lib/librte_ipsec/sa.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright(c) 2018 Intel Corporation
   3  */
   4
   5 #include <rte_ipsec.h>
   6 #include <rte_esp.h>
   7 #include <rte_ip.h>
   8 #include <rte_errno.h>
   9 #include <rte_cryptodev.h>
  10
  11 #include "sa.h"
  12 #include "ipsec_sqn.h"
  13 #include "crypto.h"
  14 #include "iph.h"
  15 #include "misc.h"
  16 #include "pad.h"
  17
  18 #define MBUF_MAX_L2_LEN         RTE_LEN2MASK(RTE_MBUF_L2_LEN_BITS, uint64_t)
  19 #define MBUF_MAX_L3_LEN         RTE_LEN2MASK(RTE_MBUF_L3_LEN_BITS, uint64_t)
  20
  21 /* some helper structures */
  22 struct crypto_xform {
  23         struct rte_crypto_auth_xform *auth;
  24         struct rte_crypto_cipher_xform *cipher;
  25         struct rte_crypto_aead_xform *aead;
  26 };
  27
  28 /*
  29  * helper routine, fills internal crypto_xform structure.
  30  */
  31 static int
  32 fill_crypto_xform(struct crypto_xform *xform, uint64_t type,
  33         const struct rte_ipsec_sa_prm *prm)
  34 {
  35         struct rte_crypto_sym_xform *xf, *xfn;
  36
  37         memset(xform, 0, sizeof(*xform));
  38
  39         xf = prm->crypto_xform;
  40         if (xf == NULL)
  41                 return -EINVAL;
  42
  43         xfn = xf->next;
  44
  45         /* for AEAD just one xform required */
  46         if (xf->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
  47                 if (xfn != NULL)
  48                         return -EINVAL;
  49                 xform->aead = &xf->aead;
  50         /*
  51          * CIPHER+AUTH xforms are expected in strict order,
  52          * depending on SA direction:
  53          * inbound: AUTH+CIPHER
  54          * outbound: CIPHER+AUTH
  55          */
  56         } else if ((type & RTE_IPSEC_SATP_DIR_MASK) == RTE_IPSEC_SATP_DIR_IB) {
  57
  58                 /* wrong order or no cipher */
  59                 if (xfn == NULL || xf->type != RTE_CRYPTO_SYM_XFORM_AUTH ||
  60                                 xfn->type != RTE_CRYPTO_SYM_XFORM_CIPHER)
  61                         return -EINVAL;
  62
  63                 xform->auth = &xf->auth;
  64                 xform->cipher = &xfn->cipher;
  65
  66         } else {
  67
  68                 /* wrong order or no auth */
  69                 if (xfn == NULL || xf->type != RTE_CRYPTO_SYM_XFORM_CIPHER ||
  70                                 xfn->type != RTE_CRYPTO_SYM_XFORM_AUTH)
  71                         return -EINVAL;
  72
  73                 xform->cipher = &xf->cipher;
  74                 xform->auth = &xfn->auth;
  75         }
  76
  77         return 0;
  78 }
  79
  80 uint64_t __rte_experimental
  81 rte_ipsec_sa_type(const struct rte_ipsec_sa *sa)
  82 {
  83         return sa->type;
  84 }
  85
  86 /**
  87  * Based on number of buckets calculated required size for the
  88  * structure that holds replay window and sequence number (RSN) information.
  89  */
  90 static size_t
  91 rsn_size(uint32_t nb_bucket)
  92 {
  93         size_t sz;
  94         struct replay_sqn *rsn;
  95
  96         sz = sizeof(*rsn) + nb_bucket * sizeof(rsn->window[0]);
  97         sz = RTE_ALIGN_CEIL(sz, RTE_CACHE_LINE_SIZE);
  98         return sz;
  99 }
 100
 101 /*
 102  * for given size, calculate required number of buckets.
