Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 2 | * ipsec.c : IPSEC module functions |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | #include <vnet/interface.h> |
Florin Coras | b040f98 | 2020-10-20 14:59:43 -0700 | [diff] [blame] | 22 | #include <vnet/udp/udp_local.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 23 | |
| 24 | #include <vnet/ipsec/ipsec.h> |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 25 | #include <vnet/ipsec/esp.h> |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 26 | #include <vnet/ipsec/ah.h> |
Zachary Leaf | b2d3678 | 2021-07-27 05:18:47 -0500 | [diff] [blame] | 27 | #include <vnet/ipsec/ipsec_tun.h> |
Neale Ranns | 6fdcc3d | 2021-10-08 07:30:47 +0000 | [diff] [blame] | 28 | #include <vnet/ipsec/ipsec_itf.h> |
Piotr Bronowski | 4da8a63 | 2022-05-06 13:52:24 +0000 | [diff] [blame] | 29 | #include <vnet/ipsec/ipsec_spd_fp_lookup.h> |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 30 | |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 31 | /* Flow cache is sized for 1 million flows with a load factor of .25. |
| 32 | */ |
| 33 | #define IPSEC4_OUT_SPD_DEFAULT_HASH_NUM_BUCKETS (1 << 22) |
| 34 | |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 35 | /* Flow cache is sized for 1 million flows with a load factor of .25. |
| 36 | */ |
| 37 | #define IPSEC4_SPD_DEFAULT_HASH_NUM_BUCKETS (1 << 22) |
| 38 | |
Dave Wallace | 71612d6 | 2017-10-24 01:32:41 -0400 | [diff] [blame] | 39 | ipsec_main_t ipsec_main; |
Piotr Bronowski | 4da8a63 | 2022-05-06 13:52:24 +0000 | [diff] [blame] | 40 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 41 | esp_async_post_next_t esp_encrypt_async_next; |
| 42 | esp_async_post_next_t esp_decrypt_async_next; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 43 | |
Benoît Ganne | 98ca76a | 2022-04-11 18:51:25 +0200 | [diff] [blame] | 44 | clib_error_t * |
| 45 | ipsec_register_next_header (vlib_main_t *vm, u8 next_header, |
| 46 | const char *next_node) |
| 47 | { |
| 48 | ipsec_main_t *im = &ipsec_main; |
| 49 | const vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) next_node); |
| 50 | /* -post nodes (eg. esp4-decrypt-post) are siblings of non-post nodes (eg. |
| 51 | * esp4-decrypt) and will therefore have the same next index */ |
| 52 | const vlib_node_t *esp_decrypt_nodes[] = { |
| 53 | vlib_get_node (vm, im->esp4_decrypt_node_index), |
| 54 | vlib_get_node (vm, im->esp6_decrypt_node_index), |
| 55 | vlib_get_node (vm, im->esp4_decrypt_tun_node_index), |
| 56 | vlib_get_node (vm, im->esp6_decrypt_tun_node_index), |
| 57 | }; |
| 58 | uword slot, max; |
| 59 | int i; |
| 60 | |
| 61 | /* looks for a next_index value that we can use for all esp decrypt nodes to |
| 62 | * avoid maintaining different next index arrays... */ |
| 63 | |
| 64 | slot = vlib_node_get_next (vm, esp_decrypt_nodes[0]->index, node->index); |
| 65 | max = vec_len (esp_decrypt_nodes[0]->next_nodes); |
| 66 | for (i = 1; i < ARRAY_LEN (esp_decrypt_nodes); i++) |
| 67 | { |
| 68 | /* if next node already exists, check it shares the same next_index */ |
| 69 | if (slot != |
| 70 | vlib_node_get_next (vm, esp_decrypt_nodes[i]->index, node->index)) |
| 71 | return clib_error_return ( |
| 72 | 0, "next node already exists with different next index"); |
| 73 | /* compute a suitable slot from the max of all nodes next index */ |
| 74 | max = clib_max (max, vec_len (esp_decrypt_nodes[i]->next_nodes)); |
| 75 | } |
| 76 | |
| 77 | if (~0 == slot) |
| 78 | { |
| 79 | /* next node not there yet, add it using the computed max */ |
| 80 | slot = max; |
| 81 | for (i = 0; i < ARRAY_LEN (esp_decrypt_nodes); i++) |
| 82 | vlib_node_add_next_with_slot (vm, esp_decrypt_nodes[i]->index, |
| 83 | node->index, slot); |
| 84 | } |
| 85 | |
| 86 | im->next_header_registrations[next_header] = slot; |
| 87 | return 0; |
| 88 | } |
| 89 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 90 | static clib_error_t * |
Klement Sekera | 4fd5a9d | 2019-01-30 11:11:23 +0100 | [diff] [blame] | 91 | ipsec_check_ah_support (ipsec_sa_t * sa) |
| 92 | { |
Neale Ranns | ece2ae0 | 2019-06-21 12:44:11 +0000 | [diff] [blame] | 93 | ipsec_main_t *im = &ipsec_main; |
| 94 | |
Klement Sekera | 4fd5a9d | 2019-01-30 11:11:23 +0100 | [diff] [blame] | 95 | if (sa->integ_alg == IPSEC_INTEG_ALG_NONE) |
| 96 | return clib_error_return (0, "unsupported none integ-alg"); |
Neale Ranns | ece2ae0 | 2019-06-21 12:44:11 +0000 | [diff] [blame] | 97 | |
| 98 | if (!vnet_crypto_is_set_handler (im->integ_algs[sa->integ_alg].alg)) |
| 99 | return clib_error_return (0, "No crypto engine support for %U", |
| 100 | format_ipsec_integ_alg, sa->integ_alg); |
| 101 | |
Klement Sekera | 4fd5a9d | 2019-01-30 11:11:23 +0100 | [diff] [blame] | 102 | return 0; |
| 103 | } |
| 104 | |
| 105 | static clib_error_t * |
| 106 | ipsec_check_esp_support (ipsec_sa_t * sa) |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 107 | { |
Neale Ranns | ece2ae0 | 2019-06-21 12:44:11 +0000 | [diff] [blame] | 108 | ipsec_main_t *im = &ipsec_main; |
| 109 | |
| 110 | if (IPSEC_INTEG_ALG_NONE != sa->integ_alg) |
| 111 | { |
| 112 | if (!vnet_crypto_is_set_handler (im->integ_algs[sa->integ_alg].alg)) |
| 113 | return clib_error_return (0, "No crypto engine support for %U", |
| 114 | format_ipsec_integ_alg, sa->integ_alg); |
| 115 | } |
