Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * ipsec_if.c : IPSec interface support |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
Pierre Pfister | 4c422f9 | 2018-12-10 11:19:08 +0100 | [diff] [blame] | 21 | #include <vnet/fib/fib.h> |
Kingwel Xie | 00bff19 | 2019-03-07 01:25:32 -0500 | [diff] [blame] | 22 | #include <vnet/udp/udp.h> |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 23 | #include <vnet/adj/adj_midchain.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 24 | |
| 25 | #include <vnet/ipsec/ipsec.h> |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 26 | #include <vnet/ipsec/esp.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 27 | |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 28 | void vl_api_rpc_call_main_thread (void *fp, u8 * data, u32 data_length); |
| 29 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 30 | static u8 * |
| 31 | format_ipsec_name (u8 * s, va_list * args) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 32 | { |
| 33 | u32 dev_instance = va_arg (*args, u32); |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 34 | ipsec_main_t *im = &ipsec_main; |
| 35 | ipsec_tunnel_if_t *t = im->tunnel_interfaces + dev_instance; |
| 36 | |
| 37 | return format (s, "ipsec%d", t->show_instance); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 38 | } |
| 39 | |
Klement Sekera | 31da2e3 | 2018-06-24 22:49:55 +0200 | [diff] [blame] | 40 | /* Statistics (not really errors) */ |
| 41 | #define foreach_ipsec_if_tx_error \ |
| 42 | _(TX, "good packets transmitted") |
| 43 | |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 44 | static void |
| 45 | ipsec_if_tunnel_stack (adj_index_t ai) |
Klement Sekera | a98346f | 2018-05-16 10:52:45 +0200 | [diff] [blame] | 46 | { |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 47 | ipsec_main_t *ipm = &ipsec_main; |
| 48 | ipsec_tunnel_if_t *it; |
| 49 | ip_adjacency_t *adj; |
| 50 | u32 sw_if_index; |
Klement Sekera | 31da2e3 | 2018-06-24 22:49:55 +0200 | [diff] [blame] | 51 | |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 52 | adj = adj_get (ai); |
| 53 | sw_if_index = adj->rewrite_header.sw_if_index; |
| 54 | |
| 55 | if ((vec_len (ipm->ipsec_if_by_sw_if_index) <= sw_if_index) || |
| 56 | (~0 == ipm->ipsec_if_by_sw_if_index[sw_if_index])) |
| 57 | return; |
| 58 | |
| 59 | it = pool_elt_at_index (ipm->tunnel_interfaces, |
| 60 | ipm->ipsec_if_by_sw_if_index[sw_if_index]); |
| 61 | |
| 62 | if (!vnet_hw_interface_is_link_up (vnet_get_main (), it->hw_if_index)) |
| 63 | { |
| 64 | adj_midchain_delegate_unstack (ai); |
| 65 | } |
| 66 | else |
| 67 | { |
| 68 | ipsec_sa_t *sa; |
| 69 | |
| 70 | sa = ipsec_sa_get (it->output_sa_index); |
| 71 | |
Neale Ranns | 45d8f85 | 2019-03-28 08:59:12 +0000 | [diff] [blame] | 72 | /* *INDENT-OFF* */ |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 73 | fib_prefix_t pfx = { |
| 74 | .fp_addr = sa->tunnel_dst_addr, |
Neale Ranns | 45d8f85 | 2019-03-28 08:59:12 +0000 | [diff] [blame] | 75 | .fp_len = (ipsec_sa_is_set_IS_TUNNEL_V6(sa) ? 128 : 32), |
| 76 | .fp_proto = (ipsec_sa_is_set_IS_TUNNEL_V6(sa) ? |
| 77 | FIB_PROTOCOL_IP6 : |
| 78 | FIB_PROTOCOL_IP4), |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 79 | }; |
Neale Ranns | 45d8f85 | 2019-03-28 08:59:12 +0000 | [diff] [blame] | 80 | /* *INDENT-ON* */ |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 81 | |
| 82 | adj_midchain_delegate_stack (ai, sa->tx_fib_index, &pfx); |
| 83 | } |
| 84 | } |
| 85 | |
| 86 | /** |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame^] | 87 | * @brief Call back when restacking all adjacencies on a IPSec interface |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 88 | */ |
