FD.io VPP  v21.06-3-gbb25fbf28
Vector Packet Processing
ipsec_tun.h
Go to the documentation of this file.
1 /*
2  * ipsec_tun.h : IPSEC tunnel protection
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/ipsec/ipsec.h>
19 
20 #define foreach_ipsec_protect_flags \
21  _ (L2, 1, "l2") \
22  _ (ENCAPED, 2, "encapped") \
23  _ (ITF, 4, "itf") \
24  _ (FEAT, 8, "feat")
25 
27 {
29 #define _(a,b,c) IPSEC_PROTECT_##a = b,
31 #undef _
32 } __clib_packed ipsec_protect_flags_t;
33 
34 extern u8 *format_ipsec_tun_protect_flags (u8 * s, va_list * args);
35 
36 /**
37  * result of a lookup in the protection bihash
38  */
40 {
45  u8 __pad[3];
47 
48 typedef struct ipsec4_tunnel_kv_t
49 {
50  /*
51  * Key fields: remote ip and spi on incoming packet
52  * all fields in NET byte order
53  */
56 } __clib_packed ipsec4_tunnel_kv_t;
57 
61 
62 static inline void
64  const ip4_address_t * ip, u32 spi)
65 {
66  k->key = (((u64) ip->as_u32) << 32 | spi);
67 }
68 
69 static inline void
71  ip4_address_t * ip, u32 * spi)
72 {
73  *spi = (u32) k->key;
74  (*ip).as_u32 = k->key >> 32;
75 }
76 
77 typedef struct ipsec6_tunnel_kv_t_
78 {
79  /*
80  * Key fields: remote ip and spi on incoming packet
81  * all fields in NET byte order
82  */
83  struct
84  {
85  ip6_address_t remote_ip;
87  u32 __pad;
88  } key;
90 } __clib_packed ipsec6_tunnel_kv_t;
91 
95 
96 extern u8 *format_ipsec4_tunnel_kv (u8 * s, va_list * args);
97 extern u8 *format_ipsec6_tunnel_kv (u8 * s, va_list * args);
98 
99 typedef struct ipsec_ep_t_
100 {
101  ip46_address_t src;
102  ip46_address_t dst;
103 } ipsec_ep_t;
104 
105 #define ITP_MAX_N_SA_IN 4
106 
107 typedef struct ipsec_tun_protect_t_
108 {
109  CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
111 
112  /* not using a vector since we want the memory inline
113  * with this struct */
116 
118 
120 
123 
125 
127 
129 
130 #define FOR_EACH_IPSEC_PROTECT_INPUT_SAI(_itp, _sai, body) \
131 { \
132  u32 __ii; \
133  for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) { \
134  _sai = itp->itp_in_sas[__ii]; \
135  body; \
136  } \
137 }
138 #define FOR_EACH_IPSEC_PROTECT_INPUT_SA(_itp, _sa, body) \
139 { \
140  u32 __ii; \
141  for (__ii = 0; __ii < _itp->itp_n_sa_in; __ii++) { \
142  _sa = ipsec_sa_get(itp->itp_in_sas[__ii]); \
143  body; \
144  } \
145 }
146 
148  const ip_address_t * nh,
149  u32 sa_out, u32 * sa_ins);
150 
151 extern int ipsec_tun_protect_del (u32 sw_if_index, const ip_address_t * nh);
152 
153 typedef walk_rc_t (*ipsec_tun_protect_walk_cb_t) (index_t itpi, void *arg);
155  void *cttx);
158  void *cttx);
159 
160 extern u8 *format_ipsec_tun_protect (u8 * s, va_list * args);
161 extern u8 *format_ipsec_tun_protect_index (u8 * s, va_list * args);
162 
165 
166 /*
167  * DP API
168  */
170 
173 {
175 }
176 
180 {
183 
185 }
186 
187 /*
188  * fd.io coding-style-patch-verification: ON
189  *
190  * Local Variables:
191  * eval: (c-set-style "gnu")
192  * End:
193  */
ipsec.h
ip_address
Definition: ip_types.h:79
ipsec4_tunnel_kv_t::value
ipsec_tun_lkup_result_t value
Definition: ipsec_tun.h:55
ipsec_ep_t
struct ipsec_ep_t_ ipsec_ep_t
ipsec4_tunnel_mk_key
static void ipsec4_tunnel_mk_key(ipsec4_tunnel_kv_t *k, const ip4_address_t *ip, u32 spi)
Definition: ipsec_tun.h:63
ipsec_tun_protect_sa_by_adj_index
index_t * ipsec_tun_protect_sa_by_adj_index
Adj index to TX SA mapping.