| 116 | if (IPSEC_CRYPTO_ALG_NONE != sa->crypto_alg) |
| 117 | { |
| 118 | if (!vnet_crypto_is_set_handler (im->crypto_algs[sa->crypto_alg].alg)) |
| 119 | return clib_error_return (0, "No crypto engine support for %U", |
| 120 | format_ipsec_crypto_alg, sa->crypto_alg); |
| 121 | } |
| 122 | |
| 123 | return (0); |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 124 | } |
| 125 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 126 | clib_error_t * |
| 127 | ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, u8 is_add) |
| 128 | { |
| 129 | ipsec_ah_backend_t *ah = |
| 130 | pool_elt_at_index (im->ah_backends, im->ah_current_backend); |
| 131 | if (ah->add_del_sa_sess_cb) |
| 132 | { |
| 133 | clib_error_t *err = ah->add_del_sa_sess_cb (sa_index, is_add); |
| 134 | if (err) |
| 135 | return err; |
| 136 | } |
| 137 | ipsec_esp_backend_t *esp = |
| 138 | pool_elt_at_index (im->esp_backends, im->esp_current_backend); |
| 139 | if (esp->add_del_sa_sess_cb) |
| 140 | { |
| 141 | clib_error_t *err = esp->add_del_sa_sess_cb (sa_index, is_add); |
| 142 | if (err) |
| 143 | return err; |
| 144 | } |
| 145 | return 0; |
| 146 | } |
| 147 | |
| 148 | clib_error_t * |
| 149 | ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa) |
| 150 | { |
| 151 | clib_error_t *error = 0; |
Matthew Smith | 461caa5 | 2018-12-21 11:53:16 -0600 | [diff] [blame] | 152 | |
| 153 | if (PREDICT_FALSE (sa->protocol == IPSEC_PROTOCOL_AH)) |
| 154 | { |
| 155 | ipsec_ah_backend_t *ah = |
| 156 | pool_elt_at_index (im->ah_backends, im->ah_current_backend); |
| 157 | ASSERT (ah->check_support_cb); |
| 158 | error = ah->check_support_cb (sa); |
| 159 | } |
| 160 | else |
| 161 | { |
| 162 | ipsec_esp_backend_t *esp = |
| 163 | pool_elt_at_index (im->esp_backends, im->esp_current_backend); |
| 164 | ASSERT (esp->check_support_cb); |
| 165 | error = esp->check_support_cb (sa); |
| 166 | } |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 167 | return error; |
| 168 | } |
| 169 | |
| 170 | |
| 171 | static void |
| 172 | ipsec_add_node (vlib_main_t * vm, const char *node_name, |
| 173 | const char *prev_node_name, u32 * out_node_index, |
| 174 | u32 * out_next_index) |
| 175 | { |
| 176 | vlib_node_t *prev_node, *node; |
| 177 | prev_node = vlib_get_node_by_name (vm, (u8 *) prev_node_name); |
| 178 | ASSERT (prev_node); |
| 179 | node = vlib_get_node_by_name (vm, (u8 *) node_name); |
| 180 | ASSERT (node); |
| 181 | *out_node_index = node->index; |
| 182 | *out_next_index = vlib_node_add_next (vm, prev_node->index, node->index); |
| 183 | } |
| 184 | |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 185 | static inline uword |
| 186 | ipsec_udp_registration_key (u16 port, u8 is_ip4) |
| 187 | { |
| 188 | uword key = (is_ip4) ? AF_IP4 : AF_IP6; |
| 189 | |
| 190 | key |= (uword) (port << 16); |
| 191 | return key; |
| 192 | } |
| 193 | |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 194 | void |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 195 | ipsec_unregister_udp_port (u16 port, u8 is_ip4) |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 196 | { |
| 197 | ipsec_main_t *im = &ipsec_main; |
| 198 | u32 n_regs; |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 199 | uword *p, key; |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 200 | |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 201 | key = ipsec_udp_registration_key (port, is_ip4); |
| 202 | p = hash_get (im->udp_port_registrations, key); |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 203 | |
| 204 | ASSERT (p); |
| 205 | |
| 206 | n_regs = p[0]; |
| 207 | |
| 208 | if (0 == --n_regs) |
| 209 | { |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 210 | udp_unregister_dst_port (vlib_get_main (), port, is_ip4); |
| 211 | hash_unset (im->udp_port_registrations, key); |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 212 | } |
| 213 | else |
| 214 | { |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 215 | hash_unset (im->udp_port_registrations, key); |
| 216 | hash_set (im->udp_port_registrations, key, n_regs); |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 217 | } |
| 218 | } |
| 219 | |
| 220 | void |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 221 | ipsec_register_udp_port (u16 port, u8 is_ip4) |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 222 | { |
| 223 | ipsec_main_t *im = &ipsec_main; |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 224 | u32 n_regs, node_index; |
| 225 | uword *p, key; |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 226 | |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 227 | key = ipsec_udp_registration_key (port, is_ip4); |
| 228 | node_index = |
| 229 | (is_ip4) ? ipsec4_tun_input_node.index : ipsec6_tun_input_node.index; |
| 230 | p = hash_get (im->udp_port_registrations, key); |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 231 | |
| 232 | n_regs = (p ? p[0] : 0); |
| 233 | |
| 234 | if (0 == n_regs++) |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 235 | udp_register_dst_port (vlib_get_main (), port, node_index, is_ip4); |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 236 | |
Matthew Smith | 6f1eb48 | 2022-08-09 22:19:38 +0000 | [diff] [blame^] | 237 | hash_unset (im->udp_port_registrations, key); |
| 238 | hash_set (im->udp_port_registrations, key, n_regs); |
