Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * gre_interface.c: gre interfaces |
| 3 | * |
| 4 | * Copyright (c) 2016 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | /** |
Chris Luke | 16bcf7d | 2016-09-01 14:31:46 -0400 | [diff] [blame] | 18 | * @file |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 19 | * @brief L2-GRE over IPSec tunnel interface. |
| 20 | * |
| 21 | * Creates ipsec-gre tunnel interface. |
| 22 | * Provides a command line interface so humans can interact with VPP. |
| 23 | */ |
| 24 | |
| 25 | #include <vnet/vnet.h> |
| 26 | #include <vnet/pg/pg.h> |
| 27 | #include <vnet/ipsec-gre/ipsec_gre.h> |
| 28 | #include <vnet/ip/format.h> |
| 29 | #include <vnet/ipsec/ipsec.h> |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 30 | |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 31 | #include <vnet/ipsec/esp.h> |
| 32 | |
| 33 | u8 * |
| 34 | format_ipsec_gre_tunnel (u8 * s, va_list * args) |
| 35 | { |
| 36 | ipsec_gre_tunnel_t *t = va_arg (*args, ipsec_gre_tunnel_t *); |
| 37 | ipsec_gre_main_t *gm = &ipsec_gre_main; |
| 38 | |
| 39 | s = format (s, |
| 40 | "[%d] %U (src) %U (dst) local-sa %d remote-sa %d", |
| 41 | t - gm->tunnels, |
| 42 | format_ip4_address, &t->tunnel_src, |
| 43 | format_ip4_address, &t->tunnel_dst, |
| 44 | t->local_sa_id, t->remote_sa_id); |
| 45 | return s; |
| 46 | } |
| 47 | |
| 48 | static clib_error_t * |
| 49 | show_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, |
| 50 | unformat_input_t * input, |
| 51 | vlib_cli_command_t * cmd) |
| 52 | { |
| 53 | ipsec_gre_main_t *igm = &ipsec_gre_main; |
| 54 | ipsec_gre_tunnel_t *t; |
| 55 | |
| 56 | if (pool_elts (igm->tunnels) == 0) |
| 57 | vlib_cli_output (vm, "No IPSec GRE tunnels configured..."); |
| 58 | |
| 59 | /* *INDENT-OFF* */ |
| 60 | pool_foreach (t, igm->tunnels, |
| 61 | ({ |
| 62 | vlib_cli_output (vm, "%U", format_ipsec_gre_tunnel, t); |
| 63 | })); |
| 64 | /* *INDENT-ON* */ |
| 65 | |
| 66 | return 0; |
| 67 | } |
| 68 | |
| 69 | /* *INDENT-OFF* */ |
| 70 | VLIB_CLI_COMMAND (show_ipsec_gre_tunnel_command, static) = { |
| 71 | .path = "show ipsec gre tunnel", |
| 72 | .function = show_ipsec_gre_tunnel_command_fn, |
| 73 | }; |
| 74 | /* *INDENT-ON* */ |
| 75 | |
| 76 | /* force inclusion from application's main.c */ |
| 77 | clib_error_t * |
| 78 | ipsec_gre_interface_init (vlib_main_t * vm) |
| 79 | { |
| 80 | return 0; |
| 81 | } |
| 82 | |
| 83 | VLIB_INIT_FUNCTION (ipsec_gre_interface_init); |
| 84 | |
| 85 | /** |
| 86 | * @brief Add or delete ipsec-gre tunnel interface. |
| 87 | * |
| 88 | * @param *a vnet_ipsec_gre_add_del_tunnel_args_t - tunnel interface parameters |
| 89 | * @param *sw_if_indexp u32 - software interface index |
| 90 | * @return int - 0 if success otherwise <code>VNET_API_ERROR_</code> |
| 91 | */ |
| 92 | int |
| 93 | vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a, |
| 94 | u32 * sw_if_indexp) |
| 95 | { |
| 96 | ipsec_gre_main_t *igm = &ipsec_gre_main; |
| 97 | vnet_main_t *vnm = igm->vnet_main; |
| 98 | ip4_main_t *im = &ip4_main; |
