FD.io VPP  v21.06-3-gbb25fbf28
Vector Packet Processing
ipsec.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2017 Intel and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef __DPDK_IPSEC_H__
16 #define __DPDK_IPSEC_H__
17 
18 #include <vnet/vnet.h>
19 #include <vppinfra/cache.h>
20 #include <vnet/ipsec/ipsec.h>
21 #include <vnet/ipsec/ipsec_sa.h>
22 
23 #undef always_inline
24 #include <rte_config.h>
25 #include <rte_crypto.h>
26 #include <rte_cryptodev.h>
27 
28 #if CLIB_DEBUG > 0
29 #define always_inline static inline
30 #else
31 #define always_inline static inline __attribute__ ((__always_inline__))
32 #endif
33 
34 #define DPDK_CRYPTO_N_QUEUE_DESC 2048
35 #define DPDK_CRYPTO_NB_SESS_OBJS 20000
36 
37 #define foreach_dpdk_crypto_input_next \
38  _(DROP, "error-drop") \
39  _(IP4_LOOKUP, "ip4-lookup") \
40  _(IP6_LOOKUP, "ip6-lookup") \
41  _(INTERFACE_OUTPUT, "interface-output") \
42  _(MIDCHAIN, "adj-midchain-tx") \
43  _(DECRYPT4_POST, "dpdk-esp4-decrypt-post") \
44  _(DECRYPT6_POST, "dpdk-esp6-decrypt-post")
45 
46 typedef enum
47 {
48 #define _(f,s) DPDK_CRYPTO_INPUT_NEXT_##f,
50 #undef _
53 
54 #define MAX_QP_PER_LCORE 16
55 
56 typedef struct
57 {
59  u32 iv[2];
62 
63 typedef struct
64 {
68  CLIB_ALIGN_MARK (mark0, 16);
70  u8 aad[16];
71  u8 icv[32]; /* XXX last 16B in next cache line */
73 
74 typedef struct
75 {
77  struct rte_crypto_op **ops;
78  u16 cipher_resource_idx[IPSEC_CRYPTO_N_ALG];
79  u16 auth_resource_idx[IPSEC_INTEG_N_ALG];
80  CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
82 
83 typedef struct
84 {
85  CLIB_ALIGN_MARK (pad, 8); /* align up to 8 bytes for 32bit builds */
86  char *name;
87  enum rte_crypto_sym_xform_type type;
95 } crypto_alg_t;
96 
97 typedef struct
98 {
101  u8 cipher_support[IPSEC_CRYPTO_N_ALG];
102  u8 auth_support[IPSEC_INTEG_N_ALG];
106  const char *name;
109 } crypto_dev_t;
110 
111 typedef struct
112 {
113  const char *name;
115 } crypto_drv_t;
116 
117 typedef struct
118 {
125  u16 inflights[2];
127  u16 __unused;
128  struct rte_crypto_op *ops[VLIB_FRAME_SIZE];
130  CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
132 
133 typedef struct
134 {
136  struct rte_cryptodev_sym_session *session;
138 
139 typedef struct
140 {
141  struct rte_cryptodev_sym_session *session;
143  CLIB_ALIGN_MARK (pad, 16); /* align up to 16 bytes for 32bit builds */
145 
146 typedef struct
147 {
148  struct rte_mempool *crypto_op;
149  struct rte_mempool *session_h;
150  struct rte_mempool **session_drv;
158  /* Required for vec_validate_aligned */
159  CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
160 } crypto_data_t;
161 
162 typedef struct
163 {
171  u64 session_timeout; /* nsec */
174 
176 
177 static const u8 pad_data[] =
178  { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 0 };
179 
180 void crypto_auto_placement (void);
181 
