2 * esp_encrypt.c : IPSec ESP encrypt node
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/ipsec/ipsec.h>
19 #include <vnet/ipsec/ipsec_sa.h>
21 #define foreach_ipsec_handoff_error \
22 _(CONGESTION_DROP, "congestion drop")
26 #define _(sym,str) IPSEC_HANDOFF_ERROR_##sym,
27 foreach_ipsec_handoff_error
29 NAT44_HANDOFF_N_ERROR,
30 } ipsec_handoff_error_t;
32 static char *ipsec_handoff_error_strings[] = {
33 #define _(sym,string) string,
34 foreach_ipsec_handoff_error
38 typedef struct ipsec_handoff_trace_t_
40 u32 next_worker_index;
41 } ipsec_handoff_trace_t;
44 format_ipsec_handoff_trace (u8 * s, va_list * args)
46 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
47 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
48 ipsec_handoff_trace_t *t = va_arg (*args, ipsec_handoff_trace_t *);
50 s = format (s, "next-worker %d", t->next_worker_index);
55 /* do worker handoff based on thread_index in NAT HA protcol header */
56 static_always_inline uword
57 ipsec_handoff (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame,
60 vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
61 u16 thread_indices[VLIB_FRAME_SIZE], *ti;
62 u32 n_enq, n_left_from, *from;
64 from = vlib_frame_vector_args (frame);
65 n_left_from = frame->n_vectors;
66 vlib_get_buffers (vm, from, bufs, n_left_from);
71 while (n_left_from >= 4)
73 /* Prefetch next iteration. */
74 if (n_left_from >= 12)
76 vlib_prefetch_buffer_header (b[8], LOAD);
77 vlib_prefetch_buffer_header (b[9], LOAD);
78 vlib_prefetch_buffer_header (b[10], LOAD);
79 vlib_prefetch_buffer_header (b[11], LOAD);
82 ti[0] = vnet_buffer (b[0])->ipsec.thread_index;
83 ti[1] = vnet_buffer (b[1])->ipsec.thread_index;
84 ti[2] = vnet_buffer (b[2])->ipsec.thread_index;
85 ti[3] = vnet_buffer (b[3])->ipsec.thread_index;
87 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
89 if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
91 ipsec_handoff_trace_t *t =
92 vlib_add_trace (vm, node, b[0], sizeof (*t));
93 t->next_worker_index = ti[0];
95 if (PREDICT_FALSE (b[1]->flags & VLIB_BUFFER_IS_TRACED))
97 ipsec_handoff_trace_t *t =
98 vlib_add_trace (vm, node, b[1], sizeof (*t));
99 t->next_worker_index = ti[1];
101 if (PREDICT_FALSE (b[2]->flags & VLIB_BUFFER_IS_TRACED))
103 ipsec_handoff_trace_t *t =
104 vlib_add_trace (vm, node, b[2], sizeof (*t));
105 t->next_worker_index = ti[2];
107 if (PREDICT_FALSE (b[3]->flags & VLIB_BUFFER_IS_TRACED))
109 ipsec_handoff_trace_t *t =
110 vlib_add_trace (vm, node, b[3], sizeof (*t));
111 t->next_worker_index = ti[3];
119 while (n_left_from > 0)
121 ti[0] = vnet_buffer (b[0])->ipsec.thread_index;
123 if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
125 ipsec_handoff_trace_t *t =
126 vlib_add_trace (vm, node, b[0], sizeof (*t));
127 t->next_worker_index = ti[0];
135 n_enq = vlib_buffer_enqueue_to_thread (vm, fq_index, from,
136 thread_indices, frame->n_vectors, 1);
138 if (n_enq < frame->n_vectors)
139 vlib_node_increment_counter (vm, node->node_index,
140 IPSEC_HANDOFF_ERROR_CONGESTION_DROP,
141 frame->n_vectors - n_enq);
146 VLIB_NODE_FN (esp4_encrypt_handoff) (vlib_main_t * vm,
147 vlib_node_runtime_t * node,
148 vlib_frame_t * from_frame)
150 ipsec_main_t *im = &ipsec_main;
152 return ipsec_handoff (vm, node, from_frame, im->esp4_enc_fq_index);
155 VLIB_NODE_FN (esp6_encrypt_handoff) (vlib_main_t * vm,
156 vlib_node_runtime_t * node,
157 vlib_frame_t * from_frame)
