/*
 **************************************************************************
 * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
 * Permission to use, copy, modify, and/or distribute this software for
 * any purpose with or without fee is hereby granted, provided that the
 * above copyright notice and this permission notice appear in all copies.
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 **************************************************************************
 */

/*
 * nss_dtlsmgr.h
 *	DTLS manager interface definitions.
 */
#ifndef _NSS_DTLSMGR_H_
#define _NSS_DTLSMGR_H_

/**
 * NSS DTLS manager flags
 */
#define NSS_DTLSMGR_HDR_IPV6		0x00000001	/**< L3 header is v6 or v4 */
#define NSS_DTLSMGR_HDR_UDPLITE		0x00000002	/**< L4 header is UDP-Lite or UDP */
#define NSS_DTLSMGR_HDR_CAPWAP		0x00000004	/**< CAPWAP-DTLS or DTLS header */
#define NSS_DTLSMGR_CIPHER_MODE_GCM	0x00000008	/**< Cipher mode is GCM */
#define NSS_DTLSMGR_ENCAP_UDPLITE_CSUM	0x00010000	/**< Checksum UDP-Lite header */
#define NSS_DTLSMGR_ENCAP_METADATA	0x00020000	/**< Packets will have metadata for encapsulation. */
#define NSS_DTLSMGR_DECAP_ACCEPT_ALL	0x00040000	/**< Send all error packets after DECAP */

/*
 * DTLS header mask
 */
#define NSS_DTLSMGR_HDR_MASK (NSS_DTLSMGR_HDR_IPV6 | NSS_DTLSMGR_HDR_UDPLITE | NSS_DTLSMGR_HDR_CAPWAP)

/*
 * DTLS crypto feature mask
 */
#define NSS_DTLSMGR_CRYPTO_MASK NSS_DTLSMGR_CIPHER_MODE_GCM

/*
 * DTLS encapsulation specific flags mask
 */
#define NSS_DTLSMGR_ENCAP_MASK (NSS_DTLSMGR_ENCAP_UDPLITE_CSUM | NSS_DTLSMGR_ENCAP_METADATA)

/*
 * DTLS decapsulation specific flags mask
 */
#define NSS_DTLSMGR_DECAP_MASK NSS_DTLSMGR_DECAP_ACCEPT_ALL

/**
 * NSS DTLS manager TX metadata flags
 */
#define NSS_DTLSMGR_METADATA_MAGIC 0x8993		/**< Magic in DTLS metadata */
#define NSS_DTLSMGR_METADATA_FLAG_ENC 0x0001		/**< Metadata valid for encapsulation. */
#define NSS_DTLSMGR_METADATA_FLAG_SEQ 0x0002		/**< Metadata has a valid sequence no. */
#define NSS_DTLSMGR_METADATA_FLAG_CTYPE 0x0004		/**< Metadata has a valid DTLS content type */

/*
 * NSS DTLS manager reserved size of header
 */
#define NSS_DTLSMGR_NEEDED_HEADROOM_SZ 128
#define NSS_DTLSMGR_NEEDED_TAILROOM_SZ 128

/**
 * NSS DTLS manager status
 */
typedef enum nss_dtlsmgr_status {
	NSS_DTLSMGR_OK,			/**< Status ok. */
	NSS_DTLSMGR_FAIL,		/**< Failed due to unknown reason. */
	NSS_DTLSMGR_FAIL_NOMEM,		/**< Failed to allocate memory. */
	NSS_DTLSMGR_FAIL_NOCRYPTO,	/**< Failed to allocate crypto resource. */
	NSS_DTLSMGR_FAIL_MESSAGE,	/**< Failed to message the NSS. */
	NSS_DTLSMGR_INVALID_VERSION,	/**< Invalid DTLS version. */
	NSS_DTLSMGR_INVALID_ALGO,	/**< Invalid algorithm. */
	NSS_DTLSMGR_INVALID_KEYLEN,	/**< Invalid key length for cipher/auth. */
} nss_dtlsmgr_status_t;

/**
 * DTLS protocol version
 */
enum nss_dtlsmgr_dtlsver {
	NSS_DTLSMGR_VERSION_1_0,	/**< Protocol v1.0. */
	NSS_DTLSMGR_VERSION_1_2,	/**< Protocol v1.2. */
};

