tunnel_mk_key (ipsec4_tunnel_kv_t * k,
const ip4_address_t * ip, u32 spi)
{
k->key = (((u64) ip->as_u32) << 32 | spi);
}
static inline void
ipsec4_tunnel_extract_key (const ipsec4_tunnel_kv_t * k,
ip4_address_t * ip, u32 * spi)
{
*spi = (u32) k->key;
(*ip).as_u32 = k->key >> 32;
}
typedef struct ipsec6_tunnel_kv_t_
{
/*
* Key fields: remote ip and spi on incoming packet
* all fields in NET byte order
*/
struct
{
ip6_address_t remote_ip;
u32 spi;
u32 __pad;
} key;
ipsec_tun_lkup_result_t value;
} __clib_packed ipsec6_tunnel_kv_t;
STATIC_ASSERT_SIZEOF (ipsec6_tunnel_kv_t, sizeof (clib_bihash_kv_24_8_t));
STATIC_ASSERT_OFFSET_OF (ipsec6_tunnel_kv_t, value,
STRUCT_OFFSET_OF (clib_bihash_kv_24_8_t, value));
extern u8 *format_ipsec4_tunnel_kv (u8 * s, va_list * args);
extern u8 *format_ipsec6_tunnel_kv (u8 * s, va_list * args);
#define foreach_ipsec_protect_flags \
_(L2, 1, "l2") \
_(ENCAPED, 2, "encapped") \
_(ITF, 4, "itf") \
typedef enum ipsec_protect_flags_t_
{
IPSEC_PROTECT_NONE = 0,
#define _(a,b,c) IPSEC_PROTECT_##a = b,
foreach_ipsec_protect_flags
#undef _
} __clib_packed ipsec_protect_flags_t;
extern u8 *format_ipsec_tun_protect_flags (u8 * s, va_list * args);
typedef struct ipsec_ep_t_
{
ip46_address_t src;
ip46_address_t dst;
} ipsec_ep_t;
#define ITP_MAX_N_SA_IN 4
typedef struct ipsec_tun_protect_t_
{
CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
index_t itp_out_sa;
/* not using a vector since we want the memory inline
* with this struct */
u32 itp_n_sa_in;
index_t itp_in_sas[ITP_MAX_N_SA_IN];
u32 itp_sw_if_index;
ipsec_ep_t itp_crypto;
ipsec_protect_flags_t itp_flags;
adj_index_t itp_ai;
ipsec_ep_t itp_tun;
ip_address_t *itp_key;
} ipsec_tun_protect_t;
#define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body) \
{ \
u32 __ii; \
for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) { \
_sai = itp->itp_in_sas[__ii]; \
body; \
} \
}
#define FOR_EACH_IPSEC_PROTECT_INPUT_SA(_itp, _sa, body) \
{ \
u32 __ii; \
for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) { \
_sa = ipsec_sa_get(itp->itp_in_sas[__ii]); \
body; \
} \
}
extern int ipsec_tun_protect_update_one (u32 sw_if_index,
const ip_address_t * nh,
u32 sa_out, u32 sa_in);
extern int ipsec_tun_protect_update (u32 sw_if_index,
const ip_address_t * nh,
u32 sa_out, u32 * sa_ins);
extern int ipsec_tun_protect_update_in (u32 sw_if_index,
const ip_address_t * nh, u32 sa_in);
extern int ipsec_tun_protect_update_out (u32 sw_if_index,
const ip_address_t * nh, u32 sa_out);
extern int ipsec_tun_protect_del (u32 sw_if_index, const ip_address_t * nh);
typedef walk_rc_t (*ipsec_tun_protect_walk_cb_t) (index_t itpi, void *arg);
extern void ipsec_tun_protect_walk (ipsec_tun_protect_walk_cb_t fn,
void *cttx);
extern void ipsec_tun_protect_walk_itf (u32 sw_if_index,
ipsec_tun_protect_walk_cb_t fn,
void *cttx);
extern u8 *format_ipsec_tun_protect (u8 * s, va_list * args);
extern u8 *format_ipsec_tun_protect_index (u8 * s, va_list * args);
extern void ipsec_tun_register_nodes (ip_address_family_t af);
extern void ipsec_tun_unregister_nodes (ip_address_family_t af);
extern void ipsec_tun_table_init (ip_address_family_t af,
uword table_size, u32 n_buckets);
// FIXME
extern vlib_node_registration_t ipsec4_tun_input_node;
extern vlib_node_registration_t ipsec6_tun_input_node;
/*
* DP API
*/
extern ipsec_tun_protect_t *ipsec_tun_protect_pool;
always_inline ipsec_tun_protect_t *
ipsec_tun_protect_get (u32 index)
{
return (pool_elt_at_index (ipsec_tun_protect_pool, index));
}
extern index_t *ipsec_tun_protect_sa_by_adj_index;
always_inline index_t
ipsec_tun_protect_get_sa_out (adj_index_t ai)
{
ASSERT (vec_len (ipsec_tun_protect_sa_by_adj_index) > ai);
ASSERT (INDEX_INVALID != ipsec_tun_protect_sa_by_adj_index[ai]);
return (ipsec_tun_protect_sa_by_adj_index[ai]);
}
/*
* fd.io coding-style-patch-verification: ON
*
* Local Variables:
* eval: (c-set-style "gnu")
* End:
*/
|
