X-Git-Url: http://git.droids-corp.org/?a=blobdiff_plain;f=examples%2Fipsec-secgw%2Fipsec.c;h=5b032fecfbcc9b880b0c06185d50de483e49193b;hb=a550baf24af90f76354eab0d4f91165a78157d38;hp=dc85adfe556665c3eb64aae601a5240f8cae989e;hpb=3a690d5a65e206ff7b0726297fc769237b6a87f6;p=dpdk.git diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c index dc85adfe55..5b032fecfb 100644 --- a/examples/ipsec-secgw/ipsec.c +++ b/examples/ipsec-secgw/ipsec.c @@ -1,5 +1,5 @@ /* SPDX-License-Identifier: BSD-3-Clause - * Copyright(c) 2016-2017 Intel Corporation + * Copyright(c) 2016-2020 Intel Corporation */ #include #include @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include @@ -33,14 +34,30 @@ set_ipsec_conf(struct ipsec_sa *sa, struct rte_security_ipsec_xform *ipsec) memcpy((uint8_t *)&tunnel->ipv4.dst_ip, (uint8_t *)&sa->dst.ip.ip4, 4); + } else if (IS_IP6_TUNNEL(sa->flags)) { + tunnel->type = + RTE_SECURITY_IPSEC_TUNNEL_IPV6; + tunnel->ipv6.hlimit = IPDEFTTL; + tunnel->ipv6.dscp = 0; + tunnel->ipv6.flabel = 0; + + memcpy((uint8_t *)&tunnel->ipv6.src_addr, + (uint8_t *)&sa->src.ip.ip6.ip6_b, 16); + + memcpy((uint8_t *)&tunnel->ipv6.dst_addr, + (uint8_t *)&sa->dst.ip.ip6.ip6_b, 16); } - /* TODO support for Transport and IPV6 tunnel */ + /* TODO support for Transport */ } ipsec->esn_soft_limit = IPSEC_OFFLOAD_ESN_SOFTLIMIT; + ipsec->replay_win_sz = app_sa_prm.window_size; + ipsec->options.esn = app_sa_prm.enable_esn; + ipsec->options.udp_encap = sa->udp_encap; } int -create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) +create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa, + struct rte_ipsec_session *ips) { struct rte_cryptodev_info cdev_info; unsigned long cdev_id_qp = 0; @@ -71,14 +88,16 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) ipsec_ctx->tbl[cdev_id_qp].id, ipsec_ctx->tbl[cdev_id_qp].qp); - if (sa->type != RTE_SECURITY_ACTION_TYPE_NONE) { + if (ips->type != RTE_SECURITY_ACTION_TYPE_NONE && + ips->type != RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) { struct rte_security_session_conf sess_conf = { - .action_type = sa->type, + .action_type = ips->type, .protocol = RTE_SECURITY_PROTOCOL_IPSEC, {.ipsec = { .spi = sa->spi, .salt = sa->salt, .options = { 0 }, + .replay_win_sz = 0, .direction = sa->direction, .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, .mode = (IS_TUNNEL(sa->flags)) ? @@ -90,7 +109,7 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) }; - if (sa->type == RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL) { + if (ips->type == RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL) { struct rte_security_ctx *ctx = (struct rte_security_ctx *) rte_cryptodev_get_sec_ctx( ipsec_ctx->tbl[cdev_id_qp].id); @@ -98,9 +117,10 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) /* Set IPsec parameters in conf */ set_ipsec_conf(sa, &(sess_conf.ipsec)); - sa->sec_session = rte_security_session_create(ctx, - &sess_conf, ipsec_ctx->session_priv_pool); - if (sa->sec_session == NULL) { + ips->security.ses = rte_security_session_create(ctx, + &sess_conf, ipsec_ctx->session_pool, + ipsec_ctx->session_priv_pool); + if (ips->security.ses == NULL) { RTE_LOG(ERR, IPSEC, "SEC Session init failed: err: %d\n", ret); return -1; @@ -110,10 +130,22 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) return -1; } } else { - sa->crypto_session = rte_cryptodev_sym_session_create( + if (ips->type == RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) { + struct rte_cryptodev_info info; + uint16_t cdev_id; + + cdev_id = ipsec_ctx->tbl[cdev_id_qp].id; + rte_cryptodev_info_get(cdev_id, &info); + if (!