 103  */
 104 static uint32_t
 105 replay_num_bucket(uint32_t wsz)
 106 {
 107         uint32_t nb;
 108
 109         nb = rte_align32pow2(RTE_ALIGN_MUL_CEIL(wsz, WINDOW_BUCKET_SIZE) /
 110                 WINDOW_BUCKET_SIZE);
 111         nb = RTE_MAX(nb, (uint32_t)WINDOW_BUCKET_MIN);
 112
 113         return nb;
 114 }
 115
 116 static int32_t
 117 ipsec_sa_size(uint64_t type, uint32_t *wnd_sz, uint32_t *nb_bucket)
 118 {
 119         uint32_t n, sz, wsz;
 120
 121         wsz = *wnd_sz;
 122         n = 0;
 123
 124         if ((type & RTE_IPSEC_SATP_DIR_MASK) == RTE_IPSEC_SATP_DIR_IB) {
 125
 126                 /*
 127                  * RFC 4303 recommends 64 as minimum window size.
 128                  * there is no point to use ESN mode without SQN window,
 129                  * so make sure we have at least 64 window when ESN is enalbed.
 130                  */
 131                 wsz = ((type & RTE_IPSEC_SATP_ESN_MASK) ==
 132                         RTE_IPSEC_SATP_ESN_DISABLE) ?
 133                         wsz : RTE_MAX(wsz, (uint32_t)WINDOW_BUCKET_SIZE);
 134                 if (wsz != 0)
 135                         n = replay_num_bucket(wsz);
 136         }
 137
 138         if (n > WINDOW_BUCKET_MAX)
 139                 return -EINVAL;
 140
 141         *wnd_sz = wsz;
 142         *nb_bucket = n;
 143
 144         sz = rsn_size(n);
 145         if ((type & RTE_IPSEC_SATP_SQN_MASK) == RTE_IPSEC_SATP_SQN_ATOM)
 146                 sz *= REPLAY_SQN_NUM;
 147
 148         sz += sizeof(struct rte_ipsec_sa);
 149         return sz;
 150 }
 151
 152 void __rte_experimental
 153 rte_ipsec_sa_fini(struct rte_ipsec_sa *sa)
 154 {
 155         memset(sa, 0, sa->size);
 156 }
 157
 158 /*
 159  * Determine expected SA type based on input parameters.
 160  */
 161 static int
 162 fill_sa_type(const struct rte_ipsec_sa_prm *prm, uint64_t *type)
 163 {
 164         uint64_t tp;
 165
 166         tp = 0;
 167
 168         if (prm->ipsec_xform.proto == RTE_SECURITY_IPSEC_SA_PROTO_AH)
 169                 tp |= RTE_IPSEC_SATP_PROTO_AH;
 170         else if (prm->ipsec_xform.proto == RTE_SECURITY_IPSEC_SA_PROTO_ESP)
 171                 tp |= RTE_IPSEC_SATP_PROTO_ESP;
 172         else
 173                 return -EINVAL;
 174
 175         if (prm->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS)
 176                 tp |= RTE_IPSEC_SATP_DIR_OB;
 177         else if (prm->ipsec_xform.direction ==
 178                         RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
 179                 tp |= RTE_IPSEC_SATP_DIR_IB;
 180         else
 181                 return -EINVAL;
 182
 183         if (prm->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
 184                 if (prm->ipsec_xform.tunnel.type ==
 185                                 RTE_SECURITY_IPSEC_TUNNEL_IPV4)
 186                         tp |= RTE_IPSEC_SATP_MODE_TUNLV4;
 187                 else if (prm->ipsec_xform.tunnel.type ==
 188                                 RTE_SECURITY_IPSEC_TUNNEL_IPV6)
 189                         tp |= RTE_IPSEC_SATP_MODE_TUNLV6;
 190                 else
 191                         return -EINVAL;
 192
 193                 if (prm->tun.next_proto == IPPROTO_IPIP)
 194                         tp |= RTE_IPSEC_SATP_IPV4;
 195                 else if (prm->tun.next_proto == IPPROTO_IPV6)
 196                         tp |= RTE_IPSEC_SATP_IPV6;
 197                 else
 198                         return -EINVAL;
 199         } else if (prm->ipsec_xform.mode ==
 200                         RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT) {
 201                 tp |= RTE_IPSEC_SATP_MODE_TRANS;
 202                 if (prm->trs.proto == IPPROTO_IPIP)
 203                         tp |= RTE_IPSEC_SATP_IPV4;
 204                 else if (prm->trs.proto == IPPROTO_IPV6)
 205                         tp |= RTE_IPSEC_SATP_IPV6;
 206                 else
 207                         return -EINVAL;
 208         } else
 209                 return -EINVAL;
 210
 211         /* check for ESN flag */
 212         if (prm->ipsec_xform.options.esn == 0)
 213                 tp |= RTE_IPSEC_SATP_ESN_DISABLE;
 214         else
 215                 tp |= RTE_IPSEC_SATP_ESN_ENABLE;
 216
 217         /* interpret flags */
 218         if (prm->flags & RTE_IPSEC_SAFLAG_SQN_ATOM)
 219                 tp |= RTE_IPSEC_SATP_SQN_ATOM;
 220         else
 221                 tp |= RTE_IPSEC_SATP_SQN_RAW;
 222
 223         *type = tp;
 224         return 0;
 225 }
 226
 227 /*
 228  * Init ESP inbound specific things.
