blob: 4412ff331ea0c0fb0d726584143dfb08b243b0f6 [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * decap.c : IPSec tunnel decapsulation
3 *
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18#include <vnet/vnet.h>
19#include <vnet/api_errno.h>
20#include <vnet/ip/ip.h>
Damjan Marion8b3191e2016-11-09 19:54:20 +010021#include <vnet/feature/feature.h>
Piotr Bronowski993b6be2022-08-31 13:48:14 +000022#include <vnet/ipsec/ipsec_spd_fp_lookup.h>
Ed Warnickecb9cada2015-12-08 15:45:58 -070023
24#include <vnet/ipsec/ipsec.h>
25#include <vnet/ipsec/esp.h>
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080026#include <vnet/ipsec/ah.h>
Neale Ranns918c1612019-02-21 23:34:59 -080027#include <vnet/ipsec/ipsec_io.h>
Ed Warnickecb9cada2015-12-08 15:45:58 -070028
ShivaShankarK05464832020-04-14 14:01:03 +053029#define foreach_ipsec_input_error \
30_(RX_PKTS, "IPSec pkts received") \
31_(RX_POLICY_MATCH, "IPSec policy match") \
32_(RX_POLICY_NO_MATCH, "IPSec policy not matched") \
33_(RX_POLICY_BYPASS, "IPSec policy bypass") \
34_(RX_POLICY_DISCARD, "IPSec policy discard")
Ed Warnickecb9cada2015-12-08 15:45:58 -070035
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070036typedef enum
37{
Ed Warnickecb9cada2015-12-08 15:45:58 -070038#define _(sym,str) IPSEC_INPUT_ERROR_##sym,
39 foreach_ipsec_input_error
40#undef _
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070041 IPSEC_INPUT_N_ERROR,
Ed Warnickecb9cada2015-12-08 15:45:58 -070042} ipsec_input_error_t;
43
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070044static char *ipsec_input_error_strings[] = {
Ed Warnickecb9cada2015-12-08 15:45:58 -070045#define _(sym,string) string,
46 foreach_ipsec_input_error
47#undef _
48};
49
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070050typedef struct
51{
Neale Rannsa09c1ff2019-02-04 01:10:30 -080052 ip_protocol_t proto;
Pierre Pfister62219272018-11-26 09:29:00 +010053 u32 spd;
Neale Rannsa09c1ff2019-02-04 01:10:30 -080054 u32 policy_index;
Piotr Bronowski06abf232022-09-20 14:44:36 +000055 u32 policy_type;
Matus Fabian5539a072016-09-07 05:57:09 -070056 u32 sa_id;
Ed Warnickecb9cada2015-12-08 15:45:58 -070057 u32 spi;
58 u32 seq;
59} ipsec_input_trace_t;
60
61/* packet trace format function */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070062static u8 *
63format_ipsec_input_trace (u8 * s, va_list * args)
Ed Warnickecb9cada2015-12-08 15:45:58 -070064{
65 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
66 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070067 ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
Ed Warnickecb9cada2015-12-08 15:45:58 -070068
Piotr Bronowski06abf232022-09-20 14:44:36 +000069 s =
70 format (s, "%U: sa_id %u type: %u spd %u policy %d spi %u (0x%08x) seq %u",
71 format_ip_protocol, t->proto, t->sa_id, t->policy_type, t->spd,
72 t->policy_index, t->spi, t->spi, t->seq);
Matus Fabian5539a072016-09-07 05:57:09 -070073
Ed Warnickecb9cada2015-12-08 15:45:58 -070074 return s;
75}
76
Zachary Leaf7cd35f52021-06-25 08:11:15 -050077always_inline void
78ipsec4_input_spd_add_flow_cache_entry (ipsec_main_t *im, u32 sa, u32 da,
79 ipsec_spd_policy_type_t policy_type,
80 u32 pol_id)
81{
82 u64 hash;
83 u8 is_overwrite = 0, is_stale_overwrite = 0;
84 /* Store in network byte order to avoid conversion on lookup */
85 ipsec4_inbound_spd_tuple_t ip4_tuple = {
86 .ip4_src_addr = (ip4_address_t) clib_host_to_net_u32 (sa),
87 .ip4_dest_addr = (ip4_address_t) clib_host_to_net_u32 (da),
88 .policy_type = policy_type
89 };
90
91 ip4_tuple.kv_16_8.value =
92 (((u64) pol_id) << 32) | ((u64) im->input_epoch_count);
93
94 hash = ipsec4_hash_16_8 (&ip4_tuple.kv_16_8);
95 hash &= (im->ipsec4_in_spd_hash_num_buckets - 1);
96
97 ipsec_spinlock_lock (&im->ipsec4_in_spd_hash_tbl[hash].bucket_lock);
98 /* Check if we are overwriting an existing entry so we know
99 whether to increment the flow cache counter. Since flow
100 cache counter is reset on any policy add/remove, but
101 hash table values are not, we need to check if the entry
102 we are overwriting is stale or not. If it's a stale entry
103 overwrite, we still want to increment flow cache counter */
104 is_overwrite = (im->ipsec4_in_spd_hash_tbl[hash].value != 0);
105 /* Check if we are overwriting a stale entry by comparing
106 with current epoch count */
107 if (PREDICT_FALSE (is_overwrite))
108 is_stale_overwrite =
109 (im->input_epoch_count !=
110 ((u32) (im->ipsec4_in_spd_hash_tbl[hash].value & 0xFFFFFFFF)));
111 clib_memcpy_fast (&im->ipsec4_in_spd_hash_tbl[hash], &ip4_tuple.kv_16_8,
112 sizeof (ip4_tuple.kv_16_8));
113 ipsec_spinlock_unlock (&im->ipsec4_in_spd_hash_tbl[hash].bucket_lock);
114
115 /* Increment the counter to track active flow cache entries
116 when entering a fresh entry or overwriting a stale one */
117 if (!is_overwrite || is_stale_overwrite)
118 clib_atomic_fetch_add_relax (&im->ipsec4_in_spd_flow_cache_entries, 1);
119
120 return;
121}
122
Ed Warnickecb9cada2015-12-08 15:45:58 -0700123always_inline ipsec_policy_t *
