2 * ipsec.c : IPSEC module functions
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 #include <vnet/udp/udp_local.h>
24 #include <vnet/ipsec/ipsec.h>
25 #include <vnet/ipsec/esp.h>
26 #include <vnet/ipsec/ah.h>
27 #include <vnet/ipsec/ipsec_tun.h>
28 #include <vnet/ipsec/ipsec_itf.h>
29 #include <vnet/ipsec/ipsec_spd_fp_lookup.h>
31 /* Flow cache is sized for 1 million flows with a load factor of .25.
33 #define IPSEC4_OUT_SPD_DEFAULT_HASH_NUM_BUCKETS (1 << 22)
35 /* Flow cache is sized for 1 million flows with a load factor of .25.
37 #define IPSEC4_SPD_DEFAULT_HASH_NUM_BUCKETS (1 << 22)
39 ipsec_main_t ipsec_main;
41 esp_async_post_next_t esp_encrypt_async_next;
42 esp_async_post_next_t esp_decrypt_async_next;
45 ipsec_register_next_header (vlib_main_t *vm, u8 next_header,
46 const char *next_node)
48 ipsec_main_t *im = &ipsec_main;
49 const vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) next_node);
50 /* -post nodes (eg. esp4-decrypt-post) are siblings of non-post nodes (eg.
51 * esp4-decrypt) and will therefore have the same next index */
52 const vlib_node_t *esp_decrypt_nodes[] = {
53 vlib_get_node (vm, im->esp4_decrypt_node_index),
54 vlib_get_node (vm, im->esp6_decrypt_node_index),
55 vlib_get_node (vm, im->esp4_decrypt_tun_node_index),
56 vlib_get_node (vm, im->esp6_decrypt_tun_node_index),
61 /* looks for a next_index value that we can use for all esp decrypt nodes to
62 * avoid maintaining different next index arrays... */
64 slot = vlib_node_get_next (vm, esp_decrypt_nodes[0]->index, node->index);
65 max = vec_len (esp_decrypt_nodes[0]->next_nodes);
66 for (i = 1; i < ARRAY_LEN (esp_decrypt_nodes); i++)
68 /* if next node already exists, check it shares the same next_index */
70 vlib_node_get_next (vm, esp_decrypt_nodes[i]->index, node->index))
71 return clib_error_return (
72 0, "next node already exists with different next index");
73 /* compute a suitable slot from the max of all nodes next index */
74 max = clib_max (max, vec_len (esp_decrypt_nodes[i]->next_nodes));
79 /* next node not there yet, add it using the computed max */
81 for (i = 0; i < ARRAY_LEN (esp_decrypt_nodes); i++)
82 vlib_node_add_next_with_slot (vm, esp_decrypt_nodes[i]->index,
86 im->next_header_registrations[next_header] = slot;
91 ipsec_check_ah_support (ipsec_sa_t * sa)
93 ipsec_main_t *im = &ipsec_main;
95 if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
96 return clib_error_return (0, "unsupported none integ-alg");
98 if (!vnet_crypto_is_set_handler (im->integ_algs[sa->integ_alg].alg))
99 return clib_error_return (0, "No crypto engine support for %U",
100 format_ipsec_integ_alg, sa->integ_alg);
105 static clib_error_t *
106 ipsec_check_esp_support (ipsec_sa_t * sa)
108 ipsec_main_t *im = &ipsec_main;
110 if (IPSEC_INTEG_ALG_NONE != sa->integ_alg)
112 if (!vnet_crypto_is_set_handler (im->integ_algs[sa->integ_alg].alg))