/**
 * DTLS interface type
 */
enum nss_dtlsmgr_interface_type {
	NSS_DTLSMGR_INTERFACE_TYPE_NONE,
	NSS_DTLSMGR_INTERFACE_TYPE_INNER,	/**< DTLS encapsulation interface */
	NSS_DTLSMGR_INTERFACE_TYPE_OUTER,	/**< DTLS decapsulation interface */
	NSS_DTLSMGR_INTERFACE_TYPE_MAX
};

/**
 * NSS DTLS manager supported cryptographic algorithms
 */
enum nss_dtlsmgr_algo {
	NSS_DTLSMGR_ALGO_AES_CBC_SHA1_HMAC,	/**< AES_CBC_SHA1_HMAC. */
	NSS_DTLSMGR_ALGO_AES_CBC_SHA256_HMAC,	/**< AES_CBC_SHA256_HMAC. */
	NSS_DTLSMGR_ALGO_3DES_CBC_SHA1_HMAC,	/**< 3DES_CBC_SHA1_HMAC. */
	NSS_DTLSMGR_ALGO_3DES_CBC_SHA256_HMAC,	/**< 3DES_CBC_SHA256_HMAC. */
	NSS_DTLSMGR_ALGO_AES_GCM,		/**< AES_GCM. */
	NSS_DTLSMGR_ALGO_MAX
};

/**
 * NSS DTLS manager metadata ctype
 */
enum nss_dtlsmgr_metadata_ctype {
	NSS_DTLSMGR_METADATA_CTYPE_CCS = 20,		/**< DTLS packet is change cipher specification.*/
	NSS_DTLSMGR_METADATA_CTYPE_ALERT = 21,		/**< DTLS packet is Alert.*/
	NSS_DTLSMGR_METADATA_CTYPE_HANDSHAKE = 22,	/**< DTLS packet is Handshake.*/
	NSS_DTLSMGR_METADATA_CTYPE_APP = 23,		/**< DTLS packet is Application data. */
};

/**
 * NSS DTLS manager metadata result type
 */
enum nss_dtlsmgr_metadata_result {
	NSS_DTLSMGR_METADATA_RESULT_OK = 0,		/**< Result OK. */
	NSS_DTLSMGR_METADATA_RESULT_AUTH_FAIL = 1,	/**< Authenication failure. */
	NSS_DTLSMGR_METADATA_RESULT_CIPHER_FAIL = 2,	/**< Cipher failure. */
	NSS_DTLSMGR_METADATA_RESULT_MAX,
};

/**
 * NSS DTLS manager cryptographic structure to represent key and its length.
 */
struct nss_dtlsmgr_crypto_data {
	const uint8_t *data;		/**< Pointer to key or nonce. */
	uint16_t len;			/**< Length of the key. */
};

/**
 * NSS DTLS manager cryptographic data
 */
struct nss_dtlsmgr_crypto {
	enum nss_dtlsmgr_algo algo;			/**< DTLS manager cryptographic algorithm. */
	struct nss_dtlsmgr_crypto_data cipher_key;	/**< Cipher key. */
	struct nss_dtlsmgr_crypto_data auth_key;	/**< Authentication key. */
	struct nss_dtlsmgr_crypto_data nonce;		/**< Nonce. */
};

/**
 * NSS DTLS manager session encapsulation data
 */
struct nss_dtlsmgr_encap_config {
	struct nss_dtlsmgr_crypto crypto;	/**< Encapsulation crypto configuration. */
	enum nss_dtlsmgr_dtlsver ver;		/**< Version used in DTLS header. */
	uint32_t sip[4];			/**< Source IP address. */
	uint32_t dip[4];			/**< Destination IP address. */
	uint16_t sport;				/**< Source UDP port. */
	uint16_t dport;				/**< Destination UDP port. */
	uint16_t epoch;				/**< Epoch. */
	uint8_t ip_ttl;				/**< IP time to live. */
	uint8_t dscp;				/**< DSCP. */
	bool dscp_copy;				/**< Flag to check if DSCP needs to be copied. */
	bool df;				/**< Flag to check fragmentation. */
};

