Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * decap.c : IPSec tunnel support |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | #include <vnet/interface.h> |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 22 | #include <vnet/fib/fib_table.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 23 | |
| 24 | #include <vnet/ipsec/ipsec.h> |
| 25 | |
| 26 | u8 * |
| 27 | format_ipsec_policy_action (u8 * s, va_list * args) |
| 28 | { |
| 29 | u32 i = va_arg (*args, u32); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 30 | char *t = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 31 | |
| 32 | switch (i) |
| 33 | { |
| 34 | #define _(v,f,str) case IPSEC_POLICY_ACTION_##f: t = str; break; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 35 | foreach_ipsec_policy_action |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 36 | #undef _ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 37 | default: |
| 38 | s = format (s, "unknown"); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 39 | } |
| 40 | s = format (s, "%s", t); |
| 41 | return s; |
| 42 | } |
| 43 | |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 44 | u8 * |
| 45 | format_ipsec_policy_type (u8 * s, va_list * args) |
| 46 | { |
| 47 | u32 i = va_arg (*args, u32); |
| 48 | char *t = 0; |
| 49 | |
| 50 | switch (i) |
| 51 | { |
| 52 | #define _(f,str) case IPSEC_SPD_POLICY_##f: t = str; break; |
| 53 | foreach_ipsec_spd_policy_type |
| 54 | #undef _ |
| 55 | default: |
| 56 | s = format (s, "unknown"); |
| 57 | } |
| 58 | s = format (s, "%s", t); |
| 59 | return s; |
| 60 | } |
| 61 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 62 | uword |
| 63 | unformat_ipsec_policy_action (unformat_input_t * input, va_list * args) |
| 64 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 65 | u32 *r = va_arg (*args, u32 *); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 66 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 67 | if (0); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 68 | #define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_POLICY_ACTION_##f; |
| 69 | foreach_ipsec_policy_action |
| 70 | #undef _ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 71 | else |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 72 | return 0; |
| 73 | return 1; |
| 74 | } |
| 75 | |
| 76 | u8 * |
| 77 | format_ipsec_crypto_alg (u8 * s, va_list * args) |
| 78 | { |
| 79 | u32 i = va_arg (*args, u32); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 80 | u8 *t = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 81 | |
| 82 | switch (i) |
| 83 | { |
| 84 | #define _(v,f,str) case IPSEC_CRYPTO_ALG_##f: t = (u8 *) str; break; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 85 | foreach_ipsec_crypto_alg |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 86 | #undef _ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 87 | default: |
| 88 | s = format (s, "unknown"); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 89 | } |
| 90 | s = format (s, "%s", t); |
| 91 | return s; |
| 92 | } |
| 93 | |
| 94 | uword |
| 95 | unformat_ipsec_crypto_alg (unformat_input_t * input, va_list * args) |
| 96 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 97 | u32 *r = va_arg (*args, u32 *); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 98 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 99 | if (0); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 100 | #define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_CRYPTO_ALG_##f; |
| 101 | foreach_ipsec_crypto_alg |
| 102 | #undef _ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 103 | else |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 104 | return 0; |