| 89 | static adj_walk_rc_t |
| 90 | ipsec_if_adj_walk_cb (adj_index_t ai, void *ctx) |
Klement Sekera | 31da2e3 | 2018-06-24 22:49:55 +0200 | [diff] [blame] | 91 | { |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 92 | ipsec_if_tunnel_stack (ai); |
Klement Sekera | 31da2e3 | 2018-06-24 22:49:55 +0200 | [diff] [blame] | 93 | |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 94 | return (ADJ_WALK_RC_CONTINUE); |
Klement Sekera | a98346f | 2018-05-16 10:52:45 +0200 | [diff] [blame] | 95 | } |
| 96 | |
Neale Ranns | 77eb28f | 2019-03-04 14:13:14 +0000 | [diff] [blame] | 97 | static void |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 98 | ipsec_if_tunnel_restack (ipsec_tunnel_if_t * it) |
Neale Ranns | fe480f6 | 2019-02-28 12:03:58 +0000 | [diff] [blame] | 99 | { |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 100 | fib_protocol_t proto; |
Neale Ranns | fe480f6 | 2019-02-28 12:03:58 +0000 | [diff] [blame] | 101 | |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 102 | /* |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame^] | 103 | * walk all the adjacencies on the IPSec interface and restack them |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 104 | */ |
| 105 | FOR_EACH_FIB_IP_PROTOCOL (proto) |
| 106 | { |
| 107 | adj_nbr_walk (it->sw_if_index, proto, ipsec_if_adj_walk_cb, NULL); |
| 108 | } |
Neale Ranns | fe480f6 | 2019-02-28 12:03:58 +0000 | [diff] [blame] | 109 | } |
| 110 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 111 | static clib_error_t * |
| 112 | ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags) |
| 113 | { |
| 114 | ipsec_main_t *im = &ipsec_main; |
| 115 | clib_error_t *err = 0; |
| 116 | ipsec_tunnel_if_t *t; |
| 117 | vnet_hw_interface_t *hi; |
| 118 | ipsec_sa_t *sa; |
| 119 | |
| 120 | hi = vnet_get_hw_interface (vnm, hw_if_index); |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 121 | t = pool_elt_at_index (im->tunnel_interfaces, hi->hw_instance); |
Neale Ranns | fe480f6 | 2019-02-28 12:03:58 +0000 | [diff] [blame] | 122 | t->flags = flags; |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 123 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 124 | if (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP) |
| 125 | { |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 126 | sa = pool_elt_at_index (im->sad, t->input_sa_index); |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 127 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 128 | err = ipsec_check_support_cb (im, sa); |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 129 | if (err) |
| 130 | return err; |
| 131 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 132 | err = ipsec_add_del_sa_sess_cb (im, t->input_sa_index, 1); |
| 133 | if (err) |
| 134 | return err; |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 135 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 136 | sa = pool_elt_at_index (im->sad, t->output_sa_index); |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 137 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 138 | err = ipsec_check_support_cb (im, sa); |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 139 | if (err) |
| 140 | return err; |
| 141 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 142 | err = ipsec_add_del_sa_sess_cb (im, t->output_sa_index, 1); |
| 143 | if (err) |
| 144 | return err; |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 145 | |
Radu Nicolau | 3f90339 | 2017-01-30 14:33:39 +0000 | [diff] [blame] | 146 | vnet_hw_interface_set_flags (vnm, hw_if_index, |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 147 | VNET_HW_INTERFACE_FLAG_LINK_UP); |
| 148 | } |
| 149 | else |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 150 | { |