(info.feature_flags & + RTE_CRYPTODEV_FF_SYM_CPU_CRYPTO)) + return -ENOTSUP; + + ips->crypto.dev_id = cdev_id; + } + ips->crypto.ses = rte_cryptodev_sym_session_create( ipsec_ctx->session_pool); rte_cryptodev_sym_session_init(ipsec_ctx->tbl[cdev_id_qp].id, - sa->crypto_session, sa->xforms, + ips->crypto.ses, sa->xforms, ipsec_ctx->session_priv_pool); rte_cryptodev_info_get(ipsec_ctx->tbl[cdev_id_qp].id, @@ -126,17 +158,19 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) } int -create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) +create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa, + struct rte_ipsec_session *ips) { int32_t ret = 0; struct rte_security_ctx *sec_ctx; struct rte_security_session_conf sess_conf = { - .action_type = sa->type, + .action_type = ips->type, .protocol = RTE_SECURITY_PROTOCOL_IPSEC, {.ipsec = { .spi = sa->spi, .salt = sa->salt, .options = { 0 }, + .replay_win_sz = 0, .direction = sa->direction, .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, .mode = (sa->flags == IP4_TUNNEL || @@ -151,7 +185,7 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) RTE_LOG_DP(DEBUG, IPSEC, "Create session for SA spi %u on port %u\n", sa->spi, sa->portid); - if (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) { + if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) { struct rte_flow_error err; const struct rte_security_capability *sec_cap; int ret = 0; @@ -165,9 +199,10 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) return -1; } - sa->sec_session = rte_security_session_create(sec_ctx, - &sess_conf, skt_ctx->session_pool); - if (sa->sec_session == NULL) { + ips->security.ses = rte_security_session_create(sec_ctx, + &sess_conf, skt_ctx->session_pool, + skt_ctx->session_priv_pool); + if (ips->security.ses == NULL) { RTE_LOG(ERR, IPSEC, "SEC Session init failed: err: %d\n", ret); return -1; @@ -177,7 +212,7 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) /* iterate until ESP tunnel*/ while (sec_cap->action != RTE_SECURITY_ACTION_TYPE_NONE) { - if (sec_cap->action == sa->type && + if (sec_cap->action == ips->type && sec_cap->protocol == RTE_SECURITY_PROTOCOL_IPSEC && sec_cap->ipsec.mode == @@ -193,8 +228,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) return -1; } - sa->ol_flags = sec_cap->ol_flags; - sa->security_ctx = sec_ctx; + ips->security.ol_flags = sec_cap->ol_flags; + ips->security.ctx = sec_ctx; sa->pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH; if (IS_IP6(sa->flags)) { @@ -223,7 +258,7 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) sa->pattern[3].type = RTE_FLOW_ITEM_TYPE_END; sa->action[0].type = RTE_FLOW_ACTION_TYPE_SECURITY; - sa->action[0].conf = sa->sec_session; + sa->action[0].conf = ips->security.ses; sa->action[1].type = RTE_FLOW_ACTION_TYPE_END; @@ -243,12 +278,30 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) unsigned int i; unsigned int j; - rte_eth_dev_info_get(sa->portid, &dev_info); + /* Don't create flow if default