/**
 * NSS DTLS manager session decapsulation data
 */
struct nss_dtlsmgr_decap_config {
	struct nss_dtlsmgr_crypto crypto;	/**< Decap Crypto configuration. */
	uint32_t nexthop_ifnum;			/**< NSS I/F number to forward after de-capsulation. */
	uint16_t window_size;			/**< Anti-Replay window size. */
};

/*
 * NSS DTLS manager hardware statistics
 */
struct nss_dtlsmgr_hw_stats {
	uint64_t len_error;             /**< Length error. */
	uint64_t token_error;           /**< Token error, unknown token command/instruction. */
	uint64_t bypass_error;          /**< Token contains too much bypass data. */
	uint64_t config_error;          /**< Invalid command/algorithm/mode/combination. */
	uint64_t algo_error;            /**< Unsupported algorithm. */
	uint64_t hash_ovf_error;        /**< Hash input overflow. */
	uint64_t ttl_error;             /**< TTL or HOP-Limit underflow. */
	uint64_t csum_error;            /**< Checksum error. */
	uint64_t timeout_error;         /**< Data timed-out. */
};

/**
 * NSS DTLS manager session statistics
 */
struct nss_dtlsmgr_stats {
	uint64_t tx_packets;		/**< Tx packets. */
	uint64_t tx_bytes;		/**< Tx bytes. */
	uint64_t rx_packets;		/**< Rx packets. */
	uint64_t rx_bytes;		/**< Rx bytes. */
	uint64_t rx_dropped;		/**< Rx drops. */
	uint64_t rx_single_rec;		/**< Received single DTLS record datagrams. */
	uint64_t rx_multi_rec;		/**< Received multiple DTLS record datagrams. */
	uint64_t fail_crypto_resource;	/**< Failure in allocation of crypto resource. */
	uint64_t fail_crypto_enqueue;	/**< Failure due to queue full in crypto or hardware. */
	uint64_t fail_headroom;		/**< Failure in headroom check. */
	uint64_t fail_tailroom;		/**< Failure in tailroom check. */
	uint64_t fail_ver;		/**< Failure in DTLS version check. */
	uint64_t fail_epoch;		/**< Failure in DTLS epoch check. */
	uint64_t fail_dtls_record;	/**< Failure in reading DTLS record. */
	uint64_t fail_capwap;		/**< Failure in Capwap classification. */
	uint64_t fail_replay;		/**< Failure in anti-replay check. */
	uint64_t fail_replay_dup;	/**< Failure in anti-replay; duplicate records. */
	uint64_t fail_replay_win;	/**< Failure in anti-replay; packet outside the window. */
	uint64_t fail_queue;		/**< Failure due to queue full in DTLS. */
	uint64_t fail_queue_nexthop;	/**< Failure due to queue full in next_hop. */
	uint64_t fail_pbuf_alloc;	/**< Failure in pbuf allocation. */
	uint64_t fail_pbuf_linear;	/**< Failure in pbuf linearization. */
	uint64_t fail_pbuf_stats;	/**< Failure in pbuf allocation for stats. */
	uint64_t fail_pbuf_align;	/**< Failure in pbuf alignment. */
	uint64_t fail_ctx_active;	/**< Failure in enqueue due to no active context. */
	uint64_t fail_hwctx_active;	/**< Failure in enqueue due to no active HW context. */
	uint64_t fail_cipher;		/**< Failure in decrypting the data. */
	uint64_t fail_auth;		/**< Failure in authenticating the data. */
	uint64_t fail_seq_ovf;		/**< Failure due to sequence number overflow. */
	uint64_t fail_blk_len;		/**< Failure in decapsulation due to bad cipher block length. */
	uint64_t fail_hash_len;		/**< Failure in decapsulation due to bad hash block length. */

	struct nss_dtlsmgr_hw_stats fail_hw;
					/**< Hardware failure statistics. */

	uint64_t fail_cle[NSS_DTLS_CMN_CLE_MAX];
					/**< Classification errors. */

	uint64_t fail_host_tx;		/**< Failure at host TX. */
	uint64_t fail_host_rx;		/**< Failure at host RX. */

	uint32_t seq_low;		/**< Lower 32 bits of current Tx sequence number. */
	uint32_t seq_high;		/**< Upper 16 bits of current Tx sequence number. */

	uint16_t epoch;			/**< Current Epoch value. */
};

