2 * ipsec_tun.h : IPSEC tunnel protection
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/ipsec/ipsec_tun.h>
19 #include <vnet/ipsec/esp.h>
20 #include <vnet/udp/udp.h>
23 * Pool of tunnel protection objects
25 ipsec_tun_protect_t *ipsec_protect_pool;
28 * DB of protected tunnels
30 typedef struct ipsec_protect_db_t_
36 static ipsec_protect_db_t ipsec_protect_db;
39 ipsec_tun_protect_feature_set (ipsec_tun_protect_t * itp, u8 enable)
43 sai = itp->itp_out_sa;
45 if (itp->itp_flags & IPSEC_PROTECT_L2)
47 /* l2-GRE only supported by the vnet ipsec code */
48 vnet_feature_enable_disable ("ethernet-output",
49 (ip46_address_is_ip4 (&itp->itp_tun.src) ?
52 itp->itp_sw_if_index, enable,
62 sa = ipsec_sa_get (sai);
64 if (sa->crypto_alg == IPSEC_CRYPTO_ALG_NONE &&
65 sa->integ_alg == IPSEC_INTEG_ALG_NONE)
67 fi4 = im->esp4_no_crypto_tun_feature_index;
68 fi6 = im->esp6_no_crypto_tun_feature_index;
72 if (ip46_address_is_ip4 (&itp->itp_tun.src))
74 /* tunnel destination is v4 so we need the Xo4 indexes */
75 fi4 = im->esp44_encrypt_tun_feature_index;
76 fi6 = im->esp64_encrypt_tun_feature_index;
80 /* tunnel destination is v6 so we need the Xo6 indexes */
81 fi4 = im->esp46_encrypt_tun_feature_index;
82 fi6 = im->esp66_encrypt_tun_feature_index;
86 vnet_feature_enable_disable_with_index
87 (vnet_get_feature_arc_index ("ip4-output"),
88 fi4, itp->itp_sw_if_index, enable, &sai, sizeof (sai));
89 vnet_feature_enable_disable_with_index
90 (vnet_get_feature_arc_index ("ip6-output"),
91 fi6, itp->itp_sw_if_index, enable, &sai, sizeof (sai));
96 ipsec_tun_protect_db_add (ipsec_main_t * im, const ipsec_tun_protect_t * itp)
102 FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai,
104 sa = ipsec_sa_get (sai);
106 ipsec_tun_lkup_result_t res = {
107 .tun_index = itp - ipsec_protect_pool,
112 * The key is formed from the tunnel's destination
113 * as the packet lookup is done from the packet's source
115 if (ip46_address_is_ip4 (&itp->itp_crypto.dst))
117 ipsec4_tunnel_key_t key = {
118 .remote_ip = itp->itp_crypto.dst.ip4,
119 .spi = clib_host_to_net_u32 (sa->spi),
121 hash_set (im->tun4_protect_by_key, key.as_u64, res.as_u64);
122 if (1 == hash_elts(im->tun4_protect_by_key))
123 udp_register_dst_port (vlib_get_main(),
125 ipsec4_tun_input_node.index, 1);
129 ipsec6_tunnel_key_t key = {
130 .remote_ip = itp->itp_crypto.dst.ip6,
131 .spi = clib_host_to_net_u32 (sa->spi),
133 hash_set_mem_alloc (&im->tun6_protect_by_key, &key, res.as_u64);
140 ipsec_tun_protect_db_remove (ipsec_main_t * im,
141 const ipsec_tun_protect_t * itp)
143 const ipsec_sa_t *sa;
146 FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
148 if (ip46_address_is_ip4 (&itp->itp_crypto.dst))
150 ipsec4_tunnel_key_t key = {
151 .remote_ip = itp->itp_crypto.dst.ip4,
152 .spi = clib_host_to_net_u32 (sa->spi),
154 hash_unset (im->tun4_protect_by_key, key.as_u64);
155 if (0 == hash_elts(im->tun4_protect_by_key))
156 udp_unregister_dst_port (vlib_get_main(),
162 ipsec6_tunnel_key_t key = {
163 .remote_ip = itp->itp_crypto.dst.ip6,
164 .spi = clib_host_to_net_u32 (sa->spi),
166 hash_unset_mem_free (&im->tun6_protect_by_key, &key);
173 ipsec_tun_protect_config (ipsec_main_t * im,
174 ipsec_tun_protect_t * itp, u32 sa_out, u32 * sas_in)
180 itp->itp_n_sa_in = vec_len (sas_in);
181 for (ii = 0; ii < itp->itp_n_sa_in; ii++)
182 itp->itp_in_sas[ii] = sas_in[ii];
183 itp->itp_out_sa = sa_out;
185 ipsec_sa_lock (itp->itp_out_sa);
188 FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai,
192 FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
194 if (ipsec_sa_is_set_IS_TUNNEL (sa))
196 itp->itp_crypto.src = sa->tunnel_dst_addr;
197 itp->itp_crypto.dst = sa->tunnel_src_addr;
198 ipsec_sa_set_IS_PROTECT (sa);
199 itp->itp_flags |= IPSEC_PROTECT_ENCAPED;
203 itp->itp_crypto.src = itp->itp_tun.src;
204 itp->itp_crypto.dst = itp->itp_tun.dst;
205 itp->itp_flags &= ~IPSEC_PROTECT_ENCAPED;
211 * add to the DB against each SA
213 ipsec_tun_protect_db_add (im, itp);
216 * enable the encrypt feature for egress.
