blob: 0772ce73df2512ef04b56c39f10a23d578ea3cd3 [file] [log] [blame]
Matus Fabian694265d2016-08-10 01:55:36 -07001/*
2 * gre_interface.c: gre interfaces
3 *
4 * Copyright (c) 2016 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17/**
Chris Luke16bcf7d2016-09-01 14:31:46 -040018 * @file
Matus Fabian694265d2016-08-10 01:55:36 -070019 * @brief L2-GRE over IPSec tunnel interface.
20 *
21 * Creates ipsec-gre tunnel interface.
22 * Provides a command line interface so humans can interact with VPP.
23 */
24
25#include <vnet/vnet.h>
26#include <vnet/pg/pg.h>
27#include <vnet/ipsec-gre/ipsec_gre.h>
28#include <vnet/ip/format.h>
29#include <vnet/ipsec/ipsec.h>
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000030
Matus Fabian694265d2016-08-10 01:55:36 -070031#include <vnet/ipsec/esp.h>
32
33u8 *
34format_ipsec_gre_tunnel (u8 * s, va_list * args)
35{
36 ipsec_gre_tunnel_t *t = va_arg (*args, ipsec_gre_tunnel_t *);
37 ipsec_gre_main_t *gm = &ipsec_gre_main;
38
39 s = format (s,
40 "[%d] %U (src) %U (dst) local-sa %d remote-sa %d",
41 t - gm->tunnels,
42 format_ip4_address, &t->tunnel_src,
43 format_ip4_address, &t->tunnel_dst,
44 t->local_sa_id, t->remote_sa_id);
45 return s;
46}
47
48static clib_error_t *
49show_ipsec_gre_tunnel_command_fn (vlib_main_t * vm,
50 unformat_input_t * input,
51 vlib_cli_command_t * cmd)
52{
53 ipsec_gre_main_t *igm = &ipsec_gre_main;
54 ipsec_gre_tunnel_t *t;
55
56 if (pool_elts (igm->tunnels) == 0)
57 vlib_cli_output (vm, "No IPSec GRE tunnels configured...");
58
59 /* *INDENT-OFF* */
60 pool_foreach (t, igm->tunnels,
61 ({
62 vlib_cli_output (vm, "%U", format_ipsec_gre_tunnel, t);
63 }));
64 /* *INDENT-ON* */
65
66 return 0;
67}
68
69/* *INDENT-OFF* */
70VLIB_CLI_COMMAND (show_ipsec_gre_tunnel_command, static) = {
71 .path = "show ipsec gre tunnel",
72 .function = show_ipsec_gre_tunnel_command_fn,
73};
74/* *INDENT-ON* */
75
76/* force inclusion from application's main.c */
77clib_error_t *
78ipsec_gre_interface_init (vlib_main_t * vm)
79{
80 return 0;
81}
82
83VLIB_INIT_FUNCTION (ipsec_gre_interface_init);
84
85/**
86 * @brief Add or delete ipsec-gre tunnel interface.
87 *
88 * @param *a vnet_ipsec_gre_add_del_tunnel_args_t - tunnel interface parameters
89 * @param *sw_if_indexp u32 - software interface index
90 * @return int - 0 if success otherwise <code>VNET_API_ERROR_</code>
91 */
92int
93vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a,
94 u32 * sw_if_indexp)
95{
96 ipsec_gre_main_t *igm = &ipsec_gre_main;
97 vnet_main_t *vnm = igm->vnet_main;
98 ip4_main_t *im = &ip4_main;
99 ipsec_gre_tunnel_t *t;
100 vnet_hw_interface_t *hi;
101 u32 hw_if_index, sw_if_index;
102 u32 slot;
103 uword *p;
104 u64 key;
105 ipsec_add_del_ipsec_gre_tunnel_args_t args;
106
107 memset (&args, 0, sizeof (args));
108 args.is_add = a->is_add;
109 args.local_sa_id = a->lsa;
110 args.remote_sa_id = a->rsa;
111 args.local_ip.as_u32 = a->src.as_u32;
112 args.remote_ip.as_u32 = a->dst.as_u32;
113
114 key = (u64) a->src.as_u32 << 32 | (u64) a->dst.as_u32;
115 p = hash_get (igm->tunnel_by_key, key);
116
117 if (a->is_add)
118 {
119 /* check if same src/dst pair exists */
120 if (p)
121 return VNET_API_ERROR_INVALID_VALUE;
122
123 pool_get_aligned (igm->tunnels, t, CLIB_CACHE_LINE_BYTES);
124 memset (t, 0, sizeof (*t));
125
126 if (vec_len (igm->free_ipsec_gre_tunnel_hw_if_indices) > 0)
127 {
128 vnet_interface_main_t *im = &vnm->interface_main;
