2 * decap.c : IPSec tunnel support
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 #include <vnet/ipsec/ikev2.h>
28 ipsec_set_interface_spd(vlib_main_t * vm, u32 sw_if_index, u32 spd_id, int is_add)
30 ipsec_main_t *im = &ipsec_main;
31 ip_lookup_main_t * lm;
32 ip_config_main_t * rx_cm;
33 ip4_ipsec_config_t config;
38 p = hash_get (im->spd_index_by_spd_id, spd_id);
40 return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
44 p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
46 return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
50 hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
54 hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
57 clib_warning("sw_if_index %u spd_id %u spd_index %u",
58 sw_if_index, spd_id, spd_index);
60 /* enable IPsec on TX */
61 vnet_interface_add_del_feature(im->vnet_main, vm, sw_if_index,
62 INTF_OUTPUT_FEAT_IPSEC, is_add);
64 /* enable IPsec on RX */
65 config.spd_index = spd_index;
68 lm = &ip4_main.lookup_main;
69 rx_cm = &lm->rx_config_mains[VNET_UNICAST];
71 ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
73 ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
74 (vm, &rx_cm->config_main,
76 ip4_main.ip4_unicast_rx_feature_ipsec,
79 rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
82 lm = &ip6_main.lookup_main;
83 rx_cm = &lm->rx_config_mains[VNET_UNICAST];
85 ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
87 ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
88 (vm, &rx_cm->config_main,
90 ip6_main.ip6_unicast_rx_feature_ipsec,
93 rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
99 ipsec_add_del_spd(vlib_main_t * vm, u32 spd_id, int is_add)
101 ipsec_main_t *im = &ipsec_main;
102 ipsec_spd_t * spd = 0;
106 p = hash_get (im->spd_index_by_spd_id, spd_id);
108 return VNET_API_ERROR_INVALID_VALUE;
110 return VNET_API_ERROR_INVALID_VALUE;
112 if (!is_add) /* delete */
115 spd = pool_elt_at_index(im->spds, spd_index);
117 return VNET_API_ERROR_INVALID_VALUE;
118 hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
120 ipsec_set_interface_spd(vm, k, spd_id, 0);
122 hash_unset (im->spd_index_by_spd_id, spd_id);
123 pool_free (spd->policies);
124 vec_free (spd->ipv4_outbound_policies);
125 vec_free (spd->ipv6_outbound_policies);
126 vec_free (spd->ipv4_inbound_protect_policy_indices);
127 vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
128 pool_put (im->spds, spd);
130 else /* create new SPD */
132 pool_get (im->spds, spd);
133 memset (spd, 0, sizeof (*spd));
134 spd_index = spd - im->spds;
136 hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
142 ipsec_spd_entry_sort(void * a1, void * a2)
144 ipsec_main_t *im = &ipsec_main;
148 ipsec_policy_t * p1, * p2;
150 pool_foreach (spd, im->spds, ({
151 p1 = pool_elt_at_index(spd->policies, *id1);
152 p2 = pool_elt_at_index(spd->policies, *id2);
154 return p2->priority - p1->priority;
161 ipsec_add_del_policy(vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
163 ipsec_main_t *im = &ipsec_main;
164 ipsec_spd_t * spd = 0;
169 clib_warning("policy-id %u priority %d is_outbound %u",policy->id, policy->priority, policy->is_outbound);
171 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
173 p = hash_get(im->sa_index_by_sa_id, policy->sa_id);
175 return VNET_API_ERROR_SYSCALL_ERROR_1;
176 policy->sa_index = p[0];
179 p = hash_get (im->spd_index_by_spd_id, policy->id);
182 return VNET_API_ERROR_SYSCALL_ERROR_1;
185 spd = pool_elt_at_index(im->spds, spd_index);
187 return VNET_API_ERROR_SYSCALL_ERROR_1;
193 pool_get (spd->policies, vp);
194 clib_memcpy (vp, policy, sizeof (*vp));
195 policy_index = vp - spd->policies;
197 if (policy->is_outbound)
201 vec_add1 (spd->ipv6_outbound_policies, policy_index);
202 clib_memcpy(vp, policy, sizeof(ipsec_policy_t));
203 vec_sort_with_function (spd->ipv6_outbound_policies,
204 ipsec_spd_entry_sort);
208 vec_add1 (spd->ipv4_outbound_policies, policy_index);
209 clib_memcpy(vp, policy, sizeof(ipsec_policy_t));
210 vec_sort_with_function (spd->ipv4_outbound_policies,
211 ipsec_spd_entry_sort);
218 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
220 vec_add1 (spd->ipv6_inbound_protect_policy_indices,
222 clib_memcpy(vp, policy, sizeof(ipsec_policy_t));
223 vec_sort_with_function (
224 spd->ipv6_inbound_protect_policy_indices,
225 ipsec_spd_entry_sort);
229 vec_add1 (spd->ipv6_inbound_policy_discard_and_bypass_indices,
231 clib_memcpy(vp, policy, sizeof(ipsec_policy_t));
232 vec_sort_with_function (
233 spd->ipv6_inbound_policy_discard_and_bypass_indices,
234 ipsec_spd_entry_sort);
239 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
241 vec_add1 (spd->ipv4_inbound_protect_policy_indices,
243 clib_memcpy(vp, policy, sizeof(ipsec_policy_t));
244 vec_sort_with_function (
245 spd->ipv4_inbound_protect_policy_indices,
246 ipsec_spd_entry_sort);
250 vec_add1 (spd->ipv4_inbound_policy_discard_and_bypass_indices,
252 clib_memcpy(vp, policy, sizeof(ipsec_policy_t));
253 vec_sort_with_function (
254 spd->ipv4_inbound_policy_discard_and_bypass_indices,
255 ipsec_spd_entry_sort);
264 pool_foreach_index(i, spd->policies, ({
265 vp = pool_elt_at_index(spd->policies, i);
266 if (vp->priority != policy->priority)
268 if (vp->is_outbound != policy->is_outbound)