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500124ipsec4_input_spd_find_flow_cache_entry (ipsec_main_t *im, u32 sa, u32 da,
125 ipsec_spd_policy_type_t policy_type)
126{
127 ipsec_policy_t *p = NULL;
128 ipsec4_hash_kv_16_8_t kv_result;
129 u64 hash;
130 ipsec4_inbound_spd_tuple_t ip4_tuple = { .ip4_src_addr = (ip4_address_t) sa,
131 .ip4_dest_addr = (ip4_address_t) da,
132 .policy_type = policy_type };
133
134 hash = ipsec4_hash_16_8 (&ip4_tuple.kv_16_8);
135 hash &= (im->ipsec4_in_spd_hash_num_buckets - 1);
136
137 ipsec_spinlock_lock (&im->ipsec4_in_spd_hash_tbl[hash].bucket_lock);
138 kv_result = im->ipsec4_in_spd_hash_tbl[hash];
139 ipsec_spinlock_unlock (&im->ipsec4_in_spd_hash_tbl[hash].bucket_lock);
140
141 if (ipsec4_hash_key_compare_16_8 ((u64 *) &ip4_tuple.kv_16_8,
142 (u64 *) &kv_result))
143 {
144 if (im->input_epoch_count == ((u32) (kv_result.value & 0xFFFFFFFF)))
145 {
146 /* Get the policy based on the index */
147 p =
148 pool_elt_at_index (im->policies, ((u32) (kv_result.value >> 32)));
149 }
150 }
151
152 return p;
153}
154
Piotr Bronowski993b6be2022-08-31 13:48:14 +0000155always_inline void
Piotr Bronowski1d9780a2022-10-21 15:48:55 +0000156ipsec_fp_in_5tuple_from_ip4_range (ipsec_fp_5tuple_t *tuple, u32 sa, u32 da,
Piotr Bronowski993b6be2022-08-31 13:48:14 +0000157 u32 spi, u8 action)
158{
159 clib_memset (tuple->l3_zero_pad, 0, sizeof (tuple->l3_zero_pad));
Piotr Bronowski1d9780a2022-10-21 15:48:55 +0000160 tuple->laddr.as_u32 = da;
161 tuple->raddr.as_u32 = sa;
Piotr Bronowski993b6be2022-08-31 13:48:14 +0000162 tuple->spi = spi;
163 tuple->action = action;
164 tuple->is_ipv6 = 0;
165}
166
Piotr Bronowski06abf232022-09-20 14:44:36 +0000167always_inline void
Piotr Bronowski1d9780a2022-10-21 15:48:55 +0000168ipsec_fp_in_5tuple_from_ip6_range (ipsec_fp_5tuple_t *tuple, ip6_address_t *sa,
169 ip6_address_t *da, u32 spi, u8 action)
Piotr Bronowski06abf232022-09-20 14:44:36 +0000170
171{
Piotr Bronowski1d9780a2022-10-21 15:48:55 +0000172 clib_memcpy (&tuple->ip6_laddr, da, sizeof (ip6_address_t));
173 clib_memcpy (&tuple->ip6_raddr, sa, sizeof (ip6_address_t));
Piotr Bronowski06abf232022-09-20 14:44:36 +0000174
175 tuple->spi = spi;
176 tuple->action = action;
177 tuple->is_ipv6 = 1;
178}
179
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500180always_inline ipsec_policy_t *
181ipsec_input_policy_match (ipsec_spd_t *spd, u32 sa, u32 da,
ShivaShankarK05464832020-04-14 14:01:03 +0530182 ipsec_spd_policy_type_t policy_type)
183{
184 ipsec_main_t *im = &ipsec_main;
185 ipsec_policy_t *p;
186 u32 *i;
187
188 vec_foreach (i, spd->policies[policy_type])
189 {
190 p = pool_elt_at_index (im->policies, *i);
191
192 if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
193 continue;
194
195 if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
196 continue;
197
198 if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
199 continue;
200
201 if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
202 continue;
203
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500204 if (im->input_flow_cache_flag)
205 {
206 /* Add an Entry in Flow cache */
207 ipsec4_input_spd_add_flow_cache_entry (im, sa, da, policy_type, *i);
208 }
ShivaShankarK05464832020-04-14 14:01:03 +0530209 return p;
210 }
211 return 0;
212}
213
214always_inline ipsec_policy_t *
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500215ipsec_input_protect_policy_match (ipsec_spd_t *spd, u32 sa, u32 da, u32 spi)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700216{
217 ipsec_main_t *im = &ipsec_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700218 ipsec_policy_t *p;
219 ipsec_sa_t *s;
220 u32 *i;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700221
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800222 vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT])
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700223 {
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800224 p = pool_elt_at_index (im->policies, *i);
Neale Rannsc5fe57d2021-02-25 16:01:28 +0000225 s = ipsec_sa_get (p->sa_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700226
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700227 if (spi != s->spi)
228 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700229
Damjan Mariond709cbc2019-03-26 13:16:42 +0100230 if (ipsec_sa_is_set_IS_TUNNEL (s))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700231 {
Neale Ranns9ec846c2021-02-09 14:04:02 +0000232 if (da != clib_net_to_host_u32 (s->tunnel.t_dst.ip.ip4.as_u32))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700233 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700234
Neale Ranns9ec846c2021-02-09 14:04:02 +0000235 if (sa != clib_net_to_host_u32 (s->tunnel.t_src.ip.ip4.as_u32))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700236 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700237
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500238 goto return_policy;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700239 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700240
