X-Git-Url: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec.h;h=c370fb1aed518745c208e4f999997121d8da2866;hp=6a9c5b1c8242d00c00ebe9a419e8cc4027dff1eb;hb=4a58e49cf;hpb=be5a5dd904d4d25857c53a4b5dee7951f724e3e2 diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h index 6a9c5b1c824..c370fb1aed5 100644 --- a/src/vnet/ipsec/ipsec.h +++ b/src/vnet/ipsec/ipsec.h @@ -16,261 +16,105 @@ #define __IPSEC_H__ #include +#include #include -#define IPSEC_FLAG_IPSEC_GRE_TUNNEL (1 << 0) +#include +#include -#define foreach_ipsec_output_next \ - _ (DROP, "error-drop") \ - _ (ESP4_ENCRYPT, "esp4-encrypt") \ - _ (AH4_ENCRYPT, "ah4-encrypt") \ - _ (ESP6_ENCRYPT, "esp6-encrypt") \ - _ (AH6_ENCRYPT, "ah6-encrypt") - -#define _(v, s) IPSEC_OUTPUT_NEXT_##v, -typedef enum -{ - foreach_ipsec_output_next -#undef _ - IPSEC_OUTPUT_N_NEXT, -} ipsec_output_next_t; - -#define foreach_ipsec_input_next \ - _ (DROP, "error-drop") \ - _ (ESP4_DECRYPT, "esp4-decrypt") \ - _ (AH4_DECRYPT, "ah4-decrypt") \ - _ (ESP6_DECRYPT, "esp6-decrypt") \ - _ (AH6_DECRYPT, "ah6-decrypt") - -#define _(v, s) IPSEC_INPUT_NEXT_##v, -typedef enum -{ - foreach_ipsec_input_next -#undef _ - IPSEC_INPUT_N_NEXT, -} ipsec_input_next_t; +#include +#include +#include +#include -#define foreach_ipsec_policy_action \ - _(0, BYPASS, "bypass") \ - _(1, DISCARD, "discard") \ - _(2, RESOLVE, "resolve") \ - _(3, PROTECT, "protect") +#include -typedef enum -{ -#define _(v,f,s) IPSEC_POLICY_ACTION_##f = v, - foreach_ipsec_policy_action -#undef _ - IPSEC_POLICY_N_ACTION, -} ipsec_policy_action_t; - -#define foreach_ipsec_crypto_alg \ - _(0, NONE, "none") \ - _(1, AES_CBC_128, "aes-cbc-128") \ - _(2, AES_CBC_192, "aes-cbc-192") \ - _(3, AES_CBC_256, "aes-cbc-256") \ - _(4, AES_CTR_128, "aes-ctr-128") \ - _(5, AES_CTR_192, "aes-ctr-192") \ - _(6, AES_CTR_256, "aes-ctr-256") \ - _(7, AES_GCM_128, "aes-gcm-128") \ - _(8, AES_GCM_192, "aes-gcm-192") \ - _(9, AES_GCM_256, "aes-gcm-256") \ - _(10, DES_CBC, "des-cbc") \ - _(11, 3DES_CBC, "3des-cbc") - -typedef enum -{ -#define _(v,f,s) IPSEC_CRYPTO_ALG_##f = v, - foreach_ipsec_crypto_alg -#undef _ - IPSEC_CRYPTO_N_ALG, -} ipsec_crypto_alg_t; - -#define foreach_ipsec_integ_alg \ - _(0, NONE, "none") \ - _(1, MD5_96, "md5-96") /* RFC2403 */ \ - _(2, SHA1_96, "sha1-96") /* RFC2404 */ \ - _(3, SHA_256_96, "sha-256-96") /* draft-ietf-ipsec-ciph-sha-256-00 */ \ - _(4, SHA_256_128, "sha-256-128") /* RFC4868 */ \ - _(5, SHA_384_192, "sha-384-192") /* RFC4868 */ \ - _(6, SHA_512_256, "sha-512-256") /* RFC4868 */ - -typedef enum -{ -#define _(v,f,s) IPSEC_INTEG_ALG_##f = v, - foreach_ipsec_integ_alg -#undef _ - IPSEC_INTEG_N_ALG, -} ipsec_integ_alg_t; - -typedef enum -{ - IPSEC_PROTOCOL_AH = 0, - IPSEC_PROTOCOL_ESP = 1 -} ipsec_protocol_t; - -typedef struct -{ - u32 id; - u32 spi; - ipsec_protocol_t protocol; - - ipsec_crypto_alg_t crypto_alg; - u8 crypto_key_len; - u8 crypto_key[128]; - - ipsec_integ_alg_t integ_alg; - u8 integ_key_len; - u8 integ_key[128]; - - u8 use_esn; - u8 use_anti_replay; - - u8 is_tunnel; - u8 is_tunnel_ip6; - u8 udp_encap; - ip46_address_t tunnel_src_addr; - ip46_address_t tunnel_dst_addr; - - u32 