flow is created */ + if (flow_info_tbl[sa->portid].rx_def_flow) + return 0; + + ret = rte_eth_dev_info_get(sa->portid, &dev_info); + if (ret != 0) { + RTE_LOG(ERR, IPSEC, + "Error during getting device (port %u) info: %s\n", + sa->portid, strerror(-ret)); + return ret; + } + sa->action[2].type = RTE_FLOW_ACTION_TYPE_END; /* Try RSS. */ sa->action[1].type = RTE_FLOW_ACTION_TYPE_RSS; sa->action[1].conf = &action_rss; - rte_eth_dev_rss_hash_conf_get(sa->portid, &rss_conf); + ret = rte_eth_dev_rss_hash_conf_get(sa->portid, + &rss_conf); + if (ret != 0) { + RTE_LOG(ERR, IPSEC, + "rte_eth_dev_rss_hash_conf_get:ret=%d\n", + ret); + return -1; + } for (i = 0, j = 0; i < dev_info.nb_rx_queues; ++i) queue[j++] = i; @@ -282,8 +335,8 @@ create_inline_session(struct socket_ctx *skt_ctx, struct ipsec_sa *sa) if (ret) goto flow_create_failure; } else if (sa->attr.egress && - (sa->ol_flags & - RTE_SECURITY_TX_HW_TRAILER_OFFLOAD)) { + (ips->security.ol_flags & + RTE_SECURITY_TX_HW_TRAILER_OFFLOAD)) { sa->action[1].type = RTE_FLOW_ACTION_TYPE_PASSTHRU; sa->action[2].type = @@ -299,7 +352,7 @@ flow_create_failure: err.message); return -1; } - } else if (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) { + } else if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) { const struct rte_security_capability *sec_cap; sec_ctx = (struct rte_security_ctx *) @@ -327,9 +380,10 @@ flow_create_failure: sess_conf.userdata = (void *) sa; - sa->sec_session = rte_security_session_create(sec_ctx, - &sess_conf, skt_ctx->session_pool); - if (sa->sec_session == NULL) { + ips->security.ses = rte_security_session_create(sec_ctx, + &sess_conf, skt_ctx->session_pool, + skt_ctx->session_priv_pool); + if (ips->security.ses == NULL) { RTE_LOG(ERR, IPSEC, "SEC Session init failed: err: %d\n", ret); return -1; @@ -345,7 +399,7 @@ flow_create_failure: /* iterate until ESP tunnel*/ while (sec_cap->action != RTE_SECURITY_ACTION_TYPE_NONE) { - if (sec_cap->action == sa->type && + if (sec_cap->action == ips->type && sec_cap->protocol == RTE_SECURITY_PROTOCOL_IPSEC && sec_cap->ipsec.mode == @@ -361,10 +415,75 @@ flow_create_failure: return -1; } - sa->ol_flags = sec_cap->ol_flags; - sa->security_ctx = sec_ctx; + ips->security.ol_flags = sec_cap->ol_flags; + ips->security.ctx = sec_ctx; + } + + return 0; +} + +int +create_ipsec_esp_flow(struct ipsec_sa *sa) +{ + int ret = 0; + struct rte_flow_error err; + if (sa->direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) { + RTE_LOG(ERR, IPSEC, + "No Flow director rule for Egress traffic\n"); + return -1; + } + if (sa->flags == TRANSPORT) { + RTE_LOG(ERR, IPSEC, + "No Flow director rule for transport mode\n"); + return -1; + } + sa->action[0].type = RTE_FLOW_ACTION_TYPE_QUEUE; + sa->pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH; + sa->action[0].conf = &(struct rte_flow_action_queue) { + .index = sa->fdir_qid, + }; + sa->attr.egress = 0; + sa->attr.ingress = 1; + if (IS_IP6(sa->flags)) { + sa->pattern[1].mask = &rte_flow_item_ipv6_mask; + sa->pattern[1].type = RTE_FLOW_ITEM_TYPE_IPV6; + sa->pattern[1].spec = &sa->ipv6_spec; + memcpy(sa->ipv6_spec.hdr.dst_addr, + sa->dst.ip.ip6.ip6_b, sizeof(sa->dst.ip.ip6.ip6_b)); + memcpy(sa->ipv6_spec.hdr.src_addr, + sa->src.ip.ip6.ip6_b, sizeof(sa->src.ip.ip6.ip6_b)); + sa->pattern[2].type = RTE_FLOW_ITEM_TYPE_ESP; + sa->pattern[2].spec = &sa->esp_spec; + sa->pattern[2].mask = &rte_flow_item_esp_mask; + sa->esp_spec.hdr.spi = rte_cpu_to_be_32(sa->spi); + sa->pattern[3].type = RTE_FLOW_ITEM_TYPE_END; + } else if (IS_IP4(sa->flags)) { + sa->pattern[1].mask = &rte_flow_item_ipv4_mask; + sa->pattern[1].type = RTE_FLOW_ITEM_TYPE_IPV4; + sa->pattern[1].spec = &sa->ipv4_spec; + sa->ipv4_spec.hdr.dst_addr = sa->dst.ip.ip4; + sa->ipv4_spec.hdr.src_addr = sa->src.ip.ip4; + sa->pattern[2].type = RTE_FLOW_ITEM_TYPE_ESP; + sa->pattern[2].spec = &sa->esp_spec; + sa->pattern[2].mask = &rte_flow_item_esp_mask; + sa->esp_spec.hdr.spi = rte_cpu_to_be_32(sa->spi); + sa->pattern[3].type = RTE_FLOW_ITEM_TYPE_END; + } + sa->action[1].type = RTE_FLOW_ACTION_TYPE_END; + + ret = rte_flow_validate(sa->portid, &sa->attr, sa->pattern, sa->action, + &err); + if (ret < 0) { + RTE_LOG(ERR, IPSEC, "Flow validation failed %s\n", err.message); + return ret; + } + + sa->flow = rte_flow_create(sa->portid, &sa->attr, sa->pattern, + sa->action, &err); + if (!sa->flow) { + RTE_LOG(ERR, IPSEC, "Flow creation failed %s\n", err.message); + return -1; } - sa->cdev_id_qp = 0; return 0; } @@ -385,7 +504,7 @@ enqueue_cop_burst(struct cdev_qp *cqp) cqp->id, cqp->qp, ret, len); /* drop packets that we fail to enqueue */ for (i = ret; i < len; i++) - rte_pktmbuf_free(cqp->buf[i]->sym->m_src); + free_pkts(&cqp->buf[i]->sym->m_src, 1); } cqp->in_flight += ret; cqp->len = 0; @@ -402,17 +521,18 @@ enqueue_cop(struct cdev_qp *cqp, struct rte_crypto_op *cop) static inline void ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, - struct rte_mbuf *pkts[], struct ipsec_sa *sas[], + struct rte_mbuf *pkts[], void *sas[], uint16_t nb_pkts) { int32_t ret = 0, i; struct ipsec_mbuf_metadata *priv; struct rte_crypto_sym_op *sym_cop; struct ipsec_sa *sa; + struct rte_ipsec_session *ips; for (i = 0; i < nb_pkts; i++) { if (unlikely(sas[i] == NULL)) { - rte_pktmbuf_free(pkts[i]); + free_pkts(&pkts[i], 1); continue; } @@ -420,19 +540,29 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, rte_prefetch0(pkts[i]); priv = get_priv(pkts[i]); - sa = sas[i]; + sa = ipsec_mask_saptr(sas[i]); priv->sa = sa; + ips = ipsec_get_primary_session(sa); - switch (sa->type) { + switch (ips->type) { case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL: priv->cop.type = RTE_CRYPTO_OP_TYPE_SYMMETRIC; priv->cop.status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED; rte_prefetch0(&priv->sym_cop); - if ((unlikely(sa->sec_session == NULL)) && - create_lookaside_session(ipsec_ctx, sa)) { - rte_pktmbuf_free(pkts[i]); + if ((unlikely(ips->security.ses == NULL)) && + create_lookaside_session(ipsec_ctx, sa, ips)) { + free_pkts(&pkts[i], 1); + continue; + } + + if (unlikely((pkts[i]->packet_type & + (RTE_PTYPE_TUNNEL_MASK | + RTE_PTYPE_L4_MASK)) == + MBUF_PTYPE_TUNNEL_ESP_IN_UDP && + sa->udp_encap != 1)) { + free_pkts(&pkts[i], 1); continue; } @@ -440,8 +570,15 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, sym_cop->m_src = pkts[i]; rte_security_attach_session(&priv->cop, - sa->sec_session); + ips->security.ses); break; + + case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO: + RTE_LOG(ERR, IPSEC, "CPU crypto is not supported by the" + " legacy mode."); + free_pkts(&pkts[i], 