 229  */
 230 static void
 231 esp_inb_init(struct rte_ipsec_sa *sa)
 232 {
 233         /* these params may differ with new algorithms support */
 234         sa->ctp.auth.offset = 0;
 235         sa->ctp.auth.length = sa->icv_len - sa->sqh_len;
 236         sa->ctp.cipher.offset = sizeof(struct esp_hdr) + sa->iv_len;
 237         sa->ctp.cipher.length = sa->icv_len + sa->ctp.cipher.offset;
 238 }
 239
 240 /*
 241  * Init ESP inbound tunnel specific things.
 242  */
 243 static void
 244 esp_inb_tun_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm)
 245 {
 246         sa->proto = prm->tun.next_proto;
 247         esp_inb_init(sa);
 248 }
 249
 250 /*
 251  * Init ESP outbound specific things.
 252  */
 253 static void
 254 esp_outb_init(struct rte_ipsec_sa *sa, uint32_t hlen)
 255 {
 256         uint8_t algo_type;
 257
 258         sa->sqn.outb.raw = 1;
 259
 260         /* these params may differ with new algorithms support */
 261         sa->ctp.auth.offset = hlen;
 262         sa->ctp.auth.length = sizeof(struct esp_hdr) + sa->iv_len + sa->sqh_len;
 263
 264         algo_type = sa->algo_type;
 265
 266         switch (algo_type) {
 267         case ALGO_TYPE_AES_GCM:
 268         case ALGO_TYPE_AES_CTR:
 269         case ALGO_TYPE_NULL:
 270                 sa->ctp.cipher.offset = hlen + sizeof(struct esp_hdr) +
 271                         sa->iv_len;
 272                 sa->ctp.cipher.length = 0;
 273                 break;
 274         case ALGO_TYPE_AES_CBC:
 275         case ALGO_TYPE_3DES_CBC:
 276                 sa->ctp.cipher.offset = sa->hdr_len + sizeof(struct esp_hdr);
 277                 sa->ctp.cipher.length = sa->iv_len;
 278                 break;
 279         }
 280 }
 281
 282 /*
 283  * Init ESP outbound tunnel specific things.
 284  */
 285 static void
 286 esp_outb_tun_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm)
 287 {
 288         sa->proto = prm->tun.next_proto;
 289         sa->hdr_len = prm->tun.hdr_len;
 290         sa->hdr_l3_off = prm->tun.hdr_l3_off;
 291
 292         /* update l2_len and l3_len fields for outbound mbuf */
 293         sa->tx_offload.val = rte_mbuf_tx_offload(sa->hdr_l3_off,
 294                 sa->hdr_len - sa->hdr_l3_off, 0, 0, 0, 0, 0);
 295
 296         memcpy(sa->hdr, prm->tun.hdr, sa->hdr_len);
 297
 298         esp_outb_init(sa, sa->hdr_len);
 299 }
 300
 301 /*
 302  * helper function, init SA structure.