| 99 | ipsec_gre_tunnel_t *t; |
| 100 | vnet_hw_interface_t *hi; |
| 101 | u32 hw_if_index, sw_if_index; |
| 102 | u32 slot; |
| 103 | uword *p; |
| 104 | u64 key; |
| 105 | ipsec_add_del_ipsec_gre_tunnel_args_t args; |
| 106 | |
| 107 | memset (&args, 0, sizeof (args)); |
| 108 | args.is_add = a->is_add; |
| 109 | args.local_sa_id = a->lsa; |
| 110 | args.remote_sa_id = a->rsa; |
| 111 | args.local_ip.as_u32 = a->src.as_u32; |
| 112 | args.remote_ip.as_u32 = a->dst.as_u32; |
| 113 | |
| 114 | key = (u64) a->src.as_u32 << 32 | (u64) a->dst.as_u32; |
| 115 | p = hash_get (igm->tunnel_by_key, key); |
| 116 | |
| 117 | if (a->is_add) |
| 118 | { |
| 119 | /* check if same src/dst pair exists */ |
| 120 | if (p) |
| 121 | return VNET_API_ERROR_INVALID_VALUE; |
| 122 | |
| 123 | pool_get_aligned (igm->tunnels, t, CLIB_CACHE_LINE_BYTES); |
| 124 | memset (t, 0, sizeof (*t)); |
| 125 | |
| 126 | if (vec_len (igm->free_ipsec_gre_tunnel_hw_if_indices) > 0) |
| 127 | { |
| 128 | vnet_interface_main_t *im = &vnm->interface_main; |
| 129 | |
| 130 | hw_if_index = igm->free_ipsec_gre_tunnel_hw_if_indices |
| 131 | [vec_len (igm->free_ipsec_gre_tunnel_hw_if_indices) - 1]; |
| 132 | _vec_len (igm->free_ipsec_gre_tunnel_hw_if_indices) -= 1; |
| 133 | |
| 134 | hi = vnet_get_hw_interface (vnm, hw_if_index); |
| 135 | hi->dev_instance = t - igm->tunnels; |
| 136 | hi->hw_instance = hi->dev_instance; |
| 137 | |
| 138 | /* clear old stats of freed tunnel before reuse */ |
| 139 | sw_if_index = hi->sw_if_index; |
| 140 | vnet_interface_counter_lock (im); |
| 141 | vlib_zero_combined_counter |
| 142 | (&im->combined_sw_if_counters[VNET_INTERFACE_COUNTER_TX], |
| 143 | sw_if_index); |
| 144 | vlib_zero_combined_counter |
| 145 | (&im->combined_sw_if_counters[VNET_INTERFACE_COUNTER_RX], |
| 146 | sw_if_index); |
| 147 | vlib_zero_simple_counter |
| 148 | (&im->sw_if_counters[VNET_INTERFACE_COUNTER_DROP], sw_if_index); |
| 149 | vnet_interface_counter_unlock (im); |
| 150 | } |
| 151 | else |
| 152 | { |
| 153 | hw_if_index = vnet_register_interface |
| 154 | (vnm, ipsec_gre_device_class.index, t - igm->tunnels, |
| 155 | ipsec_gre_hw_interface_class.index, t - igm->tunnels); |
| 156 | hi = vnet_get_hw_interface (vnm, hw_if_index); |
| 157 | sw_if_index = hi->sw_if_index; |
| 158 | } |
| 159 | |
| 160 | t->hw_if_index = hw_if_index; |
| 161 | t->sw_if_index = sw_if_index; |
| 162 | t->local_sa_id = a->lsa; |
| 163 | t->remote_sa_id = a->rsa; |
| 164 | t->local_sa = ipsec_get_sa_index_by_sa_id (a->lsa); |
| 165 | t->remote_sa = ipsec_get_sa_index_by_sa_id (a->rsa); |
| 166 | |
Matus Fabian | 025943b | 2016-10-07 03:29:09 -0700 | [diff] [blame] | 167 | ip4_sw_interface_enable_disable (sw_if_index, 1); |
| 168 | |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 169 | vec_validate_init_empty (igm->tunnel_index_by_sw_if_index, |
| 170 | sw_if_index, ~0); |
| 171 | igm->tunnel_index_by_sw_if_index[sw_if_index] = t - igm->tunnels; |
| 172 | |
| 173 | vec_validate (im->fib_index_by_sw_if_index, sw_if_index); |
