2 * ipsec_itf.c: IPSec dedicated interface type
4 * Copyright (c) 2020 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/ip/ip.h>
19 #include <vnet/ipsec/ipsec_itf.h>
20 #include <vnet/ipsec/ipsec_tun.h>
21 #include <vnet/ipsec/ipsec.h>
22 #include <vnet/adj/adj_midchain.h>
23 #include <vnet/ethernet/mac_address.h>
24 #include <vnet/mpls/mpls.h>
26 /* bitmap of Allocated IPSEC_ITF instances */
27 static uword *ipsec_itf_instances;
29 /* pool of interfaces */
30 static ipsec_itf_t *ipsec_itf_pool;
32 static u32 *ipsec_itf_index_by_sw_if_index;
35 ipsec_itf_get (index_t ii)
37 return (pool_elt_at_index (ipsec_itf_pool, ii));
41 ipsec_itf_count (void)
43 return (pool_elts (ipsec_itf_pool));
47 ipsec_itf_find_by_sw_if_index (u32 sw_if_index)
49 if (vec_len (ipsec_itf_index_by_sw_if_index) <= sw_if_index)
51 u32 ti = ipsec_itf_index_by_sw_if_index[sw_if_index];
54 return pool_elt_at_index (ipsec_itf_pool, ti);
58 format_ipsec_itf_name (u8 * s, va_list * args)
60 u32 dev_instance = va_arg (*args, u32);
61 return format (s, "ipsec%d", dev_instance);
65 ipsec_itf_adj_unstack (adj_index_t ai)
67 adj_midchain_delegate_unstack (ai);
71 ipsec_itf_adj_stack (adj_index_t ai, u32 sai)
73 const vnet_hw_interface_t *hw;
75 hw = vnet_get_sup_hw_interface (vnet_get_main (), adj_get_sw_if_index (ai));
77 if (hw->flags & VNET_HW_INTERFACE_FLAG_LINK_UP)
82 sa = ipsec_sa_get (sai);
83 ip_address_to_fib_prefix (&sa->tunnel.t_dst, &dst);
84 adj_midchain_delegate_stack (ai, sa->tunnel.t_fib_index, &dst);
87 adj_midchain_delegate_unstack (ai);
91 ipsec_itf_adj_stack_cb (adj_index_t ai, void *arg)
93 ipsec_tun_protect_t *itp = arg;
95 ipsec_itf_adj_stack (ai, itp->itp_out_sa);
97 return (ADJ_WALK_RC_CONTINUE);
101 ipsec_itf_restack (index_t itpi, const ipsec_itf_t * itf)
103 ipsec_tun_protect_t *itp;
104 fib_protocol_t proto;
106 itp = ipsec_tun_protect_get (itpi);
109 * walk all the adjacencies on the interface and restack them
111 FOR_EACH_FIB_IP_PROTOCOL (proto)
113 adj_nbr_walk (itf->ii_sw_if_index, proto, ipsec_itf_adj_stack_cb, itp);
118 ipsec_tun_protect_walk_state_change (index_t itpi, void *arg)
120 const ipsec_itf_t *itf = arg;
122 ipsec_itf_restack (itpi, itf);
124 return (WALK_CONTINUE);
127 static clib_error_t *
128 ipsec_itf_admin_up_down (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
130 vnet_hw_interface_t *hi;
134 hi = vnet_get_hw_interface (vnm, hw_if_index);
135 hw_flags = (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP ?
136 VNET_HW_INTERFACE_FLAG_LINK_UP : 0);
137 vnet_hw_interface_set_flags (vnm, hw_if_index, hw_flags);
139 itf = ipsec_itf_find_by_sw_if_index (hi->sw_if_index);
142 ipsec_tun_protect_walk_itf (itf->ii_sw_if_index,
143 ipsec_tun_protect_walk_state_change, itf);
149 ipsec_itf_tunnel_desc (u32 sw_if_index,
150 ip46_address_t * src, ip46_address_t * dst, u8 * is_l2)
152 ip46_address_reset (src);
153 ip46_address_reset (dst);
160 ipsec_itf_build_rewrite (void)
163 * passing the adj code a NULL rewrite means 'i don't have one cos
164 * t'other end is unresolved'. That's not the case here. For the ipsec
165 * tunnel there are just no bytes of encap to apply in the adj.
166 * So return a zero length rewrite. Encap will be added by a tunnel mode SA.