| 151 | vnet_hw_interface_set_flags (vnm, hw_if_index, 0 /* down */ ); |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 152 | sa = pool_elt_at_index (im->sad, t->input_sa_index); |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 153 | err = ipsec_add_del_sa_sess_cb (im, t->input_sa_index, 0); |
| 154 | if (err) |
| 155 | return err; |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 156 | sa = pool_elt_at_index (im->sad, t->output_sa_index); |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 157 | err = ipsec_add_del_sa_sess_cb (im, t->output_sa_index, 0); |
| 158 | if (err) |
| 159 | return err; |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 160 | } |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 161 | |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 162 | ipsec_if_tunnel_restack (t); |
| 163 | |
| 164 | return (NULL); |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 165 | } |
| 166 | |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 167 | static u8 * |
| 168 | ipsec_if_build_rewrite (vnet_main_t * vnm, |
| 169 | u32 sw_if_index, |
| 170 | vnet_link_t link_type, const void *dst_address) |
| 171 | { |
| 172 | return (NULL); |
| 173 | } |
| 174 | |
| 175 | static void |
| 176 | ipsec_if_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai) |
| 177 | { |
| 178 | adj_nbr_midchain_update_rewrite |
| 179 | (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK, |
| 180 | ipsec_if_build_rewrite (vnm, sw_if_index, adj_get_link_type (ai), NULL)); |
| 181 | |
| 182 | ipsec_if_tunnel_stack (ai); |
| 183 | } |
Klement Sekera | 31da2e3 | 2018-06-24 22:49:55 +0200 | [diff] [blame] | 184 | |
Neale Ranns | b80c536 | 2016-10-08 13:03:40 +0100 | [diff] [blame] | 185 | /* *INDENT-OFF* */ |
Neale Ranns | 77eb28f | 2019-03-04 14:13:14 +0000 | [diff] [blame] | 186 | VNET_DEVICE_CLASS (ipsec_device_class) = |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 187 | { |
Neale Ranns | b80c536 | 2016-10-08 13:03:40 +0100 | [diff] [blame] | 188 | .name = "IPSec", |
| 189 | .format_device_name = format_ipsec_name, |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 190 | .admin_up_down_function = ipsec_admin_up_down_function, |
Neale Ranns | b80c536 | 2016-10-08 13:03:40 +0100 | [diff] [blame] | 191 | }; |
| 192 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 193 | |
Neale Ranns | b80c536 | 2016-10-08 13:03:40 +0100 | [diff] [blame] | 194 | /* *INDENT-OFF* */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 195 | VNET_HW_INTERFACE_CLASS (ipsec_hw_class) = |
| 196 | { |
Neale Ranns | b80c536 | 2016-10-08 13:03:40 +0100 | [diff] [blame] | 197 | .name = "IPSec", |
| 198 | .build_rewrite = default_build_rewrite, |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 199 | .update_adjacency = ipsec_if_update_adj, |
Matthew Smith | 922549a | 2017-05-24 16:18:27 -0500 | [diff] [blame] | 200 | .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P, |
Neale Ranns | b80c536 | 2016-10-08 13:03:40 +0100 | [diff] [blame] | 201 | }; |
| 202 | /* *INDENT-ON* */ |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 203 | |
| 204 | static int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 205 | ipsec_add_del_tunnel_if_rpc_callback (ipsec_add_del_tunnel_args_t * a) |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 206 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 207 | vnet_main_t *vnm = vnet_get_main (); |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 208 | ASSERT (vlib_get_thread_index () == 0); |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 209 | |
