Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * decap.c : IPSec tunnel decapsulation |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
Damjan Marion | 8b3191e | 2016-11-09 19:54:20 +0100 | [diff] [blame] | 21 | #include <vnet/feature/feature.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 22 | |
| 23 | #include <vnet/ipsec/ipsec.h> |
| 24 | #include <vnet/ipsec/esp.h> |
| 25 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 26 | #define foreach_ipsec_input_error \ |
| 27 | _(RX_PKTS, "IPSEC pkts received") \ |
| 28 | _(DECRYPTION_FAILED, "IPSEC decryption failed") |
| 29 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 30 | typedef enum |
| 31 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 32 | #define _(sym,str) IPSEC_INPUT_ERROR_##sym, |
| 33 | foreach_ipsec_input_error |
| 34 | #undef _ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 35 | IPSEC_INPUT_N_ERROR, |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 36 | } ipsec_input_error_t; |
| 37 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 38 | static char *ipsec_input_error_strings[] = { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 39 | #define _(sym,string) string, |
| 40 | foreach_ipsec_input_error |
| 41 | #undef _ |
| 42 | }; |
| 43 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 44 | typedef struct |
| 45 | { |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 46 | u32 sa_id; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 47 | u32 spi; |
| 48 | u32 seq; |
| 49 | } ipsec_input_trace_t; |
| 50 | |
| 51 | /* packet trace format function */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 52 | static u8 * |
| 53 | format_ipsec_input_trace (u8 * s, va_list * args) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 54 | { |
| 55 | CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); |
| 56 | CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 57 | ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 58 | |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 59 | if (t->spi == 0 && t->seq == 0) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 60 | { |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 61 | s = format (s, "esp: no esp packet"); |
| 62 | return s; |
| 63 | } |
| 64 | |
| 65 | if (t->sa_id != 0) |
| 66 | { |
| 67 | s = format (s, "esp: sa_id %u spi %u seq %u", t->sa_id, t->spi, t->seq); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 68 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 69 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 70 | { |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 71 | s = format (s, "esp: no sa spi %u seq %u", t->spi, t->seq); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 72 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 73 | return s; |
| 74 | } |
| 75 | |
| 76 | always_inline ipsec_policy_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 77 | ipsec_input_protect_policy_match (ipsec_spd_t * spd, u32 sa, u32 da, u32 spi) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 78 | { |
| 79 | ipsec_main_t *im = &ipsec_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 80 | ipsec_policy_t *p; |
| 81 | ipsec_sa_t *s; |
| 82 | u32 *i; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 83 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 84 | vec_foreach (i, spd->ipv4_inbound_protect_policy_indices) |
| 85 | { |
| 86 | p = pool_elt_at_index (spd->policies, *i); |
| 87 | s = pool_elt_at_index (im->sad, p->sa_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 88 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 89 | if (spi != s->spi) |
| 90 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 91 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 92 | if (s->is_tunnel) |
| 93 | { |
| 94 | if (da != clib_net_to_host_u32 (s->tunnel_dst_addr.ip4.as_u32)) |
| 95 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 96 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 97 | if (sa != clib_net_to_host_u32 (s->tunnel_src_addr.ip4.as_u32)) |
| 98 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 99 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 100 | return p; |
| 101 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 102 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 103 | if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32)) |
| 104 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 105 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 106 | if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32)) |
| 107 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 108 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 109 | if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32)) |
| 110 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 111 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 112 | if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32)) |
| 113 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 114 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 115 | return p; |
| 116 | } |
| 117 | return 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 118 | } |
| 119 | |
| 120 | always_inline uword |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 121 | ip6_addr_match_range (ip6_address_t * a, ip6_address_t * la, |