salt; - - /* runtime */ - u32 seq; - u32 seq_hi; - u32 last_seq; - u32 last_seq_hi; - u64 replay_window; - - /*lifetime data */ - u64 total_data_size; -} ipsec_sa_t; - -typedef struct -{ - ip46_address_t start, stop; -} ip46_address_range_t; +typedef clib_error_t *(*add_del_sa_sess_cb_t) (u32 sa_index, u8 is_add); +typedef clib_error_t *(*check_support_cb_t) (ipsec_sa_t * sa); +typedef clib_error_t *(*enable_disable_cb_t) (int is_enable); typedef struct { - u16 start, stop; -} port_range_t; - -typedef struct -{ - u8 is_add; - u8 esn; - u8 anti_replay; - ip4_address_t local_ip, remote_ip; - u32 local_spi; - u32 remote_spi; - ipsec_crypto_alg_t crypto_alg; - u8 local_crypto_key_len; - u8 local_crypto_key[128]; - u8 remote_crypto_key_len; - u8 remote_crypto_key[128]; - ipsec_integ_alg_t integ_alg; - u8 local_integ_key_len; - u8 local_integ_key[128]; - u8 remote_integ_key_len; - u8 remote_integ_key[128]; - u8 renumber; - u32 show_instance; - u8 udp_encap; -} ipsec_add_del_tunnel_args_t; - -typedef struct -{ - u8 is_add; - u32 local_sa_id; - u32 remote_sa_id; - ip4_address_t local_ip; - ip4_address_t remote_ip; -} ipsec_add_del_ipsec_gre_tunnel_args_t; - -typedef enum -{ - IPSEC_IF_SET_KEY_TYPE_NONE, - IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO, - IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO, - IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG, - IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG, -} ipsec_if_set_key_type_t; - -typedef struct -{ - u32 id; - i32 priority; - u8 is_outbound; - - // Selector - u8 is_ipv6; - ip46_address_range_t laddr; - ip46_address_range_t raddr; - u8 protocol; - port_range_t lport; - port_range_t rport; - - // Policy - u8 policy; - u32 sa_id; - u32 sa_index; - - // Counter - vlib_counter_t counter; -} ipsec_policy_t; + u8 *name; + /* add/del callback */ + add_del_sa_sess_cb_t add_del_sa_sess_cb; + /* check support function */ + check_support_cb_t check_support_cb; + u32 ah4_encrypt_node_index; + u32 ah4_decrypt_node_index; + u32 ah4_encrypt_next_index; + u32 ah4_decrypt_next_index; + u32 ah6_encrypt_node_index; + u32 ah6_decrypt_node_index; + u32 ah6_encrypt_next_index; + u32 ah6_decrypt_next_index; +} ipsec_ah_backend_t; typedef struct { - u32 id; - /* pool of policies */ - ipsec_policy_t *policies; - /* vectors of policy indices */ - u32 *ipv4_outbound_policies; - u32 *ipv6_outbound_policies; - u32 *ipv4_inbound_protect_policy_indices; - u32 *ipv4_inbound_policy_discard_and_bypass_indices; - u32 *ipv6_inbound_protect_policy_indices; - u32 *ipv6_inbound_policy_discard_and_bypass_indices; -} ipsec_spd_t; + u8 *name; + /* add/del callback */ + add_del_sa_sess_cb_t add_del_sa_sess_cb; + /* check support function */ + check_support_cb_t check_support_cb; + /* enable or disable function */ + enable_disable_cb_t enable_disable_cb; + u32 esp4_encrypt_node_index; + u32 esp4_decrypt_node_index; + u32 esp4_encrypt_next_index; + u32 esp4_decrypt_next_index; + u32 esp6_encrypt_node_index; + u32 esp6_decrypt_node_index; + u32 esp6_encrypt_next_index; + u32 esp6_decrypt_next_index; + u32 esp4_decrypt_tun_node_index; + u32 