Neale Rannsd2029bc2019-07-11 09:31:19 +0000241 if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700242 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700243
Neale Rannsd2029bc2019-07-11 09:31:19 +0000244 if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700245 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700246
Neale Rannsd2029bc2019-07-11 09:31:19 +0000247 if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700248 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700249
Neale Rannsd2029bc2019-07-11 09:31:19 +0000250 if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700251 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700252
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500253 return_policy:
254 if (im->input_flow_cache_flag)
255 {
256 /* Add an Entry in Flow cache */
257 ipsec4_input_spd_add_flow_cache_entry (
258 im, sa, da, IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT, *i);
259 }
260
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700261 return p;
262 }
263 return 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700264}
265
266always_inline uword
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700267ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la,
268 ip6_address_t * ua)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700269{
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700270 if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
271 (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700272 return 1;
273 return 0;
274}
275
276always_inline ipsec_policy_t *
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200277ipsec6_input_protect_policy_match (ipsec_spd_t * spd,
278 ip6_address_t * sa,
279 ip6_address_t * da, u32 spi)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700280{
281 ipsec_main_t *im = &ipsec_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700282 ipsec_policy_t *p;
283 ipsec_sa_t *s;
284 u32 *i;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700285
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800286 vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT])
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700287 {
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800288 p = pool_elt_at_index (im->policies, *i);
Neale Rannsc5fe57d2021-02-25 16:01:28 +0000289 s = ipsec_sa_get (p->sa_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700290
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700291 if (spi != s->spi)
292 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700293
Damjan Mariond709cbc2019-03-26 13:16:42 +0100294 if (ipsec_sa_is_set_IS_TUNNEL (s))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700295 {
Neale Ranns9ec846c2021-02-09 14:04:02 +0000296 if (!ip6_address_is_equal (sa, &s->tunnel.t_src.ip.ip6))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700297 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700298
Neale Ranns9ec846c2021-02-09 14:04:02 +0000299 if (!ip6_address_is_equal (da, &s->tunnel.t_dst.ip.ip6))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700300 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700301
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700302 return p;
303 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700304
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700305 if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6))
306 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700307
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700308 if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6))
309 continue;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700310
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700311 return p;
312 }
313 return 0;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700314}
315
Damjan Mariond770cfc2019-09-02 19:00:33 +0200316extern vlib_node_registration_t ipsec4_input_node;
Jean-Mickael Guerin8941ec22016-03-04 14:14:21 +0100317
Klement Sekerab8f35442018-10-29 13:38:19 +0100318VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
319 vlib_node_runtime_t * node,
ShivaShankarK05464832020-04-14 14:01:03 +0530320 vlib_frame_t * frame)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700321{
ShivaShankarK05464832020-04-14 14:01:03 +0530322 u32 n_left_from, *from, thread_index;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700323 ipsec_main_t *im = &ipsec_main;
ShivaShankarK05464832020-04-14 14:01:03 +0530324 u64 ipsec_unprocessed = 0, ipsec_matched = 0;
325 u64 ipsec_dropped = 0, ipsec_bypassed = 0;
326 vlib_buffer_t *bufs[VLIB_FRAME_SIZE];
327 vlib_buffer_t **b = bufs;
328 u16 nexts[VLIB_FRAME_SIZE], *next;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700329
ShivaShankarK05464832020-04-14 14:01:03 +0530330 from = vlib_frame_vector_args (frame);
331 n_left_from = frame->n_vectors;
332 next = nexts;
333 vlib_get_buffers (vm, from, bufs, n_left_from);
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800334 thread_index = vm->thread_index;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700335