182 clib_error_t *create_sym_session (struct rte_cryptodev_sym_session **session,
183  u32 sa_idx, crypto_resource_t * res,
185 
188 {
189  const u32 align = 4;
190  u32 op_size =
191  sizeof (struct rte_crypto_op) + sizeof (struct rte_crypto_sym_op);
192 
193  return ((op_size + align - 1) & ~(align - 1)) + sizeof (dpdk_op_priv_t);
194 }
195 
198 {
199  const u32 align = 16;
200  u32 offset;
201 
202  offset = sizeof (struct rte_crypto_op) + sizeof (struct rte_crypto_sym_op);
203  offset = (offset + align - 1) & ~(align - 1);
204 
205  return offset;
206 }
207 
209 crypto_op_get_priv (struct rte_crypto_op * op)
210 {
211  return (dpdk_op_priv_t *) (((u8 *) op) + crypto_op_get_priv_offset ());
212 }
213 
214 
216 add_session_by_drv_and_sa_idx (struct rte_cryptodev_sym_session *session,
217  crypto_data_t * data, u32 drv_id, u32 sa_idx)
218 {
220  vec_validate_aligned (data->session_by_drv_id_and_sa_index, sa_idx,
222  sbd = vec_elt_at_index (data->session_by_drv_id_and_sa_index, sa_idx);
223  sbd->dev_mask |= 1L << drv_id;
224  sbd->session = session;
225 }
226 
227 static_always_inline struct rte_cryptodev_sym_session *
229 {
230  crypto_session_by_drv_t *sess_by_sa;
231  if (_vec_len (data->session_by_drv_id_and_sa_index) <= sa_idx)
232  return NULL;
233  sess_by_sa =
234  vec_elt_at_index (data->session_by_drv_id_and_sa_index, sa_idx);
235  return (sess_by_sa->dev_mask & (1L << drv_id)) ? sess_by_sa->session : NULL;
236 }
237 
239 crypto_get_session (struct rte_cryptodev_sym_session ** session,
240  u32 sa_idx,
241  crypto_resource_t * res,
243 {
246  struct rte_cryptodev_sym_session *sess;
247 
248  data = vec_elt_at_index (dcm->data, res->numa);
249  sess = get_session_by_drv_and_sa_idx (data, res->drv_id, sa_idx);
250 
251  if (PREDICT_FALSE (!sess))
252  return create_sym_session (session, sa_idx, res, cwm, is_outbound);
253 
254  session[0] = sess;
255 
256  return NULL;
257 }
258 
261 {
262  u16 cipher_res = cwm->cipher_resource_idx[sa->crypto_alg];
263  u16 auth_res = cwm->auth_resource_idx[sa->integ_alg];
264  u8 is_aead;
265 
266  /* Not allowed to setup SA with no-aead-cipher/NULL or NULL/NULL */
267 
268  is_aead = ((sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128) ||
269  (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_192) ||
270  (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_256));
271 
272  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_NONE)
273  return auth_res;
274 
275  if (cipher_res == auth_res)
276  return cipher_res;
277 
278  if (is_aead)
279  return cipher_res;
280 
281  return (u16) ~ 0;
282 }
283 
285 crypto_alloc_ops (u8 numa, struct rte_crypto_op ** ops, u32 n)
286 {
288  crypto_data_t *data = vec_elt_at_index (dcm->data, numa);
289  i32 ret;
290 
291  ret = rte_mempool_get_bulk (data->crypto_op, (void **) ops, n);
292 
293  /* *INDENT-OFF* */