| 122 | ip6_address_t * ua) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 123 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 124 | if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) && |
| 125 | (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 126 | return 1; |
| 127 | return 0; |
| 128 | } |
| 129 | |
| 130 | always_inline ipsec_policy_t * |
| 131 | ipsec_input_ip6_protect_policy_match (ipsec_spd_t * spd, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 132 | ip6_address_t * sa, |
| 133 | ip6_address_t * da, u32 spi) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 134 | { |
| 135 | ipsec_main_t *im = &ipsec_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 136 | ipsec_policy_t *p; |
| 137 | ipsec_sa_t *s; |
| 138 | u32 *i; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 139 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 140 | vec_foreach (i, spd->ipv6_inbound_protect_policy_indices) |
| 141 | { |
| 142 | p = pool_elt_at_index (spd->policies, *i); |
| 143 | s = pool_elt_at_index (im->sad, p->sa_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 144 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 145 | if (spi != s->spi) |
| 146 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 147 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 148 | if (s->is_tunnel) |
| 149 | { |
| 150 | if (!ip6_address_is_equal (sa, &s->tunnel_src_addr.ip6)) |
| 151 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 152 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 153 | if (!ip6_address_is_equal (da, &s->tunnel_dst_addr.ip6)) |
| 154 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 155 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 156 | return p; |
| 157 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 158 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 159 | if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6)) |
| 160 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 161 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 162 | if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6)) |
| 163 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 164 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 165 | return p; |
| 166 | } |
| 167 | return 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 168 | } |
| 169 | |
Jean-Mickael Guerin | 8941ec2 | 2016-03-04 14:14:21 +0100 | [diff] [blame] | 170 | static vlib_node_registration_t ipsec_input_ip4_node; |
| 171 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 172 | static uword |
| 173 | ipsec_input_ip4_node_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 174 | vlib_node_runtime_t * node, |
| 175 | vlib_frame_t * from_frame) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 176 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 177 | u32 n_left_from, *from, next_index, *to_next; |
| 178 | ipsec_main_t *im = &ipsec_main; |
| 179 | |
| 180 | from = vlib_frame_vector_args (from_frame); |
| 181 | n_left_from = from_frame->n_vectors; |
| 182 | |
| 183 | next_index = node->cached_next_index; |
| 184 | |
| 185 | while (n_left_from > 0) |
| 186 | { |
| 187 | u32 n_left_to_next; |
| 188 | |
| 189 | vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); |
| 190 | |
| 191 | while (n_left_from > 0 && n_left_to_next > 0) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 192 | { |
| 193 | u32 bi0, next0; |
| 194 | vlib_buffer_t *b0; |
| 195 | ip4_header_t *ip0; |
| 196 | esp_header_t *esp0; |
| 197 | ip4_ipsec_config_t *c0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 198 | ipsec_spd_t *spd0; |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 199 | ipsec_policy_t *p0 = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 200 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 201 | bi0 = to_next[0] = from[0]; |
| 202 | from += 1; |
| 203 | n_left_from -= 1; |
| 204 | to_next += 1; |
| 205 | n_left_to_next -= 1; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 206 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 207 | b0 = vlib_get_buffer (vm, bi0); |
Damjan Marion | 8b3191e | 2016-11-09 19:54:20 +0100 | [diff] [blame] | 208 | c0 = |
| 209 | vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index |
| 210 | [VLIB_RX], &next0, b0, |
| 211 | sizeof (c0[0])); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 212 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 213 | spd0 = pool_elt_at_index (im->spds, c0->spd_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 214 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 215 | ip0 = vlib_buffer_get_current (b0); |
| 216 | esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 217 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 218 | if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)) |
| 219 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 220 | #if 0 |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 221 | clib_warning |
| 222 | ("packet received from %U to %U spi %u size %u spd_id %u", |
| 223 | format_ip4_address, ip0->src_address.as_u8, |
| 224 | format_ip4_address, ip0->dst_address.as_u8, |
| 225 | clib_net_to_host_u32 (esp0->spi), |
