37 if (sa->
integ_alg == IPSEC_INTEG_ALG_NONE)
52 if (IPSEC_INTEG_ALG_NONE != sa->
integ_alg)
115 const char *prev_node_name,
u32 * out_node_index,
116 u32 * out_next_index)
123 *out_node_index = node->
index;
129 const char *node_name,
u32 * out_feature_index)
172 n_regs = (p ? p[0] : 0);
185 const char *ah4_encrypt_node_name,
186 const char *ah4_decrypt_node_name,
187 const char *ah6_encrypt_node_name,
188 const char *ah6_decrypt_node_name,
196 ipsec_add_node (vm, ah4_encrypt_node_name,
"ipsec4-output-feature",
198 ipsec_add_node (vm, ah4_decrypt_node_name,
"ipsec4-input-feature",
200 ipsec_add_node (vm, ah6_encrypt_node_name,
"ipsec6-output-feature",
202 ipsec_add_node (vm, ah6_decrypt_node_name,
"ipsec6-input-feature",
213 const char *esp4_encrypt_node_name,
214 const char *esp4_encrypt_node_tun_name,
215 const char *esp4_decrypt_node_name,
216 const char *esp4_decrypt_tun_node_name,
217 const char *esp6_encrypt_node_name,
218 const char *esp6_encrypt_node_tun_name,
219 const char *esp6_decrypt_node_name,
220 const char *esp6_decrypt_tun_node_name,
230 ipsec_add_node (vm, esp4_encrypt_node_name,
"ipsec4-output-feature",
232 ipsec_add_node (vm, esp4_decrypt_node_name,
"ipsec4-input-feature",
234 ipsec_add_node (vm, esp6_encrypt_node_name,
"ipsec6-output-feature",
236 ipsec_add_node (vm, esp6_decrypt_node_name,
"ipsec6-input-feature",
238 ipsec_add_node (vm, esp4_decrypt_tun_node_name,
"ipsec4-tun-input",
241 ipsec_add_node (vm, esp6_decrypt_tun_node_name,
"ipsec6-tun-input",
263 "%d SA entries configured",
273 return VNET_API_ERROR_RSRC_IN_USE;
276 return VNET_API_ERROR_INVALID_VALUE;
296 return VNET_API_ERROR_RSRC_IN_USE;
299 return VNET_API_ERROR_INVALID_VALUE;
347 fib_node_lock (&sa->node);
355 sa->crypto_op_data = is_enabled ?
356 sa->async_op_data.data : sa->sync_op_data.data;
357 fib_node_unlock (&sa->node);
456 a->
enc_op_id = VNET_CRYPTO_OP_DES_CBC_ENC;
457 a->
dec_op_id = VNET_CRYPTO_OP_DES_CBC_DEC;
458 a->
alg = VNET_CRYPTO_ALG_DES_CBC;
462 a->
enc_op_id = VNET_CRYPTO_OP_3DES_CBC_ENC;
463 a->
dec_op_id = VNET_CRYPTO_OP_3DES_CBC_DEC;
464 a->
alg = VNET_CRYPTO_ALG_3DES_CBC;
467 a = im->
crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_128;
468 a->
enc_op_id = VNET_CRYPTO_OP_AES_128_CBC_ENC;
469 a->
dec_op_id = VNET_CRYPTO_OP_AES_128_CBC_DEC;
470 a->
alg = VNET_CRYPTO_ALG_AES_128_CBC;
473 a = im->
crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_192;
474 a->
enc_op_id = VNET_CRYPTO_OP_AES_192_CBC_ENC;
475 a->
dec_op_id = VNET_CRYPTO_OP_AES_192_CBC_DEC;
476 a->
alg = VNET_CRYPTO_ALG_AES_192_CBC;
479 a = im->
crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_256;
480 a->
enc_op_id = VNET_CRYPTO_OP_AES_256_CBC_ENC;
481 a->
dec_op_id = VNET_CRYPTO_OP_AES_256_CBC_DEC;
482 a->
alg = VNET_CRYPTO_ALG_AES_256_CBC;
485 a = im->
crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_128;
486 a->
enc_op_id = VNET_CRYPTO_OP_AES_128_GCM_ENC;
487 a->
dec_op_id = VNET_CRYPTO_OP_AES_128_GCM_DEC;
488 a->
alg = VNET_CRYPTO_ALG_AES_128_GCM;
493 a = im->
crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_192;
494 a->
enc_op_id = VNET_CRYPTO_OP_AES_192_GCM_ENC;
495 a->
dec_op_id = VNET_CRYPTO_OP_AES_192_GCM_DEC;
496 a->
alg = VNET_CRYPTO_ALG_AES_192_GCM;
501 a = im->
crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_256;
502 a->
enc_op_id = VNET_CRYPTO_OP_AES_256_GCM_ENC;
503 a->
dec_op_id = VNET_CRYPTO_OP_AES_256_GCM_DEC;
504 a->
alg = VNET_CRYPTO_ALG_AES_256_GCM;
513 i->
op_id = VNET_CRYPTO_OP_MD5_HMAC;
514 i->
alg = VNET_CRYPTO_ALG_HMAC_MD5;
518 i->
op_id = VNET_CRYPTO_OP_SHA1_HMAC;
519 i->
alg = VNET_CRYPTO_ALG_HMAC_SHA1;
