From patchwork Tue Mar 21 14:17:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Petri Savolainen X-Patchwork-Id: 95660 Delivered-To: patch@linaro.org Received: by 10.140.89.233 with SMTP id v96csp1546668qgd; Tue, 21 Mar 2017 10:15:05 -0700 (PDT) X-Received: by 10.107.53.88 with SMTP id c85mr9562236ioa.185.1490116505760; Tue, 21 Mar 2017 10:15:05 -0700 (PDT) Return-Path: Received: from lists.linaro.org (lists.linaro.org. [54.225.227.206]) by mx.google.com with ESMTP id u69si13197715itc.24.2017.03.21.10.15.05; Tue, 21 Mar 2017 10:15:05 -0700 (PDT) Received-SPF: pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) client-ip=54.225.227.206; Authentication-Results: mx.google.com; spf=pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) smtp.mailfrom=lng-odp-bounces@lists.linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: by lists.linaro.org (Postfix, from userid 109) id 3D0B1636C2; Tue, 21 Mar 2017 17:15:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on ip-10-142-244-252 X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAD_ENC_HEADER,BAYES_00, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,URIBL_BLOCKED autolearn=disabled version=3.4.0 Received: from [127.0.0.1] (localhost [127.0.0.1]) by lists.linaro.org (Postfix) with ESMTP id 34C58637A0; Tue, 21 Mar 2017 17:13:27 +0000 (UTC) X-Original-To: lng-odp@lists.linaro.org Delivered-To: lng-odp@lists.linaro.org Received: by lists.linaro.org (Postfix, from userid 109) id 0A0D6635AC; Tue, 21 Mar 2017 14:17:31 +0000 (UTC) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0117.outbound.protection.outlook.com [104.47.2.117]) by lists.linaro.org (Postfix) with ESMTPS id 9435662DA5 for ; Tue, 21 Mar 2017 14:17:28 +0000 (UTC) Received: from AM4PR0701CA0022.eurprd07.prod.outlook.com (10.165.102.32) by DB6PR0701MB2759.eurprd07.prod.outlook.com (10.169.215.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.961.8; Tue, 21 Mar 2017 14:17:27 +0000 Received: from VE1EUR03FT024.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e09::204) by AM4PR0701CA0022.outlook.office365.com (2603:10a6:200:42::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.991.4 via Frontend Transport; Tue, 21 Mar 2017 14:17:27 +0000 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning linaro.org discourages use of 131.228.2.36 as permitted sender) Received: from hybrid2.ext.net.nokia.com (131.228.2.36) by VE1EUR03FT024.mail.protection.outlook.com (10.152.18.87) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.7 via Frontend Transport; Tue, 21 Mar 2017 14:17:27 +0000 Received: from fihe3nok1346.nsn-intra.net (10.158.36.134) by fihe3nok1347.nsn-intra.net (10.158.36.135) with Microsoft SMTP Server (TLS) id 15.1.466.34; Tue, 21 Mar 2017 16:17:25 +0200 Received: from mailrelay.int.nokia.com (10.130.128.21) by fihe3nok1346.nsn-intra.net (10.158.36.134) with Microsoft SMTP Server (TLS) id 15.1.466.34 via Frontend Transport; Tue, 21 Mar 2017 16:17:25 +0200 Received: from fihe3nok0734.emea.nsn-net.net (localhost [127.0.0.1]) by fihe3nok0734.emea.nsn-net.net (8.14.9/8.14.5) with ESMTP id v2LEHDwo004609 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 21 Mar 2017 16:17:13 +0200 Received: from 10.144.19.15 ([10.144.104.219]) by fihe3nok0734.emea.nsn-net.net (8.14.9/8.14.5) with ESMTP id v2LEHDxV004603 (version=TLSv1/SSLv3 cipher=AES128-SHA256 bits=128 verify=NOT) for ; Tue, 21 Mar 2017 16:17:13 +0200 X-HPESVCS-Source-Ip: 10.144.104.219 From: Petri Savolainen To: Date: Tue, 21 Mar 2017 16:17:12 +0200 Message-ID: <1490105833-3990-2-git-send-email-petri.savolainen@linaro.org> X-Mailer: git-send-email 