| 226 | clib_net_to_host_u16 (ip0->length), spd0->id); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 227 | #endif |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 228 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 229 | p0 = ipsec_input_protect_policy_match (spd0, |
| 230 | clib_net_to_host_u32 |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 231 | (ip0->src_address. |
| 232 | as_u32), |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 233 | clib_net_to_host_u32 |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 234 | (ip0->dst_address. |
| 235 | as_u32), |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 236 | clib_net_to_host_u32 |
| 237 | (esp0->spi)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 238 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 239 | if (PREDICT_TRUE (p0 != 0)) |
| 240 | { |
| 241 | p0->counter.packets++; |
| 242 | p0->counter.bytes += clib_net_to_host_u16 (ip0->length); |
Damjan Marion | 9c6ae5f | 2016-11-15 23:20:01 +0100 | [diff] [blame] | 243 | vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; |
| 244 | vnet_buffer (b0)->ipsec.flags = 0; |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 245 | next0 = im->esp_decrypt_next_index; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 246 | vlib_buffer_advance (b0, ip4_header_bytes (ip0)); |
| 247 | goto trace0; |
| 248 | } |
| 249 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 250 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 251 | /* FIXME bypass and discard */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 252 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 253 | trace0: |
| 254 | if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) |
| 255 | { |
| 256 | ipsec_input_trace_t *tr = |
| 257 | vlib_add_trace (vm, node, b0, sizeof (*tr)); |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 258 | if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP) |
| 259 | { |
| 260 | if (p0) |
| 261 | tr->sa_id = p0->sa_id; |
| 262 | tr->spi = clib_host_to_net_u32 (esp0->spi); |
| 263 | tr->seq = clib_host_to_net_u32 (esp0->seq); |
| 264 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 265 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 266 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 267 | vlib_validate_buffer_enqueue_x1 (vm, node, next_index, |
| 268 | to_next, n_left_to_next, bi0, |
| 269 | next0); |
| 270 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 271 | vlib_put_next_frame (vm, node, next_index, n_left_to_next); |
| 272 | } |
| 273 | vlib_node_increment_counter (vm, ipsec_input_ip4_node.index, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 274 | IPSEC_INPUT_ERROR_RX_PKTS, |
| 275 | from_frame->n_vectors); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 276 | |
| 277 | return from_frame->n_vectors; |
| 278 | } |
| 279 | |
| 280 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 281 | /* *INDENT-OFF* */ |
Jean-Mickael Guerin | 8941ec2 | 2016-03-04 14:14:21 +0100 | [diff] [blame] | 282 | VLIB_REGISTER_NODE (ipsec_input_ip4_node,static) = { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 283 | .function = ipsec_input_ip4_node_fn, |
| 284 | .name = "ipsec-input-ip4", |
| 285 | .vector_size = sizeof (u32), |
| 286 | .format_trace = format_ipsec_input_trace, |
| 287 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 288 | |
| 289 | .n_errors = ARRAY_LEN(ipsec_input_error_strings), |
| 290 | .error_strings = ipsec_input_error_strings, |
| 291 | |
| 292 | .n_next_nodes = IPSEC_INPUT_N_NEXT, |
| 293 | .next_nodes = { |
| 294 | #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n, |
| 295 | foreach_ipsec_input_next |
| 296 | #undef _ |
| 297 | }, |
| 298 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 299 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 300 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 301 | VLIB_NODE_FUNCTION_MULTIARCH (ipsec_input_ip4_node, ipsec_input_ip4_node_fn) |
| 302 | static vlib_node_registration_t ipsec_input_ip6_node; |
Damjan Marion | 1c80e83 | 2016-05-11 23:07:18 +0200 | [diff] [blame] | 303 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 304 | static uword |
| 305 | ipsec_input_ip6_node_fn (vlib_main_t * vm, |
| 306 | vlib_node_runtime_t * node, |
| 307 | vlib_frame_t * from_frame) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 308 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 309 | u32 n_left_from, *from, next_index, *to_next; |
| 310 | ipsec_main_t *im = &ipsec_main; |
| 311 | |
| 312 | from = vlib_frame_vector_args (from_frame); |
| 313 | n_left_from = from_frame->n_vectors; |
| 314 | |
| 315 | next_index = node->cached_next_index; |
| 316 | |
| 317 | while (n_left_from > 0) |
| 318 | { |
| 319 | u32 n_left_to_next; |
| 320 | |
| 321 | vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); |
| 322 | |
| 323 | while (n_left_from > 0 && n_left_to_next > 0) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 324 | { |
| 325 | u32 bi0, next0; |
| 326 | vlib_buffer_t *b0; |
| 327 | ip6_header_t *ip0; |
| 328 | esp_header_t *esp0; |
| 329 | ip4_ipsec_config_t *c0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 330 | ipsec_spd_t *spd0; |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 331 | ipsec_policy_t *p0 = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 332 | u32 header_size = sizeof (ip0[0]); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 333 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 334 | bi0 = to_next[0] = from[0]; |
