From patchwork Tue Aug 1 07:00:17 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Github ODP bot X-Patchwork-Id: 109109 Delivered-To: patch@linaro.org Received: by 10.182.45.195 with SMTP id p3csp4594298obm; Tue, 1 Aug 2017 00:11:49 -0700 (PDT) X-Received: by 10.55.17.104 with SMTP id b101mr22495251qkh.278.1501571509815; Tue, 01 Aug 2017 00:11:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1501571509; cv=none; d=google.com; s=arc-20160816; b=fFQ1c8uH8wfNB4OETrD3Q3sC3Vor6A9dczVNzzYF5Pdo6c4U6JwsHTd9k8FHWFG93g V8HV7GJXj6TjOqSZWgzY5phZylJTgNZRcJ6Lngxwm+CAWp/Sl/8+3J70hJVVLeGFgunS wceN9+4uRVWn5D9LCuPo53kxif20ryhu29I5G+pjNIB+j3ke3fFt+Wo+fv3MHhO+YeLS LcZL+eXh1npEeHy+VH597CgdlTHj4FTT60+t1nCy2Ka+ehIWHcpi8f1HL8pUs3iw0WpG F3S7elV8jO5pnGxNX4EvXMQSz83V9tE70Mhp6dTVmkC5uBfbM0ZSsJ0OCsfLXciMfnsM kGYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject:github-pr-num :references:in-reply-to:message-id:date:to:from:delivered-to :arc-authentication-results; bh=JZjfpe/8C5i1nU2SnEus0cRQoMNUHXfmIhB0e06ozhM=; b=QQ5VAT3G7Jxz3+Pm1sp/bwHWRef49kozIw889yGOEXkx/N/X9ruK3sgs2/K03Y9JtV rNTVnXU+uQI1pM6qIWPaPbVAExD4r4mxoUCU5y5kIoBlWV7BkeXaoXEQSixNFAXBdCCo IEM8j1s/0F/J8xEGI7W2atxrOtT7PExyHFKcX8TtHrimHxZBYiaMf5837Gf7lAl5XsCl vvp0crZD3i7O4GNzRpqpAslee8hITYfpRIllfVHdCzniU0NRCt7ri0SOyitR8Xho6hIH +/B3qKcZ6CMgbt+UcM0TVsMY9nnSgXTLuJc15gzBGfhPEwuBzZH3BNYPz9+gmx1J0hxz dyzw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) smtp.mailfrom=lng-odp-bounces@lists.linaro.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=yandex.ru Return-Path: Received: from lists.linaro.org (lists.linaro.org. [54.225.227.206]) by mx.google.com with ESMTP id 145si24271529qkl.378.2017.08.01.00.11.49; Tue, 01 Aug 2017 00:11:49 -0700 (PDT) Received-SPF: pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) client-ip=54.225.227.206; Authentication-Results: mx.google.com; spf=pass (google.com: domain of lng-odp-bounces@lists.linaro.org designates 54.225.227.206 as permitted sender) smtp.mailfrom=lng-odp-bounces@lists.linaro.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=yandex.ru Received: by lists.linaro.org (Postfix, from userid 109) id 6B93065D3A; Tue, 1 Aug 2017 07:11:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on ip-10-142-244-252 X-Spam-Level: X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,FREEMAIL_FROM, RCVD_IN_DNSWL_LOW,URIBL_BLOCKED autolearn=disabled version=3.4.0 Received: from [127.0.0.1] (localhost [127.0.0.1]) by lists.linaro.org (Postfix) with ESMTP id F2AD865D4B; Tue, 1 Aug 2017 07:02:33 +0000 (UTC) X-Original-To: lng-odp@lists.linaro.org Delivered-To: lng-odp@lists.linaro.org Received: by lists.linaro.org (Postfix, from userid 109) id 09A2865D3D; Tue, 1 Aug 2017 07:01:58 +0000 (UTC) Received: from forward15o.cmail.yandex.net (forward15o.cmail.yandex.net [37.9.109.212]) by lists.linaro.org (Postfix) with ESMTPS id C695F65D37 for ; Tue, 1 Aug 2017 07:01:38 +0000 (UTC) Received: from smtp1p.mail.yandex.net (smtp1p.mail.yandex.net [IPv6:2a02:6b8:0:1472:2741:0:8b6:6]) by forward15o.cmail.yandex.net (Yandex) with ESMTP id 3C51F20F84 for ; Tue, 1 Aug 2017 10:01:37 +0300 (MSK) Received: from smtp1p.mail.yandex.net (localhost.localdomain [127.0.0.1]) by smtp1p.mail.yandex.net (Yandex) with ESMTP id 44EC31780F9D for ; Tue, 1 Aug 2017 10:00:40 +0300 (MSK) Received: by smtp1p.mail.yandex.net (nwsmtp/Yandex) with ESMTPSA id Ca8Lni7XUb-0dYShXSV; Tue, 01 Aug 2017 10:00:39 +0300 (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (Client certificate not present) X-Yandex-Suid-Status: 1 0 From: Github ODP bot To: lng-odp@lists.linaro.org Date: Tue, 1 Aug 2017 10:00:17 +0300 Message-Id: <1501570817-9260-9-git-send-email-odpbot@yandex.ru> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1501570817-9260-1-git-send-email-odpbot@yandex.ru> References: <1501570817-9260-1-git-send-email-odpbot@yandex.ru> Github-pr-num: 81 Subject: [lng-odp] [PATCH API-NEXT v11 8/8] linux-generic: ipsec: draft IPsec implementation X-BeenThere: lng-odp@lists.linaro.