lib/librte_ipsec/sa.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright(c) 2018 Intel Corporation
   3  */
   4
   5 #include <rte_ipsec.h>
   6 #include <rte_esp.h>
   7 #include <rte_ip.h>
   8 #include <rte_errno.h>
   9 #include <rte_cryptodev.h>
  10
  11 #include "sa.h"
  12 #include "ipsec_sqn.h"
  13 #include "crypto.h"
  14 #include "iph.h"
  15 #include "misc.h"
  16 #include "pad.h"
  17
  18 #define MBUF_MAX_L2_LEN         RTE_LEN2MASK(RTE_MBUF_L2_LEN_BITS, uint64_t)
  19 #define MBUF_MAX_L3_LEN         RTE_LEN2MASK(RTE_MBUF_L3_LEN_BITS, uint64_t)
  20
  21 /* some helper structures */
  22 struct crypto_xform {
  23         struct rte_crypto_auth_xform *auth;
  24         struct rte_crypto_cipher_xform *cipher;
  25         struct rte_crypto_aead_xform *aead;
  26 };
  27
  28 /*
  29  * helper routine, fills internal crypto_xform structure.
  30  */
  31 static int
  32 fill_crypto_xform(struct crypto_xform *xform, uint64_t type,
  33         const struct rte_ipsec_sa_prm *prm)
  34 {
  35         struct rte_crypto_sym_xform *xf, *xfn;
  36
  37         memset(xform, 0, sizeof(*xform));
  38
  39         xf = prm->crypto_xform;
  40         if (xf == NULL)
  41                 return -EINVAL;
  42
  43         xfn = xf->next;
  44
  45         /* for AEAD just one xform required */
  46         if (xf->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
  47                 if (xfn != NULL)
  48                         return -EINVAL;
  49                 xform->aead = &xf->aead;
  50         /*
  51          * CIPHER+AUTH xforms are expected in strict order,
  52          * depending on SA direction:
  53          * inbound: AUTH+CIPHER
  54          * outbound: CIPHER+AUTH
  55          */
  56         } else if ((type & RTE_IPSEC_SATP_DIR_MASK) == RTE_IPSEC_SATP_DIR_IB) {
  57
  58                 /* wrong order or no cipher */
  59                 if (xfn == NULL || xf->type != RTE_CRYPTO_SYM_XFORM_AUTH ||
  60                                 xfn->type != RTE_CRYPTO_SYM_XFORM_CIPHER)
  61                         return -EINVAL;
  62
  63                 xform->auth = &xf->auth;
  64                 xform->cipher = &xfn->cipher;
  65
  66         } else {
  67
  68                 /* wrong order or no auth */
  69                 if (xfn == NULL || xf->type != RTE_CRYPTO_SYM_XFORM_CIPHER ||
  70                                 xfn->type != RTE_CRYPTO_SYM_XFORM_AUTH)
  71                         return -EINVAL;
  72
  73                 xform->cipher = &xf->cipher;
  74                 xform->auth = &xfn->auth;
  75         }
  76
  77         return 0;
  78 }
  79
  80 uint64_t __rte_experimental
  81 rte_ipsec_sa_type(const struct rte_ipsec_sa *sa)
  82 {
  83         return sa->type;
  84 }
  85
  86 /**
  87  * Based on number of buckets calculated required size for the
  88  * structure that holds replay window and sequence number (RSN) information.
  89  */
  90 static size_t
  91 rsn_size(uint32_t nb_bucket)
  92 {
  93         size_t sz;
  94         struct replay_sqn *rsn;
  95
  96         sz = sizeof(*rsn) + nb_bucket * sizeof(rsn->window[0]);
  97         sz = RTE_ALIGN_CEIL(sz, RTE_CACHE_LINE_SIZE);
  98         return sz;
  99 }
 100
 101 /*
 102  * for given size, calculate required number of buckets.