Matthew Smith | e04d09d | 2017-05-14 21:47:18 -0500 | [diff] [blame] | 210 | return ipsec_add_del_tunnel_if_internal (vnm, a, NULL); |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 211 | } |
| 212 | |
| 213 | int |
| 214 | ipsec_add_del_tunnel_if (ipsec_add_del_tunnel_args_t * args) |
| 215 | { |
| 216 | vl_api_rpc_call_main_thread (ipsec_add_del_tunnel_if_rpc_callback, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 217 | (u8 *) args, sizeof (*args)); |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 218 | return 0; |
| 219 | } |
| 220 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 221 | static u32 |
| 222 | ipsec_tun_mk_input_sa_id (u32 ti) |
| 223 | { |
| 224 | return (0x80000000 | ti); |
| 225 | } |
| 226 | |
| 227 | static u32 |
| 228 | ipsec_tun_mk_output_sa_id (u32 ti) |
| 229 | { |
| 230 | return (0xc0000000 | ti); |
| 231 | } |
| 232 | |
Neale Ranns | d6c9e82 | 2019-04-17 16:29:00 -0700 | [diff] [blame] | 233 | static void |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 234 | ipsec_tunnel_feature_set (ipsec_main_t * im, ipsec_tunnel_if_t * t, u8 enable) |
Neale Ranns | d6c9e82 | 2019-04-17 16:29:00 -0700 | [diff] [blame] | 235 | { |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 236 | u8 arc; |
| 237 | |
| 238 | arc = vnet_get_feature_arc_index ("ip4-output"); |
| 239 | |
| 240 | vnet_feature_enable_disable_with_index (arc, |
| 241 | im->esp4_encrypt_tun_feature_index, |
| 242 | t->sw_if_index, enable, |
| 243 | &t->output_sa_index, |
| 244 | sizeof (t->output_sa_index)); |
| 245 | |
| 246 | arc = vnet_get_feature_arc_index ("ip6-output"); |
| 247 | |
| 248 | vnet_feature_enable_disable_with_index (arc, |
| 249 | im->esp6_encrypt_tun_feature_index, |
| 250 | t->sw_if_index, enable, |
| 251 | &t->output_sa_index, |
| 252 | sizeof (t->output_sa_index)); |
Neale Ranns | d6c9e82 | 2019-04-17 16:29:00 -0700 | [diff] [blame] | 253 | } |
| 254 | |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 255 | int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 256 | ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, |
Matthew Smith | e04d09d | 2017-05-14 21:47:18 -0500 | [diff] [blame] | 257 | ipsec_add_del_tunnel_args_t * args, |
| 258 | u32 * sw_if_index) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 259 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 260 | ipsec_tunnel_if_t *t; |
| 261 | ipsec_main_t *im = &ipsec_main; |
Matthew Smith | e04d09d | 2017-05-14 21:47:18 -0500 | [diff] [blame] | 262 | vnet_hw_interface_t *hi = NULL; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 263 | u32 hw_if_index = ~0; |
| 264 | uword *p; |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 265 | u32 dev_instance; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 266 | ipsec_key_t crypto_key, integ_key; |
| 267 | ipsec_sa_flags_t flags; |
| 268 | int rv; |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 269 | int is_ip6 = args->is_ip6; |
| 270 | ipsec4_tunnel_key_t key4; |
| 271 | ipsec6_tunnel_key_t key6; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 272 | |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 273 | if (!is_ip6) |
| 274 | { |
| 275 | key4.remote_ip = args->remote_ip.ip4.as_u32; |
| 276 | key4.spi = clib_host_to_net_u32 (args->remote_spi); |
| 277 | p = hash_get (im->ipsec4_if_pool_index_by_key, key4.as_u64); |
| 278 | } |
| 279 | else |
| 280 | { |
| 281 | key6.remote_ip = args->remote_ip.ip6; |
| 282 | key6.spi = clib_host_to_net_u32 (args->remote_spi); |
| 283 | p = hash_get_mem (im->ipsec6_if_pool_index_by_key, &key6); |
| 284 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 285 | |
| 286 | if (args->is_add) |
| 287 | { |
| 288 | /* check if same src/dst pair exists */ |
