From patchwork Thu Mar 30 10:29:44 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Petri Savolainen X-Patchwork-Id: 96265 Delivered-To: patch@linaro.org Received: by 10.182.246.10 with SMTP id xs10csp1171764obc; Thu, 30 Mar 2017 03:32:31 -0700 (PDT) X-Received: by 10.237.55.134 with SMTP id j6mr5572454qtb.191.1490869951312; Thu, 30 Mar 2017 03:32:31 -0700 (PDT) Return-Path: Received: from lists.linaro.org (lists.linaro.org. [54.225.227.206]) by mx.google.com with ESMTP id o20si1488368qkl.21.2017.03.30.03.32.30; Thu, 30 Mar 2017 03:32:31 -0700 (PDT) Received-SPF: pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) client-ip=54.225.227.206; Authentication-Results: mx.google.com; spf=pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) smtp.mailfrom=lng-odp-bounces@lists.linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: by lists.linaro.org (Postfix, from userid 109) id 0BB4D63533; Thu, 30 Mar 2017 10:32:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on ip-10-142-244-252 X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAD_ENC_HEADER,BAYES_00, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_PASS autolearn=disabled version=3.4.0 Received: from [127.0.0.1] (localhost [127.0.0.1]) by lists.linaro.org (Postfix) with ESMTP id 0288560A36; Thu, 30 Mar 2017 10:31:35 +0000 (UTC) X-Original-To: lng-odp@lists.linaro.org Delivered-To: lng-odp@lists.linaro.org Received: by lists.linaro.org (Postfix, from userid 109) id 58CCA609FD; Thu, 30 Mar 2017 10:31:24 +0000 (UTC) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0115.outbound.protection.outlook.com [104.47.1.115]) by lists.linaro.org (Postfix) with ESMTPS id B16F160A36 for ; Thu, 30 Mar 2017 10:30:48 +0000 (UTC) Received: from DB6PR07CA0073.eurprd07.prod.outlook.com (10.175.238.11) by VI1PR0701MB2720.eurprd07.prod.outlook.com (10.173.80.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1005.2; Thu, 30 Mar 2017 10:30:46 +0000 Received: from VE1EUR03FT020.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e09::206) by DB6PR07CA0073.outlook.office365.com (2603:10a6:6:2b::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.8 via Frontend Transport; Thu, 30 Mar 2017 10:30:46 +0000 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning linaro.org discourages use of 131.228.2.240 as permitted sender) Received: from mailrelay.int.nokia.com (131.228.2.240) by VE1EUR03FT020.mail.protection.outlook.com (10.152.18.242) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1005.5 via Frontend Transport; Thu, 30 Mar 2017 10:30:45 +0000 Received: from fihe3nok0734.emea.nsn-net.net (localhost [127.0.0.1]) by fihe3nok0734.emea.nsn-net.net (8.14.9/8.14.5) with ESMTP id v2UATj4I020074 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 30 Mar 2017 13:29:45 +0300 Received: from 10.144.19.15 ([10.144.104.219]) by fihe3nok0734.emea.nsn-net.net (8.14.9/8.14.5) with ESMTP id v2UATjos020044 (version=TLSv1/SSLv3 cipher=AES128-SHA256 bits=128 verify=NOT) for ; Thu, 30 Mar 2017 13:29:45 +0300 X-HPESVCS-Source-Ip: 10.144.104.219 From: Petri Savolainen To: Date: Thu, 30 Mar 2017 13:29:44 +0300 Message-ID: <1490869785-16657-2-git-send-email-petri.savolainen@linaro.org> X-Mailer: git-send-email 2.8.1 In-Reply-To: <1490869785-16657-1-git-send-email-petri.savolainen@linaro.org> References: <1490869785-16657-1-git-send-email-petri.savolainen@linaro.org> X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:131.228.2.240; IPV:CAL; CTRY:FI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(39450400003)(39400400002)(39410400002)(39860400002)(39850400002)(39840400002)(2980300002)(199003)(189002)(9170700003)(356003)(48376002)(305945005)(76176999)(8676002)(50986999)(81166006)(53936002)(36756003)(110136004)(38730400002)(50466002)(2950100002)(77096006)(86362001)(47776003)(6916009)(22756006)(5660300001)(575784001)(50226002)(2906002)(2351001)(105596002)(33646002)(106466001)(5003940100001)(8936002)(189998001)(217873001); DIR:OUT; SFP:1102; SCL:1; SRVR:VI1PR0701MB2720; H:mailrelay.int.nokia.com; FPR:; SPF:SoftFail; MLV:sfv; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; VE1EUR03FT020; 1:JhmkzpebiDBbBh874tUiKVRvCgMdeUWgrELNhzyQWq2vqnJdFD+jkUF5Lv1rBeiE5lrFOsOMU0cIWTEOAR8mO9gLdPc3lOtvaHNirp1xIAAx5vPrrwV6ZrfkwpYR/hDP11sx+D9ntUuwskvKEFeDieFblsOGE+Un1lswEjZIP1XSYHoc4VYQ5VeRbG7O2hyB747YsPT0oUdfwkzNUPVMW6iimBZXOghJLn7MAnEAyB8Q3Tt9SGWtNVmEx+nJkkNIWMR2pdSeADydnuToZBarUNmIAKVdmFvMcIJ64uU8QBSGtbsWj6javCwV877x16mApRLv45VddVniwOlKq1EzcjYGnm+3Ia/55sEYpIwtvr+UWr8TbRGzVPmp9wG1/NFK4C8R4gP3CHNGMXaHXok7KhK5D7GYK+jVckL2JMXpUOn24tZPZfCkGiq/JuvK/X0j4lmc5jEp3cmu9SIN+1ymphau+CyirVOo9WJJk0R42sQKdM/K0MVaPi2QQmKu4FKBnxTJCQjUpIQpYSI++uIS/g== MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 1f1516fc-084c-4a0f-4dba-08d47757d376 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(2017030256075)(201703131423075)(201703031133081); SRVR:VI1PR0701MB2720; X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB2720; 3:3crWhqXWSSv8w/0DmfIrVhQvlzD2u0EI18a410oMhQLyTc9WNerE8KXjhp+4cP6Ae/zaug8MFW0on1aJ53bOI/q5YjzLHfgPZCxko6YrCNzF2Fz/ZoLS7r/lqSpS0zaAxxCCx7Z8qnm5Qq8AwJqXHfIf5WGZ8dFOtbX9GZ1SBlV6yR3zozXV4Q1JtZfqYaH7srtuXt8G7SR+oLb67IRt1CJrnF2V7lT20aWIcIf0h6ZnjSG1/YTo9DAk35S05hZxq3tEMJ3GpUY4VxFJ7DpsKWZVhzR3KW0nqcuAQf+mL1mzCt35j88Rzzktn7WhlP8VmUqY/Bbbetg6XERaW/J4wRFyR7BXcOET5LATYguwrgtScbyHuvSsZSQz+6ZIILEvn+6SaMoKh31/BPVsB48ouN6chJmQI9DEHFBhquIBIJvbbMoBqBiTrCwkc5HjHVfXZZsFvGhs6220AV+tsh4xbj7aRe/xv6lFFiWFaKYayNfz+62IteDJqkzoCUkBGbQO X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB2720; 25:sx8KO19utp7IiumVO/9Zbhofn42gIfHC3Los5FSmNdZ0EllwClH232TgT5fEqs/YuaH0r79r7TjkoQLxG9qHBcbAQPq+rjJdftVlObtA9BzH8ok+/gXh4A+iU0uJQEtaMPqNY7VmK40mFvCFZ4Dr2dhjcXFJ2+sgzjCvnzANQtRkbArf3oFWPmxjEh9KI/+mIP6sec/qeT+MSpmpy4E5C0WyUl+Y0atxLavGvALnB1qgtslXo8yR/OUZOZhgmy349vZkz+p2yaaZ5GtXR+JfGoA/OJ7Ra+grjLdIS2vozI7BsnKZnSF0etf5DaSZ07YKykaQ4VJzoVRSRYCmnZxfwRSnEF78EtEdDhWQhAVMWougikqhaW6bj69Z/pMSFT0hQcoCAGqdx8RAdGrnucSWc/2/pDWWUszYX80li8Uv4PS2mjEiO5Js4SQpHgI5/EpyWc7VlT3rLsBc8Q+jMc4ovQ==; 31:0vOmodd13MR1Htn4JAQ+o+l2QHU7YARfPv03dOhs7leKoqtum3vcImUbqr2Pf8BO1fHk/HZ0VImZ+KuaKy2eVNuJCZfu+Zpz/cMQJ9wzgiT/r/I1uTfFusEVyL6OR7bs/l8u2yV8TFj5AoN9p/EwZHy58XzHLSbyuR3v5kIt9YNYQoAKyqZl4LgXrWSLJHkekVPqRX4r8N7Z8WYvxO0PK1azDWiuKG5OJar0pUWBxeBU2cdbt+rjTXEQ8bSQw0vT2mqsY+mmXleGaRSiHixRYW2ZQX9dAxqCWBa0Qx0CVCo= X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB2720; 20:5KMSaOK1LJpE6hVPUBqKikVeMisXKs8JbjHDymAcylzwidQo2zhpV/Lw40jW6KsjsFq35aK6BL8rEi/K9Yf5mNll/uUm79nAx6StrkwuSvibvKytzedrd3dFczTMtqLhSMMjvC+Bc5oWpepa0AMSNthWPk9eHM+9YMnylLtuLcdweCepgN4X5lpz/JvH6n6V2JX8m5QWJAIBfVlGl6fT4ikUqPyb38Opp8pzZ4E8ongB1S1CUC5xITdtNb6JXSQRimKYlC/QiZdq5bBDvmKCaPgaT12eq7F3pVI8ToCqPNPNnj1yHc0hx1jS+B9wGUaRxpiin52gMjhAE0czIdHUeE3kgsdHJIyHN2v1SH1uj2lxP3FuGb9DKra3TZp9WPWoci1LQanzmGi5H5OI/K6EJwtKymJ5nZr8MN5J4FaOanxCs/Km7r+va/GZvmUHeeLQyH+OvTNR2RqfrrbIRukoqs4KDu69PIozgK44sqFG2Vh+0GgvOCkv4XAa4vknQVDhzC1frQy4FdaBf5LBJs0hJDkYJexvo2QAG9/9MHPHEd6p2ic3QRNSGfBqpU5Z3SeBOIA81OxOO4/IF1b2NmcROBjyx2WvmYE/gEGiv3D5RJc= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(131327999870524); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(13023025)(13021025)(13013025)(8121501046)(5005006)(3002001)(93006067)(93003067)(10201501046)(6055026)(6041248)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(20161123555025)(20161123560025)(20161123564025)(6072148); SRVR:VI1PR0701MB2720; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0701MB2720; X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB2720; 