Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 15 | #ifndef __IPSEC_H__ |
| 16 | #define __IPSEC_H__ |
| 17 | |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 18 | #include <vnet/ip/ip.h> |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 19 | #include <vnet/crypto/crypto.h> |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 20 | #include <vnet/feature/feature.h> |
| 21 | |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 22 | #include <vppinfra/types.h> |
| 23 | #include <vppinfra/cache.h> |
| 24 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 25 | #include <vnet/ipsec/ipsec_spd.h> |
| 26 | #include <vnet/ipsec/ipsec_spd_policy.h> |
| 27 | #include <vnet/ipsec/ipsec_sa.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 28 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 29 | typedef clib_error_t *(*add_del_sa_sess_cb_t) (u32 sa_index, u8 is_add); |
| 30 | typedef clib_error_t *(*check_support_cb_t) (ipsec_sa_t * sa); |
| 31 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 32 | typedef struct |
| 33 | { |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 34 | u8 *name; |
| 35 | /* add/del callback */ |
| 36 | add_del_sa_sess_cb_t add_del_sa_sess_cb; |
| 37 | /* check support function */ |
| 38 | check_support_cb_t check_support_cb; |
| 39 | u32 ah4_encrypt_node_index; |
| 40 | u32 ah4_decrypt_node_index; |
| 41 | u32 ah4_encrypt_next_index; |
| 42 | u32 ah4_decrypt_next_index; |
| 43 | u32 ah6_encrypt_node_index; |
| 44 | u32 ah6_decrypt_node_index; |
| 45 | u32 ah6_encrypt_next_index; |
| 46 | u32 ah6_decrypt_next_index; |
| 47 | } ipsec_ah_backend_t; |
| 48 | |
| 49 | typedef struct |
| 50 | { |
| 51 | u8 *name; |
| 52 | /* add/del callback */ |
| 53 | add_del_sa_sess_cb_t add_del_sa_sess_cb; |
| 54 | /* check support function */ |
| 55 | check_support_cb_t check_support_cb; |
| 56 | u32 esp4_encrypt_node_index; |
| 57 | u32 esp4_decrypt_node_index; |
| 58 | u32 esp4_encrypt_next_index; |
| 59 | u32 esp4_decrypt_next_index; |
| 60 | u32 esp6_encrypt_node_index; |
| 61 | u32 esp6_decrypt_node_index; |
| 62 | u32 esp6_encrypt_next_index; |
| 63 | u32 esp6_decrypt_next_index; |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 64 | u32 esp4_encrypt_tun_feature_index; |
| 65 | u32 esp6_encrypt_tun_feature_index; |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 66 | } ipsec_esp_backend_t; |
Sergio Gonzalez Monroy | d04b60b | 2017-01-20 15:35:23 +0000 | [diff] [blame] | 67 | |
| 68 | typedef struct |
| 69 | { |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 70 | vnet_crypto_op_id_t enc_op_id; |
| 71 | vnet_crypto_op_id_t dec_op_id; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 72 | vnet_crypto_alg_t alg; |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 73 | u8 iv_size; |
| 74 | u8 block_size; |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 75 | u8 icv_size; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 76 | } ipsec_main_crypto_alg_t; |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 77 | |
| 78 | typedef struct |
| 79 | { |
Damjan Marion | 060bfb9 | 2019-03-29 13:47:54 +0100 | [diff] [blame] | 80 | vnet_crypto_op_id_t op_id; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 81 | vnet_crypto_alg_t alg; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 82 | u8 icv_size; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 83 | } ipsec_main_integ_alg_t; |
Klement Sekera | 4f10db3 | 2018-11-12 14:32:19 +0100 | [diff] [blame] | 84 | |
| 85 | typedef struct |
| 86 | { |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 87 | vnet_crypto_op_t *crypto_ops; |
| 88 | vnet_crypto_op_t *integ_ops; |
| 89 | } ipsec_per_thread_data_t; |
| 90 | |
| 91 | typedef struct |
| 92 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 93 | /* pool of tunnel instances */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 94 | ipsec_spd_t *spds; |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 95 | /* Pool of security associations */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 96 | ipsec_sa_t *sad; |
Neale Ranns | a09c1ff | 2019-02-04 01:10:30 -0800 | [diff] [blame] | 97 | /* pool of policies */ |
| 98 | ipsec_policy_t *policies; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 99 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 100 | uword *tunnel_index_by_key; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 101 | |
| 102 | /* convenience */ |
| 103 | vlib_main_t *vlib_main; |
| 104 | vnet_main_t *vnet_main; |
| 105 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 106 | /* hashes */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 107 | uword *spd_index_by_spd_id; |