#ifdef __KERNEL__ /* only for kernel use. */

/**
 * NSS DTLS manager session stats update callback
 */
typedef void (*nss_dtlsmgr_notify_callback_t)(void *app_data, struct net_device *dev,
						struct nss_dtlsmgr_stats *stats, bool encap);
typedef void (*nss_dtlsmgr_data_callback_t)(void *app_data, struct sk_buff *skb);

/**
 * NSS DTLS manager session definition
 */
struct nss_dtlsmgr_config {
	uint32_t flags;					/**< DTLS header flags. */
	void *app_data;					/**< Opaque data returned in callback. */

	nss_dtlsmgr_notify_callback_t notify;		/**< Statistics notifcation callback. */
	nss_dtlsmgr_data_callback_t data;		/**< Data callback. */

	struct nss_dtlsmgr_encap_config encap;		/**< Encap data. */
	struct nss_dtlsmgr_decap_config decap;		/**< Decap data. */
};

#endif /* __KERNEL__ */
/**
 * NSS DTLS manager session tx/rx cipher update parameters
 */
struct nss_dtlsmgr_config_update {
	struct nss_dtlsmgr_crypto crypto;	/**< Crypto algorithm and key data. */
	uint16_t epoch;				/**< Epoch. */
	uint16_t window_size;			/**< Anti-Replay window size. */
};

/**
 * NSS DTLS manager metadata
 */
struct nss_dtlsmgr_metadata {
	uint8_t ctype;		/**< Type of DTLS packet. */
	uint8_t result;		/**< Error during DTLS decapsulation. */
	uint16_t len;		/**< Length of DTLS payload. */
	uint32_t seq;		/**< Sequence for encapsulation. */
	uint16_t flags;		/**< Metadata flags. */
	uint16_t magic;		/**< Magic. */
};

#ifdef __KERNEL__ /* only for kernel use. */

/**
 * nss_dtlsmgr_metadata_init
 *	Initializes the metadata at SKB head
 *
 * @param skb[IN] Socket buffer
 *
 * @return
 * Return NSS DTLSMGR metadata start address
 */
static inline struct nss_dtlsmgr_metadata *nss_dtlsmgr_metadata_init(struct sk_buff *skb)
{
	struct nss_dtlsmgr_metadata *ndm;

	if (unlikely(skb_headroom(skb) < sizeof(*ndm)))
		return NULL;

	ndm = (struct nss_dtlsmgr_metadata *)skb_push(skb, sizeof(*ndm));
	/*
	 * Initialize the metadata with default values
	 */
	ndm->flags = NSS_DTLSMGR_METADATA_FLAG_ENC;
	ndm->ctype = NSS_DTLSMGR_METADATA_CTYPE_APP;
	ndm->magic = NSS_DTLSMGR_METADATA_MAGIC;
	ndm->len = skb->len - sizeof(*ndm);
	ndm->seq = U32_MAX;
	ndm->result = 0;

	return ndm;
}

/**
 * nss_dtlsmgr_metadata_set_seq
 *	Update the metadata with sequence number for the first encap packet
 *
 * @param ndtm[IN] NSS DTLSMGR metadata
 * @param seq[IN]  Starting sequence number for the tunnel encapsulation
 */
static inline void nss_dtlsmgr_metadata_set_seq(struct nss_dtlsmgr_metadata *ndm, uint32_t seq)
{
	ndm->flags |= NSS_DTLSMGR_METADATA_FLAG_SEQ;
	ndm->seq = seq;
}

/**
 * nss_dtlsmgr_metadata_set_ctype
 *	Update the metadata with DTLS content type
 *
 * @param ndtm[IN]  NSS DTLSMGR metadata
 * @param ctype[IN] DTLS content type for encapsulation
 */
static inline void nss_dtlsmgr_metadata_set_ctype(struct nss_dtlsmgr_metadata *ndm, enum nss_dtlsmgr_metadata_ctype ctype)
{
	ndm->flags |= NSS_DTLSMGR_METADATA_FLAG_CTYPE;
	ndm->ctype = ctype;
}