2.8.1 In-Reply-To: <1490105833-3990-1-git-send-email-petri.savolainen@linaro.org> References: <1490105833-3990-1-git-send-email-petri.savolainen@linaro.org> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:131.228.2.36; IPV:NLI; CTRY:FI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(39850400002)(39860400002)(39840400002)(39450400003)(39410400002)(2980300002)(9170700003)(2906002)(33646002)(50466002)(53936002)(22756006)(50986999)(5003940100001)(8936002)(189998001)(47776003)(76176999)(50226002)(2950100002)(38730400002)(6916009)(36756003)(356003)(48376002)(110136004)(77096006)(8676002)(305945005)(2351001)(5660300001)(86362001)(106466001)(81166006)(105596002)(217873001); DIR:OUT; SFP:1102; SCL:1; SRVR:DB6PR0701MB2759; H:hybrid2.ext.net.nokia.com; FPR:; SPF:SoftFail; MLV:sfv; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; VE1EUR03FT024; 1:qvym0Ea3Vxu5lIlQb+e9mTk/9lrg33gOZM4fRshGNaGphWKjiHVdHLnrQ6Iw09R3rMTZ4XcW757eDYko1A8rWTfx0q+gDbjicE0hNR6J9qTevvzrnyLsllqhmpu1/YMG5R3w4r5sDP+s8iPr2Td3tXGlw3bP6wv3jQtoZJIDsX+BK8UK0LiZty6G39+Ipg8MAJqICEzEz2GAy+83qP3V/Bj0PqvdASuyO1lQx7k0TwSJVyLhq1imJfCrc9rtRphnKrZ2jNwgU6iSuvQsDQd+ewWsJ29Z50LLnb3VUIeYhGQqyy3Q9rb3n2NbjTmsMaA4zlLZbTfNobqhpGG8/Gcw0wyP7y8AAFQ/czIR4CFnhrWnjCa2C28rQtR4D6sMxhuwArlU8P1j4WdXhQS7aO9i0szRT1Cy0SeFy93jLMtQcO+uu8n88I4ZuC6YTCMU6lfQCKl0FKgUv0myJSr/QFbQUBo/lQlgWMNKI/RmuDab9MI= X-MS-Office365-Filtering-Correlation-Id: 15d9f90e-a9a3-4454-3ae7-08d4706500c9 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075); SRVR:DB6PR0701MB2759; X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2759; 3:vRF31Ty4gAmwCY0FkR0PqmzNVQ3O0vnrJVjATyZ2BX9d1EzPe6VAP7QDQHDd+cxTSBfhoW9ZGafIldkMy7UH+h3G1UIgCzSexAnlACd3O3dUT4MEKx8uHrCu0j8cpJR/7DMNxRZJSHvM4bE4mnL7qc6r5eysJ97IdaOIunVsyrd8ZkHeofb3UcSvJCADddXjSs0ju6Uy5p3wYfiNtxCjPKLV72+0j4akeiO7XXE0JAFb8zkEAq4NOoYsEnELOJtFMJTs4Z+d6lHBNdt9s2c99Kw7Vk6psDoSoSQUOgbpVr4dp3lmQQo9lP61JzJJI/OVu0yjO5g8A6YquX/OvxLNmErk+0FNAntMEQMMBf7yE4iYxGA6WGttdr8vWzES5q5cESfbPvQNlLAzSI4CCwaegA==; 25:E3pf0qoetLIhgJZip0AohZsb0wECFO/BH74wUzi3dRKBPIsVKQfhZnx5DMVNqGv+DWRC1+irEpCMAnDoR5gCtFh+E4DQ2UhW1RQ47p5UhCcNSGYXrhZqRFXm4WiuAPY3nIPeVb4L/8yvzgZkvUHbfmxBqyWQMmqaPczfc3FyLQnGfcNuHWY99yZWAsegO3Dk915D52Km5sQW5oS0YdhiW4RwQUEpMdINhIAebN1GmT2rQQbR44ToQCYpeRPfPPZeuYwdgN72Iquvj/Y797KAa512ztyF7VZFsiAisUG/XAeAqpmStrC7sEnRhqNs6kUG3K5F9REgHzjPEVjDaLp8ZxN6euj2+HqSuJ7AHgJPXSJIWgm0Sz9vPf0PzIDmr5bS3DlYi1enS31Lrb5GecXfSXMyYaaxh7K7XI/RGdz5iKmOVuHxeS5/BvhSxdQ7Ole7jgEnjc/mRj9IzfY2QLdbtg== X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2759; 31:Co/s7Z4ymxyPZjc0b/21ytBTFsVqIvnZI/jYzRhQD5bSYnx74JCF35qMTU0p9pURmv9Xuj5zRnM0knabrPaOpdLCwfxnwnVFEACx6kaP53gw/IaZJjl62YEBL9RjgYuz3p+qv9Rjd4Wcku/bdqT4qPC1r/s8HZMWkhEkdHHM9d+SnrHmHesT7D7FolExZJZQ0v43qkism6BNevJJBdISUl2Wuj+d8rWGB9/oPjmzh+CaxAKqR9Ks93CliAs6tzJybdLUX6qM5FK6R6t07TAH6g==; 20:OOk4fKAIq0vJRs3PntVGSMDPmWeH2Y0eJA6weufJVa0Ku6PgIkIpCgTN9XCyrnAWVpIHMjBBXojj1/dO9FUkaj0tstnLJa9NtalxErI7SRircHcmExDFLGKTPVkz9Cs9hX0aKlegm3e6LmYsXHAfhU8Bf/e7vMe2Q6mFr2SQEsTeL3oPRT55lmwXihvCc5mWqzXN705Q99KAQ61lz2gUgcTzvVLdg4bm7Tu5iDD+fqCv8RHrbt78156PNXYEUu5uNZfgiuy7vSRLwL19yqLCKQkzM5pVeAQQAzdnqgVIJ+vKM2Ih1Abal+MABGjDuEVXmH1+bWx6ySG9I7ZwkR69+Sc4lK4PKHFqC5S3s8JAu+76lt9WtFzVhrL2su9c+MZKvyciBMULUI3Zm1peaSceQ1rvIGUc2p4fUYsogx4fjT9pVmafrimMswI/hw2CNZyZp7ekYCKH/NuxCSthqYUCGWpk7S9Lpz3D62/lXYZppcmAzCxLJ28OUFCFudSC2/G+HM3XiQPx+k/KqTa/YyHsI6PMKGjAVbKUfxvqdgk7X1R2uvWpLvOhW9HJ2BqvdWF8jqx2tRSzNODYQFOODJi7I42O8nOmMJ0F/SpuowAymrs= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(131327999870524); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(13016025)(13018025)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123562025)(20161123558025)(20161123564025)(20161123560025)(20161123555025)(6072148); SRVR:DB6PR0701MB2759; BCL:0; PCL:0; RULEID:; SRVR:DB6PR0701MB2759; X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2759; 