Neale Ranns | abc5660 | 2020-04-01 09:45:23 +0000 | [diff] [blame] | 239 | } |
| 240 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 241 | u32 |
| 242 | ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im, |
| 243 | const char *name, |
| 244 | const char *ah4_encrypt_node_name, |
| 245 | const char *ah4_decrypt_node_name, |
| 246 | const char *ah6_encrypt_node_name, |
| 247 | const char *ah6_decrypt_node_name, |
| 248 | check_support_cb_t ah_check_support_cb, |
| 249 | add_del_sa_sess_cb_t ah_add_del_sa_sess_cb) |
| 250 | { |
| 251 | ipsec_ah_backend_t *b; |
| 252 | pool_get (im->ah_backends, b); |
Kingwel Xie | 561d1ca | 2019-03-05 22:56:17 -0500 | [diff] [blame] | 253 | b->name = format (0, "%s%c", name, 0); |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 254 | |
Pierre Pfister | 057b356 | 2018-12-10 17:01:01 +0100 | [diff] [blame] | 255 | ipsec_add_node (vm, ah4_encrypt_node_name, "ipsec4-output-feature", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 256 | &b->ah4_encrypt_node_index, &b->ah4_encrypt_next_index); |
Pierre Pfister | 057b356 | 2018-12-10 17:01:01 +0100 | [diff] [blame] | 257 | ipsec_add_node (vm, ah4_decrypt_node_name, "ipsec4-input-feature", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 258 | &b->ah4_decrypt_node_index, &b->ah4_decrypt_next_index); |
Pierre Pfister | 057b356 | 2018-12-10 17:01:01 +0100 | [diff] [blame] | 259 | ipsec_add_node (vm, ah6_encrypt_node_name, "ipsec6-output-feature", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 260 | &b->ah6_encrypt_node_index, &b->ah6_encrypt_next_index); |
Pierre Pfister | 057b356 | 2018-12-10 17:01:01 +0100 | [diff] [blame] | 261 | ipsec_add_node (vm, ah6_decrypt_node_name, "ipsec6-input-feature", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 262 | &b->ah6_decrypt_node_index, &b->ah6_decrypt_next_index); |
| 263 | |
| 264 | b->check_support_cb = ah_check_support_cb; |
| 265 | b->add_del_sa_sess_cb = ah_add_del_sa_sess_cb; |
| 266 | return b - im->ah_backends; |
| 267 | } |
| 268 | |
| 269 | u32 |
Neale Ranns | 4a58e49 | 2020-12-21 13:19:10 +0000 | [diff] [blame] | 270 | ipsec_register_esp_backend ( |
| 271 | vlib_main_t *vm, ipsec_main_t *im, const char *name, |
| 272 | const char *esp4_encrypt_node_name, const char *esp4_encrypt_node_tun_name, |
| 273 | const char *esp4_decrypt_node_name, const char *esp4_decrypt_tun_node_name, |
| 274 | const char *esp6_encrypt_node_name, const char *esp6_encrypt_node_tun_name, |
| 275 | const char *esp6_decrypt_node_name, const char *esp6_decrypt_tun_node_name, |
| 276 | const char *esp_mpls_encrypt_node_tun_name, |
| 277 | check_support_cb_t esp_check_support_cb, |
| 278 | add_del_sa_sess_cb_t esp_add_del_sa_sess_cb, |
| 279 | enable_disable_cb_t enable_disable_cb) |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 280 | { |
| 281 | ipsec_esp_backend_t *b; |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 282 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 283 | pool_get (im->esp_backends, b); |
Kingwel Xie | 561d1ca | 2019-03-05 22:56:17 -0500 | [diff] [blame] | 284 | b->name = format (0, "%s%c", name, 0); |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 285 | |
Pierre Pfister | 057b356 | 2018-12-10 17:01:01 +0100 | [diff] [blame] | 286 | ipsec_add_node (vm, esp4_encrypt_node_name, "ipsec4-output-feature", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 287 | &b->esp4_encrypt_node_index, &b->esp4_encrypt_next_index); |
Pierre Pfister | 057b356 | 2018-12-10 17:01:01 +0100 | [diff] [blame] | 288 | ipsec_add_node (vm, esp4_decrypt_node_name, "ipsec4-input-feature", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 289 | &b->esp4_decrypt_node_index, &b->esp4_decrypt_next_index); |
Pierre Pfister | 057b356 | 2018-12-10 17:01:01 +0100 | [diff] [blame] | 290 | ipsec_add_node (vm, esp6_encrypt_node_name, "ipsec6-output-feature", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 291 | &b->esp6_encrypt_node_index, &b->esp6_encrypt_next_index); |
Pierre Pfister | 057b356 | 2018-12-10 17:01:01 +0100 | [diff] [blame] | 292 | ipsec_add_node (vm, esp6_decrypt_node_name, "ipsec6-input-feature", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 293 | &b->esp6_decrypt_node_index, &b->esp6_decrypt_next_index); |
Neale Ranns | 7ec120e | 2020-01-21 04:58:02 +0000 | [diff] [blame] | 294 | ipsec_add_node (vm, esp4_decrypt_tun_node_name, "ipsec4-tun-input", |
| 295 | &b->esp4_decrypt_tun_node_index, |
| 296 | &b->esp4_decrypt_tun_next_index); |
| 297 | ipsec_add_node (vm, esp6_decrypt_tun_node_name, "ipsec6-tun-input", |
| 298 | &b->esp6_decrypt_tun_node_index, |
| 299 | &b->esp6_decrypt_tun_next_index); |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 300 | |
Neale Ranns | 4ec36c5 | 2020-03-31 09:21:29 -0400 | [diff] [blame] | 301 | b->esp6_encrypt_tun_node_index = |
| 302 | vlib_get_node_by_name (vm, (u8 *) esp6_encrypt_node_tun_name)->index; |
Neale Ranns | 4a58e49 | 2020-12-21 13:19:10 +0000 | [diff] [blame] | 303 | b->esp_mpls_encrypt_tun_node_index = |
| 304 | vlib_get_node_by_name (vm, (u8 *) esp_mpls_encrypt_node_tun_name)->index; |
Neale Ranns | 4ec36c5 | 2020-03-31 09:21:29 -0400 | [diff] [blame] | 305 | b->esp4_encrypt_tun_node_index = |