| 108 | uword *spd_index_by_sw_if_index; |
| 109 | uword *sa_index_by_sa_id; |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 110 | uword *ipsec4_if_pool_index_by_key; |
| 111 | uword *ipsec6_if_pool_index_by_key; |
Matthew Smith | 8e1039a | 2018-04-12 07:32:56 -0500 | [diff] [blame] | 112 | uword *ipsec_if_real_dev_by_show_dev; |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 113 | uword *ipsec_if_by_sw_if_index; |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 114 | uword *tun4_protect_by_key; |
| 115 | uword *tun6_protect_by_key; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 116 | |
Paul Vinciguerra | bdc0e6b | 2018-09-22 05:32:50 -0700 | [diff] [blame] | 117 | /* node indices */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 118 | u32 error_drop_node_index; |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 119 | u32 esp4_encrypt_node_index; |
| 120 | u32 esp4_decrypt_node_index; |
| 121 | u32 ah4_encrypt_node_index; |
| 122 | u32 ah4_decrypt_node_index; |
| 123 | u32 esp6_encrypt_node_index; |
| 124 | u32 esp6_decrypt_node_index; |
| 125 | u32 ah6_encrypt_node_index; |
| 126 | u32 ah6_decrypt_node_index; |
Paul Vinciguerra | bdc0e6b | 2018-09-22 05:32:50 -0700 | [diff] [blame] | 127 | /* next node indices */ |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 128 | u32 esp4_encrypt_next_index; |
| 129 | u32 esp4_decrypt_next_index; |
| 130 | u32 ah4_encrypt_next_index; |
| 131 | u32 ah4_decrypt_next_index; |
| 132 | u32 esp6_encrypt_next_index; |
| 133 | u32 esp6_decrypt_next_index; |
| 134 | u32 ah6_encrypt_next_index; |
| 135 | u32 ah6_decrypt_next_index; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 136 | |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 137 | /* tun encrypt arcs and feature nodes */ |
| 138 | u32 esp4_encrypt_tun_feature_index; |
| 139 | u32 esp6_encrypt_tun_feature_index; |
| 140 | |
Matthew Smith | 401aedf | 2019-07-08 14:45:04 -0500 | [diff] [blame] | 141 | /* tun nodes to drop packets when no crypto alg set on outbound SA */ |
| 142 | u32 esp4_no_crypto_tun_feature_index; |
| 143 | u32 esp6_no_crypto_tun_feature_index; |
| 144 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 145 | /* pool of ah backends */ |
| 146 | ipsec_ah_backend_t *ah_backends; |
| 147 | /* pool of esp backends */ |
| 148 | ipsec_esp_backend_t *esp_backends; |
| 149 | /* index of current ah backend */ |
| 150 | u32 ah_current_backend; |
| 151 | /* index of current esp backend */ |
| 152 | u32 esp_current_backend; |
| 153 | /* index of default ah backend */ |
| 154 | u32 ah_default_backend; |
| 155 | /* index of default esp backend */ |
| 156 | u32 esp_default_backend; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 157 | |
| 158 | /* crypto alg data */ |
| 159 | ipsec_main_crypto_alg_t *crypto_algs; |
| 160 | |
| 161 | /* crypto integ data */ |
| 162 | ipsec_main_integ_alg_t *integ_algs; |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 163 | |
| 164 | /* per-thread data */ |
| 165 | ipsec_per_thread_data_t *ptd; |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame^] | 166 | |
| 167 | /** Worker handoff */ |
| 168 | u32 ah4_enc_fq_index; |
| 169 | u32 ah4_dec_fq_index; |
| 170 | u32 ah6_enc_fq_index; |
| 171 | u32 ah6_dec_fq_index; |
| 172 | |
| 173 | u32 esp4_enc_fq_index; |
| 174 | u32 esp4_dec_fq_index; |
| 175 | u32 esp6_enc_fq_index; |
| 176 | u32 esp6_dec_fq_index; |
| 177 | u32 esp4_enc_tun_fq_index; |
| 178 | u32 esp6_enc_tun_fq_index; |
| 179 | u32 esp4_dec_tun_fq_index; |
| 180 | u32 esp6_dec_tun_fq_index; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 181 | } ipsec_main_t; |
| 182 | |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 183 | typedef enum ipsec_format_flags_t_ |
| 184 | { |
| 185 | IPSEC_FORMAT_BRIEF = 0, |
| 186 | IPSEC_FORMAT_DETAIL = (1 << 0), |
Christian E. Hopps | 01d61e7 | 2019-09-27 14:43:22 -0400 | [diff] [blame] | 187 | IPSEC_FORMAT_INSECURE = (1 << 1), |
Neale Ranns | b294f10 | 2019-04-03 13:17:50 +0000 | [diff] [blame] | 188 | } ipsec_format_flags_t; |
| 189 | |
Dave Wallace | 71612d6 | 2017-10-24 01:32:41 -0400 | [diff] [blame] | 190 | extern ipsec_main_t ipsec_main; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 191 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 192 | clib_error_t *ipsec_add_del_sa_sess_cb (ipsec_main_t * im, u32 sa_index, |
| 193 | u8 is_add); |
| 194 | |
| 195 | clib_error_t *ipsec_check_support_cb (ipsec_main_t * im, ipsec_sa_t * sa); |
| 196 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 197 | extern vlib_node_registration_t ah4_encrypt_node; |