| 174 | |
| 175 | hi->min_packet_bytes = 64 + sizeof (gre_header_t) + |
| 176 | sizeof (ip4_header_t) + sizeof (esp_header_t) + sizeof (esp_footer_t); |
| 177 | hi->per_packet_overhead_bytes = |
| 178 | /* preamble */ 8 + /* inter frame gap */ 12; |
| 179 | |
| 180 | /* Standard default gre MTU. */ |
| 181 | hi->max_l3_packet_bytes[VLIB_RX] = hi->max_l3_packet_bytes[VLIB_TX] = |
| 182 | 9000; |
| 183 | |
| 184 | clib_memcpy (&t->tunnel_src, &a->src, sizeof (t->tunnel_src)); |
| 185 | clib_memcpy (&t->tunnel_dst, &a->dst, sizeof (t->tunnel_dst)); |
| 186 | |
| 187 | hash_set (igm->tunnel_by_key, key, t - igm->tunnels); |
| 188 | |
| 189 | slot = vlib_node_add_named_next_with_slot |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 190 | (vnm->vlib_main, hi->tx_node_index, "esp-encrypt", |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 191 | IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT); |
| 192 | |
| 193 | ASSERT (slot == IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT); |
| 194 | |
| 195 | } |
| 196 | else |
| 197 | { /* !is_add => delete */ |
| 198 | /* tunnel needs to exist */ |
| 199 | if (!p) |
| 200 | return VNET_API_ERROR_NO_SUCH_ENTRY; |
| 201 | |
| 202 | t = pool_elt_at_index (igm->tunnels, p[0]); |
| 203 | |
| 204 | sw_if_index = t->sw_if_index; |
Matus Fabian | 025943b | 2016-10-07 03:29:09 -0700 | [diff] [blame] | 205 | ip4_sw_interface_enable_disable (sw_if_index, 0); |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 206 | vnet_sw_interface_set_flags (vnm, sw_if_index, 0 /* down */ ); |
| 207 | /* make sure tunnel is removed from l2 bd or xconnect */ |
| 208 | set_int_l2_mode (igm->vlib_main, vnm, MODE_L3, sw_if_index, 0, 0, 0, 0); |
| 209 | vec_add1 (igm->free_ipsec_gre_tunnel_hw_if_indices, t->hw_if_index); |
| 210 | igm->tunnel_index_by_sw_if_index[sw_if_index] = ~0; |
| 211 | |
| 212 | hash_unset (igm->tunnel_by_key, key); |
| 213 | pool_put (igm->tunnels, t); |
| 214 | } |
| 215 | |
| 216 | if (sw_if_indexp) |
| 217 | *sw_if_indexp = sw_if_index; |
| 218 | |
| 219 | return ipsec_add_del_ipsec_gre_tunnel (vnm, &args); |
| 220 | } |
| 221 | |
| 222 | static clib_error_t * |
| 223 | create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm, |
| 224 | unformat_input_t * input, |
| 225 | vlib_cli_command_t * cmd) |
| 226 | { |
| 227 | unformat_input_t _line_input, *line_input = &_line_input; |
| 228 | u8 is_add = 1; |
| 229 | u32 num_m_args = 0; |
| 230 | ip4_address_t src, dst; |
| 231 | u32 lsa = 0, rsa = 0; |
| 232 | vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a; |
| 233 | int rv; |
| 234 | u32 sw_if_index; |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 235 | clib_error_t *error = NULL; |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 236 | |
| 237 | /* Get a line of input. */ |
| 238 | if (!unformat_user (input, unformat_line_input, line_input)) |
| 239 | return 0; |
| 240 | |
| 241 | while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT) |
| 242 | { |
| 243 | if (unformat (line_input, "del")) |
| 244 | is_add = 0; |
