Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * decap.c : IPSec tunnel support |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | #include <vnet/interface.h> |
Klement Sekera | 4b089f2 | 2018-04-17 18:04:57 +0200 | [diff] [blame] | 22 | #include <vnet/udp/udp.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 23 | |
| 24 | #include <vnet/ipsec/ipsec.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 25 | #include <vnet/ipsec/ikev2.h> |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 26 | #include <vnet/ipsec/esp.h> |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 27 | #include <vnet/ipsec/ah.h> |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 28 | |
Klement Sekera | 4b089f2 | 2018-04-17 18:04:57 +0200 | [diff] [blame] | 29 | |
Dave Wallace | 71612d6 | 2017-10-24 01:32:41 -0400 | [diff] [blame] | 30 | ipsec_main_t ipsec_main; |
| 31 | |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 32 | u32 |
| 33 | ipsec_get_sa_index_by_sa_id (u32 sa_id) |
| 34 | { |
| 35 | ipsec_main_t *im = &ipsec_main; |
| 36 | uword *p = hash_get (im->sa_index_by_sa_id, sa_id); |
| 37 | if (!p) |
| 38 | return ~0; |
| 39 | |
| 40 | return p[0]; |
| 41 | } |
| 42 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 43 | int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 44 | ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id, |
| 45 | int is_add) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 46 | { |
| 47 | ipsec_main_t *im = &ipsec_main; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 48 | ip4_ipsec_config_t config; |
| 49 | |
Damjan Marion | 8b3191e | 2016-11-09 19:54:20 +0100 | [diff] [blame] | 50 | u32 spd_index; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 51 | uword *p; |
| 52 | |
| 53 | p = hash_get (im->spd_index_by_spd_id, spd_id); |
| 54 | if (!p) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 55 | return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 56 | |
| 57 | spd_index = p[0]; |
| 58 | |
| 59 | p = hash_get (im->spd_index_by_sw_if_index, sw_if_index); |
| 60 | if (p && is_add) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 61 | return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 62 | |
| 63 | if (is_add) |
| 64 | { |
| 65 | hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index); |
| 66 | } |
| 67 | else |
| 68 | { |
| 69 | hash_unset (im->spd_index_by_sw_if_index, sw_if_index); |
| 70 | } |
| 71 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 72 | clib_warning ("sw_if_index %u spd_id %u spd_index %u", |
| 73 | sw_if_index, spd_id, spd_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 74 | |
| 75 | /* enable IPsec on TX */ |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 76 | vnet_feature_enable_disable ("ip4-output", "ipsec-output-ip4", sw_if_index, |
| 77 | is_add, 0, 0); |
| 78 | vnet_feature_enable_disable ("ip6-output", "ipsec-output-ip6", sw_if_index, |
| 79 | is_add, 0, 0); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 80 | |
| 81 | /* enable IPsec on RX */ |
Damjan Marion | 8b3191e | 2016-11-09 19:54:20 +0100 | [diff] [blame] | 82 | vnet_feature_enable_disable ("ip4-unicast", "ipsec-input-ip4", sw_if_index, |
| 83 | is_add, &config, sizeof (config)); |
| 84 | vnet_feature_enable_disable ("ip6-unicast", "ipsec-input-ip6", sw_if_index, |
| 85 | is_add, &config, sizeof (config)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 86 | |
| 87 | return 0; |
| 88 | } |
| 89 | |
| 90 | int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 91 | ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 92 | { |
| 93 | ipsec_main_t *im = &ipsec_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 94 | ipsec_spd_t *spd = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 95 | uword *p; |
| 96 | u32 spd_index, k, v; |
| 97 | |
| 98 | p = hash_get (im->spd_index_by_spd_id, spd_id); |
| 99 | if (p && is_add) |
| 100 | return VNET_API_ERROR_INVALID_VALUE; |
| 101 | if (!p && !is_add) |
| 102 | return VNET_API_ERROR_INVALID_VALUE; |
| 103 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 104 | if (!is_add) /* delete */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 105 | { |
| 106 | spd_index = p[0]; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 107 | spd = pool_elt_at_index (im->spds, spd_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 108 | if (!spd) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 109 | return VNET_API_ERROR_INVALID_VALUE; |
| 110 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 111 | hash_foreach (k, v, im->spd_index_by_sw_if_index, ({ |
| 112 | if (v == spd_index) |
