src/vnet/ipsec/ipsec_spd.c

   1 /*
   2  * Copyright (c) 2015 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15
  16 #include <vnet/ipsec/ipsec.h>
  17 #include <vnet/ipsec/ipsec_io.h>
  18
  19 int
  20 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
  21 {
  22   ipsec_main_t *im = &ipsec_main;
  23   ipsec_spd_t *spd = 0;
  24   ipsec_spd_fp_t *fp_spd = 0;
  25   uword *p;
  26   u32 spd_index, k, v;
  27
  28   p = hash_get (im->spd_index_by_spd_id, spd_id);
  29   if (p && is_add)
  30     return VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
  31   if (!p && !is_add)
  32     return VNET_API_ERROR_NO_SUCH_ENTRY;
  33
  34   if (!is_add)                  /* delete */
  35     {
  36       spd_index = p[0];
  37       spd = pool_elt_at_index (im->spds, spd_index);
  38       if (!spd)
  39         return VNET_API_ERROR_INVALID_VALUE;
  40
  41       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
  42         if (v == spd_index)
  43           ipsec_set_interface_spd(vm, k, spd_id, 0);
  44       }));
  45       hash_unset (im->spd_index_by_spd_id, spd_id);
  46 #define _(s,v) vec_free(spd->policies[IPSEC_SPD_POLICY_##s]);
  47       foreach_ipsec_spd_policy_type
  48 #undef _
  49
  50         fp_spd = &spd->fp_spd;
  51
  52       if (im->fp_spd_ipv4_out_is_enabled)
  53         {
  54           if (fp_spd->ip4_out_lookup_hash_idx != INDEX_INVALID)
  55             {
  56               clib_bihash_16_8_t *bihash_table =
  57                 pool_elt_at_index (im->fp_ip4_lookup_hashes_pool,
  58                                    fp_spd->ip4_out_lookup_hash_idx);
  59
  60               clib_bihash_free_16_8 (bihash_table);
  61               vec_free (fp_spd->name4_out);
  62               pool_put_index (im->fp_ip4_lookup_hashes_pool,
  63                               fp_spd->ip4_out_lookup_hash_idx);
  64             }
  65         }
  66
  67       if (im->fp_spd_ipv4_in_is_enabled)
  68         {
  69           if (fp_spd->ip4_in_lookup_hash_idx != INDEX_INVALID)
  70             {
  71               clib_bihash_16_8_t *bihash_table = pool_elt_at_index (
  72                 im->fp_ip4_lookup_hashes_pool, fp_spd->ip4_in_lookup_hash_idx);
  73
  74               clib_bihash_free_16_8 (bihash_table);
  75               vec_free (fp_spd->name4_in);
  76               pool_put_index (im->fp_ip4_lookup_hashes_pool,
  77                               fp_spd->ip4_in_lookup_hash_idx);
  78             }
  79         }
  80
  81       if (im->fp_spd_ipv6_out_is_enabled)
  82         {
  83           if (fp_spd->ip6_out_lookup_hash_idx != INDEX_INVALID)
  84             {
  85               clib_bihash_40_8_t *bihash_table =
  86                 pool_elt_at_index (im->fp_ip6_lookup_hashes_pool,
  87                                    fp_spd->ip6_out_lookup_hash_idx);
  88
  89               clib_bihash_free_40_8 (bihash_table);
  90               vec_free (fp_spd->name6_out);
  91               pool_put_index (im->fp_ip6_lookup_hashes_pool,
  92                               fp_spd->ip6_out_lookup_hash_idx);
  93             }
  94         }
  95       if (im->fp_spd_ipv6_in_is_enabled)
  96         {
  97           if (fp_spd->ip6_in_lookup_hash_idx != INDEX_INVALID)
  98             {
  99               clib_bihash_40_8_t *bihash_table = pool_elt_at_index (
 100                 im->fp_ip6_lookup_hashes_pool, fp_spd->ip6_in_lookup_hash_idx);
 101
 102               clib_bihash_free_40_8 (bihash_table);
 103               vec_free (fp_spd->name6_in);
 104               pool_put_index (im->fp_ip6_lookup_hashes_pool,
 105                               fp_spd->ip6_in_lookup_hash_idx);
 106             }
 107         }
 108
 109       pool_put (im->spds, spd);
 110     }
 111   else /* create new SPD */
 112     {
 113       pool_get (im->spds, spd);
 114       clib_memset (spd, 0, sizeof (*spd));
 115       spd_index = spd - im->spds;
 116       spd->id = spd_id;
 117       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 118
 119       fp_spd = &spd->fp_spd;
 120       fp_spd->ip4_out_lookup_hash_idx = INDEX_INVALID;
 121       fp_spd->ip4_in_lookup_hash_idx = INDEX_INVALID;
 122       fp_spd->ip6_out_lookup_hash_idx = INDEX_INVALID;
 123       fp_spd->ip6_in_lookup_hash_idx = INDEX_INVALID;
 124
 125       if (im->fp_spd_ipv4_out_is_enabled)
 126         {
 127           if (pool_elts (im->fp_ip4_lookup_hashes_pool) <
 128               pool_max_len (im->fp_ip4_lookup_hashes_pool))
 129             {
 130               clib_bihash_16_8_t *bihash_table;
 131               fp_spd->name4_out = format (0, "spd_%u_fp_ip4_out", spd_id);
 132
 133               pool_get (im->fp_ip4_lookup_hashes_pool, bihash_table);
 134               fp_spd->ip4_out_lookup_hash_idx =