| 105 | return 1; |
| 106 | } |
| 107 | |
| 108 | u8 * |
| 109 | format_ipsec_integ_alg (u8 * s, va_list * args) |
| 110 | { |
| 111 | u32 i = va_arg (*args, u32); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 112 | u8 *t = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 113 | |
| 114 | switch (i) |
| 115 | { |
| 116 | #define _(v,f,str) case IPSEC_INTEG_ALG_##f: t = (u8 *) str; break; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 117 | foreach_ipsec_integ_alg |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 118 | #undef _ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 119 | default: |
| 120 | s = format (s, "unknown"); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 121 | } |
| 122 | s = format (s, "%s", t); |
| 123 | return s; |
| 124 | } |
| 125 | |
| 126 | uword |
| 127 | unformat_ipsec_integ_alg (unformat_input_t * input, va_list * args) |
| 128 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 129 | u32 *r = va_arg (*args, u32 *); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 130 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 131 | if (0); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 132 | #define _(v,f,s) else if (unformat (input, s)) *r = IPSEC_INTEG_ALG_##f; |
| 133 | foreach_ipsec_integ_alg |
| 134 | #undef _ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 135 | else |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 136 | return 0; |
| 137 | return 1; |
| 138 | } |
| 139 | |
| 140 | u8 * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 141 | format_ipsec_replay_window (u8 * s, va_list * args) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 142 | { |
| 143 | u64 w = va_arg (*args, u64); |
| 144 | u8 i; |
| 145 | |
| 146 | for (i = 0; i < 64; i++) |
| 147 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 148 | s = format (s, "%u", w & (1ULL << i) ? 1 : 0); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 149 | } |
| 150 | |
| 151 | return s; |
| 152 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 153 | |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 154 | u8 * |
| 155 | format_ipsec_policy (u8 * s, va_list * args) |
| 156 | { |
| 157 | u32 pi = va_arg (*args, u32); |
| 158 | ipsec_main_t *im = &ipsec_main; |
| 159 | ipsec_policy_t *p; |
| 160 | vlib_counter_t counts; |
| 161 | |
| 162 | p = pool_elt_at_index (im->policies, pi); |
| 163 | |
Neale Ranns | 9f231d4 | 2019-03-19 10:06:00 +0000 | [diff] [blame] | 164 | s = format (s, " [%d] priority %d action %U type %U protocol ", |
| 165 | pi, p->priority, |
| 166 | format_ipsec_policy_action, p->policy, |
| 167 | format_ipsec_policy_type, p->type); |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 168 | if (p->protocol) |
| 169 | { |
| 170 | s = format (s, "%U", format_ip_protocol, p->protocol); |
| 171 | } |
| 172 | else |
| 173 | { |
| 174 | s = format (s, "any"); |
| 175 | } |
| 176 | if (p->policy == IPSEC_POLICY_ACTION_PROTECT) |
| 177 | { |
| 178 | s = format (s, " sa %u", p->sa_id); |
| 179 | } |
Neale Ranns | 231c469 | 2019-03-18 17:11:28 +0000 | [diff] [blame] | 180 | |
| 181 | s = format (s, "\n local addr range %U - %U port range %u - %u", |
| 182 | format_ip46_address, &p->laddr.start, IP46_TYPE_ANY, |
| 183 | format_ip46_address, &p->laddr.stop, IP46_TYPE_ANY, |
| 184 | clib_net_to_host_u16 (p->lport.start), |
| 185 | clib_net_to_host_u16 (p->lport.stop)); |
| 186 | s = format (s, "\n remote addr range %U - %U port range %u - %u", |
| 187 | format_ip46_address, &p->raddr.start, IP46_TYPE_ANY, |
| 188 | format_ip46_address, &p->raddr.stop, IP46_TYPE_ANY, |
| 189 | clib_net_to_host_u16 (p->rport.start), |
| 190 | clib_net_to_host_u16 (p->rport.stop)); |
