1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(c) 2016-2017 Intel Corporation
6 * Security Associations
9 #include <netinet/in.h>
10 #include <netinet/ip.h>
11 #include <netinet/ip6.h>
13 #include <rte_memzone.h>
14 #include <rte_crypto.h>
15 #include <rte_security.h>
16 #include <rte_cryptodev.h>
17 #include <rte_byteorder.h>
18 #include <rte_errno.h>
20 #include <rte_random.h>
21 #include <rte_ethdev.h>
29 struct supported_cipher_algo {
31 enum rte_crypto_cipher_algorithm algo;
37 struct supported_auth_algo {
39 enum rte_crypto_auth_algorithm algo;
45 struct supported_aead_algo {
47 enum rte_crypto_aead_algorithm algo;
56 const struct supported_cipher_algo cipher_algos[] = {
59 .algo = RTE_CRYPTO_CIPHER_NULL,
65 .keyword = "aes-128-cbc",
66 .algo = RTE_CRYPTO_CIPHER_AES_CBC,
72 .keyword = "aes-256-cbc",
73 .algo = RTE_CRYPTO_CIPHER_AES_CBC,
79 .keyword = "aes-128-ctr",
80 .algo = RTE_CRYPTO_CIPHER_AES_CTR,
82 .block_size = 16, /* XXX AESNI MB limition, should be 4 */
86 .keyword = "3des-cbc",
87 .algo = RTE_CRYPTO_CIPHER_3DES_CBC,
94 const struct supported_auth_algo auth_algos[] = {
97 .algo = RTE_CRYPTO_AUTH_NULL,
103 .keyword = "sha1-hmac",
104 .algo = RTE_CRYPTO_AUTH_SHA1_HMAC,
109 .keyword = "sha256-hmac",
110 .algo = RTE_CRYPTO_AUTH_SHA256_HMAC,
116 const struct supported_aead_algo aead_algos[] = {
118 .keyword = "aes-128-gcm",
119 .algo = RTE_CRYPTO_AEAD_AES_GCM,
128 struct ipsec_sa sa_out[IPSEC_SA_MAX_ENTRIES];
131 struct ipsec_sa sa_in[IPSEC_SA_MAX_ENTRIES];
134 static const struct supported_cipher_algo *
135 find_match_cipher_algo(const char *cipher_keyword)
139 for (i = 0; i < RTE_DIM(cipher_algos); i++) {
140 const struct supported_cipher_algo *algo =
143 if (strcmp(cipher_keyword, algo->keyword) == 0)
150 static const struct supported_auth_algo *
151 find_match_auth_algo(const char *auth_keyword)
155 for (i = 0; i < RTE_DIM(auth_algos); i++) {
156 const struct supported_auth_algo *algo =
159 if (strcmp(auth_keyword, algo->keyword) == 0)
166 static const struct supported_aead_algo *
167 find_match_aead_algo(const char *aead_keyword)
171 for (i = 0; i < RTE_DIM(aead_algos); i++) {
172 const struct supported_aead_algo *algo =
175 if (strcmp(aead_keyword, algo->keyword) == 0)
183 * parse x:x:x:x.... hex number key string into uint8_t *key
185 * > 0: number of bytes parsed
189 parse_key_string(const char *key_str, uint8_t *key)
191 const char *pt_start = key_str, *pt_end = key_str;
192 uint32_t nb_bytes = 0;
194 while (pt_end != NULL) {
195 char sub_str[3] = {0};
197 pt_end = strchr(pt_start, ':');
199 if (pt_end == NULL) {
200 if (strlen(pt_start) > 2)
202 strncpy(sub_str, pt_start, 2);
204 if (pt_end - pt_start > 2)
207 strncpy(sub_str, pt_start, pt_end - pt_start);
208 pt_start = pt_end + 1;
211 key[nb_bytes++] = strtol(sub_str, NULL, 16);
218 parse_sa_tokens(char **tokens, uint32_t n_tokens,
219 struct parse_status *status)
221 struct ipsec_sa *rule = NULL;
222 uint32_t ti; /*token index*/
223 uint32_t *ri /*rule index*/;
224 uint32_t cipher_algo_p = 0;
225 uint32_t auth_algo_p = 0;
226 uint32_t aead_algo_p = 0;
231 uint32_t portid_p = 0;
233 if (strcmp(tokens[0], "in") == 0) {
236 APP_CHECK(*ri <= IPSEC_SA_MAX_ENTRIES - 1, status,
237 "too many sa rules, abort insertion\n");
238 if (status->status < 0)
245 APP_CHECK(*ri <= IPSEC_SA_MAX_ENTRIES - 1, status,
246 "too many sa rules, abort insertion\n");
247 if (status->status < 0)
254 APP_CHECK_TOKEN_IS_NUM(tokens, 1, status);
255 if (status->status < 0)
257 if (atoi(tokens[1]) == INVALID_SPI)
