blob: 861d27c1233b371757683a62cac960492be93f3d [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * ipsec_if_in.c : IPSec interface input node
3 *
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18#include <vnet/vnet.h>
19#include <vnet/api_errno.h>
20#include <vnet/ip/ip.h>
21
22#include <vnet/ipsec/ipsec.h>
23#include <vnet/ipsec/esp.h>
24
25/* Statistics (not really errors) */
26#define foreach_ipsec_if_input_error \
27_(RX, "good packets received")
28
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070029static char *ipsec_if_input_error_strings[] = {
Ed Warnickecb9cada2015-12-08 15:45:58 -070030#define _(sym,string) string,
31 foreach_ipsec_if_input_error
32#undef _
33};
34
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070035typedef enum
36{
Ed Warnickecb9cada2015-12-08 15:45:58 -070037#define _(sym,str) IPSEC_IF_INPUT_ERROR_##sym,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070038 foreach_ipsec_if_input_error
Ed Warnickecb9cada2015-12-08 15:45:58 -070039#undef _
40 IPSEC_IF_INPUT_N_ERROR,
41} ipsec_if_input_error_t;
42
Ed Warnickecb9cada2015-12-08 15:45:58 -070043
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070044typedef struct
45{
Ed Warnickecb9cada2015-12-08 15:45:58 -070046 u32 spi;
47 u32 seq;
48} ipsec_if_input_trace_t;
49
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070050u8 *
51format_ipsec_if_input_trace (u8 * s, va_list * args)
Ed Warnickecb9cada2015-12-08 15:45:58 -070052{
53 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
54 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070055 ipsec_if_input_trace_t *t = va_arg (*args, ipsec_if_input_trace_t *);
Ed Warnickecb9cada2015-12-08 15:45:58 -070056
57 s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq);
58 return s;
59}
60
61static uword
62ipsec_if_input_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070063 vlib_frame_t * from_frame)
Ed Warnickecb9cada2015-12-08 15:45:58 -070064{
65 ipsec_main_t *im = &ipsec_main;
Matthew Smith01034be2017-05-16 11:51:18 -050066 vnet_main_t *vnm = im->vnet_main;
67 vnet_interface_main_t *vim = &vnm->interface_main;
68 esp_main_t *em = &esp_main;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070069 u32 *from, *to_next = 0, next_index;
Matthew Smith01034be2017-05-16 11:51:18 -050070 u32 n_left_from, last_sw_if_index = ~0;
71 u32 thread_index = vlib_get_thread_index ();
72 u64 n_bytes = 0, n_packets = 0;
73 u8 icv_len;
74 ipsec_tunnel_if_t *last_t = NULL;
75 ipsec_sa_t *sa0;
Ed Warnickecb9cada2015-12-08 15:45:58 -070076
77 from = vlib_frame_vector_args (from_frame);
78 n_left_from = from_frame->n_vectors;
79 next_index = node->cached_next_index;
80
81 while (n_left_from > 0)
82 {
83 u32 n_left_to_next;
84
85 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
86
87 while (n_left_from > 0 && n_left_to_next > 0)
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070088 {
Matthew Smith01034be2017-05-16 11:51:18 -050089 u32 bi0, next0, sw_if_index0;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070090 vlib_buffer_t *b0;
91 ip4_header_t *ip0;
92 esp_header_t *esp0;
93 uword *p;
Ed Warnickecb9cada2015-12-08 15:45:58 -070094
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070095 bi0 = to_next[0] = from[0];
96 from += 1;
97 n_left_from -= 1;
98 to_next += 1;
99 n_left_to_next -= 1;
100 b0 = vlib_get_buffer (vm, bi0);
101 ip0 = vlib_buffer_get_current (b0);
102 esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
Ed Warnickecb9cada2015-12-08 15:45:58 -0700103
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000104 next0 = IPSEC_INPUT_NEXT_DROP;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700105
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700106 u64 key = (u64) ip0->src_address.as_u32 << 32 |
107 (u64) clib_net_to_host_u32 (esp0->spi);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700108
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700109 p = hash_get (im->ipsec_if_pool_index_by_key, key);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700110
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700111 if (p)
112 {
113 ipsec_tunnel_if_t *t;