| 113 | ipsec_set_interface_spd(vm, k, spd_id, 0); |
| 114 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 115 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 116 | hash_unset (im->spd_index_by_spd_id, spd_id); |
| 117 | pool_free (spd->policies); |
| 118 | vec_free (spd->ipv4_outbound_policies); |
| 119 | vec_free (spd->ipv6_outbound_policies); |
| 120 | vec_free (spd->ipv4_inbound_protect_policy_indices); |
| 121 | vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices); |
| 122 | pool_put (im->spds, spd); |
| 123 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 124 | else /* create new SPD */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 125 | { |
| 126 | pool_get (im->spds, spd); |
| 127 | memset (spd, 0, sizeof (*spd)); |
| 128 | spd_index = spd - im->spds; |
| 129 | spd->id = spd_id; |
| 130 | hash_set (im->spd_index_by_spd_id, spd_id, spd_index); |
| 131 | } |
| 132 | return 0; |
| 133 | } |
| 134 | |
| 135 | static int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 136 | ipsec_spd_entry_sort (void *a1, void *a2) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 137 | { |
| 138 | ipsec_main_t *im = &ipsec_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 139 | u32 *id1 = a1; |
| 140 | u32 *id2 = a2; |
| 141 | ipsec_spd_t *spd; |
| 142 | ipsec_policy_t *p1, *p2; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 143 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 144 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 145 | pool_foreach (spd, im->spds, ({ |
| 146 | p1 = pool_elt_at_index(spd->policies, *id1); |
| 147 | p2 = pool_elt_at_index(spd->policies, *id2); |
| 148 | if (p1 && p2) |
| 149 | return p2->priority - p1->priority; |
| 150 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 151 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 152 | |
| 153 | return 0; |
| 154 | } |
| 155 | |
| 156 | int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 157 | ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 158 | { |
| 159 | ipsec_main_t *im = &ipsec_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 160 | ipsec_spd_t *spd = 0; |
| 161 | ipsec_policy_t *vp; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 162 | uword *p; |
| 163 | u32 spd_index; |
| 164 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 165 | clib_warning ("policy-id %u priority %d is_outbound %u", policy->id, |
| 166 | policy->priority, policy->is_outbound); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 167 | |
| 168 | if (policy->policy == IPSEC_POLICY_ACTION_PROTECT) |
| 169 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 170 | p = hash_get (im->sa_index_by_sa_id, policy->sa_id); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 171 | if (!p) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 172 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 173 | policy->sa_index = p[0]; |
| 174 | } |
| 175 | |
| 176 | p = hash_get (im->spd_index_by_spd_id, policy->id); |
| 177 | |
| 178 | if (!p) |
| 179 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
| 180 | |
| 181 | spd_index = p[0]; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 182 | spd = pool_elt_at_index (im->spds, spd_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 183 | if (!spd) |
| 184 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
| 185 | |
| 186 | if (is_add) |
| 187 | { |
| 188 | u32 policy_index; |
| 189 | |
| 190 | pool_get (spd->policies, vp); |
Damjan Marion | f1213b8 | 2016-03-13 02:22:06 +0100 | [diff] [blame] | 191 | clib_memcpy (vp, policy, sizeof (*vp)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 192 | policy_index = vp - spd->policies; |
| 193 | |
| 194 | if (policy->is_outbound) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 195 | { |
| 196 | if (policy->is_ipv6) |
| 197 | { |
| 198 | vec_add1 (spd->ipv6_outbound_policies, policy_index); |
| 199 | clib_memcpy (vp, policy, sizeof (ipsec_policy_t)); |
| 200 | vec_sort_with_function (spd->ipv6_outbound_policies, |
| 201 | ipsec_spd_entry_sort); |
| 202 | } |
| 203 | else |
| 204 | { |
| 205 | vec_add1 (spd->ipv4_outbound_policies, policy_index); |
| 206 | clib_memcpy (vp, policy, sizeof (ipsec_policy_t)); |
| 207 | vec_sort_with_function (spd->ipv4_outbound_policies, |
| 208 | ipsec_spd_entry_sort); |
| 209 | } |
| 210 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 211 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 212 | { |
| 213 | if (policy->is_ipv6) |
| 214 | { |
| 215 | if (policy->policy == IPSEC_POLICY_ACTION_PROTECT) |
| 216 | { |
| 217 | vec_add1 (spd->ipv6_inbound_protect_policy_indices, |
| 218 | policy_index); |