4:lCeKjsAuVUmU1K4b+afA1XmQWnvQR/MD/K7hNnLshDt79U6BGueAGLlXRpqhIra9rpLmiccnHCxOofw3Xzau5om6vwic9DlyRzTawPcICSzXgsDnn05INg/hQekVvIVmmHrDECRGDxk9VWdbLMbq/a7K1dwGbBmiSTS1wIQQmZXZrNqg/pCDRGKppRoBLe0YWprVAuLQ8lgi0yfgc+urS1qO9PRuvN82Mmfub0JyqRwP7tpkMMu0XHuGwMeUvTxv/ek47Yn0/86RgHzVfUIZWlK7A8djS4Uvr+KS4zP0bEbA3281BPXK2KXEyCkNsv38ol0+v/7+Wg3mS9J46Tf79n8agfLFfXqTE10iDLnjkobrCI6PmTpYFh4g/oQRvNmh9tkAzIijwX7kz5n2bvqDQqEJ+du9LX/pqy87gZAeUSuH/382aiyWs6VT4nEQAzvzfqSYlZGBCTGUlCt0Pem7wNS5pGw1Zvwq7DUpfen73+ByvX144c178FpnRn9R6Lqm9CKbTvn7qACzXfBjFqkm3AzZtZ5WyiRslvx52jiH8LpUt+FlAfnhZaKhCDab1ae6QAiGirnCL6DocNaZLOnOz/En21qEKeY8rTNtULAcSWwlmkLzDPr4gv3GPHfDgAkORTgEubIepjhixKx0SlPo69KEn+J+CJeKsIAw5lc2QUToUqWhRmfYqbzqaj0JSQNiGLlXrIbj//lSi1Ubpk+pmvJrtoYX1Q4RlkzbTYnH2aZ58CTWMU5rMYgagZMjeQ8MyjitJ5s+obVO7VVDcS4NPnypEWQ3l2hRRJ0RIFXyAD9ZveV9/hvNxXZaLYJKGwuUmbIfvNKWt00xWxa0UUkmZCUctcMRWnpL7NFCquEGGGsuZeKPiXZ0KdCu5Czvh7fV X-Forefront-PRVS: 02622CEF0A X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; VI1PR0701MB2720; 23:tqX+lL/TpU5z89T5UB/SkmkRNvYupXpTnfJ4B9X?= tguENy99EdH2aGVXrPEP9h5NrmrCtOdR43JlTFIxrenunK0zM4Wyo7YLGB3EuGBpaYmlrTN4Fp0VhR0HmSpa7FOtGRmJ9eNn813cyf+gu8x8FfN1RmT7Ltf0/VpAfD1Ke/6iFJLjKI7PI0bujAcP2fAAcd5hjXF1ix997SdB3Kp1a7zaK3cjwdCqcvkFy8HD1VirvsDtbKyqYI63YQequLytq5talPrAcq6s3hxBkZvaLZvhGrf4ySf0zCslVTpM59gwTRR21NpRxZirNdfseBW6910y+Qdgbf/8hdTsCtH9dPi8eppd5Avcd+/tew4QmTOq1nqPov0nXjEgK3V/hTlRTqs8lm+Xj2u8R3/q3S7o+bDPhLZoqRU37nHjZgsGjdgSaA0bYlWTqDKczKbbnaUn1Rk/boFarppcDEcE+B99VwL0MSDvvtS/X0PsmtcQDzt7RenOceRdgLThclpHyq6xufdfUyn9GH42VNkULSDc14ZTBPs+mA6C+PvTmIOdMcLpCW54le0LTdCFWue81Z50lDIvof+/LQ/iZZiluY2fBpGIbihYKLbHCQSPU02CTotXnWLAkSZu+UnZDxZCJOYUwrjHwwcVbWXTVk1rKutOMLoqQoY5cWHGcTX6HcXf2aVJCRUyYvn2LXuowIUfSPRwoFxWxYBiXiUJfZg6mZ0LIkcppclC/gy/789hXjnS5ow/26MEfSeymjSBl0qmsAIXWdADrVcxt5QKCRwcD8tzYBkstKObklNHiKu0AO63cnLHKNDVpxhTp8G6mX4a0xszWq76If9WtApXqgEhu3NyeWDNWYQU1wPwnE0XsxQUhqOHlPVcRs0RRWANe/usWoeorndTIBwtghv0J0119niwOD9XtgxLEVjnw8ByX09fy38itWc4/ZXpq0HiKnJzBAUy1KI/PgwSZskQ0BwLXA2I6v4Ha09pHDZffj+i12cVpMFFYmtGgGXX99sl4yPYQVN8K8wnWmyTvH5fkBdl0oGrKbAezu31qo5TWDkHQJmkC79k= X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB2720; 6:OCV9msIAn1XsRxaOmS7L0iX7DHxBqkrabv6hBZnEogp6v/vdkl3iuXI4NQLdePDUcYjZYBwnk03T30peMX6ELHkCTsxvtkw+qnOg2a9jrTjU5rwvFNdJZkLD2LghMgLwBUC02kq6ABDrRSA8vj1RZtafSKtuYWddKQpKQdt7lg0vPTArjbqd73pX0U1VncKfU9QyccUvii5iQ4HNhXlgCsM73UA30dzpuKcMMgfNX56b/OF8lTjJafOHRGRUOFzSQ2kcd90p+Yorwv8zt+Oul0IWhKUgprkf8bM7Lilcblr1XPFkmHg4D+RrJRukdJlFI5ybBmjHHC2AXTMvB+XvMKox3Ax56v5ZvyYWp0vNBkg0oTC0HhYACc5SSI7GGubFDWIi0Rw/h6tNuBjA3dm+6UdxITRm7/lCnE47a7EKak4=; 5:kqhBwsjyIraZwmo0ikmc6JsK29HCa1sSRMBkQGInAZ0teJaV1usm27vxEzjZQAFuNmM46BSX2hnshlvkEKpn6NottRzffNWU5KSju0jAdlCd0okqBGmBNgUrQk+WkgOkzeAVGyte3Kv/SLWJzd8nwA==; 24:6Eg/11eE7CcwePuVFnWneZXztsPaGBWbXHWF7Oci3Rll86Q7hxj0TmJN3wbgEW58aH5sqPRysXxkTYBhNS0Vtr76sHeB3TLr05DtSltfej4= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; VI1PR0701MB2720; 7:vi3mSXm41NLTFaXqzWNAUHQ4PrID0c6eLEUQweimex2dIJj9U4UpwGTRdH16ygbcFs8Vo0+d3sjOypMW/v717/1L732dEYBWZ+3znZ7gXgMDF7HbUKlE9CIhrBfkAKIdET80g+r1ouuRi0lWBTtCFt/TjtJfqsBacS4J5601kB4J5NogPAHWqdlQiGbr8JQouzsyMQOJtIwSt0onOP1OA6AmQEXVjYSTBcMa4QJdYPu2Ne8y4TS0Hbvwsp26DGyIxoTMZqUo25LAnfsWIYcmGlJFrGZ72BVnqXnhxlDWcXuABuGjOqjvk9Zn3kFVUkJkn62GYf9DUxteayaoUuljWg== X-OriginatorOrg: nokia.onmicrosoft.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Mar 2017 10:30:45.7657 (UTC) X-MS-Exchange-CrossTenant-Id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5d471751-9675-428d-917b-70f44f9630b0; Ip=[131.228.2.240]; Helo=[mailrelay.int.nokia.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0701MB2720 Subject: [lng-odp] [API-NEXT PATCH v4 2/3] api: ipsec: add inline IPSEC support X-BeenThere: lng-odp@lists.linaro.