Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * ipsec_if_in.c : IPSec interface input node |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | |
| 22 | #include <vnet/ipsec/ipsec.h> |
| 23 | #include <vnet/ipsec/esp.h> |
| 24 | |
| 25 | /* Statistics (not really errors) */ |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 26 | #define foreach_ipsec_if_input_error \ |
| 27 | _(RX, "good packets received") \ |
| 28 | _(DISABLED, "ipsec packets received on disabled interface") |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 29 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 30 | static char *ipsec_if_input_error_strings[] = { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 31 | #define _(sym,string) string, |
| 32 | foreach_ipsec_if_input_error |
| 33 | #undef _ |
| 34 | }; |
| 35 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 36 | typedef enum |
| 37 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 38 | #define _(sym,str) IPSEC_IF_INPUT_ERROR_##sym, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 39 | foreach_ipsec_if_input_error |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 40 | #undef _ |
| 41 | IPSEC_IF_INPUT_N_ERROR, |
| 42 | } ipsec_if_input_error_t; |
| 43 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 44 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 45 | typedef struct |
| 46 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 47 | u32 spi; |
| 48 | u32 seq; |
| 49 | } ipsec_if_input_trace_t; |
| 50 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 51 | u8 * |
| 52 | format_ipsec_if_input_trace (u8 * s, va_list * args) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 53 | { |
| 54 | CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); |
| 55 | CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 56 | ipsec_if_input_trace_t *t = va_arg (*args, ipsec_if_input_trace_t *); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 57 | |
| 58 | s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq); |
| 59 | return s; |
| 60 | } |
| 61 | |
Klement Sekera | b8f3544 | 2018-10-29 13:38:19 +0100 | [diff] [blame] | 62 | VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm, |
| 63 | vlib_node_runtime_t * node, |
| 64 | vlib_frame_t * from_frame) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 65 | { |
| 66 | ipsec_main_t *im = &ipsec_main; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 67 | vnet_main_t *vnm = im->vnet_main; |
| 68 | vnet_interface_main_t *vim = &vnm->interface_main; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 69 | ipsec_proto_main_t *em = &ipsec_proto_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 70 | u32 *from, *to_next = 0, next_index; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 71 | u32 n_left_from, last_sw_if_index = ~0; |
Damjan Marion | 067cd62 | 2018-07-11 12:47:43 +0200 | [diff] [blame] | 72 | u32 thread_index = vm->thread_index; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 73 | u64 n_bytes = 0, n_packets = 0; |
| 74 | u8 icv_len; |
| 75 | ipsec_tunnel_if_t *last_t = NULL; |
| 76 | ipsec_sa_t *sa0; |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 77 | vlib_combined_counter_main_t *rx_counter; |
| 78 | vlib_combined_counter_main_t *drop_counter; |
| 79 | u32 n_disabled = 0; |
| 80 | |
| 81 | rx_counter = vim->combined_sw_if_counters + VNET_INTERFACE_COUNTER_RX; |
| 82 | drop_counter = vim->combined_sw_if_counters + VNET_INTERFACE_COUNTER_DROP; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 83 | |
| 84 | from = vlib_frame_vector_args (from_frame); |
| 85 | n_left_from = from_frame->n_vectors; |
| 86 | next_index = node->cached_next_index; |
| 87 | |
| 88 | while (n_left_from > 0) |
| 89 | { |
| 90 | u32 n_left_to_next; |
| 91 | |
| 92 | vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); |
| 93 | |
| 94 | while (n_left_from > 0 && n_left_to_next > 0) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 95 | { |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 96 | u32 bi0, next0, sw_if_index0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 97 | vlib_buffer_t *b0; |
| 98 | ip4_header_t *ip0; |
| 99 | esp_header_t *esp0; |
| 100 | uword *p; |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 101 | u32 len0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 102 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 103 | bi0 = to_next[0] = from[0]; |
| 104 | from += 1; |
| 105 | n_left_from -= 1; |
| 106 | to_next += 1; |
| 107 | n_left_to_next -= 1; |
| 108 | b0 = vlib_get_buffer (vm, bi0); |
| 109 | ip0 = vlib_buffer_get_current (b0); |
| 110 | esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 111 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 112 | next0 = IPSEC_INPUT_NEXT_DROP; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 113 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 114 | u64 key = (u64) ip0->src_address.as_u32 << 32 | |
| 115 | (u64) clib_net_to_host_u32 (esp0->spi); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 116 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 117 | p = hash_get (im->ipsec_if_pool_index_by_key, key); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 118 | |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 119 | len0 = vlib_buffer_length_in_chain (vm, b0); |
| 120 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 121 | if (p) |
| 122 | { |
| 123 | ipsec_tunnel_if_t *t; |
| 124 | t = pool_elt_at_index (im->tunnel_interfaces, p[0]); |
Damjan Marion | 9c6ae5f | 2016-11-15 23:20:01 +0100 | [diff] [blame] | 125 | vnet_buffer (b0)->ipsec.sad_index = t->input_sa_index; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 126 | if (t->hw_if_index != ~0) |
| 127 | { |
| 128 | vnet_hw_interface_t *hi; |