113 return clib_error_return (0, "No crypto engine support for %U",
114 format_ipsec_integ_alg, sa->integ_alg);
116 if (IPSEC_CRYPTO_ALG_NONE != sa->crypto_alg)
118 if (!vnet_crypto_is_set_handler (im->crypto_algs[sa->crypto_alg].alg))
119 return clib_error_return (0, "No crypto engine support for %U",
120 format_ipsec_crypto_alg, sa->crypto_alg);
127 ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, u8 is_add)
129 ipsec_ah_backend_t *ah =
130 pool_elt_at_index (im->ah_backends, im->ah_current_backend);
131 if (ah->add_del_sa_sess_cb)
133 clib_error_t *err = ah->add_del_sa_sess_cb (sa_index, is_add);
137 ipsec_esp_backend_t *esp =
138 pool_elt_at_index (im->esp_backends, im->esp_current_backend);
139 if (esp->add_del_sa_sess_cb)
141 clib_error_t *err = esp->add_del_sa_sess_cb (sa_index, is_add);
149 ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa)
151 clib_error_t *error = 0;
153 if (PREDICT_FALSE (sa->protocol == IPSEC_PROTOCOL_AH))
155 ipsec_ah_backend_t *ah =
156 pool_elt_at_index (im->ah_backends, im->ah_current_backend);
157 ASSERT (ah->check_support_cb);
158 error = ah->check_support_cb (sa);
162 ipsec_esp_backend_t *esp =
163 pool_elt_at_index (im->esp_backends, im->esp_current_backend);
164 ASSERT (esp->check_support_cb);
165 error = esp->check_support_cb (sa);
172 ipsec_add_node (vlib_main_t * vm, const char *node_name,
173 const char *prev_node_name, u32 * out_node_index,
174 u32 * out_next_index)
176 vlib_node_t *prev_node, *node;
177 prev_node = vlib_get_node_by_name (vm, (u8 *) prev_node_name);
179 node = vlib_get_node_by_name (vm, (u8 *) node_name);
181 *out_node_index = node->index;
182 *out_next_index = vlib_node_add_next (vm, prev_node->index, node->index);
186 ipsec_udp_registration_key (u16 port, u8 is_ip4)
188 uword key = (is_ip4) ? AF_IP4 : AF_IP6;
190 key |= (uword) (port << 16);
195 ipsec_unregister_udp_port (u16 port, u8 is_ip4)
197 ipsec_main_t *im = &ipsec_main;
201 key = ipsec_udp_registration_key (port, is_ip4);
202 p = hash_get (im->udp_port_registrations, key);
210 udp_unregister_dst_port (vlib_get_main (), port, is_ip4);
211 hash_unset (im->udp_port_registrations, key);
215 hash_unset (im->udp_port_registrations, key);
216 hash_set (im->udp_port_registrations, key, n_regs);
221 ipsec_register_udp_port (u16 port, u8 is_ip4)
223 ipsec_main_t *im = &ipsec_main;
224 u32 n_regs, node_index;
227 key = ipsec_udp_registration_key (port, is_ip4);
229 (is_ip4) ? ipsec4_tun_input_node.index : ipsec6_tun_input_node.index;
230 p = hash_get (im->udp_port_registrations, key);
232 n_regs = (p ? p[0] : 0);
235 udp_register_dst_port (vlib_get_main (), port, node_index, is_ip4);
237 hash_unset (im->udp_port_registrations, key);
238 hash_set (im->udp_port_registrations, key, n_regs);
242 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im,
244 const char *ah4_encrypt_node_name,
245 const char *ah4_decrypt_node_name,
