Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 15 | #ifndef __IPSEC_H__ |
| 16 | #define __IPSEC_H__ |
| 17 | |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 18 | #include <vnet/ip/ip.h> |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 19 | #include <vnet/crypto/crypto.h> |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 20 | #include <vnet/feature/feature.h> |
| 21 | |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 22 | #include <vppinfra/types.h> |
| 23 | #include <vppinfra/cache.h> |
| 24 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 25 | #include <vnet/ipsec/ipsec_spd.h> |
| 26 | #include <vnet/ipsec/ipsec_spd_policy.h> |
| 27 | #include <vnet/ipsec/ipsec_sa.h> |
| 28 | #include <vnet/ipsec/ipsec_if.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 29 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 30 | typedef clib_error_t *(*add_del_sa_sess_cb_t) (u32 sa_index, u8 is_add); |
| 31 | typedef clib_error_t *(*check_support_cb_t) (ipsec_sa_t * sa); |
| 32 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 33 | typedef struct |
| 34 | { |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 35 | u8 *name; |
| 36 | /* add/del callback */ |
| 37 | add_del_sa_sess_cb_t add_del_sa_sess_cb; |
| 38 | /* check support function */ |
| 39 | check_support_cb_t check_support_cb; |
| 40 | u32 ah4_encrypt_node_index; |
| 41 | u32 ah4_decrypt_node_index; |
| 42 | u32 ah4_encrypt_next_index; |
| 43 | u32 ah4_decrypt_next_index; |
| 44 | u32 ah6_encrypt_node_index; |
| 45 | u32 ah6_decrypt_node_index; |
| 46 | u32 ah6_encrypt_next_index; |
| 47 | u32 ah6_decrypt_next_index; |
| 48 | } ipsec_ah_backend_t; |
| 49 | |
| 50 | typedef struct |
| 51 | { |
| 52 | u8 *name; |
| 53 | /* add/del callback */ |
| 54 | add_del_sa_sess_cb_t add_del_sa_sess_cb; |
| 55 | /* check support function */ |
| 56 | check_support_cb_t check_support_cb; |
| 57 | u32 esp4_encrypt_node_index; |
| 58 | u32 esp4_decrypt_node_index; |
| 59 | u32 esp4_encrypt_next_index; |
| 60 | u32 esp4_decrypt_next_index; |
| 61 | u32 esp6_encrypt_node_index; |
| 62 | u32 esp6_decrypt_node_index; |
| 63 | u32 esp6_encrypt_next_index; |
| 64 | u32 esp6_decrypt_next_index; |
| 65 | } ipsec_esp_backend_t; |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 66 | |
| 67 | typedef struct |
| 68 | { |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 69 | vnet_crypto_op_type_t enc_op_type; |
| 70 | vnet_crypto_op_type_t dec_op_type; |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 71 | u8 iv_size; |
| 72 | u8 block_size; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 73 | } ipsec_main_crypto_alg_t; |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 74 | |
| 75 | typedef struct |
| 76 | { |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 77 | vnet_crypto_op_type_t op_type; |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 78 | u8 trunc_size; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 79 | } ipsec_main_integ_alg_t; |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 80 | |
| 81 | typedef struct |
| 82 | { |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 83 | vnet_crypto_op_t *crypto_ops; |
| 84 | vnet_crypto_op_t *integ_ops; |
| 85 | } ipsec_per_thread_data_t; |
| 86 | |
| 87 | typedef struct |
| 88 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 89 | /* pool of tunnel instances */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 90 | ipsec_spd_t *spds; |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 91 | /* Pool of security associations */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 92 | ipsec_sa_t *sad; |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 93 | /* pool of policies */ |
| 94 | ipsec_policy_t *policies; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 95 | |
| 96 | /* pool of tunnel interfaces */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 97 | ipsec_tunnel_if_t *tunnel_interfaces; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 98 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 99 | uword *tunnel_index_by_key; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 100 | |
| 101 | /* convenience */ |
| 102 | vlib_main_t *vlib_main; |
| 103 | vnet_main_t *vnet_main; |
| 104 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 105 | /* hashes */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 106 | uword *spd_index_by_spd_id; |
| 107 | uword *spd_index_by_sw_if_index; |
| 108 | uword *sa_index_by_sa_id; |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 109 | uword *ipsec4_if_pool_index_by_key; |
| 110 | uword *ipsec6_if_pool_index_by_key; |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 111 | uword *ipsec_if_real_dev_by_show_dev; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 112 | |
Paul Vinciguerra | bdc0e6b | 2018-09-22 05:32:50 -0700 | [diff] [blame] | 113 | /* node indices */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 114 | u32 error_drop_node_index; |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 115 | u32 esp4_encrypt_node_index; |
| 116 | u32 esp4_decrypt_node_index; |
| 117 | u32 ah4_encrypt_node_index; |
| 118 | u32 ah4_decrypt_node_index; |
| 119 | u32 esp6_encrypt_node_index; |
| 120 | u32 esp6_decrypt_node_index; |
| 121 | u32 ah6_encrypt_node_index; |