 303  */
 304 static int
 305 esp_sa_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm,
 306         const struct crypto_xform *cxf)
 307 {
 308         static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
 309                                 RTE_IPSEC_SATP_MODE_MASK;
 310
 311         if (cxf->aead != NULL) {
 312                 switch (cxf->aead->algo) {
 313                 case RTE_CRYPTO_AEAD_AES_GCM:
 314                         /* RFC 4106 */
 315                         sa->aad_len = sizeof(struct aead_gcm_aad);
 316                         sa->icv_len = cxf->aead->digest_length;
 317                         sa->iv_ofs = cxf->aead->iv.offset;
 318                         sa->iv_len = sizeof(uint64_t);
 319                         sa->pad_align = IPSEC_PAD_AES_GCM;
 320                         sa->algo_type = ALGO_TYPE_AES_GCM;
 321                         break;
 322                 default:
 323                         return -EINVAL;
 324                 }
 325         } else {
 326                 sa->icv_len = cxf->auth->digest_length;
 327                 sa->iv_ofs = cxf->cipher->iv.offset;
 328                 sa->sqh_len = IS_ESN(sa) ? sizeof(uint32_t) : 0;
 329
 330                 switch (cxf->cipher->algo) {
 331                 case RTE_CRYPTO_CIPHER_NULL:
 332                         sa->pad_align = IPSEC_PAD_NULL;
 333                         sa->iv_len = 0;
 334                         sa->algo_type = ALGO_TYPE_NULL;
 335                         break;
 336
 337                 case RTE_CRYPTO_CIPHER_AES_CBC:
 338                         sa->pad_align = IPSEC_PAD_AES_CBC;
 339                         sa->iv_len = IPSEC_MAX_IV_SIZE;
 340                         sa->algo_type = ALGO_TYPE_AES_CBC;
 341                         break;
 342
 343                 case RTE_CRYPTO_CIPHER_AES_CTR:
 344                         /* RFC 3686 */
 345                         sa->pad_align = IPSEC_PAD_AES_CTR;
 346                         sa->iv_len = IPSEC_AES_CTR_IV_SIZE;
 347                         sa->algo_type = ALGO_TYPE_AES_CTR;
 348                         break;
 349
 350                 case RTE_CRYPTO_CIPHER_3DES_CBC:
 351                         /* RFC 1851 */
 352                         sa->pad_align = IPSEC_PAD_3DES_CBC;
 353                         sa->iv_len = IPSEC_3DES_IV_SIZE;
 354                         sa->algo_type = ALGO_TYPE_3DES_CBC;
 355                         break;
 356
 357                 default:
 358                         return -EINVAL;
 359                 }
 360         }
 361
 362         sa->udata = prm->userdata;
 363         sa->spi = rte_cpu_to_be_32(prm->ipsec_xform.spi);
 364         sa->salt = prm->ipsec_xform.salt;
 365
 366         /* preserve all values except l2_len and l3_len */
 367         sa->tx_offload.msk =
 368                 ~rte_mbuf_tx_offload(MBUF_MAX_L2_LEN, MBUF_MAX_L3_LEN,
 369                                 0, 0, 0, 0, 0);
 370
 371         switch (sa->type & msk) {
 372         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
 373         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
 374                 esp_inb_tun_init(sa, prm);
 375                 break;
 376         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
 377                 esp_inb_init(sa);
 378                 break;
 379         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
 380         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
 381                 esp_outb_tun_init(sa, prm);
 382                 break;
 383         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
 384                 esp_outb_init(sa, 0);
 385                 break;
 386         }
 387
 388         return 0;
 389 }
 390
 391 /*
 392  * helper function, init SA replay structure.