| 129 | |
| 130 | vnet_buffer (b0)->ipsec.flags = 0; |
| 131 | hi = vnet_get_hw_interface (vnm, t->hw_if_index); |
| 132 | sw_if_index0 = hi->sw_if_index; |
Matthew Smith | 02e14b5 | 2017-09-14 09:05:35 -0500 | [diff] [blame] | 133 | vnet_buffer (b0)->sw_if_index[VLIB_RX] = sw_if_index0; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 134 | |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 135 | if (PREDICT_FALSE |
| 136 | (!(hi->flags & VNET_HW_INTERFACE_FLAG_LINK_UP))) |
| 137 | { |
| 138 | vlib_increment_combined_counter |
| 139 | (drop_counter, thread_index, sw_if_index0, 1, len0); |
| 140 | b0->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED]; |
| 141 | n_disabled++; |
| 142 | goto trace; |
| 143 | } |
| 144 | |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 145 | if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index)) |
| 146 | { |
| 147 | n_packets++; |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 148 | n_bytes += len0; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 149 | } |
| 150 | else |
| 151 | { |
| 152 | sa0 = pool_elt_at_index (im->sad, t->input_sa_index); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 153 | icv_len = |
| 154 | em->ipsec_proto_main_integ_algs[sa0-> |
| 155 | integ_alg].trunc_size; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 156 | |
| 157 | /* length = packet length - ESP/tunnel overhead */ |
| 158 | n_bytes -= n_packets * (sizeof (ip4_header_t) + |
| 159 | sizeof (esp_header_t) + |
| 160 | sizeof (esp_footer_t) + |
| 161 | 16 /* aes-cbc IV */ + icv_len); |
| 162 | |
| 163 | if (last_t) |
| 164 | { |
| 165 | vlib_increment_combined_counter |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 166 | (rx_counter, thread_index, sw_if_index0, |
| 167 | n_packets, n_bytes); |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 168 | } |
| 169 | |
| 170 | last_sw_if_index = sw_if_index0; |
| 171 | last_t = t; |
| 172 | n_packets = 1; |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 173 | n_bytes = len0; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 174 | } |
| 175 | } |
| 176 | else |
| 177 | { |
| 178 | vnet_buffer (b0)->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL; |
| 179 | } |
| 180 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 181 | vlib_buffer_advance (b0, ip4_header_bytes (ip0)); |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 182 | next0 = im->esp4_decrypt_next_index; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 183 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 184 | |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 185 | trace: |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 186 | if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) |
| 187 | { |
| 188 | ipsec_if_input_trace_t *tr = |
| 189 | vlib_add_trace (vm, node, b0, sizeof (*tr)); |
| 190 | tr->spi = clib_host_to_net_u32 (esp0->spi); |
| 191 | tr->seq = clib_host_to_net_u32 (esp0->seq); |
| 192 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 193 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 194 | vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, |
| 195 | n_left_to_next, bi0, next0); |
| 196 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 197 | vlib_put_next_frame (vm, node, next_index, n_left_to_next); |
| 198 | } |
| 199 | |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 200 | if (last_t) |
| 201 | { |
| 202 | sa0 = pool_elt_at_index (im->sad, last_t->input_sa_index); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 203 | icv_len = em->ipsec_proto_main_integ_algs[sa0->integ_alg].trunc_size; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 204 | |
| 205 | n_bytes -= n_packets * (sizeof (ip4_header_t) + sizeof (esp_header_t) + |
| 206 | sizeof (esp_footer_t) + 16 /* aes-cbc IV */ + |
| 207 | icv_len); |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 208 | vlib_increment_combined_counter (rx_counter, |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 209 | thread_index, |
| 210 | last_sw_if_index, n_packets, n_bytes); |
| 211 | } |
| 212 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 213 | vlib_node_increment_counter (vm, ipsec_if_input_node.index, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 214 | IPSEC_IF_INPUT_ERROR_RX, |
Matthew Smith | 831fd64 | 2018-05-15 22:03:05 -0500 | [diff] [blame] | 215 | from_frame->n_vectors - n_disabled); |
| 216 | |
| 217 | vlib_node_increment_counter (vm, ipsec_if_input_node.index, |
| 218 | IPSEC_IF_INPUT_ERROR_DISABLED, n_disabled); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 219 | |
| 220 | return from_frame->n_vectors; |
| 221 | } |
| 222 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 223 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 224 | VLIB_REGISTER_NODE (ipsec_if_input_node) = { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 225 | .name = "ipsec-if-input", |
| 226 | .vector_size = sizeof (u32), |
| 227 | .format_trace = format_ipsec_if_input_trace, |
| 228 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 229 | |
| 230 | .n_errors = ARRAY_LEN(ipsec_if_input_error_strings), |
| 231 | .error_strings = ipsec_if_input_error_strings, |
| 232 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 233 | .sibling_of = "ipsec4-input", |
Damjan Marion | 1c80e83 | 2016-05-11 23:07:18 +0200 | [diff] [blame] | 234 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 235 | /* *INDENT-ON* */ |
Damjan Marion | 1c80e83 | 2016-05-11 23:07:18 +0200 | [diff] [blame] | 236 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 237 | /* |
| 238 | * fd.io coding-style-patch-verification: ON |
| 239 | * |
| 240 | * Local Variables: |
| 241 | * eval: (c-set-style "gnu") |
| 242 | * End: |
| 243 | */ |