259 rule->spi = atoi(tokens[1]);
261 for (ti = 2; ti < n_tokens; ti++) {
262 if (strcmp(tokens[ti], "mode") == 0) {
263 APP_CHECK_PRESENCE(mode_p, tokens[ti], status);
264 if (status->status < 0)
267 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
268 if (status->status < 0)
271 if (strcmp(tokens[ti], "ipv4-tunnel") == 0)
272 rule->flags = IP4_TUNNEL;
273 else if (strcmp(tokens[ti], "ipv6-tunnel") == 0)
274 rule->flags = IP6_TUNNEL;
275 else if (strcmp(tokens[ti], "transport") == 0)
276 rule->flags = TRANSPORT;
278 APP_CHECK(0, status, "unrecognized "
279 "input \"%s\"", tokens[ti]);
287 if (strcmp(tokens[ti], "cipher_algo") == 0) {
288 const struct supported_cipher_algo *algo;
291 APP_CHECK_PRESENCE(cipher_algo_p, tokens[ti],
293 if (status->status < 0)
296 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
297 if (status->status < 0)
300 algo = find_match_cipher_algo(tokens[ti]);
302 APP_CHECK(algo != NULL, status, "unrecognized "
303 "input \"%s\"", tokens[ti]);
305 rule->cipher_algo = algo->algo;
306 rule->block_size = algo->block_size;
307 rule->iv_len = algo->iv_len;
308 rule->cipher_key_len = algo->key_len;
310 /* for NULL algorithm, no cipher key required */
311 if (rule->cipher_algo == RTE_CRYPTO_CIPHER_NULL) {
316 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
317 if (status->status < 0)
320 APP_CHECK(strcmp(tokens[ti], "cipher_key") == 0,
321 status, "unrecognized input \"%s\", "
322 "expect \"cipher_key\"", tokens[ti]);
323 if (status->status < 0)
326 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
327 if (status->status < 0)
330 key_len = parse_key_string(tokens[ti],
332 APP_CHECK(key_len == rule->cipher_key_len, status,
333 "unrecognized input \"%s\"", tokens[ti]);
334 if (status->status < 0)
337 if (algo->algo == RTE_CRYPTO_CIPHER_AES_CBC ||
338 algo->algo == RTE_CRYPTO_CIPHER_3DES_CBC)
339 rule->salt = (uint32_t)rte_rand();
341 if (algo->algo == RTE_CRYPTO_CIPHER_AES_CTR) {
343 rule->cipher_key_len = key_len;
345 &rule->cipher_key[key_len], 4);
352 if (strcmp(tokens[ti], "auth_algo") == 0) {
353 const struct supported_auth_algo *algo;
356 APP_CHECK_PRESENCE(auth_algo_p, tokens[ti],
358 if (status->status < 0)
361 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
362 if (status->status < 0)
365 algo = find_match_auth_algo(tokens[ti]);
366 APP_CHECK(algo != NULL, status, "unrecognized "
367 "input \"%s\"", tokens[ti]);
369 rule->auth_algo = algo->algo;
370 rule->auth_key_len = algo->key_len;
371 rule->digest_len = algo->digest_len;
373 /* NULL algorithm and combined algos do not
376 if (algo->key_not_req) {
381 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
382 if (status->status < 0)
385 APP_CHECK(strcmp(tokens[ti], "auth_key") == 0,
386 status, "unrecognized input \"%s\", "
387 "expect \"auth_key\"", tokens[ti]);
388 if (status->status < 0)
391 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
392 if (status->status < 0)
395 key_len = parse_key_string(tokens[ti],
397 APP_CHECK(key_len == rule->auth_key_len, status,
398 "unrecognized input \"%s\"", tokens[ti]);
399 if (status->status < 0)
406 if (strcmp(tokens[ti], "aead_algo") == 0) {
407 const struct supported_aead_algo *algo;
410 APP_CHECK_PRESENCE(aead_algo_p, tokens[ti],
412 if (status->status < 0)
415 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
416 if (status->status < 0)
419 algo = find_match_aead_algo(tokens[ti]);
421 APP_CHECK(algo != NULL, status, "unrecognized "
422 "input \"%s\"", tokens[ti]);
424 rule->aead_algo = algo->algo;