159 ipsec_main_t *im = &ipsec_main;
161 return ipsec_handoff (vm, node, from_frame, im->esp6_enc_fq_index);
164 VLIB_NODE_FN (esp4_encrypt_tun_handoff) (vlib_main_t * vm,
165 vlib_node_runtime_t * node,
166 vlib_frame_t * from_frame)
168 ipsec_main_t *im = &ipsec_main;
170 return ipsec_handoff (vm, node, from_frame, im->esp4_enc_tun_fq_index);
173 VLIB_NODE_FN (esp6_encrypt_tun_handoff) (vlib_main_t * vm,
174 vlib_node_runtime_t * node,
175 vlib_frame_t * from_frame)
177 ipsec_main_t *im = &ipsec_main;
179 return ipsec_handoff (vm, node, from_frame, im->esp6_enc_tun_fq_index);
182 VLIB_NODE_FN (esp_mpls_encrypt_tun_handoff)
183 (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
185 ipsec_main_t *im = &ipsec_main;
187 return ipsec_handoff (vm, node, from_frame, im->esp_mpls_enc_tun_fq_index);
190 VLIB_NODE_FN (esp4_decrypt_handoff) (vlib_main_t * vm,
191 vlib_node_runtime_t * node,
192 vlib_frame_t * from_frame)
194 ipsec_main_t *im = &ipsec_main;
196 return ipsec_handoff (vm, node, from_frame, im->esp4_dec_fq_index);
199 VLIB_NODE_FN (esp6_decrypt_handoff) (vlib_main_t * vm,
200 vlib_node_runtime_t * node,
201 vlib_frame_t * from_frame)
203 ipsec_main_t *im = &ipsec_main;
205 return ipsec_handoff (vm, node, from_frame, im->esp6_dec_fq_index);
208 VLIB_NODE_FN (esp4_decrypt_tun_handoff) (vlib_main_t * vm,
209 vlib_node_runtime_t * node,
210 vlib_frame_t * from_frame)
212 ipsec_main_t *im = &ipsec_main;
214 return ipsec_handoff (vm, node, from_frame, im->esp4_dec_tun_fq_index);
217 VLIB_NODE_FN (esp6_decrypt_tun_handoff) (vlib_main_t * vm,
218 vlib_node_runtime_t * node,
219 vlib_frame_t * from_frame)
221 ipsec_main_t *im = &ipsec_main;
223 return ipsec_handoff (vm, node, from_frame, im->esp6_dec_tun_fq_index);
226 VLIB_NODE_FN (ah4_encrypt_handoff) (vlib_main_t * vm,
227 vlib_node_runtime_t * node,
228 vlib_frame_t * from_frame)
230 ipsec_main_t *im = &ipsec_main;
232 return ipsec_handoff (vm, node, from_frame, im->ah4_enc_fq_index);
235 VLIB_NODE_FN (ah6_encrypt_handoff) (vlib_main_t * vm,
236 vlib_node_runtime_t * node,
237 vlib_frame_t * from_frame)
239 ipsec_main_t *im = &ipsec_main;
241 return ipsec_handoff (vm, node, from_frame, im->ah6_enc_fq_index);
244 VLIB_NODE_FN (ah4_decrypt_handoff) (vlib_main_t * vm,
245 vlib_node_runtime_t * node,
246 vlib_frame_t * from_frame)
248 ipsec_main_t *im = &ipsec_main;
250 return ipsec_handoff (vm, node, from_frame, im->ah4_dec_fq_index);
253 VLIB_NODE_FN (ah6_decrypt_handoff) (vlib_main_t * vm,
254 vlib_node_runtime_t * node,
255 vlib_frame_t * from_frame)
257 ipsec_main_t *im = &ipsec_main;
259 return ipsec_handoff (vm, node, from_frame, im->ah6_dec_fq_index);
263 VLIB_REGISTER_NODE (esp4_encrypt_handoff) = {
264 .name = "esp4-encrypt-handoff",
265 .vector_size = sizeof (u32),
266 .format_trace = format_ipsec_handoff_trace,
267 .type = VLIB_NODE_TYPE_INTERNAL,
268 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
269 .error_strings = ipsec_handoff_error_strings,
275 VLIB_REGISTER_NODE (esp6_encrypt_handoff) = {
276 .name = "esp6-encrypt-handoff",
277 .vector_size = sizeof (u32),
278 .format_trace = format_ipsec_handoff_trace,
279 .type = VLIB_NODE_TYPE_INTERNAL,
280 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
281 .error_strings = ipsec_handoff_error_strings,
287 VLIB_REGISTER_NODE (esp4_encrypt_tun_handoff) = {
288 .name = "esp4-encrypt-tun-handoff",
289 .vector_size = sizeof (u32),