246 const char *ah6_encrypt_node_name,
247 const char *ah6_decrypt_node_name,
248 check_support_cb_t ah_check_support_cb,
249 add_del_sa_sess_cb_t ah_add_del_sa_sess_cb)
251 ipsec_ah_backend_t *b;
252 pool_get (im->ah_backends, b);
253 b->name = format (0, "%s%c", name, 0);
255 ipsec_add_node (vm, ah4_encrypt_node_name, "ipsec4-output-feature",
256 &b->ah4_encrypt_node_index, &b->ah4_encrypt_next_index);
257 ipsec_add_node (vm, ah4_decrypt_node_name, "ipsec4-input-feature",
258 &b->ah4_decrypt_node_index, &b->ah4_decrypt_next_index);
259 ipsec_add_node (vm, ah6_encrypt_node_name, "ipsec6-output-feature",
260 &b->ah6_encrypt_node_index, &b->ah6_encrypt_next_index);
261 ipsec_add_node (vm, ah6_decrypt_node_name, "ipsec6-input-feature",
262 &b->ah6_decrypt_node_index, &b->ah6_decrypt_next_index);
264 b->check_support_cb = ah_check_support_cb;
265 b->add_del_sa_sess_cb = ah_add_del_sa_sess_cb;
266 return b - im->ah_backends;
270 ipsec_register_esp_backend (
271 vlib_main_t *vm, ipsec_main_t *im, const char *name,
272 const char *esp4_encrypt_node_name, const char *esp4_encrypt_node_tun_name,
273 const char *esp4_decrypt_node_name, const char *esp4_decrypt_tun_node_name,
274 const char *esp6_encrypt_node_name, const char *esp6_encrypt_node_tun_name,
275 const char *esp6_decrypt_node_name, const char *esp6_decrypt_tun_node_name,
276 const char *esp_mpls_encrypt_node_tun_name,
277 check_support_cb_t esp_check_support_cb,
278 add_del_sa_sess_cb_t esp_add_del_sa_sess_cb,
279 enable_disable_cb_t enable_disable_cb)
281 ipsec_esp_backend_t *b;
283 pool_get (im->esp_backends, b);
284 b->name = format (0, "%s%c", name, 0);
286 ipsec_add_node (vm, esp4_encrypt_node_name, "ipsec4-output-feature",
287 &b->esp4_encrypt_node_index, &b->esp4_encrypt_next_index);
288 ipsec_add_node (vm, esp4_decrypt_node_name, "ipsec4-input-feature",
289 &b->esp4_decrypt_node_index, &b->esp4_decrypt_next_index);
290 ipsec_add_node (vm, esp6_encrypt_node_name, "ipsec6-output-feature",
291 &b->esp6_encrypt_node_index, &b->esp6_encrypt_next_index);
292 ipsec_add_node (vm, esp6_decrypt_node_name, "ipsec6-input-feature",
293 &b->esp6_decrypt_node_index, &b->esp6_decrypt_next_index);
294 ipsec_add_node (vm, esp4_decrypt_tun_node_name, "ipsec4-tun-input",
295 &b->esp4_decrypt_tun_node_index,
296 &b->esp4_decrypt_tun_next_index);
297 ipsec_add_node (vm, esp6_decrypt_tun_node_name, "ipsec6-tun-input",
298 &b->esp6_decrypt_tun_node_index,
299 &b->esp6_decrypt_tun_next_index);
301 b->esp6_encrypt_tun_node_index =
302 vlib_get_node_by_name (vm, (u8 *) esp6_encrypt_node_tun_name)->index;
303 b->esp_mpls_encrypt_tun_node_index =
304 vlib_get_node_by_name (vm, (u8 *) esp_mpls_encrypt_node_tun_name)->index;
305 b->esp4_encrypt_tun_node_index =
306 vlib_get_node_by_name (vm, (u8 *) esp4_encrypt_node_tun_name)->index;
308 b->check_support_cb = esp_check_support_cb;
309 b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb;