425 rule->cipher_key_len = algo->key_len;
426 rule->digest_len = algo->digest_len;
427 rule->aad_len = algo->aad_len;
428 rule->block_size = algo->block_size;
429 rule->iv_len = algo->iv_len;
431 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
432 if (status->status < 0)
435 APP_CHECK(strcmp(tokens[ti], "aead_key") == 0,
436 status, "unrecognized input \"%s\", "
437 "expect \"aead_key\"", tokens[ti]);
438 if (status->status < 0)
441 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
442 if (status->status < 0)
445 key_len = parse_key_string(tokens[ti],
447 APP_CHECK(key_len == rule->cipher_key_len, status,
448 "unrecognized input \"%s\"", tokens[ti]);
449 if (status->status < 0)
453 rule->cipher_key_len = key_len;
455 &rule->cipher_key[key_len], 4);
461 if (strcmp(tokens[ti], "src") == 0) {
462 APP_CHECK_PRESENCE(src_p, tokens[ti], status);
463 if (status->status < 0)
466 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
467 if (status->status < 0)
470 if (rule->flags == IP4_TUNNEL) {
473 APP_CHECK(parse_ipv4_addr(tokens[ti],
474 &ip, NULL) == 0, status,
475 "unrecognized input \"%s\", "
476 "expect valid ipv4 addr",
478 if (status->status < 0)
480 rule->src.ip.ip4 = rte_bswap32(
481 (uint32_t)ip.s_addr);
482 } else if (rule->flags == IP6_TUNNEL) {
485 APP_CHECK(parse_ipv6_addr(tokens[ti], &ip,
487 "unrecognized input \"%s\", "
488 "expect valid ipv6 addr",
490 if (status->status < 0)
492 memcpy(rule->src.ip.ip6.ip6_b,
494 } else if (rule->flags == TRANSPORT) {
495 APP_CHECK(0, status, "unrecognized input "
496 "\"%s\"", tokens[ti]);
504 if (strcmp(tokens[ti], "dst") == 0) {
505 APP_CHECK_PRESENCE(dst_p, tokens[ti], status);
506 if (status->status < 0)
509 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
510 if (status->status < 0)
513 if (rule->flags == IP4_TUNNEL) {
516 APP_CHECK(parse_ipv4_addr(tokens[ti],
517 &ip, NULL) == 0, status,
518 "unrecognized input \"%s\", "
519 "expect valid ipv4 addr",
521 if (status->status < 0)
523 rule->dst.ip.ip4 = rte_bswap32(
524 (uint32_t)ip.s_addr);
525 } else if (rule->flags == IP6_TUNNEL) {
528 APP_CHECK(parse_ipv6_addr(tokens[ti], &ip,
530 "unrecognized input \"%s\", "
531 "expect valid ipv6 addr",
533 if (status->status < 0)
535 memcpy(rule->dst.ip.ip6.ip6_b, ip.s6_addr, 16);
536 } else if (rule->flags == TRANSPORT) {
537 APP_CHECK(0, status, "unrecognized "
538 "input \"%s\"", tokens[ti]);
546 if (strcmp(tokens[ti], "type") == 0) {
547 APP_CHECK_PRESENCE(type_p, tokens[ti], status);
548 if (status->status < 0)
551 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
552 if (status->status < 0)
555 if (strcmp(tokens[ti], "inline-crypto-offload") == 0)
557 RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO;
558 else if (strcmp(tokens[ti],
559 "inline-protocol-offload") == 0)
561 RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL;
562 else if (strcmp(tokens[ti],
563 "lookaside-protocol-offload") == 0)
565 RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL;
566 else if (strcmp(tokens[ti], "no-offload") == 0)
567 rule->type = RTE_SECURITY_ACTION_TYPE_NONE;
569 APP_CHECK(0, status, "Invalid input \"%s\"",
578 if (strcmp(tokens[ti], "port_id") == 0) {
579 APP_CHECK_PRESENCE(portid_p, tokens[ti], status);
580 if (status->status < 0)
582 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
583 if (status->status < 0)
585 rule->portid = atoi(tokens[ti]);
586 if (status->status < 0)
592 /* unrecognizeable input */
593 APP_CHECK(0, status, "unrecognized input \"%s\"",