| 306 | vlib_get_node_by_name (vm, (u8 *) esp4_encrypt_node_tun_name)->index; |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 307 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 308 | b->check_support_cb = esp_check_support_cb; |
| 309 | b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb; |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 310 | b->enable_disable_cb = enable_disable_cb; |
| 311 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 312 | return b - im->esp_backends; |
| 313 | } |
| 314 | |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 315 | clib_error_t * |
| 316 | ipsec_rsc_in_use (ipsec_main_t * im) |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 317 | { |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 318 | /* return an error is crypto resource are in use */ |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 319 | if (pool_elts (ipsec_sa_pool) > 0) |
| 320 | return clib_error_return (0, "%d SA entries configured", |
| 321 | pool_elts (ipsec_sa_pool)); |
Neale Ranns | 6fdcc3d | 2021-10-08 07:30:47 +0000 | [diff] [blame] | 322 | if (ipsec_itf_count () > 0) |
| 323 | return clib_error_return (0, "%d IPSec interface configured", |
| 324 | ipsec_itf_count ()); |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 325 | |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 326 | return (NULL); |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 327 | } |
| 328 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 329 | int |
| 330 | ipsec_select_ah_backend (ipsec_main_t * im, u32 backend_idx) |
| 331 | { |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 332 | if (ipsec_rsc_in_use (im)) |
| 333 | return VNET_API_ERROR_RSRC_IN_USE; |
| 334 | |
| 335 | if (pool_is_free_index (im->ah_backends, backend_idx)) |
| 336 | return VNET_API_ERROR_INVALID_VALUE; |
| 337 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 338 | ipsec_ah_backend_t *b = pool_elt_at_index (im->ah_backends, backend_idx); |
| 339 | im->ah_current_backend = backend_idx; |
| 340 | im->ah4_encrypt_node_index = b->ah4_encrypt_node_index; |
| 341 | im->ah4_decrypt_node_index = b->ah4_decrypt_node_index; |
| 342 | im->ah4_encrypt_next_index = b->ah4_encrypt_next_index; |
| 343 | im->ah4_decrypt_next_index = b->ah4_decrypt_next_index; |
| 344 | im->ah6_encrypt_node_index = b->ah6_encrypt_node_index; |
| 345 | im->ah6_decrypt_node_index = b->ah6_decrypt_node_index; |
| 346 | im->ah6_encrypt_next_index = b->ah6_encrypt_next_index; |
| 347 | im->ah6_decrypt_next_index = b->ah6_decrypt_next_index; |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 348 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 349 | return 0; |
| 350 | } |
| 351 | |
| 352 | int |
| 353 | ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx) |
| 354 | { |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 355 | if (ipsec_rsc_in_use (im)) |
| 356 | return VNET_API_ERROR_RSRC_IN_USE; |
| 357 | |
| 358 | if (pool_is_free_index (im->esp_backends, backend_idx)) |
| 359 | return VNET_API_ERROR_INVALID_VALUE; |
| 360 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 361 | /* disable current backend */ |
| 362 | if (im->esp_current_backend != ~0) |
| 363 | { |
| 364 | ipsec_esp_backend_t *cb = pool_elt_at_index (im->esp_backends, |
| 365 | im->esp_current_backend); |
| 366 | if (cb->enable_disable_cb) |
| 367 | { |
| 368 | if ((cb->enable_disable_cb) (0) != 0) |
| 369 | return -1; |
| 370 | } |
| 371 | } |
| 372 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 373 | ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx); |
| 374 | im->esp_current_backend = backend_idx; |
| 375 | im->esp4_encrypt_node_index = b->esp4_encrypt_node_index; |
| 376 | im->esp4_decrypt_node_index = b->esp4_decrypt_node_index; |
| 377 | im->esp4_encrypt_next_index = b->esp4_encrypt_next_index; |
| 378 | im->esp4_decrypt_next_index = b->esp4_decrypt_next_index; |
| 379 | im->esp6_encrypt_node_index = b->esp6_encrypt_node_index; |
| 380 | im->esp6_decrypt_node_index = b->esp6_decrypt_node_index; |
| 381 | im->esp6_encrypt_next_index = b->esp6_encrypt_next_index; |
| 382 | im->esp6_decrypt_next_index = b->esp6_decrypt_next_index; |
Neale Ranns | 7ec120e | 2020-01-21 04:58:02 +0000 | [diff] [blame] | 383 | im->esp4_decrypt_tun_node_index = b->esp4_decrypt_tun_node_index; |
| 384 | im->esp4_decrypt_tun_next_index = b->esp4_decrypt_tun_next_index; |
| 385 | im->esp6_decrypt_tun_node_index = b->esp6_decrypt_tun_node_index; |
| 386 | im->esp6_decrypt_tun_next_index = b->esp6_decrypt_tun_next_index; |
Neale Ranns | 4ec36c5 | 2020-03-31 09:21:29 -0400 | [diff] [blame] | 387 | im->esp4_encrypt_tun_node_index = b->esp4_encrypt_tun_node_index; |
| 388 | im->esp6_encrypt_tun_node_index = b->esp6_encrypt_tun_node_index; |
Neale Ranns | 4a58e49 | 2020-12-21 13:19:10 +0000 | [diff] [blame] | 389 | im->esp_mpls_encrypt_tun_node_index = b->esp_mpls_encrypt_tun_node_index; |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 390 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 391 | if (b->enable_disable_cb) |
| 392 | { |
| 393 | if ((b->enable_disable_cb) (1) != 0) |
| 394 | return -1; |
| 395 | } |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 396 | return 0; |
| 397 | } |
| 398 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 399 | void |
| 400 | ipsec_set_async_mode (u32 is_enabled) |
| 401 | { |
| 402 | ipsec_main_t *im = &ipsec_main; |
| 403 | ipsec_sa_t *sa; |