Ed Warnickecb9cada2015-12-08 15:45:58 -0700336
337 while (n_left_from > 0)
338 {
ShivaShankarK05464832020-04-14 14:01:03 +0530339 u32 next32, pi0;
340 ip4_header_t *ip0;
341 esp_header_t *esp0 = NULL;
342 ah_header_t *ah0;
343 ip4_ipsec_config_t *c0;
344 ipsec_spd_t *spd0;
345 ipsec_policy_t *p0 = NULL;
346 u8 has_space0;
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500347 bool search_flow_cache = false;
Piotr Bronowski993b6be2022-08-31 13:48:14 +0000348 ipsec_policy_t *policies[1];
349 ipsec_fp_5tuple_t tuples[1];
350 bool ip_v6 = true;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700351
ShivaShankarK05464832020-04-14 14:01:03 +0530352 if (n_left_from > 2)
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700353 {
ShivaShankarK05464832020-04-14 14:01:03 +0530354 vlib_prefetch_buffer_data (b[1], LOAD);
355 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700356
ShivaShankarK05464832020-04-14 14:01:03 +0530357 b[0]->flags |= VNET_BUFFER_F_IS_IP4;
358 b[0]->flags &= ~VNET_BUFFER_F_IS_IP6;
359 c0 = vnet_feature_next_with_data (&next32, b[0], sizeof (c0[0]));
360 next[0] = (u16) next32;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700361
ShivaShankarK05464832020-04-14 14:01:03 +0530362 spd0 = pool_elt_at_index (im->spds, c0->spd_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700363
ShivaShankarK05464832020-04-14 14:01:03 +0530364 ip0 = vlib_buffer_get_current (b[0]);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700365
ShivaShankarK05464832020-04-14 14:01:03 +0530366 if (PREDICT_TRUE
367 (ip0->protocol == IP_PROTOCOL_IPSEC_ESP
368 || ip0->protocol == IP_PROTOCOL_UDP))
369 {
Ed Warnickecb9cada2015-12-08 15:45:58 -0700370
ShivaShankarK05464832020-04-14 14:01:03 +0530371 esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
372 if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_UDP))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700373 {
ShivaShankarK05464832020-04-14 14:01:03 +0530374 /* FIXME Skip, if not a UDP encapsulated packet */
375 esp0 = (esp_header_t *) ((u8 *) esp0 + sizeof (udp_header_t));
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700376 }
ShivaShankarK05464832020-04-14 14:01:03 +0530377
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500378 // if flow cache is enabled, first search through flow cache for a
379 // policy match for either protect, bypass or discard rules, in that
380 // order. if no match is found search_flow_cache is set to false (1)
381 // and we revert back to linear search
382 search_flow_cache = im->input_flow_cache_flag;
383
384 esp_or_udp:
Piotr Bronowski993b6be2022-08-31 13:48:14 +0000385 if (im->fp_spd_ipv4_in_is_enabled &&
386 PREDICT_TRUE (INDEX_INVALID !=
387 spd0->fp_spd.ip4_in_lookup_hash_idx))
388 {
389 ipsec_fp_in_5tuple_from_ip4_range (
390 &tuples[0], ip0->src_address.as_u32, ip0->dst_address.as_u32,
391 clib_net_to_host_u32 (esp0->spi),
392 IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT);
393 ipsec_fp_in_policy_match_n (&spd0->fp_spd, !ip_v6, tuples,
394 policies, 1);
395 p0 = policies[0];
396 }
397 else if (search_flow_cache) // attempt to match policy in flow cache
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500398 {
399 p0 = ipsec4_input_spd_find_flow_cache_entry (
400 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
401 IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT);
402 }
403
404 else // linear search if flow cache is not enabled,
405 // or flow cache search just failed
406 {
407 p0 = ipsec_input_protect_policy_match (
408 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
409 clib_net_to_host_u32 (ip0->dst_address.as_u32),
410 clib_net_to_host_u32 (esp0->spi));
411 }
ShivaShankarK05464832020-04-14 14:01:03 +0530412
413 has_space0 =
414 vlib_buffer_has_space (b[0],
415 (clib_address_t) (esp0 + 1) -
416 (clib_address_t) ip0);
417
418 if (PREDICT_TRUE ((p0 != NULL) & (has_space0)))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700419 {
ShivaShankarK05464832020-04-14 14:01:03 +0530420 ipsec_matched += 1;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800421
ShivaShankarK05464832020-04-14 14:01:03 +0530422 pi0 = p0 - im->policies;
423 vlib_increment_combined_counter
424 (&ipsec_spd_policy_counters,
425 thread_index, pi0, 1, clib_net_to_host_u16 (ip0->length));
Benoît Gannef7f49642019-10-25 15:26:27 +0200426
ShivaShankarK05464832020-04-14 14:01:03 +0530427 vnet_buffer (b[0])->ipsec.sad_index = p0->sa_index;
428 next[0] = im->esp4_decrypt_next_index;
429 vlib_buffer_advance (b[0], ((u8 *) esp0 - (u8 *) ip0));
430 goto trace0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700431 }
Kingwel Xiec69ac312019-02-04 01:49:29 -0800432 else
433 {
ShivaShankarK05464832020-04-14 14:01:03 +0530434 p0 = 0;
435 pi0 = ~0;
436 };
437
Piotr Bronowski993b6be2022-08-31 13:48:14 +0000438 if (im->fp_spd_ipv4_in_is_enabled &&
439 PREDICT_TRUE (INDEX_INVALID !=
440 spd0->fp_spd.ip4_in_lookup_hash_idx))
441 {
442 tuples->action = IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS;