310 b->enable_disable_cb = enable_disable_cb;
312 return b - im->esp_backends;
316 ipsec_rsc_in_use (ipsec_main_t * im)
318 /* return an error is crypto resource are in use */
319 if (pool_elts (ipsec_sa_pool) > 0)
320 return clib_error_return (0, "%d SA entries configured",
321 pool_elts (ipsec_sa_pool));
322 if (ipsec_itf_count () > 0)
323 return clib_error_return (0, "%d IPSec interface configured",
330 ipsec_select_ah_backend (ipsec_main_t * im, u32 backend_idx)
332 if (ipsec_rsc_in_use (im))
333 return VNET_API_ERROR_RSRC_IN_USE;
335 if (pool_is_free_index (im->ah_backends, backend_idx))
336 return VNET_API_ERROR_INVALID_VALUE;
338 ipsec_ah_backend_t *b = pool_elt_at_index (im->ah_backends, backend_idx);
339 im->ah_current_backend = backend_idx;
340 im->ah4_encrypt_node_index = b->ah4_encrypt_node_index;
341 im->ah4_decrypt_node_index = b->ah4_decrypt_node_index;
342 im->ah4_encrypt_next_index = b->ah4_encrypt_next_index;
343 im->ah4_decrypt_next_index = b->ah4_decrypt_next_index;
344 im->ah6_encrypt_node_index = b->ah6_encrypt_node_index;
345 im->ah6_decrypt_node_index = b->ah6_decrypt_node_index;
346 im->ah6_encrypt_next_index = b->ah6_encrypt_next_index;
347 im->ah6_decrypt_next_index = b->ah6_decrypt_next_index;
353 ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
355 if (ipsec_rsc_in_use (im))
356 return VNET_API_ERROR_RSRC_IN_USE;
358 if (pool_is_free_index (im->esp_backends, backend_idx))
359 return VNET_API_ERROR_INVALID_VALUE;
361 /* disable current backend */
362 if (im->esp_current_backend != ~0)
364 ipsec_esp_backend_t *cb = pool_elt_at_index (im->esp_backends,
365 im->esp_current_backend);
366 if (cb->enable_disable_cb)
368 if ((cb->enable_disable_cb) (0) != 0)
373 ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx);
374 im->esp_current_backend = backend_idx;
375 im->esp4_encrypt_node_index = b->esp4_encrypt_node_index;
376 im->esp4_decrypt_node_index = b->esp4_decrypt_node_index;
377 im->esp4_encrypt_next_index = b->esp4_encrypt_next_index;
378 im->esp4_decrypt_next_index = b->esp4_decrypt_next_index;
379 im->esp6_encrypt_node_index = b->esp6_encrypt_node_index;
380 im->esp6_decrypt_node_index = b->esp6_decrypt_node_index;
381 im->esp6_encrypt_next_index = b->esp6_encrypt_next_index;
382 im->esp6_decrypt_next_index = b->esp6_decrypt_next_index;
383 im->esp4_decrypt_tun_node_index = b->esp4_decrypt_tun_node_index;
384 im->esp4_decrypt_tun_next_index = b->esp4_decrypt_tun_next_index;
385 im->esp6_decrypt_tun_node_index = b->esp6_decrypt_tun_node_index;
386 im->esp6_decrypt_tun_next_index = b->esp6_decrypt_tun_next_index;
387 im->esp4_encrypt_tun_node_index = b->esp4_encrypt_tun_node_index;
388 im->esp6_encrypt_tun_node_index = b->esp6_encrypt_tun_node_index;
389 im->esp_mpls_encrypt_tun_node_index = b->esp_mpls_encrypt_tun_node_index;
391 if (b->enable_disable_cb)
393 if ((b->enable_disable_cb) (1) != 0)
