2019-01-10 21:06:28 +00:00
|
|
|
/* SPDX-License-Identifier: BSD-3-Clause
|
2020-02-04 13:12:55 +00:00
|
|
|
* Copyright(c) 2018-2020 Intel Corporation
|
2019-01-10 21:06:28 +00:00
|
|
|
*/
|
|
|
|
|
2019-01-10 21:06:29 +00:00
|
|
|
#include <rte_ipsec.h>
|
2019-01-10 21:06:28 +00:00
|
|
|
#include <rte_esp.h>
|
|
|
|
#include <rte_ip.h>
|
|
|
|
#include <rte_errno.h>
|
2019-01-10 21:06:30 +00:00
|
|
|
#include <rte_cryptodev.h>
|
2019-01-10 21:06:28 +00:00
|
|
|
|
|
|
|
#include "sa.h"
|
|
|
|
#include "ipsec_sqn.h"
|
2019-01-10 21:06:30 +00:00
|
|
|
#include "crypto.h"
|
|
|
|
#include "iph.h"
|
2019-04-02 08:34:40 +00:00
|
|
|
#include "misc.h"
|
2019-01-10 21:06:30 +00:00
|
|
|
#include "pad.h"
|
2019-01-10 21:06:28 +00:00
|
|
|
|
2019-04-02 08:34:37 +00:00
|
|
|
#define MBUF_MAX_L2_LEN RTE_LEN2MASK(RTE_MBUF_L2_LEN_BITS, uint64_t)
|
|
|
|
#define MBUF_MAX_L3_LEN RTE_LEN2MASK(RTE_MBUF_L3_LEN_BITS, uint64_t)
|
|
|
|
|
2019-01-10 21:06:28 +00:00
|
|
|
/* some helper structures */
|
|
|
|
struct crypto_xform {
|
|
|
|
struct rte_crypto_auth_xform *auth;
|
|
|
|
struct rte_crypto_cipher_xform *cipher;
|
|
|
|
struct rte_crypto_aead_xform *aead;
|
|
|
|
};
|
|
|
|
|
|
|
|
/*
|
|
|
|
* helper routine, fills internal crypto_xform structure.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
fill_crypto_xform(struct crypto_xform *xform, uint64_t type,
|
|
|
|
const struct rte_ipsec_sa_prm *prm)
|
|
|
|
{
|
|
|
|
struct rte_crypto_sym_xform *xf, *xfn;
|
|
|
|
|
|
|
|
memset(xform, 0, sizeof(*xform));
|
|
|
|
|
|
|
|
xf = prm->crypto_xform;
|
|
|
|
if (xf == NULL)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
xfn = xf->next;
|
|
|
|
|
|
|
|
/* for AEAD just one xform required */
|
|
|
|
if (xf->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
|
|
|
|
if (xfn != NULL)
|
|
|
|
return -EINVAL;
|
|
|
|
xform->aead = &xf->aead;
|
|
|
|
/*
|
|
|
|
* CIPHER+AUTH xforms are expected in strict order,
|
|
|
|
* depending on SA direction:
|
|
|
|
* inbound: AUTH+CIPHER
|
|
|
|
* outbound: CIPHER+AUTH
|
|
|
|
*/
|
|
|
|
} else if ((type & RTE_IPSEC_SATP_DIR_MASK) == RTE_IPSEC_SATP_DIR_IB) {
|
|
|
|
|
|
|
|
/* wrong order or no cipher */
|
|
|
|
if (xfn == NULL || xf->type != RTE_CRYPTO_SYM_XFORM_AUTH ||
|
|
|
|
xfn->type != RTE_CRYPTO_SYM_XFORM_CIPHER)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
xform->auth = &xf->auth;
|
|
|
|
xform->cipher = &xfn->cipher;
|
|
|
|
|
|
|
|
} else {
|
|
|
|
|
|
|
|
/* wrong order or no auth */
|
|
|
|
if (xfn == NULL || xf->type != RTE_CRYPTO_SYM_XFORM_CIPHER ||
|
|
|
|
xfn->type != RTE_CRYPTO_SYM_XFORM_AUTH)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
xform->cipher = &xf->cipher;
|
|
|
|
xform->auth = &xfn->auth;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-06-29 11:58:52 +00:00
|
|
|
uint64_t
|
2019-01-10 21:06:28 +00:00
|
|
|
rte_ipsec_sa_type(const struct rte_ipsec_sa *sa)
|
|
|
|
{
|
|
|
|
return sa->type;
|
|
|
|
}
|
|
|
|
|
2019-04-02 08:34:40 +00:00
|
|
|
/**
|
|
|
|
* Based on number of buckets calculated required size for the
|
|
|
|
* structure that holds replay window and sequence number (RSN) information.
|
|
|
|
*/
|
|
|
|
static size_t
|
|
|
|
rsn_size(uint32_t nb_bucket)
|
|
|
|
{
|
|
|
|
size_t sz;
|
|
|
|
struct replay_sqn *rsn;
|
|
|
|
|
|
|
|
sz = sizeof(*rsn) + nb_bucket * sizeof(rsn->window[0]);
|
|
|
|
sz = RTE_ALIGN_CEIL(sz, RTE_CACHE_LINE_SIZE);
|
|
|
|
return sz;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* for given size, calculate required number of buckets.
