From patchwork Fri Mar 24 15:04:39 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Petri Savolainen X-Patchwork-Id: 95960 Delivered-To: patch@linaro.org Received: by 10.140.89.233 with SMTP id v96csp89065qgd; Fri, 24 Mar 2017 08:07:17 -0700 (PDT) X-Received: by 10.200.34.113 with SMTP id p46mr7856843qtp.38.1490368037466; Fri, 24 Mar 2017 08:07:17 -0700 (PDT) Return-Path: Received: from lists.linaro.org (lists.linaro.org. [54.225.227.206]) by mx.google.com with ESMTP id 3si2146105qtz.30.2017.03.24.08.07.16; Fri, 24 Mar 2017 08:07:17 -0700 (PDT) Received-SPF: pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) client-ip=54.225.227.206; Authentication-Results: mx.google.com; spf=pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) smtp.mailfrom=lng-odp-bounces@lists.linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: by lists.linaro.org (Postfix, from userid 109) id AE63663E23; Fri, 24 Mar 2017 15:07:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on ip-10-142-244-252 X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAD_ENC_HEADER,BAYES_00, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_PASS, URIBL_BLOCKED autolearn=disabled version=3.4.0 Received: from [127.0.0.1] (localhost [127.0.0.1]) by lists.linaro.org (Postfix) with ESMTP id C9E7B642D2; Fri, 24 Mar 2017 15:05:20 +0000 (UTC) X-Original-To: lng-odp@lists.linaro.org Delivered-To: lng-odp@lists.linaro.org Received: by lists.linaro.org (Postfix, from userid 109) id 2308C62E09; Fri, 24 Mar 2017 15:05:11 +0000 (UTC) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0116.outbound.protection.outlook.com [104.47.2.116]) by lists.linaro.org (Postfix) with ESMTPS id B0A9E60F1D for ; Fri, 24 Mar 2017 15:05:04 +0000 (UTC) Received: from AM5PR0701CA0061.eurprd07.prod.outlook.com (10.169.145.151) by HE1PR07MB1004.eurprd07.prod.outlook.com (10.162.27.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.991.4; Fri, 24 Mar 2017 15:05:00 +0000 Received: from VE1EUR03FT025.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e09::206) by AM5PR0701CA0061.outlook.office365.com (2603:10a6:203:2::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1005.2 via Frontend Transport; Fri, 24 Mar 2017 15:04:59 +0000 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning linaro.org discourages use of 131.228.2.241 as permitted sender) Received: from mailrelay.int.nokia.com (131.228.2.241) by VE1EUR03FT025.mail.protection.outlook.com (10.152.18.74) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.7 via Frontend Transport; Fri, 24 Mar 2017 15:04:59 +0000 Received: from fihe3nok0735.emea.nsn-net.net (localhost [127.0.0.1]) by fihe3nok0735.emea.nsn-net.net (8.14.9/8.14.5) with ESMTP id v2OF4fC4018373 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 24 Mar 2017 17:04:41 +0200 Received: from 10.144.19.15 ([10.144.104.219]) by fihe3nok0735.emea.nsn-net.net (8.14.9/8.14.5) with ESMTP id v2OF4fE5018344 (version=TLSv1/SSLv3 cipher=AES128-SHA256 bits=128 verify=NOT) for ; Fri, 24 Mar 2017 17:04:41 +0200 X-HPESVCS-Source-Ip: 10.144.104.219 From: Petri Savolainen To: Date: Fri, 24 Mar 2017 17:04:39 +0200 Message-ID: <1490367881-16266-2-git-send-email-petri.savolainen@linaro.org> X-Mailer: git-send-email 2.8.1 In-Reply-To: <1490367881-16266-1-git-send-email-petri.savolainen@linaro.org> References: <1490367881-16266-1-git-send-email-petri.savolainen@linaro.org> X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:131.228.2.241; IPV:CAL; CTRY:FI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(39410400002)(39850400002)(39840400002)(39860400002)(39450400003)(2980300002)(199003)(189002)(9170700003)(189998001)(106466001)(105596002)(36756003)(8936002)(86362001)(33646002)(2351001)(47776003)(5660300001)(110136004)(38730400002)(50986999)(76176999)(77096006)(53936002)(6916009)(305945005)(2950100002)(356003)(8676002)(22756006)(5003940100001)(2906002)(50226002)(81166006)(48376002)(50466002)(217873001); DIR:OUT; SFP:1102; SCL:1; SRVR:HE1PR07MB1004; H:mailrelay.int.nokia.com; FPR:; SPF:SoftFail; MLV:sfv; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; VE1EUR03FT025; 1:YcW/0BLUONMhHpsU+pGdBz8NPratFmW4fuPGSrNbfZNFS0+xMc31yNgdBs7inekOvSHnXLHTNbBumJATnDzGDSmaxeW3tH8PI3o2nepbVXtdzRJfEf8J2zm5cl7v86xDoJY9pbQj07DQX4wzW9yod2KYaEAIpp0zk0pzGB93Xj+IQgtM4zZXawJzw+ga4fjnHHpONThZG7a9czgD2amENyTT1i6+JrhuLT9o39+2y6yxDQjueVtHvaK6rxrpNpT1nOcEUXjDOfWRGjPIsS+I74mKsvf9GFWDEXVYLWsEolPQLi3Xns6vQ0flnMRykG4+wn8FaTd3iQ+VNNEp+gt7vvGpTgYb+Ew7CaDkRMutwngjVvGO1ijlyLxVmxPy+NhRbftKpXfzeCNCcejcPCYklT7z1Hld/Roa+3bLu2IREeGiRO6xvZK0dRmsboB/QKbD72+7ymBFqGZqID0C4L27N3EscsWGipaoSuP/AMWGuTdrAJ19THgT/UKMA+rN680+ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 42170787-7e3b-442c-f4f3-08d472c7242c X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075); SRVR:HE1PR07MB1004; X-Microsoft-Exchange-Diagnostics: 1; HE1PR07MB1004; 3:4v00ETh3WAb5U2FRvOWF9AXoxeqJq1zCM9VM2x+SklqToTCqYbOFo3vlxgvydq2+dFZllYzhBGOvRpvVoS1kXHYJ/UW3uMf7yrlroSxxLfCiI/yhGLaNc+AOzWQ2Fht7ORSCmUtF6jEZpzrya7OzotwQL2vt4v/U577I59zc9ijLkii1VMlD/EB/ww2liv74F6I02D3uS6rFSisRIcO5O1s8eOF/puOahtVX9S8nOnjgJvpZTq606d0BxgjQwsAkRcfpQbv4MqF0z/B0JF3RiAk43ogWSCTd5Z/Y3K+BlbOYNfS1O5zfhwXpZSDpjk4wc1n/abV6sQe4PGdU2PfTncPGyAKE6iRk5C4Ap7Mp3QUOeucBGVPhSc5GxnPN/UEoiM8NkhdrVPv8pcwq8HOYTg==; 25:akxjfZtnCpoL2Q13H5iD933d8otyILOK9KwYXit+D91uXtS+D1ZhaaBJmWdXQFzwict9NzBsP5u+03MaizUfpwps3b7hIfJasV80ExIw/n6vy18k88bXi6zaDDIWH/41opB0gyU3N0/B7Wfk5sYvFkuGIXoitcRLkYx9aoQUgZARITGL7Pt8u/z43QhcvF3e7UF/T8zgVgyNsAvSfwDbyftJ3vwQvvWMPd2pNZ6+wW592ccxOO/GKHwJ2Klt+IneMoVBTZezPgfpC/Kwo/Cs9Dt3qcu3P+YVICsK+cIjFxt5VGY+e/0zmUtOuPxEsRIs3Gvph7HWQHOZAn77z34C93f/IieCbe2uBBLio9EeqaTouJEvPFiB2l2JawsueKJSd3Qp1andsiM68En8LOrD9QZwYf52Ar7LZkvenCEomNMsQDRryDe2+rzadYNZJdR7WkIzONJuSnH7PbKOtm7x0w== X-Microsoft-Exchange-Diagnostics: 1; HE1PR07MB1004; 31:KTq7oBZO+hVNsx2fpCqxd1WS7eTOaar9dDV80eNuZd/Ldlxj78MSdAi8JM5nprRtWvX1Sc1xdBddy1bUh3iGLpV4PYwhEAttVeZlbKcjX0lepFEI/ymgkSbaVznh0bAkfV+Iwj5NuM5UZcF2SuhyKh1PpU6IlKR/2ibpY00SvMJle7uCQHV6EmM9LdPYzcSmzyZvoNjDsd4G44CwU8aTSiz/hQk22IWLq1y8ZN4Bd03xwAlY8W0bmHQ8KOCCCgFIkkV3xvJjUuejRtFf9coMBc0FhwZhKcMOEZH/OCtsZ08=; 20:YuZSNLUliw/OzmXvhu8bY8Q0zpWHwkQ+sf3ixplAZMt7N6VpyQQ4UjskvkLEev+Bs0Dd3YWjDRQHAKPrZRjrx35L5uSdIh8MB4yyi1ajV2ZxgRViX4xc13CBS7jgC6ns7XUEMTpDtRLf5yhEyEPgZSugiujGZ9/zx4bFROhOhwlGGUbeZB7oVN9LB5jGIQ+ARv/xfiQSmRFTGvLxxZfkrBXx/Q3toA4FChBQAheRzSsfJvNOFo+0RlKVdN14gAyLaNcWcLCG4AhXzipXSe1jHByS9a4jMHuis8hA1LA+wJs9W5RCVNNJki7/ZFP0dUCeyixz/vy6IHB+vFPBlgssK5+QIBN08LPTt76j+hDIMH1W6v0e4KaZvPyvNhNyPT/xYau9wfFn3K/FSFvTMtVsAQthwHG7ICDNDV/WgvtyXEVv8Ju6nuWkxyqjsWP4L2melPIS/wB35NATLOiaktl25yLSKJ+iy7pZQ1meZXFILoKL05acY/rcQ9BeRBlDQhTBSGVxGL97+CdUi3y9kqdJhxGyBEzr88ixlivVidOl4rOTpgl3PpAYkIRhcgBxAZSpp0EjEuTKMzGbAA3zAMkYaMbqyLe5yJpr9LgxyoxlTmw= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(131327999870524); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(13021025)(13023025)(13013025)(8121501046)(3002001)(10201501046)(6055026)(6041248)(20161123558025)(20161123562025)(20161123560025)(20161123555025)(20161123564025)(6072148); SRVR:HE1PR07MB1004; BCL:0; PCL:0; RULEID:; SRVR:HE1PR07MB1004; X-Microsoft-Exchange-Diagnostics: 1; HE1PR07MB1004; 