| 289 | if (p) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 290 | return VNET_API_ERROR_INVALID_VALUE; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 291 | |
Neale Ranns | fe480f6 | 2019-02-28 12:03:58 +0000 | [diff] [blame] | 292 | pool_get_aligned_zero (im->tunnel_interfaces, t, CLIB_CACHE_LINE_BYTES); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 293 | |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 294 | dev_instance = t - im->tunnel_interfaces; |
| 295 | if (args->renumber) |
| 296 | t->show_instance = args->show_instance; |
| 297 | else |
| 298 | t->show_instance = dev_instance; |
| 299 | |
| 300 | if (hash_get (im->ipsec_if_real_dev_by_show_dev, t->show_instance)) |
| 301 | { |
| 302 | pool_put (im->tunnel_interfaces, t); |
| 303 | return VNET_API_ERROR_INSTANCE_IN_USE; |
| 304 | } |
| 305 | |
| 306 | hash_set (im->ipsec_if_real_dev_by_show_dev, t->show_instance, |
| 307 | dev_instance); |
| 308 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 309 | flags = IPSEC_SA_FLAG_IS_TUNNEL; |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 310 | if (args->is_ip6) |
| 311 | flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 312 | if (args->udp_encap) |
| 313 | flags |= IPSEC_SA_FLAG_UDP_ENCAP; |
| 314 | if (args->esn) |
Damjan Marion | 1e3aa5e | 2019-03-28 10:58:59 +0100 | [diff] [blame] | 315 | flags |= IPSEC_SA_FLAG_USE_ESN; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 316 | if (args->anti_replay) |
| 317 | flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 318 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 319 | ipsec_mk_key (&crypto_key, |
| 320 | args->remote_crypto_key, args->remote_crypto_key_len); |
| 321 | ipsec_mk_key (&integ_key, |
| 322 | args->remote_integ_key, args->remote_integ_key_len); |
| 323 | |
| 324 | rv = ipsec_sa_add (ipsec_tun_mk_input_sa_id (dev_instance), |
| 325 | args->remote_spi, |
| 326 | IPSEC_PROTOCOL_ESP, |
| 327 | args->crypto_alg, |
| 328 | &crypto_key, |
| 329 | args->integ_alg, |
| 330 | &integ_key, |
Neale Ranns | 2b5ba95 | 2019-04-02 10:15:40 +0000 | [diff] [blame] | 331 | (flags | IPSEC_SA_FLAG_IS_INBOUND), |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 332 | args->tx_table_id, |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 333 | args->salt, |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 334 | &args->remote_ip, |
| 335 | &args->local_ip, &t->input_sa_index); |
| 336 | |
| 337 | if (rv) |
Neale Ranns | 2f05220 | 2019-06-14 10:31:46 +0000 | [diff] [blame] | 338 | return rv; |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 339 | |
| 340 | ipsec_mk_key (&crypto_key, |
| 341 | args->local_crypto_key, args->local_crypto_key_len); |
| 342 | ipsec_mk_key (&integ_key, |
| 343 | args->local_integ_key, args->local_integ_key_len); |
| 344 | |
| 345 | rv = ipsec_sa_add (ipsec_tun_mk_output_sa_id (dev_instance), |
| 346 | args->local_spi, |
| 347 | IPSEC_PROTOCOL_ESP, |
| 348 | args->crypto_alg, |
| 349 | &crypto_key, |
| 350 | args->integ_alg, |
| 351 | &integ_key, |
| 352 | flags, |
| 353 | args->tx_table_id, |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 354 | args->salt, |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 355 | &args->local_ip, |
| 356 | &args->remote_ip, &t->output_sa_index); |
| 357 | |
| 358 | if (rv) |
Neale Ranns | 2f05220 | 2019-06-14 10:31:46 +0000 | [diff] [blame] | 359 | return rv; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 360 | |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 361 | /* copy the key */ |
| 362 | if (is_ip6) |
| 363 | hash_set_mem_alloc (&im->ipsec6_if_pool_index_by_key, &key6, |
| 364 | t - im->tunnel_interfaces); |
| 365 | else |
| 366 | hash_set (im->ipsec4_if_pool_index_by_key, key4.as_u64, |