400 ipsec_set_async_mode (u32 is_enabled)
402 ipsec_main_t *im = &ipsec_main;
405 vnet_crypto_request_async_mode (is_enabled);
407 im->async_mode = is_enabled;
409 /* change SA crypto op data */
410 pool_foreach (sa, ipsec_sa_pool)
411 ipsec_sa_set_async_mode (sa, is_enabled);
415 crypto_engine_backend_register_post_node (vlib_main_t * vm)
417 esp_async_post_next_t *eit;
418 esp_async_post_next_t *dit;
420 eit = &esp_encrypt_async_next;
421 eit->esp4_post_next =
422 vnet_crypto_register_post_node (vm, "esp4-encrypt-post");
423 eit->esp6_post_next =
424 vnet_crypto_register_post_node (vm, "esp6-encrypt-post");
425 eit->esp4_tun_post_next =
426 vnet_crypto_register_post_node (vm, "esp4-encrypt-tun-post");
427 eit->esp6_tun_post_next =
428 vnet_crypto_register_post_node (vm, "esp6-encrypt-tun-post");
429 eit->esp_mpls_tun_post_next =
430 vnet_crypto_register_post_node (vm, "esp-mpls-encrypt-tun-post");
432 dit = &esp_decrypt_async_next;
433 dit->esp4_post_next =
434 vnet_crypto_register_post_node (vm, "esp4-decrypt-post");
435 dit->esp6_post_next =
436 vnet_crypto_register_post_node (vm, "esp6-decrypt-post");
437 dit->esp4_tun_post_next =
438 vnet_crypto_register_post_node (vm, "esp4-decrypt-tun-post");
439 dit->esp6_tun_post_next =
440 vnet_crypto_register_post_node (vm, "esp6-decrypt-tun-post");
443 static clib_error_t *
444 ipsec_init (vlib_main_t * vm)
447 ipsec_main_t *im = &ipsec_main;
448 ipsec_main_crypto_alg_t *a;
450 /* Backend registration requires the feature arcs to be set up */
451 if ((error = vlib_call_init_function (vm, vnet_feature_init)))
454 im->vnet_main = vnet_get_main ();
457 im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
458 im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
459 im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
461 vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
463 im->error_drop_node_index = node->index;
465 im->ah_current_backend = ~0;
466 im->esp_current_backend = ~0;
468 u32 idx = ipsec_register_ah_backend (vm, im, "crypto engine backend",
473 ipsec_check_ah_support,
476 im->ah_default_backend = idx;
477 int rv = ipsec_select_ah_backend (im, idx);
479 (void) (rv); // avoid warning
481 idx = ipsec_register_esp_backend (
482 vm, im, "crypto engine backend", "esp4-encrypt", "esp4-encrypt-tun",
483 "esp4-decrypt", "esp4-decrypt-tun", "esp6-encrypt", "esp6-encrypt-tun",
484 "esp6-decrypt", "esp6-decrypt-tun", "esp-mpls-encrypt-tun",
485 ipsec_check_esp_support, NULL, crypto_dispatch_enable_disable);
486 im->esp_default_backend = idx;
488 rv = ipsec_select_esp_backend (im, idx);
490 (void) (rv); // avoid warning
492 if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
495 vec_validate (im->crypto_algs, IPSEC_CRYPTO_N_ALG - 1);
497 a = im->crypto_algs + IPSEC_CRYPTO_ALG_NONE;
498 a->enc_op_id = VNET_CRYPTO_OP_NONE;
499 a->dec_op_id = VNET_CRYPTO_OP_NONE;