 103  */
 104 static uint32_t
 105 replay_num_bucket(uint32_t wsz)
 106 {
 107         uint32_t nb;
 108
 109         nb = rte_align32pow2(RTE_ALIGN_MUL_CEIL(wsz, WINDOW_BUCKET_SIZE) /
 110                 WINDOW_BUCKET_SIZE);
 111         nb = RTE_MAX(nb, (uint32_t)WINDOW_BUCKET_MIN);
 112
 113         return nb;
 114 }
 115
 116 static int32_t
 117 ipsec_sa_size(uint64_t type, uint32_t *wnd_sz, uint32_t *nb_bucket)
 118 {
 119         uint32_t n, sz, wsz;
 120
 121         wsz = *wnd_sz;
 122         n = 0;
 123
 124         if ((type & RTE_IPSEC_SATP_DIR_MASK) == RTE_IPSEC_SATP_DIR_IB) {
 125
 126                 /*
 127                  * RFC 4303 recommends 64 as minimum window size.
 128                  * there is no point to use ESN mode without SQN window,
 129                  * so make sure we have at least 64 window when ESN is enalbed.
 130                  */
 131                 wsz = ((type & RTE_IPSEC_SATP_ESN_MASK) ==
 132                         RTE_IPSEC_SATP_ESN_DISABLE) ?
 133                         wsz : RTE_MAX(wsz, (uint32_t)WINDOW_BUCKET_SIZE);
 134                 if (wsz != 0)
 135                         n = replay_num_bucket(wsz);
 136         }
 137
 138         if (n > WINDOW_BUCKET_MAX)
 139                 return -EINVAL;
 140
 141         *wnd_sz = wsz;
 142         *nb_bucket = n;
 143
 144         sz = rsn_size(n);
 145         if ((type & RTE_IPSEC_SATP_SQN_MASK) == RTE_IPSEC_SATP_SQN_ATOM)
 146                 sz *= REPLAY_SQN_NUM;
 147
 148         sz += sizeof(struct rte_ipsec_sa);
 149         return sz;
 150 }
 151
 152 void __rte_experimental
 153 rte_ipsec_sa_fini(struct rte_ipsec_sa *sa)
 154 {
 155         memset(sa, 0, sa->size);
 156 }
 157
 158 /*
 159  * Determine expected SA type based on input parameters.
 160  */
 161 static int
 162 fill_sa_type(const struct rte_ipsec_sa_prm *prm, uint64_t *type)
 163 {
 164         uint64_t tp;
 165
 166         tp = 0;
 167
 168         if (prm->ipsec_xform.proto == RTE_SECURITY_IPSEC_SA_PROTO_AH)
 169                 tp |= RTE_IPSEC_SATP_PROTO_AH;
 170         else if (prm->ipsec_xform.proto == RTE_SECURITY_IPSEC_SA_PROTO_ESP)
 171                 tp |= RTE_IPSEC_SATP_PROTO_ESP;
 172         else
 173                 return -EINVAL;
 174
 175         if (prm->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS)
 176                 tp |= RTE_IPSEC_SATP_DIR_OB;
 177         else if (prm->ipsec_xform.direction ==
 178                         RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
 179                 tp |= RTE_IPSEC_SATP_DIR_IB;
 180         else
 181                 return -EINVAL;
 182
 183         if (prm->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
 184                 if (prm->ipsec_xform.tunnel.type ==
 185                                 RTE_SECURITY_IPSEC_TUNNEL_IPV4)
 186                         tp |= RTE_IPSEC_SATP_MODE_TUNLV4;
 187                 else if (prm->ipsec_xform.tunnel.type ==
 188                                 RTE_SECURITY_IPSEC_TUNNEL_IPV6)
 189                         tp |= RTE_IPSEC_SATP_MODE_TUNLV6;
 190                 else
 191                         return -EINVAL;
 192
 193                 if (prm->tun.next_proto == IPPROTO_IPIP)
 194                         tp |= RTE_IPSEC_SATP_IPV4;
 195                 else if (prm->tun.next_proto == IPPROTO_IPV6)
 196                         tp |= RTE_IPSEC_SATP_IPV6;
 197                 else
 198                         return -EINVAL;
 199         } else if (prm->ipsec_xform.mode ==
 200                         RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT) {
 201                 tp |= RTE_IPSEC_SATP_MODE_TRANS;
 202                 if (prm->trs.proto == IPPROTO_IPIP)
 203                         tp |= RTE_IPSEC_SATP_IPV4;
 204                 else if (prm->trs.proto == IPPROTO_IPV6)
 205                         tp |= RTE_IPSEC_SATP_IPV6;
 206                 else
 207                         return -EINVAL;
 208         } else
 209                 return -EINVAL;
 210
 211         /* check for ESN flag */
 212         if (prm->ipsec_xform.options.esn == 0)
 213                 tp |= RTE_IPSEC_SATP_ESN_DISABLE;
 214         else
 215                 tp |= RTE_IPSEC_SATP_ESN_ENABLE;
 216
 217         /* interpret flags */
 218         if (prm->flags & RTE_IPSEC_SAFLAG_SQN_ATOM)
 219                 tp |= RTE_IPSEC_SATP_SQN_ATOM;
 220         else
 221                 tp |= RTE_IPSEC_SATP_SQN_RAW;
 222
 223         *type = tp;
 224         return 0;
 225 }
 226
 227 /*
 228  * Init ESP inbound specific things.