4:oODuwVo1Kh3oAd7ptuEQXx8rRxPs5dGYt0r6tPPAhmVUgXIHrIHp+0DLI3fsBPfZKxZlgm1pYg0q7eMSTN61Uk0XF7Dl7ia19ftQ0026ulQRXmVsm4mE/8CLNxujt5fwbhYdhXAGj4wFO8fc6ev+kHP/uEbyLwXit/2U7kb3wNtsUtBhSqTQBks3o69YAHJszy5kB7fU7gwvsyjFSOrOneU6mjWl3SztP3LJ08Lp7RWUkOb1s9+wBoCMOK3kGnLF3373voKPXkQSgbJuNNdn2aTQAUZaPKkzAi8jUrPxi+wyW01ZnLWOc9d2A1QUK0Dc7XPPseE2lqJ6yynuRkQ2OCv5TmtetwIgsaZJu0HI/oy39KQtVT8BKvhWGw5cDjCEfchW9zA2nL9gbO9bX9LT/cl5ZBzjicRPQTjiMo2sjFy/U3wdwbh6KvdCXWH+c2fL/K+2V3qUEGA/vQ0aIh+TMK/CjMcIs12Sw0ZDj9sJy8lb7LwRVOUJ70HdQ3nAqxGJhZ1ocBqG9s2C5LGQyoj6xCyMDty5BTp3JTvc90vuyNPL3ALYVmycimXXcLvhEhj6ZbuS0yQmSREYEPzsZLCeZaTUXXcaeimlsbxfSpjtIWWAOyQB8ijYZ4ZZeVFw8XkYkQWJCk3IFnRtkFsfnuSTLaTIHR2ycCpbt4FW+szqL7u1PpQWU4dGyN+5D+PfYW3SHiUeMFyD2M74ErR3z1yYJbRbCPja7biOhaUuVMYw7v71+pMlJjHrDCX+wRl0IN6F X-Forefront-PRVS: 02530BD3AA X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; DB6PR0701MB2759; 23:koUHbjXAtYftsGI1UkGcBuYDrG8Bvg44TBsInRx?= fha7mUDM3UqaN04OfBwd7OzcmNT5OrrRMbZosUKzxgse6MitO3lnGSmpz4CZje4yo5RKqXg2XWisQL9vua1wYQu4U3xrwAU9NbwDBOdxfyvM7SJjNxSmpoSG15C0+3L9Bq2f25ps2wakkaRSUo18G4bju45MCWNqROBoGHHUCHcIJQXiiUtnsTBbzcj2tAEIWNEV38Y3GinWb9uigsB5DUoetyP2JH3Bo7ICFGWm+GByRK9ufhG7dP9raJXsR+yN3rE+O3FIi9cnuKY8yerlmAwiSi1EVkd2vr0OrKyvvAauzK+jXC+Ec9GAey1BnDGMAxaQ1z2yKZJBWwZ/fwVDb362x8dB7b+zIJhRx41Ju91wce4ww4JK0un8CIEsitML1Njfd+f+d1XSyGhMmepHvttJn1rIe66k1K9KLU+TJglpAyTFzBG+gO/tcPFaw7Z4Wy7Onb5OFhGonoTqvjh4HXuEWilM3uma6V1KxkDWUeU4INo+VdIhmBs2pvQv4zLJ7DrENhpNGRGxUiE8oB8T+gUZT802Ef/Z4kpp76r8ifhlJgVBQswG2/9W05+SjQfH+KlVxTEH0NkE50/6ECmXD6CyBBcHHRs52XhNAtsj45Fn+cAsmh6hNnWqMhbkB6Iihsfu4TL+vegOU8jOeFow6v3JkIx2ZPjuBprpq6j/Dpl/HRPVuyYx3Vl6OBoroW+Zd6r9JstivhmP10c8iQoPsy4QRVYxPD1sM9CxldVm35/Lhu7zoBY5Y0CLv/Cs7SL7z23sNJXheGERC2ASrlD34Z/cHbfnIYhc+A5IR9rFMmbjCmc6dPJTbSfih7n6b7xFG3gf8sCMY5UATa1aaf87+31W8q6IjnDmvXaBE6/SkJsGIeZ8VeoKsrt/MRXr355+56737dqccFoi3D2xmmZV+izqpRKkXvXA5XBrkQzI66vxjMg== X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2759; 6:wLNSqQ5Kc5OyaKowQel1RGvCytSegDrF3s5jwVY6nTswknoYmUnJLCTnXOQ0/315oDfyCFvCh8Ipf7r069r/+fTfLX/Cg/9dz66ivwGfGdofSUn7Pe4p2AxGP7ST8+4zbSotNSBd2C9BRS9a2OwCRImnmUXfzafYDM+GLU95gpJHR8pfe1UGTWUqjcF5hJuMkH4ETKrMBkonojTwcNS+MLQr7ydJ7Z8LTXEpPHbsMiDHzr6UqDp+xGR1Q9/EJd/THoRO7+ODtJ0xXdBfP3ZBDpI9TxWIn/G99qn+JroJKJpxzBITQl/MT+O4ouxlP2ghhHCEOG8yk/NRmZ95tjqDmuAhFkxRiUQ1tJpSAzTb7lFCfAMWJvCqb9KVd9DK+WyeKDdpAdwP8fvCCmSPEHpz6agZLeElQJm5DEzzfBRpfO8=; 5:+CZCL9sTnVaovSKRFIuMD4/+YEveD9n9u4A8hEzTtfZ52y6MGR1xqNNY7zGCkrDFS0ddYk0J8yZzBZC6mrbXJBVqIpULq9IHqCOCWJxUs2vn/O4JKHStAiW3hFL1s/dg2irWL3bY9oQ5qne28D21kw==; 24:ZtkMU0c55V4gat4EHbDO57MPGPpLMejLPvbHhascwyj8A3KjnVitq8V13iVVE6+EvNumHP+Dtwaoy++1cGMEdh7VGzL7u/WHoTPR0dGMxtc= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; DB6PR0701MB2759; 7:/o9IC1aBaxiSa+28Fqb2h705fBWuPN/gkLPS+EXws1GIquxdZrF8uLgono6r5YM3ZKbt8cBoCdVI2x/6xQ7UYjeaTqVQv4wO34BGd3/pIG/ZkjL5mjK8/77Nce9DebCza9RQIp9BWz0p/0pP77UMrOP8/g2k7NJ4PXhRyic8nqjM6ptoBuDInu1vkehufZwDt2R/NQxY7ob+o2d2JnGCbPLUKVQRAJ+eImcPpAqn08FpIeDTT4ryDqgERfvKOj5huwEhv3WW6WeC5vH8t88qh9qcsxjO/sN++2Iew0cXTHo5khNg6AWPEtyYN07ZYl1NyRxQS7qhQJwSJLvicvn29g== X-OriginatorOrg: nokia.onmicrosoft.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Mar 2017 14:17:27.2340 (UTC) X-MS-Exchange-CrossTenant-Id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5d471751-9675-428d-917b-70f44f9630b0; Ip=[131.228.2.36]; Helo=[hybrid2.ext.net.nokia.