170 vec_validate (rewrite, 0);
171 vec_reset_length (rewrite);
177 ipsec_itf_build_rewrite_i (vnet_main_t * vnm,
179 vnet_link_t link_type, const void *dst_address)
181 return (ipsec_itf_build_rewrite ());
185 ipsec_itf_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
187 adj_nbr_midchain_update_rewrite
188 (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK, ipsec_itf_build_rewrite ());
192 VNET_DEVICE_CLASS (ipsec_itf_device_class) = {
193 .name = "IPSEC Tunnel",
194 .format_device_name = format_ipsec_itf_name,
195 .admin_up_down_function = ipsec_itf_admin_up_down,
196 .ip_tun_desc = ipsec_itf_tunnel_desc,
199 VNET_HW_INTERFACE_CLASS(ipsec_hw_interface_class) = {
201 .build_rewrite = ipsec_itf_build_rewrite_i,
202 .update_adjacency = ipsec_itf_update_adj,
203 .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
205 VNET_HW_INTERFACE_CLASS(ipsec_p2mp_hw_interface_class) = {
207 .build_rewrite = ipsec_itf_build_rewrite_i,
208 .update_adjacency = ipsec_itf_update_adj,
209 .flags = VNET_HW_INTERFACE_CLASS_FLAG_NBMA,
214 * Maintain a bitmap of allocated ipsec_itf instance numbers.
216 #define IPSEC_ITF_MAX_INSTANCE (16 * 1024)
219 ipsec_itf_instance_alloc (u32 want)
222 * Check for dynamically allocated instance number.
228 bit = clib_bitmap_first_clear (ipsec_itf_instances);
229 if (bit >= IPSEC_ITF_MAX_INSTANCE)
233 ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, bit, 1);
240 if (want >= IPSEC_ITF_MAX_INSTANCE)
248 if (clib_bitmap_get (ipsec_itf_instances, want))
254 * Grant allocation request.
256 ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, want, 1);
262 ipsec_itf_instance_free (u32 instance)
264 if (instance >= IPSEC_ITF_MAX_INSTANCE)
269 if (clib_bitmap_get (ipsec_itf_instances, instance) == 0)
274 ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, instance, 0);
279 ipsec_itf_reset_tx_nodes (u32 sw_if_index)
281 vnet_feature_modify_end_node (
282 ip4_main.lookup_main.output_feature_arc_index, sw_if_index,
283 vlib_get_node_by_name (vlib_get_main (), (u8 *) "ip4-drop")->index);
284 vnet_feature_modify_end_node (
285 ip6_main.lookup_main.output_feature_arc_index, sw_if_index,
286 vlib_get_node_by_name (vlib_get_main (), (u8 *) "ip6-drop")->index);
287 vnet_feature_modify_end_node (
288 mpls_main.output_feature_arc_index, sw_if_index,
289 vlib_get_node_by_name (vlib_get_main (), (u8 *) "mpls-drop")->index);
293 ipsec_itf_create (u32 user_instance, tunnel_mode_t mode, u32 * sw_if_indexp)
295 vnet_main_t *vnm = vnet_get_main ();
296 u32 instance, hw_if_index;
297 vnet_hw_interface_t *hi;
298 ipsec_itf_t *ipsec_itf;
300 ASSERT (sw_if_indexp);
302 *sw_if_indexp = (u32) ~ 0;
305 * Allocate a ipsec_itf instance. Either select on dynamically
306 * or try to use the desired user_instance number.
308 instance = ipsec_itf_instance_alloc (user_instance);
310 return VNET_API_ERROR_INVALID_REGISTRATION;
312 pool_get (ipsec_itf_pool, ipsec_itf);
314 /* tunnel index (or instance) */
315 u32 t_idx = ipsec_itf - ipsec_itf_pool;
317 ipsec_itf->ii_mode = mode;
318 ipsec_itf->ii_user_instance = instance;
320 hw_if_index = vnet_register_interface (vnm,
321 ipsec_itf_device_class.index,
322 ipsec_itf->ii_user_instance,
323 (mode == TUNNEL_MODE_P2P ?