 229  */
 230 static void
 231 esp_inb_init(struct rte_ipsec_sa *sa)
 232 {
 233         /* these params may differ with new algorithms support */
 234         sa->ctp.auth.offset = 0;
 235         sa->ctp.auth.length = sa->icv_len - sa->sqh_len;
 236         sa->ctp.cipher.offset = sizeof(struct rte_esp_hdr) + sa->iv_len;
 237         sa->ctp.cipher.length = sa->icv_len + sa->ctp.cipher.offset;
 238 }
 239
 240 /*
 241  * Init ESP inbound tunnel specific things.
 242  */
 243 static void
 244 esp_inb_tun_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm)
 245 {
 246         sa->proto = prm->tun.next_proto;
 247         esp_inb_init(sa);
 248 }
 249
 250 /*
 251  * Init ESP outbound specific things.
 252  */
 253 static void
 254 esp_outb_init(struct rte_ipsec_sa *sa, uint32_t hlen)
 255 {
 256         uint8_t algo_type;
 257
 258         sa->sqn.outb.raw = 1;
 259
 260         /* these params may differ with new algorithms support */
 261         sa->ctp.auth.offset = hlen;
 262         sa->ctp.auth.length = sizeof(struct rte_esp_hdr) +
 263                 sa->iv_len + sa->sqh_len;
 264
 265         algo_type = sa->algo_type;
 266
 267         switch (algo_type) {
 268         case ALGO_TYPE_AES_GCM:
 269         case ALGO_TYPE_AES_CTR:
 270         case ALGO_TYPE_NULL:
 271                 sa->ctp.cipher.offset = hlen + sizeof(struct rte_esp_hdr) +
 272                         sa->iv_len;
 273                 sa->ctp.cipher.length = 0;
 274                 break;
 275         case ALGO_TYPE_AES_CBC:
 276         case ALGO_TYPE_3DES_CBC:
 277                 sa->ctp.cipher.offset = sa->hdr_len +
 278                         sizeof(struct rte_esp_hdr);
 279                 sa->ctp.cipher.length = sa->iv_len;
 280                 break;
 281         }
 282 }
 283
 284 /*
 285  * Init ESP outbound tunnel specific things.
 286  */
 287 static void
 288 esp_outb_tun_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm)
 289 {
 290         sa->proto = prm->tun.next_proto;
 291         sa->hdr_len = prm->tun.hdr_len;
 292         sa->hdr_l3_off = prm->tun.hdr_l3_off;
 293
 294         /* update l2_len and l3_len fields for outbound mbuf */
 295         sa->tx_offload.val = rte_mbuf_tx_offload(sa->hdr_l3_off,
 296                 sa->hdr_len - sa->hdr_l3_off, 0, 0, 0, 0, 0);
 297
 298         memcpy(sa->hdr, prm->tun.hdr, sa->hdr_len);
 299
 300         esp_outb_init(sa, sa->hdr_len);
 301 }
 302
 303 /*
 304  * helper function, init SA structure.