esp4_decrypt_tun_next_index; + u32 esp4_encrypt_tun_node_index; + u32 esp6_decrypt_tun_node_index; + u32 esp6_decrypt_tun_next_index; + u32 esp6_encrypt_tun_node_index; + u32 esp_mpls_encrypt_tun_node_index; +} ipsec_esp_backend_t; typedef struct { - u32 spd_index; -} ip4_ipsec_config_t; + vnet_crypto_op_id_t enc_op_id; + vnet_crypto_op_id_t dec_op_id; + vnet_crypto_alg_t alg; + u8 iv_size; + u8 block_align; + u8 icv_size; +} ipsec_main_crypto_alg_t; typedef struct { - u32 spd_index; -} ip6_ipsec_config_t; + vnet_crypto_op_id_t op_id; + vnet_crypto_alg_t alg; + u8 icv_size; +} ipsec_main_integ_alg_t; typedef struct { - /* Required for pool_get_aligned */ CLIB_CACHE_LINE_ALIGN_MARK (cacheline0); - u32 input_sa_index; - u32 output_sa_index; - u32 hw_if_index; - u32 show_instance; -} ipsec_tunnel_if_t; - -typedef struct -{ - clib_error_t *(*add_del_sa_sess_cb) (u32 sa_index, u8 is_add); - clib_error_t *(*check_support_cb) (ipsec_sa_t * sa); -} ipsec_main_callbacks_t; + vnet_crypto_op_t *crypto_ops; + vnet_crypto_op_t *integ_ops; + vnet_crypto_op_t *chained_crypto_ops; + vnet_crypto_op_t *chained_integ_ops; + vnet_crypto_op_chunk_t *chunks; +} ipsec_per_thread_data_t; typedef struct { /* pool of tunnel instances */ ipsec_spd_t *spds; + /* Pool of security associations */ ipsec_sa_t *sad; + /* pool of policies */ + ipsec_policy_t *policies; - /* pool of tunnel interfaces */ - ipsec_tunnel_if_t *tunnel_interfaces; - u32 *free_tunnel_if_indices; - - u32 **empty_buffers; + /* hash tables of UDP port registrations */ + uword *udp_port_registrations; uword *tunnel_index_by_key; @@ -278,115 +122,133 @@ typedef struct vlib_main_t *vlib_main; vnet_main_t *vnet_main; - /* next node indices */ - u32 feature_next_node_index[32]; - /* hashes */ uword *spd_index_by_spd_id; uword *spd_index_by_sw_if_index; uword *sa_index_by_sa_id; - uword *ipsec_if_pool_index_by_key; + uword *ipsec4_if_pool_index_by_key; + uword *ipsec6_if_pool_index_by_key; uword *ipsec_if_real_dev_by_show_dev; + uword *ipsec_if_by_sw_if_index; + + clib_bihash_8_16_t tun4_protect_by_key; + clib_bihash_24_16_t tun6_protect_by_key; /* node indices */ u32 error_drop_node_index; u32 esp4_encrypt_node_index; u32 esp4_decrypt_node_index; + u32 esp4_decrypt_tun_node_index; + u32 esp4_encrypt_tun_node_index; u32 ah4_encrypt_node_index; u32 ah4_decrypt_node_index; u32 esp6_encrypt_node_index; u32 esp6_decrypt_node_index; + u32 esp6_decrypt_tun_node_index; + u32 esp6_encrypt_tun_node_index; + u32 esp_mpls_encrypt_tun_node_index; u32 ah6_encrypt_node_index; u32 ah6_decrypt_node_index; /* next node indices */ u32 esp4_encrypt_next_index; u32 esp4_decrypt_next_index; + u32 esp4_decrypt_tun_next_index; u32 ah4_encrypt_next_index; u32 ah4_decrypt_next_index; u32 esp6_encrypt_next_index; u32 esp6_decrypt_next_index; + u32 esp6_decrypt_tun_next_index; u32 ah6_encrypt_next_index; u32 ah6_decrypt_next_index; - /* callbacks */ - ipsec_main_callbacks_t cb; - - /* helper for sort function */ - ipsec_spd_t *spd_to_sort; + /* tun nodes to drop packets when no crypto alg set on outbound SA */ + u32 esp4_no_crypto_tun_node_index; + u32 