4:SqEMpPWRpmbU1reVcaMx94NTmjSiSMudDQ+2UZplXL/9UmcQul662hBOSzFWvuYv35stHo5Pl+HuDWGWjfNpZWRiSyspmwKGpb8cYwWwz/PFo8wKBJ0A9Q/mS0A5zY8X69GZxzBVcrTZ76RhBSylGIIgSAWy5IDJvufXmA+wEc0ufCgsaJthJAXjPJWN1Ezc27cw670DpCJrDoHfGTzpr/YNLdpD8T12sE/kgv212xrp/NbNPUgIYD7WkqX9Sme8QDsyvC48bWVmfKhlxPLAguuJUod1gXPJi/Mz1CrMPvmlmNHbqpxR/eFn+QqGOcd5GPxe8o2CXZwr4hukVrw9e05W7aZQKtWX3AX2y2m0NHCwhAyXo/eGWWfKoHU8q13Jzl2o+choXmHkMGn7MbTCrcyOE62/K/NLTjDwrnNAs5JbRT3QM4+4UU9u61oe8pBn3TQEfDOTiVc94BTdY8jIdJWu8JNblvbPLwnOuKDQX2L1np4A86Qq0iCNzUmOdFgRogS6V4bGlAywpFo9fjcTsNX6fAgb+fcWVX/Imib7rrgQDyB6FqThwVVzzhADUr2DkT3Ia9eXp6finyFrSX58WBmbbfnqRbyf2/jgBLD5fQPOnqjf+hacPFShnOj8IN2wi4+cYekIRaeHhyHggHD/wfAGnIWUQW8VxSeqveJruEBQeCWYjkBPTIqnw9DiPQBk2FxogAQRz4Sp6Xf2eMF6FfOInRCbXFsqaf3Gb0VP94S450N0VYgnqCtF7pIfmuZt X-Forefront-PRVS: 0256C18696 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; HE1PR07MB1004; 23:H1wf6+RdKktwjlUUJm1UydRpita5WzqlOjzx7/CWw?= a7Apw4xMYzXjikIJ1YYMLExTqM8RaekJiWLxHEcvTYw/cf/4xpY8/5LbHaGR4nY8+Uvqa3r3ekvvB+WRj2UxH0neF1Gz8dfBOUbaCoR3bmpmiH2W5EbnT1D5Kl9aq2ndUPHv3rzwU4tt4/bFaAhzzlc9AgMexlA8kDQ8tBvSJ5jkmS9NoLKz7Wdj/7whRJ/glP2ytD8HAEK+ee31hgtWiK603NIMaMJJoaEWduoFhFwR/mYpJ32AIiRVdzO7d6MlfjUarhxA26JgltRhI5f5gpfXy64jqGnJZrUIh3zvr/7IcfdNTLOavQOQCsWJXK+BjatRh3NVbfh3s3hrxyjgGiqPNdptXveKGnYghkdMfkkIf9Y9hoTZMFSA2mHfAMuCMocxIUtUVXXCTpI+N4pom9KB+bWm3Tm8Un1xFZ73F3KzlO/0n6M0PhmLxHf7idNdOhoTukVvkIq5GB4XUlGrIQcChfE+3qbCTA1CDwH3pQLaN3opMHBSohJz9Difp5nJdcX9pxIRWNdMSR4+3Plmuq8tb0wRqrAFLztgNxX02tJ3PcBS1VQOEsX7BAQD8SLUfUhYWzANIqvRc8y2Qi1g4Nm6+e4Mfj3+S8fNtmOgYdkvQOgux/kgKGnNUyPac8sj5klqcrVA9AJueiWTjrPSYadugfS9fOfjVqZRv1UgOTYnQyOqbX4keZnn1dtP2/wTukcpP10qJZl0IzBypRiEfpv7GhP5bk/6wdzZR8AtubHEI7XrKRqQRBBKR8i4eeswFnXvt7SJ2BC6xjQquap4XgugfEfHrveddYpoRG9PK7o7JFSHxUh8HvD5J69xT1usscyHel86ih1CwjHH9iHgZSdsNiUZ+LjQzYcWhpToQLWXizO4HiIlP6e5BDhN/rtSxEXqMlUhce9XDeCDLoiM5S9P4jgKwFktMssRUi46I0HaHPoCOpWdRhgKg3hc15p+R+WiszmjxQifOr/SbFM7s24 X-Microsoft-Exchange-Diagnostics: 1; HE1PR07MB1004; 6:C1zjFMXKNFD0UUKP+QvlQV0jtyE3fKNBqpKDwXDSMvi3pSYy7Gf4BVi15+5yqSHRqngUXremQ4SmnWKL/PZK0Tfi2JFtpUjiSYhs+u1tR3qfEYJ7kaxzWfT25ACLz9QnZymfAxGY8B/uIBDhW55OAxnBwusluSd95V0oSk0R4UdJ87WpiXlNJSRHlpzD5twTWUhnwG8UbSLUijpXqT5i/tKy/z9TEeaTDtkZ4YeaG0r9mdn3o0rggLU7CxBFj52XHB+jx62K8bk///17cN9ygcOqXXWC1BcvLIBe5GK7ZMfRd9gGJ+57+mnKxN13XhMgEpJRUrSefa9ewLxT3REbS0Vr49qzubq6DlvWGsh9d4DCh1n8SoBn/Fv/6Aho2Mstbn9kpDAgPejDfGgNkMJPNKfartR2kpOMmyLxGe1xXrE=; 5:2vnhqYcfZzEGUz2L6ch3i5MSQppUPo+bq1mFiuYqXnsN3e+CeiMWRMbJDaDcZG58bkTdcD6FGrZ4hnyJ7DQlg9DfIp8ZSylV0tSWBB+RgX44hmiIEn74dEhPZpgmcZpdMFPOrjFTNIl2VEi4aCpBIw==; 24:HFWHcwKtk8ZP/yJddZdYrU0cn5bjh3sqB2uvAVbsHQmh/kvSf/NRYj18uZUharbk7CUHwHBcJ/H7pBP9ZfsvEUGJaPmNx6i83DqcxOeb1dI= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; HE1PR07MB1004; 7:qWBB5Bw2tzcIFlE3XJI7UpzhGnugImnZpG1lYF+qbRMGuwfGVaWXex5rsJJW1kfo+IziermzlXbFFEjEhlgidvJ5oCxapvV9gD2hgMkKt+leAms11D7JhiAInLfGJgGELH0lqtD6ZqEjdyEpSrzlWn3xx3CAUur7VytC2T0zhza1w9pelwcyJJLxuq6SaBRWSUrPtsRehFEvucd9dqeWPqf5p5KwPOh1aGdHsL7wFSPQHy9y25udTJGLEU2PZIhfER6ebjU+TRDBitoufwfZiPsbeIakDEDK9t4g/0E2IbuWFE5T0cjARGTLWashCopKMa03p1LroyypWpjC2HbOsQ== X-OriginatorOrg: nokia.onmicrosoft.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Mar 2017 15:04:59.5191 (UTC) X-MS-Exchange-CrossTenant-Id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5d471751-9675-428d-917b-70f44f9630b0; Ip=[131.228.2.241]; Helo=[mailrelay.int.nokia.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB1004 Subject: [lng-odp] [API-NEXT PATCH v3 2/4] api: ipsec: add inline IPSEC support X-BeenThere: lng-odp@lists.linaro.