 305  */
 306 static int
 307 esp_sa_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm,
 308         const struct crypto_xform *cxf)
 309 {
 310         static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
 311                                 RTE_IPSEC_SATP_MODE_MASK;
 312
 313         if (cxf->aead != NULL) {
 314                 switch (cxf->aead->algo) {
 315                 case RTE_CRYPTO_AEAD_AES_GCM:
 316                         /* RFC 4106 */
 317                         sa->aad_len = sizeof(struct aead_gcm_aad);
 318                         sa->icv_len = cxf->aead->digest_length;
 319                         sa->iv_ofs = cxf->aead->iv.offset;
 320                         sa->iv_len = sizeof(uint64_t);
 321                         sa->pad_align = IPSEC_PAD_AES_GCM;
 322                         sa->algo_type = ALGO_TYPE_AES_GCM;
 323                         break;
 324                 default:
 325                         return -EINVAL;
 326                 }
 327         } else {
 328                 sa->icv_len = cxf->auth->digest_length;
 329                 sa->iv_ofs = cxf->cipher->iv.offset;
 330                 sa->sqh_len = IS_ESN(sa) ? sizeof(uint32_t) : 0;
 331
 332                 switch (cxf->cipher->algo) {
 333                 case RTE_CRYPTO_CIPHER_NULL:
 334                         sa->pad_align = IPSEC_PAD_NULL;
 335                         sa->iv_len = 0;
 336                         sa->algo_type = ALGO_TYPE_NULL;
 337                         break;
 338
 339                 case RTE_CRYPTO_CIPHER_AES_CBC:
 340                         sa->pad_align = IPSEC_PAD_AES_CBC;
 341                         sa->iv_len = IPSEC_MAX_IV_SIZE;
 342                         sa->algo_type = ALGO_TYPE_AES_CBC;
 343                         break;
 344
 345                 case RTE_CRYPTO_CIPHER_AES_CTR:
 346                         /* RFC 3686 */
 347                         sa->pad_align = IPSEC_PAD_AES_CTR;
 348                         sa->iv_len = IPSEC_AES_CTR_IV_SIZE;
 349                         sa->algo_type = ALGO_TYPE_AES_CTR;
 350                         break;
 351
 352                 case RTE_CRYPTO_CIPHER_3DES_CBC:
 353                         /* RFC 1851 */
 354                         sa->pad_align = IPSEC_PAD_3DES_CBC;
 355                         sa->iv_len = IPSEC_3DES_IV_SIZE;
 356                         sa->algo_type = ALGO_TYPE_3DES_CBC;
 357                         break;
 358
 359                 default:
 360                         return -EINVAL;
 361                 }
 362         }
 363
 364         sa->udata = prm->userdata;
 365         sa->spi = rte_cpu_to_be_32(prm->ipsec_xform.spi);
 366         sa->salt = prm->ipsec_xform.salt;
 367
 368         /* preserve all values except l2_len and l3_len */
 369         sa->tx_offload.msk =
 370                 ~rte_mbuf_tx_offload(MBUF_MAX_L2_LEN, MBUF_MAX_L3_LEN,
 371                                 0, 0, 0, 0, 0);
 372
 373         switch (sa->type & msk) {
 374         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
 375         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
 376                 esp_inb_tun_init(sa, prm);
 377                 break;
 378         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
 379                 esp_inb_init(sa);
 380                 break;
 381         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
 382         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
 383                 esp_outb_tun_init(sa, prm);
 384                 break;
 385         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
 386                 esp_outb_init(sa, 0);
 387                 break;
 388         }
 389
 390         return 0;
 391 }
 392
 393 /*
 394  * helper function, init SA replay structure.