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: "The OpenDataPlane \(ODP\) List" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: lng-odp-bounces@lists.linaro.org Sender: "lng-odp" From: Dmitry Eremin-Solenikov For now it's only a preview with the following limitation: - Only IPv4 support - No pipeline_cls and outer header retaining support - No zeroing of mutable IPv4 options for AH ICV calculation - No replay protection - No ESN support - No UDP encapsulation support Signed-off-by: Dmitry Eremin-Solenikov --- /** Email created from pull request 81 (lumag:ipsec-packet-impl-2) ** https://github.com/Linaro/odp/pull/81 ** Patch: https://github.com/Linaro/odp/pull/81.patch ** Base sha: c16f1363303cd5fc11324acbc4dfebe0a9680a41 ** Merge commit sha: 38d17798a2db32c26fbd413245d59dde8e3011d9 **/ .../linux-generic/include/odp_ipsec_internal.h | 7 + .../linux-generic/include/odp_packet_internal.h | 4 + platform/linux-generic/odp_ipsec.c | 1178 +++++++++++++++++++- 3 files changed, 1140 insertions(+), 49 deletions(-) diff --git a/platform/linux-generic/include/odp_ipsec_internal.h b/platform/linux-generic/include/odp_ipsec_internal.h index 64ef8ab7..74085c95 100644 --- a/platform/linux-generic/include/odp_ipsec_internal.h +++ b/platform/linux-generic/include/odp_ipsec_internal.h @@ -183,6 +183,13 @@ int _odp_ipsec_sa_update_stats(ipsec_sa_t *ipsec_sa, uint32_t len, odp_ipsec_op_status_t *status); /** + * Try inline IPsec processing of provided packet. + * + * @retval 0 if packet was processed and sent using IPsec inline processing + */ +int _odp_ipsec_try_inline(odp_packet_t pkt); + +/** * @} */ diff --git a/platform/linux-generic/include/odp_packet_internal.h b/platform/linux-generic/include/odp_packet_internal.h index e028bc28..785c4b64 100644 --- a/platform/linux-generic/include/odp_packet_internal.h +++ b/platform/linux-generic/include/odp_packet_internal.h @@ -26,6 +26,7 @@ extern "C" { #include #include #include +#include #include #include @@ -145,6 +146,9 @@ typedef struct { uint8_t extra[PKT_EXTRA_LEN] ODP_ALIGNED_CACHE; #endif + /* Context for IPsec */ + odp_ipsec_packet_result_t ipsec_ctx; + /* Packet data storage */ uint8_t data[0]; } odp_packet_hdr_t; diff --git a/platform/linux-generic/odp_ipsec.c b/platform/linux-generic/odp_ipsec.c index d0ca027c..e80d676d 100644 --- a/platform/linux-generic/odp_ipsec.c +++ b/platform/linux-generic/odp_ipsec.c @@ -6,125 +6,1205 @@ #include +#include +#include #include +#include +#include + #include +typedef struct ODP_PACKED { + odp_u32be_t spi; /**< Security Parameter Index */ + odp_u32be_t seq_no; /**< Sequence Number */ +} ipsec_aad_t; + int odp_ipsec_capability(odp_ipsec_capability_t *capa) { + int rc; + odp_crypto_capability_t crypto_capa; + odp_queue_capability_t queue_capa; + memset(capa, 0, sizeof(odp_ipsec_capability_t)); + capa->op_mode_sync = ODP_SUPPORT_PREFERRED; + capa->op_mode_async = ODP_SUPPORT_PREFERRED; + capa->op_mode_inline_in = ODP_SUPPORT_PREFERRED; + capa->op_mode_inline_out = ODP_SUPPORT_PREFERRED; + + capa->proto_ah = ODP_SUPPORT_YES; + + capa->max_num_sa = ODP_CONFIG_IPSEC_SAS; + + rc = odp_crypto_capability(&crypto_capa); + if (rc < 0) + return rc; + + capa->ciphers = crypto_capa.ciphers; + capa->auths = crypto_capa.auths; + + rc = odp_queue_capability(&queue_capa); + if (rc < 0) + return rc; + + capa->max_queues = queue_capa.max_queues; + return 0; } int odp_ipsec_cipher_capability(odp_cipher_alg_t cipher, odp_crypto_cipher_capability_t capa[], int num) { - (void)cipher; - (void)capa; - (void)num; - - return -1; + return odp_crypto_cipher_capability(cipher, capa, num); } int odp_ipsec_auth_capability(odp_auth_alg_t auth, odp_crypto_auth_capability_t capa[], int num) { - (void)auth; - (void)capa; - (void)num; - - return -1; + return odp_crypto_auth_capability(auth, capa, num); } void odp_ipsec_config_init(odp_ipsec_config_t *config) { memset(config, 0, sizeof(odp_ipsec_config_t)); + config->inbound_mode = ODP_IPSEC_OP_MODE_SYNC; + config->outbound_mode = ODP_IPSEC_OP_MODE_SYNC; + config->max_num_sa = ODP_CONFIG_IPSEC_SAS; + config->inbound.default_queue = ODP_QUEUE_INVALID; + config->inbound.lookup.min_spi = 0; + config->inbound.lookup.max_spi = UINT32_MAX; } +static odp_ipsec_config_t ipsec_config; + int odp_ipsec_config(const odp_ipsec_config_t *config) { - (void)config; + if (ODP_CONFIG_IPSEC_SAS > config->max_num_sa) + return -1; + + ipsec_config = *config; + + return 0; +} + +static odp_ipsec_packet_result_t *ipsec_pkt_result(odp_packet_t packet) +{ + ODP_ASSERT(ODP_EVENT_PACKET_IPSEC == + odp_event_subtype(odp_packet_to_event(packet))); + + return &odp_packet_hdr(packet)->ipsec_ctx; +} + +/** + * Checksum + * + * @param buffer calculate chksum for buffer + * @param len buffer length + * + * @return checksum value in host cpu order + */ +static inline +odp_u16sum_t _odp_chksum(void *buffer, int len) +{ + uint16_t *buf = (uint16_t *)buffer; + uint32_t sum = 0; + uint16_t result; + + for (sum = 0; len > 1; len -= 2) + sum += *buf++; + + if (len == 1) + sum += *(unsigned char *)buf; + + sum = (sum >> 16) + (sum & 0xFFFF); + sum += (sum >> 16); + result = ~sum; + + return (__odp_force odp_u16sum_t) result; +} + +/** + * Calculate and fill in IPv4 checksum + * + * @note when using this api to populate data destined for the wire + * odp_cpu_to_be_16() can be used to remove sparse warnings + * + * @param pkt ODP packet + * + * @return IPv4 checksum in host cpu order, or 0 on failure + */ +static inline odp_u16sum_t +_odp_ipv4_csum_update(odp_packet_t pkt) +{ + uint16_t *w; + _odp_ipv4hdr_t *ip; + int nleft = sizeof(_odp_ipv4hdr_t); + + ip = (_odp_ipv4hdr_t *)odp_packet_l3_ptr(pkt, NULL); + if (ip == NULL) + return 0; + + ip->chksum = 0; + w = (uint16_t *)(void *)ip; + ip->chksum = _odp_chksum(w, nleft); + return ip->chksum; +} + +#define ipv4_hdr_len(ip) (_ODP_IPV4HDR_IHL(ip->ver_ihl) * 4) +static inline +void ipv4_adjust_len(_odp_ipv4hdr_t *ip, int adj) +{ + ip->tot_len = odp_cpu_to_be_16(odp_be_to_cpu_16(ip->tot_len) + adj); +} + +static const uint8_t ipsec_padding[255] = { + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, + 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, + 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, + 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, + 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, + 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, + 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, + 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, + 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, + 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, + 0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, + 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, + 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, + 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, + 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, + 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, + 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, + 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, + 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, + 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, + 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, + 0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, + 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, + 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, + 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, + 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, + 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, + 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, + 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef, + 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, + 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff, +}; + +static +ipsec_sa_t *ipsec_in_single(odp_packet_t pkt, + odp_ipsec_sa_t sa, + odp_packet_t *pkt_out, + odp_ipsec_op_status_t *status) +{ + ipsec_sa_t *ipsec_sa = NULL; + uint32_t ip_offset = odp_packet_l3_offset(pkt); + _odp_ipv4hdr_t *ip = odp_packet_l3_ptr(pkt, NULL); + uint16_t ip_hdr_len = ipv4_hdr_len(ip); + odp_crypto_packet_op_param_t param; + int rc; + unsigned stats_length; + uint16_t ipsec_offset; /**< Offset of IPsec header from + buffer start */ + uint8_t iv[MAX_IV_LEN]; /**< ESP IV storage */ + ipsec_aad_t aad; /**< AAD, note ESN is not fully supported */ + unsigned hdr_len; /**< Length of IPsec headers */ + unsigned trl_len; /**< Length of IPsec trailers */ + uint8_t ip_tos; /**< Saved IP TOS value */ + uint8_t ip_ttl; /**< Saved IP TTL value */ + uint16_t ip_frag_offset; /**< Saved IP flags value */ + odp_crypto_packet_result_t crypto; /**< Crypto operation result */ + + ODP_ASSERT(ODP_PACKET_OFFSET_INVALID != ip_offset); + ODP_ASSERT(NULL != ip); + + ip_tos = 0; + ip_ttl = 0; + ip_frag_offset = 0; + + /* Initialize parameters block */ + memset(¶m, 0, sizeof(param)); + + ipsec_offset = ip_offset + ip_hdr_len; + + if (_ODP_IPV4HDR_IS_FRAGMENT(ip->frag_offset)) { + status->error.proto = 1; + goto out; + } + + /* Check IP header for IPSec protocols and look it up */ + if (_ODP_IPPROTO_ESP == ip->proto) { + _odp_esphdr_t esp; + + if (odp_packet_copy_to_mem(pkt, ipsec_offset, + sizeof(esp), &esp) < 0) { + status->error.alg = 1; + goto out; + } + + if (ODP_IPSEC_SA_INVALID == sa) { + ipsec_sa_lookup_t lookup; + + lookup.proto = ODP_IPSEC_ESP; + lookup.spi = odp_be_to_cpu_32(esp.spi); + lookup.dst_addr = &ip->dst_addr; + + ipsec_sa = _odp_ipsec_sa_lookup(&lookup); + if (NULL == ipsec_sa) { + status->error.sa_lookup = 1; + goto out; + } + } else { + ipsec_sa = _odp_ipsec_sa_use(sa); + ODP_ASSERT(NULL != ipsec_sa); + if (ipsec_sa->proto != ODP_IPSEC_ESP || + ipsec_sa->spi != odp_be_to_cpu_32(esp.spi)) { + status->error.proto = 1; + goto