| 367 | t - im->tunnel_interfaces); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 368 | |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 369 | hw_if_index = vnet_register_interface (vnm, ipsec_device_class.index, |
| 370 | t - im->tunnel_interfaces, |
| 371 | ipsec_hw_class.index, |
| 372 | t - im->tunnel_interfaces); |
Matthew Smith | e04d09d | 2017-05-14 21:47:18 -0500 | [diff] [blame] | 373 | |
| 374 | hi = vnet_get_hw_interface (vnm, hw_if_index); |
Klement Sekera | 31da2e3 | 2018-06-24 22:49:55 +0200 | [diff] [blame] | 375 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 376 | t->hw_if_index = hw_if_index; |
Neale Ranns | fe480f6 | 2019-02-28 12:03:58 +0000 | [diff] [blame] | 377 | t->sw_if_index = hi->sw_if_index; |
| 378 | |
Neale Ranns | d7603d9 | 2019-03-28 08:56:10 +0000 | [diff] [blame] | 379 | /* Standard default jumbo MTU. */ |
| 380 | vnet_sw_interface_set_mtu (vnm, t->sw_if_index, 9000); |
| 381 | |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 382 | /* Add the new tunnel to the DB of tunnels per sw_if_index ... */ |
| 383 | vec_validate_init_empty (im->ipsec_if_by_sw_if_index, t->sw_if_index, |
| 384 | ~0); |
| 385 | im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance; |
| 386 | |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 387 | ipsec_tunnel_feature_set (im, t, 1); |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 388 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 389 | /*1st interface, register protocol */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 390 | if (pool_elts (im->tunnel_interfaces) == 1) |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 391 | { |
| 392 | ip4_register_protocol (IP_PROTOCOL_IPSEC_ESP, |
| 393 | ipsec4_if_input_node.index); |
| 394 | ip6_register_protocol (IP_PROTOCOL_IPSEC_ESP, |
| 395 | ipsec6_if_input_node.index); |
| 396 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 397 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 398 | } |
| 399 | else |
| 400 | { |
Neale Ranns | c80cc9a | 2019-03-20 14:10:23 +0000 | [diff] [blame] | 401 | u32 ti; |
| 402 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 403 | /* check if exists */ |
| 404 | if (!p) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 405 | return VNET_API_ERROR_INVALID_VALUE; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 406 | |
Neale Ranns | c80cc9a | 2019-03-20 14:10:23 +0000 | [diff] [blame] | 407 | ti = p[0]; |
| 408 | t = pool_elt_at_index (im->tunnel_interfaces, ti); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 409 | hi = vnet_get_hw_interface (vnm, t->hw_if_index); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 410 | vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */ |
Matthew Smith | 537eeec | 2018-04-09 11:49:20 -0500 | [diff] [blame] | 411 | |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 412 | ipsec_tunnel_feature_set (im, t, 0); |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 413 | vnet_delete_hw_interface (vnm, t->hw_if_index); |
Matthew Smith | 01034be | 2017-05-16 11:51:18 -0500 | [diff] [blame] | 414 | |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 415 | if (is_ip6) |
| 416 | hash_unset_mem_free (&im->ipsec6_if_pool_index_by_key, &key6); |
| 417 | else |
| 418 | hash_unset (im->ipsec4_if_pool_index_by_key, key4.as_u64); |
| 419 | |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 420 | hash_unset (im->ipsec_if_real_dev_by_show_dev, t->show_instance); |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 421 | im->ipsec_if_by_sw_if_index[t->sw_if_index] = ~0; |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 422 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 423 | pool_put (im->tunnel_interfaces, t); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 424 | |