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0701MB2759 Subject: [lng-odp] [API-NEXT PATCH v2 2/3] api: ipsec: add inline IPSEC support X-BeenThere: lng-odp@lists.linaro.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: "The OpenDataPlane \(ODP\) List" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: lng-odp-bounces@lists.linaro.org Sender: "lng-odp" Added support for inline IPSEC processing on packet input and output. Inline mode IPSEC and traffic manager cannot be enabled (currently) on the same pktio interface. Signed-off-by: Petri Savolainen --- include/odp/api/spec/ipsec.h | 348 ++++++++++++++++++++++++++++++++++++--- include/odp/api/spec/packet_io.h | 32 ++++ 2 files changed, 355 insertions(+), 25 deletions(-) -- 2.8.1 Signed-off-by: Petri Savolainen diff --git a/include/odp/api/spec/ipsec.h b/include/odp/api/spec/ipsec.h index e951e49..23d02cf 100644 --- a/include/odp/api/spec/ipsec.h +++ b/include/odp/api/spec/ipsec.h @@ -19,6 +19,8 @@ extern "C" { #endif #include +#include +#include /** @defgroup odp_ipsec ODP IPSEC * Operations of IPSEC API. @@ -51,11 +53,43 @@ typedef enum odp_ipsec_op_mode_t { * Application uses asynchronous IPSEC operations, * which return results via events. */ - ODP_IPSEC_OP_MODE_ASYNC + ODP_IPSEC_OP_MODE_ASYNC, + + /** Inline IPSEC operation + * + * Packet input/output is connected directly to IPSEC inbound/outbound + * processing. Application uses asynchronous or inline IPSEC + * operations. + */ + ODP_IPSEC_OP_MODE_INLINE, + + /** IPSEC is disabled in inbound / outbound direction */ + ODP_IPSEC_OP_MODE_DISABLED } odp_ipsec_op_mode_t; /** + * Protocol layers in IPSEC configuration + */ +typedef enum odp_ipsec_proto_layer_t { + /** No layers */ + ODP_IPSEC_LAYER_NONE = 0, + + /** Layer L2 protocols (Ethernet, VLAN, etc) */ + ODP_IPSEC_LAYER_L2, + + /** Layer L3 protocols (IPv4, IPv6, ICMP, IPSec, etc) */ + ODP_IPSEC_LAYER_L3, + + /** Layer L4 protocols (UDP, TCP, SCTP) */ + ODP_IPSEC_LAYER_L4, + + /** All layers */ + ODP_IPSEC_LAYER_ALL + +} odp_ipsec_proto_layer_t; + +/** * Configuration options for IPSEC inbound processing */ typedef struct odp_ipsec_inbound_config_t { @@ -77,9 +111,113 @@ typedef struct odp_ipsec_inbound_config_t { uint32_t max; } spi; + /** Retain outer headers + * + * Select up to which protocol layer (at least) outer headers are + * retained in inbound inline processing. Default value is + * ODP_IPSEC_LAYER_NONE. + * + * ODP_IPSEC_LAYER_NONE: Application does not require any outer + * headers to be retained. + * + * ODP_IPSEC_LAYER_L2: Retain headers up to layer 2. + * + * ODP_IPSEC_LAYER_L3: Retain headers up to layer 3, otherwise the + * same as ODP_IPSEC_LAYER_ALL. + * + * ODP_IPSEC_LAYER_L4: Retain headers up to layer 4, otherwise the + * same as ODP_IPSEC_LAYER_ALL. + * + * ODP_IPSEC_LAYER_ALL: In tunnel mode, all headers before IPSEC are + * retained. In transport mode, all headers + * before IP (carrying IPSEC) are retained. + * + */ + odp_ipsec_proto_layer_t retain_outer; + + /** Parse packet headers in IPSEC payload + * + * Select header parsing level after inbound processing. Packet headers + * in IPSEC payload must be parsed (at least) up to this level. + * Default value is ODP_IPSEC_LAYER_NONE. + * + * Note that IPSec payload is never a L2 packet (ODP_IPSEC_LAYER_L2 + * equals ODP_IPSEC_LAYER_NONE). In transport mode, IPSEC payload + * starts after IP header (ODP_IPSEC_LAYER_L3 equals + * ODP_IPSEC_LAYER_NONE). + */ + odp_ipsec_proto_layer_t parse; + + /** Flags to control IPSEC payload data checks up to the selected parse + * level. */ + union { + struct { + /** Check IPv4 header checksum in IPSEC