| 335 | from += 1; |
| 336 | n_left_from -= 1; |
| 337 | to_next += 1; |
| 338 | n_left_to_next -= 1; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 339 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 340 | b0 = vlib_get_buffer (vm, bi0); |
Damjan Marion | 8b3191e | 2016-11-09 19:54:20 +0100 | [diff] [blame] | 341 | c0 = |
| 342 | vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index |
| 343 | [VLIB_RX], &next0, b0, |
| 344 | sizeof (c0[0])); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 345 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 346 | spd0 = pool_elt_at_index (im->spds, c0->spd_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 347 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 348 | ip0 = vlib_buffer_get_current (b0); |
| 349 | esp0 = (esp_header_t *) ((u8 *) ip0 + header_size); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 350 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 351 | if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)) |
| 352 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 353 | #if 0 |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 354 | clib_warning |
| 355 | ("packet received from %U to %U spi %u size %u spd_id %u", |
| 356 | format_ip6_address, &ip0->src_address, format_ip6_address, |
| 357 | &ip0->dst_address, clib_net_to_host_u32 (esp0->spi), |
| 358 | clib_net_to_host_u16 (ip0->payload_length) + header_size, |
| 359 | spd0->id); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 360 | #endif |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 361 | p0 = ipsec_input_ip6_protect_policy_match (spd0, |
| 362 | &ip0->src_address, |
| 363 | &ip0->dst_address, |
| 364 | clib_net_to_host_u32 |
| 365 | (esp0->spi)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 366 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 367 | if (PREDICT_TRUE (p0 != 0)) |
| 368 | { |
| 369 | p0->counter.packets++; |
| 370 | p0->counter.bytes += |
| 371 | clib_net_to_host_u16 (ip0->payload_length); |
| 372 | p0->counter.bytes += header_size; |
Damjan Marion | 9c6ae5f | 2016-11-15 23:20:01 +0100 | [diff] [blame] | 373 | vnet_buffer (b0)->ipsec.sad_index = p0->sa_index; |
| 374 | vnet_buffer (b0)->ipsec.flags = 0; |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 375 | next0 = im->esp_decrypt_next_index; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 376 | vlib_buffer_advance (b0, header_size); |
| 377 | goto trace0; |
| 378 | } |
| 379 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 380 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 381 | trace0: |
| 382 | if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED)) |
| 383 | { |
| 384 | ipsec_input_trace_t *tr = |
| 385 | vlib_add_trace (vm, node, b0, sizeof (*tr)); |
Matus Fabian | 5539a07 | 2016-09-07 05:57:09 -0700 | [diff] [blame] | 386 | if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP) |
| 387 | { |
| 388 | if (p0) |
| 389 | tr->sa_id = p0->sa_id; |
| 390 | tr->spi = clib_host_to_net_u32 (esp0->spi); |
| 391 | tr->seq = clib_host_to_net_u32 (esp0->seq); |
| 392 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 393 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 394 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 395 | vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, |
| 396 | n_left_to_next, bi0, next0); |
| 397 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 398 | vlib_put_next_frame (vm, node, next_index, n_left_to_next); |
| 399 | } |
| 400 | vlib_node_increment_counter (vm, ipsec_input_ip6_node.index, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 401 | IPSEC_INPUT_ERROR_RX_PKTS, |
| 402 | from_frame->n_vectors); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 403 | |
| 404 | return from_frame->n_vectors; |
| 405 | } |
| 406 | |
| 407 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 408 | /* *INDENT-OFF* */ |
Jean-Mickael Guerin | 8941ec2 | 2016-03-04 14:14:21 +0100 | [diff] [blame] | 409 | VLIB_REGISTER_NODE (ipsec_input_ip6_node,static) = { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 410 | .function = ipsec_input_ip6_node_fn, |
| 411 | .name = "ipsec-input-ip6", |
| 412 | .vector_size = sizeof (u32), |
| 413 | .format_trace = format_ipsec_input_trace, |
| 414 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 415 | |
| 416 | .n_errors = ARRAY_LEN(ipsec_input_error_strings), |
| 417 | .error_strings = ipsec_input_error_strings, |
| 418 | |
| 419 | .n_next_nodes = IPSEC_INPUT_N_NEXT, |
| 420 | .next_nodes = { |
| 421 | #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n, |
| 422 | foreach_ipsec_input_next |
| 423 | #undef _ |
| 424 | }, |
| 425 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 426 | /* *INDENT-ON* */ |
Damjan Marion | 1c80e83 | 2016-05-11 23:07:18 +0200 | [diff] [blame] | 427 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 428 | VLIB_NODE_FUNCTION_MULTIARCH (ipsec_input_ip6_node, ipsec_input_ip6_node_fn) |
| 429 | /* |
| 430 | * fd.io coding-style-patch-verification: ON |
| 431 | * |
| 432 | * Local Variables: |
| 433 | * eval: (c-set-style "gnu") |
| 434 | * End: |
| 435 | */ |