| 425 | /* delete input and output SA */ |
Neale Ranns | c80cc9a | 2019-03-20 14:10:23 +0000 | [diff] [blame] | 426 | ipsec_sa_del (ipsec_tun_mk_input_sa_id (ti)); |
| 427 | ipsec_sa_del (ipsec_tun_mk_output_sa_id (ti)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 428 | } |
Matthew Smith | e04d09d | 2017-05-14 21:47:18 -0500 | [diff] [blame] | 429 | |
| 430 | if (sw_if_index) |
| 431 | *sw_if_index = hi->sw_if_index; |
| 432 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 433 | return 0; |
| 434 | } |
| 435 | |
| 436 | int |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 437 | ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, |
| 438 | u8 is_outbound) |
| 439 | { |
| 440 | ipsec_main_t *im = &ipsec_main; |
| 441 | vnet_hw_interface_t *hi; |
| 442 | ipsec_tunnel_if_t *t; |
| 443 | ipsec_sa_t *sa, *old_sa; |
| 444 | u32 sa_index, old_sa_index; |
| 445 | uword *p; |
| 446 | |
| 447 | hi = vnet_get_hw_interface (vnm, hw_if_index); |
| 448 | t = pool_elt_at_index (im->tunnel_interfaces, hi->dev_instance); |
| 449 | |
| 450 | sa_index = ipsec_get_sa_index_by_sa_id (sa_id); |
| 451 | if (sa_index == ~0) |
| 452 | { |
| 453 | clib_warning ("SA with ID %u not found", sa_id); |
| 454 | return VNET_API_ERROR_INVALID_VALUE; |
| 455 | } |
| 456 | |
| 457 | if (ipsec_is_sa_used (sa_index)) |
| 458 | { |
| 459 | clib_warning ("SA with ID %u is already in use", sa_id); |
| 460 | return VNET_API_ERROR_INVALID_VALUE; |
| 461 | } |
| 462 | |
| 463 | sa = pool_elt_at_index (im->sad, sa_index); |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 464 | |
| 465 | if (!is_outbound) |
| 466 | { |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 467 | old_sa_index = t->input_sa_index; |
| 468 | old_sa = pool_elt_at_index (im->sad, old_sa_index); |
| 469 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 470 | if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ^ |
| 471 | ipsec_sa_is_set_IS_TUNNEL_V6 (old_sa)) |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 472 | { |
| 473 | clib_warning ("IPsec interface SA endpoints type can't be changed"); |
| 474 | return VNET_API_ERROR_INVALID_VALUE; |
| 475 | } |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 476 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 477 | if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa)) |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 478 | { |
| 479 | ipsec6_tunnel_key_t key; |
| 480 | |
| 481 | /* unset old inbound hash entry. packets should stop arriving */ |
| 482 | key.remote_ip = old_sa->tunnel_src_addr.ip6; |
| 483 | key.spi = clib_host_to_net_u32 (old_sa->spi); |
| 484 | |
| 485 | p = hash_get_mem (im->ipsec6_if_pool_index_by_key, &key); |
| 486 | if (p) |
| 487 | hash_unset_mem_free (&im->ipsec6_if_pool_index_by_key, &key); |
| 488 | |
| 489 | /* set new inbound SA, then set new hash entry */ |
| 490 | t->input_sa_index = sa_index; |
| 491 | key.remote_ip = sa->tunnel_src_addr.ip6; |
| 492 | key.spi = clib_host_to_net_u32 (sa->spi); |
| 493 | |
| 494 | hash_set_mem_alloc (&im->ipsec6_if_pool_index_by_key, &key, |
| 495 | hi->dev_instance); |
| 496 | } |
| 497 | else |
| 498 | { |
| 499 | ipsec4_tunnel_key_t key; |
| 500 | |
| 501 | /* unset old inbound hash entry. packets should stop arriving */ |
| 502 | key.remote_ip = old_sa->tunnel_src_addr.ip4.as_u32; |
| 503 | key.spi = clib_host_to_net_u32 (old_sa->spi); |
| 504 | |
| 505 | p = hash_get (im->ipsec4_if_pool_index_by_key, key.as_u64); |
| 506 | if (p) |
| 507 | hash_unset (im->ipsec4_if_pool_index_by_key, key.as_u64); |
| 508 | |
| 509 | /* set new inbound SA, then set new hash entry */ |
| 510 | t->input_sa_index = sa_index; |