599 APP_CHECK(cipher_algo_p == 0, status,
600 "AEAD used, no need for cipher options");
601 if (status->status < 0)
604 APP_CHECK(auth_algo_p == 0, status,
605 "AEAD used, no need for auth options");
606 if (status->status < 0)
609 APP_CHECK(cipher_algo_p == 1, status, "missing cipher or AEAD options");
610 if (status->status < 0)
613 APP_CHECK(auth_algo_p == 1, status, "missing auth or AEAD options");
614 if (status->status < 0)
618 APP_CHECK(mode_p == 1, status, "missing mode option");
619 if (status->status < 0)
622 if ((rule->type != RTE_SECURITY_ACTION_TYPE_NONE) && (portid_p == 0))
623 printf("Missing portid option, falling back to non-offload\n");
625 if (!type_p || !portid_p) {
626 rule->type = RTE_SECURITY_ACTION_TYPE_NONE;
634 print_one_sa_rule(const struct ipsec_sa *sa, int inbound)
639 printf("\tspi_%s(%3u):", inbound?"in":"out", sa->spi);
641 for (i = 0; i < RTE_DIM(cipher_algos); i++) {
642 if (cipher_algos[i].algo == sa->cipher_algo &&
643 cipher_algos[i].key_len == sa->cipher_key_len) {
644 printf("%s ", cipher_algos[i].keyword);
649 for (i = 0; i < RTE_DIM(auth_algos); i++) {
650 if (auth_algos[i].algo == sa->auth_algo) {
651 printf("%s ", auth_algos[i].keyword);
656 for (i = 0; i < RTE_DIM(aead_algos); i++) {
657 if (aead_algos[i].algo == sa->aead_algo) {
658 printf("%s ", aead_algos[i].keyword);
667 printf("IP4Tunnel ");
668 uint32_t_to_char(sa->src.ip.ip4, &a, &b, &c, &d);
669 printf("%hhu.%hhu.%hhu.%hhu ", d, c, b, a);
670 uint32_t_to_char(sa->dst.ip.ip4, &a, &b, &c, &d);
671 printf("%hhu.%hhu.%hhu.%hhu", d, c, b, a);
674 printf("IP6Tunnel ");
675 for (i = 0; i < 16; i++) {
676 if (i % 2 && i != 15)
677 printf("%.2x:", sa->src.ip.ip6.ip6_b[i]);
679 printf("%.2x", sa->src.ip.ip6.ip6_b[i]);
682 for (i = 0; i < 16; i++) {
683 if (i % 2 && i != 15)
684 printf("%.2x:", sa->dst.ip.ip6.ip6_b[i]);
686 printf("%.2x", sa->dst.ip.ip6.ip6_b[i]);
697 struct ipsec_sa sa[IPSEC_SA_MAX_ENTRIES];
700 struct rte_crypto_sym_xform a;
701 struct rte_crypto_sym_xform b;
703 } xf[IPSEC_SA_MAX_ENTRIES];
706 static struct sa_ctx *
707 sa_create(const char *name, int32_t socket_id)
710 struct sa_ctx *sa_ctx;
712 const struct rte_memzone *mz;
714 snprintf(s, sizeof(s), "%s_%u", name, socket_id);
716 /* Create SA array table */
717 printf("Creating SA context with %u maximum entries\n",
718 IPSEC_SA_MAX_ENTRIES);
720 mz_size = sizeof(struct sa_ctx);
721 mz = rte_memzone_reserve(s, mz_size, socket_id,
722 RTE_MEMZONE_1GB | RTE_MEMZONE_SIZE_HINT_ONLY);
724 printf("Failed to allocate SA DB memory\n");
729 sa_ctx = (struct sa_ctx *)mz->addr;
735 check_eth_dev_caps(uint16_t portid, uint32_t inbound)
737 struct rte_eth_dev_info dev_info;
739 rte_eth_dev_info_get(portid, &dev_info);
742 if ((dev_info.rx_offload_capa &
743 DEV_RX_OFFLOAD_SECURITY) == 0) {
744 RTE_LOG(WARNING, PORT,
745 "hardware RX IPSec offload is not supported\n");
749 } else { /* outbound */
750 if ((dev_info.tx_offload_capa &
751 DEV_TX_OFFLOAD_SECURITY) == 0) {
752 RTE_LOG(WARNING, PORT,
753 "hardware TX IPSec offload is not supported\n");
762 sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
763 uint32_t nb_entries, uint32_t inbound)
769 for (i = 0; i < nb_entries; i++) {
770 idx = SPI2IDX(entries[i].spi);
771 sa = &sa_ctx->sa[idx];
773 printf("Index %u already in use by SPI %u\n",
780 if (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL ||
781 sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) {
782 if (check_eth_dev_caps(sa->portid, inbound))
786 sa->direction = (inbound == 1) ?
