Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * ipsec_if_in.c : IPSec interface input node |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | |
| 22 | #include <vnet/ipsec/ipsec.h> |
| 23 | #include <vnet/ipsec/esp.h> |
| 24 | |
| 25 | /* Statistics (not really errors) */ |
| 26 | #define foreach_ipsec_if_input_error \ |
| 27 | _(RX, "good packets received") |
| 28 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 29 | static char *ipsec_if_input_error_strings[] = { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 30 | #define _(sym,string) string, |
| 31 | foreach_ipsec_if_input_error |
| 32 | #undef _ |
| 33 | }; |
| 34 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 35 | typedef enum |
| 36 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 37 | #define _(sym,str) IPSEC_IF_INPUT_ERROR_##sym, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 38 | foreach_ipsec_if_input_error |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 39 | #undef _ |
| 40 | IPSEC_IF_INPUT_N_ERROR, |
| 41 | } ipsec_if_input_error_t; |
| 42 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 43 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 44 | typedef struct |
| 45 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 46 | u32 spi; |
| 47 | u32 seq; |
| 48 | } ipsec_if_input_trace_t; |
| 49 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 50 | u8 * |
| 51 | format_ipsec_if_input_trace (u8 * s, va_list * args) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 52 | { |
| 53 | CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); |
| 54 | CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 55 | ipsec_if_input_trace_t *t = va_arg (*args, ipsec_if_input_trace_t *); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 56 | |
| 57 | s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq); |
| 58 | return s; |
| 59 | } |
| 60 | |
| 61 | static uword |
| 62 | ipsec_if_input_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 63 | vlib_frame_t * from_frame) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 64 | { |
| 65 | ipsec_main_t *im = &ipsec_main; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 66 | vnet_main_t *vnm = im->vnet_main; |
| 67 | vnet_interface_main_t *vim = &vnm->interface_main; |
| 68 | esp_main_t *em = &esp_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 69 | u32 *from, *to_next = 0, next_index; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 70 | u32 n_left_from, last_sw_if_index = ~0; |
| 71 | u32 thread_index = vlib_get_thread_index (); |
| 72 | u64 n_bytes = 0, n_packets = 0; |
| 73 | u8 icv_len; |
| 74 | ipsec_tunnel_if_t *last_t = NULL; |
| 75 | ipsec_sa_t *sa0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 76 | |
| 77 | from = vlib_frame_vector_args (from_frame); |
| 78 | n_left_from = from_frame->n_vectors; |
| 79 | next_index = node->cached_next_index; |
| 80 | |
| 81 | while (n_left_from > 0) |
| 82 | { |
| 83 | u32 n_left_to_next; |
| 84 | |
| 85 | vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); |
| 86 | |
| 87 | while (n_left_from > 0 && n_left_to_next > 0) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 88 | { |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 89 | u32 bi0, next0, sw_if_index0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 90 | vlib_buffer_t *b0; |
| 91 | ip4_header_t *ip0; |
| 92 | esp_header_t *esp0; |
| 93 | uword *p; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 94 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 95 | bi0 = to_next[0] = from[0]; |
| 96 | from += 1; |
| 97 | n_left_from -= 1; |
| 98 | to_next += 1; |
| 99 | n_left_to_next -= 1; |
| 100 | b0 = vlib_get_buffer (vm, bi0); |
| 101 | ip0 = vlib_buffer_get_current (b0); |
| 102 | esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 103 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 104 | next0 = IPSEC_INPUT_NEXT_DROP; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 105 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 106 | u64 key = (u64) ip0->src_address.as_u32 << 32 | |
| 107 | (u64) clib_net_to_host_u32 (esp0->spi); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 108 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 109 | p = hash_get (im->ipsec_if_pool_index_by_key, key); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 110 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 111 | if (p) |
| 112 | { |
| 113 | ipsec_tunnel_if_t *t; |
| 114 | t = pool_elt_at_index (im->tunnel_interfaces, p[0]); |
Damjan Marion | 9c6ae5f | 2016-11-15 23:20:01 +0100 | [diff] [blame] | 115 | vnet_buffer (b0)->ipsec.sad_index = t->input_sa_index; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 116 | if (t->hw_if_index != ~0) |