| 511 | key.remote_ip = sa->tunnel_src_addr.ip4.as_u32; |
| 512 | key.spi = clib_host_to_net_u32 (sa->spi); |
| 513 | |
| 514 | hash_set (im->ipsec4_if_pool_index_by_key, key.as_u64, |
| 515 | hi->dev_instance); |
| 516 | } |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 517 | } |
| 518 | else |
| 519 | { |
| 520 | old_sa_index = t->output_sa_index; |
| 521 | old_sa = pool_elt_at_index (im->sad, old_sa_index); |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 522 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 523 | if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ^ |
| 524 | ipsec_sa_is_set_IS_TUNNEL_V6 (old_sa)) |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 525 | { |
| 526 | clib_warning ("IPsec interface SA endpoints type can't be changed"); |
| 527 | return VNET_API_ERROR_INVALID_VALUE; |
| 528 | } |
| 529 | |
Neale Ranns | d6c9e82 | 2019-04-17 16:29:00 -0700 | [diff] [blame] | 530 | /* |
| 531 | * re-enable the feature to get the new SA in |
| 532 | * the workers are stopped so no packets are sent in the clear |
| 533 | */ |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 534 | ipsec_tunnel_feature_set (im, t, 0); |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 535 | t->output_sa_index = sa_index; |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 536 | ipsec_tunnel_feature_set (im, t, 1); |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 537 | } |
| 538 | |
| 539 | /* remove sa_id to sa_index mapping on old SA */ |
| 540 | if (ipsec_get_sa_index_by_sa_id (old_sa->id) == old_sa_index) |
| 541 | hash_unset (im->sa_index_by_sa_id, old_sa->id); |
| 542 | |
Matthew Smith | 41b25cf | 2018-12-05 14:41:21 -0600 | [diff] [blame] | 543 | if (ipsec_add_del_sa_sess_cb (im, old_sa_index, 0)) |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 544 | { |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 545 | clib_warning ("IPsec backend add/del callback returned error"); |
| 546 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 547 | } |
Neale Ranns | d6c9e82 | 2019-04-17 16:29:00 -0700 | [diff] [blame] | 548 | ipsec_sa_del (old_sa->id); |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 549 | |
| 550 | return 0; |
| 551 | } |
| 552 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 553 | clib_error_t * |
| 554 | ipsec_tunnel_if_init (vlib_main_t * vm) |
| 555 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 556 | ipsec_main_t *im = &ipsec_main; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 557 | |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 558 | /* initialize the ipsec-if ip4 hash */ |
| 559 | im->ipsec4_if_pool_index_by_key = |
| 560 | hash_create (0, sizeof (ipsec4_tunnel_key_t)); |
| 561 | /* initialize the ipsec-if ip6 hash */ |
| 562 | im->ipsec6_if_pool_index_by_key = hash_create_mem (0, |
| 563 | sizeof |
| 564 | (ipsec6_tunnel_key_t), |
| 565 | sizeof (uword)); |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 566 | im->ipsec_if_real_dev_by_show_dev = hash_create (0, sizeof (uword)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 567 | |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 568 | udp_register_dst_port (vm, UDP_DST_PORT_ipsec, ipsec4_if_input_node.index, |
Kingwel Xie | 00bff19 | 2019-03-07 01:25:32 -0500 | [diff] [blame] | 569 | 1); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 570 | return 0; |
| 571 | } |
| 572 | |
| 573 | VLIB_INIT_FUNCTION (ipsec_tunnel_if_init); |
| 574 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 575 | |
| 576 | /* |
| 577 | * fd.io coding-style-patch-verification: ON |
| 578 | * |
| 579 | * Local Variables: |
| 580 | * eval: (c-set-style "gnu") |
| 581 | * End: |
| 582 | */ |