src/vnet/ipsec/ipsec_spd.c

   1 /*
   2  * Copyright (c) 2015 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15
  16 #include <vnet/ipsec/ipsec.h>
  17 #include <vnet/ipsec/ipsec_io.h>
  18
  19 int
  20 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
  21 {
  22   ipsec_main_t *im = &ipsec_main;
  23   ipsec_spd_t *spd = 0;
  24   ipsec_spd_fp_t *fp_spd = 0;
  25   uword *p;
  26   u32 spd_index, k, v;
  27
  28   p = hash_get (im->spd_index_by_spd_id, spd_id);
  29   if (p && is_add)
  30     return VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
  31   if (!p && !is_add)
  32     return VNET_API_ERROR_NO_SUCH_ENTRY;
  33
  34   if (!is_add)                  /* delete */
  35     {
  36       spd_index = p[0];
  37       spd = pool_elt_at_index (im->spds, spd_index);
  38       if (!spd)
  39         return VNET_API_ERROR_INVALID_VALUE;
  40
  41       /* *INDENT-OFF* */
  42       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
  43         if (v == spd_index)
  44           ipsec_set_interface_spd(vm, k, spd_id, 0);
  45       }));
  46       /* *INDENT-ON* */
  47       hash_unset (im->spd_index_by_spd_id, spd_id);
  48 #define _(s,v) vec_free(spd->policies[IPSEC_SPD_POLICY_##s]);
  49       foreach_ipsec_spd_policy_type
  50 #undef _
  51
  52         fp_spd = &spd->fp_spd;
  53
  54       if (im->fp_spd_ipv4_out_is_enabled)
  55         {
  56           if (fp_spd->ip4_out_lookup_hash_idx != INDEX_INVALID)
  57             {
  58               clib_bihash_16_8_t *bihash_table =
  59                 pool_elt_at_index (im->fp_ip4_lookup_hashes_pool,
  60                                    fp_spd->ip4_out_lookup_hash_idx);
  61
  62               clib_bihash_free_16_8 (bihash_table);
  63               vec_free (fp_spd->name4_out);
  64               pool_put_index (im->fp_ip4_lookup_hashes_pool,
  65                               fp_spd->ip4_out_lookup_hash_idx);
  66             }
  67         }
  68
  69       if (im->fp_spd_ipv4_in_is_enabled)
  70         {
  71           if (fp_spd->ip4_in_lookup_hash_idx != INDEX_INVALID)
  72             {
  73               clib_bihash_16_8_t *bihash_table = pool_elt_at_index (
  74                 im->fp_ip4_lookup_hashes_pool, fp_spd->ip4_in_lookup_hash_idx);
  75
  76               clib_bihash_free_16_8 (bihash_table);
  77               vec_free (fp_spd->name4_in);
  78               pool_put_index (im->fp_ip4_lookup_hashes_pool,
  79                               fp_spd->ip4_in_lookup_hash_idx);
  80             }
  81         }
  82
  83       if (im->fp_spd_ipv6_out_is_enabled)
  84         {
  85           if (fp_spd->ip6_out_lookup_hash_idx != INDEX_INVALID)
  86             {
  87               clib_bihash_40_8_t *bihash_table =
  88                 pool_elt_at_index (im->fp_ip6_lookup_hashes_pool,
  89                                    fp_spd->ip6_out_lookup_hash_idx);
  90
  91               clib_bihash_free_40_8 (bihash_table);
  92               vec_free (fp_spd->name6_out);
  93               pool_put_index (im->fp_ip6_lookup_hashes_pool,
  94                               fp_spd->ip6_out_lookup_hash_idx);
  95             }
  96         }
  97       if (im->fp_spd_ipv6_in_is_enabled)
  98         {
  99           if (fp_spd->ip6_in_lookup_hash_idx != INDEX_INVALID)
 100             {
 101               clib_bihash_40_8_t *bihash_table = pool_elt_at_index (
 102                 im->fp_ip6_lookup_hashes_pool, fp_spd->ip6_in_lookup_hash_idx);
 103
 104               clib_bihash_free_40_8 (bihash_table);
 105               vec_free (fp_spd->name6_in);
 106               pool_put_index (im->fp_ip6_lookup_hashes_pool,
 107                               fp_spd->ip6_in_lookup_hash_idx);
 108             }
 109         }
 110
 111       pool_put (im->spds, spd);
 112     }
 113   else /* create new SPD */
 114     {
 115       pool_get (im->spds, spd);
 116       clib_memset (spd, 0, sizeof (*spd));
 117       spd_index = spd - im->spds;
 118       spd->id = spd_id;
 119       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 120
 121       fp_spd = &spd->fp_spd;
 122       fp_spd->ip4_out_lookup_hash_idx = INDEX_INVALID;
 123       fp_spd->ip4_in_lookup_hash_idx = INDEX_INVALID;
 124       fp_spd->ip6_out_lookup_hash_idx = INDEX_INVALID;
 125       fp_spd->ip6_in_lookup_hash_idx = INDEX_INVALID;
 126
 127       if (im->fp_spd_ipv4_out_is_enabled)
 128         {
 129           if (pool_elts (im->fp_ip4_lookup_hashes_pool) <
 130               pool_max_len (im->fp_ip4_lookup_hashes_pool))
 131             {
 132               clib_bihash_16_8_t *bihash_table;
 133               fp_spd->name4_out = format (0, "spd_%u_fp_ip4_out", spd_id);
 134
 135               pool_get (im->fp_ip4_lookup_hashes_pool, bihash_table);