|
|
|
|
*/
|
|
|
|
static uint32_t
|
|
|
|
replay_num_bucket(uint32_t wsz)
|
|
|
|
{
|
|
|
|
uint32_t nb;
|
|
|
|
|
|
|
|
nb = rte_align32pow2(RTE_ALIGN_MUL_CEIL(wsz, WINDOW_BUCKET_SIZE) /
|
|
|
|
WINDOW_BUCKET_SIZE);
|
|
|
|
nb = RTE_MAX(nb, (uint32_t)WINDOW_BUCKET_MIN);
|
|
|
|
|
|
|
|
return nb;
|
|
|
|
}
|
|
|
|
|
2019-01-10 21:06:28 +00:00
|
|
|
static int32_t
|
2019-01-10 21:06:31 +00:00
|
|
|
ipsec_sa_size(uint64_t type, uint32_t *wnd_sz, uint32_t *nb_bucket)
|
2019-01-10 21:06:28 +00:00
|
|
|
{
|
2019-01-10 21:06:31 +00:00
|
|
|
uint32_t n, sz, wsz;
|
2019-01-10 21:06:28 +00:00
|
|
|
|
2019-01-10 21:06:31 +00:00
|
|
|
wsz = *wnd_sz;
|
2019-01-10 21:06:28 +00:00
|
|
|
n = 0;
|
2019-01-10 21:06:31 +00:00
|
|
|
|
|
|
|
if ((type & RTE_IPSEC_SATP_DIR_MASK) == RTE_IPSEC_SATP_DIR_IB) {
|
|
|
|
|
|
|
|
/*
|
|
|
|
* RFC 4303 recommends 64 as minimum window size.
|
|
|
|
* there is no point to use ESN mode without SQN window,
|
|
|
|
* so make sure we have at least 64 window when ESN is enalbed.
|
|
|
|
*/
|
|
|
|
wsz = ((type & RTE_IPSEC_SATP_ESN_MASK) ==
|
|
|
|
RTE_IPSEC_SATP_ESN_DISABLE) ?
|
|
|
|
wsz : RTE_MAX(wsz, (uint32_t)WINDOW_BUCKET_SIZE);
|
|
|
|
if (wsz != 0)
|
|
|
|
n = replay_num_bucket(wsz);
|
|
|
|
}
|
2019-01-10 21:06:28 +00:00
|
|
|
|
|
|
|
if (n > WINDOW_BUCKET_MAX)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2019-01-10 21:06:31 +00:00
|
|
|
*wnd_sz = wsz;
|
2019-01-10 21:06:28 +00:00
|
|
|
*nb_bucket = n;
|
|
|
|
|
|
|
|
sz = rsn_size(n);
|
2019-01-10 21:06:31 +00:00
|
|
|
if ((type & RTE_IPSEC_SATP_SQN_MASK) == RTE_IPSEC_SATP_SQN_ATOM)
|
|
|
|
sz *= REPLAY_SQN_NUM;
|
|
|
|
|
2019-01-10 21:06:28 +00:00
|
|
|
sz += sizeof(struct rte_ipsec_sa);
|
|
|
|
return sz;
|
|
|
|
}
|
|
|
|
|
2019-06-29 11:58:52 +00:00
|
|
|
void
|
2019-01-10 21:06:28 +00:00
|
|
|
rte_ipsec_sa_fini(struct rte_ipsec_sa *sa)
|
|
|
|
{
|
|
|
|
memset(sa, 0, sa->size);
|
|
|
|
}
|
|
|
|
|
2019-01-10 21:06:30 +00:00
|
|
|
/*
|
|
|
|
* Determine expected SA type based on input parameters.