500 a->alg = VNET_CRYPTO_ALG_NONE;
504 a = im->crypto_algs + IPSEC_CRYPTO_ALG_DES_CBC;
505 a->enc_op_id = VNET_CRYPTO_OP_DES_CBC_ENC;
506 a->dec_op_id = VNET_CRYPTO_OP_DES_CBC_DEC;
507 a->alg = VNET_CRYPTO_ALG_DES_CBC;
508 a->iv_size = a->block_align = 8;
510 a = im->crypto_algs + IPSEC_CRYPTO_ALG_3DES_CBC;
511 a->enc_op_id = VNET_CRYPTO_OP_3DES_CBC_ENC;
512 a->dec_op_id = VNET_CRYPTO_OP_3DES_CBC_DEC;
513 a->alg = VNET_CRYPTO_ALG_3DES_CBC;
514 a->iv_size = a->block_align = 8;
516 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_128;
517 a->enc_op_id = VNET_CRYPTO_OP_AES_128_CBC_ENC;
518 a->dec_op_id = VNET_CRYPTO_OP_AES_128_CBC_DEC;
519 a->alg = VNET_CRYPTO_ALG_AES_128_CBC;
520 a->iv_size = a->block_align = 16;
522 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_192;
523 a->enc_op_id = VNET_CRYPTO_OP_AES_192_CBC_ENC;
524 a->dec_op_id = VNET_CRYPTO_OP_AES_192_CBC_DEC;
525 a->alg = VNET_CRYPTO_ALG_AES_192_CBC;
526 a->iv_size = a->block_align = 16;
528 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_256;
529 a->enc_op_id = VNET_CRYPTO_OP_AES_256_CBC_ENC;
530 a->dec_op_id = VNET_CRYPTO_OP_AES_256_CBC_DEC;
531 a->alg = VNET_CRYPTO_ALG_AES_256_CBC;
532 a->iv_size = a->block_align = 16;
534 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CTR_128;
535 a->enc_op_id = VNET_CRYPTO_OP_AES_128_CTR_ENC;
536 a->dec_op_id = VNET_CRYPTO_OP_AES_128_CTR_DEC;
537 a->alg = VNET_CRYPTO_ALG_AES_128_CTR;
541 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CTR_192;
542 a->enc_op_id = VNET_CRYPTO_OP_AES_192_CTR_ENC;
543 a->dec_op_id = VNET_CRYPTO_OP_AES_192_CTR_DEC;
544 a->alg = VNET_CRYPTO_ALG_AES_192_CTR;
548 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CTR_256;
549 a->enc_op_id = VNET_CRYPTO_OP_AES_256_CTR_ENC;
550 a->dec_op_id = VNET_CRYPTO_OP_AES_256_CTR_DEC;
551 a->alg = VNET_CRYPTO_ALG_AES_256_CTR;
555 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_128;
556 a->enc_op_id = VNET_CRYPTO_OP_AES_128_GCM_ENC;
557 a->dec_op_id = VNET_CRYPTO_OP_AES_128_GCM_DEC;
558 a->alg = VNET_CRYPTO_ALG_AES_128_GCM;
563 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_192;
564 a->enc_op_id = VNET_CRYPTO_OP_AES_192_GCM_ENC;
565 a->dec_op_id = VNET_CRYPTO_OP_AES_192_GCM_DEC;
566 a->alg = VNET_CRYPTO_ALG_AES_192_GCM;
571 a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_256;
572 a->enc_op_id = VNET_CRYPTO_OP_AES_256_GCM_ENC;
573 a->dec_op_id = VNET_CRYPTO_OP_AES_256_GCM_DEC;
574 a->alg = VNET_CRYPTO_ALG_AES_256_GCM;
579 a = im->crypto_algs + IPSEC_CRYPTO_ALG_CHACHA20_POLY1305;
580 a->enc_op_id = VNET_CRYPTO_OP_CHACHA20_POLY1305_ENC;
581 a->dec_op_id = VNET_CRYPTO_OP_CHACHA20_POLY1305_DEC;
582 a->alg = VNET_CRYPTO_ALG_CHACHA20_POLY1305;
586 vec_validate (im->integ_algs, IPSEC_INTEG_N_ALG - 1);
587 ipsec_main_integ_alg_t *i;
589 i = &im->integ_algs[IPSEC_INTEG_ALG_MD5_96];
590 i->op_id = VNET_CRYPTO_OP_MD5_HMAC;
591 i->alg = VNET_CRYPTO_ALG_HMAC_MD5;