out; + } + } + + memcpy(iv, ipsec_sa->salt, ipsec_sa->salt_length); + if (odp_packet_copy_to_mem(pkt, + ipsec_offset + _ODP_ESPHDR_LEN, + ipsec_sa->esp_iv_len, + iv + ipsec_sa->salt_length) < 0) { + status->error.alg = 1; + goto out; + } + + hdr_len = _ODP_ESPHDR_LEN + ipsec_sa->esp_iv_len; + trl_len = _ODP_ESPTRL_LEN + ipsec_sa->icv_len; + + param.cipher_range.offset = ipsec_offset + hdr_len; + param.cipher_range.length = odp_be_to_cpu_16(ip->tot_len) - + ip_hdr_len - + hdr_len - + ipsec_sa->icv_len; + param.override_iv_ptr = iv; + + aad.spi = esp.spi; + aad.seq_no = esp.seq_no; + + param.aad.ptr = (uint8_t *)&aad; + param.aad.length = sizeof(aad); + + param.auth_range.offset = ipsec_offset; + param.auth_range.length = odp_be_to_cpu_16(ip->tot_len) - + ip_hdr_len - + ipsec_sa->icv_len; + param.hash_result_offset = ip_offset + + odp_be_to_cpu_16(ip->tot_len) - + ipsec_sa->icv_len; + + stats_length = param.cipher_range.length; + } else if (_ODP_IPPROTO_AH == ip->proto) { + _odp_ahhdr_t ah; + + if (odp_packet_copy_to_mem(pkt, ipsec_offset, + sizeof(ah), &ah) < 0) { + status->error.alg = 1; + goto out; + } + + if (ODP_IPSEC_SA_INVALID == sa) { + ipsec_sa_lookup_t lookup; + + lookup.proto = ODP_IPSEC_AH; + lookup.spi = odp_be_to_cpu_32(ah.spi); + lookup.dst_addr = &ip->dst_addr; + + ipsec_sa = _odp_ipsec_sa_lookup(&lookup); + if (NULL == ipsec_sa) { + status->error.sa_lookup = 1; + goto out; + } + } else { + ipsec_sa = _odp_ipsec_sa_use(sa); + ODP_ASSERT(NULL != ipsec_sa); + if (ipsec_sa->proto != ODP_IPSEC_AH || + ipsec_sa->spi != odp_be_to_cpu_32(ah.spi)) { + status->error.proto = 1; + goto out; + } + } + + hdr_len = (ah.ah_len + 2) * 4; + trl_len = 0; + + /* Save everything to context */ + ip_tos = ip->tos; + ip_frag_offset = odp_be_to_cpu_16(ip->frag_offset); + ip_ttl = ip->ttl; + + /* FIXME: zero copy of header, passing it to crypto! */ + /* + * If authenticating, zero the mutable fields build the request + */ + ip->chksum = 0; + ip->tos = 0; + ip->frag_offset = 0; + ip->ttl = 0; + + param.auth_range.offset = ip_offset; + param.auth_range.length = odp_be_to_cpu_16(ip->tot_len); + param.hash_result_offset = ipsec_offset + _ODP_AHHDR_LEN; + + stats_length = param.auth_range.length; + } else { + status->error.proto = 1; + goto out; + } + + if (_odp_ipsec_sa_update_stats(ipsec_sa, + stats_length, + status) < 0) + goto out; + + param.session = ipsec_sa->session; + + rc = odp_crypto_op(&pkt, &pkt, ¶m, 1); + if (rc < 0) { + ODP_DBG("Crypto failed\n"); + status->error.alg = 1; + goto out; + } + + rc = odp_crypto_result(&crypto, pkt); + if (rc < 0) { + ODP_DBG("Crypto failed\n"); + status->error.alg = 1; + goto out; + } + + if (!crypto.ok) { + if ((crypto.cipher_status.alg_err != + ODP_CRYPTO_ALG_ERR_NONE) || + (crypto.cipher_status.hw_err != + ODP_CRYPTO_HW_ERR_NONE)) + status->error.alg = 1; + + if ((crypto.auth_status.alg_err != + ODP_CRYPTO_ALG_ERR_NONE) || + (crypto.auth_status.hw_err != + ODP_CRYPTO_HW_ERR_NONE)) + status->error.auth = 1; + + goto out; + } + + ip_offset = odp_packet_l3_offset(pkt); + ip = odp_packet_l3_ptr(pkt, NULL); + ip_hdr_len = ipv4_hdr_len(ip); + + if (_ODP_IPPROTO_ESP == ip->proto) { + /* + * Finish cipher by finding ESP trailer and processing + */ + _odp_esptrl_t esptrl; + uint32_t esptrl_offset = ip_offset + + odp_be_to_cpu_16(ip->tot_len) - + trl_len; + + if (odp_packet_copy_to_mem(pkt, esptrl_offset, + sizeof(esptrl), &esptrl) < 0) { + status->error.proto = 1; + goto out; + } + + if (ip_offset + esptrl.pad_len > esptrl_offset) { + status->error.proto = 1; + goto out; + } + + if (_odp_packet_cmp_data(pkt, esptrl_offset - esptrl.pad_len, + ipsec_padding, esptrl.pad_len) != 0) { + status->error.proto = 1; + goto out; + } + + ip->proto = esptrl.next_header; + trl_len += esptrl.pad_len; + } else if (_ODP_IPPROTO_AH == ip->proto) { + /* + * Finish auth + */ + _odp_ahhdr_t ah; + + if (odp_packet_copy_to_mem(pkt, ipsec_offset, + sizeof(ah), &ah) < 0) { + status->error.alg = 1; + goto out; + } + + ip->proto = ah.next_header; + + /* Restore mutable fields */ + ip->ttl = ip_ttl; + ip->tos = ip_tos; + ip->frag_offset = odp_cpu_to_be_16(ip_frag_offset); + } else { + status->error.proto = 1; + goto out; + } + + if (ODP_IPSEC_MODE_TUNNEL == ipsec_sa->mode) { + /* We have a tunneled IPv4 packet, strip outer and IPsec + * headers */ + odp_packet_move_data(pkt, ip_hdr_len + hdr_len, 0, + ip_offset); + if (odp_packet_trunc_head(&pkt, ip_hdr_len + hdr_len, + NULL, NULL) < 0) { + status->error.alg = 1; + goto out; + } + + ip = odp_packet_l3_ptr(pkt, NULL); + ip->ttl -= ipsec_sa->dec_ttl; + _odp_ipv4_csum_update(pkt); + + } else { + /* Finalize