443 ipsec_fp_in_policy_match_n (&spd0->fp_spd, !ip_v6, tuples,
444 policies, 1);
445 p0 = policies[0];
446 }
447 else if (search_flow_cache)
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500448 {
449 p0 = ipsec4_input_spd_find_flow_cache_entry (
450 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
451 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
452 }
453
454 else
455 {
456 p0 = ipsec_input_policy_match (
457 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
458 clib_net_to_host_u32 (ip0->dst_address.as_u32),
459 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
460 }
461
ShivaShankarK05464832020-04-14 14:01:03 +0530462 if (PREDICT_TRUE ((p0 != NULL)))
463 {
464 ipsec_bypassed += 1;
Zachary Leaffbab65b2021-06-07 03:01:07 -0500465
ShivaShankarK05464832020-04-14 14:01:03 +0530466 pi0 = p0 - im->policies;
Zachary Leaffbab65b2021-06-07 03:01:07 -0500467 vlib_increment_combined_counter (
468 &ipsec_spd_policy_counters, thread_index, pi0, 1,
469 clib_net_to_host_u16 (ip0->length));
470
ShivaShankarK05464832020-04-14 14:01:03 +0530471 goto trace0;
472 }
473 else
474 {
475 p0 = 0;
476 pi0 = ~0;
477 };
478
Piotr Bronowski993b6be2022-08-31 13:48:14 +0000479 if (im->fp_spd_ipv4_in_is_enabled &&
480 PREDICT_TRUE (INDEX_INVALID !=
481 spd0->fp_spd.ip4_in_lookup_hash_idx))
482 {
483 tuples->action = IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD;
484 ipsec_fp_in_policy_match_n (&spd0->fp_spd, !ip_v6, tuples,
485 policies, 1);
486 p0 = policies[0];
487 }
488 else
489
490 if (search_flow_cache)
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500491 {
492 p0 = ipsec4_input_spd_find_flow_cache_entry (
493 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
494 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
495 }
496
497 else
498 {
499 p0 = ipsec_input_policy_match (
500 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
501 clib_net_to_host_u32 (ip0->dst_address.as_u32),
502 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
503 }
504
ShivaShankarK05464832020-04-14 14:01:03 +0530505 if (PREDICT_TRUE ((p0 != NULL)))
506 {
507 ipsec_dropped += 1;
Zachary Leaffbab65b2021-06-07 03:01:07 -0500508
ShivaShankarK05464832020-04-14 14:01:03 +0530509 pi0 = p0 - im->policies;
Zachary Leaffbab65b2021-06-07 03:01:07 -0500510 vlib_increment_combined_counter (
511 &ipsec_spd_policy_counters, thread_index, pi0, 1,
512 clib_net_to_host_u16 (ip0->length));
513
ShivaShankarK05464832020-04-14 14:01:03 +0530514 next[0] = IPSEC_INPUT_NEXT_DROP;
515 goto trace0;
516 }
517 else
518 {
519 p0 = 0;
520 pi0 = ~0;
521 };
Zachary Leaf26fec712021-10-26 10:05:58 -0500522
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500523 // flow cache search failed, try again with linear search
524 if (search_flow_cache && p0 == NULL)
525 {
526 search_flow_cache = false;
527 goto esp_or_udp;
528 }
529
Zachary Leaf26fec712021-10-26 10:05:58 -0500530 /* Drop by default if no match on PROTECT, BYPASS or DISCARD */
531 ipsec_unprocessed += 1;
532 next[0] = IPSEC_INPUT_NEXT_DROP;
533
ShivaShankarK05464832020-04-14 14:01:03 +0530534 trace0:
535 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
536 PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
537 {
538 ipsec_input_trace_t *tr =
539 vlib_add_trace (vm, node, b[0], sizeof (*tr));
540
541 tr->proto = ip0->protocol;
542 tr->sa_id = p0 ? p0->sa_id : ~0;
543 tr->spi = has_space0 ? clib_net_to_host_u32 (esp0->spi) : ~0;
544 tr->seq = has_space0 ? clib_net_to_host_u32 (esp0->seq) : ~0;
545 tr->spd = spd0->id;
546 tr->policy_index = pi0;
547 }
548 }
549 else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
550 {
551 ah0 = (ah_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500552
553 // if flow cache is enabled, first search through flow cache for a
554 // policy match and revert back to linear search on failure
555 search_flow_cache = im->input_flow_cache_flag;
556
557 ah:
558 if (search_flow_cache)
559 {
560 p0 = ipsec4_input_spd_find_flow_cache_entry (
561 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
562 IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT);
563 }
564
565 else
566 {
567 p0 = ipsec_input_protect_policy_match (
568 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
569 clib_net_to_host_u32 (ip0->dst_address.as_u32),
570 clib_net_to_host_u32 (ah0->spi));
571 }
ShivaShankarK05464832020-04-14 14:01:03 +0530572
573 has_space0 =
574 vlib_buffer_has_space (b[0],
575 (clib_address_t) (ah0 + 1) -
576 (clib_address_t) ip0);
577
578 if (PREDICT_TRUE ((p0 != NULL) & (has_space0)))
579 {
580 ipsec_matched += 1;
581
582 pi0 = p0 - im->policies;
583 vlib_increment_combined_counter
584 (&ipsec_spd_policy_counters,
585 thread_index, pi0, 1, clib_net_to_host_u16 (ip0->length));
586
587 vnet_buffer (b[0])->ipsec.sad_index = p0->sa_index;
588 next[0] = im->ah4_decrypt_next_index;
589 goto trace1;
590 }
591 else
592 {
593 p0 = 0;
594 pi0 = ~0;
Kingwel Xiec69ac312019-02-04 01:49:29 -0800595 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700596