esp6_no_crypto_tun_node_index; + + /* tun nodes for encrypt on L2 interfaces */ + u32 esp4_encrypt_l2_tun_node_index; + u32 esp6_encrypt_l2_tun_node_index; + + /* pool of ah backends */ + ipsec_ah_backend_t *ah_backends; + /* pool of esp backends */ + ipsec_esp_backend_t *esp_backends; + /* index of current ah backend */ + u32 ah_current_backend; + /* index of current esp backend */ + u32 esp_current_backend; + /* index of default ah backend */ + u32 ah_default_backend; + /* index of default esp backend */ + u32 esp_default_backend; + + /* crypto alg data */ + ipsec_main_crypto_alg_t *crypto_algs; + + /* crypto integ data */ + ipsec_main_integ_alg_t *integ_algs; + + /* per-thread data */ + ipsec_per_thread_data_t *ptd; + + /** Worker handoff */ + u32 ah4_enc_fq_index; + u32 ah4_dec_fq_index; + u32 ah6_enc_fq_index; + u32 ah6_dec_fq_index; + + u32 esp4_enc_fq_index; + u32 esp4_dec_fq_index; + u32 esp6_enc_fq_index; + u32 esp6_dec_fq_index; + u32 esp4_enc_tun_fq_index; + u32 esp6_enc_tun_fq_index; + u32 esp_mpls_enc_tun_fq_index; + u32 esp4_dec_tun_fq_index; + u32 esp6_dec_tun_fq_index; + + u8 async_mode; } ipsec_main_t; +typedef enum ipsec_format_flags_t_ +{ + IPSEC_FORMAT_BRIEF = 0, + IPSEC_FORMAT_DETAIL = (1 << 0), + IPSEC_FORMAT_INSECURE = (1 << 1), +} ipsec_format_flags_t; + extern ipsec_main_t ipsec_main; -extern vlib_node_registration_t esp4_encrypt_node; -extern vlib_node_registration_t esp4_decrypt_node; +clib_error_t *ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, + u8 is_add); + +clib_error_t *ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa); + extern vlib_node_registration_t ah4_encrypt_node; extern vlib_node_registration_t ah4_decrypt_node; -extern vlib_node_registration_t esp6_encrypt_node; -extern vlib_node_registration_t esp6_decrypt_node; extern vlib_node_registration_t ah6_encrypt_node; extern vlib_node_registration_t ah6_decrypt_node; -extern vlib_node_registration_t ipsec_if_input_node; - +extern vlib_node_registration_t esp4_encrypt_node; +extern vlib_node_registration_t esp4_decrypt_node; +extern vlib_node_registration_t esp6_encrypt_node; +extern vlib_node_registration_t esp6_decrypt_node; +extern vlib_node_registration_t esp4_encrypt_tun_node; +extern vlib_node_registration_t esp6_encrypt_tun_node; +extern vlib_node_registration_t esp_mpls_encrypt_tun_node; +extern vlib_node_registration_t esp4_decrypt_tun_node; +extern vlib_node_registration_t esp6_decrypt_tun_node; +extern vlib_node_registration_t ipsec4_tun_input_node; +extern vlib_node_registration_t ipsec6_tun_input_node; /* * functions */ -int ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id, - int is_add); -int ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add); -int ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, - int is_add); -int ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add); -int ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update); - -u32 ipsec_get_sa_index_by_sa_id (u32 sa_id); -u8 ipsec_is_sa_used (u32 sa_index); -u8 *format_ipsec_policy_action (u8 * s, va_list * args); -u8 *format_ipsec_crypto_alg (u8 * s, va_list * args); -u8 *format_ipsec_integ_alg (u8 * s, va_list * args); u8 *format_ipsec_replay_window (u8 * s, va_list * args); -uword unformat_ipsec_policy_action (unformat_input_t * input, va_list * args); -uword unformat_ipsec_crypto_alg (unformat_input_t * input, va_list * args); -uword unformat_ipsec_integ_alg (unformat_input_t * input, va_list * args); - -int ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, - ipsec_add_del_tunnel_args_t * args, - u32 * sw_if_index); -int ipsec_add_del_tunnel_if (ipsec_add_del_tunnel_args_t * args); -int ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm, - ipsec_add_del_ipsec_gre_tunnel_args_t * - args); -int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index, - ipsec_if_set_key_type_t type, u8 alg, u8 * key); -int ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, - u8 is_outbound); - /* * inline functions */ -always_inline void -ipsec_alloc_empty_buffers (vlib_main_t * vm, ipsec_main_t * im) -{ - u32 thread_index = vm->thread_index; - uword l = vec_len (im->empty_buffers[thread_index]); - uword n_alloc = 0; - - if (PREDICT_FALSE (l < VLIB_FRAME_SIZE)) - { - if (!im->empty_buffers[thread_index]) - { - vec_alloc (im->empty_buffers[thread_index], 2 * VLIB_FRAME_SIZE); - } - - n_alloc = vlib_buffer_alloc (vm, im->empty_buffers[thread_index] + l, - 2 * VLIB_FRAME_SIZE - l); - - _vec_len (im->empty_buffers[thread_index]) = l + n_alloc; - } -} - static_always_inline u32 get_next_output_feature_node_index (vlib_buffer_t * b, vlib_node_runtime_t * nr) @@ -399,6 +261,45 @@ get_next_output_feature_node_index (vlib_buffer_t * b, return node->next_nodes[next]; } +u32 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im, + const char *name, + const char *ah4_encrypt_node_name, + const char *ah4_decrypt_node_name, + const char *ah6_encrypt_node_name, + const char *ah6_decrypt_node_name, + check_support_cb_t ah_check_support_cb, + add_del_sa_sess_cb_t ah_add_del_sa_sess_cb); + +u32 ipsec_register_esp_backend ( + vlib_main_t *vm, ipsec_main_t *im, const char *name, + const char *esp4_encrypt_node_name, const char *esp4_encrypt_tun_node_name, + const char *esp4_decrypt_node_name, const char *esp4_decrypt_tun_node_name, + const char *esp6_encrypt_node_name, const char *esp6_encrypt_tun_node_name, + const char *esp6_decrypt_node_name, const char *esp6_decrypt_tun_node_name, + const char *esp_mpls_encrypt_tun_node_name, + check_support_cb_t esp_check_support_cb, + add_del_sa_sess_cb_t esp_add_del_sa_sess_cb, + enable_disable_cb_t enable_disable_cb); + +int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx); +int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx); + +clib_error_t *ipsec_rsc_in_use (ipsec_main_t * im); +void ipsec_set_async_mode (u32 is_enabled); + +always_inline ipsec_sa_t * +ipsec_sa_get (u32 sa_index) +{ + return (pool_elt_at_index (ipsec_main.sad, sa_index)); +} + +void ipsec_add_feature (const char *arc_name, const char *node_name, + u32 * out_feature_index); + +void ipsec_set_async_mode (u32 is_enabled); +extern void ipsec_register_udp_port (u16 udp_port); +extern void ipsec_unregister_udp_port (u16 udp_port); + #endif /* __IPSEC_H__ */ /*