|
|
|
|
*/
|
2019-01-10 21:06:28 +00:00
|
|
|
static int
|
|
|
|
fill_sa_type(const struct rte_ipsec_sa_prm *prm, uint64_t *type)
|
|
|
|
{
|
|
|
|
uint64_t tp;
|
|
|
|
|
|
|
|
tp = 0;
|
|
|
|
|
|
|
|
if (prm->ipsec_xform.proto == RTE_SECURITY_IPSEC_SA_PROTO_AH)
|
|
|
|
tp |= RTE_IPSEC_SATP_PROTO_AH;
|
|
|
|
else if (prm->ipsec_xform.proto == RTE_SECURITY_IPSEC_SA_PROTO_ESP)
|
|
|
|
tp |= RTE_IPSEC_SATP_PROTO_ESP;
|
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (prm->ipsec_xform.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS)
|
|
|
|
tp |= RTE_IPSEC_SATP_DIR_OB;
|
|
|
|
else if (prm->ipsec_xform.direction ==
|
|
|
|
RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
|
|
|
|
tp |= RTE_IPSEC_SATP_DIR_IB;
|
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (prm->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
|
|
|
|
if (prm->ipsec_xform.tunnel.type ==
|
|
|
|
RTE_SECURITY_IPSEC_TUNNEL_IPV4)
|
|
|
|
tp |= RTE_IPSEC_SATP_MODE_TUNLV4;
|
|
|
|
else if (prm->ipsec_xform.tunnel.type ==
|
|
|
|
RTE_SECURITY_IPSEC_TUNNEL_IPV6)
|
|
|
|
tp |= RTE_IPSEC_SATP_MODE_TUNLV6;
|
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (prm->tun.next_proto == IPPROTO_IPIP)
|
|
|
|
tp |= RTE_IPSEC_SATP_IPV4;
|
|
|
|
else if (prm->tun.next_proto == IPPROTO_IPV6)
|
|
|
|
tp |= RTE_IPSEC_SATP_IPV6;
|
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
} else if (prm->ipsec_xform.mode ==
|
|
|
|
RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT) {
|
|
|
|
tp |= RTE_IPSEC_SATP_MODE_TRANS;
|
|
|
|
if (prm->trs.proto == IPPROTO_IPIP)
|
|
|
|
tp |= RTE_IPSEC_SATP_IPV4;
|
|
|
|
else if (prm->trs.proto == IPPROTO_IPV6)
|
|
|
|
tp |= RTE_IPSEC_SATP_IPV6;
|
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
} else
|
|
|
|
return -EINVAL;
|
|
|
|
|
2019-01-10 21:06:31 +00:00
|
|
|
/* check for ESN flag */
|
|
|
|
if (prm->ipsec_xform.options.esn == 0)
|
|
|
|
tp |= RTE_IPSEC_SATP_ESN_DISABLE;
|
|
|
|
else
|
|
|
|
tp |= RTE_IPSEC_SATP_ESN_ENABLE;
|
|
|
|
|
2019-07-04 10:42:35 +00:00
|
|
|
/* check for ECN flag */
|
|
|
|
if (prm->ipsec_xform.options.ecn == 0)
|
|
|
|
tp |= RTE_IPSEC_SATP_ECN_DISABLE;
|
|
|
|
else
|
|
|
|
tp |= RTE_IPSEC_SATP_ECN_ENABLE;
|
|
|
|
|
|
|
|
/* check for DSCP flag */
|
|
|
|
if (prm->ipsec_xform.options.copy_dscp == 0)
|
|
|
|
tp |= RTE_IPSEC_SATP_DSCP_DISABLE;
|
|
|
|
else
|
|
|
|
tp |= RTE_IPSEC_SATP_DSCP_ENABLE;
|
|
|
|
|
2019-01-10 21:06:31 +00:00
|
|
|
/* interpret flags */
|
|
|
|
if (prm->flags & RTE_IPSEC_SAFLAG_SQN_ATOM)
|
|
|
|
tp |= RTE_IPSEC_SATP_SQN_ATOM;
|
|
|
|
else
|
|
|
|
tp |= RTE_IPSEC_SATP_SQN_RAW;
|
|
|
|
|
2019-01-10 21:06:28 +00:00
|
|
|
*type = tp;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-01-10 21:06:30 +00:00
|
|
|
/*
|
|
|
|
* Init ESP inbound specific things.
|
|
|
|
*/
|
2019-01-10 21:06:28 +00:00
|
|
|
static void
|
|
|
|
esp_inb_init(struct rte_ipsec_sa *sa)
|
|
|
|
{
|
|
|
|
/* these params may differ with new algorithms support */
|
2019-05-21 16:13:06 +00:00
|
|
|
sa->ctp.cipher.offset = sizeof(struct rte_esp_hdr) + sa->iv_len;
|
2019-01-10 21:06:28 +00:00
|
|
|
sa->ctp.cipher.length = sa->icv_len + sa->ctp.cipher.offset;
|
2020-02-04 13:12:55 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* for AEAD and NULL algorithms we can assume that
|
|
|
|
* auth and cipher offsets would be equal.
|
|
|
|
*/
|
|
|
|
switch (sa->algo_type) {
|
|
|
|
case ALGO_TYPE_AES_GCM:
|
|
|
|
case ALGO_TYPE_NULL:
|
|
|
|
sa->ctp.auth.raw = sa->ctp.cipher.raw;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
sa->ctp.auth.offset = 0;
|
|
|
|
sa->ctp.auth.length = sa->icv_len - sa->sqh_len;
|
|
|
|
sa->cofs.ofs.cipher.tail = sa->sqh_len;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
sa->cofs.ofs.cipher.head = sa->ctp.cipher.offset - sa->ctp.auth.offset;
|
2019-01-10 21:06:28 +00:00
|
|
|
}
|
|
|
|
|
2019-01-10 21:06:30 +00:00
|
|
|
/*
|
|
|
|
* Init ESP inbound tunnel specific things.
|
|
|
|
*/
|
2019-01-10 21:06:28 +00:00
|
|
|
static void
|
|
|
|
esp_inb_tun_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm)
|
|
|
|
{
|
|
|
|
sa->proto = prm->tun.next_proto;
|
|
|
|
esp_inb_init(sa);
|
|
|
|
}
|
|
|
|
|
2019-01-10 21:06:30 +00:00
|
|
|
/*
|
|
|
|
* Init ESP outbound specific things.