594 i = &im->integ_algs[IPSEC_INTEG_ALG_SHA1_96];
595 i->op_id = VNET_CRYPTO_OP_SHA1_HMAC;
596 i->alg = VNET_CRYPTO_ALG_HMAC_SHA1;
599 i = &im->integ_algs[IPSEC_INTEG_ALG_SHA_256_96];
600 i->op_id = VNET_CRYPTO_OP_SHA1_HMAC;
601 i->alg = VNET_CRYPTO_ALG_HMAC_SHA256;
604 i = &im->integ_algs[IPSEC_INTEG_ALG_SHA_256_128];
605 i->op_id = VNET_CRYPTO_OP_SHA256_HMAC;
606 i->alg = VNET_CRYPTO_ALG_HMAC_SHA256;
609 i = &im->integ_algs[IPSEC_INTEG_ALG_SHA_384_192];
610 i->op_id = VNET_CRYPTO_OP_SHA384_HMAC;
611 i->alg = VNET_CRYPTO_ALG_HMAC_SHA384;
614 i = &im->integ_algs[IPSEC_INTEG_ALG_SHA_512_256];
615 i->op_id = VNET_CRYPTO_OP_SHA512_HMAC;
616 i->alg = VNET_CRYPTO_ALG_HMAC_SHA512;
619 vec_validate_aligned (im->ptd, vlib_num_workers (), CLIB_CACHE_LINE_BYTES);
622 crypto_engine_backend_register_post_node (vm);
624 im->ipsec4_out_spd_hash_tbl = NULL;
625 im->output_flow_cache_flag = 0;
626 im->ipsec4_out_spd_flow_cache_entries = 0;
628 im->ipsec4_out_spd_hash_num_buckets =
629 IPSEC4_OUT_SPD_DEFAULT_HASH_NUM_BUCKETS;
631 im->ipsec4_in_spd_hash_tbl = NULL;
632 im->input_flow_cache_flag = 0;
633 im->ipsec4_in_spd_flow_cache_entries = 0;
634 im->input_epoch_count = 0;
635 im->ipsec4_in_spd_hash_num_buckets = IPSEC4_SPD_DEFAULT_HASH_NUM_BUCKETS;
637 vec_validate_init_empty_aligned (im->next_header_registrations, 255, ~0,
638 CLIB_CACHE_LINE_BYTES);
640 im->fp_spd_ipv4_out_is_enabled = 0;
641 im->fp_spd_ipv6_out_is_enabled = 0;
642 im->fp_spd_ipv4_in_is_enabled = 0;
643 im->fp_spd_ipv6_in_is_enabled = 0;
645 im->fp_lookup_hash_buckets = IPSEC_FP_HASH_LOOKUP_HASH_BUCKETS;
650 VLIB_INIT_FUNCTION (ipsec_init);
652 static clib_error_t *
653 ipsec_config (vlib_main_t *vm, unformat_input_t *input)
655 ipsec_main_t *im = &ipsec_main;
656 unformat_input_t sub_input;
658 u32 ipsec4_out_spd_hash_num_buckets;
659 u32 ipsec4_in_spd_hash_num_buckets;
660 u32 ipsec_spd_fp_num_buckets;
661 bool fp_spd_ip4_enabled = false;
662 bool fp_spd_ip6_enabled = false;
664 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
666 if (unformat (input, "ipv6-outbound-spd-fast-path on"))
668 im->fp_spd_ipv6_out_is_enabled = 1;
669 fp_spd_ip6_enabled = true;
671 else if (unformat (input, "ipv6-outbound-spd-fast-path off"))
672 im->fp_spd_ipv6_out_is_enabled = 0;
673 else if (unformat (input, "ipv4-outbound-spd-fast-path on"))
675 im->fp_spd_ipv4_out_is_enabled = 1;
676 im->output_flow_cache_flag = 0;
677 fp_spd_ip4_enabled = true;
679 else if (unformat (input, "ipv4-outbound-spd-fast-path off"))
680 im->fp_spd_ipv4_out_is_enabled = 0;
681 else if (unformat (input, "ipv6-inbound-spd-fast-path on"))
683 im->fp_spd_ipv6_in_is_enabled = 1;
684 fp_spd_ip6_enabled = true;
686 else if (unformat (input, "ipv6-inbound-spd-fast-path off"))
687 im->fp_spd_ipv6_in_is_enabled = 0;
688 else if (unformat (input, "ipv4-inbound-spd-fast-path on"))
690 im->fp_spd_ipv4_in_is_enabled = 1;
