DPDK
24.07.0
|
#include <stdint.h>
#include <stdio.h>
#include <netinet/in.h>
#include <rte_compat.h>
#include <rte_crypto_sym.h>
Go to the source code of this file.
Data Structures | |
struct | rte_swx_ipsec_burst_size |
struct | rte_swx_ipsec_params |
struct | rte_swx_ipsec_input_packet_metadata |
struct | rte_swx_ipsec_sa_cipher_params |
struct | rte_swx_ipsec_sa_authentication_params |
struct | rte_swx_ipsec_sa_aead_params |
struct | rte_swx_ipsec_sa_encap_params |
struct | rte_swx_ipsec_sa_params |
Macros | |
#define | RTE_SWX_IPSEC_NAME_SIZE 64 |
#define | RTE_SWX_IPSEC_BURST_SIZE_MAX 256 |
#define | RTE_SWX_IPSEC_KEY_SIZE_MAX 64 |
Functions | |
__rte_experimental struct rte_swx_ipsec * | rte_swx_ipsec_find (const char *name) |
__rte_experimental int | rte_swx_ipsec_create (struct rte_swx_ipsec **ipsec, const char *name, struct rte_swx_ipsec_params *params, int numa_node) |
__rte_experimental void | rte_swx_ipsec_free (struct rte_swx_ipsec *ipsec) |
__rte_experimental void | rte_swx_ipsec_run (struct rte_swx_ipsec *ipsec) |
__rte_experimental int | rte_swx_ipsec_sa_add (struct rte_swx_ipsec *ipsec, struct rte_swx_ipsec_sa_params *sa_params, uint32_t *sa_id) |
__rte_experimental void | rte_swx_ipsec_sa_delete (struct rte_swx_ipsec *ipsec, uint32_t sa_id) |
__rte_experimental struct rte_swx_ipsec_sa_params * | rte_swx_ipsec_sa_read (struct rte_swx_ipsec *ipsec, const char *string, int *is_blank_or_comment, const char **errmsg) |
RTE SWX Internet Protocol Security (IPsec)
The IPsec block is a companion block for the SWX pipeline used to provide IPsec support to the pipeline. The block is external to the pipeline, hence it needs to be explicitly instantiated by the user and connected to a pipeline instance through the pipeline I/O ports.
Main features:
Security Association (SA):
Packet format:
SA update procedure:
Definition in file rte_swx_ipsec.h.
#define RTE_SWX_IPSEC_NAME_SIZE 64 |
Name size.
Definition at line 65 of file rte_swx_ipsec.h.
#define RTE_SWX_IPSEC_BURST_SIZE_MAX 256 |
Maximum burst size.
Definition at line 70 of file rte_swx_ipsec.h.
#define RTE_SWX_IPSEC_KEY_SIZE_MAX 64 |
Maximum key size in bytes.
Definition at line 185 of file rte_swx_ipsec.h.
__rte_experimental struct rte_swx_ipsec* rte_swx_ipsec_find | ( | const char * | name | ) |
IPsec instance find
[in] | name | IPsec instance name. |
__rte_experimental int rte_swx_ipsec_create | ( | struct rte_swx_ipsec ** | ipsec, |
const char * | name, | ||
struct rte_swx_ipsec_params * | params, | ||
int | numa_node | ||
) |
IPsec instance create
[out] | ipsec | IPsec instance handle. Must point to valid memory. Contains valid pipeline handle once this function returns successfully. |
[in] | name | IPsec instance unique name. |
[in] | params | IPsec instance configuration parameters. |
[in] | numa_node | Non-Uniform Memory Access (NUMA) node. |
__rte_experimental void rte_swx_ipsec_free | ( | struct rte_swx_ipsec * | ipsec | ) |
IPsec instance free
[in] | ipsec | IPsec instance handle. |
__rte_experimental void rte_swx_ipsec_run | ( | struct rte_swx_ipsec * | ipsec | ) |
IPsec Data Plane API IPsec instance run
[in] | ipsec | IPsec instance handle. |
__rte_experimental int rte_swx_ipsec_sa_add | ( | struct rte_swx_ipsec * | ipsec, |
struct rte_swx_ipsec_sa_params * | sa_params, | ||
uint32_t * | sa_id | ||
) |
IPsec SA add
[in] | ipsec | IPsec instance handle. |
[in] | sa_params | SA parameters. |
[out] | sa_id | On success, the SA ID. |
__rte_experimental void rte_swx_ipsec_sa_delete | ( | struct rte_swx_ipsec * | ipsec, |
uint32_t | sa_id | ||
) |
IPsec SA delete
It is the responibility of the Control Plane to make sure the SA to be deleted is no longer used by the Data Plane.
[in] | ipsec | IPsec instance handle. |
[in] | sa_id | The SA ID. |
__rte_experimental struct rte_swx_ipsec_sa_params* rte_swx_ipsec_sa_read | ( | struct rte_swx_ipsec * | ipsec, |
const char * | string, | ||
int * | is_blank_or_comment, | ||
const char ** | errmsg | ||
) |
IPsec SA read from string
IPsec SA syntax:
<sa> : encrypt <crypto_params> <encap_params> | decrypt <crypto_params> <encap_params> ;
<crypto_params> : <cipher> <auth> | <aead> ;
<cipher> : cipher <ciher_alg> key <cipher_key> | cipher <cipher_alg> ;
<auth> : auth <authentication_alg> key <authentication_key> | auth <authentication_alg> ;
<aead> : aead <aead_alg> key <aead_key> ;
<encap_params> : esp spi <spi> tunnel ipv4 srcaddr <ipv4_src_addr> dstaddr <ipv4_dst_addr> | esp spi <spi> tunnel ipv6 srcaddr <ipv6_src_addr> dstaddr <ipv6_dst_addr> | esp spi <spi> transport ;
[in] | ipsec | IPsec instance handle. |
[in] | string | String containing the SA. |
[in,out] | is_blank_or_comment | On error, when its input value is not NULL, this argument is set to a non-zero value when string contains a blank or comment line and to zero otherwise. |
[in,out] | errmsg | On error, when its input value is not NULL, this argument points to a string with details on the detected error. |