| 198 | extern vlib_node_registration_t ah4_decrypt_node; |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 199 | extern vlib_node_registration_t ah6_encrypt_node; |
| 200 | extern vlib_node_registration_t ah6_decrypt_node; |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame^] | 201 | extern vlib_node_registration_t esp4_encrypt_node; |
| 202 | extern vlib_node_registration_t esp4_decrypt_node; |
| 203 | extern vlib_node_registration_t esp6_encrypt_node; |
| 204 | extern vlib_node_registration_t esp6_decrypt_node; |
| 205 | extern vlib_node_registration_t esp4_encrypt_tun_node; |
| 206 | extern vlib_node_registration_t esp6_encrypt_tun_node; |
| 207 | extern vlib_node_registration_t esp4_decrypt_tun_node; |
| 208 | extern vlib_node_registration_t esp6_decrypt_tun_node; |
Kingwel Xie | 1ba5bc8 | 2019-03-20 07:21:58 -0400 | [diff] [blame] | 209 | extern vlib_node_registration_t ipsec4_if_input_node; |
| 210 | extern vlib_node_registration_t ipsec6_if_input_node; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 211 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 212 | /* |
| 213 | * functions |
| 214 | */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 215 | u8 *format_ipsec_replay_window (u8 * s, va_list * args); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 216 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 217 | /* |
| 218 | * inline functions |
| 219 | */ |
| 220 | |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 221 | static_always_inline u32 |
| 222 | get_next_output_feature_node_index (vlib_buffer_t * b, |
| 223 | vlib_node_runtime_t * nr) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 224 | { |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 225 | u32 next; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 226 | vlib_main_t *vm = vlib_get_main (); |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 227 | vlib_node_t *node = vlib_get_node (vm, nr->node_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 228 | |
Damjan Marion | 7d98a12 | 2018-07-19 20:42:08 +0200 | [diff] [blame] | 229 | vnet_feature_next (&next, b); |
Matus Fabian | 08a6f01 | 2016-11-15 06:08:51 -0800 | [diff] [blame] | 230 | return node->next_nodes[next]; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 231 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 232 | |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 233 | u32 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im, |
| 234 | const char *name, |
| 235 | const char *ah4_encrypt_node_name, |
| 236 | const char *ah4_decrypt_node_name, |
| 237 | const char *ah6_encrypt_node_name, |
| 238 | const char *ah6_decrypt_node_name, |
| 239 | check_support_cb_t ah_check_support_cb, |
| 240 | add_del_sa_sess_cb_t ah_add_del_sa_sess_cb); |
| 241 | |
| 242 | u32 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im, |
| 243 | const char *name, |
| 244 | const char *esp4_encrypt_node_name, |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 245 | const char *esp4_encrypt_tun_node_name, |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 246 | const char *esp4_decrypt_node_name, |
| 247 | const char *esp6_encrypt_node_name, |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 248 | const char *esp6_encrypt_tun_node_name, |
Klement Sekera | b4d3053 | 2018-11-08 13:00:02 +0100 | [diff] [blame] | 249 | const char *esp6_decrypt_node_name, |
| 250 | check_support_cb_t esp_check_support_cb, |
| 251 | add_del_sa_sess_cb_t esp_add_del_sa_sess_cb); |
| 252 | |
| 253 | int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx); |
| 254 | int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx); |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 255 | |
Neale Ranns | e8915fc | 2019-04-23 20:57:55 -0400 | [diff] [blame] | 256 | clib_error_t *ipsec_rsc_in_use (ipsec_main_t * im); |
| 257 | |
Neale Ranns | 25edf14 | 2019-03-22 08:12:48 +0000 | [diff] [blame] | 258 | always_inline ipsec_sa_t * |
| 259 | ipsec_sa_get (u32 sa_index) |
| 260 | { |
| 261 | return (pool_elt_at_index (ipsec_main.sad, sa_index)); |
| 262 | } |
| 263 | |
Matthew Smith | 401aedf | 2019-07-08 14:45:04 -0500 | [diff] [blame] | 264 | void ipsec_add_feature (const char *arc_name, const char *node_name, |
| 265 | u32 * out_feature_index); |
| 266 | |
Prashant Maheshwari | dbf68c9 | 2019-11-14 12:42:59 +0530 | [diff] [blame] | 267 | |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 268 | #endif /* __IPSEC_H__ */ |
| 269 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 270 | /* |
| 271 | * fd.io coding-style-patch-verification: ON |
| 272 | * |
| 273 | * Local Variables: |
| 274 | * eval: (c-set-style "gnu") |
| 275 | * End: |
| 276 | */ |