| 404 | |
Neale Ranns | f16e9a5 | 2021-02-25 19:09:24 +0000 | [diff] [blame] | 405 | vnet_crypto_request_async_mode (is_enabled); |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 406 | |
| 407 | im->async_mode = is_enabled; |
| 408 | |
Neale Ranns | f16e9a5 | 2021-02-25 19:09:24 +0000 | [diff] [blame] | 409 | /* change SA crypto op data */ |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 410 | pool_foreach (sa, ipsec_sa_pool) |
| 411 | { |
| 412 | sa->crypto_op_data = |
Neale Ranns | f16e9a5 | 2021-02-25 19:09:24 +0000 | [diff] [blame] | 413 | (is_enabled ? sa->async_op_data.data : sa->sync_op_data.data); |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 414 | } |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 415 | } |
| 416 | |
| 417 | static void |
| 418 | crypto_engine_backend_register_post_node (vlib_main_t * vm) |
| 419 | { |
| 420 | esp_async_post_next_t *eit; |
| 421 | esp_async_post_next_t *dit; |
| 422 | |
| 423 | eit = &esp_encrypt_async_next; |
| 424 | eit->esp4_post_next = |
| 425 | vnet_crypto_register_post_node (vm, "esp4-encrypt-post"); |
| 426 | eit->esp6_post_next = |
| 427 | vnet_crypto_register_post_node (vm, "esp6-encrypt-post"); |
| 428 | eit->esp4_tun_post_next = |
| 429 | vnet_crypto_register_post_node (vm, "esp4-encrypt-tun-post"); |
| 430 | eit->esp6_tun_post_next = |
| 431 | vnet_crypto_register_post_node (vm, "esp6-encrypt-tun-post"); |
Neale Ranns | 4a58e49 | 2020-12-21 13:19:10 +0000 | [diff] [blame] | 432 | eit->esp_mpls_tun_post_next = |
| 433 | vnet_crypto_register_post_node (vm, "esp-mpls-encrypt-tun-post"); |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 434 | |
| 435 | dit = &esp_decrypt_async_next; |
| 436 | dit->esp4_post_next = |
| 437 | vnet_crypto_register_post_node (vm, "esp4-decrypt-post"); |
| 438 | dit->esp6_post_next = |
| 439 | vnet_crypto_register_post_node (vm, "esp6-decrypt-post"); |
| 440 | dit->esp4_tun_post_next = |
| 441 | vnet_crypto_register_post_node (vm, "esp4-decrypt-tun-post"); |
| 442 | dit->esp6_tun_post_next = |
| 443 | vnet_crypto_register_post_node (vm, "esp6-decrypt-tun-post"); |
| 444 | } |
| 445 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 446 | static clib_error_t * |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 447 | ipsec_init (vlib_main_t * vm) |
| 448 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 449 | clib_error_t *error; |
| 450 | ipsec_main_t *im = &ipsec_main; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 451 | ipsec_main_crypto_alg_t *a; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 452 | |
Dave Barach | 0dd9165 | 2019-05-05 13:34:28 -0400 | [diff] [blame] | 453 | /* Backend registration requires the feature arcs to be set up */ |
| 454 | if ((error = vlib_call_init_function (vm, vnet_feature_init))) |
| 455 | return (error); |
| 456 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 457 | im->vnet_main = vnet_get_main (); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 458 | im->vlib_main = vm; |
| 459 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 460 | im->spd_index_by_spd_id = hash_create (0, sizeof (uword)); |
| 461 | im->sa_index_by_sa_id = hash_create (0, sizeof (uword)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 462 | im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword)); |
| 463 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 464 | vlib_node_t *node = vlib_get_node_by_name (vm, (u8 *) "error-drop"); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 465 | ASSERT (node); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 466 | im->error_drop_node_index = node->index; |
| 467 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 468 | im->ah_current_backend = ~0; |
| 469 | im->esp_current_backend = ~0; |
| 470 | |
Neale Ranns | d1a5b2d | 2019-05-16 17:09:28 +0000 | [diff] [blame] | 471 | u32 idx = ipsec_register_ah_backend (vm, im, "crypto engine backend", |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 472 | "ah4-encrypt", |
| 473 | "ah4-decrypt", |
| 474 | "ah6-encrypt", |
| 475 | "ah6-decrypt", |
Klement Sekera | 4fd5a9d | 2019-01-30 11:11:23 +0100 | [diff] [blame] | 476 | ipsec_check_ah_support, |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 477 | NULL); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 478 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 479 | im->ah_default_backend = idx; |
| 480 | int rv = ipsec_select_ah_backend (im, idx); |
| 481 | ASSERT (0 == rv); |
| 482 | (void) (rv); // avoid warning |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 483 | |
Neale Ranns | 4a58e49 | 2020-12-21 13:19:10 +0000 | [diff] [blame] | 484 | idx = ipsec_register_esp_backend ( |
| 485 | vm, im, "crypto engine backend", "esp4-encrypt", "esp4-encrypt-tun", |
| 486 | "esp4-decrypt", "esp4-decrypt-tun", "esp6-encrypt", "esp6-encrypt-tun", |
| 487 | "esp6-decrypt", "esp6-decrypt-tun", "esp-mpls-encrypt-tun", |
| 488 | ipsec_check_esp_support, NULL, crypto_dispatch_enable_disable); |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 489 | im->esp_default_backend = idx; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 490 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 491 | rv = ipsec_select_esp_backend (im, idx); |
| 492 | ASSERT (0 == rv); |