/**
 * nss_dtlsmgr_metadata_get_ctype
 *	Returns the type of DTLS payload
 *
 * @param ndm[IN] DTLS metadata header
 *
 * @return
 * NSS_DTLSMGR_METADATA_CTYPE_APP for normal data
 */
static inline enum nss_dtlsmgr_metadata_ctype nss_dtlsmgr_metadata_get_ctype(struct nss_dtlsmgr_metadata *ndm)
{
	return ndm->ctype;
}

/**
 * nss_dtlsmgr_metadata_get_error
 *	Returns the error seen during decapsulation
 *
 * @param ndm[IN] DTLS metadata header
 *
 * @return
 * NSS_DTLSMGR_METADATA_RESULT_OK for success
 */
static inline enum nss_dtlsmgr_metadata_result nss_dtlsmgr_metadata_get_result(struct nss_dtlsmgr_metadata *ndm)
{
	return ndm->result;
}

/**
 * nss_dtlsmgr_metadata_verify_magic
 *	Returns true if magic pattern matches
 *
 * @param ndm[IN] DTLS metadata header
 *
 * @return
 * true for success
 */
static inline bool nss_dtlsmgr_metadata_verify_magic(struct nss_dtlsmgr_metadata *ndm)
{
	return ndm->magic == NSS_DTLSMGR_METADATA_MAGIC;
}

/**
 * nss_dtlsmgr_session_create
 *	Create a NSS DTLS session and associated crypto sessions
 *
 * @param in_data[IN] DTLS session create data
 * @param out_data[out] Return parameters from DTLS session create operation
 *
 * @return
 * NSS_DTLSMGR_OK for success
 */
struct net_device *nss_dtlsmgr_session_create(struct nss_dtlsmgr_config *cfg);

/**
 * nss_dtlsmgr_session_destroy
 *	Destroy a NSS DTLS session and associated crypto sessions
 *
 * @param dtls_if[IN] NSS DTLS I/F
 *
 * @return
 * NSS_DTLSMGR_OK for success
 */
nss_dtlsmgr_status_t nss_dtlsmgr_session_destroy(struct net_device *dev);

/**
 * nss_dtlsmgr_session_update_encap
 *	Update encapsulation cipher state of a DTLS session.
 *	Configures new parameters into the pending encapsulation cipher
 *	state of a DTLS session. This has no effect on the current
 *	cipher state and its processing of packets.
 *
 * @param dev[IN] DTLS network device
 * @param cfg[IN] DTLS session update parameters
 *
 * @return NSS_DTLSMGR_OK for success
 */
nss_dtlsmgr_status_t nss_dtlsmgr_session_update_encap(struct net_device *dev, struct nss_dtlsmgr_config_update *cfg);

/**
 * nss_dtlsmgr_session_update_decap
 *	Update decapsulation cipher state of a DTLS session.
 *	Configures new parameters into the pending decapsulation cipher
 *	state of a DTLS session. This has no effect on the current
 *	cipher state and its processing of packets.
 *
 * @param dev[IN] DTLS network device
 * @param cfg[IN] DTLS session update parameters
 *
 * @return NSS_DTLSMGR_OK for success
 */
nss_dtlsmgr_status_t nss_dtlsmgr_session_update_decap(struct net_device *dev, struct nss_dtlsmgr_config_update *cfg);

/**
 * nss_dtlsmgr_session_switch_encap
 *	Switch DTLS session from current to new for encapsulation
 *
 * @param dev[in] DTLS network device
 *
 * @return TRUE for success
 */
bool nss_dtlsmgr_session_switch_encap(struct net_device *dev);

/**
 * nss_dtlsmgr_session_switch_decap
 *	Switch DTLS session from current to new for de-capsulation
 *
 * @param dev[in] DTLS network device
 *
 * @return TRUE for success
 */
bool nss_dtlsmgr_session_switch_decap(struct net_device *dev);

/**
 * nss_dtlmsgr_get_interface
 *	Get the NSS interface number for encap/decap interface.
 *
 * @param dev[in] DTLS network device
 * @param type[in] DTLS interface type
 *
 * @return interface number for success
 */
int32_t nss_dtlsmgr_get_interface(struct net_device *dev, enum nss_dtlsmgr_interface_type type);
#endif /* __KERNEL__ */
#endif /* _NSS_DTLSMGR_H_ */