294  data->crypto_op_get_failed += ! !ret;
295  /* *INDENT-ON* */
296 
297  return ret;
298 }
299 
301 crypto_free_ops (u8 numa, struct rte_crypto_op **ops, u32 n)
302 {
304  crypto_data_t *data = vec_elt_at_index (dcm->data, numa);
305 
306  if (!n)
307  return;
308 
309  rte_mempool_put_bulk (data->crypto_op, (void **) ops, n);
310 }
311 
314  u32 node_index, u32 error, u8 numa, u8 encrypt)
315 {
317  crypto_resource_t *res;
318  u16 *res_idx;
319 
320  /* *INDENT-OFF* */
321  vec_foreach (res_idx, cwm->resource_idx)
322  {
323  u16 enq, n_ops;
324  res = vec_elt_at_index (dcm->resource, res_idx[0]);
325 
326  if (!res->n_ops)
327  continue;
328 
329  n_ops = (DPDK_CRYPTO_N_QUEUE_DESC / 2) - res->inflights[encrypt];
330  n_ops = res->n_ops < n_ops ? res->n_ops : n_ops;
331  enq = rte_cryptodev_enqueue_burst (res->dev_id, res->qp_id,
332  res->ops, n_ops);
333  ASSERT (n_ops == enq);
334  res->inflights[encrypt] += enq;
335 
336  if (PREDICT_FALSE (enq < res->n_ops))
337  {
338  crypto_free_ops (numa, &res->ops[enq], res->n_ops - enq);
339  vlib_buffer_free (vm, &res->bi[enq], res->n_ops - enq);
340 
342  res->n_ops - enq);
343  }
344  res->n_ops = 0;
345  }
346  /* *INDENT-ON* */
347 }
348 
351 {
352  icb->salt = salt;
353  icb->iv[0] = seq;
354  icb->iv[1] = seq_hi;
355 }
356 
358 crypto_op_setup (u8 is_aead, struct rte_mbuf *mb0,
359  struct rte_crypto_op *op, void *session,
360  u32 cipher_off, u32 cipher_len,
361  u32 auth_off, u32 auth_len,
362  u8 * aad, u8 * digest, u64 digest_paddr)
363 {
364  struct rte_crypto_sym_op *sym_op;
365 
366  sym_op = (struct rte_crypto_sym_op *) (op + 1);
367 
368  sym_op->m_src = mb0;
369  sym_op->session = session;
370 
371  if (is_aead)
372  {
373  sym_op->aead.data.offset = cipher_off;
374  sym_op->aead.data.length = cipher_len;
375 
376  sym_op->aead.aad.data = aad;
377  sym_op->aead.aad.phys_addr =
378  op->phys_addr + (uintptr_t) aad - (uintptr_t) op;
379 
380  sym_op->aead.digest.data = digest;
381  sym_op->aead.digest.phys_addr = digest_paddr;
382  }
383  else
384  {
385  sym_op->cipher.data.offset = cipher_off;
386  sym_op->cipher.data.length = cipher_len;
387 
388  sym_op->auth.data.offset = auth_off;
389  sym_op->auth.data.length = auth_len;
390 
391  sym_op->auth.digest.data = digest;
392  sym_op->auth.digest.phys_addr = digest_paddr;
393  }
394 }
395 
396 #endif /* __DPDK_IPSEC_H__ */
397 
398 /*
399  * fd.io coding-style-patch-verification: ON
400  *
401  * Local Variables:
402  * eval: (c-set-style "gnu")
403  * End:
404  */
crypto_data_t::session_by_drv_id_and_sa_index
crypto_session_by_drv_t * session_by_drv_id_and_sa_index
Definition: ipsec.h:156
ipsec.h
crypto_drv_t::name
const char * name
Definition: ipsec.h:113
vlib_buffer_free
static void vlib_buffer_free(vlib_main_t *vm, u32 *buffers, u32 n_buffers)
Free buffers Frees the entire buffer chain for each buffer.