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: "The OpenDataPlane \(ODP\) List" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: lng-odp-bounces@lists.linaro.org Sender: "lng-odp" Added support for inline IPSEC processing on packet input and output. Inline mode IPSEC and traffic manager cannot be enabled (currently) on the same pktio interface. Signed-off-by: Petri Savolainen --- include/odp/api/spec/ipsec.h | 355 ++++++++++++++++++++++++++++++++++++--- include/odp/api/spec/packet_io.h | 32 ++++ 2 files changed, 360 insertions(+), 27 deletions(-) -- 2.8.1 Signed-off-by: Petri Savolainen diff --git a/include/odp/api/spec/ipsec.h b/include/odp/api/spec/ipsec.h index d3e51bc..2e7e1e4 100644 --- a/include/odp/api/spec/ipsec.h +++ b/include/odp/api/spec/ipsec.h @@ -19,6 +19,8 @@ extern "C" { #endif #include +#include +#include /** @defgroup odp_ipsec ODP IPSEC * Operations of IPSEC API. @@ -51,11 +53,43 @@ typedef enum odp_ipsec_op_mode_t { * Application uses asynchronous IPSEC operations, * which return results via events. */ - ODP_IPSEC_OP_MODE_ASYNC + ODP_IPSEC_OP_MODE_ASYNC, + + /** Inline IPSEC operation + * + * Packet input/output is connected directly to IPSEC inbound/outbound + * processing. Application uses asynchronous or inline IPSEC + * operations. + */ + ODP_IPSEC_OP_MODE_INLINE, + + /** IPSEC is disabled in inbound / outbound direction */ + ODP_IPSEC_OP_MODE_DISABLED } odp_ipsec_op_mode_t; /** + * Protocol layers in IPSEC configuration + */ +typedef enum odp_ipsec_proto_layer_t { + /** No layers */ + ODP_IPSEC_LAYER_NONE = 0, + + /** Layer L2 protocols (Ethernet, VLAN, etc) */ + ODP_IPSEC_LAYER_L2, + + /** Layer L3 protocols (IPv4, IPv6, ICMP, IPSEC, etc) */ + ODP_IPSEC_LAYER_L3, + + /** Layer L4 protocols (UDP, TCP, SCTP) */ + ODP_IPSEC_LAYER_L4, + + /** All layers */ + ODP_IPSEC_LAYER_ALL + +} odp_ipsec_proto_layer_t; + +/** * Configuration options for IPSEC inbound processing */ typedef struct odp_ipsec_inbound_config_t { @@ -81,9 +115,110 @@ typedef struct odp_ipsec_inbound_config_t { } spi_lookup; + /** Retain outer headers + * + * Select up to which protocol layer (at least) outer headers are + * retained in inbound inline processing. Default value is + * ODP_IPSEC_LAYER_NONE. + * + * ODP_IPSEC_LAYER_NONE: Application does not require any outer + * headers to be retained. + * + * ODP_IPSEC_LAYER_L2: Retain headers up to layer 2. + * + * ODP_IPSEC_LAYER_L3: Retain headers up to layer 3, otherwise the + * same as ODP_IPSEC_LAYER_ALL. + * + * ODP_IPSEC_LAYER_L4: Retain headers up to layer 4, otherwise the + * same as ODP_IPSEC_LAYER_ALL. + * + * ODP_IPSEC_LAYER_ALL: In tunnel mode, all headers before IPSEC are + * retained. In transport mode, all headers + * before IP (carrying IPSEC) are retained. + * + */ + odp_ipsec_proto_layer_t retain_outer; + + /** Parse packet headers after IPSEC transformation + * + * Select header parsing level after inbound processing. Headers of the + * resulting packet must be parsed (at least) up to this level. Parsing + * starts from IP (layer 3). Each successfully transformed packet has + * a valid value for L3 offset regardless of the parse configuration. + * Default value is ODP_IPSEC_LAYER_NONE. + */ + odp_ipsec_proto_layer_t parse; + + /** Flags to control IPSEC payload data checks up to the selected parse + * level. */ + union { + struct { + /** Check IPv4 header checksum in IPSEC payload. + * Default value is 0. */ + uint32_t ipv4_chksum : 1; + + /** Check UDP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t udp_chksum : 1; + + /** Check TCP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t tcp_chksum : 1; + + /** Check SCTP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t sctp_chksum : 1; + } check; + + /** All bits of the bit field structure + * + * This field can be used to set/clear all flags, or bitwise + * operations over the entire structure. */ + uint32_t all_check; + }; + } odp_ipsec_inbound_config_t; /** + * Configuration options for IPSEC outbound processing + */ +typedef struct odp_ipsec_outbound_config_t { + /** Flags to control L3/L4 checksum insertion as part of outbound + * packet processing. Packet must have set with valid L3/L4 offsets. + * Checksum configuration is ignored for packets that checksum cannot + * be computed for (e.g. IPv4 fragments). Application may use a packet + * metadata flag to disable checksum insertion per packet bases. + */ + union { + struct { + /** Insert IPv4 header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_ipv4 : 1; + + /** Insert UDP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_udp : 1; + + /** Insert TCP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_tcp : 1; + + /** Insert SCTP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_sctp : 1; + + } chksum; + + /** All bits of the bit field structure + * + * This field can be used to set/clear all flags, or bitwise + * operations over the entire structure. */ + uint32_t all_chksum; + }; + +} odp_ipsec_outbound_config_t; + +/** * IPSEC capability */ typedef struct odp_ipsec_capability_t { @@ -106,6 +241,23 @@ typedef struct odp_ipsec_capability_t { */ uint8_t op_mode_async; + /** Inline IPSEC operation mode (ODP_IPSEC_OP_MODE_INLINE) support + * + * 0: Inline IPSEC operation is not supported + * 1: Inline IPSEC operation is supported + * 2: Inline IPSEC operation is supported and preferred + */ + uint8_t op_mode_inline; + + /** Support of pipelined classification (ODP_IPSEC_PIPELINE_CLS) of + * resulting inbound packets. + * + * 0: Classification of resulting packets is not supported + * 1: Classification of resulting packets is supported + * 2: Classification of resulting packets is supported and preferred + */ + uint8_t pipeline_cls; + /** Soft expiry limit in seconds support * * 0: Limit is not supported @@ -132,12 +284,19 @@ typedef struct odp_ipsec_capability_t { * IPSEC configuration options */ typedef struct odp_ipsec_config_t { - /** IPSEC operation mode. Application selects which mode (sync or async) - * will be used for IPSEC operations. + /** Inbound IPSEC operation mode. Application selects which mode + * will be used for inbound IPSEC operations. * * @see odp_ipsec_in(), odp_ipsec_in_enq() */ - odp_ipsec_op_mode_t op_mode; + odp_ipsec_op_mode_t inbound_mode; + + /** Outbound IPSEC operation mode. Application selects which mode + * will be used for outbound IPSEC operations. + * + * @see odp_ipsec_out(), odp_ipsec_out_enq(), odp_ipsec_out_inline() + */ + odp_ipsec_op_mode_t outbound_mode; /** Maximum number of IPSEC SAs that application will use * simultaneously */ @@ -146,6 +305,9 @@ typedef struct odp_ipsec_config_t { /** IPSEC inbound processing configuration */ odp_ipsec_inbound_config_t inbound; + /** IPSEC outbound processing configuration */ + odp_ipsec_outbound_config_t outbound; + } odp_ipsec_config_t; /** @@ -385,13 +547,35 @@ typedef enum odp_ipsec_lookup_mode_t { ODP_IPSEC_LOOKUP_DISABLED = 0, /** Inbound SA lookup is enabled. Lookup matches only SPI value. - * SA lookup failure status (error.sa_lookup) is reported through + * In inline mode, a lookup miss directs the packet back to normal + * packet input interface processing. In other modes, the SA lookup + * failure status (error.sa_lookup) is reported through * odp_ipsec_packet_result_t. */ - ODP_IPSEC_LOOKUP_SPI + ODP_IPSEC_LOOKUP_SPI, + + /** Inbound SA lookup is enabled. Lookup matches both SPI value and + * destination IP address. Functionality is otherwise identical to + * ODP_IPSEC_LOOKUP_SPI. */ + ODP_IPSEC_LOOKUP_DSTADDR_SPI } odp_ipsec_lookup_mode_t; /** + * Result event pipeline configuration + */ +typedef enum odp_ipsec_pipeline_t { + /** Do not pipeline */ + ODP_IPSEC_PIPELINE_NONE = 0, + + /** Send IPSEC result events to the classifier. + * + * IPSEC capability 'pipeline_cls' determines if pipelined + * classification is supported. */ + ODP_IPSEC_PIPELINE_CLS + +} odp_ipsec_pipeline_t; + +/** * IPSEC Security Association (SA) parameters */ typedef struct odp_ipsec_sa_param_t { @@ -432,6 +616,21 @@ typedef struct odp_ipsec_sa_param_t { /** SPI value */ uint32_t spi; + /** Additional inbound SA lookup parameters. Values are considered + * only in ODP_IPSEC_LOOKUP_DSTADDR_SPI lookup mode. */ + struct { + /** Select IP version + * + * 4: IPv4 + * 6: IPv6 + */ + uint8_t ip_version; + + /** IP destination address (NETWORK ENDIAN) */ + void *dst_addr; + + } lookup_param; + /** MTU for outbound IP fragmentation offload * * This is the maximum length of IP packets that outbound IPSEC @@ -440,13 +639,31 @@ typedef struct odp_ipsec_sa_param_t { */ uint32_t mtu; + /** Select pipelined destination for IPSEC result events + * + * Asynchronous and inline modes generate result events. Select where + * those events are sent. Inbound SAs may choose to use pipelined + * classification. The default value is ODP_IPSEC_PIPELINE_NONE. + */ + odp_ipsec_pipeline_t pipeline; + /** Destination queue for IPSEC events * - * Operations in asynchronous mode enqueue resulting events into - * this queue. + * Operations in asynchronous or inline mode enqueue resulting events + * into this queue. */ odp_queue_t dest_queue; + /** Classifier destination CoS for IPSEC result events + * + * Result events for successfully decapsulated packets are sent to + * classification through this CoS. Other result events are sent to + * 'dest_queue'. This field is considered only when 'pipeline' is + * ODP_IPSEC_PIPELINE_CLS. The CoS must not be shared between any pktio + * interface default CoS. + */ + odp_cos_t dest_cos; + /** User defined SA context pointer * * User defined context pointer associated with the SA. @@ -679,6 +896,18 @@ typedef struct odp_ipsec_op_status_t { uint32_t all_error; }; + union { + /** Status flags */ + struct { + /** Packet was processed in inline mode */ + uint32_t inline_mode : 1; + + } flag; + + /** All flag bits */ + uint32_t all_flag; + }; + } odp_ipsec_op_status_t; /** @@ -708,7 +937,7 @@ typedef struct odp_ipsec_op_param_t { /** Pointer to an array of packets * - * Each packet must have a valid value for these meta-data: + * Each packet must have a valid value for these metadata: * * L3 offset: Offset to the first byte of the (outmost) IP header * * L4 offset: For inbound direction, when udp_encap is enabled - * offset to the first byte of the encapsulating UDP @@ -733,6 +962,35 @@ typedef struct odp_ipsec_op_param_t { } odp_ipsec_op_param_t; /** + * Outbound inline IPSEC operation parameters + */ +typedef struct odp_ipsec_inline_op_param_t { + /** Packet output interface for inline output operation + * + * Outbound inline IPSEC operation uses this packet IO interface to + * output the packet after a successful IPSEC transformation. The pktio + * must have been configured to operate in inline IPSEC mode. + */ + odp_pktio_t pktio; + + /** Outer headers for inline output operation + * + * Outbound inline IPSEC operation uses this information to prepend + * outer headers to the IPSEC packet before sending it out. + */ + struct { + /** Points to first byte of outer headers to be copied in + * front of the outgoing IPSEC packet. Implementation copies + * the headers during odp_ipsec_out_inline() call. */ + uint8_t *ptr; + + /** Outer header length in bytes */ + uint32_t len; + } outer_hdr; + +} odp_ipsec_inline_op_param_t; + +/** * IPSEC operation result for a packet */ typedef struct odp_ipsec_packet_result_t { @@ -758,6 +1016,23 @@ typedef struct odp_ipsec_packet_result_t { */ odp_ipsec_sa_t sa; + /** Packet outer header status before inbound inline processing. + * This is valid only when status.flag.inline_mode is set. + */ + struct { + /** Points to the first byte of retained outer headers. These + * headers are stored in a contiquous, per packet, + * implementation specific memory space. Since the memory space + * may overlap with e.g. packet head/tailroom, the content + * becomes invalid if packet data storage is modified in + * anyway. The memory space may not be sharable to other + * threads. */ + uint8_t *ptr; + + /** Outer header length in bytes */ + uint32_t len; + } outer_hdr; + } odp_ipsec_packet_result_t; /** @@ -779,18 +1054,14 @@ typedef struct odp_ipsec_op_result_t { * at least 'num_pkt' elements. * * Each successfully transformed packet has a valid value for these - * meta-data: + * metadata regardless of the inner packet parse configuration. + * (odp_ipsec_inbound_config_t): * * L3 offset: Offset to the first byte of the (outmost) IP header - * * L4 offset: Offset to the first byte of the valid and known L4 - * header (immediately following the IP header). - * * Various flags about L3 and L4 layers: - * has_l3, has_l4, has_ipv4, has_ipv6, has_ipfrag, - * has_ipsec, has_udp, has_tcp, etc depending on - * the resulted packet format + * * pktio: For inbound inline IPSEC processed packets, original + * packet input interface * - * @see odp_packet_l3_offset(), odp_packet_l4_offset(), - * odp_packet_has_ipv4(), odp_packet_has_ipv6(), - * odp_packet_has_ipfrag(), odp_packet_has_ipsec() + * Other metadata for parse results and error checks depend on + * configuration (selected parse and error check levels). */ odp_packet_t *pkt; @@ -921,10 +1192,10 @@ int odp_ipsec_out(const odp_ipsec_op_param_t *input, /** * Inbound asynchronous IPSEC operation * - * This operation does inbound IPSEC processing in asynchronous mode - * (ODP_IPSEC_OP_MODE_ASYNC). It processes packets otherwise identically to - * odp_ipsec_in(), but outputs all results through one or more - * ODP_EVENT_IPSEC_RESULT events with the following ordering considerations. + * This operation does inbound IPSEC processing in asynchronous mode. It + * processes packets otherwise identically to odp_ipsec_in(), but outputs all + * results through one or more ODP_EVENT_IPSEC_RESULT events with the following + * ordering considerations. * * Asynchronous mode maintains (operation input) packet order per SA when * application calls the operation within an ordered or atomic scheduler context @@ -934,6 +1205,11 @@ int odp_ipsec_out(const odp_ipsec_op_param_t *input, * events for the same SA are enqueued in order, and packet handles (for the * same SA) are stored in order within an event. * + * The function may be used also in inline processing mode, e.g. for IPSEC + * packets for which inline processing is not possible. Packets for the same SA + * may be processed simultaneously in both modes (initiated by this function + * and inline operation). + * * @param input Operation input parameters * * @return Number of input packets consumed (0 ... input.num_pkt) @@ -946,10 +1222,10 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); /** * Outbound asynchronous IPSEC operation * - * This operation does outbound IPSEC processing in asynchronous mode - * (ODP_IPSEC_OP_MODE_ASYNC). It processes packets