324 ipsec_hw_interface_class.index :
325 ipsec_p2mp_hw_interface_class.index),
328 hi = vnet_get_hw_interface (vnm, hw_if_index);
329 vnet_sw_interface_set_mtu (vnm, hi->sw_if_index, 9000);
331 vec_validate_init_empty (ipsec_itf_index_by_sw_if_index, hi->sw_if_index,
333 ipsec_itf_index_by_sw_if_index[hi->sw_if_index] = t_idx;
335 ipsec_itf->ii_sw_if_index = *sw_if_indexp = hi->sw_if_index;
336 ipsec_itf_reset_tx_nodes (hi->sw_if_index);
342 ipsec_itf_delete (u32 sw_if_index)
344 vnet_main_t *vnm = vnet_get_main ();
346 if (pool_is_free_index (vnm->interface_main.sw_interfaces, sw_if_index))
347 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
349 vnet_hw_interface_t *hw = vnet_get_sup_hw_interface (vnm, sw_if_index);
350 if (hw == 0 || hw->dev_class_index != ipsec_itf_device_class.index)
351 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
353 ipsec_itf_t *ipsec_itf;
354 ipsec_itf = ipsec_itf_find_by_sw_if_index (sw_if_index);
355 if (NULL == ipsec_itf)
356 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
358 if (ipsec_itf_instance_free (hw->dev_instance) < 0)
359 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
361 vnet_reset_interface_l3_output_node (vnm->vlib_main, sw_if_index);
363 vnet_delete_hw_interface (vnm, hw->hw_if_index);
364 pool_put (ipsec_itf_pool, ipsec_itf);
370 ipsec_itf_walk (ipsec_itf_walk_cb_t cb, void *ctx)
374 pool_foreach (itf, ipsec_itf_pool)
376 if (WALK_CONTINUE != cb (itf, ctx))
381 static clib_error_t *
382 ipsec_itf_create_cli (vlib_main_t * vm,
383 unformat_input_t * input, vlib_cli_command_t * cmd)
385 unformat_input_t _line_input, *line_input = &_line_input;
386 u32 instance, sw_if_index;
392 instance = sw_if_index = ~0;
393 mac_address_set_zero (&mac);
395 if (unformat_user (input, unformat_line_input, line_input))
397 while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
399 if (unformat (line_input, "instance %d", &instance))
403 error = clib_error_return (0, "unknown input: %U",
404 format_unformat_error, line_input);
409 unformat_free (line_input);
415 rv = ipsec_itf_create (instance, TUNNEL_MODE_P2P, &sw_if_index);
418 return clib_error_return (0, "iPSec interface create failed");
420 vlib_cli_output (vm, "%U\n", format_vnet_sw_if_index_name, vnet_get_main (),
426 * Create a IPSec interface.
429 * The following two command syntaxes are equivalent:
430 * @cliexcmd{ipsec itf create [instance <instance>]}
431 * Example of how to create a ipsec interface:
432 * @cliexcmd{ipsec itf create}
435 VLIB_CLI_COMMAND (ipsec_itf_create_command, static) = {
436 .path = "ipsec itf create",
437 .short_help = "ipsec itf create [instance <instance>]",
438 .function = ipsec_itf_create_cli,
442 static clib_error_t *
443 ipsec_itf_delete_cli (vlib_main_t * vm,
444 unformat_input_t * input, vlib_cli_command_t * cmd)
450 vnm = vnet_get_main ();
453 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
456 (input, "%U", unformat_vnet_sw_interface, vnm, &sw_if_index))
462 if (~0 != sw_if_index)
464 rv = ipsec_itf_delete (sw_if_index);
467 return clib_error_return (0, "ipsec interface delete failed");
470 return clib_error_return (0, "no such interface: %U",
471 format_unformat_error, input);
477 * Delete a IPSEC_ITF interface.
480 * The following two command syntaxes are equivalent:
481 * @cliexcmd{ipsec itf delete <interface>}
482 * Example of how to create a ipsec_itf interface:
483 * @cliexcmd{ipsec itf delete ipsec0}
486 VLIB_CLI_COMMAND (ipsec_itf_delete_command, static) = {
487 .path = "ipsec itf delete",
488 .short_help = "ipsec itf delete <interface>",
489 .function = ipsec_itf_delete_cli,
493 static clib_error_t *
494 ipsec_interface_show (vlib_main_t * vm,
495 unformat_input_t * input, vlib_cli_command_t * cmd)
500 pool_foreach_index (ii, ipsec_itf_pool)
502 vlib_cli_output (vm, "%U", format_ipsec_itf, ii);
510 * show IPSEC tunnel protection hash tables
513 VLIB_CLI_COMMAND (ipsec_interface_show_node, static) =
515 .path = "show ipsec interface",
516 .function = ipsec_interface_show,
517 .short_help = "show ipsec interface",
522 * fd.io coding-style-patch-verification: ON
525 * eval: (c-set-style "gnu")