X-Git-Url: http://git.droids-corp.org/?a=blobdiff_plain;ds=sidebyside;f=examples%2Fipsec-secgw%2Fipsec.c;h=d4b57121ac8fa204f2aae6c2c71f6ace00645449;hb=aafc3ce7f289e97a21e9a01a3806684f94ff5bb9;hp=5f9d560dd9415fd0e774a1b287155f232ef967c1;hpb=23742f21f74a9d8380367c39b8ee4561e6dd1526;p=dpdk.git diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c index 5f9d560dd9..d4b57121ac 100644 --- a/examples/ipsec-secgw/ipsec.c +++ b/examples/ipsec-secgw/ipsec.c @@ -33,14 +33,29 @@ set_ipsec_conf(struct ipsec_sa *sa, struct rte_security_ipsec_xform *ipsec) memcpy((uint8_t *)&tunnel->ipv4.dst_ip, (uint8_t *)&sa->dst.ip.ip4, 4); + } else if (IS_IP6_TUNNEL(sa->flags)) { + tunnel->type = + RTE_SECURITY_IPSEC_TUNNEL_IPV6; + tunnel->ipv6.hlimit = IPDEFTTL; + tunnel->ipv6.dscp = 0; + tunnel->ipv6.flabel = 0; + + memcpy((uint8_t *)&tunnel->ipv6.src_addr, + (uint8_t *)&sa->src.ip.ip6.ip6_b, 16); + + memcpy((uint8_t *)&tunnel->ipv6.dst_addr, + (uint8_t *)&sa->dst.ip.ip6.ip6_b, 16); } - /* TODO support for Transport and IPV6 tunnel */ + /* TODO support for Transport */ } ipsec->esn_soft_limit = IPSEC_OFFLOAD_ESN_SOFTLIMIT; + ipsec->replay_win_sz = app_sa_prm.window_size; + ipsec->options.esn = app_sa_prm.enable_esn; } int -create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) +create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa, + struct rte_ipsec_session *ips) { struct rte_cryptodev_info cdev_info; unsigned long cdev_id_qp = 0; @@ -71,14 +86,15 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) ipsec_ctx->tbl[cdev_id_qp].id, ipsec_ctx->tbl[cdev_id_qp].qp); - if (sa->type != RTE_SECURITY_ACTION_TYPE_NONE) { + if (ips->type != RTE_SECURITY_ACTION_TYPE_NONE) { struct rte_security_session_conf sess_conf = { - .action_type = sa->type, + .action_type = ips->type, .protocol = RTE_SECURITY_PROTOCOL_IPSEC, {.ipsec = { .spi = sa->spi, .salt = sa->salt, .options = { 0 }, + .replay_win_sz = 0, .direction = sa->direction, .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, .mode = (IS_TUNNEL(sa->flags)) ? @@ -90,7 +106,7 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) }; - if (sa->type == RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL) { + if (ips->type == RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL) { struct rte_security_ctx *ctx = (struct rte_security_ctx *) rte_cryptodev_get_sec_ctx( ipsec_ctx->tbl[cdev_id_qp].id); @@ -98,9 +114,9 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) /* Set IPsec parameters in conf */ set_ipsec_conf(sa, &(sess_conf.ipsec)); - sa->sec_session = rte_security_session_create(ctx, + ips->security.ses = rte_security_session_create(ctx, &sess_conf, ipsec_ctx->session_priv_pool); - if (sa->sec_session == NULL) { + if (ips->security.ses == NULL) { RTE_LOG(ERR, IPSEC, "SEC Session init failed: err: %d\n", ret); return -1; @@ -110,10 +126,10 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) return -1; } } else { - sa->crypto_session = rte_cryptodev_sym_session_create( + ips->crypto.ses = rte_cryptodev_sym_session_create( ipsec_ctx->session_pool); rte_cryptodev_sym_session_init(ipsec_ctx->tbl[cdev_id_qp].id, - sa->crypto_session, sa->xforms, + ips->crypto.ses, sa->xforms, ipsec_ctx->session_priv_pool); rte_cryptodev_info_get(ipsec_ctx->tbl[cdev_id_qp].id, @@ -126,17 +142,19 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) } int -create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) +create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa, + struct rte_ipsec_session *ips) { int32_t ret = 0; struct rte_security_ctx *sec_ctx; struct rte_security_session_conf sess_conf = { - .action_type = sa->type, + .action_type = ips->type, .protocol = RTE_SECURITY_PROTOCOL_IPSEC, {.ipsec = { .spi = sa->spi, .salt = sa->salt, .options = { 0 }, + .replay_win_sz = 0, .direction = sa->direction, .