218 ipsec_tun_protect_feature_set (itp, 1);
222 ipsec_tun_protect_unconfig (ipsec_main_t * im, ipsec_tun_protect_t * itp)
227 ipsec_tun_protect_feature_set (itp, 0);
230 FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
232 ipsec_sa_unset_IS_PROTECT (sa);
235 ipsec_tun_protect_db_remove (im, itp);
237 ipsec_sa_unlock(itp->itp_out_sa);
239 FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai,
241 ipsec_sa_unlock(sai);
247 ipsec_tun_protect_find (u32 sw_if_index)
249 if (vec_len (ipsec_protect_db.tunnels) < sw_if_index)
250 return (INDEX_INVALID);
252 return (ipsec_protect_db.tunnels[sw_if_index]);
256 ipsec_tun_protect_update_one (u32 sw_if_index, u32 sa_out, u32 sa_in)
261 vec_add1 (sas_in, sa_in);
262 rv = ipsec_tun_protect_update (sw_if_index, sa_out, sas_in);
268 ipsec_tun_protect_update_out (u32 sw_if_index, u32 sa_out)
270 u32 itpi, *sas_in, sai, *saip;
271 ipsec_tun_protect_t *itp;
278 vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index,
280 itpi = ipsec_protect_db.tunnels[sw_if_index];
282 if (INDEX_INVALID == itpi)
284 return (VNET_API_ERROR_INVALID_INTERFACE);
287 itp = pool_elt_at_index (ipsec_protect_pool, itpi);
290 FOR_EACH_IPSEC_PROTECT_INPUT_SAI (itp, sai, (
293 vec_add1 (sas_in, sai);
298 sa_out = ipsec_sa_find_and_lock (sa_out);
302 rv = VNET_API_ERROR_INVALID_VALUE;
306 ipsec_tun_protect_unconfig (im, itp);
307 ipsec_tun_protect_config (im, itp, sa_out, sas_in);
309 ipsec_sa_unlock (sa_out);
310 vec_foreach (saip, sas_in) ipsec_sa_unlock (*saip);
318 ipsec_tun_protect_update_in (u32 sw_if_index, u32 sa_in)
320 u32 itpi, *sas_in, sa_out;
321 ipsec_tun_protect_t *itp;
328 vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index,
330 itpi = ipsec_protect_db.tunnels[sw_if_index];
332 if (INDEX_INVALID == itpi)
334 return (VNET_API_ERROR_INVALID_INTERFACE);
337 sa_in = ipsec_sa_find_and_lock (sa_in);
341 rv = VNET_API_ERROR_INVALID_VALUE;
344 vec_add1 (sas_in, sa_in);
346 itp = pool_elt_at_index (ipsec_protect_pool, itpi);
347 sa_out = itp->itp_out_sa;
349 ipsec_sa_lock (sa_out);
351 ipsec_tun_protect_unconfig (im, itp);
352 ipsec_tun_protect_config (im, itp, sa_out, sas_in);
354 ipsec_sa_unlock (sa_out);
355 ipsec_sa_unlock (sa_in);
362 ipsec_tun_protect_update (u32 sw_if_index, u32 sa_out, u32 * sas_in)
364 ipsec_tun_protect_t *itp;
371 vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index,
373 itpi = ipsec_protect_db.tunnels[sw_if_index];
375 vec_foreach_index (ii, sas_in)
377 sas_in[ii] = ipsec_sa_find_and_lock (sas_in[ii]);
378 if (~0 == sas_in[ii])
380 rv = VNET_API_ERROR_INVALID_VALUE;
385 sa_out = ipsec_sa_find_and_lock (sa_out);
389 rv = VNET_API_ERROR_INVALID_VALUE;
393 if (INDEX_INVALID == itpi)
395 vnet_device_class_t *dev_class;
396 vnet_hw_interface_t *hi;
400 vnm = vnet_get_main ();
401 hi = vnet_get_sup_hw_interface (vnm, sw_if_index);
402 dev_class = vnet_get_device_class (vnm, hi->dev_class_index);
404 if (NULL == dev_class->ip_tun_desc)
406 rv = VNET_API_ERROR_INVALID_SW_IF_INDEX;
410 pool_get_zero (ipsec_protect_pool, itp);
412 itp->itp_sw_if_index = sw_if_index;
413 ipsec_protect_db.tunnels[sw_if_index] = itp - ipsec_protect_pool;
414 ipsec_protect_db.count++;
416 itp->itp_n_sa_in = vec_len (sas_in);
417 for (ii = 0; ii < itp->itp_n_sa_in; ii++)
418 itp->itp_in_sas[ii] = sas_in[ii];
419 itp->itp_out_sa = sa_out;
