src/vnet/ipsec/ipsec_tun.h

   1 /*
   2  * ipsec_tun.h : IPSEC tunnel protection
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/ipsec/ipsec.h>
  19
  20 /* *INDENT-OFF* */
  21 typedef CLIB_PACKED(struct {
  22   /*
  23    * Key fields: remote ip and spi on incoming packet
  24    * all fields in NET byte order
  25    */
  26   union {
  27     struct {
  28       ip4_address_t remote_ip;
  29       u32 spi;
  30     };
  31     u64 as_u64;
  32   };
  33 }) ipsec4_tunnel_key_t;
  34 /* *INDENT-ON* */
  35
  36 /* *INDENT-OFF* */
  37 typedef CLIB_PACKED(struct {
  38   /*
  39    * Key fields: remote ip and spi on incoming packet
  40    * all fields in NET byte order
  41    */
  42   ip6_address_t remote_ip;
  43   u32 spi;
  44 }) ipsec6_tunnel_key_t;
  45 /* *INDENT-ON* */
  46
  47 extern u8 *format_ipsec4_tunnel_key (u8 * s, va_list * args);
  48 extern u8 *format_ipsec6_tunnel_key (u8 * s, va_list * args);
  49
  50 typedef enum ipsec_protect_flags_t_
  51 {
  52   IPSEC_PROTECT_L2 = (1 << 0),
  53   IPSEC_PROTECT_ENCAPED = (1 << 1),
  54 } __clib_packed ipsec_protect_flags_t;
  55
  56 typedef struct ipsec_ep_t_
  57 {
  58   ip46_address_t src;
  59   ip46_address_t dst;
  60 } ipsec_ep_t;
  61
  62 typedef struct ipsec_tun_protect_t_
  63 {
  64   CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
  65   index_t itp_out_sa;
  66
  67   /* not using a vector since we want the memory inline
  68    * with this struct */
  69   u32 itp_n_sa_in;
  70   index_t itp_in_sas[4];
  71
  72   u32 itp_sw_if_index;
  73
  74   ipsec_ep_t itp_crypto;
  75
  76   ipsec_protect_flags_t itp_flags;
  77
  78   ipsec_ep_t itp_tun;
  79
  80   ip_address_t *itp_key;
  81
  82 } ipsec_tun_protect_t;
  83
  84 #define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body) \
  85 {                                                          \
  86   u32 __ii;                                                \
  87   for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) {       \
  88     _sai = itp->itp_in_sas[__ii];                          \
  89     body;                                                  \
  90   }                                                        \
  91 }
  92 #define FOR_EACH_IPSEC_PROTECT_INPUT_SA(_itp, _sa, body)   \
  93 {                                                          \
  94   u32 __ii;                                                \
  95   for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) {       \
  96     _sa = ipsec_sa_get(itp->itp_in_sas[__ii]);             \
  97     body;                                                  \
  98   }                                                        \
  99 }
 100
 101 extern int ipsec_tun_protect_update_one (u32 sw_if_index,
 102                                          const ip_address_t * nh,
 103                                          u32 sa_out, u32 sa_in);
 104 extern int ipsec_tun_protect_update (u32 sw_if_index,
 105                                      const ip_address_t * nh,
 106                                      u32 sa_out, u32 * sa_ins);
 107 extern int ipsec_tun_protect_update_in (u32 sw_if_index,
 108                                         const ip_address_t * nh, u32 sa_in);
 109 extern int ipsec_tun_protect_update_out (u32 sw_if_index,
 110                                          const ip_address_t * nh, u32 sa_out);
 111
 112 extern int ipsec_tun_protect_del (u32 sw_if_index, const ip_address_t * nh);
 113
 114 typedef walk_rc_t (*ipsec_tun_protect_walk_cb_t) (index_t itpi, void *arg);
 115 extern void ipsec_tun_protect_walk (ipsec_tun_protect_walk_cb_t fn,
 116                                     void *cttx);
 117 extern void ipsec_tun_protect_walk_itf (u32 sw_if_index,
 118                                         ipsec_tun_protect_walk_cb_t fn,
 119                                         void *cttx);
 120
 121 extern u8 *format_ipsec_tun_protect (u8 * s, va_list * args);
 122 extern u8 *format_ipsec_tun_protect_index (u8 * s, va_list * args);
 123
 124 extern void ipsec_tun_register_nodes (ip_address_family_t af);
 125 extern void ipsec_tun_unregister_nodes (ip_address_family_t af);
 126
 127 // FIXME
 128 extern vlib_node_registration_t ipsec4_tun_input_node;
 129 extern vlib_node_registration_t ipsec6_tun_input_node;
 130
 131 /*
 132  * DP API
 133  */
 134 extern ipsec_tun_protect_t *ipsec_tun_protect_pool;
 135
 136 typedef struct ipsec_tun_lkup_result_t_
 137 {
 138   union
 139   {
 140     struct
 141     {
 142       u32 tun_index;
 143       u32 sa_index;
 144     };
 145     u64 as_u64;
 146   };
 147 } ipsec_tun_lkup_result_t;
 148
 149 always_inline ipsec_tun_protect_t *
 150 ipsec_tun_protect_get (u32 index)
 151 {
 152   return (pool_elt_at_index (ipsec_tun_protect_pool, index));
 153 }
 154
 155 extern index_t *ipsec_tun_protect_sa_by_adj_index;
 156 always_inline index_t
 157 ipsec_tun_protect_get_sa_out (adj_index_t ai)
 158 {
 159   ASSERT (vec_len (ipsec_tun_protect_sa_by_adj_index) > ai);
 160   ASSERT (INDEX_INVALID != ipsec_tun_protect_sa_by_adj_index[ai]);
 161
 162   return (ipsec_tun_protect_sa_by_adj_index[ai]);
 163 }
 164
 165 /*
 166  * fd.io coding-style-patch-verification: ON
 167  *
 168  * Local Variables:
 169  * eval: (c-set-style "gnu")
 170  * End:
 171  */