| 245 | else if (unformat (line_input, "src %U", unformat_ip4_address, &src)) |
| 246 | num_m_args++; |
| 247 | else if (unformat (line_input, "dst %U", unformat_ip4_address, &dst)) |
| 248 | num_m_args++; |
| 249 | else if (unformat (line_input, "local-sa %d", &lsa)) |
| 250 | num_m_args++; |
| 251 | else if (unformat (line_input, "remote-sa %d", &rsa)) |
| 252 | num_m_args++; |
| 253 | else |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 254 | { |
| 255 | error = clib_error_return (0, "unknown input `%U'", |
| 256 | format_unformat_error, line_input); |
| 257 | goto done; |
| 258 | } |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 259 | } |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 260 | |
| 261 | if (num_m_args < 4) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 262 | { |
| 263 | error = clib_error_return (0, "mandatory argument(s) missing"); |
| 264 | goto done; |
| 265 | } |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 266 | |
| 267 | if (memcmp (&src, &dst, sizeof (src)) == 0) |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 268 | { |
| 269 | error = clib_error_return (0, "src and dst are identical"); |
| 270 | goto done; |
| 271 | } |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 272 | |
| 273 | memset (a, 0, sizeof (*a)); |
| 274 | a->is_add = is_add; |
| 275 | a->lsa = lsa; |
| 276 | a->rsa = rsa; |
| 277 | clib_memcpy (&a->src, &src, sizeof (src)); |
| 278 | clib_memcpy (&a->dst, &dst, sizeof (dst)); |
| 279 | |
| 280 | rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index); |
| 281 | |
| 282 | switch (rv) |
| 283 | { |
| 284 | case 0: |
| 285 | vlib_cli_output (vm, "%U\n", format_vnet_sw_if_index_name, |
| 286 | vnet_get_main (), sw_if_index); |
| 287 | break; |
| 288 | case VNET_API_ERROR_INVALID_VALUE: |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 289 | error = clib_error_return (0, "GRE tunnel already exists..."); |
| 290 | goto done; |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 291 | default: |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 292 | error = clib_error_return (0, |
| 293 | "vnet_ipsec_gre_add_del_tunnel returned %d", |
| 294 | rv); |
| 295 | goto done; |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 296 | } |
| 297 | |
Billy McFall | a9a20e7 | 2017-02-15 11:39:12 -0500 | [diff] [blame] | 298 | done: |
| 299 | unformat_free (line_input); |
| 300 | |
| 301 | return error; |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 302 | } |
| 303 | |
| 304 | /* *INDENT-OFF* */ |
| 305 | VLIB_CLI_COMMAND (create_ipsec_gre_tunnel_command, static) = { |
| 306 | .path = "create ipsec gre tunnel", |
| 307 | .short_help = "create ipsec gre tunnel src <addr> dst <addr> " |
| 308 | "local-sa <id> remote-sa <id> [del]", |
| 309 | .function = create_ipsec_gre_tunnel_command_fn, |
| 310 | }; |
| 311 | /* *INDENT-ON* */ |
| 312 | |
| 313 | /* |
| 314 | * fd.io coding-style-patch-verification: ON |
| 315 | * |
| 316 | * Local Variables: |
| 317 | * eval: (c-set-style "gnu") |
| 318 | * End: |
| 319 | */ |