421 rv = dev_class->ip_tun_desc (sw_if_index,
423 &itp->itp_tun.dst, &is_l2);
429 itp->itp_flags |= IPSEC_PROTECT_L2;
432 * add to the tunnel DB for ingress
433 * - if the SA is in trasnport mode, then the packates will arrivw
434 * with the IP src,dst of the protected tunnel, in which case we can
435 * simply strip the IP header and hand the payload to the protocol
436 * appropriate input handler
437 * - if the SA is in tunnel mode then there are two IP headers present
438 * one for the crytpo tunnel endpoints (described in the SA) and one
439 * for the tunnel endpoints. The outer IP headers in the srriving
440 * packets will have the crypto endpoints. So the DB needs to contain
441 * the crpto endpoint. Once the crypto header is stripped, revealing,
442 * the tunnel-IP we have 2 choices:
443 * 1) do a tunnel lookup based on the revealed header
444 * 2) skip the tunnel lookup and assume that the packet matches the
445 * one that is protected here.
446 * If we did 1) then we would allow our peer to use the SA for tunnel
447 * X to inject traffic onto tunnel Y, this is not good. If we do 2)
448 * then we don't verify that the peer is indeed using SA for tunnel
449 * X and addressing tunnel X. So we take a compromise, once the SA
450 * matches to tunnel X we veriy that the inner IP matches the value
451 * of the tunnel we are protecting, else it's dropped.
453 ipsec_tun_protect_config (im, itp, sa_out, sas_in);
455 if (1 == hash_elts (im->tun4_protect_by_key))
456 ip4_register_protocol (IP_PROTOCOL_IPSEC_ESP,
457 ipsec4_tun_input_node.index);
458 if (1 == hash_elts (im->tun6_protect_by_key))
459 ip6_register_protocol (IP_PROTOCOL_IPSEC_ESP,
460 ipsec6_tun_input_node.index);
464 /* updating SAs only */
465 itp = pool_elt_at_index (ipsec_protect_pool, itpi);
467 ipsec_tun_protect_unconfig (im, itp);
468 ipsec_tun_protect_config (im, itp, sa_out, sas_in);
471 ipsec_sa_unlock (sa_out);
472 vec_foreach (saip, sas_in) ipsec_sa_unlock (*saip);
480 ipsec_tun_protect_del (u32 sw_if_index)
482 ipsec_tun_protect_t *itp;
488 vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index,
490 itpi = ipsec_protect_db.tunnels[sw_if_index];
492 if (INDEX_INVALID == itpi)
493 return (VNET_API_ERROR_NO_SUCH_ENTRY);
495 itp = ipsec_tun_protect_get (itpi);
496 ipsec_tun_protect_unconfig (im, itp);
498 ipsec_protect_db.tunnels[itp->itp_sw_if_index] = INDEX_INVALID;
500 pool_put (ipsec_protect_pool, itp);
502 if (0 == hash_elts (im->tun4_protect_by_key))
503 ip4_unregister_protocol (IP_PROTOCOL_IPSEC_ESP);
504 if (0 == hash_elts (im->tun6_protect_by_key))
505 ip6_unregister_protocol (IP_PROTOCOL_IPSEC_ESP);
511 ipsec_tun_protect_walk (ipsec_tun_protect_walk_cb_t fn, void *ctx)
516 pool_foreach_index(itpi, ipsec_protect_pool,
524 ipsec_tunnel_protect_init (vlib_main_t * vm)
529 im->tun6_protect_by_key = hash_create_mem (0,
530 sizeof (ipsec6_tunnel_key_t),
532 im->tun4_protect_by_key = hash_create (0, sizeof (u64));
534 /* set up feature nodes to drop outbound packets with no crypto alg set */
535 ipsec_add_feature ("ip4-output", "esp4-no-crypto",
536 &im->esp4_no_crypto_tun_feature_index);
537 ipsec_add_feature ("ip6-output", "esp6-no-crypto",
538 &im->esp6_no_crypto_tun_feature_index);
543 VLIB_INIT_FUNCTION (ipsec_tunnel_protect_init);
547 * fd.io coding-style-patch-verification: ON
550 * eval: (c-set-style "gnu")