ipsec: Tunnel SA DSCP behaviour

[vpp.git] / src / vnet / ipsec / ipsec_sa.h

diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h
index b3e138b..6ed7132 100644 (file)
--- a/src/vnet/ipsec/ipsec_sa.h
+++ b/src/vnet/ipsec/ipsec_sa.h
@@ -16,8 +16,10 @@
 #define __IPSEC_SPD_SA_H__
 
 #include <vlib/vlib.h>
+#include <vnet/crypto/crypto.h>
 #include <vnet/ip/ip.h>
 #include <vnet/fib/fib_node.h>
+#include <vnet/tunnel/tunnel.h>
 
 #define foreach_ipsec_crypto_alg    \
   _ (0, NONE, "none")               \
@@ -39,7 +41,7 @@ typedef enum
   foreach_ipsec_crypto_alg
 #undef _
     IPSEC_CRYPTO_N_ALG,
-} ipsec_crypto_alg_t;
+} __clib_packed ipsec_crypto_alg_t;
 
 #define IPSEC_CRYPTO_ALG_IS_GCM(_alg)                     \
   (((_alg == IPSEC_CRYPTO_ALG_AES_GCM_128) ||             \
@@ -61,13 +63,13 @@ typedef enum
   foreach_ipsec_integ_alg
 #undef _
     IPSEC_INTEG_N_ALG,
-} ipsec_integ_alg_t;
+} __clib_packed ipsec_integ_alg_t;
 
 typedef enum
 {
   IPSEC_PROTOCOL_AH = 0,
   IPSEC_PROTOCOL_ESP = 1
-} ipsec_protocol_t;
+} __clib_packed ipsec_protocol_t;
 
 #define IPSEC_KEY_MAX_LEN 128
 typedef struct ipsec_key_t_
@@ -112,8 +114,10 @@ typedef struct
   ipsec_sa_flags_t flags;
 
   u8 crypto_iv_size;
-  u8 crypto_block_size;
+  u8 esp_block_align;
   u8 integ_icv_size;
+  u32 encrypt_thread_index;
+  u32 decrypt_thread_index;
   u32 spi;
   u32 seq;
   u32 seq_hi;
@@ -124,13 +128,31 @@ typedef struct
 
   vnet_crypto_key_index_t crypto_key_index;
   vnet_crypto_key_index_t integ_key_index;
-  vnet_crypto_op_id_t crypto_enc_op_id:16;
-  vnet_crypto_op_id_t crypto_dec_op_id:16;
-  vnet_crypto_op_id_t integ_op_id:16;
 
-  /* data accessed by dataplane code should be above this comment */
+  /* Union data shared by sync and async ops, updated when mode is
+   * changed. */
+  union
+  {
+    struct
+    {
+      vnet_crypto_op_id_t crypto_enc_op_id:16;
+      vnet_crypto_op_id_t crypto_dec_op_id:16;
+      vnet_crypto_op_id_t integ_op_id:16;
+    };
+
+    struct
+    {
+      vnet_crypto_async_op_id_t crypto_async_enc_op_id:16;
+      vnet_crypto_async_op_id_t crypto_async_dec_op_id:16;
+      vnet_crypto_key_index_t linked_key_index;
+    };
+
+    u64 crypto_op_data;
+  };
+
     CLIB_CACHE_LINE_ALIGN_MARK (cacheline1);
 
+  u64 gcm_iv_counter;
   union
   {
     ip4_header_t ip4_hdr;
@@ -138,33 +160,65 @@ typedef struct
   };
   udp_header_t udp_hdr;
 
-  fib_node_t node;
-  u32 id;
-  u32 stat_index;
+  /* Salt used in GCM modes - stored in network byte order */
+  u32 salt;
+
   ipsec_protocol_t protocol;
+  tunnel_encap_decap_flags_t tunnel_flags;
+  ip_dscp_t dscp;
+  u8 __pad[1];
 