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: "The OpenDataPlane \(ODP\) List" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: lng-odp-bounces@lists.linaro.org Sender: "lng-odp" Added support for inline IPSEC processing on packet input and output. Inline mode IPSEC and traffic manager cannot be enabled (currently) on the same pktio interface. Signed-off-by: Petri Savolainen --- include/odp/api/spec/ipsec.h | 355 ++++++++++++++++++++++++++++++++++++--- include/odp/api/spec/packet_io.h | 32 ++++ 2 files changed, 360 insertions(+), 27 deletions(-) -- 2.8.1 diff --git a/include/odp/api/spec/ipsec.h b/include/odp/api/spec/ipsec.h index 118363e..b3dc0ca 100644 --- a/include/odp/api/spec/ipsec.h +++ b/include/odp/api/spec/ipsec.h @@ -19,6 +19,8 @@ extern "C" { #endif #include +#include +#include /** @defgroup odp_ipsec ODP IPSEC * Operations of IPSEC API. @@ -51,11 +53,43 @@ typedef enum odp_ipsec_op_mode_t { * Application uses asynchronous IPSEC operations, * which return results via events. */ - ODP_IPSEC_OP_MODE_ASYNC + ODP_IPSEC_OP_MODE_ASYNC, + + /** Inline IPSEC operation + * + * Packet input/output is connected directly to IPSEC inbound/outbound + * processing. Application uses asynchronous or inline IPSEC + * operations. + */ + ODP_IPSEC_OP_MODE_INLINE, + + /** IPSEC is disabled in inbound / outbound direction */ + ODP_IPSEC_OP_MODE_DISABLED } odp_ipsec_op_mode_t; /** + * Protocol layers in IPSEC configuration + */ +typedef enum odp_ipsec_proto_layer_t { + /** No layers */ + ODP_IPSEC_LAYER_NONE = 0, + + /** Layer L2 protocols (Ethernet, VLAN, etc) */ + ODP_IPSEC_LAYER_L2, + + /** Layer L3 protocols (IPv4, IPv6, ICMP, IPSEC, etc) */ + ODP_IPSEC_LAYER_L3, + + /** Layer L4 protocols (UDP, TCP, SCTP) */ + ODP_IPSEC_LAYER_L4, + + /** All layers */ + ODP_IPSEC_LAYER_ALL + +} odp_ipsec_proto_layer_t; + +/** * Configuration options for IPSEC inbound processing */ typedef struct odp_ipsec_inbound_config_t { @@ -88,9 +122,110 @@ typedef struct odp_ipsec_inbound_config_t { } lookup; + /** Retain outer headers + * + * Select up to which protocol layer (at least) outer headers are + * retained in inbound inline processing. Default value is + * ODP_IPSEC_LAYER_NONE. + * + * ODP_IPSEC_LAYER_NONE: Application does not require any outer + * headers to be retained. + * + * ODP_IPSEC_LAYER_L2: Retain headers up to layer 2. + * + * ODP_IPSEC_LAYER_L3: Retain headers up to layer 3, otherwise the + * same as ODP_IPSEC_LAYER_ALL. + * + * ODP_IPSEC_LAYER_L4: Retain headers up to layer 4, otherwise the + * same as ODP_IPSEC_LAYER_ALL. + * + * ODP_IPSEC_LAYER_ALL: In tunnel mode, all headers before IPSEC are + * retained. In transport mode, all headers + * before IP (carrying IPSEC) are retained. + * + */ + odp_ipsec_proto_layer_t retain_outer; + + /** Parse packet headers after IPSEC transformation + * + * Select header parsing level after inbound processing. Headers of the + * resulting packet must be parsed (at least) up to this level. Parsing + * starts from IP (layer 3). Each successfully transformed packet has + * a valid value for L3 offset regardless of the parse configuration. + * Default value is ODP_IPSEC_LAYER_NONE. + */ + odp_ipsec_proto_layer_t parse; + + /** Flags to control IPSEC payload data checks up to the selected parse + * level. */ + union { + struct { + /** Check IPv4 header checksum in IPSEC payload. + * Default value is 0. */ + uint32_t ipv4_chksum : 1; + + /** Check UDP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t udp_chksum : 1; + + /** Check TCP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t tcp_chksum : 