the IPv4 header */ + ipv4_adjust_len(ip, -(hdr_len + trl_len)); + + _odp_ipv4_csum_update(pkt); + + odp_packet_move_data(pkt, hdr_len, 0, + ip_offset + ip_hdr_len); + if (odp_packet_trunc_head(&pkt, hdr_len, + NULL, NULL) < 0) { + status->error.alg = 1; + goto out; + } + } + + if (odp_packet_trunc_tail(&pkt, trl_len, NULL, NULL) < 0) + status->error.alg = 1; + + if (!status->error.all) { + odp_packet_hdr_t *pkt_hdr = odp_packet_hdr(pkt); + + packet_parse_reset(pkt_hdr); + /* FIXME: select parsing layer basing on config? */ + packet_parse_layer(pkt_hdr, ODP_PKTIO_PARSER_LAYER_ALL); + } +out: + *pkt_out = pkt; + + return ipsec_sa; +} + +/* Generate sequence number */ +static inline +uint32_t ipsec_seq_no(ipsec_sa_t *ipsec_sa) +{ + return odp_atomic_fetch_add_u32(&ipsec_sa->out.seq, 1); +} + +/* Helper for calculating encode length using data length and block size */ +#define ESP_ENCODE_LEN(x, b) ((((x) + ((b) - 1)) / (b)) * (b)) + +static +ipsec_sa_t *ipsec_out_single(odp_packet_t pkt, + odp_ipsec_sa_t sa, + odp_packet_t *pkt_out, + odp_ipsec_out_opt_t *opt ODP_UNUSED, + odp_ipsec_op_status_t *status) +{ + ipsec_sa_t *ipsec_sa = NULL; + uint32_t ip_offset = odp_packet_l3_offset(pkt); + _odp_ipv4hdr_t *ip = odp_packet_l3_ptr(pkt, NULL); + uint16_t ip_hdr_len = ipv4_hdr_len(ip); + odp_crypto_packet_op_param_t param; + unsigned stats_length; + int rc; + uint16_t ipsec_offset; /**< Offset of IPsec header from + buffer start */ + uint8_t iv[MAX_IV_LEN]; /**< ESP IV storage */ + ipsec_aad_t aad; /**< AAD, note ESN is not fully supported */ + unsigned hdr_len; /**< Length of IPsec headers */ + unsigned trl_len; /**< Length of IPsec trailers */ + uint8_t ip_tos; /**< Saved IP TOS value */ + uint8_t ip_ttl; /**< Saved IP TTL value */ + uint16_t ip_frag_offset; /**< Saved IP flags value */ + odp_crypto_packet_result_t crypto; /**< Crypto operation result */ + + ODP_ASSERT(ODP_PACKET_OFFSET_INVALID != ip_offset); + ODP_ASSERT(NULL != ip); + + ip_tos = 0; + ip_ttl = 0; + ip_frag_offset = 0; + + ipsec_sa = _odp_ipsec_sa_use(sa); + ODP_ASSERT(NULL != ipsec_sa); + + /* Initialize parameters block */ + memset(¶m, 0, sizeof(param)); + + if (ODP_IPSEC_MODE_TRANSPORT == ipsec_sa->mode && + _ODP_IPV4HDR_IS_FRAGMENT(ip->frag_offset)) { + status->error.alg = 1; + goto out; + } + + if (ODP_IPSEC_MODE_TUNNEL == ipsec_sa->mode) { + _odp_ipv4hdr_t out_ip; + uint16_t tot_len; + + ip->ttl -= ipsec_sa->dec_ttl; + + out_ip.ver_ihl = 0x45; + if (ipsec_sa->copy_dscp) + out_ip.tos = ip->tos; + else + out_ip.tos = (ip->tos & ~_ODP_IP_TOS_DSCP_MASK) | + (ipsec_sa->out.tun_dscp << + _ODP_IP_TOS_DSCP_SHIFT); + tot_len = odp_be_to_cpu_16(ip->tot_len) + _ODP_IPV4HDR_LEN; + out_ip.tot_len = odp_cpu_to_be_16(tot_len); + /* No need to convert to BE: ID just should not be duplicated */ + out_ip.id = odp_atomic_fetch_add_u32(&ipsec_sa->out.tun_hdr_id, + 1); + if (ipsec_sa->copy_df) + out_ip.frag_offset = ip->frag_offset; + else + out_ip.frag_offset = (ip->frag_offset & ~0x4000) | + (ipsec_sa->out.tun_df << 14); + out_ip.ttl = ipsec_sa->out.tun_ttl; + out_ip.proto = _ODP_IPV4; + /* Will be filled later by packet checksum update */ + out_ip.chksum = 0; + out_ip.src_addr = ipsec_sa->out.tun_src_ip; + out_ip.dst_addr = ipsec_sa->out.tun_dst_ip; + + if (odp_packet_extend_head(&pkt, _ODP_IPV4HDR_LEN, + NULL, NULL) < 0) { + status->error.alg = 1; + goto out; + } + + odp_packet_move_data(pkt, 0, _ODP_IPV4HDR_LEN, ip_offset); + + odp_packet_copy_from_mem(pkt, ip_offset, + _ODP_IPV4HDR_LEN, &out_ip); + + odp_packet_l4_offset_set(pkt, ip_offset + _ODP_IPV4HDR_LEN); - return -1; + ip = odp_packet_l3_ptr(pkt, NULL); + ip_hdr_len = _ODP_IPV4HDR_LEN; + } + + ipsec_offset = ip_offset + ip_hdr_len; + + if (ipsec_sa->proto == ODP_IPSEC_ESP) { + _odp_esphdr_t esp; + _odp_esptrl_t esptrl; + uint32_t encrypt_len; + uint16_t ip_data_len = odp_be_to_cpu_16(ip->tot_len) - + ip_hdr_len; + uint32_t pad_block = ipsec_sa->esp_block_len; + + /* ESP trailer should be 32-bit right aligned */ + if (pad_block < 4) + pad_block = 4; + + encrypt_len = ESP_ENCODE_LEN(ip_data_len + _ODP_ESPTRL_LEN, + pad_block); + + hdr_len = _ODP_ESPHDR_LEN + ipsec_sa->esp_iv_len; + trl_len = encrypt_len - + ip_data_len + + ipsec_sa->icv_len; + + if (ipsec_sa->esp_iv_len) { + uint32_t len; + + len = odp_random_data(iv + ipsec_sa->salt_length, + ipsec_sa->esp_iv_len, + ODP_RANDOM_CRYPTO); + + if (len != ipsec_sa->esp_iv_len) { + status->error.alg = 1; + goto out; + } + + memcpy(iv, ipsec_sa->salt, ipsec_sa->salt_length); + + param.override_iv_ptr = iv; + } + + if (odp_packet_extend_tail(&pkt, trl_len, NULL, NULL) < 