| 219 | clib_memcpy (vp, policy, sizeof (ipsec_policy_t)); |
Ed Warnicke | 853e720 | 2016-08-12 11:42:26 -0700 | [diff] [blame] | 220 | vec_sort_with_function |
| 221 | (spd->ipv6_inbound_protect_policy_indices, |
| 222 | ipsec_spd_entry_sort); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 223 | } |
| 224 | else |
| 225 | { |
Ed Warnicke | 853e720 | 2016-08-12 11:42:26 -0700 | [diff] [blame] | 226 | vec_add1 |
| 227 | (spd->ipv6_inbound_policy_discard_and_bypass_indices, |
| 228 | policy_index); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 229 | clib_memcpy (vp, policy, sizeof (ipsec_policy_t)); |
Ed Warnicke | 853e720 | 2016-08-12 11:42:26 -0700 | [diff] [blame] | 230 | vec_sort_with_function |
| 231 | (spd->ipv6_inbound_policy_discard_and_bypass_indices, |
| 232 | ipsec_spd_entry_sort); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 233 | } |
| 234 | } |
| 235 | else |
| 236 | { |
| 237 | if (policy->policy == IPSEC_POLICY_ACTION_PROTECT) |
| 238 | { |
| 239 | vec_add1 (spd->ipv4_inbound_protect_policy_indices, |
| 240 | policy_index); |
| 241 | clib_memcpy (vp, policy, sizeof (ipsec_policy_t)); |
Ed Warnicke | 853e720 | 2016-08-12 11:42:26 -0700 | [diff] [blame] | 242 | vec_sort_with_function |
| 243 | (spd->ipv4_inbound_protect_policy_indices, |
| 244 | ipsec_spd_entry_sort); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 245 | } |
| 246 | else |
| 247 | { |
Ed Warnicke | 853e720 | 2016-08-12 11:42:26 -0700 | [diff] [blame] | 248 | vec_add1 |
| 249 | (spd->ipv4_inbound_policy_discard_and_bypass_indices, |
| 250 | policy_index); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 251 | clib_memcpy (vp, policy, sizeof (ipsec_policy_t)); |
Ed Warnicke | 853e720 | 2016-08-12 11:42:26 -0700 | [diff] [blame] | 252 | vec_sort_with_function |
| 253 | (spd->ipv4_inbound_policy_discard_and_bypass_indices, |
| 254 | ipsec_spd_entry_sort); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 255 | } |
| 256 | } |
| 257 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 258 | |
| 259 | } |
| 260 | else |
| 261 | { |
| 262 | u32 i, j; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 263 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 264 | pool_foreach_index(i, spd->policies, ({ |
Damjan Marion | 607de1a | 2016-08-16 22:53:54 +0200 | [diff] [blame] | 265 | vp = pool_elt_at_index(spd->policies, i); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 266 | if (vp->priority != policy->priority) |
| 267 | continue; |
| 268 | if (vp->is_outbound != policy->is_outbound) |
| 269 | continue; |
| 270 | if (vp->policy != policy->policy) |
| 271 | continue; |
| 272 | if (vp->sa_id != policy->sa_id) |
| 273 | continue; |
| 274 | if (vp->protocol != policy->protocol) |
| 275 | continue; |
| 276 | if (vp->lport.start != policy->lport.start) |
| 277 | continue; |
| 278 | if (vp->lport.stop != policy->lport.stop) |
| 279 | continue; |
| 280 | if (vp->rport.start != policy->rport.start) |
| 281 | continue; |
| 282 | if (vp->rport.stop != policy->rport.stop) |
| 283 | continue; |
| 284 | if (vp->is_ipv6 != policy->is_ipv6) |
| 285 | continue; |
| 286 | if (policy->is_ipv6) |
| 287 | { |
| 288 | if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0]) |
| 289 | continue; |
| 290 | if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1]) |
| 291 | continue; |
| 292 | if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0]) |
| 293 | continue; |
| 294 | if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1]) |
| 295 | continue; |
| 296 | if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0]) |
| 297 | continue; |
| 298 | if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1]) |
| 299 | continue; |
| 300 | if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0]) |
| 301 | continue; |
| 302 | if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1]) |
| 303 | continue; |
| 304 | if (policy->is_outbound) |
| 305 | { |
| 306 | vec_foreach_index(j, spd->ipv6_outbound_policies) { |
| 307 | if (vec_elt(spd->ipv6_outbound_policies, j) == i) { |
| 308 | vec_del1 (spd->ipv6_outbound_policies, j); |
| 309 | break; |
| 310 | } |
| 311 | } |
| 312 | } |
| 313 | else |
| 314 | { |
| 315 | if (policy->policy == IPSEC_POLICY_ACTION_PROTECT) |
| 316 | { |
| 317 | vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) { |
| 318 | if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) { |
| 319 | vec_del1 (spd->ipv6_inbound_protect_policy_indices, j); |
| 320 | break; |
| 321 | } |
| 322 | } |
| 323 | } |
| 324 | else |
| 325 | { |
| 326 | vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) { |