Definition: ipsec_tun.c:53
ipsec_tun_protect_t_::itp_tun
ipsec_ep_t itp_tun
Definition: ipsec_tun.h:124
ipsec_tun_lkup_result_t_::tun_index
u32 tun_index
Definition: ipsec_tun.h:41
format_ipsec_tun_protect
u8 * format_ipsec_tun_protect(u8 *s, va_list *args)
Definition: ipsec_format.c:356
ipsec_tun_protect_t_::itp_flags
ipsec_protect_flags_t itp_flags
Definition: ipsec_tun.h:121
STATIC_ASSERT_OFFSET_OF
STATIC_ASSERT_OFFSET_OF(ipsec4_tunnel_kv_t, value, STRUCT_OFFSET_OF(clib_bihash_kv_8_16_t, value))
ipsec_tun_protect_get_sa_out
static index_t ipsec_tun_protect_get_sa_out(adj_index_t ai)
Definition: ipsec_tun.h:179
ipsec_tun_protect_t_::itp_ai
adj_index_t itp_ai
Definition: ipsec_tun.h:122
pool_elt_at_index
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:553
ipsec_tun_protect_update
int ipsec_tun_protect_update(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 *sa_ins)
Definition: ipsec_tun.c:564
ipsec6_tunnel_kv_t_::spi
u32 spi
Definition: ipsec_tun.h:86
STATIC_ASSERT_SIZEOF
STATIC_ASSERT_SIZEOF(ipsec4_tunnel_kv_t, sizeof(clib_bihash_kv_8_16_t))
ipsec_tun_protect_walk
void ipsec_tun_protect_walk(ipsec_tun_protect_walk_cb_t fn, void *cttx)
Definition: ipsec_tun.c:746
ipsec_tun_protect_t_::itp_sw_if_index
u32 itp_sw_if_index
Definition: ipsec_tun.h:117
sa_out
u32 sa_out
Definition: ipsec.api:280
ipsec_tun_register_nodes
void ipsec_tun_register_nodes(ip_address_family_t af)
Definition: ipsec_tun.c:98
ipsec_tun_protect_pool
ipsec_tun_protect_t * ipsec_tun_protect_pool
Pool of tunnel protection objects.
Definition: ipsec_tun.c:43
clib_bihash_kv_24_16_t
Definition: bihash_24_16.h:40
ipsec_tun_lkup_result_t_::sa_index
u32 sa_index
Definition: ipsec_tun.h:42
ipsec_tun_unregister_nodes
void ipsec_tun_unregister_nodes(ip_address_family_t af)
Definition: ipsec_tun.c:115
ipsec_tun_protect_t_::CLIB_CACHE_LINE_ALIGN_MARK
CLIB_CACHE_LINE_ALIGN_MARK(cacheline0)
ipsec_tun_protect_walk_itf
void ipsec_tun_protect_walk_itf(u32 sw_if_index, ipsec_tun_protect_walk_cb_t fn, void *cttx)
Definition: ipsec_tun.c:759
format_ipsec6_tunnel_kv
u8 * format_ipsec6_tunnel_kv(u8 *s, va_list *args)
Definition: ipsec_format.c:400
ipsec4_tunnel_kv_t
Definition: ipsec_tun.h:48
foreach_ipsec_protect_flags
#define foreach_ipsec_protect_flags
Definition: ipsec_tun.h:20
STRUCT_OFFSET_OF
#define STRUCT_OFFSET_OF(t, f)
Definition: clib.h:73
vec_len
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
Definition: vec_bootstrap.h:142
format_ipsec4_tunnel_kv
u8 * format_ipsec4_tunnel_kv(u8 *s, va_list *args)
Definition: ipsec_format.c:382
ipsec_tun_protect_t
struct ipsec_tun_protect_t_ ipsec_tun_protect_t
ipsec_tun_protect_t_
Definition: ipsec_tun.h:107
index_t
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
Definition: dpo.h:43
ipsec_tun_protect_walk_cb_t
walk_rc_t(* ipsec_tun_protect_walk_cb_t)(index_t itpi, void *arg)
Definition: ipsec_tun.h:153
ipsec_tun_protect_t_::itp_crypto
ipsec_ep_t itp_crypto
Definition: ipsec_tun.h:119
ipsec_tun_protect_del
int ipsec_tun_protect_del(u32 sw_if_index, const ip_address_t *nh)
Definition: ipsec_tun.c:714
ipsec_tun_protect_t_::itp_out_sa
index_t itp_out_sa
