2 * esp_encrypt.c : IPSec ESP encrypt node
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/ipsec/ipsec.h>
19 #include <vnet/ipsec/ipsec_sa.h>
21 #define foreach_ipsec_handoff_error \
22 _(CONGESTION_DROP, "congestion drop")
26 #define _(sym,str) IPSEC_HANDOFF_ERROR_##sym,
27 foreach_ipsec_handoff_error
29 NAT44_HANDOFF_N_ERROR,
30 } ipsec_handoff_error_t;
32 static char *ipsec_handoff_error_strings[] = {
33 #define _(sym,string) string,
34 foreach_ipsec_handoff_error
38 typedef struct ipsec_handoff_trace_t_
40 u32 next_worker_index;
41 } ipsec_handoff_trace_t;
44 format_ipsec_handoff_trace (u8 * s, va_list * args)
46 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
47 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
48 ipsec_handoff_trace_t *t = va_arg (*args, ipsec_handoff_trace_t *);
50 s = format (s, "next-worker %d", t->next_worker_index);
55 /* do worker handoff based on thread_index in NAT HA protcol header */
56 static_always_inline uword
57 ipsec_handoff (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame,
60 vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
61 u16 thread_indices[VLIB_FRAME_SIZE], *ti;
62 u32 n_enq, n_left_from, *from;
64 from = vlib_frame_vector_args (frame);
65 n_left_from = frame->n_vectors;
66 vlib_get_buffers (vm, from, bufs, n_left_from);
71 while (n_left_from >= 4)
73 /* Prefetch next iteration. */
74 if (n_left_from >= 12)
76 vlib_prefetch_buffer_header (b[8], LOAD);
77 vlib_prefetch_buffer_header (b[9], LOAD);
78 vlib_prefetch_buffer_header (b[10], LOAD);
79 vlib_prefetch_buffer_header (b[11], LOAD);
82 ti[0] = vnet_buffer (b[0])->ipsec.thread_index;
83 ti[1] = vnet_buffer (b[1])->ipsec.thread_index;
84 ti[2] = vnet_buffer (b[2])->ipsec.thread_index;
85 ti[3] = vnet_buffer (b[3])->ipsec.thread_index;
87 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE))
89 if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
91 ipsec_handoff_trace_t *t =
92 vlib_add_trace (vm, node, b[0], sizeof (*t));
93 t->next_worker_index = ti[0];
95 if (PREDICT_FALSE (b[1]->flags & VLIB_BUFFER_IS_TRACED))
97 ipsec_handoff_trace_t *t =
98 vlib_add_trace (vm, node, b[1], sizeof (*t));
99 t->next_worker_index = ti[1];
101 if (PREDICT_FALSE (b[2]->flags & VLIB_BUFFER_IS_TRACED))
103 ipsec_handoff_trace_t *t =
104 vlib_add_trace (vm, node, b[2], sizeof (*t));
105 t->next_worker_index = ti[2];
107 if (PREDICT_FALSE (b[3]->flags & VLIB_BUFFER_IS_TRACED))
109 ipsec_handoff_trace_t *t =
110 vlib_add_trace (vm, node, b[3], sizeof (*t));
111 t->next_worker_index = ti[3];
119 while (n_left_from > 0)
121 ti[0] = vnet_buffer (b[0])->ipsec.thread_index;
123 if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
125 ipsec_handoff_trace_t *t =
126 vlib_add_trace (vm, node, b[0], sizeof (*t));
127 t->next_worker_index = ti[0];
135 n_enq = vlib_buffer_enqueue_to_thread (vm, node, fq_index, from,
136 thread_indices, frame->n_vectors, 1);
138 if (n_enq < frame->n_vectors)
139 vlib_node_increment_counter (vm, node->node_index,
140 IPSEC_HANDOFF_ERROR_CONGESTION_DROP,
141 frame->n_vectors - n_enq);
146 VLIB_NODE_FN (esp4_encrypt_handoff) (vlib_main_t * vm,
147 vlib_node_runtime_t * node,
148 vlib_frame_t * from_frame)
150 ipsec_main_t *im = &ipsec_main;
152 return ipsec_handoff (vm, node, from_frame, im->esp4_enc_fq_index);
155 VLIB_NODE_FN (esp6_encrypt_handoff) (vlib_main_t * vm,
156 vlib_node_runtime_t * node,
157 vlib_frame_t * from_frame)