Definition: buffer_funcs.h:982
crypto_session_by_drv_t
Definition: ipsec.h:139
crypto_session_disposal_t::session
struct rte_cryptodev_sym_session * session
Definition: ipsec.h:136
crypto_get_session
static_always_inline clib_error_t * crypto_get_session(struct rte_cryptodev_sym_session **session, u32 sa_idx, crypto_resource_t *res, crypto_worker_main_t *cwm, u8 is_outbound)
Definition: ipsec.h:239
crypto_data_t::session_drv
struct rte_mempool ** session_drv
Definition: ipsec.h:150
crypto_alg_t::trunc_size
u8 trunc_size
Definition: ipsec.h:91
CLIB_CACHE_LINE_ALIGN_MARK
#define CLIB_CACHE_LINE_ALIGN_MARK(mark)
Definition: cache.h:60
crypto_data_t::crypto_op
struct rte_mempool * crypto_op
Definition: ipsec.h:148
dpdk_crypto_main_t
Definition: ipsec.h:162
dpdk_op_priv_t::encrypt
u8 encrypt
Definition: ipsec.h:67
crypto_dev_t::free_resources
u16 * free_resources
Definition: ipsec.h:99
VLIB_FRAME_SIZE
#define VLIB_FRAME_SIZE
Definition: node.h:368
foreach_dpdk_crypto_input_next
#define foreach_dpdk_crypto_input_next
Definition: ipsec.h:37
crypto_data_t::session_disposal
crypto_session_disposal_t * session_disposal
Definition: ipsec.h:151
dpdk_crypto_main_t::cipher_algs
crypto_alg_t * cipher_algs
Definition: ipsec.h:167
dpdk_op_priv_t::bi
u32 bi
Definition: ipsec.h:66
crypto_dev_t::used_resources
u16 * used_resources
Definition: ipsec.h:100
u16
unsigned short u16
Definition: types.h:57
crypto_data_t::session_h
struct rte_mempool * session_h
Definition: ipsec.h:149
vm
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
Definition: nat44_ei.c:3047
crypto_data_t
Definition: ipsec.h:146
node_index
node node_index
Definition: interface_output.c:420
crypto_session_by_drv_t::dev_mask
u64 dev_mask
Definition: ipsec.h:142
crypto_dev_t::numa
u8 numa
Definition: ipsec.h:104
crypto_resource_t::n_ops
u16 n_ops
Definition: ipsec.h:126
ipsec_sa.h
crypto_data_t::session_drv_failed
u64 * session_drv_failed
Definition: ipsec.h:155
crypto_dev_t::id
u16 id
Definition: ipsec.h:105
crypto_alg_t
Definition: ipsec.h:83
crypto_data_t::session_by_sa_index
uword * session_by_sa_index
Definition: ipsec.h:152
error
Definition: cJSON.c:88
CLIB_ALIGN_MARK
#define CLIB_ALIGN_MARK(name, alignment)
Definition: clib.h:93
i32
signed int i32
Definition: types.h:77
dpdk_gcm_cnt_blk::salt
u32 salt
Definition: ipsec.h:58
dpdk_crypto_main_t::auth_algs
crypto_alg_t * auth_algs
Definition: ipsec.h:168
crypto_worker_main_t
Definition: ipsec.h:74
crypto_drv_t
Definition: ipsec.h:111
is_outbound
bool is_outbound
Definition: ipsec.api:96
DPDK_CRYPTO_N_QUEUE_DESC
#define DPDK_CRYPTO_N_QUEUE_DESC
Definition: ipsec.h:34
crypto_set_icb
static_always_inline void crypto_set_icb(dpdk_gcm_cnt_blk *icb, u32 salt, u32 seq, u32 seq_hi)
Definition: ipsec.h:350
dpdk_op_priv_t::next
u32 next
Definition: ipsec.h:65
crypto_session_disposal_t::ts
u64 ts
Definition: ipsec.h:135
vec_elt_at_index
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
Definition: vec_bootstrap.h:203
offset
struct clib_bihash_value offset
template key/value backing page structure
PREDICT_FALSE
#define PREDICT_FALSE(x)
Definition: clib.h:124
dpdk_gcm_cnt_blk::cnt
u32 cnt
Definition: ipsec.h:60
vec_validate_aligned
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
Definition: vec.h:534
crypto_resource_t::thread_idx
u16 thread_idx
Definition: ipsec.h:119
static_always_inline
#define static_always_inline