1; + + /** Check SCTP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t sctp_chksum : 1; + } check; + + /** All bits of the bit field structure + * + * This field can be used to set/clear all flags, or bitwise + * operations over the entire structure. */ + uint32_t all_check; + }; + } odp_ipsec_inbound_config_t; /** + * Configuration options for IPSEC outbound processing + */ +typedef struct odp_ipsec_outbound_config_t { + /** Flags to control L3/L4 checksum insertion as part of outbound + * packet processing. Packet must have set with valid L3/L4 offsets. + * Checksum configuration is ignored for packets that checksum cannot + * be computed for (e.g. IPv4 fragments). Application may use a packet + * metadata flag to disable checksum insertion per packet bases. + */ + union { + struct { + /** Insert IPv4 header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_ipv4 : 1; + + /** Insert UDP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_udp : 1; + + /** Insert TCP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_tcp : 1; + + /** Insert SCTP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_sctp : 1; + + } chksum; + + /** All bits of the bit field structure + * + * This field can be used to set/clear all flags, or bitwise + * operations over the entire structure. */ + uint32_t all_chksum; + }; + +} odp_ipsec_outbound_config_t; + +/** * IPSEC capability */ typedef struct odp_ipsec_capability_t { @@ -113,6 +248,23 @@ typedef struct odp_ipsec_capability_t { */ uint8_t op_mode_async; + /** Inline IPSEC operation mode (ODP_IPSEC_OP_MODE_INLINE) support + * + * 0: Inline IPSEC operation is not supported + * 1: Inline IPSEC operation is supported + * 2: Inline IPSEC operation is supported and preferred + */ + uint8_t op_mode_inline; + + /** Support of pipelined classification (ODP_IPSEC_PIPELINE_CLS) of + * resulting inbound packets. + * + * 0: Classification of resulting packets is not supported + * 1: Classification of resulting packets is supported + * 2: Classification of resulting packets is supported and preferred + */ + uint8_t pipeline_cls; + /** Soft expiry limit in seconds support * * 0: Limit is not supported @@ -139,12 +291,19 @@ typedef struct odp_ipsec_capability_t { * IPSEC configuration options */ typedef struct odp_ipsec_config_t { - /** IPSEC operation mode. Application selects which mode (sync or async) - * will be used for IPSEC operations. + /** Inbound IPSEC operation mode. Application selects which mode + * will be used for inbound IPSEC operations. * * @see odp_ipsec_in(), odp_ipsec_in_enq() */ - odp_ipsec_op_mode_t op_mode; + odp_ipsec_op_mode_t inbound_mode; + + /** Outbound IPSEC operation mode. Application selects which mode + * will be used for outbound IPSEC operations. + * + * @see odp_ipsec_out(), odp_ipsec_out_enq(), odp_ipsec_out_inline() + */ + odp_ipsec_op_mode_t outbound_mode; /** Maximum number of IPSEC SAs that application will use * simultaneously */ @@ -153,6 +312,9 @@ typedef struct odp_ipsec_config_t { /** IPSEC inbound processing configuration */ odp_ipsec_inbound_config_t inbound; + /** IPSEC outbound processing configuration */ + odp_ipsec_outbound_config_t outbound; + } odp_ipsec_config_t; /** @@ -392,13 +554,35 @@ typedef enum odp_ipsec_lookup_mode_t { ODP_IPSEC_LOOKUP_DISABLED = 0, /** Inbound SA lookup is enabled. Lookup matches only SPI value. - * SA lookup failure status (error.sa_lookup) is reported through + * In inline mode, a lookup miss directs the packet back to normal + * packet input interface processing. In other modes, the SA lookup + * failure status (error.sa_lookup) is reported through * odp_ipsec_packet_result_t. */ - ODP_IPSEC_LOOKUP_SPI + ODP_IPSEC_LOOKUP_SPI, + + /** Inbound