blob: 9a5dbb3e8b272c51f27999bc23ae91961f25f550 [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000015#ifndef __IPSEC_H__
16#define __IPSEC_H__
17
Sergio Gonzalez Monroydb93cd92017-08-26 15:22:05 +010018#include <vnet/ip/ip.h>
Damjan Marion91f17dc2019-03-18 18:59:25 +010019#include <vnet/crypto/crypto.h>
Sergio Gonzalez Monroydb93cd92017-08-26 15:22:05 +010020#include <vnet/feature/feature.h>
21
Klement Sekera4f10db32018-11-12 14:32:19 +010022#include <vppinfra/types.h>
23#include <vppinfra/cache.h>
24
Neale Ranns999c8ee2019-02-01 03:31:24 -080025#include <vnet/ipsec/ipsec_spd.h>
26#include <vnet/ipsec/ipsec_spd_policy.h>
27#include <vnet/ipsec/ipsec_sa.h>
28#include <vnet/ipsec/ipsec_if.h>
Ed Warnickecb9cada2015-12-08 15:45:58 -070029
Klement Sekerab4d30532018-11-08 13:00:02 +010030typedef clib_error_t *(*add_del_sa_sess_cb_t) (u32 sa_index, u8 is_add);
31typedef clib_error_t *(*check_support_cb_t) (ipsec_sa_t * sa);
32
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070033typedef struct
34{
Klement Sekerab4d30532018-11-08 13:00:02 +010035 u8 *name;
36 /* add/del callback */
37 add_del_sa_sess_cb_t add_del_sa_sess_cb;
38 /* check support function */
39 check_support_cb_t check_support_cb;
40 u32 ah4_encrypt_node_index;
41 u32 ah4_decrypt_node_index;
42 u32 ah4_encrypt_next_index;
43 u32 ah4_decrypt_next_index;
44 u32 ah6_encrypt_node_index;
45 u32 ah6_decrypt_node_index;
46 u32 ah6_encrypt_next_index;
47 u32 ah6_decrypt_next_index;
48} ipsec_ah_backend_t;
49
50typedef struct
51{
52 u8 *name;
53 /* add/del callback */
54 add_del_sa_sess_cb_t add_del_sa_sess_cb;
55 /* check support function */
56 check_support_cb_t check_support_cb;
57 u32 esp4_encrypt_node_index;
58 u32 esp4_decrypt_node_index;
59 u32 esp4_encrypt_next_index;
60 u32 esp4_decrypt_next_index;
61 u32 esp6_encrypt_node_index;
62 u32 esp6_decrypt_node_index;
63 u32 esp6_encrypt_next_index;
64 u32 esp6_decrypt_next_index;
65} ipsec_esp_backend_t;
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +000066
67typedef struct
68{
Damjan Marion91f17dc2019-03-18 18:59:25 +010069 vnet_crypto_op_type_t enc_op_type;
70 vnet_crypto_op_type_t dec_op_type;
Klement Sekera4f10db32018-11-12 14:32:19 +010071 u8 iv_size;
72 u8 block_size;
Damjan Marion91f17dc2019-03-18 18:59:25 +010073} ipsec_main_crypto_alg_t;
Klement Sekera4f10db32018-11-12 14:32:19 +010074
75typedef struct
76{
Damjan Marion91f17dc2019-03-18 18:59:25 +010077 vnet_crypto_op_type_t op_type;
Klement Sekera4f10db32018-11-12 14:32:19 +010078 u8 trunc_size;
Damjan Marion91f17dc2019-03-18 18:59:25 +010079} ipsec_main_integ_alg_t;
Klement Sekera4f10db32018-11-12 14:32:19 +010080
81typedef struct
82{
Damjan Marionc59b9a22019-03-19 15:38:40 +010083 vnet_crypto_op_t *crypto_ops;
84 vnet_crypto_op_t *integ_ops;
85} ipsec_per_thread_data_t;
86
87typedef struct
88{
Ed Warnickecb9cada2015-12-08 15:45:58 -070089 /* pool of tunnel instances */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070090 ipsec_spd_t *spds;
Neale Rannsa09c1ff2019-02-04 01:10:30 -080091 /* Pool of security associations */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070092 ipsec_sa_t *sad;
Neale Rannsa09c1ff2019-02-04 01:10:30 -080093 /* pool of policies */
94 ipsec_policy_t *policies;
Ed Warnickecb9cada2015-12-08 15:45:58 -070095
96 /* pool of tunnel interfaces */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070097 ipsec_tunnel_if_t *tunnel_interfaces;
Ed Warnickecb9cada2015-12-08 15:45:58 -070098
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070099 uword *tunnel_index_by_key;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700100
101 /* convenience */
102 vlib_main_t *vlib_main;
103 vnet_main_t *vnet_main;
104
Ed Warnickecb9cada2015-12-08 15:45:58 -0700105 /* hashes */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700106 uword *spd_index_by_spd_id;
107 uword *spd_index_by_sw_if_index;
108 uword *sa_index_by_sa_id;
Kingwel Xie1ba5bc82019-03-20 07:21:58 -0400109 uword *ipsec4_if_pool_index_by_key;
110 uword *ipsec6_if_pool_index_by_key;
Matthew Smith8e1039a2018-04-12 07:32:56 -0500111 uword *ipsec_if_real_dev_by_show_dev;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700112
Paul Vinciguerrabdc0e6b2018-09-22 05:32:50 -0700113 /* node indices */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700114 u32 error_drop_node_index;
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200115 u32 esp4_encrypt_node_index;
116 u32 esp4_decrypt_node_index;
117 u32 ah4_encrypt_node_index;
118 u32 ah4_decrypt_node_index;
119 u32 esp6_encrypt_node_index;
120 u32 esp6_decrypt_node_index;
121 u32 ah6_encrypt_node_index;