290 .format_trace = format_ipsec_handoff_trace,
291 .type = VLIB_NODE_TYPE_INTERNAL,
292 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
293 .error_strings = ipsec_handoff_error_strings,
299 VLIB_REGISTER_NODE (esp6_encrypt_tun_handoff) = {
300 .name = "esp6-encrypt-tun-handoff",
301 .vector_size = sizeof (u32),
302 .format_trace = format_ipsec_handoff_trace,
303 .type = VLIB_NODE_TYPE_INTERNAL,
304 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
305 .error_strings = ipsec_handoff_error_strings,
311 VLIB_REGISTER_NODE (esp_mpls_encrypt_tun_handoff) = {
312 .name = "esp-mpls-encrypt-tun-handoff",
313 .vector_size = sizeof (u32),
314 .format_trace = format_ipsec_handoff_trace,
315 .type = VLIB_NODE_TYPE_INTERNAL,
316 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
317 .error_strings = ipsec_handoff_error_strings,
323 VLIB_REGISTER_NODE (esp4_decrypt_handoff) = {
324 .name = "esp4-decrypt-handoff",
325 .vector_size = sizeof (u32),
326 .format_trace = format_ipsec_handoff_trace,
327 .type = VLIB_NODE_TYPE_INTERNAL,
328 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
329 .error_strings = ipsec_handoff_error_strings,
335 VLIB_REGISTER_NODE (esp6_decrypt_handoff) = {
336 .name = "esp6-decrypt-handoff",
337 .vector_size = sizeof (u32),
338 .format_trace = format_ipsec_handoff_trace,
339 .type = VLIB_NODE_TYPE_INTERNAL,
340 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
341 .error_strings = ipsec_handoff_error_strings,
347 VLIB_REGISTER_NODE (esp4_decrypt_tun_handoff) = {
348 .name = "esp4-decrypt-tun-handoff",
349 .vector_size = sizeof (u32),
350 .format_trace = format_ipsec_handoff_trace,
351 .type = VLIB_NODE_TYPE_INTERNAL,
352 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
353 .error_strings = ipsec_handoff_error_strings,
359 VLIB_REGISTER_NODE (esp6_decrypt_tun_handoff) = {
360 .name = "esp6-decrypt-tun-handoff",
361 .vector_size = sizeof (u32),
362 .format_trace = format_ipsec_handoff_trace,
363 .type = VLIB_NODE_TYPE_INTERNAL,
364 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
365 .error_strings = ipsec_handoff_error_strings,
371 VLIB_REGISTER_NODE (ah4_encrypt_handoff) = {
372 .name = "ah4-encrypt-handoff",
373 .vector_size = sizeof (u32),
374 .format_trace = format_ipsec_handoff_trace,
375 .type = VLIB_NODE_TYPE_INTERNAL,
376 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
377 .error_strings = ipsec_handoff_error_strings,
383 VLIB_REGISTER_NODE (ah6_encrypt_handoff) = {
384 .name = "ah6-encrypt-handoff",
385 .vector_size = sizeof (u32),
386 .format_trace = format_ipsec_handoff_trace,
387 .type = VLIB_NODE_TYPE_INTERNAL,
388 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
389 .error_strings = ipsec_handoff_error_strings,
395 VLIB_REGISTER_NODE (ah4_decrypt_handoff) = {
396 .name = "ah4-decrypt-handoff",
397 .vector_size = sizeof (u32),
398 .format_trace = format_ipsec_handoff_trace,
399 .type = VLIB_NODE_TYPE_INTERNAL,
400 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
401 .error_strings = ipsec_handoff_error_strings,
407 VLIB_REGISTER_NODE (ah6_decrypt_handoff) = {
408 .name = "ah6-decrypt-handoff",
409 .vector_size = sizeof (u32),
410 .format_trace = format_ipsec_handoff_trace,
411 .type = VLIB_NODE_TYPE_INTERNAL,
412 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
413 .error_strings = ipsec_handoff_error_strings,
422 * fd.io coding-style-patch-verification: ON
425 * eval: (c-set-style "gnu")