 393  */
 394 static void
 395 fill_sa_replay(struct rte_ipsec_sa *sa, uint32_t wnd_sz, uint32_t nb_bucket)
 396 {
 397         sa->replay.win_sz = wnd_sz;
 398         sa->replay.nb_bucket = nb_bucket;
 399         sa->replay.bucket_index_mask = nb_bucket - 1;
 400         sa->sqn.inb.rsn[0] = (struct replay_sqn *)(sa + 1);
 401         if ((sa->type & RTE_IPSEC_SATP_SQN_MASK) == RTE_IPSEC_SATP_SQN_ATOM)
 402                 sa->sqn.inb.rsn[1] = (struct replay_sqn *)
 403                         ((uintptr_t)sa->sqn.inb.rsn[0] + rsn_size(nb_bucket));
 404 }
 405
 406 int __rte_experimental
 407 rte_ipsec_sa_size(const struct rte_ipsec_sa_prm *prm)
 408 {
 409         uint64_t type;
 410         uint32_t nb, wsz;
 411         int32_t rc;
 412
 413         if (prm == NULL)
 414                 return -EINVAL;
 415
 416         /* determine SA type */
 417         rc = fill_sa_type(prm, &type);
 418         if (rc != 0)
 419                 return rc;
 420
 421         /* determine required size */
 422         wsz = prm->replay_win_sz;
 423         return ipsec_sa_size(type, &wsz, &nb);
 424 }
 425
 426 int __rte_experimental
 427 rte_ipsec_sa_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm,
 428         uint32_t size)
 429 {
 430         int32_t rc, sz;
 431         uint32_t nb, wsz;
 432         uint64_t type;
 433         struct crypto_xform cxf;
 434
 435         if (sa == NULL || prm == NULL)
 436                 return -EINVAL;
 437
 438         /* determine SA type */
 439         rc = fill_sa_type(prm, &type);
 440         if (rc != 0)
 441                 return rc;
 442
 443         /* determine required size */
 444         wsz = prm->replay_win_sz;
 445         sz = ipsec_sa_size(type, &wsz, &nb);
 446         if (sz < 0)
 447                 return sz;
 448         else if (size < (uint32_t)sz)
 449                 return -ENOSPC;
 450
 451         /* only esp is supported right now */
 452         if (prm->ipsec_xform.proto != RTE_SECURITY_IPSEC_SA_PROTO_ESP)
 453                 return -EINVAL;
 454
 455         if (prm->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL &&
 456                         prm->tun.hdr_len > sizeof(sa->hdr))
 457                 return -EINVAL;
 458
 459         rc = fill_crypto_xform(&cxf, type, prm);
 460         if (rc != 0)
 461                 return rc;
 462
 463         /* initialize SA */
 464
 465         memset(sa, 0, sz);
 466         sa->type = type;
 467         sa->size = sz;
 468
 469         /* check for ESN flag */
 470         sa->sqn_mask = (prm->ipsec_xform.options.esn == 0) ?
 471                 UINT32_MAX : UINT64_MAX;
 472
 473         rc = esp_sa_init(sa, prm, &cxf);
 474         if (rc != 0)
 475                 rte_ipsec_sa_fini(sa);
 476
 477         /* fill replay window related fields */
 478         if (nb != 0)
 479                 fill_sa_replay(sa, wsz, nb);
 480
 481         return sz;
 482 }
 483
 484 /*
 485  *  setup crypto ops for LOOKASIDE_PROTO type of devices.
 486  */
 487 static inline void
 488 lksd_proto_cop_prepare(const struct rte_ipsec_session *ss,
 489         struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num)
 490 {
 491         uint32_t i;
 492         struct rte_crypto_sym_op *sop;
 493
 494         for (i = 0; i != num; i++) {
 495                 sop = cop[i]->sym;
 496                 cop[i]->type = RTE_CRYPTO_OP_TYPE_SYMMETRIC;
 497                 cop[i]->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
 498                 cop[i]->sess_type = RTE_CRYPTO_OP_SECURITY_SESSION;
 499                 sop->m_src = mb[i];
 500                 __rte_security_attach_session(sop, ss->security.ses);
 501         }
 502 }
 503
 504 /*
 505  *  setup packets and crypto ops for LOOKASIDE_PROTO type of devices.
 506  *  Note that for LOOKASIDE_PROTO all packet modifications will be
 507  *  performed by PMD/HW.
 508  *  SW has only to prepare crypto op.
 509  */
 510 static uint16_t
 511 lksd_proto_prepare(const struct rte_ipsec_session *ss,
 512         struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num)
 513 {
 514         lksd_proto_cop_prepare(ss, mb, cop, num);
 515         return num;
 516 }
 517
 518 /*
 519  * simplest pkt process routine:
 520  * all actual processing is already done by HW/PMD,
 521  * just check mbuf ol_flags.