159 ipsec_main_t *im = &ipsec_main;
161 return ipsec_handoff (vm, node, from_frame, im->esp6_enc_fq_index);
164 VLIB_NODE_FN (esp4_encrypt_tun_handoff) (vlib_main_t * vm,
165 vlib_node_runtime_t * node,
166 vlib_frame_t * from_frame)
168 ipsec_main_t *im = &ipsec_main;
170 return ipsec_handoff (vm, node, from_frame, im->esp4_enc_tun_fq_index);
173 VLIB_NODE_FN (esp6_encrypt_tun_handoff) (vlib_main_t * vm,
174 vlib_node_runtime_t * node,
175 vlib_frame_t * from_frame)
177 ipsec_main_t *im = &ipsec_main;
179 return ipsec_handoff (vm, node, from_frame, im->esp6_enc_tun_fq_index);
182 VLIB_NODE_FN (esp_mpls_encrypt_tun_handoff)
183 (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
185 ipsec_main_t *im = &ipsec_main;
187 return ipsec_handoff (vm, node, from_frame, im->esp_mpls_enc_tun_fq_index);
190 VLIB_NODE_FN (esp4_decrypt_handoff) (vlib_main_t * vm,
191 vlib_node_runtime_t * node,
192 vlib_frame_t * from_frame)
194 ipsec_main_t *im = &ipsec_main;
196 return ipsec_handoff (vm, node, from_frame, im->esp4_dec_fq_index);
199 VLIB_NODE_FN (esp6_decrypt_handoff) (vlib_main_t * vm,
200 vlib_node_runtime_t * node,
201 vlib_frame_t * from_frame)
203 ipsec_main_t *im = &ipsec_main;
205 return ipsec_handoff (vm, node, from_frame, im->esp6_dec_fq_index);
208 VLIB_NODE_FN (esp4_decrypt_tun_handoff) (vlib_main_t * vm,
209 vlib_node_runtime_t * node,
210 vlib_frame_t * from_frame)
212 ipsec_main_t *im = &ipsec_main;
214 return ipsec_handoff (vm, node, from_frame, im->esp4_dec_tun_fq_index);
217 VLIB_NODE_FN (esp6_decrypt_tun_handoff) (vlib_main_t * vm,
218 vlib_node_runtime_t * node,
219 vlib_frame_t * from_frame)
221 ipsec_main_t *im = &ipsec_main;
223 return ipsec_handoff (vm, node, from_frame, im->esp6_dec_tun_fq_index);
226 VLIB_NODE_FN (ah4_encrypt_handoff) (vlib_main_t * vm,
227 vlib_node_runtime_t * node,
228 vlib_frame_t * from_frame)
230 ipsec_main_t *im = &ipsec_main;
232 return ipsec_handoff (vm, node, from_frame, im->ah4_enc_fq_index);
235 VLIB_NODE_FN (ah6_encrypt_handoff) (vlib_main_t * vm,
236 vlib_node_runtime_t * node,
237 vlib_frame_t * from_frame)
239 ipsec_main_t *im = &ipsec_main;
241 return ipsec_handoff (vm, node, from_frame, im->ah6_enc_fq_index);
244 VLIB_NODE_FN (ah4_decrypt_handoff) (vlib_main_t * vm,
245 vlib_node_runtime_t * node,
246 vlib_frame_t * from_frame)
248 ipsec_main_t *im = &ipsec_main;
250 return ipsec_handoff (vm, node, from_frame, im->ah4_dec_fq_index);
253 VLIB_NODE_FN (ah6_decrypt_handoff) (vlib_main_t * vm,
254 vlib_node_runtime_t * node,
255 vlib_frame_t * from_frame)
257 ipsec_main_t *im = &ipsec_main;
259 return ipsec_handoff (vm, node, from_frame, im->ah6_dec_fq_index);
262 VLIB_REGISTER_NODE (esp4_encrypt_handoff) = {
263 .name = "esp4-encrypt-handoff",
264 .vector_size = sizeof (u32),
265 .format_trace = format_ipsec_handoff_trace,
266 .type = VLIB_NODE_TYPE_INTERNAL,
267 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
268 .error_strings = ipsec_handoff_error_strings,
274 VLIB_REGISTER_NODE (esp6_encrypt_handoff) = {
275 .name = "esp6-encrypt-handoff",
276 .vector_size = sizeof (u32),
277 .format_trace = format_ipsec_handoff_trace,
278 .type = VLIB_NODE_TYPE_INTERNAL,
279 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
280 .error_strings = ipsec_handoff_error_strings,
286 VLIB_REGISTER_NODE (esp4_encrypt_tun_handoff) = {
287 .name = "esp4-encrypt-tun-handoff",
288 .vector_size = sizeof (u32),