| 327 | if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) { |
| 328 | vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j); |
| 329 | break; |
| 330 | } |
| 331 | } |
| 332 | } |
| 333 | } |
| 334 | } |
| 335 | else |
| 336 | { |
| 337 | if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32) |
| 338 | continue; |
| 339 | if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32) |
| 340 | continue; |
| 341 | if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32) |
| 342 | continue; |
| 343 | if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32) |
| 344 | continue; |
| 345 | if (policy->is_outbound) |
| 346 | { |
| 347 | vec_foreach_index(j, spd->ipv4_outbound_policies) { |
| 348 | if (vec_elt(spd->ipv4_outbound_policies, j) == i) { |
| 349 | vec_del1 (spd->ipv4_outbound_policies, j); |
| 350 | break; |
| 351 | } |
Damjan Marion | 607de1a | 2016-08-16 22:53:54 +0200 | [diff] [blame] | 352 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 353 | } |
| 354 | else |
| 355 | { |
| 356 | if (policy->policy == IPSEC_POLICY_ACTION_PROTECT) |
| 357 | { |
| 358 | vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) { |
| 359 | if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) { |
| 360 | vec_del1 (spd->ipv4_inbound_protect_policy_indices, j); |
| 361 | break; |
| 362 | } |
| 363 | } |
| 364 | } |
| 365 | else |
| 366 | { |
| 367 | vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) { |
| 368 | if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) { |
| 369 | vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j); |
| 370 | break; |
Matus Fabian | ce8805c | 2018-03-16 05:44:24 -0700 | [diff] [blame] | 371 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 372 | } |
| 373 | } |
| 374 | } |
| 375 | } |
| 376 | pool_put (spd->policies, vp); |
| 377 | break; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 378 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 379 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 380 | } |
| 381 | |
| 382 | return 0; |
| 383 | } |
| 384 | |
Matthew Smith | ca514fd | 2017-10-12 12:06:59 -0500 | [diff] [blame] | 385 | u8 |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 386 | ipsec_is_sa_used (u32 sa_index) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 387 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 388 | ipsec_main_t *im = &ipsec_main; |
| 389 | ipsec_spd_t *spd; |
| 390 | ipsec_policy_t *p; |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 391 | ipsec_tunnel_if_t *t; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 392 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 393 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 394 | pool_foreach(spd, im->spds, ({ |
| 395 | pool_foreach(p, spd->policies, ({ |
| 396 | if (p->policy == IPSEC_POLICY_ACTION_PROTECT) |
| 397 | { |
| 398 | if (p->sa_index == sa_index) |
| 399 | return 1; |
| 400 | } |
| 401 | })); |
| 402 | })); |
Matus Fabian | 694265d | 2016-08-10 01:55:36 -0700 | [diff] [blame] | 403 | |
| 404 | pool_foreach(t, im->tunnel_interfaces, ({ |
| 405 | if (t->input_sa_index == sa_index) |
| 406 | return 1; |
| 407 | if (t->output_sa_index == sa_index) |
| 408 | return 1; |
| 409 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 410 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 411 | |
| 412 | return 0; |
| 413 | } |
| 414 | |
| 415 | int |
Klement Sekera | 4b089f2 | 2018-04-17 18:04:57 +0200 | [diff] [blame] | 416 | ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add, |
| 417 | u8 udp_encap) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 418 | { |
| 419 | ipsec_main_t *im = &ipsec_main; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 420 | ipsec_sa_t *sa = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 421 | uword *p; |
| 422 | u32 sa_index; |
Sergio Gonzalez Monroy | 2096063 | 2017-10-12 11:43:41 +0100 | [diff] [blame] | 423 | clib_error_t *err; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 424 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 425 | clib_warning ("id %u spi %u", new_sa->id, new_sa->spi); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 426 | |
| 427 | p = hash_get (im->sa_index_by_sa_id, new_sa->id); |
| 428 | if (p && is_add) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 429 | return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 430 | if (!p && !is_add) |
| 431 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
| 432 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 433 | if (!is_add) /* delete */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 434 | { |