| 493 | (void) (rv); // avoid warning |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 494 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 495 | if ((error = vlib_call_init_function (vm, ipsec_cli_init))) |
| 496 | return error; |
| 497 | |
Piotr Bronowski | 86f8208 | 2022-07-08 12:45:05 +0000 | [diff] [blame] | 498 | im->ipv4_fp_spd_is_enabled = 0; |
| 499 | im->ipv6_fp_spd_is_enabled = 0; |
| 500 | |
Piotr Bronowski | 0464310 | 2022-05-10 13:18:22 +0000 | [diff] [blame] | 501 | im->fp_lookup_hash_buckets = IPSEC_FP_HASH_LOOKUP_HASH_BUCKETS; |
| 502 | |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 503 | vec_validate (im->crypto_algs, IPSEC_CRYPTO_N_ALG - 1); |
| 504 | |
Neale Ranns | 2cdcd0c | 2019-08-27 12:26:14 +0000 | [diff] [blame] | 505 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_NONE; |
| 506 | a->enc_op_id = VNET_CRYPTO_OP_NONE; |
| 507 | a->dec_op_id = VNET_CRYPTO_OP_NONE; |
| 508 | a->alg = VNET_CRYPTO_ALG_NONE; |
| 509 | a->iv_size = 0; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 510 | a->block_align = 1; |
Neale Ranns | 2cdcd0c | 2019-08-27 12:26:14 +0000 | [diff] [blame] | 511 | |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 512 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_DES_CBC; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 513 | a->enc_op_id = VNET_CRYPTO_OP_DES_CBC_ENC; |
| 514 | a->dec_op_id = VNET_CRYPTO_OP_DES_CBC_DEC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 515 | a->alg = VNET_CRYPTO_ALG_DES_CBC; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 516 | a->iv_size = a->block_align = 8; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 517 | |
| 518 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_3DES_CBC; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 519 | a->enc_op_id = VNET_CRYPTO_OP_3DES_CBC_ENC; |
| 520 | a->dec_op_id = VNET_CRYPTO_OP_3DES_CBC_DEC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 521 | a->alg = VNET_CRYPTO_ALG_3DES_CBC; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 522 | a->iv_size = a->block_align = 8; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 523 | |
| 524 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_128; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 525 | a->enc_op_id = VNET_CRYPTO_OP_AES_128_CBC_ENC; |
| 526 | a->dec_op_id = VNET_CRYPTO_OP_AES_128_CBC_DEC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 527 | a->alg = VNET_CRYPTO_ALG_AES_128_CBC; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 528 | a->iv_size = a->block_align = 16; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 529 | |
| 530 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_192; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 531 | a->enc_op_id = VNET_CRYPTO_OP_AES_192_CBC_ENC; |
| 532 | a->dec_op_id = VNET_CRYPTO_OP_AES_192_CBC_DEC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 533 | a->alg = VNET_CRYPTO_ALG_AES_192_CBC; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 534 | a->iv_size = a->block_align = 16; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 535 | |
| 536 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CBC_256; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 537 | a->enc_op_id = VNET_CRYPTO_OP_AES_256_CBC_ENC; |
| 538 | a->dec_op_id = VNET_CRYPTO_OP_AES_256_CBC_DEC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 539 | a->alg = VNET_CRYPTO_ALG_AES_256_CBC; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 540 | a->iv_size = a->block_align = 16; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 541 | |
Benoît Ganne | 490b927 | 2021-01-22 18:03:09 +0100 | [diff] [blame] | 542 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CTR_128; |
| 543 | a->enc_op_id = VNET_CRYPTO_OP_AES_128_CTR_ENC; |
| 544 | a->dec_op_id = VNET_CRYPTO_OP_AES_128_CTR_DEC; |
| 545 | a->alg = VNET_CRYPTO_ALG_AES_128_CTR; |
| 546 | a->iv_size = 8; |
| 547 | a->block_align = 1; |
| 548 | |
| 549 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CTR_192; |
| 550 | a->enc_op_id = VNET_CRYPTO_OP_AES_192_CTR_ENC; |
| 551 | a->dec_op_id = VNET_CRYPTO_OP_AES_192_CTR_DEC; |
| 552 | a->alg = VNET_CRYPTO_ALG_AES_192_CTR; |
| 553 | a->iv_size = 8; |
| 554 | a->block_align = 1; |
| 555 | |
| 556 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_CTR_256; |
| 557 | a->enc_op_id = VNET_CRYPTO_OP_AES_256_CTR_ENC; |
| 558 | a->dec_op_id = VNET_CRYPTO_OP_AES_256_CTR_DEC; |
| 559 | a->alg = VNET_CRYPTO_ALG_AES_256_CTR; |
| 560 | a->iv_size = 8; |
| 561 | a->block_align = 1; |
| 562 | |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 563 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_128; |
| 564 | a->enc_op_id = VNET_CRYPTO_OP_AES_128_GCM_ENC; |
| 565 | a->dec_op_id = VNET_CRYPTO_OP_AES_128_GCM_DEC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 566 | a->alg = VNET_CRYPTO_ALG_AES_128_GCM; |
Damjan Marion | f1ecb65 | 2020-02-10 19:21:14 +0100 | [diff] [blame] | 567 | a->iv_size = 8; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 568 | a->block_align = 1; |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 569 | a->icv_size = 16; |
| 570 | |
| 571 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_192; |
| 572 | a->enc_op_id = VNET_CRYPTO_OP_AES_192_GCM_ENC; |
| 573 | a->dec_op_id = VNET_CRYPTO_OP_AES_192_GCM_DEC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 574 | a->alg = VNET_CRYPTO_ALG_AES_192_GCM; |