SA lookup is enabled. Lookup matches both SPI value and + * destination IP address. Functionality is otherwise identical to + * ODP_IPSEC_LOOKUP_SPI. */ + ODP_IPSEC_LOOKUP_DSTADDR_SPI } odp_ipsec_lookup_mode_t; /** + * Result event pipeline configuration + */ +typedef enum odp_ipsec_pipeline_t { + /** Do not pipeline */ + ODP_IPSEC_PIPELINE_NONE = 0, + + /** Send IPSEC result events to the classifier. + * + * IPSEC capability 'pipeline_cls' determines if pipelined + * classification is supported. */ + ODP_IPSEC_PIPELINE_CLS + +} odp_ipsec_pipeline_t; + +/** * IPSEC Security Association (SA) parameters */ typedef struct odp_ipsec_sa_param_t { @@ -439,6 +623,21 @@ typedef struct odp_ipsec_sa_param_t { /** SPI value */ uint32_t spi; + /** Additional inbound SA lookup parameters. Values are considered + * only in ODP_IPSEC_LOOKUP_DSTADDR_SPI lookup mode. */ + struct { + /** Select IP version + * + * 4: IPv4 + * 6: IPv6 + */ + uint8_t ip_version; + + /** IP destination address (NETWORK ENDIAN) */ + void *dst_addr; + + } lookup_param; + /** MTU for outbound IP fragmentation offload * * This is the maximum length of IP packets that outbound IPSEC @@ -447,13 +646,31 @@ typedef struct odp_ipsec_sa_param_t { */ uint32_t mtu; + /** Select pipelined destination for IPSEC result events + * + * Asynchronous and inline modes generate result events. Select where + * those events are sent. Inbound SAs may choose to use pipelined + * classification. The default value is ODP_IPSEC_PIPELINE_NONE. + */ + odp_ipsec_pipeline_t pipeline; + /** Destination queue for IPSEC events * - * Operations in asynchronous mode enqueue resulting events into - * this queue. + * Operations in asynchronous or inline mode enqueue resulting events + * into this queue. */ odp_queue_t dest_queue; + /** Classifier destination CoS for IPSEC result events + * + * Result events for successfully decapsulated packets are sent to + * classification through this CoS. Other result events are sent to + * 'dest_queue'. This field is considered only when 'pipeline' is + * ODP_IPSEC_PIPELINE_CLS. The CoS must not be shared between any pktio + * interface default CoS. + */ + odp_cos_t dest_cos; + /** User defined SA context pointer * * User defined context pointer associated with the SA. @@ -686,6 +903,18 @@ typedef struct odp_ipsec_op_status_t { uint32_t all_error; }; + union { + /** Status flags */ + struct { + /** Packet was processed in inline mode */ + uint32_t inline_mode : 1; + + } flag; + + /** All flag bits */ + uint32_t all_flag; + }; + } odp_ipsec_op_status_t; /** @@ -715,7 +944,7 @@ typedef struct odp_ipsec_op_param_t { /** Pointer to an array of packets * - * Each packet must have a valid value for these meta-data: + * Each packet must have a valid value for these metadata: * * L3 offset: Offset to the first byte of the (outmost) IP header * * L4 offset: For inbound direction, when udp_encap is enabled - * offset to the first byte of the encapsulating UDP @@ -740,6 +969,35 @@ typedef struct odp_ipsec_op_param_t { } odp_ipsec_op_param_t; /** + * Outbound inline IPSEC operation parameters + */ +typedef struct odp_ipsec_inline_op_param_t { + /** Packet output interface for inline output operation + * + * Outbound inline IPSEC operation uses this packet IO interface to + * output the packet after a successful IPSEC transformation. The pktio + * must have been configured to operate in inline IPSEC mode. + */ + odp_pktio_t pktio; + + /** Outer headers for inline output operation + * + * Outbound inline IPSEC operation uses this information to prepend + * outer headers to the IPSEC packet before sending it out. + */ + struct { + /** Points to first byte of outer