| 435 | sa_index = p[0]; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 436 | sa = pool_elt_at_index (im->sad, sa_index); |
| 437 | if (ipsec_is_sa_used (sa_index)) |
| 438 | { |
| 439 | clib_warning ("sa_id %u used in policy", sa->id); |
| 440 | return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */ |
| 441 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 442 | hash_unset (im->sa_index_by_sa_id, sa->id); |
Sergio Gonzalez Monroy | 2096063 | 2017-10-12 11:43:41 +0100 | [diff] [blame] | 443 | if (im->cb.add_del_sa_sess_cb) |
| 444 | { |
| 445 | err = im->cb.add_del_sa_sess_cb (sa_index, 0); |
| 446 | if (err) |
| 447 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
| 448 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 449 | pool_put (im->sad, sa); |
| 450 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 451 | else /* create new SA */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 452 | { |
| 453 | pool_get (im->sad, sa); |
Damjan Marion | f1213b8 | 2016-03-13 02:22:06 +0100 | [diff] [blame] | 454 | clib_memcpy (sa, new_sa, sizeof (*sa)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 455 | sa_index = sa - im->sad; |
Klement Sekera | 4b089f2 | 2018-04-17 18:04:57 +0200 | [diff] [blame] | 456 | sa->udp_encap = udp_encap ? 1 : 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 457 | hash_set (im->sa_index_by_sa_id, sa->id, sa_index); |
Sergio Gonzalez Monroy | 2096063 | 2017-10-12 11:43:41 +0100 | [diff] [blame] | 458 | if (im->cb.add_del_sa_sess_cb) |
| 459 | { |
| 460 | err = im->cb.add_del_sa_sess_cb (sa_index, 1); |
| 461 | if (err) |
| 462 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
| 463 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 464 | } |
| 465 | return 0; |
| 466 | } |
| 467 | |
| 468 | int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 469 | ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 470 | { |
| 471 | ipsec_main_t *im = &ipsec_main; |
| 472 | uword *p; |
| 473 | u32 sa_index; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 474 | ipsec_sa_t *sa = 0; |
Sergio Gonzalez Monroy | 2096063 | 2017-10-12 11:43:41 +0100 | [diff] [blame] | 475 | clib_error_t *err; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 476 | |
| 477 | p = hash_get (im->sa_index_by_sa_id, sa_update->id); |
| 478 | if (!p) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 479 | return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 480 | |
| 481 | sa_index = p[0]; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 482 | sa = pool_elt_at_index (im->sad, sa_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 483 | |
| 484 | /* new crypto key */ |
| 485 | if (0 < sa_update->crypto_key_len) |
| 486 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 487 | clib_memcpy (sa->crypto_key, sa_update->crypto_key, |
| 488 | sa_update->crypto_key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 489 | sa->crypto_key_len = sa_update->crypto_key_len; |
| 490 | } |
| 491 | |
| 492 | /* new integ key */ |
| 493 | if (0 < sa_update->integ_key_len) |
| 494 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 495 | clib_memcpy (sa->integ_key, sa_update->integ_key, |
| 496 | sa_update->integ_key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 497 | sa->integ_key_len = sa_update->integ_key_len; |
| 498 | } |
| 499 | |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 500 | if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len) |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 501 | { |
Sergio Gonzalez Monroy | 2096063 | 2017-10-12 11:43:41 +0100 | [diff] [blame] | 502 | if (im->cb.add_del_sa_sess_cb) |
| 503 | { |
| 504 | err = im->cb.add_del_sa_sess_cb (sa_index, 0); |
| 505 | if (err) |
| 506 | return VNET_API_ERROR_SYSCALL_ERROR_1; |
| 507 | } |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 508 | } |
| 509 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 510 | return 0; |
| 511 | } |
| 512 | |
| 513 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 514 | ipsec_rand_seed (void) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 515 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 516 | struct |
| 517 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 518 | time_t time; |
| 519 | pid_t pid; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 520 | void *p; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 521 | } seed_data; |
| 522 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 523 | seed_data.time = time (NULL); |
| 524 | seed_data.pid = getpid (); |
