src/vnet/ipsec/ipsec_tun.h

   1 /*
   2  * ipsec_tun.h : IPSEC tunnel protection
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/ipsec/ipsec.h>
  19
  20 /* *INDENT-OFF* */
  21 typedef CLIB_PACKED(struct {
  22   /*
  23    * Key fields: remote ip and spi on incoming packet
  24    * all fields in NET byte order
  25    */
  26   union {
  27     struct {
  28       ip4_address_t remote_ip;
  29       u32 spi;
  30     };
  31     u64 as_u64;
  32   };
  33 }) ipsec4_tunnel_key_t;
  34 /* *INDENT-ON* */
  35
  36 /* *INDENT-OFF* */
  37 typedef CLIB_PACKED(struct {
  38   /*
  39    * Key fields: remote ip and spi on incoming packet
  40    * all fields in NET byte order
  41    */
  42   ip6_address_t remote_ip;
  43   u32 spi;
  44 }) ipsec6_tunnel_key_t;
  45 /* *INDENT-ON* */
  46
  47 extern u8 *format_ipsec4_tunnel_key (u8 * s, va_list * args);
  48 extern u8 *format_ipsec6_tunnel_key (u8 * s, va_list * args);
  49
  50 typedef enum ipsec_protect_flags_t_
  51 {
  52   IPSEC_PROTECT_L2 = (1 << 0),
  53   IPSEC_PROTECT_ENCAPED = (1 << 1),
  54 } __clib_packed ipsec_protect_flags_t;
  55
  56 typedef struct ipsec_ep_t_
  57 {
  58   ip46_address_t src;
  59   ip46_address_t dst;
  60 } ipsec_ep_t;
  61
  62 typedef struct ipsec_tun_protect_t_
  63 {
  64   CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
  65   index_t itp_out_sa;
  66
  67   /* not using a vector since we want the memory inline
  68    * with this struct */
  69   u32 itp_n_sa_in;
  70   index_t itp_in_sas[4];
  71
  72   u32 itp_sw_if_index;
  73
  74   ipsec_ep_t itp_crypto;
  75
  76   ipsec_protect_flags_t itp_flags;
  77
  78   ipsec_ep_t itp_tun;
  79
  80 } ipsec_tun_protect_t;
  81
  82 #define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body) \
  83 {                                                          \
  84   u32 __ii;                                                \
  85   for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) {       \
  86     _sai = itp->itp_in_sas[__ii];                          \
  87     body;                                                  \
  88   }                                                        \
  89 }
  90 #define FOR_EACH_IPSEC_PROTECT_INPUT_SA(_itp, _sa, body)   \
  91 {                                                          \
  92   u32 __ii;                                                \
  93   for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) {       \
  94     _sa = ipsec_sa_get(itp->itp_in_sas[__ii]);             \
  95     body;                                                  \
  96   }                                                        \
  97 }
  98
  99 extern int ipsec_tun_protect_update_one (u32 sw_if_index, u32 sa_out,
 100                                          u32 sa_in);
 101 extern int ipsec_tun_protect_update (u32 sw_if_index, u32 sa_out,
 102                                      u32 * sa_ins);
 103 extern int ipsec_tun_protect_update_in (u32 sw_if_index, u32 sa_in);
 104 extern int ipsec_tun_protect_update_out (u32 sw_if_index, u32 sa_out);
 105
 106 extern int ipsec_tun_protect_del (u32 sw_if_index);
 107
 108 typedef walk_rc_t (*ipsec_tun_protect_walk_cb_t) (index_t itpi, void *arg);
 109 extern void ipsec_tun_protect_walk (ipsec_tun_protect_walk_cb_t fn,
 110                                     void *cttx);
 111 extern index_t ipsec_tun_protect_find (u32 sw_if_index);
 112
 113 extern u8 *format_ipsec_tun_protect (u8 * s, va_list * args);
 114
 115 // FIXME
 116 extern vlib_node_registration_t ipsec4_tun_input_node;
 117 extern vlib_node_registration_t ipsec6_tun_input_node;
 118
 119 /*
 120  * DP API
 121  */
 122 extern ipsec_tun_protect_t *ipsec_protect_pool;
 123
 124 typedef struct ipsec_tun_lkup_result_t_
 125 {
 126   union
 127   {
 128     struct
 129     {
 130       u32 tun_index;
 131       u32 sa_index;
 132     };
 133     u64 as_u64;
 134   };
 135 } ipsec_tun_lkup_result_t;
 136
 137 always_inline ipsec_tun_protect_t *
 138 ipsec_tun_protect_get (u32 index)
 139 {
 140   return (pool_elt_at_index (ipsec_protect_pool, index));
 141 }
 142
 143 /*
 144  * fd.io coding-style-patch-verification: ON
 145  *
 146  * Local Variables:
 147  * eval: (c-set-style "gnu")
 148  * End:
 149  */