| 191 | |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 192 | vlib_get_combined_counter (&ipsec_spd_policy_counters, pi, &counts); |
| 193 | s = format (s, "\n packets %u bytes %u", counts.packets, counts.bytes); |
| 194 | |
| 195 | return (s); |
| 196 | } |
| 197 | |
| 198 | u8 * |
| 199 | format_ipsec_spd (u8 * s, va_list * args) |
| 200 | { |
| 201 | u32 si = va_arg (*args, u32); |
| 202 | ipsec_main_t *im = &ipsec_main; |
| 203 | ipsec_spd_t *spd; |
| 204 | u32 *i; |
| 205 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 206 | if (pool_is_free_index (im->spds, si)) |
| 207 | { |
| 208 | s = format (s, "No such SPD index: %d", si); |
| 209 | goto done; |
| 210 | } |
| 211 | |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 212 | spd = pool_elt_at_index (im->spds, si); |
| 213 | |
| 214 | s = format (s, "spd %u", spd->id); |
| 215 | |
| 216 | #define _(v, n) \ |
| 217 | s = format (s, "\n %s:", n); \ |
| 218 | vec_foreach(i, spd->policies[IPSEC_SPD_POLICY_##v]) \ |
| 219 | { \ |
| 220 | s = format (s, "\n %U", format_ipsec_policy, *i); \ |
| 221 | } |
| 222 | foreach_ipsec_spd_policy_type; |
| 223 | #undef _ |
| 224 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 225 | done: |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 226 | return (s); |
| 227 | } |
| 228 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 229 | u8 * |
| 230 | format_ipsec_key (u8 * s, va_list * args) |
| 231 | { |
| 232 | ipsec_key_t *key = va_arg (*args, ipsec_key_t *); |
| 233 | |
| 234 | return (format (s, "%U", format_hex_bytes, key->data, key->len)); |
| 235 | } |
| 236 | |
| 237 | uword |
| 238 | unformat_ipsec_key (unformat_input_t * input, va_list * args) |
| 239 | { |
| 240 | ipsec_key_t *key = va_arg (*args, ipsec_key_t *); |
| 241 | u8 *data; |
| 242 | |
| 243 | if (unformat (input, "%U", unformat_hex_string, &data)) |
| 244 | { |
| 245 | ipsec_mk_key (key, data, vec_len (data)); |
| 246 | vec_free (data); |
| 247 | } |
| 248 | else |
| 249 | return 0; |
| 250 | return 1; |
| 251 | } |
| 252 | |
| 253 | u8 * |
Neale Ranns | e524d45 | 2019-02-19 15:22:46 +0000 | [diff] [blame] | 254 | format_ipsec_sa_flags (u8 * s, va_list * args) |
| 255 | { |
| 256 | ipsec_sa_flags_t flags = va_arg (*args, int); |
| 257 | |
| 258 | if (0) |
| 259 | ; |
| 260 | #define _(v, f, str) else if (flags & IPSEC_SA_FLAG_##f) s = format(s, "%s ", str); |
| 261 | foreach_ipsec_sa_flags |
| 262 | #undef _ |
| 263 | return (s); |
| 264 | } |
| 265 | |
| 266 | u8 * |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 267 | format_ipsec_sa (u8 * s, va_list * args) |
| 268 | { |
| 269 | u32 sai = va_arg (*args, u32); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 270 | ipsec_format_flags_t flags = va_arg (*args, ipsec_format_flags_t); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 271 | ipsec_main_t *im = &ipsec_main; |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 272 | vlib_counter_t counts; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 273 | u32 tx_table_id; |
| 274 | ipsec_sa_t *sa; |
| 275 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 276 | if (pool_is_free_index (im->sad, sai)) |
| 277 | { |
| 278 | s = format (s, "No such SA index: %d", sai); |
| 279 | goto done; |
| 280 | } |
| 281 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 282 | sa = pool_elt_at_index (im->sad, sai); |
| 283 | |
Neale Ranns | e524d45 | 2019-02-19 15:22:46 +0000 | [diff] [blame] | 284 | s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s %U", |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 285 | sai, sa->id, sa->spi, |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 286 | ipsec_sa_is_set_IS_TUNNEL (sa) ? "tunnel" : "transport", |