| 525 | seed_data.p = (void *) &seed_data; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 526 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 527 | RAND_seed ((const void *) &seed_data, sizeof (seed_data)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 528 | } |
| 529 | |
| 530 | static clib_error_t * |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 531 | ipsec_check_support (ipsec_sa_t * sa) |
| 532 | { |
| 533 | if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128) |
| 534 | return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg"); |
| 535 | if (sa->integ_alg == IPSEC_INTEG_ALG_NONE) |
| 536 | return clib_error_return (0, "unsupported none integ-alg"); |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 537 | |
| 538 | return 0; |
| 539 | } |
| 540 | |
| 541 | static clib_error_t * |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 542 | ipsec_init (vlib_main_t * vm) |
| 543 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 544 | clib_error_t *error; |
| 545 | ipsec_main_t *im = &ipsec_main; |
| 546 | vlib_thread_main_t *tm = vlib_get_thread_main (); |
| 547 | vlib_node_t *node; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 548 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 549 | ipsec_rand_seed (); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 550 | |
| 551 | memset (im, 0, sizeof (im[0])); |
| 552 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 553 | im->vnet_main = vnet_get_main (); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 554 | im->vlib_main = vm; |
| 555 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 556 | im->spd_index_by_spd_id = hash_create (0, sizeof (uword)); |
| 557 | im->sa_index_by_sa_id = hash_create (0, sizeof (uword)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 558 | im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword)); |
| 559 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 560 | vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1, |
| 561 | CLIB_CACHE_LINE_BYTES); |
Matthew Smith | 29d8510 | 2016-05-01 14:52:08 -0500 | [diff] [blame] | 562 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 563 | node = vlib_get_node_by_name (vm, (u8 *) "error-drop"); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 564 | ASSERT (node); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 565 | im->error_drop_node_index = node->index; |
| 566 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 567 | node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt"); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 568 | ASSERT (node); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 569 | im->esp_encrypt_node_index = node->index; |
| 570 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 571 | node = vlib_get_node_by_name (vm, (u8 *) "esp-decrypt"); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 572 | ASSERT (node); |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 573 | im->esp_decrypt_node_index = node->index; |
| 574 | |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 575 | node = vlib_get_node_by_name (vm, (u8 *) "ah-encrypt"); |
| 576 | ASSERT (node); |
| 577 | im->ah_encrypt_node_index = node->index; |
| 578 | |
| 579 | node = vlib_get_node_by_name (vm, (u8 *) "ah-decrypt"); |
| 580 | ASSERT (node); |
| 581 | im->ah_decrypt_node_index = node->index; |
| 582 | |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 583 | im->esp_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP_ENCRYPT; |
| 584 | im->esp_decrypt_next_index = IPSEC_INPUT_NEXT_ESP_DECRYPT; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 585 | im->ah_encrypt_next_index = IPSEC_OUTPUT_NEXT_AH_ENCRYPT; |
| 586 | im->ah_decrypt_next_index = IPSEC_INPUT_NEXT_AH_DECRYPT; |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 587 | |
| 588 | im->cb.check_support_cb = ipsec_check_support; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 589 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 590 | if ((error = vlib_call_init_function (vm, ipsec_cli_init))) |
| 591 | return error; |
| 592 | |
| 593 | if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init))) |
| 594 | return error; |
| 595 | |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 596 | ipsec_proto_init (); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 597 | |
| 598 | if ((error = ikev2_init (vm))) |
| 599 | return error; |
| 600 | |
| 601 | return 0; |
| 602 | } |
| 603 | |
| 604 | VLIB_INIT_FUNCTION (ipsec_init); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 605 | |
| 606 | /* |
| 607 | * fd.io coding-style-patch-verification: ON |
| 608 | * |
| 609 | * Local Variables: |
| 610 | * eval: (c-set-style "gnu") |
| 611 | * End: |
| 612 | */ |