289 .format_trace = format_ipsec_handoff_trace,
290 .type = VLIB_NODE_TYPE_INTERNAL,
291 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
292 .error_strings = ipsec_handoff_error_strings,
298 VLIB_REGISTER_NODE (esp6_encrypt_tun_handoff) = {
299 .name = "esp6-encrypt-tun-handoff",
300 .vector_size = sizeof (u32),
301 .format_trace = format_ipsec_handoff_trace,
302 .type = VLIB_NODE_TYPE_INTERNAL,
303 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
304 .error_strings = ipsec_handoff_error_strings,
310 VLIB_REGISTER_NODE (esp_mpls_encrypt_tun_handoff) = {
311 .name = "esp-mpls-encrypt-tun-handoff",
312 .vector_size = sizeof (u32),
313 .format_trace = format_ipsec_handoff_trace,
314 .type = VLIB_NODE_TYPE_INTERNAL,
315 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
316 .error_strings = ipsec_handoff_error_strings,
322 VLIB_REGISTER_NODE (esp4_decrypt_handoff) = {
323 .name = "esp4-decrypt-handoff",
324 .vector_size = sizeof (u32),
325 .format_trace = format_ipsec_handoff_trace,
326 .type = VLIB_NODE_TYPE_INTERNAL,
327 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
328 .error_strings = ipsec_handoff_error_strings,
334 VLIB_REGISTER_NODE (esp6_decrypt_handoff) = {
335 .name = "esp6-decrypt-handoff",
336 .vector_size = sizeof (u32),
337 .format_trace = format_ipsec_handoff_trace,
338 .type = VLIB_NODE_TYPE_INTERNAL,
339 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
340 .error_strings = ipsec_handoff_error_strings,
346 VLIB_REGISTER_NODE (esp4_decrypt_tun_handoff) = {
347 .name = "esp4-decrypt-tun-handoff",
348 .vector_size = sizeof (u32),
349 .format_trace = format_ipsec_handoff_trace,
350 .type = VLIB_NODE_TYPE_INTERNAL,
351 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
352 .error_strings = ipsec_handoff_error_strings,
358 VLIB_REGISTER_NODE (esp6_decrypt_tun_handoff) = {
359 .name = "esp6-decrypt-tun-handoff",
360 .vector_size = sizeof (u32),
361 .format_trace = format_ipsec_handoff_trace,
362 .type = VLIB_NODE_TYPE_INTERNAL,
363 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
364 .error_strings = ipsec_handoff_error_strings,
370 VLIB_REGISTER_NODE (ah4_encrypt_handoff) = {
371 .name = "ah4-encrypt-handoff",
372 .vector_size = sizeof (u32),
373 .format_trace = format_ipsec_handoff_trace,
374 .type = VLIB_NODE_TYPE_INTERNAL,
375 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
376 .error_strings = ipsec_handoff_error_strings,
382 VLIB_REGISTER_NODE (ah6_encrypt_handoff) = {
383 .name = "ah6-encrypt-handoff",
384 .vector_size = sizeof (u32),
385 .format_trace = format_ipsec_handoff_trace,
386 .type = VLIB_NODE_TYPE_INTERNAL,
387 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
388 .error_strings = ipsec_handoff_error_strings,
394 VLIB_REGISTER_NODE (ah4_decrypt_handoff) = {
395 .name = "ah4-decrypt-handoff",
396 .vector_size = sizeof (u32),
397 .format_trace = format_ipsec_handoff_trace,
398 .type = VLIB_NODE_TYPE_INTERNAL,
399 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
400 .error_strings = ipsec_handoff_error_strings,
406 VLIB_REGISTER_NODE (ah6_decrypt_handoff) = {
407 .name = "ah6-decrypt-handoff",
408 .vector_size = sizeof (u32),
409 .format_trace = format_ipsec_handoff_trace,
410 .type = VLIB_NODE_TYPE_INTERNAL,
411 .n_errors = ARRAY_LEN(ipsec_handoff_error_strings),
412 .error_strings = ipsec_handoff_error_strings,
420 * fd.io coding-style-patch-verification: ON
423 * eval: (c-set-style "gnu")