|
|
|
|
*/
|
2019-01-10 21:06:28 +00:00
|
|
|
static void
|
|
|
|
esp_outb_init(struct rte_ipsec_sa *sa, uint32_t hlen)
|
|
|
|
{
|
2019-03-20 15:38:34 +00:00
|
|
|
uint8_t algo_type;
|
|
|
|
|
2020-04-24 04:33:04 +00:00
|
|
|
sa->sqn.outb = 1;
|
2019-01-10 21:06:28 +00:00
|
|
|
|
2019-03-20 15:38:34 +00:00
|
|
|
algo_type = sa->algo_type;
|
|
|
|
|
2020-02-04 13:12:55 +00:00
|
|
|
/*
|
|
|
|
* Setup auth and cipher length and offset.
|
|
|
|
* these params may differ with new algorithms support
|
|
|
|
*/
|
|
|
|
|
2019-03-20 15:38:34 +00:00
|
|
|
switch (algo_type) {
|
|
|
|
case ALGO_TYPE_AES_GCM:
|
|
|
|
case ALGO_TYPE_AES_CTR:
|
|
|
|
case ALGO_TYPE_NULL:
|
2019-05-21 16:13:06 +00:00
|
|
|
sa->ctp.cipher.offset = hlen + sizeof(struct rte_esp_hdr) +
|
2019-01-10 21:06:28 +00:00
|
|
|
sa->iv_len;
|
|
|
|
sa->ctp.cipher.length = 0;
|
2019-03-20 15:38:34 +00:00
|
|
|
break;
|
|
|
|
case ALGO_TYPE_AES_CBC:
|
2019-03-20 15:38:36 +00:00
|
|
|
case ALGO_TYPE_3DES_CBC:
|
2020-02-04 13:12:55 +00:00
|
|
|
sa->ctp.cipher.offset = hlen + sizeof(struct rte_esp_hdr);
|
2019-01-10 21:06:28 +00:00
|
|
|
sa->ctp.cipher.length = sa->iv_len;
|
2019-03-20 15:38:34 +00:00
|
|
|
break;
|
2019-01-10 21:06:28 +00:00
|
|
|
}
|
2020-02-04 13:12:55 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* for AEAD and NULL algorithms we can assume that
|
|
|
|
* auth and cipher offsets would be equal.
|
|
|
|
*/
|
|
|
|
switch (algo_type) {
|
|
|
|
case ALGO_TYPE_AES_GCM:
|
|
|
|
case ALGO_TYPE_NULL:
|
|
|
|
sa->ctp.auth.raw = sa->ctp.cipher.raw;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
sa->ctp.auth.offset = hlen;
|
|
|
|
sa->ctp.auth.length = sizeof(struct rte_esp_hdr) +
|
|
|
|
sa->iv_len + sa->sqh_len;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
sa->cofs.ofs.cipher.head = sa->ctp.cipher.offset - sa->ctp.auth.offset;
|
|
|
|
sa->cofs.ofs.cipher.tail = (sa->ctp.auth.offset + sa->ctp.auth.length) -
|
|
|
|
(sa->ctp.cipher.offset + sa->ctp.cipher.length);
|
2019-01-10 21:06:28 +00:00
|
|
|
}
|
|
|
|
|
2019-01-10 21:06:30 +00:00
|
|
|
/*
|
|
|
|
* Init ESP outbound tunnel specific things.
|
|
|
|
*/
|
2019-01-10 21:06:28 +00:00
|
|
|
static void
|
|
|
|
esp_outb_tun_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm)
|
|
|
|
{
|
|
|
|
sa->proto = prm->tun.next_proto;
|
|
|
|
sa->hdr_len = prm->tun.hdr_len;
|
|
|
|
sa->hdr_l3_off = prm->tun.hdr_l3_off;
|
2019-04-02 08:34:37 +00:00
|
|
|
|
|
|
|
/* update l2_len and l3_len fields for outbound mbuf */
|
|
|
|
sa->tx_offload.val = rte_mbuf_tx_offload(sa->hdr_l3_off,
|
|
|
|
sa->hdr_len - sa->hdr_l3_off, 0, 0, 0, 0, 0);
|
|
|
|
|
2019-01-10 21:06:28 +00:00
|
|
|
memcpy(sa->hdr, prm->tun.hdr, sa->hdr_len);
|
|
|
|
|
|
|
|
esp_outb_init(sa, sa->hdr_len);
|
|
|
|
}
|
|
|
|
|
2019-01-10 21:06:30 +00:00
|
|
|
/*
|
|
|
|
* helper function, init SA structure.