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500597 if (search_flow_cache)
598 {
599 p0 = ipsec4_input_spd_find_flow_cache_entry (
600 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
601 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
602 }
603
604 else
605 {
606 p0 = ipsec_input_policy_match (
607 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
608 clib_net_to_host_u32 (ip0->dst_address.as_u32),
609 IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS);
610 }
611
ShivaShankarK05464832020-04-14 14:01:03 +0530612 if (PREDICT_TRUE ((p0 != NULL)))
613 {
614 ipsec_bypassed += 1;
Zachary Leaffbab65b2021-06-07 03:01:07 -0500615
ShivaShankarK05464832020-04-14 14:01:03 +0530616 pi0 = p0 - im->policies;
Zachary Leaffbab65b2021-06-07 03:01:07 -0500617 vlib_increment_combined_counter (
618 &ipsec_spd_policy_counters, thread_index, pi0, 1,
619 clib_net_to_host_u16 (ip0->length));
620
ShivaShankarK05464832020-04-14 14:01:03 +0530621 goto trace1;
622 }
623 else
624 {
625 p0 = 0;
626 pi0 = ~0;
627 };
628
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500629 if (search_flow_cache)
630 {
631 p0 = ipsec4_input_spd_find_flow_cache_entry (
632 im, ip0->src_address.as_u32, ip0->dst_address.as_u32,
633 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
634 }
635
636 else
637 {
638 p0 = ipsec_input_policy_match (
639 spd0, clib_net_to_host_u32 (ip0->src_address.as_u32),
640 clib_net_to_host_u32 (ip0->dst_address.as_u32),
641 IPSEC_SPD_POLICY_IP4_INBOUND_DISCARD);
642 }
643
ShivaShankarK05464832020-04-14 14:01:03 +0530644 if (PREDICT_TRUE ((p0 != NULL)))
645 {
646 ipsec_dropped += 1;
Zachary Leaffbab65b2021-06-07 03:01:07 -0500647
ShivaShankarK05464832020-04-14 14:01:03 +0530648 pi0 = p0 - im->policies;
Zachary Leaffbab65b2021-06-07 03:01:07 -0500649 vlib_increment_combined_counter (
650 &ipsec_spd_policy_counters, thread_index, pi0, 1,
651 clib_net_to_host_u16 (ip0->length));
652
ShivaShankarK05464832020-04-14 14:01:03 +0530653 next[0] = IPSEC_INPUT_NEXT_DROP;
654 goto trace1;
655 }
656 else
657 {
658 p0 = 0;
659 pi0 = ~0;
660 };
Zachary Leaf26fec712021-10-26 10:05:58 -0500661
Zachary Leaf7cd35f52021-06-25 08:11:15 -0500662 // flow cache search failed, retry with linear search
663 if (search_flow_cache && p0 == NULL)
664 {
665 search_flow_cache = false;
666 goto ah;
667 }
668
Zachary Leaf26fec712021-10-26 10:05:58 -0500669 /* Drop by default if no match on PROTECT, BYPASS or DISCARD */
670 ipsec_unprocessed += 1;
671 next[0] = IPSEC_INPUT_NEXT_DROP;
672
ShivaShankarK05464832020-04-14 14:01:03 +0530673 trace1:
674 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
675 PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
676 {
677 ipsec_input_trace_t *tr =
678 vlib_add_trace (vm, node, b[0], sizeof (*tr));
679
680 tr->proto = ip0->protocol;
681 tr->sa_id = p0 ? p0->sa_id : ~0;
682 tr->spi = has_space0 ? clib_net_to_host_u32 (ah0->spi) : ~0;
683 tr->seq = has_space0 ? clib_net_to_host_u32 (ah0->seq_no) : ~0;
684 tr->spd = spd0->id;
685 tr->policy_index = pi0;
686 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700687 }
ShivaShankarK05464832020-04-14 14:01:03 +0530688 else
689 {
690 ipsec_unprocessed += 1;
691 }
692 n_left_from -= 1;
693 b += 1;
694 next += 1;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700695 }
Kingwel Xiec69ac312019-02-04 01:49:29 -0800696
ShivaShankarK05464832020-04-14 14:01:03 +0530697 vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700698
Kingwel Xiec69ac312019-02-04 01:49:29 -0800699 vlib_node_increment_counter (vm, ipsec4_input_node.index,
ShivaShankarK05464832020-04-14 14:01:03 +0530700 IPSEC_INPUT_ERROR_RX_PKTS, frame->n_vectors);
701
702 vlib_node_increment_counter (vm, ipsec4_input_node.index,
703 IPSEC_INPUT_ERROR_RX_POLICY_MATCH,
Kingwel Xiec69ac312019-02-04 01:49:29 -0800704 ipsec_matched);
ShivaShankarK05464832020-04-14 14:01:03 +0530705
706 vlib_node_increment_counter (vm, ipsec4_input_node.index,
707 IPSEC_INPUT_ERROR_RX_POLICY_NO_MATCH,
708 ipsec_unprocessed);
709
710 vlib_node_increment_counter (vm, ipsec4_input_node.index,
711 IPSEC_INPUT_ERROR_RX_POLICY_DISCARD,
712 ipsec_dropped);
713
714 vlib_node_increment_counter (vm, ipsec4_input_node.index,
715 IPSEC_INPUT_ERROR_RX_POLICY_BYPASS,
716 ipsec_bypassed);
717
718 return frame->n_vectors;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700719}
720
721
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700722/* *INDENT-OFF* */
Damjan Mariond770cfc2019-09-02 19:00:33 +0200723VLIB_REGISTER_NODE (ipsec4_input_node) = {
Pierre Pfister057b3562018-12-10 17:01:01 +0100724 .name = "ipsec4-input-feature",
Ed Warnickecb9cada2015-12-08 15:45:58 -0700725 .vector_size = sizeof (u32),
726 .format_trace = format_ipsec_input_trace,
727 .type = VLIB_NODE_TYPE_INTERNAL,
Ed Warnickecb9cada2015-12-08 15:45:58 -0700728 .n_errors = ARRAY_LEN(ipsec_input_error_strings),
729 .error_strings = ipsec_input_error_strings,
Ed Warnickecb9cada2015-12-08 15:45:58 -0700730 .n_next_nodes = IPSEC_INPUT_N_NEXT,
731 .next_nodes = {
732#define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