| 122 | u32 ah6_decrypt_node_index; |
Paul Vinciguerra | bdc0e6b | 2018-09-22 05:32:50 -0700 | [diff] [blame] | 123 | /* next node indices */ |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 124 | u32 esp4_encrypt_next_index; |
| 125 | u32 esp4_decrypt_next_index; |
| 126 | u32 ah4_encrypt_next_index; |
| 127 | u32 ah4_decrypt_next_index; |
| 128 | u32 esp6_encrypt_next_index; |
| 129 | u32 esp6_decrypt_next_index; |
| 130 | u32 ah6_encrypt_next_index; |
| 131 | u32 ah6_decrypt_next_index; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 132 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 133 | /* pool of ah backends */ |
| 134 | ipsec_ah_backend_t *ah_backends; |
| 135 | /* pool of esp backends */ |
| 136 | ipsec_esp_backend_t *esp_backends; |
| 137 | /* index of current ah backend */ |
| 138 | u32 ah_current_backend; |
| 139 | /* index of current esp backend */ |
| 140 | u32 esp_current_backend; |
| 141 | /* index of default ah backend */ |
| 142 | u32 ah_default_backend; |
| 143 | /* index of default esp backend */ |
| 144 | u32 esp_default_backend; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 145 | |
| 146 | /* crypto alg data */ |
| 147 | ipsec_main_crypto_alg_t *crypto_algs; |
| 148 | |
| 149 | /* crypto integ data */ |
| 150 | ipsec_main_integ_alg_t *integ_algs; |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 151 | |
| 152 | /* per-thread data */ |
| 153 | ipsec_per_thread_data_t *ptd; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 154 | } ipsec_main_t; |
| 155 | |
Dave Wallace | 71612d6 | 2017-10-24 01:32:41 -0400 | [diff] [blame] | 156 | extern ipsec_main_t ipsec_main; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 157 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 158 | clib_error_t *ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, |
| 159 | u8 is_add); |
| 160 | |
| 161 | clib_error_t *ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa); |
| 162 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 163 | extern vlib_node_registration_t esp4_encrypt_node; |
| 164 | extern vlib_node_registration_t esp4_decrypt_node; |
| 165 | extern vlib_node_registration_t ah4_encrypt_node; |
| 166 | extern vlib_node_registration_t ah4_decrypt_node; |
| 167 | extern vlib_node_registration_t esp6_encrypt_node; |
| 168 | extern vlib_node_registration_t esp6_decrypt_node; |
| 169 | extern vlib_node_registration_t ah6_encrypt_node; |
| 170 | extern vlib_node_registration_t ah6_decrypt_node; |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 171 | extern vlib_node_registration_t ipsec4_if_input_node; |
| 172 | extern vlib_node_registration_t ipsec6_if_input_node; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 173 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 174 | /* |
| 175 | * functions |
| 176 | */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 177 | u8 *format_ipsec_replay_window (u8 * s, va_list * args); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 178 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 179 | /* |
| 180 | * inline functions |
| 181 | */ |
| 182 | |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 183 | static_always_inline u32 |
| 184 | get_next_output_feature_node_index (vlib_buffer_t * b, |
| 185 | vlib_node_runtime_t * nr) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 186 | { |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 187 | u32 next; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 188 | vlib_main_t *vm = vlib_get_main (); |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 189 | vlib_node_t *node = vlib_get_node (vm, nr->node_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 190 | |
Damjan Marion | 7d98a12 | 2018-07-19 20:42:08 +0200 | [diff] [blame] | 191 | vnet_feature_next (&next, b); |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 192 | return node->next_nodes[next]; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 193 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 194 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 195 | u32 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im, |
| 196 | const char *name, |
| 197 | const char *ah4_encrypt_node_name, |
| 198 | const char *ah4_decrypt_node_name, |
| 199 | const char *ah6_encrypt_node_name, |
| 200 | const char *ah6_decrypt_node_name, |
| 201 | check_support_cb_t ah_check_support_cb, |
| 202 | add_del_sa_sess_cb_t ah_add_del_sa_sess_cb); |
| 203 | |
| 204 | u32 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im, |
| 205 | const char *name, |
| 206 | const char *esp4_encrypt_node_name, |
| 207 | const char *esp4_decrypt_node_name, |
| 208 | const char *esp6_encrypt_node_name, |
| 209 | const char *esp6_decrypt_node_name, |
| 210 | check_support_cb_t esp_check_support_cb, |
| 211 | add_del_sa_sess_cb_t esp_add_del_sa_sess_cb); |
| 212 | |
| 213 | int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx); |
| 214 | int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx); |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 215 | #endif /* __IPSEC_H__ */ |
| 216 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 217 | /* |
| 218 | * fd.io coding-style-patch-verification: ON |
| 219 | * |
| 220 | * Local Variables: |
| 221 | * eval: (c-set-style "gnu") |
| 222 | * End: |
| 223 | */ |