 135                 bihash_table - im->fp_ip4_lookup_hashes_pool;
 136               clib_bihash_init_16_8 (bihash_table, (char *) fp_spd->name4_out,
 137                                      im->fp_lookup_hash_buckets,
 138                                      im->fp_lookup_hash_buckets *
 139                                        IPSEC_FP_IP4_HASH_MEM_PER_BUCKET);
 140             }
 141         }
 142
 143       if (im->fp_spd_ipv4_in_is_enabled)
 144         {
 145           if (pool_elts (im->fp_ip4_lookup_hashes_pool) <
 146               pool_max_len (im->fp_ip4_lookup_hashes_pool))
 147             {
 148               clib_bihash_16_8_t *bihash_table;
 149               fp_spd->name4_in = format (0, "spd_%u_fp_ip4_in", spd_id);
 150
 151               pool_get (im->fp_ip4_lookup_hashes_pool, bihash_table);
 152               fp_spd->ip4_in_lookup_hash_idx =
 153                 bihash_table - im->fp_ip4_lookup_hashes_pool;
 154               clib_bihash_init_16_8 (bihash_table, (char *) fp_spd->name4_in,
 155                                      im->fp_lookup_hash_buckets,
 156                                      im->fp_lookup_hash_buckets *
 157                                        IPSEC_FP_IP4_HASH_MEM_PER_BUCKET);
 158             }
 159         }
 160       if (im->fp_spd_ipv6_out_is_enabled)
 161         {
 162           if (pool_elts (im->fp_ip6_lookup_hashes_pool) <
 163               pool_max_len (im->fp_ip6_lookup_hashes_pool))
 164             {
 165               clib_bihash_40_8_t *bihash_table;
 166
 167               fp_spd->name6_out = format (0, "spd_%u_fp_ip6_out", spd_id);
 168               pool_get (im->fp_ip6_lookup_hashes_pool, bihash_table);
 169               fp_spd->ip6_out_lookup_hash_idx =
 170                 bihash_table - im->fp_ip6_lookup_hashes_pool;
 171               clib_bihash_init_40_8 (bihash_table, (char *) fp_spd->name6_out,
 172                                      im->fp_lookup_hash_buckets,
 173                                      im->fp_lookup_hash_buckets *
 174                                        IPSEC_FP_IP6_HASH_MEM_PER_BUCKET);
 175             }
 176         }
 177       if (im->fp_spd_ipv6_in_is_enabled)
 178         {
 179           if (pool_elts (im->fp_ip6_lookup_hashes_pool) <
 180               pool_max_len (im->fp_ip6_lookup_hashes_pool))
 181             {
 182               clib_bihash_40_8_t *bihash_table;
 183
 184               fp_spd->name6_in = format (0, "spd_%u_fp_ip6_in", spd_id);
 185               pool_get (im->fp_ip6_lookup_hashes_pool, bihash_table);
 186               fp_spd->ip6_in_lookup_hash_idx =
 187                 bihash_table - im->fp_ip6_lookup_hashes_pool;
 188               clib_bihash_init_40_8 (bihash_table, (char *) fp_spd->name6_in,
 189                                      im->fp_lookup_hash_buckets,
 190                                      im->fp_lookup_hash_buckets *
 191                                        IPSEC_FP_IP6_HASH_MEM_PER_BUCKET);
 192             }
 193         }
 194     }
 195   return 0;
 196 }
 197
 198 int
 199 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
 200                          int is_add)
 201 {
 202   ipsec_main_t *im = &ipsec_main;
 203   ip4_ipsec_config_t config;
 204
 205   u32 spd_index;
 206   uword *p;
 207
 208   p = hash_get (im->spd_index_by_spd_id, spd_id);
 209   if (!p)
 210     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such spd-id */
 211
 212   spd_index = p[0];
 213
 214   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
 215   if (p && is_add)
 216     return VNET_API_ERROR_SYSCALL_ERROR_2;      /* spd already assigned */
 217
 218   if (is_add)
 219     {
 220       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
 221     }
 222   else
 223     {
 224       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
 225     }
 226
 227   /* enable IPsec on TX */
 228   vnet_feature_enable_disable ("ip4-output", "ipsec4-output-feature",
 229                                sw_if_index, is_add, 0, 0);
 230   vnet_feature_enable_disable ("ip6-output", "ipsec6-output-feature",
 231                                sw_if_index, is_add, 0, 0);
 232
 233   config.spd_index = spd_index;
 234
 235   /* enable IPsec on RX */
 236   vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input-feature",
 237                                sw_if_index, is_add, &config, sizeof (config));
 238   vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input-feature",
 239                                sw_if_index, is_add, &config, sizeof (config));
 240
 241   return 0;
 242 }
 243
 244 /*
 245  * fd.io coding-style-patch-verification: ON
 246  *
 247  * Local Variables:
 248  * eval: (c-set-style "gnu")
 249  * End:
 250  */