787 RTE_SECURITY_IPSEC_SA_DIR_INGRESS :
788 RTE_SECURITY_IPSEC_SA_DIR_EGRESS;
792 sa->src.ip.ip4 = rte_cpu_to_be_32(sa->src.ip.ip4);
793 sa->dst.ip.ip4 = rte_cpu_to_be_32(sa->dst.ip.ip4);
796 if (sa->aead_algo == RTE_CRYPTO_AEAD_AES_GCM) {
799 sa_ctx->xf[idx].a.type = RTE_CRYPTO_SYM_XFORM_AEAD;
800 sa_ctx->xf[idx].a.aead.algo = sa->aead_algo;
801 sa_ctx->xf[idx].a.aead.key.data = sa->cipher_key;
802 sa_ctx->xf[idx].a.aead.key.length =
804 sa_ctx->xf[idx].a.aead.op = (inbound == 1) ?
805 RTE_CRYPTO_AEAD_OP_DECRYPT :
806 RTE_CRYPTO_AEAD_OP_ENCRYPT;
807 sa_ctx->xf[idx].a.next = NULL;
808 sa_ctx->xf[idx].a.aead.iv.offset = IV_OFFSET;
809 sa_ctx->xf[idx].a.aead.iv.length = iv_length;
810 sa_ctx->xf[idx].a.aead.aad_length =
812 sa_ctx->xf[idx].a.aead.digest_length =
815 sa->xforms = &sa_ctx->xf[idx].a;
817 print_one_sa_rule(sa, inbound);
819 switch (sa->cipher_algo) {
820 case RTE_CRYPTO_CIPHER_NULL:
821 case RTE_CRYPTO_CIPHER_3DES_CBC:
822 case RTE_CRYPTO_CIPHER_AES_CBC:
823 iv_length = sa->iv_len;
825 case RTE_CRYPTO_CIPHER_AES_CTR:
829 RTE_LOG(ERR, IPSEC_ESP,
830 "unsupported cipher algorithm %u\n",
836 sa_ctx->xf[idx].b.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
837 sa_ctx->xf[idx].b.cipher.algo = sa->cipher_algo;
838 sa_ctx->xf[idx].b.cipher.key.data = sa->cipher_key;
839 sa_ctx->xf[idx].b.cipher.key.length =
841 sa_ctx->xf[idx].b.cipher.op =
842 RTE_CRYPTO_CIPHER_OP_DECRYPT;
843 sa_ctx->xf[idx].b.next = NULL;
844 sa_ctx->xf[idx].b.cipher.iv.offset = IV_OFFSET;
845 sa_ctx->xf[idx].b.cipher.iv.length = iv_length;
847 sa_ctx->xf[idx].a.type = RTE_CRYPTO_SYM_XFORM_AUTH;
848 sa_ctx->xf[idx].a.auth.algo = sa->auth_algo;
849 sa_ctx->xf[idx].a.auth.key.data = sa->auth_key;
850 sa_ctx->xf[idx].a.auth.key.length =
852 sa_ctx->xf[idx].a.auth.digest_length =
854 sa_ctx->xf[idx].a.auth.op =
855 RTE_CRYPTO_AUTH_OP_VERIFY;
856 } else { /* outbound */
857 sa_ctx->xf[idx].a.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
858 sa_ctx->xf[idx].a.cipher.algo = sa->cipher_algo;
859 sa_ctx->xf[idx].a.cipher.key.data = sa->cipher_key;
860 sa_ctx->xf[idx].a.cipher.key.length =
862 sa_ctx->xf[idx].a.cipher.op =
863 RTE_CRYPTO_CIPHER_OP_ENCRYPT;
864 sa_ctx->xf[idx].a.next = NULL;
865 sa_ctx->xf[idx].a.cipher.iv.offset = IV_OFFSET;
866 sa_ctx->xf[idx].a.cipher.iv.length = iv_length;
868 sa_ctx->xf[idx].b.type = RTE_CRYPTO_SYM_XFORM_AUTH;
869 sa_ctx->xf[idx].b.auth.algo = sa->auth_algo;
870 sa_ctx->xf[idx].b.auth.key.data = sa->auth_key;
871 sa_ctx->xf[idx].b.auth.key.length =
873 sa_ctx->xf[idx].b.auth.digest_length =
875 sa_ctx->xf[idx].b.auth.op =
876 RTE_CRYPTO_AUTH_OP_GENERATE;
879 sa_ctx->xf[idx].a.next = &sa_ctx->xf[idx].b;