|
|
|
|
*/
|
2019-01-10 21:06:28 +00:00
|
|
|
static int
|
|
|
|
esp_sa_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm,
|
|
|
|
const struct crypto_xform *cxf)
|
|
|
|
{
|
|
|
|
static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
|
|
|
|
RTE_IPSEC_SATP_MODE_MASK;
|
|
|
|
|
2019-07-04 10:42:35 +00:00
|
|
|
if (prm->ipsec_xform.options.ecn)
|
|
|
|
sa->tos_mask |= RTE_IPV4_HDR_ECN_MASK;
|
|
|
|
|
|
|
|
if (prm->ipsec_xform.options.copy_dscp)
|
|
|
|
sa->tos_mask |= RTE_IPV4_HDR_DSCP_MASK;
|
|
|
|
|
2019-01-10 21:06:28 +00:00
|
|
|
if (cxf->aead != NULL) {
|
2019-03-20 15:38:34 +00:00
|
|
|
switch (cxf->aead->algo) {
|
|
|
|
case RTE_CRYPTO_AEAD_AES_GCM:
|
|
|
|
/* RFC 4106 */
|
|
|
|
sa->aad_len = sizeof(struct aead_gcm_aad);
|
|
|
|
sa->icv_len = cxf->aead->digest_length;
|
|
|
|
sa->iv_ofs = cxf->aead->iv.offset;
|
|
|
|
sa->iv_len = sizeof(uint64_t);
|
|
|
|
sa->pad_align = IPSEC_PAD_AES_GCM;
|
|
|
|
sa->algo_type = ALGO_TYPE_AES_GCM;
|
|
|
|
break;
|
|
|
|
default:
|
2019-01-10 21:06:28 +00:00
|
|
|
return -EINVAL;
|
2019-03-20 15:38:34 +00:00
|
|
|
}
|
2019-01-10 21:06:28 +00:00
|
|
|
} else {
|
|
|
|
sa->icv_len = cxf->auth->digest_length;
|
|
|
|
sa->iv_ofs = cxf->cipher->iv.offset;
|
|
|
|
sa->sqh_len = IS_ESN(sa) ? sizeof(uint32_t) : 0;
|
2019-03-20 15:38:34 +00:00
|
|
|
|
|
|
|
switch (cxf->cipher->algo) {
|
|
|
|
case RTE_CRYPTO_CIPHER_NULL:
|
2019-01-10 21:06:28 +00:00
|
|
|
sa->pad_align = IPSEC_PAD_NULL;
|
|
|
|
sa->iv_len = 0;
|
2019-03-20 15:38:34 +00:00
|
|
|
sa->algo_type = ALGO_TYPE_NULL;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case RTE_CRYPTO_CIPHER_AES_CBC:
|
2019-01-10 21:06:28 +00:00
|
|
|
sa->pad_align = IPSEC_PAD_AES_CBC;
|
|
|
|
sa->iv_len = IPSEC_MAX_IV_SIZE;
|
2019-03-20 15:38:34 +00:00
|
|
|
sa->algo_type = ALGO_TYPE_AES_CBC;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case RTE_CRYPTO_CIPHER_AES_CTR:
|
|
|
|
/* RFC 3686 */
|
|
|
|
sa->pad_align = IPSEC_PAD_AES_CTR;
|
|
|
|
sa->iv_len = IPSEC_AES_CTR_IV_SIZE;
|
|
|
|
sa->algo_type = ALGO_TYPE_AES_CTR;
|
|
|
|
break;
|
|
|
|
|
2019-03-20 15:38:36 +00:00
|
|
|
case RTE_CRYPTO_CIPHER_3DES_CBC:
|
|
|
|
/* RFC 1851 */
|
|
|
|
sa->pad_align = IPSEC_PAD_3DES_CBC;
|
|
|
|
sa->iv_len = IPSEC_3DES_IV_SIZE;
|
|
|
|
sa->algo_type = ALGO_TYPE_3DES_CBC;
|
|
|
|
break;
|
|
|
|
|
2019-03-20 15:38:34 +00:00
|
|
|
default:
|
2019-01-10 21:06:28 +00:00
|
|
|
return -EINVAL;
|
2019-03-20 15:38:34 +00:00
|
|
|
}
|
2019-01-10 21:06:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
sa->udata = prm->userdata;
|
|
|
|
sa->spi = rte_cpu_to_be_32(prm->ipsec_xform.spi);
|
|
|
|
sa->salt = prm->ipsec_xform.salt;
|
|
|
|
|
2019-04-02 08:34:37 +00:00
|
|
|
/* preserve all values except l2_len and l3_len */
|
|
|
|
sa->tx_offload.msk =
|
|
|
|
~rte_mbuf_tx_offload(MBUF_MAX_L2_LEN, MBUF_MAX_L3_LEN,
|
|
|
|
0, 0, 0, 0, 0);
|
|
|
|
|
2019-01-10 21:06:28 +00:00
|
|
|
switch (sa->type & msk) {
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
|
|
|
|
esp_inb_tun_init(sa, prm);
|
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
|
|
|
|
esp_inb_init(sa);
|
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
|
|
|
|
esp_outb_tun_init(sa, prm);
|
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
|
|
|
|
esp_outb_init(sa, 0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-01-10 21:06:31 +00:00