Damjan Marion | f1ecb65 | 2020-02-10 19:21:14 +0100 | [diff] [blame] | 575 | a->iv_size = 8; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 576 | a->block_align = 1; |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 577 | a->icv_size = 16; |
| 578 | |
| 579 | a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_256; |
| 580 | a->enc_op_id = VNET_CRYPTO_OP_AES_256_GCM_ENC; |
| 581 | a->dec_op_id = VNET_CRYPTO_OP_AES_256_GCM_DEC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 582 | a->alg = VNET_CRYPTO_ALG_AES_256_GCM; |
Damjan Marion | f1ecb65 | 2020-02-10 19:21:14 +0100 | [diff] [blame] | 583 | a->iv_size = 8; |
Christian Hopps | fb7e7ed | 2019-11-03 07:02:15 -0500 | [diff] [blame] | 584 | a->block_align = 1; |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 585 | a->icv_size = 16; |
| 586 | |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 587 | vec_validate (im->integ_algs, IPSEC_INTEG_N_ALG - 1); |
| 588 | ipsec_main_integ_alg_t *i; |
| 589 | |
Dmitry Vakhrushev | 77cc14a | 2019-08-14 00:12:33 -0400 | [diff] [blame] | 590 | i = &im->integ_algs[IPSEC_INTEG_ALG_MD5_96]; |
| 591 | i->op_id = VNET_CRYPTO_OP_MD5_HMAC; |
| 592 | i->alg = VNET_CRYPTO_ALG_HMAC_MD5; |
| 593 | i->icv_size = 12; |
| 594 | |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 595 | i = &im->integ_algs[IPSEC_INTEG_ALG_SHA1_96]; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 596 | i->op_id = VNET_CRYPTO_OP_SHA1_HMAC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 597 | i->alg = VNET_CRYPTO_ALG_HMAC_SHA1; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 598 | i->icv_size = 12; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 599 | |
| 600 | i = &im->integ_algs[IPSEC_INTEG_ALG_SHA_256_96]; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 601 | i->op_id = VNET_CRYPTO_OP_SHA1_HMAC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 602 | i->alg = VNET_CRYPTO_ALG_HMAC_SHA256; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 603 | i->icv_size = 12; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 604 | |
| 605 | i = &im->integ_algs[IPSEC_INTEG_ALG_SHA_256_128]; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 606 | i->op_id = VNET_CRYPTO_OP_SHA256_HMAC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 607 | i->alg = VNET_CRYPTO_ALG_HMAC_SHA256; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 608 | i->icv_size = 16; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 609 | |
| 610 | i = &im->integ_algs[IPSEC_INTEG_ALG_SHA_384_192]; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 611 | i->op_id = VNET_CRYPTO_OP_SHA384_HMAC; |
Damjan Marion | 4cb8381 | 2019-04-24 17:32:01 +0200 | [diff] [blame] | 612 | i->alg = VNET_CRYPTO_ALG_HMAC_SHA384; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 613 | i->icv_size = 24; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 614 | |
| 615 | i = &im->integ_algs[IPSEC_INTEG_ALG_SHA_512_256]; |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 616 | i->op_id = VNET_CRYPTO_OP_SHA512_HMAC; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 617 | i->alg = VNET_CRYPTO_ALG_HMAC_SHA512; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 618 | i->icv_size = 32; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 619 | |
Neale Ranns | 5ae793a | 2019-04-03 13:36:56 +0000 | [diff] [blame] | 620 | vec_validate_aligned (im->ptd, vlib_num_workers (), CLIB_CACHE_LINE_BYTES); |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 621 | |
Fan Zhang | f539578 | 2020-04-29 14:00:03 +0100 | [diff] [blame] | 622 | im->async_mode = 0; |
| 623 | crypto_engine_backend_register_post_node (vm); |
| 624 | |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 625 | im->ipsec4_out_spd_hash_tbl = NULL; |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 626 | im->output_flow_cache_flag = 0; |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 627 | im->ipsec4_out_spd_flow_cache_entries = 0; |
| 628 | im->epoch_count = 0; |
| 629 | im->ipsec4_out_spd_hash_num_buckets = |
| 630 | IPSEC4_OUT_SPD_DEFAULT_HASH_NUM_BUCKETS; |
| 631 | |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 632 | im->ipsec4_in_spd_hash_tbl = NULL; |
| 633 | im->input_flow_cache_flag = 0; |
| 634 | im->ipsec4_in_spd_flow_cache_entries = 0; |
| 635 | im->input_epoch_count = 0; |
| 636 | im->ipsec4_in_spd_hash_num_buckets = IPSEC4_SPD_DEFAULT_HASH_NUM_BUCKETS; |
| 637 | |
Benoît Ganne | 98ca76a | 2022-04-11 18:51:25 +0200 | [diff] [blame] | 638 | vec_validate_init_empty_aligned (im->next_header_registrations, 255, ~0, |
| 639 | CLIB_CACHE_LINE_BYTES); |
| 640 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 641 | return 0; |
| 642 | } |
| 643 | |
| 644 | VLIB_INIT_FUNCTION (ipsec_init); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 645 | |
Zachary Leaf | b2d3678 | 2021-07-27 05:18:47 -0500 | [diff] [blame] | 646 | static clib_error_t * |
| 647 | ipsec_config (vlib_main_t *vm, unformat_input_t *input) |
| 648 | { |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 649 | ipsec_main_t *im = &ipsec_main; |
Zachary Leaf | b2d3678 | 2021-07-27 05:18:47 -0500 | [diff] [blame] | 650 | unformat_input_t sub_input; |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 651 | |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 652 | u32 ipsec4_out_spd_hash_num_buckets; |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 653 | u32 ipsec4_in_spd_hash_num_buckets; |