 522  * used for:
 523  * - inbound for RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL
 524  * - inbound/outbound for RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
 525  * - outbound for RTE_SECURITY_ACTION_TYPE_NONE when ESN is disabled
 526  */
 527 static uint16_t
 528 pkt_flag_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[],
 529         uint16_t num)
 530 {
 531         uint32_t i, k;
 532         uint32_t dr[num];
 533
 534         RTE_SET_USED(ss);
 535
 536         k = 0;
 537         for (i = 0; i != num; i++) {
 538                 if ((mb[i]->ol_flags & PKT_RX_SEC_OFFLOAD_FAILED) == 0)
 539                         k++;
 540                 else
 541                         dr[i - k] = i;
 542         }
 543
 544         /* handle unprocessed mbufs */
 545         if (k != num) {
 546                 rte_errno = EBADMSG;
 547                 if (k != 0)
 548                         move_bad_mbufs(mb, dr, num, num - k);
 549         }
 550
 551         return k;
 552 }
 553
 554 /*
 555  * Select packet processing function for session on LOOKASIDE_NONE
 556  * type of device.
 557  */
 558 static int
 559 lksd_none_pkt_func_select(const struct rte_ipsec_sa *sa,
 560                 struct rte_ipsec_sa_pkt_func *pf)
 561 {
 562         int32_t rc;
 563
 564         static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
 565                         RTE_IPSEC_SATP_MODE_MASK;
 566
 567         rc = 0;
 568         switch (sa->type & msk) {
 569         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
 570         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
 571                 pf->prepare = esp_inb_pkt_prepare;
 572                 pf->process = esp_inb_tun_pkt_process;
 573                 break;
 574         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
 575                 pf->prepare = esp_inb_pkt_prepare;
 576                 pf->process = esp_inb_trs_pkt_process;
 577                 break;
 578         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
 579         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
 580                 pf->prepare = esp_outb_tun_prepare;
 581                 pf->process = (sa->sqh_len != 0) ?
 582                         esp_outb_sqh_process : pkt_flag_process;
 583                 break;
 584         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
 585                 pf->prepare = esp_outb_trs_prepare;
 586                 pf->process = (sa->sqh_len != 0) ?
 587                         esp_outb_sqh_process : pkt_flag_process;
 588                 break;
 589         default:
 590                 rc = -ENOTSUP;
 591         }
 592
 593         return rc;
 594 }
 595
 596 /*
 597  * Select packet processing function for session on INLINE_CRYPTO
 598  * type of device.
 599  */
 600 static int
 601 inline_crypto_pkt_func_select(const struct rte_ipsec_sa *sa,
 602                 struct rte_ipsec_sa_pkt_func *pf)
 603 {
 604         int32_t rc;
 605
 606         static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
 607                         RTE_IPSEC_SATP_MODE_MASK;
 608
 609         rc = 0;
 610         switch (sa->type & msk) {
 611         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
 612         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
 613                 pf->process = esp_inb_tun_pkt_process;
 614                 break;
 615         case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
 616                 pf->process = esp_inb_trs_pkt_process;
 617                 break;
 618         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
 619         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
 620                 pf->process = inline_outb_tun_pkt_process;
 621                 break;
 622         case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
 623                 pf->process = inline_outb_trs_pkt_process;
 624                 break;
 625         default:
 626                 rc = -ENOTSUP;
 627         }
 628
 629         return rc;
 630 }
 631
 632 /*
 633  * Select packet processing function for given session based on SA parameters
 634  * and type of associated with the session device.
 635  */
 636 int
 637 ipsec_sa_pkt_func_select(const struct rte_ipsec_session *ss,
 638         const struct rte_ipsec_sa *sa, struct rte_ipsec_sa_pkt_func *pf)
 639 {
 640         int32_t rc;
 641
 642         rc = 0;
 643         pf[0] = (struct rte_ipsec_sa_pkt_func) { 0 };
 644
 645         switch (ss->type) {
 646         case RTE_SECURITY_ACTION_TYPE_NONE:
 647                 rc = lksd_none_pkt_func_select(sa, pf);
 648                 break;
 649         case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO:
 650                 rc = inline_crypto_pkt_func_select(sa, pf);
 651                 break;
 652         case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL:
 653                 if ((sa->type & RTE_IPSEC_SATP_DIR_MASK) ==
 654                                 RTE_IPSEC_SATP_DIR_IB)
 655                         pf->process = pkt_flag_process;
 656                 else
 657                         pf->process = inline_proto_outb_pkt_process;
 658                 break;
 659         case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL:
 660                 pf->prepare = lksd_proto_prepare;
 661                 pf->process = pkt_flag_process;
 662                 break;
 663         default:
 664                 rc = -ENOTSUP;
 665         }
 666
 667         return rc;
 668 }