129
130 hw_if_index = igm->free_ipsec_gre_tunnel_hw_if_indices
131 [vec_len (igm->free_ipsec_gre_tunnel_hw_if_indices) - 1];
132 _vec_len (igm->free_ipsec_gre_tunnel_hw_if_indices) -= 1;
133
134 hi = vnet_get_hw_interface (vnm, hw_if_index);
135 hi->dev_instance = t - igm->tunnels;
136 hi->hw_instance = hi->dev_instance;
137
138 /* clear old stats of freed tunnel before reuse */
139 sw_if_index = hi->sw_if_index;
140 vnet_interface_counter_lock (im);
141 vlib_zero_combined_counter
142 (&im->combined_sw_if_counters[VNET_INTERFACE_COUNTER_TX],
143 sw_if_index);
144 vlib_zero_combined_counter
145 (&im->combined_sw_if_counters[VNET_INTERFACE_COUNTER_RX],
146 sw_if_index);
147 vlib_zero_simple_counter
148 (&im->sw_if_counters[VNET_INTERFACE_COUNTER_DROP], sw_if_index);
149 vnet_interface_counter_unlock (im);
150 }
151 else
152 {
153 hw_if_index = vnet_register_interface
154 (vnm, ipsec_gre_device_class.index, t - igm->tunnels,
155 ipsec_gre_hw_interface_class.index, t - igm->tunnels);
156 hi = vnet_get_hw_interface (vnm, hw_if_index);
157 sw_if_index = hi->sw_if_index;
158 }
159
160 t->hw_if_index = hw_if_index;
161 t->sw_if_index = sw_if_index;
162 t->local_sa_id = a->lsa;
163 t->remote_sa_id = a->rsa;
164 t->local_sa = ipsec_get_sa_index_by_sa_id (a->lsa);
165 t->remote_sa = ipsec_get_sa_index_by_sa_id (a->rsa);
166
Matus Fabian025943b2016-10-07 03:29:09 -0700167 ip4_sw_interface_enable_disable (sw_if_index, 1);
168
Matus Fabian694265d2016-08-10 01:55:36 -0700169 vec_validate_init_empty (igm->tunnel_index_by_sw_if_index,
170 sw_if_index, ~0);
171 igm->tunnel_index_by_sw_if_index[sw_if_index] = t - igm->tunnels;
172
173 vec_validate (im->fib_index_by_sw_if_index, sw_if_index);
174
175 hi->min_packet_bytes = 64 + sizeof (gre_header_t) +
176 sizeof (ip4_header_t) + sizeof (esp_header_t) + sizeof (esp_footer_t);
177 hi->per_packet_overhead_bytes =
178 /* preamble */ 8 + /* inter frame gap */ 12;
179
180 /* Standard default gre MTU. */
181 hi->max_l3_packet_bytes[VLIB_RX] = hi->max_l3_packet_bytes[VLIB_TX] =
182 9000;
183
184 clib_memcpy (&t->tunnel_src, &a->src, sizeof (t->tunnel_src));
185 clib_memcpy (&t->tunnel_dst, &a->dst, sizeof (t->tunnel_dst));
186
187 hash_set (igm->tunnel_by_key, key, t - igm->tunnels);
188
189 slot = vlib_node_add_named_next_with_slot
Sergio Gonzalez Monroyd04b60b2017-01-20 15:35:23 +0000190 (vnm->vlib_main, hi->tx_node_index, "esp-encrypt",
Matus Fabian694265d2016-08-10 01:55:36 -0700191 IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT);
192
193 ASSERT (slot == IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT);
194
195 }
196 else
197 { /* !is_add => delete */
198 /* tunnel needs to exist */
199 if (!p)
200 return VNET_API_ERROR_NO_SUCH_ENTRY;
201
202 t = pool_elt_at_index (igm->tunnels, p[0]);
203
204 sw_if_index = t->sw_if_index;
Matus Fabian025943b2016-10-07 03:29:09 -0700205 ip4_sw_interface_enable_disable (sw_if_index, 0);
Matus Fabian694265d2016-08-10 01:55:36 -0700206 vnet_sw_interface_set_flags (vnm, sw_if_index, 0 /* down */ );
207 /* make sure tunnel is removed from l2 bd or xconnect */
208 set_int_l2_mode (igm->vlib_main, vnm, MODE_L3, sw_if_index, 0, 0, 0, 0);
209 vec_add1 (igm->free_ipsec_gre_tunnel_hw_if_indices, t->hw_if_index);
210 igm->tunnel_index_by_sw_if_index[sw_if_index] = ~0;
211
212 hash_unset (igm->tunnel_by_key, key);
213 pool_put (igm->tunnels, t);