| 287 | ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? "-ip6" : "", |
Neale Ranns | e524d45 | 2019-02-19 15:22:46 +0000 | [diff] [blame] | 288 | sa->protocol ? "esp" : "ah", format_ipsec_sa_flags, sa->flags); |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 289 | |
| 290 | if (!(flags & IPSEC_FORMAT_DETAIL)) |
| 291 | goto done; |
| 292 | |
Neale Ranns | 00a4420 | 2019-03-21 16:36:28 +0000 | [diff] [blame] | 293 | s = format (s, "\n seq %u seq-hi %u", sa->seq, sa->seq_hi); |
| 294 | s = format (s, "\n last-seq %u last-seq-hi %u window %U", |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 295 | sa->last_seq, sa->last_seq_hi, |
| 296 | format_ipsec_replay_window, sa->replay_window); |
| 297 | s = format (s, "\n crypto alg %U%s%U", |
| 298 | format_ipsec_crypto_alg, sa->crypto_alg, |
| 299 | sa->crypto_alg ? " key " : "", |
| 300 | format_ipsec_key, &sa->crypto_key); |
| 301 | s = format (s, "\n integrity alg %U%s%U", |
| 302 | format_ipsec_integ_alg, sa->integ_alg, |
| 303 | sa->integ_alg ? " key " : "", format_ipsec_key, &sa->integ_key); |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 304 | vlib_get_combined_counter (&ipsec_sa_counters, sai, &counts); |
| 305 | s = format (s, "\n packets %u bytes %u", counts.packets, counts.bytes); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 306 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 307 | if (ipsec_sa_is_set_IS_TUNNEL (sa)) |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 308 | { |
| 309 | tx_table_id = fib_table_get_table_id (sa->tx_fib_index, |
| 310 | FIB_PROTOCOL_IP4); |
| 311 | s = format (s, "\n table-ID %d tunnel src %U dst %U", |
| 312 | tx_table_id, |
| 313 | format_ip46_address, &sa->tunnel_src_addr, IP46_TYPE_ANY, |
| 314 | format_ip46_address, &sa->tunnel_dst_addr, IP46_TYPE_ANY); |
Neale Ranns | 2b5ba95 | 2019-04-02 10:15:40 +0000 | [diff] [blame] | 315 | if (!ipsec_sa_is_set_IS_INBOUND (sa)) |
| 316 | { |
| 317 | s = |
| 318 | format (s, "\n resovle via fib-entry: %d", |
| 319 | sa->fib_entry_index); |
| 320 | s = format (s, "\n stacked on:"); |
| 321 | s = |
| 322 | format (s, "\n %U", format_dpo_id, |
| 323 | &sa->dpo[IPSEC_PROTOCOL_ESP], 6); |
| 324 | } |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 325 | } |
| 326 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 327 | done: |
| 328 | return (s); |
| 329 | } |
| 330 | |
| 331 | u8 * |
| 332 | format_ipsec_tunnel (u8 * s, va_list * args) |
| 333 | { |
| 334 | ipsec_main_t *im = &ipsec_main; |
| 335 | u32 ti = va_arg (*args, u32); |
| 336 | vnet_hw_interface_t *hi; |
| 337 | ipsec_tunnel_if_t *t; |
| 338 | |
| 339 | if (pool_is_free_index (im->tunnel_interfaces, ti)) |
| 340 | { |
| 341 | s = format (s, "No such tunnel index: %d", ti); |
| 342 | goto done; |
| 343 | } |
| 344 | |
| 345 | t = pool_elt_at_index (im->tunnel_interfaces, ti); |
| 346 | |
| 347 | if (t->hw_if_index == ~0) |
| 348 | goto done; |
| 349 | |
| 350 | hi = vnet_get_hw_interface (im->vnet_main, t->hw_if_index); |
| 351 | |
| 352 | s = format (s, "%s\n", hi->name); |
| 353 | |
| 354 | s = format (s, " out-bound sa: "); |
| 355 | s = format (s, "%U\n", format_ipsec_sa, t->output_sa_index, |
| 356 | IPSEC_FORMAT_BRIEF); |
| 357 | |
| 358 | s = format (s, " in-bound sa: "); |
| 359 | s = format (s, "%U\n", format_ipsec_sa, t->input_sa_index, |
| 360 | IPSEC_FORMAT_BRIEF); |
| 361 | |
| 362 | done: |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 363 | return (s); |
| 364 | } |
| 365 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 366 | /* |
| 367 | * fd.io coding-style-patch-verification: ON |
| 368 | * |
| 369 | * Local Variables: |
| 370 | * eval: (c-set-style "gnu") |
| 371 | * End: |
| 372 | */ |