522 i = &im->
integ_algs[IPSEC_INTEG_ALG_SHA_256_96];
523 i->
op_id = VNET_CRYPTO_OP_SHA1_HMAC;
524 i->
alg = VNET_CRYPTO_ALG_HMAC_SHA256;
527 i = &im->
integ_algs[IPSEC_INTEG_ALG_SHA_256_128];
528 i->
op_id = VNET_CRYPTO_OP_SHA256_HMAC;
529 i->
alg = VNET_CRYPTO_ALG_HMAC_SHA256;
532 i = &im->
integ_algs[IPSEC_INTEG_ALG_SHA_384_192];
533 i->
op_id = VNET_CRYPTO_OP_SHA384_HMAC;
534 i->
alg = VNET_CRYPTO_ALG_HMAC_SHA384;
537 i = &im->
integ_algs[IPSEC_INTEG_ALG_SHA_512_256];
538 i->
op_id = VNET_CRYPTO_OP_SHA512_HMAC;
539 i->
alg = VNET_CRYPTO_ALG_HMAC_SHA512;
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
u32 esp4_decrypt_tun_node_index
u32 ipsec_register_ah_backend(vlib_main_t *vm, ipsec_main_t *im, const char *name, const char *ah4_encrypt_node_name, const char *ah4_decrypt_node_name, const char *ah6_encrypt_node_name, const char *ah6_decrypt_node_name, check_support_cb_t ah_check_support_cb, add_del_sa_sess_cb_t ah_add_del_sa_sess_cb)
#define hash_set(h, key, value)
u32 esp4_encrypt_next_index
ipsec_main_crypto_alg_t * crypto_algs
ipsec_per_thread_data_t * ptd
u32 esp6_decrypt_node_index
#define hash_unset(h, key)
enable_disable_cb_t enable_disable_cb
u8 vnet_get_feature_arc_index(const char *s)
u32 ah4_decrypt_next_index
vnet_main_t * vnet_get_main(void)
void ipsec_unregister_udp_port(u16 port)
static void ipsec_add_node(vlib_main_t *vm, const char *node_name, const char *prev_node_name, u32 *out_node_index, u32 *out_next_index)
u32 esp6_encrypt_tun_node_index
u32 esp4_decrypt_node_index
u32 vlib_frame_queue_main_init(u32 node_index, u32 frame_queue_nelts)
ipsec_integ_alg_t integ_alg
u32 ah6_decrypt_next_index
u32 esp6_decrypt_tun_node_index
u32 esp6_decrypt_next_index
u32 ah4_encrypt_next_index
u32 ah4_encrypt_node_index
u32 esp6_encrypt_node_index
vlib_node_registration_t ah6_encrypt_node
(constructor) VLIB_REGISTER_NODE (ah6_encrypt_node)
int ipsec_select_ah_backend(ipsec_main_t *im, u32 backend_idx)
u32 esp6_decrypt_tun_next_index
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
u32 ah6_decrypt_node_index
static uword vlib_node_add_next(vlib_main_t *vm, uword node, uword next_node)
vlib_node_registration_t esp4_encrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp4_encrypt_tun_node)
uword * spd_index_by_sw_if_index
int vnet_crypto_is_set_handler(vnet_crypto_alg_t alg)
u32 esp4_decrypt_tun_next_index
u32 esp4_enc_tun_fq_index
vlib_node_registration_t esp6_decrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp6_decrypt_tun_node)
u32 esp6_encrypt_next_index
static clib_error_t * ipsec_check_ah_support(ipsec_sa_t *sa)
u32 ah6_encrypt_node_index
vlib_node_registration_t ah6_decrypt_node
(constructor) VLIB_REGISTER_NODE (ah6_decrypt_node)
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
uword * udp_port_registrations
#define VLIB_INIT_FUNCTION(x)
void ipsec_register_udp_port(u16 port)
u32 esp6_encrypt_node_index
u32 esp4_decrypt_next_index
u32 ipsec_register_esp_backend(vlib_main_t *vm, ipsec_main_t *im, const char *name, const char *esp4_encrypt_node_name, const char *esp4_encrypt_node_tun_name, const char *esp4_decrypt_node_name, const char *esp4_decrypt_tun_node_name, const char *esp6_encrypt_node_name, const char *esp6_encrypt_node_tun_name, const char *esp6_decrypt_node_name, const char *esp6_decrypt_tun_node_name, check_support_cb_t esp_check_support_cb, add_del_sa_sess_cb_t esp_add_del_sa_sess_cb, enable_disable_cb_t enable_disable_cb)
u32 ah6_encrypt_next_index
int ipsec_select_esp_backend(ipsec_main_t *im, u32 backend_idx)
u32 esp4_dec_tun_fq_index
#define clib_error_return(e, args...)