114 t = pool_elt_at_index (im->tunnel_interfaces, p[0]);
Damjan Marion9c6ae5f2016-11-15 23:20:01 +0100115 vnet_buffer (b0)->ipsec.sad_index = t->input_sa_index;
Matthew Smith01034be2017-05-16 11:51:18 -0500116 if (t->hw_if_index != ~0)
117 {
118 vnet_hw_interface_t *hi;
119
120 vnet_buffer (b0)->ipsec.flags = 0;
121 hi = vnet_get_hw_interface (vnm, t->hw_if_index);
122 sw_if_index0 = hi->sw_if_index;
123
124 if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index))
125 {
126 n_packets++;
127 n_bytes += vlib_buffer_length_in_chain (vm, b0);
128 }
129 else
130 {
131 sa0 = pool_elt_at_index (im->sad, t->input_sa_index);
132 icv_len = em->esp_integ_algs[sa0->integ_alg].trunc_size;
133
134 /* length = packet length - ESP/tunnel overhead */
135 n_bytes -= n_packets * (sizeof (ip4_header_t) +
136 sizeof (esp_header_t) +
137 sizeof (esp_footer_t) +
138 16 /* aes-cbc IV */ + icv_len);
139
140 if (last_t)
141 {
142 vlib_increment_combined_counter
143 (vim->combined_sw_if_counters
144 + VNET_INTERFACE_COUNTER_RX,
145 thread_index, sw_if_index0, n_packets, n_bytes);
146 }
147
148 last_sw_if_index = sw_if_index0;
149 last_t = t;
150 n_packets = 1;
151 n_bytes = vlib_buffer_length_in_chain (vm, b0);
152 }
153 }
154 else
155 {
156 vnet_buffer (b0)->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
157 }
158
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700159 vlib_buffer_advance (b0, ip4_header_bytes (ip0));
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000160 next0 = im->esp_decrypt_next_index;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700161 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700162
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700163 if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
164 {
165 ipsec_if_input_trace_t *tr =
166 vlib_add_trace (vm, node, b0, sizeof (*tr));
167 tr->spi = clib_host_to_net_u32 (esp0->spi);
168 tr->seq = clib_host_to_net_u32 (esp0->seq);
169 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700170
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700171 vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
172 n_left_to_next, bi0, next0);
173 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700174 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
175 }
176
Matthew Smith01034be2017-05-16 11:51:18 -0500177 if (last_t)
178 {
179 sa0 = pool_elt_at_index (im->sad, last_t->input_sa_index);
180 icv_len = em->esp_integ_algs[sa0->integ_alg].trunc_size;
181
182 n_bytes -= n_packets * (sizeof (ip4_header_t) + sizeof (esp_header_t) +
183 sizeof (esp_footer_t) + 16 /* aes-cbc IV */ +
184 icv_len);
185 vlib_increment_combined_counter (vim->combined_sw_if_counters
186 + VNET_INTERFACE_COUNTER_RX,
187 thread_index,
188 last_sw_if_index, n_packets, n_bytes);
189 }
190
Ed Warnickecb9cada2015-12-08 15:45:58 -0700191 vlib_node_increment_counter (vm, ipsec_if_input_node.index,
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700192 IPSEC_IF_INPUT_ERROR_RX,
193 from_frame->n_vectors);
Ed Warnickecb9cada2015-12-08 15:45:58 -0700194
195 return from_frame->n_vectors;
196}
197
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700198/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -0700199VLIB_REGISTER_NODE (ipsec_if_input_node) = {
200 .function = ipsec_if_input_node_fn,
201 .name = "ipsec-if-input",
202 .vector_size = sizeof (u32),
203 .format_trace = format_ipsec_if_input_trace,
204 .type = VLIB_NODE_TYPE_INTERNAL,
205
206 .n_errors = ARRAY_LEN(ipsec_if_input_error_strings),
207 .error_strings = ipsec_if_input_error_strings,
208
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000209 .sibling_of = "ipsec-input-ip4",
Damjan Marion1c80e832016-05-11 23:07:18 +0200210};
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700211/* *INDENT-ON* */
Damjan Marion1c80e832016-05-11 23:07:18 +0200212
213VLIB_NODE_FUNCTION_MULTIARCH (ipsec_if_input_node, ipsec_if_input_node_fn)
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700214/*
215 * fd.io coding-style-patch-verification: ON
216 *
217 * Local Variables:
218 * eval: (c-set-style "gnu")
219 * End:
220 */