 395  */
 396 static void
 397 fill_sa_replay(struct rte_ipsec_sa *sa, uint32_t wnd_sz, uint32_t nb_bucket)
 398 {
 399         sa->replay.win_sz = wnd_sz;
 400         sa->replay.nb_bucket = nb_bucket;
 401         sa->replay.bucket_index_mask = nb_bucket - 1;
 402         sa->sqn.inb.rsn[0] = (struct replay_sqn *)(sa + 1);
 403         if ((sa->type & RTE_IPSEC_SATP_SQN_MASK) == RTE_IPSEC_SATP_SQN_ATOM)
 404                 sa->sqn.inb.rsn[1] = (struct replay_sqn *)
 405                         ((uintptr_t)sa->sqn.inb.rsn[0] + rsn_size(nb_bucket));
 406 }
 407
 408 int __rte_experimental
 409 rte_ipsec_sa_size(const struct rte_ipsec_sa_prm *prm)
 410 {
 411         uint64_t type;
 412         uint32_t nb, wsz;
 413         int32_t rc;
 414
 415         if (prm == NULL)
 416                 return -EINVAL;
 417
 418         /* determine SA type */
 419         rc = fill_sa_type(prm, &type);
 420         if (rc != 0)
 421                 return rc;
 422
 423         /* determine required size */
 424         wsz = prm->replay_win_sz;
 425         return ipsec_sa_size(type, &wsz, &nb);
 426 }
 427
 428 int __rte_experimental
 429 rte_ipsec_sa_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm,
 430         uint32_t size)
 431 {
 432         int32_t rc, sz;
 433         uint32_t nb, wsz;
 434         uint64_t type;
 435         struct crypto_xform cxf;
 436
 437         if (sa == NULL || prm == NULL)
 438                 return -EINVAL;
 439
 440         /* determine SA type */
 441         rc = fill_sa_type(prm, &type);
 442         if (rc != 0)
 443                 return rc;
 444
 445         /* determine required size */
 446         wsz = prm->replay_win_sz;
 447         sz = ipsec_sa_size(type, &wsz, &nb);
 448         if (sz < 0)
 449                 return sz;
 450         else if (size < (uint32_t)sz)
 451                 return -ENOSPC;
 452
 453         /* only esp is supported right now */
 454         if (prm->ipsec_xform.proto != RTE_SECURITY_IPSEC_SA_PROTO_ESP)
 455                 return -EINVAL;
 456
 457         if (prm->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL &&
 458                         prm->tun.hdr_len > sizeof(sa->hdr))
 459                 return -EINVAL;
 460
 461         rc = fill_crypto_xform(&cxf, type, prm);
 462         if (rc != 0)
 463                 return rc;
 464
 465         /* initialize SA */
 466
 467         memset(sa, 0, sz);
 468         sa->type = type;
 469         sa->size = sz;
 470
 471         /* check for ESN flag */
 472         sa->sqn_mask = (prm->ipsec_xform.options.esn == 0) ?
 473                 UINT32_MAX : UINT64_MAX;
 474
 475         rc = esp_sa_init(sa, prm, &cxf);
 476         if (rc != 0)
 477                 rte_ipsec_sa_fini(sa);
 478
 479         /* fill replay window related fields */
 480         if (nb != 0)
 481                 fill_sa_replay(sa, wsz, nb);
 482
 483         return sz;
 484 }
 485
 486 /*
 487  *  setup crypto ops for LOOKASIDE_PROTO type of devices.
 488  */
 489 static inline void
 490 lksd_proto_cop_prepare(const struct rte_ipsec_session *ss,
 491         struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num)
 492 {
 493         uint32_t i;
 494         struct rte_crypto_sym_op *sop;
 495
 496         for (i = 0; i != num; i++) {
 497                 sop = cop[i]->sym;
 498                 cop[i]->type = RTE_CRYPTO_OP_TYPE_SYMMETRIC;
 499                 cop[i]->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
 500                 cop[i]->sess_type = RTE_CRYPTO_OP_SECURITY_SESSION;
 501                 sop->m_src = mb[i];
 502                 __rte_security_attach_session(sop, ss->security.ses);
 503         }
 504 }
 505
 506 /*
 507  *  setup packets and crypto ops for LOOKASIDE_PROTO type of devices.
 508  *  Note that for LOOKASIDE_PROTO all packet modifications will be
 509  *  performed by PMD/HW.
 510  *  SW has only to prepare crypto op.
 511  */
 512 static uint16_t
 513 lksd_proto_prepare(const struct rte_ipsec_session *ss,
 514         struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num)
 515 {
 516         lksd_proto_cop_prepare(ss, mb, cop, num);
 517         return num;
 518 }
 519
 520 /*
 521  * simplest pkt process routine:
 522  * all actual processing is already done by HW/PMD,
 523  * just check mbuf ol_flags.