270 if (vp->policy != policy->policy)
272 if (vp->sa_id != policy->sa_id)
274 if (vp->protocol != policy->protocol)
276 if (vp->lport.start != policy->lport.start)
278 if (vp->lport.stop != policy->lport.stop)
280 if (vp->rport.start != policy->rport.start)
282 if (vp->rport.stop != policy->rport.stop)
284 if (vp->is_ipv6 != policy->is_ipv6)
288 if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
290 if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
292 if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
294 if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
296 if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
298 if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
300 if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
302 if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
304 if (policy->is_outbound)
306 vec_foreach_index(j, spd->ipv6_outbound_policies) {
307 if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
308 vec_del1 (spd->ipv6_outbound_policies, j);
315 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
317 vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
318 if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
319 vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
326 vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
327 if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
328 vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
337 if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
339 if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
341 if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
343 if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
345 if (policy->is_outbound)
347 vec_foreach_index(j, spd->ipv4_outbound_policies) {
348 if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
349 vec_del1 (spd->ipv4_outbound_policies, j);
356 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
358 vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
359 if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
360 vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
367 vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
368 if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
369 vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
375 pool_put (spd->policies, vp);
385 ipsec_is_sa_used(u32 sa_index)
387 ipsec_main_t * im = &ipsec_main;
391 pool_foreach(spd, im->spds, ({
392 pool_foreach(p, spd->policies, ({
393 if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
395 if (p->sa_index == sa_index)
405 ipsec_add_del_sa(vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
407 ipsec_main_t *im = &ipsec_main;
412 clib_warning("id %u spi %u", new_sa->id, new_sa->spi);
414 p = hash_get (im->sa_index_by_sa_id, new_sa->id);
416 return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
418 return VNET_API_ERROR_SYSCALL_ERROR_1;
420 if (!is_add) /* delete */
423 sa = pool_elt_at_index(im->sad, sa_index);
424 if (ipsec_is_sa_used(sa_index))
426 clib_warning("sa_id %u used in policy", sa->id);
427 return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
429 hash_unset (im->sa_index_by_sa_id, sa->id);
430 pool_put (im->sad, sa);
432 else /* create new SA */
434 pool_get (im->sad, sa);
435 clib_memcpy (sa, new_sa, sizeof (*sa));
436 sa_index = sa - im->sad;
437 hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
443 ipsec_set_sa_key(vlib_main_t * vm, ipsec_sa_t * sa_update)
445 ipsec_main_t *im = &ipsec_main;
450 p = hash_get (im->sa_index_by_sa_id, sa_update->id);
452 return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
455 sa = pool_elt_at_index(im->sad, sa_index);
458 if (0 < sa_update->crypto_key_len)
460 clib_memcpy(sa->crypto_key, sa_update->crypto_key, sa_update->crypto_key_len);
461 sa->crypto_key_len = sa_update->crypto_key_len;
465 if (0 < sa_update->integ_key_len)
467 clib_memcpy(sa->integ_key, sa_update->integ_key, sa_update->integ_key_len);
468 sa->integ_key_len = sa_update->integ_key_len;
475 ipsec_rand_seed(void)
483 seed_data.time = time(NULL);
484 seed_data.pid = getpid();
485 seed_data.p = (void *)&seed_data;
487 RAND_seed((const void *)&seed_data, sizeof(seed_data));
490 static clib_error_t *
491 ipsec_init (vlib_main_t * vm)
493 clib_error_t * error;
494 ipsec_main_t * im = &ipsec_main;
495 vlib_thread_main_t * tm = vlib_get_thread_main();
500 memset (im, 0, sizeof (im[0]));
502 im->vnet_main = vnet_get_main();
505 im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
506 im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
507 im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
509 vec_validate_aligned(im->empty_buffers, tm->n_vlib_mains-1, CLIB_CACHE_LINE_BYTES);
511 node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
513 im->error_drop_node_index = node->index;
515 node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
517 im->esp_encrypt_node_index = node->index;
519 node = vlib_get_node_by_name (vm, (u8 *) "ip4-lookup");
521 im->ip4_lookup_node_index = node->index;
524 if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
527 if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
532 if ((error = ikev2_init (vm)))
538 VLIB_INIT_FUNCTION (ipsec_init);