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, .mode = (sa->flags == IP4_TUNNEL || @@ -151,7 +169,7 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) RTE_LOG_DP(DEBUG, IPSEC, "Create session for SA spi %u on port %u\n", sa->spi, sa->portid); - if (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) { + if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) { struct rte_flow_error err; const struct rte_security_capability *sec_cap; int ret = 0; @@ -165,9 +183,9 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) return -1; } - sa->sec_session = rte_security_session_create(sec_ctx, + ips->security.ses = rte_security_session_create(sec_ctx, &sess_conf, skt_ctx->session_pool); - if (sa->sec_session == NULL) { + if (ips->security.ses == NULL) { RTE_LOG(ERR, IPSEC, "SEC Session init failed: err: %d\n", ret); return -1; @@ -177,7 +195,7 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) /* iterate until ESP tunnel*/ while (sec_cap->action != RTE_SECURITY_ACTION_TYPE_NONE) { - if (sec_cap->action == sa->type && + if (sec_cap->action == ips->type && sec_cap->protocol == RTE_SECURITY_PROTOCOL_IPSEC && sec_cap->ipsec.mode == @@ -193,8 +211,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) return -1; } - sa->ol_flags = sec_cap->ol_flags; - sa->security_ctx = sec_ctx; + ips->security.ol_flags = sec_cap->ol_flags; + ips->security.ctx = sec_ctx; sa->pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH; if (IS_IP6(sa->flags)) { @@ -223,7 +241,7 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) sa->pattern[3].type = RTE_FLOW_ITEM_TYPE_END; sa->action[0].type = RTE_FLOW_ACTION_TYPE_SECURITY; - sa->action[0].conf = sa->sec_session; + sa->action[0].conf = ips->security.ses; sa->action[1].type = RTE_FLOW_ACTION_TYPE_END; @@ -243,7 +261,14 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) unsigned int i; unsigned int j; - rte_eth_dev_info_get(sa->portid, &dev_info); + ret = rte_eth_dev_info_get(sa->portid, &dev_info); + if (ret != 0) { + RTE_LOG(ERR, IPSEC, + "Error during getting device (port %u) info: %s\n", + sa->portid, strerror(-ret)); + return ret; + } + sa->action[2].type = RTE_FLOW_ACTION_TYPE_END; /* Try RSS. */ sa->action[1].type = RTE_FLOW_ACTION_TYPE_RSS; @@ -289,8 +314,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) if (ret) goto flow_create_failure; } else if (sa->attr.egress && - (sa->ol_flags & - RTE_SECURITY_TX_HW_TRAILER_OFFLOAD)) { + (ips->security.ol_flags & + RTE_SECURITY_TX_HW_TRAILER_OFFLOAD)) { sa->action[1].type = RTE_FLOW_ACTION_TYPE_PASSTHRU; sa->action[2].type = @@ -306,7 +331,7 @@ flow_create_failure: err.message); return -1; } - } else if (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) { + } else if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) { const struct rte_security_capability *sec_cap; sec_ctx = (struct rte_security_ctx *) @@ -334,9 +359,9 @@ flow_create_failure: sess_conf.userdata = (void *) sa; - sa->sec_session = rte_security_session_create(sec_ctx, + ips->security.ses = rte_security_session_create(sec_ctx, &sess_conf, skt_ctx->session_pool); - if (sa->sec_session == NULL) { + if (ips->security.ses == NULL) { RTE_LOG(ERR, IPSEC, "SEC Session init failed: err: %d\n", ret); return -1; @@ -352,7 +377,7 @@ flow_create_failure: /* iterate until ESP tunnel*/ while (sec_cap->action != RTE_SECURITY_ACTION_TYPE_NONE) { - if (sec_cap->action == sa->type && + if (sec_cap->action == ips->type && sec_cap->protocol == RTE_SECURITY_PROTOCOL_IPSEC && sec_cap->ipsec.mode == @@ -368,8 +393,8 @@ flow_create_failure: return -1; } - sa->ol_flags = sec_cap->ol_flags; - sa->security_ctx = sec_ctx; + ips->security.ol_flags = sec_cap->ol_flags; + ips->security.ctx = sec_ctx; } sa->cdev_id_qp = 0; @@ -409,13 +434,14 @@ enqueue_cop(struct cdev_qp *cqp, struct rte_crypto_op *cop) static inline void ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, - struct rte_mbuf *pkts[], struct ipsec_sa *sas[], + struct rte_mbuf *pkts[], void *sas[], uint16_t nb_pkts) { int32_t ret = 0, i; struct ipsec_mbuf_metadata *priv; struct rte_crypto_sym_op *sym_cop; struct ipsec_sa *sa; + struct rte_ipsec_session *ips; for (i = 0; i < nb_pkts; i++) { if (unlikely(sas[i] == NULL)) { @@ -427,18 +453,19 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, rte_prefetch0(pkts[i]); priv = get_priv(pkts[i]); - sa = sas[i]; + sa = ipsec_mask_saptr(sas[i]); priv->sa = sa; + ips = ipsec_get_primary_session(sa); - switch (sa->type) { + switch (ips->type) { case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL: priv->cop.type = RTE_CRYPTO_OP_TYPE_SYMMETRIC; priv->cop.status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED; rte_prefetch0(&priv->sym_cop); - if ((unlikely(sa->sec_session == NULL)) && - create_lookaside_session(ipsec_ctx, sa)) { + if ((unlikely(ips->security.ses == NULL)) && + create_lookaside_session(ipsec_ctx, sa, ips)) { rte_pktmbuf_free(pkts[i]); continue; } @@ -447,7 +474,7 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, sym_cop->m_src = pkts[i]; rte_security_attach_session(&priv->cop, - sa->sec_session); + ips->security.ses); break; case RTE_SECURITY_ACTION_TYPE_NONE: @@ -456,14 +483,14 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, rte_prefetch0(&priv->sym_cop); - if ((unlikely(sa->crypto_session == NULL)) && - create_lookaside_session(ipsec_ctx, sa)) { + if ((unlikely(ips->crypto.ses == NULL)) && + create_lookaside_session(ipsec_ctx, sa, ips)) { rte_pktmbuf_free(pkts[i]); continue; } rte_crypto_op_attach_sym_session(&priv->cop, - sa->crypto_session); + ips->crypto.ses); ret = xform_func(pkts[i], sa, &priv->cop); if (unlikely(ret)) { @@ -472,21 +499,22 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, } break; case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL: - RTE_ASSERT(sa->sec_session != NULL); + RTE_ASSERT(ips->security.ses != NULL); ipsec_ctx->ol_pkts[ipsec_ctx->ol_pkts_cnt++] = pkts[i]; - if (sa->ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA) + if (ips->security.ol_flags & + RTE_SECURITY_TX_OLOAD_NEED_MDATA) rte_security_set_pkt_metadata( - sa->security_ctx, - sa->sec_session, pkts[i], NULL); + ips->security.ctx, ips->security.ses, + pkts[i], NULL); continue; case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO: - RTE_ASSERT(sa->sec_session != NULL); + RTE_ASSERT(ips->security.ses != NULL); priv->cop.type = RTE_CRYPTO_OP_TYPE_SYMMETRIC; priv->cop.status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED; rte_prefetch0(&priv->sym_cop); rte_security_attach_session(&priv->cop, - sa->sec_session); + ips->security.ses); ret = xform_func(pkts[i], sa, &priv->cop); if (unlikely(ret)) { @@ -495,10 +523,11 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, } ipsec_ctx->ol_pkts[ipsec_ctx->ol_pkts_cnt++] = pkts[i]; - if (sa->ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA) + if (ips->security.ol_flags & + RTE_SECURITY_TX_OLOAD_NEED_MDATA) rte_security_set_pkt_metadata( - sa->security_ctx, - sa->sec_session, pkts[i], NULL); + ips->security.ctx, ips->security.ses, + pkts[i], NULL); continue; } @@ -567,12 +596,19 @@ ipsec_dequeue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, RTE_ASSERT(sa != NULL); - if (sa->type == RTE_SECURITY_ACTION_TYPE_NONE) { + if (ipsec_get_action_type(sa) == + RTE_SECURITY_ACTION_TYPE_NONE) { ret = xform_func(pkt, sa, cops[j]); if (unlikely(ret)) { rte_pktmbuf_free(pkt); continue; } + } else if (ipsec_get_action_type(sa) == + RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL) { + if (cops[j]->status) { + rte_pktmbuf_free(pkt); + continue; + } } pkts[nb_pkts++] = pkt; } @@ -586,7 +622,7 @@ uint16_t ipsec_inbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], uint16_t nb_pkts, uint16_t len) { - struct ipsec_sa *sas[nb_pkts]; + void *sas[nb_pkts]; inbound_sa_lookup(ctx->sa_ctx, pkts, sas, nb_pkts); @@ -606,7 +642,7 @@ uint16_t ipsec_outbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], uint32_t sa_idx[], uint16_t nb_pkts, uint16_t len) { - struct ipsec_sa *sas[nb_pkts]; + void *sas[nb_pkts]; outbound_sa_lookup(ctx->sa_ctx, sa_idx, sas, nb_pkts);