880 sa_ctx->xf[idx].b.next = NULL;
881 sa->xforms = &sa_ctx->xf[idx].a;
883 print_one_sa_rule(sa, inbound);
891 sa_out_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
894 return sa_add_rules(sa_ctx, entries, nb_entries, 0);
898 sa_in_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
901 return sa_add_rules(sa_ctx, entries, nb_entries, 1);
905 sa_init(struct socket_ctx *ctx, int32_t socket_id)
910 rte_exit(EXIT_FAILURE, "NULL context.\n");
912 if (ctx->sa_in != NULL)
913 rte_exit(EXIT_FAILURE, "Inbound SA DB for socket %u already "
914 "initialized\n", socket_id);
916 if (ctx->sa_out != NULL)
917 rte_exit(EXIT_FAILURE, "Outbound SA DB for socket %u already "
918 "initialized\n", socket_id);
922 ctx->sa_in = sa_create(name, socket_id);
923 if (ctx->sa_in == NULL)
924 rte_exit(EXIT_FAILURE, "Error [%d] creating SA "
925 "context %s in socket %d\n", rte_errno,
928 sa_in_add_rules(ctx->sa_in, sa_in, nb_sa_in);
930 RTE_LOG(WARNING, IPSEC, "No SA Inbound rule specified\n");
934 ctx->sa_out = sa_create(name, socket_id);
935 if (ctx->sa_out == NULL)
936 rte_exit(EXIT_FAILURE, "Error [%d] creating SA "
937 "context %s in socket %d\n", rte_errno,
940 sa_out_add_rules(ctx->sa_out, sa_out, nb_sa_out);
942 RTE_LOG(WARNING, IPSEC, "No SA Outbound rule "
947 inbound_sa_check(struct sa_ctx *sa_ctx, struct rte_mbuf *m, uint32_t sa_idx)
949 struct ipsec_mbuf_metadata *priv;
953 return (sa_ctx->sa[sa_idx].spi == priv->sa->spi);
957 single_inbound_lookup(struct ipsec_sa *sadb, struct rte_mbuf *pkt,
958 struct ipsec_sa **sa_ret)
968 ip = rte_pktmbuf_mtod(pkt, struct ip *);
969 if (ip->ip_v == IPVERSION)
970 esp = (struct esp_hdr *)(ip + 1);
972 esp = (struct esp_hdr *)(((struct ip6_hdr *)ip) + 1);
974 if (esp->spi == INVALID_SPI)
977 sa = &sadb[SPI2IDX(rte_be_to_cpu_32(esp->spi))];
978 if (rte_be_to_cpu_32(esp->spi) != sa->spi)
983 src4_addr = RTE_PTR_ADD(ip, offsetof(struct ip, ip_src));
984 if ((ip->ip_v == IPVERSION) &&
985 (sa->src.ip.ip4 == *src4_addr) &&
986 (sa->dst.ip.ip4 == *(src4_addr + 1)))
990 src6_addr = RTE_PTR_ADD(ip, offsetof(struct ip6_hdr, ip6_src));
991 if ((ip->ip_v == IP6_VERSION) &&
992 !memcmp(&sa->src.ip.ip6.ip6, src6_addr, 16) &&
993 !memcmp(&sa->dst.ip.ip6.ip6, src6_addr + 16, 16))
1002 inbound_sa_lookup(struct sa_ctx *sa_ctx, struct rte_mbuf *pkts[],
1003 struct ipsec_sa *sa[], uint16_t nb_pkts)
1007 for (i = 0; i < nb_pkts; i++)
1008 single_inbound_lookup(sa_ctx->sa, pkts[i], &sa[i]);
1012 outbound_sa_lookup(struct sa_ctx *sa_ctx, uint32_t sa_idx[],
1013 struct ipsec_sa *sa[], uint16_t nb_pkts)
1017 for (i = 0; i < nb_pkts; i++)
1018 sa[i] = &sa_ctx->sa[sa_idx[i]];