214 }
215
216 if (sw_if_indexp)
217 *sw_if_indexp = sw_if_index;
218
219 return ipsec_add_del_ipsec_gre_tunnel (vnm, &args);
220}
221
222static clib_error_t *
223create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm,
224 unformat_input_t * input,
225 vlib_cli_command_t * cmd)
226{
227 unformat_input_t _line_input, *line_input = &_line_input;
228 u8 is_add = 1;
229 u32 num_m_args = 0;
230 ip4_address_t src, dst;
231 u32 lsa = 0, rsa = 0;
232 vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a;
233 int rv;
234 u32 sw_if_index;
Billy McFalla9a20e72017-02-15 11:39:12 -0500235 clib_error_t *error = NULL;
Matus Fabian694265d2016-08-10 01:55:36 -0700236
237 /* Get a line of input. */
238 if (!unformat_user (input, unformat_line_input, line_input))
239 return 0;
240
241 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
242 {
243 if (unformat (line_input, "del"))
244 is_add = 0;
245 else if (unformat (line_input, "src %U", unformat_ip4_address, &src))
246 num_m_args++;
247 else if (unformat (line_input, "dst %U", unformat_ip4_address, &dst))
248 num_m_args++;
249 else if (unformat (line_input, "local-sa %d", &lsa))
250 num_m_args++;
251 else if (unformat (line_input, "remote-sa %d", &rsa))
252 num_m_args++;
253 else
Billy McFalla9a20e72017-02-15 11:39:12 -0500254 {
255 error = clib_error_return (0, "unknown input `%U'",
256 format_unformat_error, line_input);
257 goto done;
258 }
Matus Fabian694265d2016-08-10 01:55:36 -0700259 }
Matus Fabian694265d2016-08-10 01:55:36 -0700260
261 if (num_m_args < 4)
Billy McFalla9a20e72017-02-15 11:39:12 -0500262 {
263 error = clib_error_return (0, "mandatory argument(s) missing");
264 goto done;
265 }
Matus Fabian694265d2016-08-10 01:55:36 -0700266
267 if (memcmp (&src, &dst, sizeof (src)) == 0)
Billy McFalla9a20e72017-02-15 11:39:12 -0500268 {
269 error = clib_error_return (0, "src and dst are identical");
270 goto done;
271 }
Matus Fabian694265d2016-08-10 01:55:36 -0700272
273 memset (a, 0, sizeof (*a));
274 a->is_add = is_add;
275 a->lsa = lsa;
276 a->rsa = rsa;
277 clib_memcpy (&a->src, &src, sizeof (src));
278 clib_memcpy (&a->dst, &dst, sizeof (dst));
279
280 rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index);
281
282 switch (rv)
283 {
284 case 0:
285 vlib_cli_output (vm, "%U\n", format_vnet_sw_if_index_name,
286 vnet_get_main (), sw_if_index);
287 break;
288 case VNET_API_ERROR_INVALID_VALUE:
Billy McFalla9a20e72017-02-15 11:39:12 -0500289 error = clib_error_return (0, "GRE tunnel already exists...");
290 goto done;
Matus Fabian694265d2016-08-10 01:55:36 -0700291 default:
Billy McFalla9a20e72017-02-15 11:39:12 -0500292 error = clib_error_return (0,
293 "vnet_ipsec_gre_add_del_tunnel returned %d",
294 rv);
295 goto done;
Matus Fabian694265d2016-08-10 01:55:36 -0700296 }
297
Billy McFalla9a20e72017-02-15 11:39:12 -0500298done:
299 unformat_free (line_input);
300
301 return error;
Matus Fabian694265d2016-08-10 01:55:36 -0700302}
303
304/* *INDENT-OFF* */
305VLIB_CLI_COMMAND (create_ipsec_gre_tunnel_command, static) = {
306 .path = "create ipsec gre tunnel",
307 .short_help = "create ipsec gre tunnel src <addr> dst <addr> "
308 "local-sa <id> remote-sa <id> [del]",
309 .function = create_ipsec_gre_tunnel_command_fn,
310};
311/* *INDENT-ON* */
312
313/*
314* fd.io coding-style-patch-verification: ON
315*
316* Local Variables:
317* eval: (c-set-style "gnu")
318* End:
319*/