Definition: clib.h:112
clib_spinlock_s
Definition: lock.h:51
crypto_auto_placement
void crypto_auto_placement(void)
Definition: ipsec.c:729
crypto_dev_t::name
const char * name
Definition: ipsec.h:106
uword
u64 uword
Definition: types.h:112
crypto_resource_t::remove
u8 remove
Definition: ipsec.h:120
crypto_resource_t::ops
struct rte_crypto_op * ops[VLIB_FRAME_SIZE]
Definition: ipsec.h:128
crypto_alg_t::iv_len
u8 iv_len
Definition: ipsec.h:90
vlib_node_increment_counter
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1244
dpdk_crypto_main_t::drv
crypto_drv_t * drv
Definition: ipsec.h:170
dpdk_crypto_main_t::resource
crypto_resource_t * resource
Definition: ipsec.h:166
crypto_worker_main_t::cipher_resource_idx
u16 cipher_resource_idx[IPSEC_CRYPTO_N_ALG]
Definition: ipsec.h:78
crypto_dev_t::drv_id
u8 drv_id
Definition: ipsec.h:103
IPSEC_CRYPTO_N_ALG
@ IPSEC_CRYPTO_N_ALG
Definition: ipsec_sa.h:43
dpdk_crypto_main_t::session_timeout
u64 session_timeout
Definition: ipsec.h:171
dpdk_crypto_main
dpdk_crypto_main_t dpdk_crypto_main
Definition: ipsec.c:26
CLIB_CACHE_LINE_BYTES
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
ipsec_sa_t::crypto_alg
ipsec_crypto_alg_t crypto_alg
Definition: ipsec_sa.h:217
dpdk_crypto_input_next_t
dpdk_crypto_input_next_t
Definition: ipsec.h:46
crypto_data_t::session_h_failed
u64 session_h_failed
Definition: ipsec.h:154
crypto_op_get_priv_offset
static_always_inline u32 crypto_op_get_priv_offset(void)
Definition: ipsec.h:197
dpdk_op_priv_t
Definition: ipsec.h:63
crypto_op_len
static_always_inline u32 crypto_op_len(void)
Definition: ipsec.h:187
dpdk_op_priv_t::cb
dpdk_gcm_cnt_blk cb
Definition: ipsec.h:69
dpdk_gcm_cnt_blk
Definition: ipsec.h:56
dpdk_crypto_main_t::data
crypto_data_t * data
Definition: ipsec.h:169
crypto_resource_t::dev_id
u8 dev_id
Definition: ipsec.h:122
data
u8 data[128]
Definition: ipsec_types.api:92
get_session_by_drv_and_sa_idx
static_always_inline struct rte_cryptodev_sym_session * get_session_by_drv_and_sa_idx(crypto_data_t *data, u32 drv_id, u32 sa_idx)
Definition: ipsec.h:228
ipsec_sa_t
Definition: ipsec_sa.h:116
crypto_free_ops
static_always_inline void crypto_free_ops(u8 numa, struct rte_crypto_op **ops, u32 n)
Definition: ipsec.h:301
crypto_drv_t::devs
u16 * devs
Definition: ipsec.h:114
dpdk_crypto_main_t::workers_main
crypto_worker_main_t * workers_main
Definition: ipsec.h:164
clib_bihash_value
template key/value backing page structure
Definition: bihash_doc.h:44
crypto_session_disposal_t
Definition: ipsec.h:133
crypto_data_t::crypto_op_get_failed
u64 crypto_op_get_failed
Definition: ipsec.h:153
u64
unsigned long u64
Definition: types.h:89
ASSERT
#define ASSERT(truth)
Definition: error_bootstrap.h:69
cache.h
dpdk_crypto_main_t::dev
crypto_dev_t * dev
Definition: ipsec.h:165
crypto_op_setup
static_always_inline void crypto_op_setup(u8 is_aead, struct rte_mbuf *mb0, struct rte_crypto_op *op, void *session, u32 cipher_off, u32 cipher_len, u32 auth_off, u32 auth_len, u8 *aad, u8 *digest, u64 digest_paddr)
Definition: ipsec.h:358
u32
unsigned int u32
Definition: types.h:88
crypto_worker_main_t::auth_resource_idx
u16 auth_resource_idx[IPSEC_INTEG_N_ALG]
Definition: ipsec.h:79
crypto_alg_t::boundary
u8 boundary
Definition: ipsec.h:92
pad_data
static const u8 pad_data[]
Definition: ipsec.h:177
vec_foreach
#define vec_foreach(var, vec)
Vector iterator.
