X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_sa.h;h=7827ef18084a8a78e428a0b6c0e2e71151bdb61e;hb=f16e9a550;hp=7a52e831c77b508474bb90e36afa22570f9fd49c;hpb=751bb131ef504b64fe82f393df21dba95ca92e97;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h
index 7a52e831c77..7827ef18084 100644
--- a/src/vnet/ipsec/ipsec_sa.h
+++ b/src/vnet/ipsec/ipsec_sa.h
@@ -101,7 +101,8 @@ typedef struct ipsec_key_t_
   _ (32, IS_PROTECT, "Protect")                                               \
   _ (64, IS_INBOUND, "inbound")                                               \
   _ (128, IS_AEAD, "aead")                                                    \
-  _ (256, IS_CTR, "ctr")
+  _ (256, IS_CTR, "ctr")                                                      \
+  _ (512, IS_ASYNC, "async")
 
 typedef enum ipsec_sad_flags_t_
 {
@@ -174,8 +175,7 @@ typedef struct
 
   ipsec_protocol_t protocol;
   tunnel_encap_decap_flags_t tunnel_flags;
-  ip_dscp_t dscp;
-  u8 __pad2[1];
+  u8 __pad[2];
 
   /* data accessed by dataplane code should be above this comment */
     CLIB_CACHE_LINE_ALIGN_MARK (cacheline2);
@@ -203,8 +203,7 @@ typedef struct
     u64 data;
   } async_op_data;
 
-  ip46_address_t tunnel_src_addr;
-  ip46_address_t tunnel_dst_addr;
+  tunnel_t tunnel;
 
   fib_node_t node;
 
@@ -214,10 +213,6 @@ typedef struct
   vnet_crypto_alg_t integ_calg;
   vnet_crypto_alg_t crypto_calg;
 
-  fib_node_index_t fib_entry_index;
-  u32 sibling;
-  u32 tx_fib_index;
-
   /* else u8 packed */
   ipsec_crypto_alg_t crypto_alg;
   ipsec_integ_alg_t integ_alg;
@@ -229,6 +224,19 @@ typedef struct
 STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline1, CLIB_CACHE_LINE_BYTES);
 STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline2, 2 * CLIB_CACHE_LINE_BYTES);
 
+/**
+ * Pool of IPSec SAs
+ */
+extern ipsec_sa_t *ipsec_sa_pool;
+
+/*
+ * Ensure that the IPsec data does not overlap with the IP data in
+ * the buffer meta data
+ */
+STATIC_ASSERT (STRUCT_OFFSET_OF (vnet_buffer_opaque_t, ipsec.sad_index) ==
+		 STRUCT_OFFSET_OF (vnet_buffer_opaque_t, ip.save_protocol),
+	       "IPSec data is overlapping with IP data");
+
 #define _(a,v,s)                                                        \
   always_inline int                                                     \
   ipsec_sa_is_set_##v (const ipsec_sa_t *sa) {                          \
@@ -258,21 +266,12 @@ extern vlib_combined_counter_main_t ipsec_sa_counters;
 
 extern void ipsec_mk_key (ipsec_key_t * key, const u8 * data, u8 len);
 
-extern int ipsec_sa_add_and_lock (u32 id,
-				  u32 spi,
-				  ipsec_protocol_t proto,
-				  ipsec_crypto_alg_t crypto_alg,
-				  const ipsec_key_t * ck,
-				  ipsec_integ_alg_t integ_alg,
-				  const ipsec_key_t * ik,
-				  ipsec_sa_flags_t flags,
-				  u32 tx_table_id,
-				  u32 salt,
-				  const ip46_address_t * tunnel_src_addr,
-				  const ip46_address_t * tunnel_dst_addr,
-				  tunnel_encap_decap_flags_t tunnel_flags,
-				  ip_dscp_t dscp,
-				  u32 * sa_index, u16 src_port, u16 dst_port);
+extern int
+ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto,
+		       ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck,
+		       ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik,
+		       ipsec_sa_flags_t flags, u32 salt, u16 src_port,
+		       u16 dst_port, const tunnel_t *tun, u32 *sa_out_index);
 extern index_t ipsec_sa_find_and_lock (u32 id);
 extern int ipsec_sa_unlock_id (u32 id);
 extern void ipsec_sa_unlock (index_t sai);
@@ -286,6 +285,7 @@ extern void ipsec_sa_set_integ_alg (ipsec_sa_t * sa,
 typedef walk_rc_t (*ipsec_sa_walk_cb_t) (ipsec_sa_t * sa, void *ctx);
 extern void ipsec_sa_walk (ipsec_sa_walk_cb_t cd, void *ctx);
 
+extern u8 *format_ipsec_replay_window (u8 *s, va_list *args);
 extern u8 *format_ipsec_crypto_alg (u8 * s, va_list * args);
 extern u8 *format_ipsec_integ_alg (u8 * s, va_list * args);
 extern u8 *format_ipsec_sa (u8 * s, va_list * args);
@@ -515,6 +515,12 @@ ipsec_sa_assign_thread (u32 thread_id)
 	  : (unix_time_now_nsec () % vlib_num_workers ()) + 1);
 }
 
+always_inline ipsec_sa_t *
+ipsec_sa_get (u32 sa_index)
+{
+  return (pool_elt_at_index (ipsec_sa_pool, sa_index));
+}
+
 #endif /* __IPSEC_SPD_SA_H__ */
 
 /*