733 foreach_ipsec_input_next
734#undef _
735 },
736};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700737/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700738
Damjan Mariond770cfc2019-09-02 19:00:33 +0200739extern vlib_node_registration_t ipsec6_input_node;
Damjan Marion1c80e832016-05-11 23:07:18 +0200740
Klement Sekerab8f35442018-10-29 13:38:19 +0100741
742VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
743 vlib_node_runtime_t * node,
744 vlib_frame_t * from_frame)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700745{
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800746 u32 n_left_from, *from, next_index, *to_next, thread_index;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700747 ipsec_main_t *im = &ipsec_main;
Kingwel Xiec69ac312019-02-04 01:49:29 -0800748 u32 ipsec_unprocessed = 0;
749 u32 ipsec_matched = 0;
Piotr Bronowski06abf232022-09-20 14:44:36 +0000750 ipsec_policy_t *policies[1];
751 ipsec_fp_5tuple_t tuples[1];
752 bool ip_v6 = true;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700753
754 from = vlib_frame_vector_args (from_frame);
755 n_left_from = from_frame->n_vectors;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800756 thread_index = vm->thread_index;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700757
758 next_index = node->cached_next_index;
759
760 while (n_left_from > 0)
761 {
762 u32 n_left_to_next;
763
764 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
765
766 while (n_left_from > 0 && n_left_to_next > 0)
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700767 {
Piotr Bronowski06abf232022-09-20 14:44:36 +0000768 u32 bi0, next0, pi0 = ~0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700769 vlib_buffer_t *b0;
770 ip6_header_t *ip0;
771 esp_header_t *esp0;
772 ip4_ipsec_config_t *c0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700773 ipsec_spd_t *spd0;
Matus Fabian5539a072016-09-07 05:57:09 -0700774 ipsec_policy_t *p0 = 0;
Klement Sekera611864f2018-09-26 11:19:00 +0200775 ah_header_t *ah0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700776 u32 header_size = sizeof (ip0[0]);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700777
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700778 bi0 = to_next[0] = from[0];
779 from += 1;
780 n_left_from -= 1;
781 to_next += 1;
782 n_left_to_next -= 1;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700783
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700784 b0 = vlib_get_buffer (vm, bi0);
Szymon Sliwa65a27272018-05-09 14:28:08 +0200785 b0->flags |= VNET_BUFFER_F_IS_IP6;
786 b0->flags &= ~VNET_BUFFER_F_IS_IP4;
Damjan Marion7d98a122018-07-19 20:42:08 +0200787 c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700788
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700789 spd0 = pool_elt_at_index (im->spds, c0->spd_index);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700790
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700791 ip0 = vlib_buffer_get_current (b0);
792 esp0 = (esp_header_t *) ((u8 *) ip0 + header_size);
Klement Sekera611864f2018-09-26 11:19:00 +0200793 ah0 = (ah_header_t *) ((u8 *) ip0 + header_size);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700794
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700795 if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
796 {
Ed Warnickecb9cada2015-12-08 15:45:58 -0700797#if 0
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700798 clib_warning
799 ("packet received from %U to %U spi %u size %u spd_id %u",
800 format_ip6_address, &ip0->src_address, format_ip6_address,
801 &ip0->dst_address, clib_net_to_host_u32 (esp0->spi),
802 clib_net_to_host_u16 (ip0->payload_length) + header_size,
803 spd0->id);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700804#endif
Piotr Bronowski06abf232022-09-20 14:44:36 +0000805 if (im->fp_spd_ipv6_in_is_enabled &&
806 PREDICT_TRUE (INDEX_INVALID !=
807 spd0->fp_spd.ip6_in_lookup_hash_idx))
808 {
809 ipsec_fp_in_5tuple_from_ip6_range (
810 &tuples[0], &ip0->src_address, &ip0->dst_address,
811 clib_net_to_host_u32 (esp0->spi),
812 IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT);
813 ipsec_fp_in_policy_match_n (&spd0->fp_spd, ip_v6, tuples,
814 policies, 1);
815 p0 = policies[0];
816 }
817 else
818 p0 = ipsec6_input_protect_policy_match (
819 spd0, &ip0->src_address, &ip0->dst_address,
820 clib_net_to_host_u32 (esp0->spi));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700821
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700822 if (PREDICT_TRUE (p0 != 0))
823 {
Kingwel Xiec69ac312019-02-04 01:49:29 -0800824 ipsec_matched += 1;
825
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800826 pi0 = p0 - im->policies;
827 vlib_increment_combined_counter
828 (&ipsec_spd_policy_counters,
829 thread_index, pi0, 1,
830 clib_net_to_host_u16 (ip0->payload_length) +
831 header_size);
Kingwel Xiec69ac312019-02-04 01:49:29 -0800832