Definition: ipsec_tun.h:110
ipsec_ep_t_
Definition: ipsec_tun.h:99
IPSEC_PROTECT_NONE
@ IPSEC_PROTECT_NONE
Definition: ipsec_tun.h:28
ipsec_tun_lkup_result_t_
result of a lookup in the protection bihash
Definition: ipsec_tun.h:39
nh
vl_api_fib_path_nh_t nh
Definition: fib_types.api:126
ipsec_ep_t_::dst
ip46_address_t dst
Definition: ipsec_tun.h:102
ip4_address_t
Definition: ip4_packet.h:50
ipsec6_tunnel_kv_t_
Definition: ipsec_tun.h:77
ipsec4_tunnel_extract_key
static void ipsec4_tunnel_extract_key(const ipsec4_tunnel_kv_t *k, ip4_address_t *ip, u32 *spi)
Definition: ipsec_tun.h:70
ipsec_ep_t_::src
ip46_address_t src
Definition: ipsec_tun.h:101
ipsec_tun_lkup_result_t
struct ipsec_tun_lkup_result_t_ ipsec_tun_lkup_result_t
result of a lookup in the protection bihash
ipsec4_tunnel_kv_t
struct ipsec4_tunnel_kv_t ipsec4_tunnel_kv_t
ipsec6_tunnel_kv_t
struct ipsec6_tunnel_kv_t_ ipsec6_tunnel_kv_t
ipsec4_tunnel_kv_t::key
u64 key
Definition: ipsec_tun.h:54
index
u32 index
Definition: flow_types.api:221
always_inline
#define always_inline
Definition: rdma_mlx5dv.h:23
ipsec_protect_flags_t_
ipsec_protect_flags_t_
Definition: ipsec_tun.h:26
clib_bihash_kv_8_16_t
8 octet key, 8 octet key value pair
Definition: bihash_8_16.h:41
spi
u32 spi
Definition: flow_types.api:140
u64
unsigned long u64
Definition: types.h:89
ASSERT
#define ASSERT(truth)
Definition: error_bootstrap.h:69
u32
unsigned int u32
Definition: types.h:88
ipsec_tun_protect_t_::itp_in_sas
index_t itp_in_sas[ITP_MAX_N_SA_IN]
Definition: ipsec_tun.h:115
ipsec6_tunnel_kv_t_::remote_ip
ip6_address_t remote_ip
Definition: ipsec_tun.h:85
ipsec_tun_protect_t_::itp_key
ip_address_t * itp_key
Definition: ipsec_tun.h:126
value
u8 value
Definition: qos.api:54
adj_index_t
u32 adj_index_t
An index for adjacencies.
Definition: adj_types.h:30
ITP_MAX_N_SA_IN
#define ITP_MAX_N_SA_IN
Definition: ipsec_tun.h:105
u8
unsigned char u8
Definition: types.h:56
ip
vl_api_address_t ip
Definition: l2.api:558
ipsec_protect_flags_t
enum ipsec_protect_flags_t_ ipsec_protect_flags_t
ipsec_tun_lkup_result_t_::sw_if_index
u32 sw_if_index
Definition: ipsec_tun.h:43
ipsec_tun_protect_get
static ipsec_tun_protect_t * ipsec_tun_protect_get(u32 index)
Definition: ipsec_tun.h:172
format_ipsec_tun_protect_index
u8 * format_ipsec_tun_protect_index(u8 *s, va_list *args)
Definition: ipsec_format.c:326
INDEX_INVALID
#define INDEX_INVALID
Invalid index - used when no index is known blazoned capitals INVALID speak volumes where ~0 does not...
Definition: dpo.h:49
sw_if_index
vl_api_interface_index_t sw_if_index
Definition: wireguard.api:34
ipsec6_tunnel_kv_t_::value
ipsec_tun_lkup_result_t value
Definition: ipsec_tun.h:89
walk_rc_t
enum walk_rc_t_ walk_rc_t
Walk return code.
ipsec6_tunnel_kv_t_::key
struct ipsec6_tunnel_kv_t_::@455 key
ipsec_tun_lkup_result_t_::flags
ipsec_protect_flags_t flags
Definition: ipsec_tun.h:44
format_ipsec_tun_protect_flags
u8 * format_ipsec_tun_protect_flags(u8 *s, va_list *args)
Definition: ipsec_format.c:340
ipsec_tun_protect_t_::itp_n_sa_in
u32 itp_n_sa_in
Definition: ipsec_tun.h:114
ip_address_family_t
enum ip_address_family_t_ ip_address_family_t