| 117 | { |
| 118 | vnet_hw_interface_t *hi; |
| 119 | |
| 120 | vnet_buffer (b0)->ipsec.flags = 0; |
| 121 | hi = vnet_get_hw_interface (vnm, t->hw_if_index); |
| 122 | sw_if_index0 = hi->sw_if_index; |
Matthew Smith | 02e14b5 | 2017-09-14 09:05:35 -0500 | [diff] [blame] | 123 | vnet_buffer (b0)->sw_if_index[VLIB_RX] = sw_if_index0; |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 124 | |
| 125 | if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index)) |
| 126 | { |
| 127 | n_packets++; |
| 128 | n_bytes += vlib_buffer_length_in_chain (vm, b0); |
| 129 | } |
| 130 | else |
| 131 | { |
| 132 | sa0 = pool_elt_at_index (im->sad, t->input_sa_index); |
| 133 | icv_len = em->esp_integ_algs[sa0->integ_alg].trunc_size; |
| 134 | |
| 135 | /* length = packet length - ESP/tunnel overhead */ |
| 136 | n_bytes -= n_packets * (sizeof (ip4_header_t) + |
| 137 | sizeof (esp_header_t) + |
| 138 | sizeof (esp_footer_t) + |
| 139 | 16 /* aes-cbc IV */ + icv_len); |
| 140 | |
| 141 | if (last_t) |
| 142 | { |
| 143 | vlib_increment_combined_counter |
| 144 | (vim->combined_sw_if_counters |
| 145 | + VNET_INTERFACE_COUNTER_RX, |
| 146 | thread_index, sw_if_index0, n_packets, n_bytes); |
| 147 | } |
| 148 | |
| 149 | last_sw_if_index = sw_if_index0; |
| 150 | last_t = t; |
| 151 | n_packets = 1; |
| 152 | n_bytes = vlib_buffer_length_in_chain (vm, b0); |
| 153 | } |
| 154 | } |
| 155 | else |
| 156 | { |
| 157 | vnet_buffer (b0)->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL; |
| 158 | } |
| 159 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 160 | vlib_buffer_advance (b0, ip4_header_bytes (ip0)); |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 161 | next0 = im->esp_decrypt_next_index; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 162 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 163 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 164 | if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) |
| 165 | { |
| 166 | ipsec_if_input_trace_t *tr = |
| 167 | vlib_add_trace (vm, node, b0, sizeof (*tr)); |
| 168 | tr->spi = clib_host_to_net_u32 (esp0->spi); |
| 169 | tr->seq = clib_host_to_net_u32 (esp0->seq); |
| 170 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 171 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 172 | vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, |
| 173 | n_left_to_next, bi0, next0); |
| 174 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 175 | vlib_put_next_frame (vm, node, next_index, n_left_to_next); |
| 176 | } |
| 177 | |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 178 | if (last_t) |
| 179 | { |
| 180 | sa0 = pool_elt_at_index (im->sad, last_t->input_sa_index); |
| 181 | icv_len = em->esp_integ_algs[sa0->integ_alg].trunc_size; |
| 182 | |
| 183 | n_bytes -= n_packets * (sizeof (ip4_header_t) + sizeof (esp_header_t) + |
| 184 | sizeof (esp_footer_t) + 16 /* aes-cbc IV */ + |
| 185 | icv_len); |
| 186 | vlib_increment_combined_counter (vim->combined_sw_if_counters |
| 187 | + VNET_INTERFACE_COUNTER_RX, |
| 188 | thread_index, |
| 189 | last_sw_if_index, n_packets, n_bytes); |
| 190 | } |
| 191 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 192 | vlib_node_increment_counter (vm, ipsec_if_input_node.index, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 193 | IPSEC_IF_INPUT_ERROR_RX, |
| 194 | from_frame->n_vectors); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 195 | |
| 196 | return from_frame->n_vectors; |
| 197 | } |
| 198 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 199 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 200 | VLIB_REGISTER_NODE (ipsec_if_input_node) = { |
| 201 | .function = ipsec_if_input_node_fn, |
| 202 | .name = "ipsec-if-input", |
| 203 | .vector_size = sizeof (u32), |
| 204 | .format_trace = format_ipsec_if_input_trace, |
| 205 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 206 | |
| 207 | .n_errors = ARRAY_LEN(ipsec_if_input_error_strings), |
| 208 | .error_strings = ipsec_if_input_error_strings, |
| 209 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 210 | .sibling_of = "ipsec-input-ip4", |
Damjan Marion | 1c80e83 | 2016-05-11 23:07:18 +0200 | [diff] [blame] | 211 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 212 | /* *INDENT-ON* */ |
Damjan Marion | 1c80e83 | 2016-05-11 23:07:18 +0200 | [diff] [blame] | 213 | |
| 214 | VLIB_NODE_FUNCTION_MULTIARCH (ipsec_if_input_node, ipsec_if_input_node_fn) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 215 | /* |
| 216 | * fd.io coding-style-patch-verification: ON |
| 217 | * |
| 218 | * Local Variables: |
| 219 | * eval: (c-set-style "gnu") |
| 220 | * End: |
| 221 | */ |