src/vnet/ipsec/ipsec_tun.h

   1 /*
   2  * ipsec_tun.h : IPSEC tunnel protection
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/ipsec/ipsec.h>
  19
  20 /* *INDENT-OFF* */
  21 typedef CLIB_PACKED(struct {
  22   /*
  23    * Key fields: remote ip and spi on incoming packet
  24    * all fields in NET byte order
  25    */
  26   union {
  27     struct {
  28       ip4_address_t remote_ip;
  29       u32 spi;
  30     };
  31     u64 as_u64;
  32   };
  33 }) ipsec4_tunnel_key_t;
  34 /* *INDENT-ON* */
  35
  36 /* *INDENT-OFF* */
  37 typedef CLIB_PACKED(struct {
  38   /*
  39    * Key fields: remote ip and spi on incoming packet
  40    * all fields in NET byte order
  41    */
  42   ip6_address_t remote_ip;
  43   u32 spi;
  44 }) ipsec6_tunnel_key_t;
  45 /* *INDENT-ON* */
  46
  47 extern u8 *format_ipsec4_tunnel_key (u8 * s, va_list * args);
  48 extern u8 *format_ipsec6_tunnel_key (u8 * s, va_list * args);
  49
  50 typedef enum ipsec_protect_flags_t_
  51 {
  52   IPSEC_PROTECT_L2 = (1 << 0),
  53   IPSEC_PROTECT_ENCAPED = (1 << 1),
  54 } __clib_packed ipsec_protect_flags_t;
  55
  56 typedef struct ipsec_ep_t_
  57 {
  58   ip46_address_t src;
  59   ip46_address_t dst;
  60 } ipsec_ep_t;
  61
  62 #define ITP_MAX_N_SA_IN 4
  63
  64 typedef struct ipsec_tun_protect_t_
  65 {
  66   CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
  67   index_t itp_out_sa;
  68
  69   /* not using a vector since we want the memory inline
  70    * with this struct */
  71   u32 itp_n_sa_in;
  72   index_t itp_in_sas[ITP_MAX_N_SA_IN];
  73
  74   u32 itp_sw_if_index;
  75
  76   ipsec_ep_t itp_crypto;
  77
  78   ipsec_protect_flags_t itp_flags;
  79
  80   ipsec_ep_t itp_tun;
  81
  82   ip_address_t *itp_key;
  83
  84 } ipsec_tun_protect_t;
  85
  86 #define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body) \
  87 {                                                          \
  88   u32 __ii;                                                \
  89   for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) {       \
  90     _sai = itp->itp_in_sas[__ii];                          \
  91     body;                                                  \
  92   }                                                        \
  93 }
  94 #define FOR_EACH_IPSEC_PROTECT_INPUT_SA(_itp, _sa, body)   \
  95 {                                                          \
  96   u32 __ii;                                                \
  97   for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) {       \
  98     _sa = ipsec_sa_get(itp->itp_in_sas[__ii]);             \
  99     body;                                                  \
 100   }                                                        \
 101 }
 102
 103 extern int ipsec_tun_protect_update_one (u32 sw_if_index,
 104                                          const ip_address_t * nh,
 105                                          u32 sa_out, u32 sa_in);
 106 extern int ipsec_tun_protect_update (u32 sw_if_index,
 107                                      const ip_address_t * nh,
 108                                      u32 sa_out, u32 * sa_ins);
 109 extern int ipsec_tun_protect_update_in (u32 sw_if_index,
 110                                         const ip_address_t * nh, u32 sa_in);
 111 extern int ipsec_tun_protect_update_out (u32 sw_if_index,
 112                                          const ip_address_t * nh, u32 sa_out);
 113
 114 extern int ipsec_tun_protect_del (u32 sw_if_index, const ip_address_t * nh);
 115
 116 typedef walk_rc_t (*ipsec_tun_protect_walk_cb_t) (index_t itpi, void *arg);
 117 extern void ipsec_tun_protect_walk (ipsec_tun_protect_walk_cb_t fn,
 118                                     void *cttx);
 119 extern void ipsec_tun_protect_walk_itf (u32 sw_if_index,
 120                                         ipsec_tun_protect_walk_cb_t fn,
 121                                         void *cttx);
 122
 123 extern u8 *format_ipsec_tun_protect (u8 * s, va_list * args);
 124 extern u8 *format_ipsec_tun_protect_index (u8 * s, va_list * args);
 125
 126 extern void ipsec_tun_register_nodes (ip_address_family_t af);
 127 extern void ipsec_tun_unregister_nodes (ip_address_family_t af);
 128
 129 // FIXME
 130 extern vlib_node_registration_t ipsec4_tun_input_node;
 131 extern vlib_node_registration_t ipsec6_tun_input_node;
 132
 133 /*
 134  * DP API
 135  */
 136 extern ipsec_tun_protect_t *ipsec_tun_protect_pool;
 137
 138 typedef struct ipsec_tun_lkup_result_t_
 139 {
 140   union
 141   {
 142     struct
 143     {
 144       u32 tun_index;
 145       u32 sa_index;
 146     };
 147     u64 as_u64;
 148   };
 149 } ipsec_tun_lkup_result_t;
 150
 151 always_inline ipsec_tun_protect_t *
 152 ipsec_tun_protect_get (u32 index)
 153 {
 154   return (pool_elt_at_index (ipsec_tun_protect_pool, index));
 155 }
 156
 157 extern index_t *ipsec_tun_protect_sa_by_adj_index;
 158 always_inline index_t
 159 ipsec_tun_protect_get_sa_out (adj_index_t ai)
 160 {
 161   ASSERT (vec_len (ipsec_tun_protect_sa_by_adj_index) > ai);
 162   ASSERT (INDEX_INVALID != ipsec_tun_protect_sa_by_adj_index[ai]);
 163
 164   return (ipsec_tun_protect_sa_by_adj_index[ai]);
 165 }
 166
 167 /*
 168  * fd.io coding-style-patch-verification: ON
 169  *
 170  * Local Variables:
 171  * eval: (c-set-style "gnu")
 172  * End:
 173  */