headers to be copied in + * front of the outgoing IPSEC packet. Implementation copies + * the headers during odp_ipsec_out_inline() call. */ + uint8_t *ptr; + + /** Outer header length in bytes */ + uint32_t len; + } outer_hdr; + +} odp_ipsec_inline_op_param_t; + +/** * IPSEC operation result for a packet */ typedef struct odp_ipsec_packet_result_t { @@ -765,6 +1023,23 @@ typedef struct odp_ipsec_packet_result_t { */ odp_ipsec_sa_t sa; + /** Packet outer header status before inbound inline processing. + * This is valid only when status.flag.inline_mode is set. + */ + struct { + /** Points to the first byte of retained outer headers. These + * headers are stored in a contiquous, per packet, + * implementation specific memory space. Since the memory space + * may overlap with e.g. packet head/tailroom, the content + * becomes invalid if packet data storage is modified in + * anyway. The memory space may not be sharable to other + * threads. */ + uint8_t *ptr; + + /** Outer header length in bytes */ + uint32_t len; + } outer_hdr; + } odp_ipsec_packet_result_t; /** @@ -786,18 +1061,14 @@ typedef struct odp_ipsec_op_result_t { * at least 'num_pkt' elements. * * Each successfully transformed packet has a valid value for these - * meta-data: + * metadata regardless of the inner packet parse configuration. + * (odp_ipsec_inbound_config_t): * * L3 offset: Offset to the first byte of the (outmost) IP header - * * L4 offset: Offset to the first byte of the valid and known L4 - * header (immediately following the IP header). - * * Various flags about L3 and L4 layers: - * has_l3, has_l4, has_ipv4, has_ipv6, has_ipfrag, - * has_ipsec, has_udp, has_tcp, etc depending on - * the resulted packet format + * * pktio: For inbound inline IPSEC processed packets, original + * packet input interface * - * @see odp_packet_l3_offset(), odp_packet_l4_offset(), - * odp_packet_has_ipv4(), odp_packet_has_ipv6(), - * odp_packet_has_ipfrag(), odp_packet_has_ipsec() + * Other metadata for parse results and error checks depend on + * configuration (selected parse and error check levels). */ odp_packet_t *pkt; @@ -928,10 +1199,10 @@ int odp_ipsec_out(const odp_ipsec_op_param_t *input, /** * Inbound asynchronous IPSEC operation * - * This operation does inbound IPSEC processing in asynchronous mode - * (ODP_IPSEC_OP_MODE_ASYNC). It processes packets otherwise identically to - * odp_ipsec_in(), but outputs all results through one or more - * ODP_EVENT_IPSEC_RESULT events with the following ordering considerations. + * This operation does inbound IPSEC processing in asynchronous mode. It + * processes packets otherwise identically to odp_ipsec_in(), but outputs all + * results through one or more ODP_EVENT_IPSEC_RESULT events with the following + * ordering considerations. * * Asynchronous mode maintains (operation input) packet order per SA when * application calls the operation within an ordered or atomic scheduler context @@ -941,6 +1212,11 @@ int odp_ipsec_out(const odp_ipsec_op_param_t *input, * events for the same SA are enqueued in order, and packet handles (for the * same SA) are stored in order within an event. * + * The function may be used also in inline processing mode, e.g. for IPSEC + * packets for which inline processing is not possible. Packets for the same SA + * may be processed simultaneously in both modes (initiated by this function + * and inline operation). + * * @param input Operation input parameters * * @return Number of input packets consumed (0 ... input.num_pkt) @@ -953,10 +1229,10 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); /** * Outbound asynchronous IPSEC operation * - * This operation does outbound IPSEC processing in