check_support_cb_t check_support_cb
vlib_node_registration_t esp4_decrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp4_decrypt_tun_node)
clib_error_t *(* add_del_sa_sess_cb_t)(u32 sa_index, u8 is_add)
#define vlib_call_init_function(vm, x)
u32 esp6_decrypt_node_index
u32 vnet_get_feature_index(u8 arc, const char *s)
static clib_error_t * vnet_feature_init(vlib_main_t *vm)
u32 ah4_decrypt_node_index
vlib_node_registration_t esp6_encrypt_node
(constructor) VLIB_REGISTER_NODE (esp6_encrypt_node)
clib_error_t * crypto_dispatch_enable_disable(int is_enable)
u32 error_drop_node_index
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
vlib_node_registration_t esp6_encrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp6_encrypt_tun_node)
u32 esp4_encrypt_node_index
clib_error_t * ipsec_check_support_cb(ipsec_main_t *im, ipsec_sa_t *sa)
vnet_crypto_op_id_t enc_op_id
u32 ah4_decrypt_next_index
u32 esp6_dec_tun_fq_index
clib_error_t * ipsec_rsc_in_use(ipsec_main_t *im)
u32 esp4_decrypt_tun_next_index
u32 vnet_crypto_register_post_node(vlib_main_t *vm, char *post_node_name)
async crypto register functions
u32 ah4_enc_fq_index
Worker handoff.
u32 esp6_decrypt_tun_node_index
vlib_node_registration_t ah4_encrypt_node
(constructor) VLIB_REGISTER_NODE (ah4_encrypt_node)
u32 esp4_encrypt_node_index
uword * spd_index_by_spd_id
u32 ah4_decrypt_node_index
clib_error_t * ipsec_add_del_sa_sess_cb(ipsec_main_t *im, u32 sa_index, u8 is_add)
u32 ah6_encrypt_next_index
clib_error_t *(* enable_disable_cb_t)(int is_enable)
u32 esp6_decrypt_tun_next_index
ipsec_ah_backend_t * ah_backends
clib_error_t * ipsec_cli_init(vlib_main_t *vm)
sll srl srl sll sra u16x4 i
vlib_node_registration_t ah4_decrypt_node
(constructor) VLIB_REGISTER_NODE (ah4_decrypt_node)
static void crypto_engine_backend_register_post_node(vlib_main_t *vm)
void udp_unregister_dst_port(vlib_main_t *vm, udp_dst_port_t dst_port, u8 is_ip4)
u32 esp6_enc_tun_fq_index
u32 esp4_encrypt_next_index
vlib_node_registration_t esp4_encrypt_node
(constructor) VLIB_REGISTER_NODE (esp4_encrypt_node)
u32 ah4_encrypt_next_index
uword * sa_index_by_sa_id
u32 esp6_decrypt_next_index
#define pool_is_free_index(P, I)
Use free bitmap to query whether given index is free.
u32 esp4_encrypt_tun_node_index
vlib_main_t vlib_node_runtime_t * node
static clib_error_t * ipsec_init(vlib_main_t *vm)
esp_async_post_next_t esp_decrypt_async_next
u32 esp6_encrypt_next_index
static clib_error_t * ipsec_check_esp_support(ipsec_sa_t *sa)
clib_error_t *(* check_support_cb_t)(ipsec_sa_t *sa)
#define hash_create(elts, value_bytes)
vnet_crypto_op_id_t op_id
void ipsec_set_async_mode(u32 is_enabled)
u32 ah4_encrypt_node_index
ipsec_main_integ_alg_t * integ_algs
u32 esp4_decrypt_node_index
ipsec_protocol_t protocol
add_del_sa_sess_cb_t add_del_sa_sess_cb
vnet_crypto_op_id_t dec_op_id
vlib_node_registration_t ipsec4_tun_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_tun_input_node)
u32 ah6_decrypt_node_index
static vlib_main_t * vlib_get_main(void)
u32 ah6_encrypt_node_index
u32 ah6_decrypt_next_index
check_support_cb_t check_support_cb
u32 esp4_decrypt_tun_node_index
esp_async_post_next_t esp_encrypt_async_next
u32 esp4_encrypt_tun_node_index
void ipsec_add_feature(const char *arc_name, const char *node_name, u32 *out_feature_index)
u32 esp4_decrypt_next_index
ipsec_crypto_alg_t crypto_alg
static u32 vlib_num_workers()
void udp_register_dst_port(vlib_main_t *vm, udp_dst_port_t dst_port, u32 node_index, u8 is_ip4)
add_del_sa_sess_cb_t add_del_sa_sess_cb
ipsec_esp_backend_t * esp_backends
#define CLIB_CACHE_LINE_BYTES
vlib_node_registration_t esp6_decrypt_node
(constructor) VLIB_REGISTER_NODE (esp6_decrypt_node)
u32 esp6_encrypt_tun_node_index
vlib_node_registration_t esp4_decrypt_node
(constructor) VLIB_REGISTER_NODE (esp4_decrypt_node)
static uword pool_elts(void *v)
Number of active elements in a pool.