0) { + status->error.alg = 1; + goto out; + } + + if (odp_packet_extend_head(&pkt, hdr_len, NULL, NULL) < 0) { + status->error.alg = 1; + goto out; + } + + odp_packet_move_data(pkt, 0, hdr_len, ipsec_offset); + + ip = odp_packet_l3_ptr(pkt, NULL); + + /* Set IPv4 length before authentication */ + ipv4_adjust_len(ip, hdr_len + trl_len); + + uint32_t esptrl_offset = ip_offset + + ip_hdr_len + + hdr_len + + encrypt_len - + _ODP_ESPTRL_LEN; + + memset(&esp, 0, sizeof(esp)); + esp.spi = odp_cpu_to_be_32(ipsec_sa->spi); + esp.seq_no = odp_cpu_to_be_32(ipsec_seq_no(ipsec_sa)); + + aad.spi = esp.spi; + aad.seq_no = esp.seq_no; + + param.aad.ptr = (uint8_t *)&aad; + param.aad.length = sizeof(aad); + + memset(&esptrl, 0, sizeof(esptrl)); + esptrl.pad_len = encrypt_len - ip_data_len - _ODP_ESPTRL_LEN; + esptrl.next_header = ip->proto; + ip->proto = _ODP_IPPROTO_ESP; + + odp_packet_copy_from_mem(pkt, + ipsec_offset, _ODP_ESPHDR_LEN, + &esp); + memcpy(iv, ipsec_sa->salt, ipsec_sa->salt_length); + odp_packet_copy_from_mem(pkt, + ipsec_offset + _ODP_ESPHDR_LEN, + ipsec_sa->esp_iv_len, + iv + ipsec_sa->salt_length); + odp_packet_copy_from_mem(pkt, + esptrl_offset - esptrl.pad_len, + esptrl.pad_len, ipsec_padding); + odp_packet_copy_from_mem(pkt, + esptrl_offset, _ODP_ESPTRL_LEN, + &esptrl); + + param.cipher_range.offset = ipsec_offset + hdr_len; + param.cipher_range.length = odp_be_to_cpu_16(ip->tot_len) - + ip_hdr_len - + hdr_len - + ipsec_sa->icv_len; + + param.auth_range.offset = ipsec_offset; + param.auth_range.length = odp_be_to_cpu_16(ip->tot_len) - + ip_hdr_len - + ipsec_sa->icv_len; + param.hash_result_offset = ip_offset + + odp_be_to_cpu_16(ip->tot_len) - + ipsec_sa->icv_len; + + stats_length = param.cipher_range.length; + } else if (ipsec_sa->proto == ODP_IPSEC_AH) { + _odp_ahhdr_t ah; + + hdr_len = _ODP_AHHDR_LEN + ipsec_sa->icv_len; + trl_len = 0; + + /* Save IPv4 stuff */ + ip_tos = ip->tos; + ip_frag_offset = odp_be_to_cpu_16(ip->frag_offset); + ip_ttl = ip->ttl; + + if (odp_packet_extend_tail(&pkt, trl_len, NULL, NULL) < 0) { + status->error.alg = 1; + goto out; + } + + if (odp_packet_extend_head(&pkt, hdr_len, NULL, NULL) < 0) { + status->error.alg = 1; + goto out; + } + + odp_packet_move_data(pkt, 0, hdr_len, ipsec_offset); + + ip = odp_packet_l3_ptr(pkt, NULL); + + /* Set IPv4 length before authentication */ + ipv4_adjust_len(ip, hdr_len + trl_len); + + memset(&ah, 0, sizeof(ah)); + ah.spi = odp_cpu_to_be_32(ipsec_sa->spi); + ah.ah_len = 1 + (ipsec_sa->icv_len / 4); + ah.seq_no = odp_cpu_to_be_32(ipsec_seq_no(ipsec_sa)); + ah.next_header = ip->proto; + ip->proto = _ODP_IPPROTO_AH; + + odp_packet_copy_from_mem(pkt, + ipsec_offset, _ODP_AHHDR_LEN, + &ah); + _odp_packet_set_data(pkt, + ipsec_offset + _ODP_AHHDR_LEN, + 0, ipsec_sa->icv_len); + + ip->chksum = 0; + ip->tos = 0; + ip->frag_offset = 0; + ip->ttl = 0; + + param.auth_range.offset = ip_offset; + param.auth_range.length = odp_be_to_cpu_16(ip->tot_len); + param.hash_result_offset = ipsec_offset + _ODP_AHHDR_LEN; + + stats_length = param.auth_range.length; + } else { + status->error.alg = 1; + goto out; + } + + if (_odp_ipsec_sa_update_stats(ipsec_sa, + stats_length, + status) < 0) + goto out; + + param.session = ipsec_sa->session; + + rc = odp_crypto_op(&pkt, &pkt, ¶m, 1); + if (rc < 0) { + ODP_DBG("Crypto failed\n"); + status->error.alg = 1; + goto out; + } + + rc = odp_crypto_result(&crypto, pkt); + if (rc < 0) { + ODP_DBG("Crypto failed\n"); + status->error.alg = 1; + goto out; + } + + if (!crypto.ok) { + if ((crypto.cipher_status.alg_err != + ODP_CRYPTO_ALG_ERR_NONE) || + (crypto.cipher_status.hw_err != + ODP_CRYPTO_HW_ERR_NONE)) + status->error.alg = 1; + + if ((crypto.auth_status.alg_err != + ODP_CRYPTO_ALG_ERR_NONE) || + (crypto.auth_status.hw_err != + ODP_CRYPTO_HW_ERR_NONE)) + status->error.auth = 1; + + goto out; + } + + ip = odp_packet_l3_ptr(pkt, NULL); + + /* Finalize the IPv4 header */ + if (ip->proto == _ODP_IPPROTO_AH) { + ip->ttl = ip_ttl; + ip->tos = ip_tos; + ip->frag_offset = odp_cpu_to_be_16(ip_frag_offset); + } + + _odp_ipv4_csum_update(pkt); + +out: + + *pkt_out = pkt; + return ipsec_sa; } int odp_ipsec_in(const odp_packet_t pkt_in[], int num_in, odp_packet_t pkt_out[], int *num_out, const odp_ipsec_in_param_t *param) { - (void)pkt_in; - (void)num_in; - (void)pkt_out; - (void)num_out; - (void)param; + int in_pkt = 0; + int out_pkt = 0; + int max_out = *num_out; + unsigned sa_idx = 0; + unsigned sa_inc = (param->num_sa > 1) ? 