 136               fp_spd->ip4_out_lookup_hash_idx =
 137                 bihash_table - im->fp_ip4_lookup_hashes_pool;
 138               clib_bihash_init_16_8 (bihash_table, (char *) fp_spd->name4_out,
 139                                      im->fp_lookup_hash_buckets,
 140                                      im->fp_lookup_hash_buckets *
 141                                        IPSEC_FP_IP4_HASH_MEM_PER_BUCKET);
 142             }
 143         }
 144
 145       if (im->fp_spd_ipv4_in_is_enabled)
 146         {
 147           if (pool_elts (im->fp_ip4_lookup_hashes_pool) <
 148               pool_max_len (im->fp_ip4_lookup_hashes_pool))
 149             {
 150               clib_bihash_16_8_t *bihash_table;
 151               fp_spd->name4_in = format (0, "spd_%u_fp_ip4_in", spd_id);
 152
 153               pool_get (im->fp_ip4_lookup_hashes_pool, bihash_table);
 154               fp_spd->ip4_in_lookup_hash_idx =
 155                 bihash_table - im->fp_ip4_lookup_hashes_pool;
 156               clib_bihash_init_16_8 (bihash_table, (char *) fp_spd->name4_in,
 157                                      im->fp_lookup_hash_buckets,
 158                                      im->fp_lookup_hash_buckets *
 159                                        IPSEC_FP_IP4_HASH_MEM_PER_BUCKET);
 160             }
 161         }
 162       if (im->fp_spd_ipv6_out_is_enabled)
 163         {
 164           if (pool_elts (im->fp_ip6_lookup_hashes_pool) <
 165               pool_max_len (im->fp_ip6_lookup_hashes_pool))
 166             {
 167               clib_bihash_40_8_t *bihash_table;
 168
 169               fp_spd->name6_out = format (0, "spd_%u_fp_ip6_out", spd_id);
 170               pool_get (im->fp_ip6_lookup_hashes_pool, bihash_table);
 171               fp_spd->ip6_out_lookup_hash_idx =
 172                 bihash_table - im->fp_ip6_lookup_hashes_pool;
 173               clib_bihash_init_40_8 (bihash_table, (char *) fp_spd->name6_out,
 174                                      im->fp_lookup_hash_buckets,
 175                                      im->fp_lookup_hash_buckets *
 176                                        IPSEC_FP_IP6_HASH_MEM_PER_BUCKET);
 177             }
 178         }
 179       if (im->fp_spd_ipv6_in_is_enabled)
 180         {
 181           if (pool_elts (im->fp_ip6_lookup_hashes_pool) <
 182               pool_max_len (im->fp_ip6_lookup_hashes_pool))
 183             {
 184               clib_bihash_40_8_t *bihash_table;
 185
 186               fp_spd->name6_in = format (0, "spd_%u_fp_ip6_in", spd_id);
 187               pool_get (im->fp_ip6_lookup_hashes_pool, bihash_table);
 188               fp_spd->ip6_in_lookup_hash_idx =
 189                 bihash_table - im->fp_ip6_lookup_hashes_pool;
 190               clib_bihash_init_40_8 (bihash_table, (char *) fp_spd->name6_in,
 191                                      im->fp_lookup_hash_buckets,
 192                                      im->fp_lookup_hash_buckets *
 193                                        IPSEC_FP_IP6_HASH_MEM_PER_BUCKET);
 194             }
 195         }
 196     }
 197   return 0;
 198 }
 199
 200 int
 201 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
 202                          int is_add)
 203 {
 204   ipsec_main_t *im = &ipsec_main;
 205   ip4_ipsec_config_t config;
 206
 207   u32 spd_index;
 208   uword *p;
 209
 210   p = hash_get (im->spd_index_by_spd_id, spd_id);
 211   if (!p)
 212     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such spd-id */
 213
 214   spd_index = p[0];
 215
 216   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
 217   if (p && is_add)
 218     return VNET_API_ERROR_SYSCALL_ERROR_2;      /* spd already assigned */
 219
 220   if (is_add)
 221     {
 222       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
 223     }
 224   else
 225     {
 226       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
 227     }
 228
 229   /* enable IPsec on TX */
 230   vnet_feature_enable_disable ("ip4-output", "ipsec4-output-feature",
 231                                sw_if_index, is_add, 0, 0);
 232   vnet_feature_enable_disable ("ip6-output", "ipsec6-output-feature",
 233                                sw_if_index, is_add, 0, 0);
 234
 235   config.spd_index = spd_index;
 236
 237   /* enable IPsec on RX */
 238   vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input-feature",
 239                                sw_if_index, is_add, &config, sizeof (config));
 240   vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input-feature",
 241                                sw_if_index, is_add, &config, sizeof (config));
 242
 243   return 0;
 244 }
 245
 246 /*
 247  * fd.io coding-style-patch-verification: ON
 248  *
 249  * Local Variables:
 250  * eval: (c-set-style "gnu")
 251  * End:
 252  */