|
|
|
/*
|
|
|
|
* helper function, init SA replay structure.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
fill_sa_replay(struct rte_ipsec_sa *sa, uint32_t wnd_sz, uint32_t nb_bucket)
|
|
|
|
{
|
|
|
|
sa->replay.win_sz = wnd_sz;
|
|
|
|
sa->replay.nb_bucket = nb_bucket;
|
|
|
|
sa->replay.bucket_index_mask = nb_bucket - 1;
|
|
|
|
sa->sqn.inb.rsn[0] = (struct replay_sqn *)(sa + 1);
|
|
|
|
if ((sa->type & RTE_IPSEC_SATP_SQN_MASK) == RTE_IPSEC_SATP_SQN_ATOM)
|
|
|
|
sa->sqn.inb.rsn[1] = (struct replay_sqn *)
|
|
|
|
((uintptr_t)sa->sqn.inb.rsn[0] + rsn_size(nb_bucket));
|
|
|
|
}
|
|
|
|
|
2019-06-29 11:58:52 +00:00
|
|
|
int
|
2019-01-10 21:06:28 +00:00
|
|
|
rte_ipsec_sa_size(const struct rte_ipsec_sa_prm *prm)
|
|
|
|
{
|
|
|
|
uint64_t type;
|
2019-01-10 21:06:31 +00:00
|
|
|
uint32_t nb, wsz;
|
2019-01-10 21:06:28 +00:00
|
|
|
int32_t rc;
|
|
|
|
|
|
|
|
if (prm == NULL)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
/* determine SA type */
|
|
|
|
rc = fill_sa_type(prm, &type);
|
|
|
|
if (rc != 0)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
/* determine required size */
|
2019-11-06 06:54:13 +00:00
|
|
|
wsz = prm->ipsec_xform.replay_win_sz;
|
2019-01-10 21:06:31 +00:00
|
|
|
return ipsec_sa_size(type, &wsz, &nb);
|
2019-01-10 21:06:28 +00:00
|
|
|
}
|
|
|
|
|
2019-06-29 11:58:52 +00:00
|
|
|
int
|
2019-01-10 21:06:28 +00:00
|
|
|
rte_ipsec_sa_init(struct rte_ipsec_sa *sa, const struct rte_ipsec_sa_prm *prm,
|
|
|
|
uint32_t size)
|
|
|
|
{
|
|
|
|
int32_t rc, sz;
|
2019-01-10 21:06:31 +00:00
|
|
|
uint32_t nb, wsz;
|
2019-01-10 21:06:28 +00:00
|
|
|
uint64_t type;
|
|
|
|
struct crypto_xform cxf;
|
|
|
|
|
|
|
|
if (sa == NULL || prm == NULL)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
/* determine SA type */
|
|
|
|
rc = fill_sa_type(prm, &type);
|
|
|
|
if (rc != 0)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
/* determine required size */
|
2019-11-06 06:54:13 +00:00
|
|
|
wsz = prm->ipsec_xform.replay_win_sz;
|
2019-01-10 21:06:31 +00:00
|
|
|
sz = ipsec_sa_size(type, &wsz, &nb);
|
2019-01-10 21:06:28 +00:00
|
|
|
if (sz < 0)
|
|
|
|
return sz;
|
|
|
|
else if (size < (uint32_t)sz)
|
|
|
|
return -ENOSPC;
|
|
|
|
|
|
|
|
/* only esp is supported right now */
|
|
|
|
if (prm->ipsec_xform.proto != RTE_SECURITY_IPSEC_SA_PROTO_ESP)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (prm->ipsec_xform.mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL &&
|
|
|
|
prm->tun.hdr_len > sizeof(sa->hdr))
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
rc = fill_crypto_xform(&cxf, type, prm);
|
|
|
|
if (rc != 0)
|
|
|
|
return rc;
|
|
|
|
|
|
|
|
/* initialize SA */
|
|
|
|
|
|
|
|
memset(sa, 0, sz);
|
|
|
|
sa->type = type;
|
|
|
|
sa->size = sz;
|
|
|
|
|
|
|
|
/* check for ESN flag */
|
|
|
|
sa->sqn_mask = (prm->ipsec_xform.options.esn == 0) ?
|
|
|
|
UINT32_MAX : UINT64_MAX;
|
|
|
|
|
|
|
|
rc = esp_sa_init(sa, prm, &cxf);
|
|
|
|
if (rc != 0)
|
|
|
|
rte_ipsec_sa_fini(sa);
|
|
|
|
|
|
|
|
/* fill replay window related fields */
|
2019-01-10 21:06:31 +00:00
|
|
|
if (nb != 0)
|
|
|
|
fill_sa_replay(sa, wsz, nb);
|
2019-01-10 21:06:28 +00:00
|
|
|
|
|
|
|
return sz;
|
|
|
|
}
|
2019-01-10 21:06:29 +00:00
|
|
|
|
2019-01-10 21:06:30 +00:00
|
|
|
/*
|
|
|
|
* setup crypto ops for LOOKASIDE_PROTO type of devices.