 524  * used for:
 525  * - inbound for RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL
 526  * - inbound/outbound for RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
 527  * - outbound for RTE_SECURITY_ACTION_TYPE_NONE when ESN is disabled
 528  */
 529 static uint16_t
 530 pkt_flag_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[],
 531         uint16_t num)
 532 {
 533         uint32_t i, k;
 534         uint32_t dr[num];
 535
 536         RTE_SET_USED(ss);
 537
 538         k = 0;
 539         for (i = 0; i != num; i++) {
 540                 if ((mb[i]->ol_flags & PKT_RX_SEC_OFFLOAD_FAILED) == 0)
 541                         k++;
 542                 else
 543                         dr[i - k] = i;
 544         }
 545
 546         /* handle unprocessed mbufs */
 547         if (k != num) {
 548                 rte_errno = EBADMSG;
 549                 if (k != 0)
 550                         move_bad_mbufs(mb, dr, num, num - k);
 551         }
 552
 553         return k;
 554 }
 555
 556 /*
 557  * Select packet processing function for session on LOOKASIDE_NONE
 558  * type of device.
 559  */
 560 static int
 561 lksd_none_pkt_func_select(const struct rte_ipsec_sa *sa,
 562                 struct rte_ipsec_sa_pkt_func *pf)
 563 {
 564         int32_t rc;
 565
 566         static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
 567                         RTE_IPSEC_SATP_MODE_MASK;
 568
 569         rc = 0;
 570         switch (sa->type & msk) {
 571         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
 572         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
 573                 pf->prepare = esp_inb_pkt_prepare;
 574                 pf->process = esp_inb_tun_pkt_process;
 575                 break;
 576         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
 577                 pf->prepare = esp_inb_pkt_prepare;
 578                 pf->process = esp_inb_trs_pkt_process;
 579                 break;
 580         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
 581         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
 582                 pf->prepare = esp_outb_tun_prepare;
 583                 pf->process = (sa->sqh_len != 0) ?
 584                         esp_outb_sqh_process : pkt_flag_process;
 585                 break;
 586         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
 587                 pf->prepare = esp_outb_trs_prepare;
 588                 pf->process = (sa->sqh_len != 0) ?
 589                         esp_outb_sqh_process : pkt_flag_process;
 590                 break;
 591         default:
 592                 rc = -ENOTSUP;
 593         }
 594
 595         return rc;
 596 }
 597
 598 /*
 599  * Select packet processing function for session on INLINE_CRYPTO
 600  * type of device.
 601  */
 602 static int
 603 inline_crypto_pkt_func_select(const struct rte_ipsec_sa *sa,
 604                 struct rte_ipsec_sa_pkt_func *pf)
 605 {
 606         int32_t rc;
 607
 608         static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
 609                         RTE_IPSEC_SATP_MODE_MASK;
 610
 611         rc = 0;
 612         switch (sa->type & msk) {
 613         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
 614         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
 615                 pf->process = esp_inb_tun_pkt_process;
 616                 break;
 617         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
 618                 pf->process = esp_inb_trs_pkt_process;
 619                 break;
 620         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
 621         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
 622                 pf->process = inline_outb_tun_pkt_process;
 623                 break;
 624         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
 625                 pf->process = inline_outb_trs_pkt_process;
 626                 break;
 627         default:
 628                 rc = -ENOTSUP;
 629         }
 630
 631         return rc;
 632 }
 633
 634 /*
 635  * Select packet processing function for given session based on SA parameters
 636  * and type of associated with the session device.
 637  */
 638 int
 639 ipsec_sa_pkt_func_select(const struct rte_ipsec_session *ss,
 640         const struct rte_ipsec_sa *sa, struct rte_ipsec_sa_pkt_func *pf)
 641 {
 642         int32_t rc;
 643
 644         rc = 0;
 645         pf[0] = (struct rte_ipsec_sa_pkt_func) { 0 };
 646
 647         switch (ss->type) {
 648         case RTE_SECURITY_ACTION_TYPE_NONE:
 649                 rc = lksd_none_pkt_func_select(sa, pf);
 650                 break;
 651         case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO:
 652                 rc = inline_crypto_pkt_func_select(sa, pf);
 653                 break;
 654         case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL:
 655                 if ((sa->type & RTE_IPSEC_SATP_DIR_MASK) ==
 656                                 RTE_IPSEC_SATP_DIR_IB)
 657                         pf->process = pkt_flag_process;
 658                 else
 659                         pf->process = inline_proto_outb_pkt_process;
 660                 break;
 661         case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL:
 662                 pf->prepare = lksd_proto_prepare;
 663                 pf->process = pkt_flag_process;
 664                 break;
 665         default:
 666                 rc = -ENOTSUP;
 667         }
 668
 669         return rc;
 670 }