asynchronous mode - * (ODP_IPSEC_OP_MODE_ASYNC). It processes packets otherwise identically to - * odp_ipsec_out(), but outputs all results through one or more - * ODP_EVENT_IPSEC_RESULT events with the following ordering considerations. + * This operation does outbound IPSEC processing in asynchronous mode. It + * processes packets otherwise identically to odp_ipsec_out(), but outputs all + * results through one or more ODP_EVENT_IPSEC_RESULT events with the following + * ordering considerations. * * Asynchronous mode maintains (operation input) packet order per SA when * application calls the operation within an ordered or atomic scheduler context @@ -966,6 +1242,9 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); * events for the same SA are enqueued in order, and packet handles (for the * same SA) are stored in order within an event. * + * The function may be used also in inline processing mode, e.g. for IPSEC + * packets for which inline processing is not possible. + * * @param input Operation input parameters * * @return Number of input packets consumed (0 ... input.num_pkt) @@ -976,6 +1255,28 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); int odp_ipsec_out_enq(const odp_ipsec_op_param_t *input); /** + * Outbound inline IPSEC operation + * + * This operation does outbound inline IPSEC processing for the packets. It's + * otherwise identical to odp_ipsec_out_enq(), but outputs all successfully + * transformed packets to the specified output interface, instead of generating + * result events for those. + * + * Inline operation parameters are defined per packet. The array of parameters + * must have 'op_param.num_pkt' elements and is pointed to by 'inline_param'. + * + * @param op_param Operation parameters + * @param inline_param Outbound inline operation specific parameters + * + * @return Number of packets consumed (0 ... op_param.num_pkt) + * @retval <0 On failure + * + * @see odp_ipsec_out_enq() + */ +int odp_ipsec_out_inline(const odp_ipsec_op_param_t *op_param, + const odp_ipsec_inline_op_param_t *inline_param); + +/** * Get IPSEC results from an ODP_EVENT_IPSEC_RESULT event * * Copies IPSEC operation results from an event. The event must be of diff --git a/include/odp/api/spec/packet_io.h b/include/odp/api/spec/packet_io.h index cec1f22..8802089 100644 --- a/include/odp/api/spec/packet_io.h +++ b/include/odp/api/spec/packet_io.h @@ -407,6 +407,38 @@ typedef struct odp_pktio_config_t { * interface capability before enabling the same. */ odp_bool_t enable_loop; + /** Inbound IPSEC inlined with packet input + * + * Enable/disable inline inbound IPSEC operation. When enabled packet + * input directs all IPSEC packets automatically to IPSEC inbound + * processing. IPSEC configuration is done through the IPSEC API. + * Packets that are not (recognized as) IPSEC are processed + * according to the packet input configuration. + * + * 0: Disable inbound IPSEC inline operation (default) + * 1: Enable inbound IPSEC inline operation + * + * @see odp_ipsec_config(), odp_ipsec_sa_create() + */ + odp_bool_t inbound_ipsec; + + /** Outbound IPSEC inlined with packet output + * + * Enable/disable inline outbound IPSEC operation. When enabled IPSEC + * outbound processing can send outgoing IPSEC packets directly + * to the pktio interface for output. IPSEC configuration is done + * through the IPSEC API. + * + * Outbound IPSEC inline operation cannot be combined with traffic + * manager (ODP_PKTOUT_MODE_TM). + * + * 0: Disable outbound IPSEC inline operation (default) + * 1: Enable outbound IPSEC inline operation + * + * @see odp_ipsec_config(), odp_ipsec_sa_create() + */ + odp_bool_t outbound_ipsec; + } odp_pktio_config_t; /**