|
|
|
|
*/
|
|
|
|
static inline void
|
|
|
|
lksd_proto_cop_prepare(const struct rte_ipsec_session *ss,
|
|
|
|
struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num)
|
|
|
|
{
|
|
|
|
uint32_t i;
|
|
|
|
struct rte_crypto_sym_op *sop;
|
|
|
|
|
|
|
|
for (i = 0; i != num; i++) {
|
|
|
|
sop = cop[i]->sym;
|
|
|
|
cop[i]->type = RTE_CRYPTO_OP_TYPE_SYMMETRIC;
|
|
|
|
cop[i]->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
|
|
|
|
cop[i]->sess_type = RTE_CRYPTO_OP_SECURITY_SESSION;
|
|
|
|
sop->m_src = mb[i];
|
|
|
|
__rte_security_attach_session(sop, ss->security.ses);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* setup packets and crypto ops for LOOKASIDE_PROTO type of devices.
|
|
|
|
* Note that for LOOKASIDE_PROTO all packet modifications will be
|
|
|
|
* performed by PMD/HW.
|
|
|
|
* SW has only to prepare crypto op.
|
|
|
|
*/
|
|
|
|
static uint16_t
|
|
|
|
lksd_proto_prepare(const struct rte_ipsec_session *ss,
|
|
|
|
struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num)
|
|
|
|
{
|
|
|
|
lksd_proto_cop_prepare(ss, mb, cop, num);
|
|
|
|
return num;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* simplest pkt process routine:
|
|
|
|
* all actual processing is already done by HW/PMD,
|
|
|
|
* just check mbuf ol_flags.
|
|
|
|
* used for:
|
|
|
|
* - inbound for RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL
|
|
|
|
* - inbound/outbound for RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
|
|
|
|
* - outbound for RTE_SECURITY_ACTION_TYPE_NONE when ESN is disabled
|
|
|
|
*/
|
2020-02-04 13:12:55 +00:00
|
|
|
uint16_t
|
|
|
|
pkt_flag_process(const struct rte_ipsec_session *ss,
|
|
|
|
struct rte_mbuf *mb[], uint16_t num)
|
2019-01-10 21:06:30 +00:00
|
|
|
{
|
|
|
|
uint32_t i, k;
|
2019-04-02 08:34:39 +00:00
|
|
|
uint32_t dr[num];
|
2019-01-10 21:06:30 +00:00
|
|
|
|
|
|
|
RTE_SET_USED(ss);
|
|
|
|
|
|
|
|
k = 0;
|
|
|
|
for (i = 0; i != num; i++) {
|
|
|
|
if ((mb[i]->ol_flags & PKT_RX_SEC_OFFLOAD_FAILED) == 0)
|
2019-04-02 08:34:39 +00:00
|
|
|
k++;
|
2019-01-10 21:06:30 +00:00
|
|
|
else
|
2019-04-02 08:34:39 +00:00
|
|
|
dr[i - k] = i;
|
2019-01-10 21:06:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* handle unprocessed mbufs */
|
|
|
|
if (k != num) {
|
|
|
|
rte_errno = EBADMSG;
|
|
|
|
if (k != 0)
|
2019-04-02 08:34:39 +00:00
|
|
|
move_bad_mbufs(mb, dr, num, num - k);
|
2019-01-10 21:06:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return k;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Select packet processing function for session on LOOKASIDE_NONE
|
|
|
|
* type of device.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
lksd_none_pkt_func_select(const struct rte_ipsec_sa *sa,
|
|
|
|
struct rte_ipsec_sa_pkt_func *pf)
|
|
|
|
{
|
|
|
|
int32_t rc;
|
|
|
|
|
|
|
|
static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
|
|
|
|
RTE_IPSEC_SATP_MODE_MASK;
|
|
|
|
|
|
|
|
rc = 0;
|
|
|
|
switch (sa->type & msk) {
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
|
2020-02-04 13:12:55 +00:00
|
|
|
pf->prepare.async = esp_inb_pkt_prepare;
|
2019-04-02 08:34:40 +00:00
|
|
|
pf->process = esp_inb_tun_pkt_process;
|
2019-01-10 21:06:30 +00:00
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
|
2020-02-04 13:12:55 +00:00
|
|
|
pf->prepare.async = esp_inb_pkt_prepare;
|
2019-04-02 08:34:40 +00:00
|
|
|
pf->process = esp_inb_trs_pkt_process;
|
2019-01-10 21:06:30 +00:00
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
|
2020-02-04 13:12:55 +00:00
|
|
|
pf->prepare.async = esp_outb_tun_prepare;
|
2019-01-10 21:06:30 +00:00
|
|
|
pf->process = (sa->sqh_len != 0) ?
|
2019-04-02 08:34:40 +00:00
|
|
|
esp_outb_sqh_process : pkt_flag_process;
|
2019-01-10 21:06:30 +00:00
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
|
2020-02-04 13:12:55 +00:00
|
|
|
pf->prepare.async = esp_outb_trs_prepare;
|
|
|
|
pf->process = (sa->sqh_len != 0) ?