otherwise identically to - * odp_ipsec_out(), but outputs all results through one or more - * ODP_EVENT_IPSEC_RESULT events with the following ordering considerations. + * This operation does outbound IPSEC processing in asynchronous mode. It + * processes packets otherwise identically to odp_ipsec_out(), but outputs all + * results through one or more ODP_EVENT_IPSEC_RESULT events with the following + * ordering considerations. * * Asynchronous mode maintains (operation input) packet order per SA when * application calls the operation within an ordered or atomic scheduler context @@ -959,6 +1235,9 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); * events for the same SA are enqueued in order, and packet handles (for the * same SA) are stored in order within an event. * + * The function may be used also in inline processing mode, e.g. for IPSEC + * packets for which inline processing is not possible. + * * @param input Operation input parameters * * @return Number of input packets consumed (0 ... input.num_pkt) @@ -969,6 +1248,28 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); int odp_ipsec_out_enq(const odp_ipsec_op_param_t *input); /** + * Outbound inline IPSEC operation + * + * This operation does outbound inline IPSEC processing for the packets. It's + * otherwise identical to odp_ipsec_out_enq(), but outputs all successfully + * transformed packets to the specified output interface, instead of generating + * result events for those. + * + * Inline operation parameters are defined per packet. The array of parameters + * must have 'op_param.num_pkt' elements and is pointed to by 'inline_param'. + * + * @param op_param Operation parameters + * @param inline_param Outbound inline operation specific parameters + * + * @return Number of packets consumed (0 ... op_param.num_pkt) + * @retval <0 On failure + * + * @see odp_ipsec_out_enq() + */ +int odp_ipsec_out_inline(const odp_ipsec_op_param_t *op_param, + const odp_ipsec_inline_op_param_t *inline_param); + +/** * Get IPSEC results from an ODP_EVENT_IPSEC_RESULT event * * Copies IPSEC operation results from an event. The event must be of diff --git a/include/odp/api/spec/packet_io.h b/include/odp/api/spec/packet_io.h index cec1f22..8802089 100644 --- a/include/odp/api/spec/packet_io.h +++ b/include/odp/api/spec/packet_io.h @@ -407,6 +407,38 @@ typedef struct odp_pktio_config_t { * interface capability before enabling the same. */ odp_bool_t enable_loop; + /** Inbound IPSEC inlined with packet input + * + * Enable/disable inline inbound IPSEC operation. When enabled packet + * input directs all IPSEC packets automatically to IPSEC inbound + * processing. IPSEC configuration is done through the IPSEC API. + * Packets that are not (recognized as) IPSEC are processed + * according to the packet input configuration. + * + * 0: Disable inbound IPSEC inline operation (default) + * 1: Enable inbound IPSEC inline operation + * + * @see odp_ipsec_config(), odp_ipsec_sa_create() + */ + odp_bool_t inbound_ipsec; + + /** Outbound IPSEC inlined with packet output + * + * Enable/disable inline outbound IPSEC operation. When enabled IPSEC + * outbound processing can send outgoing IPSEC packets directly + * to the pktio interface for output. IPSEC configuration is done + * through the IPSEC API. + * + * Outbound IPSEC inline operation cannot be combined with traffic + * manager (ODP_PKTOUT_MODE_TM). + * + * 0: Disable outbound IPSEC inline operation (default) + * 1: Enable outbound IPSEC inline operation + * + * @see odp_ipsec_config(), odp_ipsec_sa_create() + */ + odp_bool_t outbound_ipsec; + } odp_pktio_config_t; /**