payload. + * Default value is 0. */ + uint32_t ipv4_chksum : 1; + + /** Check UDP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t udp_chksum : 1; + + /** Check TCP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t tcp_chksum : 1; + + /** Check SCTP checksum in IPSEC payload. + * Default value is 0. */ + uint32_t sctp_chksum : 1; + } check; + + /** All bits of the bit field structure + * + * This field can be used to set/clear all flags, or bitwise + * operations over the entire structure. */ + uint32_t all_check; + }; + } odp_ipsec_inbound_config_t; /** + * Configuration options for IPSEC outbound processing + */ +typedef struct odp_ipsec_outbound_config_t { + /** Flags to control L3/L4 checksum insertion as part of outbound + * packet processing. Packet must have set with valid L3/L4 offsets. + * Checksum configuration is ignored for packets that checksum cannot + * be computed for (e.g. IPv4 fragments). Application may use a packet + * metadata flag to disable checksum insertion per packet bases. + */ + union { + struct { + /** Insert IPv4 header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_ipv4 : 1; + + /** Insert UDP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_udp : 1; + + /** Insert TCP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_tcp : 1; + + /** Insert SCTP header checksum on the payload packet + * before IPSEC transformation. Default value is 0. */ + uint32_t inner_sctp : 1; + + } chksum; + + /** All bits of the bit field structure + * + * This field can be used to set/clear all flags, or bitwise + * operations over the entire structure. */ + uint32_t all_chksum; + }; + +} odp_ipsec_outbound_config_t; + +/** * IPSEC capability */ typedef struct odp_ipsec_capability_t { @@ -102,6 +240,24 @@ typedef struct odp_ipsec_capability_t { */ uint8_t op_mode_async; + /** Inline IPSEC operation mode (ODP_IPSEC_OP_MODE_INLINE) support + * + * 0: Inline IPSEC operation is not supported + * 1: Inline IPSEC operation is supported + * 2: Inline IPSEC operation is supported and preferred + */ + uint8_t op_mode_inline; + + /** Support of inline classification (ODP_IPSEC_DEST_CLS) for resulting + * inbound packets. + * + * 0: Inline classification of resulting packets is not supported + * 1: Inline classification of resulting packets is supported + * 2: Inline classification of resulting packets is supported and + * preferred + */ + uint8_t cls_inline; + /** Soft expiry limit in seconds support * * 0: Limit is not supported @@ -128,12 +284,19 @@ typedef struct odp_ipsec_capability_t { * IPSEC configuration options */ typedef struct odp_ipsec_config_t { - /** IPSEC operation mode. Application selects which mode (sync or async) - * will be used for IPSEC operations. + /** Inbound IPSEC operation mode. Application selects which mode + * will be used for inbound IPSEC operations. * * @see odp_ipsec_in(), odp_ipsec_in_enq() */ - odp_ipsec_op_mode_t op_mode; + odp_ipsec_op_mode_t inbound_mode; + + /** Outbound IPSEC operation mode. Application selects which mode + * will be used for outbound IPSEC operations. + * + * @see odp_ipsec_out(), odp_ipsec_out_enq(), odp_ipsec_out_inline() + */ + odp_ipsec_op_mode_t outbound_mode; /** Maximum number of IPSEC SAs that application will use * simultaneously */ @@ -142,6 +305,9 @@ typedef struct odp_ipsec_config_t { /** IPSEC inbound processing configuration */ odp_ipsec_inbound_config_t inbound; + /** IPSEC outbound processing configuration */ + odp_ipsec_outbound_config_t outbound; + } odp_ipsec_config_t; /** @@ -381,11 +547,29 @@ typedef enum odp_ipsec_lookup_mode_t { ODP_IPSEC_LOOKUP_DISABLED = 0, /** Inbound SA lookup is enabled. Used SPI values must be unique. */ - ODP_IPSEC_LOOKUP_IN_UNIQUE_SA + ODP_IPSEC_LOOKUP_IN_UNIQUE_SPI, + + /** Inbound SA lookup is enabled. Lookup matches both SPI and + * destination IP address. Used SPI values must be unique. */ + ODP_IPSEC_LOOKUP_IN_DSTADDR_UNIQUE_SPI } odp_ipsec_lookup_mode_t; /** + * Result event destination + */ +typedef enum odp_ipsec_dest_mode_t { + /** Destination for IPSEC result events is a queue. */ + ODP_IPSEC_DEST_QUEUE = 0, + + /** Destination for IPSEC result events is the classifier. + * IPSEC capability 'cls_inline' determines if inline classification + * is supported. */ + ODP_IPSEC_DEST_CLS + +} odp_ipsec_dest_mode_t; + +/** * IPSEC Security Association (SA) parameters */ typedef struct odp_ipsec_sa_param_t { @@ -426,6 +610,17 @@ typedef struct odp_ipsec_sa_param_t { /** SPI value */ uint32_t spi; + /** Additional inbound SA lookup parameters. Values are considered + * only in ODP_IPSEC_LOOKUP_IN_DSTADDR_UNIQUE_SPI lookup mode. */ + struct { + /* v4 or v6 */ + uint8_t ip_version; + + /* IP destination address (NETWORK ENDIAN) */ + void *dst_addr; + + } lookup_param; + /** MTU for outbound IP fragmentation offload * * This is the maximum length of IP packets that outbound IPSEC @@ -434,13 +629,32 @@ typedef struct odp_ipsec_sa_param_t { */ uint32_t mtu; + /** Select where IPSEC result events are sent + * + * Asynchronous and inline modes generate result events. Select where + * those events are sent. Inbound SAs may choose between a queue or + * the classifier. Outbound SAs must define a queue always. + * The default value is ODP_IPSEC_DEST_QUEUE. + */ + odp_ipsec_dest_mode_t dest_mode; + /** Destination queue for IPSEC events * - * Operations in asynchronous mode enqueue resulting events into - * this queue. + * Operations in asynchronous or inline mode enqueue resulting events + * into this queue. */ odp_queue_t dest_queue; + /** Classifier destination CoS for IPSEC result events + * + * Result events for successfully decapsulated packets are sent to + * classification through this CoS. Other result events are sent to + * 'dest_queue'. This field is considered only when 'dest_mode' is + * ODP_IPSEC_DEST_CLS. The CoS must not be shared between any pktio + * interface default CoS. + */ + odp_cos_t dest_cos; + /** User defined SA context pointer * * User defined context pointer associated with the SA. @@ -673,6 +887,18 @@ typedef struct odp_ipsec_op_status_t { uint32_t all_error; }; + union { + /** Status flags */ + struct { + /** Packet was processed in inline mode */ + uint32_t inline_mode : 1; + + } flag; + + /** All flag bits */ + uint32_t all_flag; + }; + } odp_ipsec_op_status_t; /** @@ -727,6 +953,35 @@ typedef struct odp_ipsec_op_param_t { } odp_ipsec_op_param_t; /** + * Outbound inline IPSEC operation parameters + */ +typedef struct odp_ipsec_inline_op_param_t { + /** Packet output interface for inline output operation + * + * Outbound inline IPSEC operation uses this packet IO interface to + * output the packet after a successful IPSEC transformation. The pktio + * must have been configured to operate in inline IPSEC mode. + */ + odp_pktio_t pktio; + + /** Outer headers for inline output operation + * + * Outbound inline IPSEC operation uses this information to prepend + * outer headers to the IPSEC packet before sending it out. + */ + struct { + /** Points to first byte of outer headers to be copied in + * front of the outgoing IPSEC packet. Implementation copies + * the headers during odp_ipsec_out_inline() call. */ + uint8_t *ptr; + + /** Outer header length