Definition: vec_bootstrap.h:213
add_session_by_drv_and_sa_idx
static_always_inline void add_session_by_drv_and_sa_idx(struct rte_cryptodev_sym_session *session, crypto_data_t *data, u32 drv_id, u32 sa_idx)
Definition: ipsec.h:216
crypto_alg_t::key_len
u8 key_len
Definition: ipsec.h:89
iv
static u8 iv[]
Definition: aes_cbc.c:24
crypto_alg_t::disabled
u8 disabled
Definition: ipsec.h:93
crypto_alg_t::resources
u8 resources
Definition: ipsec.h:94
dpdk_crypto_main_t::enabled
u8 enabled
Definition: ipsec.h:172
crypto_alg_t::name
char * name
Definition: ipsec.h:86
salt
u32 salt
Definition: ipsec_types.api:136
crypto_worker_main_t::ops
struct rte_crypto_op ** ops
Definition: ipsec.h:77
crypto_resource_t::qp_id
u16 qp_id
Definition: ipsec.h:124
vlib_main_t
Definition: main.h:102
crypto_enqueue_ops
static_always_inline void crypto_enqueue_ops(vlib_main_t *vm, crypto_worker_main_t *cwm, u32 node_index, u32 error, u8 numa, u8 encrypt)
Definition: ipsec.h:313
create_sym_session
clib_error_t * create_sym_session(struct rte_cryptodev_sym_session **session, u32 sa_idx, crypto_resource_t *res, crypto_worker_main_t *cwm, u8 is_outbound)
Definition: ipsec.c:322
u8
unsigned char u8
Definition: types.h:56
clib_error_t
Definition: clib_error.h:21
crypto_worker_main_t::resource_idx
u16 * resource_idx
Definition: ipsec.h:76
crypto_dev_t::features
u64 features
Definition: ipsec.h:108
ipsec_sa_t::integ_alg
ipsec_integ_alg_t integ_alg
Definition: ipsec_sa.h:218
IPSEC_INTEG_N_ALG
@ IPSEC_INTEG_N_ALG
Definition: ipsec_sa.h:70
crypto_dev_t
Definition: ipsec.h:97
crypto_session_by_drv_t::session
struct rte_cryptodev_sym_session * session
Definition: ipsec.h:141
crypto_data_t::lockp
clib_spinlock_t lockp
Definition: ipsec.h:157
pad
u8 pad[3]
log2 (size of the packing page block)
Definition: bihash_doc.h:61
crypto_alloc_ops
static_always_inline i32 crypto_alloc_ops(u8 numa, struct rte_crypto_op **ops, u32 n)
Definition: ipsec.h:285
vnet.h
crypto_resource_t::drv_id
u8 drv_id
Definition: ipsec.h:121
crypto_resource_t::bi
u32 bi[VLIB_FRAME_SIZE]
Definition: ipsec.h:129
dpdk_gcm_cnt_blk::iv
u32 iv[2]
Definition: ipsec.h:59
DPDK_CRYPTO_INPUT_N_NEXT
@ DPDK_CRYPTO_INPUT_N_NEXT
Definition: ipsec.h:51
crypto_dev_t::max_qp
u32 max_qp
Definition: ipsec.h:107
crypto_resource_t::inflights
u16 inflights[2]
Definition: ipsec.h:125
crypto_resource_t
Definition: ipsec.h:117
crypto_op_get_priv
static_always_inline dpdk_op_priv_t * crypto_op_get_priv(struct rte_crypto_op *op)
Definition: ipsec.h:209
type
vl_api_fib_path_type_t type
Definition: fib_types.api:123
crypto_resource_t::numa
u8 numa
Definition: ipsec.h:123
crypto_alg_t::alg
u32 alg
Definition: ipsec.h:88
get_resource
static_always_inline u16 get_resource(crypto_worker_main_t *cwm, ipsec_sa_t *sa)
Definition: ipsec.h:260