|
|
|
|
esp_outb_sqh_process : pkt_flag_process;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
rc = -ENOTSUP;
|
|
|
|
}
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
cpu_crypto_pkt_func_select(const struct rte_ipsec_sa *sa,
|
|
|
|
struct rte_ipsec_sa_pkt_func *pf)
|
|
|
|
{
|
|
|
|
int32_t rc;
|
|
|
|
|
|
|
|
static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
|
|
|
|
RTE_IPSEC_SATP_MODE_MASK;
|
|
|
|
|
|
|
|
rc = 0;
|
|
|
|
switch (sa->type & msk) {
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
|
|
|
|
pf->prepare.sync = cpu_inb_pkt_prepare;
|
|
|
|
pf->process = esp_inb_tun_pkt_process;
|
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
|
|
|
|
pf->prepare.sync = cpu_inb_pkt_prepare;
|
|
|
|
pf->process = esp_inb_trs_pkt_process;
|
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
|
|
|
|
pf->prepare.sync = cpu_outb_tun_pkt_prepare;
|
|
|
|
pf->process = (sa->sqh_len != 0) ?
|
|
|
|
esp_outb_sqh_process : pkt_flag_process;
|
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
|
|
|
|
pf->prepare.sync = cpu_outb_trs_pkt_prepare;
|
2019-01-10 21:06:30 +00:00
|
|
|
pf->process = (sa->sqh_len != 0) ?
|
2019-04-02 08:34:40 +00:00
|
|
|
esp_outb_sqh_process : pkt_flag_process;
|
2019-01-10 21:06:30 +00:00
|
|
|
break;
|
|
|
|
default:
|
|
|
|
rc = -ENOTSUP;
|
|
|
|
}
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Select packet processing function for session on INLINE_CRYPTO
|
|
|
|
* type of device.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
inline_crypto_pkt_func_select(const struct rte_ipsec_sa *sa,
|
|
|
|
struct rte_ipsec_sa_pkt_func *pf)
|
|
|
|
{
|
|
|
|
int32_t rc;
|
|
|
|
|
|
|
|
static const uint64_t msk = RTE_IPSEC_SATP_DIR_MASK |
|
|
|
|
RTE_IPSEC_SATP_MODE_MASK;
|
|
|
|
|
|
|
|
rc = 0;
|
|
|
|
switch (sa->type & msk) {
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
|
2019-06-05 15:31:27 +00:00
|
|
|
pf->process = inline_inb_tun_pkt_process;
|
2019-01-10 21:06:30 +00:00
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
|
2019-06-05 15:31:27 +00:00
|
|
|
pf->process = inline_inb_trs_pkt_process;
|
2019-01-10 21:06:30 +00:00
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):
|
|
|
|
pf->process = inline_outb_tun_pkt_process;
|
|
|
|
break;
|
|
|
|
case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TRANS):
|
|
|
|
pf->process = inline_outb_trs_pkt_process;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
rc = -ENOTSUP;
|
|
|
|
}
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Select packet processing function for given session based on SA parameters
|
|
|
|
* and type of associated with the session device.
|
|
|
|
*/
|
2019-01-10 21:06:29 +00:00
|
|
|
int
|
|
|
|
ipsec_sa_pkt_func_select(const struct rte_ipsec_session *ss,
|
|
|
|
const struct rte_ipsec_sa *sa, struct rte_ipsec_sa_pkt_func *pf)
|
|
|
|
{
|
|
|
|
int32_t rc;
|
|
|
|
|
|
|
|
rc = 0;
|
2020-02-04 13:12:55 +00:00
|
|
|
pf[0] = (struct rte_ipsec_sa_pkt_func) { {NULL}, NULL };
|
2019-01-10 21:06:29 +00:00
|
|
|
|
|
|
|
switch (ss->type) {
|
2019-01-10 21:06:30 +00:00
|
|
|
case RTE_SECURITY_ACTION_TYPE_NONE:
|
|
|
|
rc = lksd_none_pkt_func_select(sa, pf);
|
|
|
|
break;
|
|
|
|
case RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO:
|
|
|
|
rc = inline_crypto_pkt_func_select(sa, pf);
|
|
|
|
break;
|
|
|
|
case RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL:
|
|
|
|
if ((sa->type & RTE_IPSEC_SATP_DIR_MASK) ==
|
|
|
|
RTE_IPSEC_SATP_DIR_IB)
|
|
|
|
pf->process = pkt_flag_process;
|
|
|
|
else
|
2019-04-02 08:34:40 +00:00
|
|
|
pf->process = inline_proto_outb_pkt_process;
|
2019-01-10 21:06:30 +00:00
|
|
|
break;
|
|
|
|
case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL:
|
2020-02-04 13:12:55 +00:00
|
|
|
pf->prepare.async = lksd_proto_prepare;
|
2019-01-10 21:06:30 +00:00
|
|
|
pf->process = pkt_flag_process;
|
|
|
|
break;
|
2020-02-04 13:12:55 +00:00
|
|
|
case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO:
|
|
|
|
rc = cpu_crypto_pkt_func_select(sa, pf);
|
|
|
|
break;
|
2019-01-10 21:06:29 +00:00
|
|
|
default:
|
|
|
|
rc = -ENOTSUP;
|
|
|
|
}
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|