2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
15 #ifndef __IPSEC_SPD_POLICY_H__
16 #define __IPSEC_SPD_POLICY_H__
18 #include <vppinfra/bihash_40_8.h>
19 #include <vppinfra/bihash_16_8.h>
20 #include <vnet/ipsec/ipsec_spd.h>
22 * calculated as max number of flows (2^10) divided by KVP_PER_PAGE (4)
24 #define IPSEC_FP_HASH_LOOKUP_HASH_BUCKETS (1 << 8)
26 #define IPSEC_POLICY_PROTOCOL_ANY IP_PROTOCOL_RESERVED
29 * This number is calculated as ceil power of 2 for the number
30 * sizeof(clib_bihash_kv_16_8_t)=24 * BIHASH_KVP_PER_PAGE=4 * COLLISIONS_NO=8
34 #define IPSEC_FP_IP4_HASH_MEM_PER_BUCKET 1024
37 * This number is calculated as ceil power of 2 for the number
38 * sizeof(clib_bihash_kv_40_8_t)=48 * BIHASH_KVP_PER_PAGE=4 * COLLISIONS_NO=8
41 #define IPSEC_FP_IP6_HASH_MEM_PER_BUCKET 2048
43 #define foreach_ipsec_policy_action \
44 _ (0, BYPASS, "bypass") \
45 _ (1, DISCARD, "discard") \
46 _ (2, RESOLVE, "resolve") \
47 _ (3, PROTECT, "protect")
51 #define _(v, f, s) IPSEC_POLICY_ACTION_##f = v,
52 foreach_ipsec_policy_action
54 } ipsec_policy_action_t;
56 #define IPSEC_POLICY_N_ACTION (IPSEC_POLICY_ACTION_PROTECT + 1)
60 ip46_address_t start, stop;
61 } ip46_address_range_t;
70 * Policy packet & bytes counters
72 extern vlib_combined_counter_main_t ipsec_spd_policy_counters;
75 * @brief A Secruity Policy. An entry in an SPD
77 typedef struct ipsec_policy_t_
83 ipsec_spd_policy_type_t type;
87 ip46_address_range_t laddr;
88 ip46_address_range_t raddr;
94 ipsec_policy_action_t policy;
101 * @brief Add/Delete a SPD
103 extern int ipsec_add_del_policy (vlib_main_t * vm,
104 ipsec_policy_t * policy,
105 int is_add, u32 * stat_index);
107 extern u8 *format_ipsec_policy (u8 * s, va_list * args);
108 extern u8 *format_ipsec_policy_action (u8 * s, va_list * args);
109 extern uword unformat_ipsec_policy_action (unformat_input_t * input,
113 extern int ipsec_policy_mk_type (bool is_outbound,
115 ipsec_policy_action_t action,
116 ipsec_spd_policy_type_t * type);
118 /* A 5-tuple used to calculate the bihash entry */
131 ip6_address_t ip6_laddr;
132 ip6_address_t ip6_raddr;
141 clib_bihash_kv_40_8_t kv_40_8;
145 u64 padding_for_kv_16_8[3];
146 clib_bihash_kv_16_8_t kv_16_8;
151 * An element describing a particular policy mask,
152 * and refcount of policies with same mask.
156 /** Required for pool_get_aligned */
157 CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
158 ipsec_fp_5tuple_t mask;
159 u32 refcount; /* counts how many policies use this mask */
160 } ipsec_fp_mask_type_entry_t;
163 * Bihash lookup value,
164 * contains an unordered vector of policies indices in policy pool.
171 u32 *fp_policies_ids;
173 } ipsec_fp_lookup_value_t;
176 * @brief add or delete a fast path policy
178 int ipsec_fp_add_del_policy (void *fp_spd, ipsec_policy_t *policy, int is_add,
181 static_always_inline int
182 ipsec_policy_is_equal (ipsec_policy_t *p1, ipsec_policy_t *p2)
184 if (p1->priority != p2->priority)
186 if (p1->type != p2->type)
188 if (p1->policy != p2->policy)
190 if (p1->sa_id != p2->sa_id)
192 if (p1->protocol != p2->protocol)
194 if (p1->lport.start != p2->lport.start)
196 if (p1->lport.stop != p2->lport.stop)
198 if (p1->rport.start != p2->rport.start)
200 if (p1->rport.stop != p2->rport.stop)
202 if (p1->is_ipv6 != p2->is_ipv6)
206 if (p1->laddr.start.ip6.as_u64[0] != p2->laddr.start.ip6.as_u64[0])
208 if (p1->laddr.start.ip6.as_u64[1] != p2->laddr.start.ip6.as_u64[1])
210 if (p1->laddr.stop.ip6.as_u64[0] != p2->laddr.stop.ip6.as_u64[0])
212 if (p1->laddr.stop.ip6.as_u64[1] != p2->laddr.stop.ip6.as_u64[1])
214 if (p1->raddr.start.ip6.as_u64[0] != p2->raddr.start.ip6.as_u64[0])
216 if (p1->raddr.start.ip6.as_u64[1] != p2->raddr.start.ip6.as_u64[1])
218 if (p1->raddr.stop.ip6.as_u64[0] != p2->raddr.stop.ip6.as_u64[0])
220 if (p1->laddr.stop.ip6.as_u64[1] != p2->laddr.stop.ip6.as_u64[1])
225 if (p1->laddr.start.ip4.as_u32 != p2->laddr.start.ip4.as_u32)
227 if (p1->laddr.stop.ip4.as_u32 != p2->laddr.stop.ip4.as_u32)
229 if (p1->raddr.start.ip4.as_u32 != p2->raddr.start.ip4.as_u32)
231 if (p1->raddr.stop.ip4.as_u32 != p2->raddr.stop.ip4.as_u32)
237 #endif /* __IPSEC_SPD_POLICY_H__ */
240 * fd.io coding-style-patch-verification: ON
243 * eval: (c-set-style "gnu")