-  ipsec_crypto_alg_t crypto_alg;
-  ipsec_key_t crypto_key;
-  vnet_crypto_alg_t crypto_calg;
+  /* data accessed by dataplane code should be above this comment */
+    CLIB_CACHE_LINE_ALIGN_MARK (cacheline2);
 
-  ipsec_integ_alg_t integ_alg;
-  ipsec_key_t integ_key;
-  vnet_crypto_alg_t integ_calg;
+  /* Elements with u64 size multiples */
+  union
+  {
+    struct
+    {
+      vnet_crypto_op_id_t crypto_enc_op_id:16;
+      vnet_crypto_op_id_t crypto_dec_op_id:16;
+      vnet_crypto_op_id_t integ_op_id:16;
+    };
+    u64 data;
+  } sync_op_data;
+
+  union
+  {
+    struct
+    {
+      vnet_crypto_async_op_id_t crypto_async_enc_op_id:16;
+      vnet_crypto_async_op_id_t crypto_async_dec_op_id:16;
+      vnet_crypto_key_index_t linked_key_index;
+    };
+    u64 data;
+  } async_op_data;
 
   ip46_address_t tunnel_src_addr;
   ip46_address_t tunnel_dst_addr;
 
+  fib_node_t node;
+
+  /* elements with u32 size */
+  u32 id;
+  u32 stat_index;
+  vnet_crypto_alg_t integ_calg;
+  vnet_crypto_alg_t crypto_calg;
+
   fib_node_index_t fib_entry_index;
   u32 sibling;
-
   u32 tx_fib_index;
 
-  /* Salt used in GCM modes - stored in network byte order */
-  u32 salt;
-  u64 gcm_iv_counter;
+  /* else u8 packed */
+  ipsec_crypto_alg_t crypto_alg;
+  ipsec_integ_alg_t integ_alg;
+
+  ipsec_key_t integ_key;
+  ipsec_key_t crypto_key;
 } ipsec_sa_t;
 
 STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline1, CLIB_CACHE_LINE_BYTES);
+STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline2, 2 * CLIB_CACHE_LINE_BYTES);
 
 #define _(a,v,s)                                                        \
   always_inline int                                                     \
@@ -207,10 +261,13 @@ extern int ipsec_sa_add_and_lock (u32 id,
                                  u32 salt,
                                  const ip46_address_t * tunnel_src_addr,
                                  const ip46_address_t * tunnel_dst_addr,
-                                 u32 * sa_index);
+                                 tunnel_encap_decap_flags_t tunnel_flags,
+                                 ip_dscp_t dscp,
+                                 u32 * sa_index, u16 src_port, u16 dst_port);
 extern index_t ipsec_sa_find_and_lock (u32 id);
 extern int ipsec_sa_unlock_id (u32 id);
 extern void ipsec_sa_unlock (index_t sai);
+extern void ipsec_sa_lock (index_t sai);
 extern void ipsec_sa_clear (index_t sai);
 extern void ipsec_sa_set_crypto_alg (ipsec_sa_t * sa,
                                     ipsec_crypto_alg_t crypto_alg);
@@ -230,6 +287,8 @@ extern uword unformat_ipsec_integ_alg (unformat_input_t * input,
                                       va_list * args);
 extern uword unformat_ipsec_key (unformat_input_t * input, va_list * args);
 
+#define IPSEC_UDP_PORT_NONE ((u16)~0)
+
 /*
  * Anti Replay definitions
  */
@@ -435,6 +494,18 @@ ipsec_sa_anti_replay_advance (ipsec_sa_t * sa, u32 seq)
     }
 }
 
+
+/*
+ * Makes choice for thread_id should be assigned.
+ *  if input ~0, gets random worker_id based on unix_time_now_nsec
+*/
+always_inline u32
+ipsec_sa_assign_thread (u32 thread_id)
+{
+  return ((thread_id) ? thread_id
+         : (unix_time_now_nsec () % vlib_num_workers ()) + 1);
+}
+
 #endif /* __IPSEC_SPD_SA_H__ */
 
 /*