1 : 0; + + while (in_pkt < num_in && out_pkt < max_out) { + odp_packet_t pkt = pkt_in[in_pkt]; + odp_ipsec_op_status_t status; + odp_ipsec_sa_t sa; + ipsec_sa_t *ipsec_sa; + odp_ipsec_packet_result_t *result; + + memset(&status, 0, sizeof(status)); + + if (0 == param->num_sa) { + sa = ODP_IPSEC_SA_INVALID; + } else { + sa = param->sa[sa_idx++]; + ODP_ASSERT(ODP_IPSEC_SA_INVALID != sa); + } - return -1; + ipsec_sa = ipsec_in_single(pkt, sa, &pkt, &status); + + _odp_buffer_event_subtype_set(packet_to_buffer(pkt), + ODP_EVENT_PACKET_IPSEC); + result = ipsec_pkt_result(pkt); + memset(result, 0, sizeof(*result)); + result->status = status; + if (NULL != ipsec_sa) + result->sa = ipsec_sa->ipsec_sa_hdl; + else + result->sa = ODP_IPSEC_SA_INVALID; + + pkt_out[out_pkt] = pkt; + in_pkt++; + out_pkt++; + sa_idx += sa_inc; + + /* Last thing */ + if (NULL != ipsec_sa) + _odp_ipsec_sa_unuse(ipsec_sa); + } + + *num_out = out_pkt; + + return in_pkt; } +static odp_ipsec_out_opt_t default_opt = { + .mode = ODP_IPSEC_FRAG_DISABLED, +}; + int odp_ipsec_out(const odp_packet_t pkt_in[], int num_in, odp_packet_t pkt_out[], int *num_out, const odp_ipsec_out_param_t *param) { - (void)pkt_in; - (void)num_in; - (void)pkt_out; - (void)num_out; - (void)param; + int in_pkt = 0; + int out_pkt = 0; + int max_out = *num_out; + unsigned sa_idx = 0; + unsigned opt_idx = 0; + unsigned sa_inc = (param->num_sa > 1) ? 1 : 0; + unsigned opt_inc = (param->num_opt > 1) ? 1 : 0; + + ODP_ASSERT(param->num_sa != 0); - return -1; + while (in_pkt < num_in && out_pkt < max_out) { + odp_packet_t pkt = pkt_in[in_pkt]; + odp_ipsec_op_status_t status; + odp_ipsec_sa_t sa; + ipsec_sa_t *ipsec_sa; + odp_ipsec_packet_result_t *result; + odp_ipsec_out_opt_t *opt; + + memset(&status, 0, sizeof(status)); + + sa = param->sa[sa_idx++]; + ODP_ASSERT(ODP_IPSEC_SA_INVALID != sa); + + if (0 == param->num_opt) + opt = &default_opt; + else + opt = ¶m->opt[opt_idx]; + + ipsec_sa = ipsec_out_single(pkt, sa, &pkt, opt, &status); + ODP_ASSERT(NULL != ipsec_sa); + + _odp_buffer_event_subtype_set(packet_to_buffer(pkt), + ODP_EVENT_PACKET_IPSEC); + result = ipsec_pkt_result(pkt); + memset(result, 0, sizeof(*result)); + result->status = status; + result->sa = ipsec_sa->ipsec_sa_hdl; + + pkt_out[out_pkt] = pkt; + in_pkt++; + out_pkt++; + sa_idx += sa_inc; + opt_idx += opt_inc; + + /* Last thing */ + _odp_ipsec_sa_unuse(ipsec_sa); + } + + *num_out = out_pkt; + + return in_pkt; } -int odp_ipsec_in_enq(const odp_packet_t pkt[], int num, +int odp_ipsec_in_enq(const odp_packet_t pkt_in[], int num_in, const odp_ipsec_in_param_t *param) { - (void)pkt; - (void)num; - (void)param; + int in_pkt = 0; + unsigned sa_idx = 0; + unsigned sa_inc = (param->num_sa > 1) ? 1 : 0; + + while (in_pkt < num_in) { + odp_packet_t pkt = pkt_in[in_pkt]; + odp_ipsec_op_status_t status; + odp_ipsec_sa_t sa; + ipsec_sa_t *ipsec_sa; + odp_ipsec_packet_result_t *result; + odp_queue_t queue; + + memset(&status, 0, sizeof(status)); + + if (0 == param->num_sa) { + sa = ODP_IPSEC_SA_INVALID; + } else { + sa = param->sa[sa_idx++]; + ODP_ASSERT(ODP_IPSEC_SA_INVALID != sa); + } + + ipsec_sa = ipsec_in_single(pkt, sa, &pkt, &status); + + _odp_buffer_event_subtype_set(packet_to_buffer(pkt), + ODP_EVENT_PACKET_IPSEC); + result = ipsec_pkt_result(pkt); + memset(result, 0, sizeof(*result)); + result->status = status; + if (NULL != ipsec_sa) { + result->sa = ipsec_sa->ipsec_sa_hdl; + queue = ipsec_sa->queue; + } else { + result->sa = ODP_IPSEC_SA_INVALID; + queue = ipsec_config.inbound.default_queue; + } + + if (odp_queue_enq(queue, odp_ipsec_packet_to_event(pkt))) { + odp_packet_free(pkt); + break; + } + in_pkt++; + sa_idx += sa_inc; - return -1; + /* Last thing */ + if (NULL != ipsec_sa) + _odp_ipsec_sa_unuse(ipsec_sa); + } + + return in_pkt; } -int odp_ipsec_out_enq(const odp_packet_t pkt[], int num, +int odp_ipsec_out_enq(const odp_packet_t pkt_in[], int num_in, const odp_ipsec_out_param_t *param) { - (void)pkt; - (void)num; - (void)param; + int in_pkt = 0; + unsigned sa_idx = 0; + unsigned opt_idx = 0; + unsigned sa_inc = (param->num_sa > 1) ? 1 : 0; + unsigned opt_inc = (param->num_opt > 1) ? 