691 im->input_flow_cache_flag = 0;
692 fp_spd_ip4_enabled = true;
694 else if (unformat (input, "ipv4-inbound-spd-fast-path off"))
695 im->fp_spd_ipv4_in_is_enabled = 0;
696 else if (unformat (input, "spd-fast-path-num-buckets %d",
697 &ipsec_spd_fp_num_buckets))
699 /* Number of bihash buckets is power of 2 >= input */
700 im->fp_lookup_hash_buckets = 1ULL
701 << max_log2 (ipsec_spd_fp_num_buckets);
703 else if (unformat (input, "ipv4-outbound-spd-flow-cache on"))
704 im->output_flow_cache_flag = im->fp_spd_ipv4_out_is_enabled ? 0 : 1;
705 else if (unformat (input, "ipv4-outbound-spd-flow-cache off"))
706 im->output_flow_cache_flag = 0;
707 else if (unformat (input, "ipv4-outbound-spd-hash-buckets %d",
708 &ipsec4_out_spd_hash_num_buckets))
710 /* Size of hash is power of 2 >= number of buckets */
711 im->ipsec4_out_spd_hash_num_buckets =
712 1ULL << max_log2 (ipsec4_out_spd_hash_num_buckets);
714 else if (unformat (input, "ipv4-inbound-spd-flow-cache on"))
715 im->input_flow_cache_flag = im->fp_spd_ipv4_in_is_enabled ? 0 : 1;
716 else if (unformat (input, "ipv4-inbound-spd-flow-cache off"))
717 im->input_flow_cache_flag = 0;
718 else if (unformat (input, "ipv4-inbound-spd-hash-buckets %d",
719 &ipsec4_in_spd_hash_num_buckets))
721 im->ipsec4_in_spd_hash_num_buckets =
722 1ULL << max_log2 (ipsec4_in_spd_hash_num_buckets);
724 else if (unformat (input, "ip4 %U", unformat_vlib_cli_sub_input,
727 uword table_size = ~0;
730 while (unformat_check_input (&sub_input) != UNFORMAT_END_OF_INPUT)
732 if (unformat (&sub_input, "num-buckets %u", &n_buckets))
735 return clib_error_return (0, "unknown input `%U'",
736 format_unformat_error, &sub_input);
739 ipsec_tun_table_init (AF_IP4, table_size, n_buckets);
741 else if (unformat (input, "ip6 %U", unformat_vlib_cli_sub_input,
744 uword table_size = ~0;
747 while (unformat_check_input (&sub_input) != UNFORMAT_END_OF_INPUT)
749 if (unformat (&sub_input, "num-buckets %u", &n_buckets))
752 return clib_error_return (0, "unknown input `%U'",
753 format_unformat_error, &sub_input);
756 ipsec_tun_table_init (AF_IP6, table_size, n_buckets);
759 return clib_error_return (0, "unknown input `%U'",
760 format_unformat_error, input);
762 if (im->output_flow_cache_flag)
764 vec_add2 (im->ipsec4_out_spd_hash_tbl, im->ipsec4_out_spd_hash_tbl,
765 im->ipsec4_out_spd_hash_num_buckets);
767 if (im->input_flow_cache_flag)
769 vec_add2 (im->ipsec4_in_spd_hash_tbl, im->ipsec4_in_spd_hash_tbl,
770 im->ipsec4_in_spd_hash_num_buckets);
773 if (fp_spd_ip4_enabled)
774 pool_alloc_aligned (im->fp_ip4_lookup_hashes_pool,
775 IPSEC_FP_IP4_HASHES_POOL_SIZE, CLIB_CACHE_LINE_BYTES);
777 if (fp_spd_ip6_enabled)
778 pool_alloc_aligned (im->fp_ip6_lookup_hashes_pool,
779 IPSEC_FP_IP6_HASHES_POOL_SIZE, CLIB_CACHE_LINE_BYTES);
784 VLIB_CONFIG_FUNCTION (ipsec_config, "ipsec");
787 * fd.io coding-style-patch-verification: ON
790 * eval: (c-set-style "gnu")