1); + continue; + case RTE_SECURITY_ACTION_TYPE_NONE: priv->cop.type = RTE_CRYPTO_OP_TYPE_SYMMETRIC; @@ -449,49 +586,51 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, rte_prefetch0(&priv->sym_cop); - if ((unlikely(sa->crypto_session == NULL)) && - create_lookaside_session(ipsec_ctx, sa)) { - rte_pktmbuf_free(pkts[i]); + if ((unlikely(ips->crypto.ses == NULL)) && + create_lookaside_session(ipsec_ctx, sa, ips)) { + free_pkts(&pkts[i], 1); continue; } rte_crypto_op_attach_sym_session(&priv->cop, - sa->crypto_session); + ips->crypto.ses); ret = xform_func(pkts[i], sa, &priv->cop); if (unlikely(ret)) { - rte_pktmbuf_free(pkts[i]); + free_pkts(&pkts[i], 1); continue; } break; case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL: - RTE_ASSERT(sa->sec_session != NULL); + RTE_ASSERT(ips->security.ses != NULL); ipsec_ctx->ol_pkts[ipsec_ctx->ol_pkts_cnt++] = pkts[i]; - if (sa->ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA) + if (ips->security.ol_flags & + RTE_SECURITY_TX_OLOAD_NEED_MDATA) rte_security_set_pkt_metadata( - sa->security_ctx, - sa->sec_session, pkts[i], NULL); + ips->security.ctx, ips->security.ses, + pkts[i], NULL); continue; case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO: - RTE_ASSERT(sa->sec_session != NULL); + RTE_ASSERT(ips->security.ses != NULL); priv->cop.type = RTE_CRYPTO_OP_TYPE_SYMMETRIC; priv->cop.status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED; rte_prefetch0(&priv->sym_cop); rte_security_attach_session(&priv->cop, - sa->sec_session); + ips->security.ses); ret = xform_func(pkts[i], sa, &priv->cop); if (unlikely(ret)) { - rte_pktmbuf_free(pkts[i]); + free_pkts(&pkts[i], 1); continue; } ipsec_ctx->ol_pkts[ipsec_ctx->ol_pkts_cnt++] = pkts[i]; - if (sa->ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA) + if (ips->security.ol_flags & + RTE_SECURITY_TX_OLOAD_NEED_MDATA) rte_security_set_pkt_metadata( - sa->security_ctx, - sa->sec_session, pkts[i], NULL); + ips->security.ctx, ips->security.ses, + pkts[i], NULL); continue; } @@ -517,7 +656,7 @@ ipsec_inline_dequeue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, sa = priv->sa; ret = xform_func(pkt, sa, &priv->cop); if (unlikely(ret)) { - rte_pktmbuf_free(pkt); + free_pkts(&pkt, 1); continue; } pkts[nb_pkts++] = pkt; @@ -560,10 +699,17 @@ ipsec_dequeue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx, RTE_ASSERT(sa != NULL); - if (sa->type == RTE_SECURITY_ACTION_TYPE_NONE) { + if (ipsec_get_action_type(sa) == + RTE_SECURITY_ACTION_TYPE_NONE) { ret = xform_func(pkt, sa, cops[j]); if (unlikely(ret)) { - rte_pktmbuf_free(pkt); + free_pkts(&pkt, 1); + continue; + } + } else if (ipsec_get_action_type(sa) == + RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL) { + if (cops[j]->status) { + free_pkts(&pkt, 1); continue; } } @@ -579,7 +725,7 @@ uint16_t ipsec_inbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], uint16_t nb_pkts, uint16_t len) { - struct ipsec_sa *sas[nb_pkts]; + void *sas[nb_pkts]; inbound_sa_lookup(ctx->sa_ctx, pkts, sas, nb_pkts); @@ -599,7 +745,7 @@ uint16_t ipsec_outbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[], uint32_t sa_idx[], uint16_t nb_pkts, uint16_t len) { - struct ipsec_sa *sas[nb_pkts]; + void *sas[nb_pkts]; outbound_sa_lookup(ctx->sa_ctx, sa_idx, sas, nb_pkts);