1 : 0; + + ODP_ASSERT(param->num_sa != 0); + + while (in_pkt < num_in) { + odp_packet_t pkt = pkt_in[in_pkt]; + odp_ipsec_op_status_t status; + odp_ipsec_sa_t sa; + ipsec_sa_t *ipsec_sa; + odp_ipsec_packet_result_t *result; + odp_ipsec_out_opt_t *opt; + odp_queue_t queue; + + memset(&status, 0, sizeof(status)); + + sa = param->sa[sa_idx++]; + ODP_ASSERT(ODP_IPSEC_SA_INVALID != sa); + + if (0 == param->num_opt) + opt = &default_opt; + else + opt = ¶m->opt[opt_idx]; + + ipsec_sa = ipsec_out_single(pkt, sa, &pkt, opt, &status); + ODP_ASSERT(NULL != ipsec_sa); + + _odp_buffer_event_subtype_set(packet_to_buffer(pkt), + ODP_EVENT_PACKET_IPSEC); + result = ipsec_pkt_result(pkt); + memset(result, 0, sizeof(*result)); + result->status = status; + result->sa = ipsec_sa->ipsec_sa_hdl; + queue = ipsec_sa->queue; + + if (odp_queue_enq(queue, odp_ipsec_packet_to_event(pkt))) { + odp_packet_free(pkt); + break; + } + in_pkt++; + sa_idx += sa_inc; + opt_idx += opt_inc; + + /* Last thing */ + _odp_ipsec_sa_unuse(ipsec_sa); + } + + return in_pkt; +} + +int _odp_ipsec_try_inline(odp_packet_t pkt) +{ + odp_ipsec_op_status_t status; + ipsec_sa_t *ipsec_sa; + odp_ipsec_packet_result_t *result; + odp_queue_t queue; - return -1; + memset(&status, 0, sizeof(status)); + + ipsec_sa = ipsec_in_single(pkt, ODP_IPSEC_SA_INVALID, &pkt, &status); + /* + * Route packet back in case of lookup failure or early error before + * lookup + */ + if (NULL == ipsec_sa) + return -1; + + _odp_buffer_event_subtype_set(packet_to_buffer(pkt), + ODP_EVENT_PACKET_IPSEC); + result = ipsec_pkt_result(pkt); + memset(result, 0, sizeof(*result)); + result->status = status; + result->sa = ipsec_sa->ipsec_sa_hdl; + queue = ipsec_sa->queue; + + if (odp_queue_enq(queue, odp_ipsec_packet_to_event(pkt))) + odp_packet_free(pkt); + + /* Last thing */ + _odp_ipsec_sa_unuse(ipsec_sa); + + return 0; } -int odp_ipsec_out_inline(const odp_packet_t pkt[], int num, +int odp_ipsec_out_inline(const odp_packet_t pkt_in[], int num_in, const odp_ipsec_out_param_t *param, const odp_ipsec_out_inline_param_t *inline_param) { - (void)pkt; - (void)num; - (void)param; - (void)inline_param; + int in_pkt = 0; + unsigned sa_idx = 0; + unsigned opt_idx = 0; + unsigned sa_inc = (param->num_sa > 1) ? 1 : 0; + unsigned opt_inc = (param->num_opt > 1) ? 1 : 0; + + ODP_ASSERT(param->num_sa != 0); + + while (in_pkt < num_in) { + odp_packet_t pkt = pkt_in[in_pkt]; + odp_ipsec_op_status_t status; + odp_ipsec_sa_t sa; + ipsec_sa_t *ipsec_sa; + odp_ipsec_packet_result_t *result; + odp_ipsec_out_opt_t *opt; + uint32_t hdr_len, offset; + const void *ptr; + + memset(&status, 0, sizeof(status)); + + if (0 == param->num_sa) { + sa = ODP_IPSEC_SA_INVALID; + } else { + sa = param->sa[sa_idx++]; + ODP_ASSERT(ODP_IPSEC_SA_INVALID != sa); + } + + if (0 == param->num_opt) + opt = &default_opt; + else + opt = ¶m->opt[opt_idx]; + + hdr_len = inline_param[in_pkt].outer_hdr.len; + ptr = inline_param[in_pkt].outer_hdr.ptr; + offset = odp_packet_l3_offset(pkt); + if (offset >= hdr_len) { + if (odp_packet_trunc_head(&pkt, offset - hdr_len, + NULL, NULL) < 0) + status.error.alg = 1; + + } else { + if (odp_packet_extend_head(&pkt, hdr_len - offset, + NULL, NULL) < 0) + status.error.alg = 1; + } + + odp_packet_l3_offset_set(pkt, hdr_len); + + if (odp_packet_copy_from_mem(pkt, 0, + hdr_len, + ptr) < 0) + status.error.alg = 1; - return -1; + ipsec_sa = ipsec_out_single(pkt, sa, &pkt, opt, &status); + ODP_ASSERT(NULL != ipsec_sa); + + _odp_buffer_event_subtype_set(packet_to_buffer(pkt), + ODP_EVENT_PACKET_IPSEC); + result = ipsec_pkt_result(pkt); + memset(result, 0, sizeof(*result)); + result->sa = ipsec_sa->ipsec_sa_hdl; + result->status = status; + + if (!status.error.all) { + odp_pktout_queue_t pkqueue; + + if (odp_pktout_queue(inline_param[in_pkt].pktio, + &pkqueue, 1) < 0) { + status.error.alg = 1; + goto err; + } + + if (odp_pktout_send(pkqueue, &pkt, 1) < 0) { + status.error.alg = 1; + goto err; + } + } else { + odp_queue_t queue; + odp_buffer_t buf; +err: + buf = packet_to_buffer(pkt); + _odp_buffer_event_subtype_set(buf, + ODP_EVENT_PACKET_IPSEC); + result = ipsec_pkt_result(pkt); + memset(result, 0, sizeof(*result)); + result->sa = ipsec_sa->ipsec_sa_hdl; + result->status = status; + queue = ipsec_sa->queue; + + if (odp_queue_enq(queue, + odp_ipsec_packet_to_event(pkt))) { + odp_packet_free(pkt); + break; + } + } + in_pkt++; + sa_idx += sa_inc; + opt_idx += opt_inc; + + /* Last thing */ + _odp_ipsec_sa_unuse(ipsec_sa); + } + + return in_pkt; } int odp_ipsec_result(odp_ipsec_packet_result_t *result, odp_packet_t packet) { - (void)result; - (void)packet; + odp_ipsec_packet_result_t *res; - return -1; + ODP_ASSERT(result != NULL); + + res = ipsec_pkt_result(packet); + + /* FIXME: maybe postprocess here, setting alg error in case of crypto + * error instead of processing packet fully in ipsec_in/out_single */ + + *result = *res; + + return 0; } odp_packet_t odp_ipsec_packet_from_event(odp_event_t ev) { - (void)ev; - - return ODP_PACKET_INVALID; + return odp_packet_from_event(ev); } odp_event_t odp_ipsec_packet_to_event(odp_packet_t pkt) { - (void)pkt; - - return ODP_EVENT_INVALID; + return odp_packet_to_event(pkt); }