in bytes */ + uint32_t len; + } outer_hdr; + +} odp_ipsec_inline_op_param_t; + +/** * IPSEC operation result for a packet */ typedef struct odp_ipsec_packet_result_t { @@ -752,6 +1007,23 @@ typedef struct odp_ipsec_packet_result_t { */ odp_ipsec_sa_t sa; + /** Packet outer header status before inbound inline processing. + * This is valid only when status.flag.inline_mode is set. + */ + struct { + /** Points to the first byte of retained outer headers. These + * headers are stored in a contiquous, per packet, + * implementation specific memory space. Since the memory space + * may overlap with e.g. packet head/tailroom, the content + * becomes invalid if packet data storage is modified in + * anyway. The memory space may not be sharable to other + * threads. */ + uint8_t *ptr; + + /** Outer header length in bytes */ + uint32_t len; + } outer_hdr; + } odp_ipsec_packet_result_t; /** @@ -773,18 +1045,14 @@ typedef struct odp_ipsec_op_result_t { * at least 'num_pkt' elements. * * Each successfully transformed packet has a valid value for these - * meta-data: + * meta-data regardless of the inner packet parse configuration. + * (odp_ipsec_inbound_config_t): * * L3 offset: Offset to the first byte of the (outmost) IP header - * * L4 offset: Offset to the first byte of the valid and known L4 - * header (immediately following the IP header). - * * Various flags about L3 and L4 layers: - * has_l3, has_l4, has_ipv4, has_ipv6, has_ipfrag, - * has_ipsec, has_udp, has_tcp, etc depending on - * the resulted packet format + * * pktio: For inbound inline IPSEC processed packets, original + * packet input interface * - * @see odp_packet_l3_offset(), odp_packet_l4_offset(), - * odp_packet_has_ipv4(), odp_packet_has_ipv6(), - * odp_packet_has_ipfrag(), odp_packet_has_ipsec() + * Other meta-data for parse results and error checks depend on + * configuration (selected parse and error check levels). */ odp_packet_t *pkt; @@ -915,10 +1183,10 @@ int odp_ipsec_out(const odp_ipsec_op_param_t *input, /** * Inbound asynchronous IPSEC operation * - * This operation does inbound IPSEC processing in asynchronous mode - * (ODP_IPSEC_OP_MODE_ASYNC). It processes packets otherwise identically to - * odp_ipsec_in(), but outputs all results through one or more - * ODP_EVENT_IPSEC_RESULT events with the following ordering considerations. + * This operation does inbound IPSEC processing in asynchronous mode. It + * processes packets otherwise identically to odp_ipsec_in(), but outputs all + * results through one or more ODP_EVENT_IPSEC_RESULT events with the following + * ordering considerations. * * Asynchronous mode maintains (operation input) packet order per SA when * application calls the operation within an ordered or atomic scheduler context @@ -928,6 +1196,11 @@ int odp_ipsec_out(const odp_ipsec_op_param_t *input, * events for the same SA are enqueued in order, and packet handles (for the * same SA) are stored in order within an event. * + * The function may be used also in inline processing mode, e.g. for IPSEC + * packets for which inline processing is not possible. Packets for the same SA + * may be processed simultaneously in both modes (initiated by this function + * and inline operation). + * * @param input Operation input parameters * * @return Number of input packets consumed (0 ... input.num_pkt) @@ -940,10 +1213,10 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); /** * Outbound asynchronous IPSEC operation * - * This operation does outbound IPSEC processing in asynchronous mode - * (ODP_IPSEC_OP_MODE_ASYNC). It processes packets otherwise identically to - * odp_ipsec_out(), but outputs all results through one or more - * ODP_EVENT_IPSEC_RESULT events with the following ordering considerations. + * This operation does outbound IPSEC processing in asynchronous mode. It + * processes packets otherwise identically to odp_ipsec_out(), but outputs all + * results through one or more ODP_EVENT_IPSEC_RESULT events with the following + * ordering considerations. * * Asynchronous mode maintains (operation input) packet order per SA when * application calls the operation within an ordered or atomic scheduler context @@ -953,6 +1226,9 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); * events for the same SA are enqueued in order, and packet handles (for the * same SA) are stored in order within an event. * + * The function may be used also in inline processing mode, e.g. for IPSEC + * packets for which inline processing is not possible. + * * @param input Operation input parameters * * @return Number of input packets consumed (0 ... input.num_pkt) @@ -963,6 +1239,28 @@ int odp_ipsec_in_enq(const odp_ipsec_op_param_t *input); int odp_ipsec_out_enq(const odp_ipsec_op_param_t *input); /** + * Outbound inline IPSEC operation + * + * This operation does outbound inline IPSEC processing for the packets. It's + * otherwise identical to odp_ipsec_out_enq(), but outputs all successfully + * transformed packets to the specified output interface, instead of generating + * result events for those. + * + * Inline operation parameters are defined per packet. The array of parameters + * must have 'op_param.num_pkt' elements and is pointed to by 'inline_param'. + * + * @param op_param Operation parameters + * @param inline_param Outbound inline operation specific parameters + * + * @return Number of packets consumed (0 ... op_param.num_pkt) + * @retval <0 On failure + * + * @see odp_ipsec_out_enq() + */ +int odp_ipsec_out_inline(const odp_ipsec_op_param_t *op_param, + const odp_ipsec_inline_op_param_t *inline_param); + +/** * Get IPSEC results from an ODP_EVENT_IPSEC_RESULT event * * Copies IPSEC operation results from an event. The event must be of diff --git a/include/odp/api/spec/packet_io.h b/include/odp/api/spec/packet_io.h index cec1f22..8802089 100644 --- a/include/odp/api/spec/packet_io.h +++ b/include/odp/api/spec/packet_io.h @@ -407,6 +407,38 @@ typedef struct odp_pktio_config_t { * interface capability before enabling the same. */ odp_bool_t enable_loop; + /** Inbound IPSEC inlined with packet input + * + * Enable/disable inline inbound IPSEC operation. When enabled packet + * input directs all IPSEC packets automatically to IPSEC inbound + * processing. IPSEC configuration is done through the IPSEC API. + * Packets that are not (recognized as) IPSEC are processed + * according to the packet input configuration. + * + * 0: Disable inbound IPSEC inline operation (default) + * 1: Enable inbound IPSEC inline operation + * + * @see odp_ipsec_config(), odp_ipsec_sa_create() + */ + odp_bool_t inbound_ipsec; + + /** Outbound IPSEC inlined with packet output + * + * Enable/disable inline outbound IPSEC operation. When enabled IPSEC + * outbound processing can send outgoing IPSEC packets directly + * to the pktio interface for output. IPSEC configuration is done + * through the IPSEC API. + * + * Outbound IPSEC inline operation cannot be combined with traffic + * manager (ODP_PKTOUT_MODE_TM). + * + * 0: Disable outbound IPSEC inline operation (default) + * 1: Enable outbound IPSEC inline operation + * + * @see odp_ipsec_config(), odp_ipsec_sa_create() + */ + odp_bool_t outbound_ipsec; + } odp_pktio_config_t; /**