Damjan Marion9c6ae5f2016-11-15 23:20:01 +0100833 vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200834 next0 = im->esp6_decrypt_next_index;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700835 vlib_buffer_advance (b0, header_size);
Piotr Bronowski06abf232022-09-20 14:44:36 +0000836 /* TODO Add policy matching for bypass and discard policy
837 * type */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700838 goto trace0;
839 }
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800840 else
841 {
842 pi0 = ~0;
Zachary Leaf26fec712021-10-26 10:05:58 -0500843 ipsec_unprocessed += 1;
844 next0 = IPSEC_INPUT_NEXT_DROP;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800845 }
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700846 }
Klement Sekera611864f2018-09-26 11:19:00 +0200847 else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
848 {
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200849 p0 = ipsec6_input_protect_policy_match (spd0,
850 &ip0->src_address,
851 &ip0->dst_address,
852 clib_net_to_host_u32
853 (ah0->spi));
Klement Sekera611864f2018-09-26 11:19:00 +0200854
855 if (PREDICT_TRUE (p0 != 0))
856 {
Kingwel Xiec69ac312019-02-04 01:49:29 -0800857 ipsec_matched += 1;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800858 pi0 = p0 - im->policies;
859 vlib_increment_combined_counter
860 (&ipsec_spd_policy_counters,
861 thread_index, pi0, 1,
862 clib_net_to_host_u16 (ip0->payload_length) +
863 header_size);
Kingwel Xiec69ac312019-02-04 01:49:29 -0800864
Klement Sekera611864f2018-09-26 11:19:00 +0200865 vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200866 next0 = im->ah6_decrypt_next_index;
Klement Sekera611864f2018-09-26 11:19:00 +0200867 goto trace0;
868 }
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800869 else
870 {
871 pi0 = ~0;
Zachary Leaf26fec712021-10-26 10:05:58 -0500872 ipsec_unprocessed += 1;
873 next0 = IPSEC_INPUT_NEXT_DROP;
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800874 }
Klement Sekera611864f2018-09-26 11:19:00 +0200875 }
Kingwel Xiec69ac312019-02-04 01:49:29 -0800876 else
877 {
878 ipsec_unprocessed += 1;
879 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700880
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700881 trace0:
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800882 if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
883 PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700884 {
885 ipsec_input_trace_t *tr =
886 vlib_add_trace (vm, node, b0, sizeof (*tr));
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800887
888 if (p0)
Piotr Bronowski06abf232022-09-20 14:44:36 +0000889 {
890 tr->sa_id = p0->sa_id;
891 tr->policy_type = p0->type;
892 }
893
Neale Rannsa09c1ff2019-02-04 01:10:30 -0800894 tr->proto = ip0->protocol;
895 tr->spi = clib_net_to_host_u32 (esp0->spi);
896 tr->seq = clib_net_to_host_u32 (esp0->seq);
897 tr->spd = spd0->id;
Piotr Bronowski06abf232022-09-20 14:44:36 +0000898 tr->policy_index = pi0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700899 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700900
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700901 vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
902 n_left_to_next, bi0, next0);
903 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700904 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
905 }
Kingwel Xiec69ac312019-02-04 01:49:29 -0800906
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200907 vlib_node_increment_counter (vm, ipsec6_input_node.index,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700908 IPSEC_INPUT_ERROR_RX_PKTS,
Kingwel Xiec69ac312019-02-04 01:49:29 -0800909 from_frame->n_vectors - ipsec_unprocessed);
910
911 vlib_node_increment_counter (vm, ipsec6_input_node.index,
ShivaShankarK05464832020-04-14 14:01:03 +0530912 IPSEC_INPUT_ERROR_RX_POLICY_MATCH,
Kingwel Xiec69ac312019-02-04 01:49:29 -0800913 ipsec_matched);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700914
915 return from_frame->n_vectors;
916}
917
918
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700919/* *INDENT-OFF* */
Damjan Mariond770cfc2019-09-02 19:00:33 +0200920VLIB_REGISTER_NODE (ipsec6_input_node) = {
Pierre Pfister057b3562018-12-10 17:01:01 +0100921 .name = "ipsec6-input-feature",
Ed Warnickecb9cada2015-12-08 15:45:58 -0700922 .vector_size = sizeof (u32),
923 .format_trace = format_ipsec_input_trace,
924 .type = VLIB_NODE_TYPE_INTERNAL,
Ed Warnickecb9cada2015-12-08 15:45:58 -0700925 .n_errors = ARRAY_LEN(ipsec_input_error_strings),
926 .error_strings = ipsec_input_error_strings,
Kingwel Xiec69ac312019-02-04 01:49:29 -0800927 .n_next_nodes = IPSEC_INPUT_N_NEXT,
928 .next_nodes = {
929#define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
930 foreach_ipsec_input_next
931#undef _
932 },
Ed Warnickecb9cada2015-12-08 15:45:58 -0700933};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700934/* *INDENT-ON* */
Damjan Marion1c80e832016-05-11 23:07:18 +0200935
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700936/*
937 * fd.io coding-style-patch-verification: ON
938 *
939 * Local Variables:
940 * eval: (c-set-style "gnu")
941 * End:
942 */