| 221 | } |
| 222 | |
| 223 | int |
| 224 | esp_outbound(struct rte_mbuf *m, struct ipsec_sa *sa, |
| 225 | struct rte_crypto_op *cop) |
| 226 | { |
| 227 | struct ip *ip4; |
| 228 | struct ip6_hdr *ip6; |
| 229 | struct rte_esp_hdr *esp = NULL; |
| 230 | uint8_t *padding = NULL, *new_ip, nlp; |
| 231 | struct rte_crypto_sym_op *sym_cop; |
| 232 | int32_t i; |
| 233 | uint16_t pad_payload_len, pad_len, ip_hdr_len; |
| 234 | struct rte_ipsec_session *ips; |
| 235 | |
| 236 | RTE_ASSERT(m != NULL); |
| 237 | RTE_ASSERT(sa != NULL); |
| 238 | |
| 239 | ips = ipsec_get_primary_session(sa); |
| 240 | ip_hdr_len = 0; |
| 241 | |
| 242 | ip4 = rte_pktmbuf_mtod(m, struct ip *); |
| 243 | if (likely(ip4->ip_v == IPVERSION)) { |
| 244 | if (unlikely(IS_TRANSPORT(sa->flags))) { |
| 245 | ip_hdr_len = ip4->ip_hl * 4; |
| 246 | nlp = ip4->ip_p; |
| 247 | } else |
| 248 | nlp = IPPROTO_IPIP; |
| 249 | } else if (ip4->ip_v == IP6_VERSION) { |
| 250 | if (unlikely(IS_TRANSPORT(sa->flags))) { |
| 251 | /* XXX No option headers supported */ |
| 252 | ip_hdr_len = sizeof(struct ip6_hdr); |
| 253 | ip6 = (struct ip6_hdr *)ip4; |
| 254 | nlp = ip6->ip6_nxt; |
| 255 | } else |
| 256 | nlp = IPPROTO_IPV6; |
| 257 | } else { |
| 258 | RTE_LOG(ERR, IPSEC_ESP, "invalid IP packet type %d\n", |
| 259 | ip4->ip_v); |
| 260 | return -EINVAL; |
| 261 | } |
| 262 | |
| 263 | /* Padded payload length */ |
| 264 | pad_payload_len = RTE_ALIGN_CEIL(rte_pktmbuf_pkt_len(m) - |
| 265 | ip_hdr_len + 2, sa->block_size); |
| 266 | pad_len = pad_payload_len + ip_hdr_len - rte_pktmbuf_pkt_len(m); |
| 267 | |
| 268 | RTE_ASSERT(IS_TUNNEL(sa->flags) || IS_TRANSPORT(sa->flags)); |
| 269 | |
| 270 | if (likely(IS_IP4_TUNNEL(sa->flags))) |
| 271 | ip_hdr_len = sizeof(struct ip); |
| 272 | else if (IS_IP6_TUNNEL(sa->flags)) |
| 273 | ip_hdr_len = sizeof(struct ip6_hdr); |
| 274 | else if (!IS_TRANSPORT(sa->flags)) { |
| 275 | RTE_LOG(ERR, IPSEC_ESP, "Unsupported SA flags: 0x%x\n", |
| 276 | sa->flags); |
| 277 | return -EINVAL; |
| 278 | } |
| 279 | |
| 280 | /* Check maximum packet size */ |
nothing calls this directly
no test coverage detected