Piotr Bronowski | 4da8a63 | 2022-05-06 13:52:24 +0000 | [diff] [blame] | 654 | u32 ipsec_spd_fp_num_buckets; |
Zachary Leaf | b2d3678 | 2021-07-27 05:18:47 -0500 | [diff] [blame] | 655 | |
| 656 | while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| 657 | { |
Piotr Bronowski | 86f8208 | 2022-07-08 12:45:05 +0000 | [diff] [blame] | 658 | if (unformat (input, "ipv6-outbound-spd-fast-path on")) |
Piotr Bronowski | 4da8a63 | 2022-05-06 13:52:24 +0000 | [diff] [blame] | 659 | { |
Piotr Bronowski | 86f8208 | 2022-07-08 12:45:05 +0000 | [diff] [blame] | 660 | im->ipv6_fp_spd_is_enabled = 1; |
| 661 | } |
| 662 | else if (unformat (input, "ipv6-outbound-spd-fast-path off")) |
| 663 | im->ipv6_fp_spd_is_enabled = 0; |
| 664 | else if (unformat (input, "ipv4-outbound-spd-fast-path on")) |
| 665 | { |
| 666 | im->ipv4_fp_spd_is_enabled = 1; |
Piotr Bronowski | 4da8a63 | 2022-05-06 13:52:24 +0000 | [diff] [blame] | 667 | im->output_flow_cache_flag = 0; |
| 668 | } |
| 669 | else if (unformat (input, "ipv4-outbound-spd-fast-path off")) |
Piotr Bronowski | 86f8208 | 2022-07-08 12:45:05 +0000 | [diff] [blame] | 670 | im->ipv4_fp_spd_is_enabled = 0; |
Piotr Bronowski | 4da8a63 | 2022-05-06 13:52:24 +0000 | [diff] [blame] | 671 | else if (unformat (input, "spd-fast-path-num-buckets %d", |
| 672 | &ipsec_spd_fp_num_buckets)) |
| 673 | { |
| 674 | /* Number of bihash buckets is power of 2 >= input */ |
| 675 | im->fp_lookup_hash_buckets = 1ULL |
| 676 | << max_log2 (ipsec_spd_fp_num_buckets); |
| 677 | } |
| 678 | else if (unformat (input, "ipv4-outbound-spd-flow-cache on")) |
Piotr Bronowski | 86f8208 | 2022-07-08 12:45:05 +0000 | [diff] [blame] | 679 | im->output_flow_cache_flag = im->ipv4_fp_spd_is_enabled ? 0 : 1; |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 680 | else if (unformat (input, "ipv4-outbound-spd-flow-cache off")) |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 681 | im->output_flow_cache_flag = 0; |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 682 | else if (unformat (input, "ipv4-outbound-spd-hash-buckets %d", |
| 683 | &ipsec4_out_spd_hash_num_buckets)) |
| 684 | { |
| 685 | /* Size of hash is power of 2 >= number of buckets */ |
| 686 | im->ipsec4_out_spd_hash_num_buckets = |
| 687 | 1ULL << max_log2 (ipsec4_out_spd_hash_num_buckets); |
| 688 | } |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 689 | else if (unformat (input, "ipv4-inbound-spd-flow-cache on")) |
| 690 | im->input_flow_cache_flag = 1; |
| 691 | else if (unformat (input, "ipv4-inbound-spd-flow-cache off")) |
| 692 | im->input_flow_cache_flag = 0; |
| 693 | else if (unformat (input, "ipv4-inbound-spd-hash-buckets %d", |
| 694 | &ipsec4_in_spd_hash_num_buckets)) |
| 695 | { |
| 696 | im->ipsec4_in_spd_hash_num_buckets = |
| 697 | 1ULL << max_log2 (ipsec4_in_spd_hash_num_buckets); |
| 698 | } |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 699 | else if (unformat (input, "ip4 %U", unformat_vlib_cli_sub_input, |
| 700 | &sub_input)) |
Zachary Leaf | b2d3678 | 2021-07-27 05:18:47 -0500 | [diff] [blame] | 701 | { |
| 702 | uword table_size = ~0; |
| 703 | u32 n_buckets = ~0; |
| 704 | |
| 705 | while (unformat_check_input (&sub_input) != UNFORMAT_END_OF_INPUT) |
| 706 | { |
| 707 | if (unformat (&sub_input, "num-buckets %u", &n_buckets)) |
| 708 | ; |
| 709 | else |
| 710 | return clib_error_return (0, "unknown input `%U'", |
| 711 | format_unformat_error, &sub_input); |
| 712 | } |
| 713 | |
| 714 | ipsec_tun_table_init (AF_IP4, table_size, n_buckets); |
| 715 | } |
| 716 | else if (unformat (input, "ip6 %U", unformat_vlib_cli_sub_input, |
| 717 | &sub_input)) |
| 718 | { |
| 719 | uword table_size = ~0; |
| 720 | u32 n_buckets = ~0; |
| 721 | |
| 722 | while (unformat_check_input (&sub_input) != UNFORMAT_END_OF_INPUT) |
| 723 | { |
| 724 | if (unformat (&sub_input, "num-buckets %u", &n_buckets)) |
| 725 | ; |
| 726 | else |
| 727 | return clib_error_return (0, "unknown input `%U'", |
| 728 | format_unformat_error, &sub_input); |
| 729 | } |
| 730 | |
| 731 | ipsec_tun_table_init (AF_IP6, table_size, n_buckets); |
| 732 | } |
| 733 | else |
| 734 | return clib_error_return (0, "unknown input `%U'", |
| 735 | format_unformat_error, input); |
| 736 | } |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 737 | if (im->output_flow_cache_flag) |
Govindarajan Mohandoss | 6d7dfcb | 2021-03-19 19:20:49 +0000 | [diff] [blame] | 738 | { |
| 739 | vec_add2 (im->ipsec4_out_spd_hash_tbl, im->ipsec4_out_spd_hash_tbl, |
| 740 | im->ipsec4_out_spd_hash_num_buckets); |
| 741 | } |
Zachary Leaf | 7cd35f5 | 2021-06-25 08:11:15 -0500 | [diff] [blame] | 742 | if (im->input_flow_cache_flag) |
| 743 | { |
| 744 | vec_add2 (im->ipsec4_in_spd_hash_tbl, im->ipsec4_in_spd_hash_tbl, |
| 745 | im->ipsec4_in_spd_hash_num_buckets); |
| 746 | } |
Zachary Leaf | b2d3678 | 2021-07-27 05:18:47 -0500 | [diff] [blame] | 747 | |
| 748 | return 0; |
| 749 | } |
| 750 | |
| 751 | VLIB_CONFIG_FUNCTION (ipsec_config, "ipsec"); |
| 752 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 753 | /* |
| 754 | * fd.io coding-style-patch-verification: ON |
| 755 | * |
| 756 | * Local Variables: |
| 757 | * eval: (c-set-style "gnu") |
| 758 | * End: |
| 759 | */ |