122 u32 ah6_decrypt_node_index;
Paul Vinciguerrabdc0e6b2018-09-22 05:32:50 -0700123 /* next node indices */
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200124 u32 esp4_encrypt_next_index;
125 u32 esp4_decrypt_next_index;
126 u32 ah4_encrypt_next_index;
127 u32 ah4_decrypt_next_index;
128 u32 esp6_encrypt_next_index;
129 u32 esp6_decrypt_next_index;
130 u32 ah6_encrypt_next_index;
131 u32 ah6_decrypt_next_index;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700132
Klement Sekerab4d30532018-11-08 13:00:02 +0100133 /* pool of ah backends */
134 ipsec_ah_backend_t *ah_backends;
135 /* pool of esp backends */
136 ipsec_esp_backend_t *esp_backends;
137 /* index of current ah backend */
138 u32 ah_current_backend;
139 /* index of current esp backend */
140 u32 esp_current_backend;
141 /* index of default ah backend */
142 u32 ah_default_backend;
143 /* index of default esp backend */
144 u32 esp_default_backend;
Damjan Marion91f17dc2019-03-18 18:59:25 +0100145
146 /* crypto alg data */
147 ipsec_main_crypto_alg_t *crypto_algs;
148
149 /* crypto integ data */
150 ipsec_main_integ_alg_t *integ_algs;
Damjan Marionc59b9a22019-03-19 15:38:40 +0100151
152 /* per-thread data */
153 ipsec_per_thread_data_t *ptd;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700154} ipsec_main_t;
155
Dave Wallace71612d62017-10-24 01:32:41 -0400156extern ipsec_main_t ipsec_main;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700157
Klement Sekerab4d30532018-11-08 13:00:02 +0100158clib_error_t *ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index,
159 u8 is_add);
160
161clib_error_t *ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa);
162
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200163extern vlib_node_registration_t esp4_encrypt_node;
164extern vlib_node_registration_t esp4_decrypt_node;
165extern vlib_node_registration_t ah4_encrypt_node;
166extern vlib_node_registration_t ah4_decrypt_node;
167extern vlib_node_registration_t esp6_encrypt_node;
168extern vlib_node_registration_t esp6_decrypt_node;
169extern vlib_node_registration_t ah6_encrypt_node;
170extern vlib_node_registration_t ah6_decrypt_node;
Kingwel Xie1ba5bc82019-03-20 07:21:58 -0400171extern vlib_node_registration_t ipsec4_if_input_node;
172extern vlib_node_registration_t ipsec6_if_input_node;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700173
Ed Warnickecb9cada2015-12-08 15:45:58 -0700174/*
175 * functions
176 */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700177u8 *format_ipsec_replay_window (u8 * s, va_list * args);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700178
Ed Warnickecb9cada2015-12-08 15:45:58 -0700179/*
180 * inline functions
181 */
182
Matus Fabian08a6f012016-11-15 06:08:51 -0800183static_always_inline u32
184get_next_output_feature_node_index (vlib_buffer_t * b,
185 vlib_node_runtime_t * nr)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700186{
Matus Fabian08a6f012016-11-15 06:08:51 -0800187 u32 next;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700188 vlib_main_t *vm = vlib_get_main ();
Matus Fabian08a6f012016-11-15 06:08:51 -0800189 vlib_node_t *node = vlib_get_node (vm, nr->node_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700190
Damjan Marion7d98a122018-07-19 20:42:08 +0200191 vnet_feature_next (&next, b);
Matus Fabian08a6f012016-11-15 06:08:51 -0800192 return node->next_nodes[next];
Ed Warnickecb9cada2015-12-08 15:45:58 -0700193}
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700194
Klement Sekerab4d30532018-11-08 13:00:02 +0100195u32 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im,
196 const char *name,
197 const char *ah4_encrypt_node_name,
198 const char *ah4_decrypt_node_name,
199 const char *ah6_encrypt_node_name,
200 const char *ah6_decrypt_node_name,
201 check_support_cb_t ah_check_support_cb,
202 add_del_sa_sess_cb_t ah_add_del_sa_sess_cb);
203
204u32 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
205 const char *name,
206 const char *esp4_encrypt_node_name,
207 const char *esp4_decrypt_node_name,
208 const char *esp6_encrypt_node_name,
209 const char *esp6_decrypt_node_name,
210 check_support_cb_t esp_check_support_cb,
211 add_del_sa_sess_cb_t esp_add_del_sa_sess_cb);
212
213int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx);
214int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx);
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +0000215#endif /* __IPSEC_H__ */
216
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700217/*
218 * fd.io coding-style-patch-verification: ON
219 *
220 * Local Variables:
221 * eval: (c-set-style "gnu")
222 * End:
223 */