2 * decap.c : IPSec tunnel support
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 #include <vnet/ipsec/ikev2.h>
28 ipsec_get_sa_index_by_sa_id (u32 sa_id)
30 ipsec_main_t *im = &ipsec_main;
31 uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
39 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
42 ipsec_main_t *im = &ipsec_main;
44 ip_config_main_t *rx_cm;
45 ip4_ipsec_config_t config;
50 p = hash_get (im->spd_index_by_spd_id, spd_id);
52 return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
56 p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
58 return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
62 hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
66 hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
69 clib_warning ("sw_if_index %u spd_id %u spd_index %u",
70 sw_if_index, spd_id, spd_index);
72 /* enable IPsec on TX */
73 vnet_interface_add_del_feature (im->vnet_main, vm, sw_if_index,
74 INTF_OUTPUT_FEAT_IPSEC, is_add);
76 /* enable IPsec on RX */
77 config.spd_index = spd_index;
80 lm = &ip4_main.lookup_main;
81 rx_cm = &lm->feature_config_mains[VNET_IP_RX_UNICAST_FEAT];
83 ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
85 ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
86 (vm, &rx_cm->config_main,
87 ci, ip4_main.ip4_unicast_rx_feature_ipsec, &config, sizeof (config));
88 rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
91 lm = &ip6_main.lookup_main;
92 rx_cm = &lm->feature_config_mains[VNET_IP_RX_UNICAST_FEAT];
94 ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
96 ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
97 (vm, &rx_cm->config_main,
98 ci, ip6_main.ip6_unicast_rx_feature_ipsec, &config, sizeof (config));
99 rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
105 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
107 ipsec_main_t *im = &ipsec_main;
108 ipsec_spd_t *spd = 0;
112 p = hash_get (im->spd_index_by_spd_id, spd_id);
114 return VNET_API_ERROR_INVALID_VALUE;
116 return VNET_API_ERROR_INVALID_VALUE;
118 if (!is_add) /* delete */
121 spd = pool_elt_at_index (im->spds, spd_index);
123 return VNET_API_ERROR_INVALID_VALUE;
125 hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
127 ipsec_set_interface_spd(vm, k, spd_id, 0);
130 hash_unset (im->spd_index_by_spd_id, spd_id);
131 pool_free (spd->policies);
132 vec_free (spd->ipv4_outbound_policies);
133 vec_free (spd->ipv6_outbound_policies);
134 vec_free (spd->ipv4_inbound_protect_policy_indices);
135 vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
136 pool_put (im->spds, spd);
138 else /* create new SPD */
140 pool_get (im->spds, spd);
141 memset (spd, 0, sizeof (*spd));
142 spd_index = spd - im->spds;
144 hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
150 ipsec_spd_entry_sort (void *a1, void *a2)
152 ipsec_main_t *im = &ipsec_main;
156 ipsec_policy_t *p1, *p2;
159 pool_foreach (spd, im->spds, ({
160 p1 = pool_elt_at_index(spd->policies, *id1);
161 p2 = pool_elt_at_index(spd->policies, *id2);
163 return p2->priority - p1->priority;
171 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
173 ipsec_main_t *im = &ipsec_main;
174 ipsec_spd_t *spd = 0;
179 clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
180 policy->priority, policy->is_outbound);
182 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
184 p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
186 return VNET_API_ERROR_SYSCALL_ERROR_1;
187 policy->sa_index = p[0];
190 p = hash_get (im->spd_index_by_spd_id, policy->id);
193 return VNET_API_ERROR_SYSCALL_ERROR_1;
196 spd = pool_elt_at_index (im->spds, spd_index);
198 return VNET_API_ERROR_SYSCALL_ERROR_1;
204 pool_get (spd->policies, vp);
205 clib_memcpy (vp, policy, sizeof (*vp));
206 policy_index = vp - spd->policies;
208 if (policy->is_outbound)
212 vec_add1 (spd->ipv6_outbound_policies, policy_index);
213 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
214 vec_sort_with_function (spd->ipv6_outbound_policies,
215 ipsec_spd_entry_sort);
219 vec_add1 (spd->ipv4_outbound_policies, policy_index);
220 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
221 vec_sort_with_function (spd->ipv4_outbound_policies,
222 ipsec_spd_entry_sort);
229 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
231 vec_add1 (spd->ipv6_inbound_protect_policy_indices,
233 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
234 vec_sort_with_function
235 (spd->ipv6_inbound_protect_policy_indices,
236 ipsec_spd_entry_sort);
241 (spd->ipv6_inbound_policy_discard_and_bypass_indices,
243 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
244 vec_sort_with_function
245 (spd->ipv6_inbound_policy_discard_and_bypass_indices,
246 ipsec_spd_entry_sort);
251 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
253 vec_add1 (spd->ipv4_inbound_protect_policy_indices,
255 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
256 vec_sort_with_function
257 (spd->ipv4_inbound_protect_policy_indices,
258 ipsec_spd_entry_sort);
263 (spd->ipv4_inbound_policy_discard_and_bypass_indices,
265 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
266 vec_sort_with_function
267 (spd->ipv4_inbound_policy_discard_and_bypass_indices,
268 ipsec_spd_entry_sort);
278 pool_foreach_index(i, spd->policies, ({
279 vp = pool_elt_at_index(spd->policies, i);
280 if (vp->priority != policy->priority)
282 if (vp->is_outbound != policy->is_outbound)
284 if (vp->policy != policy->policy)
286 if (vp->sa_id != policy->sa_id)
288 if (vp->protocol != policy->protocol)
290 if (vp->lport.start != policy->lport.start)
292 if (vp->lport.stop != policy->lport.stop)
294 if (vp->rport.start != policy->rport.start)
296 if (vp->rport.stop != policy->rport.stop)
298 if (vp->is_ipv6 != policy->is_ipv6)
302 if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
304 if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
306 if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
308 if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
310 if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
312 if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
314 if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
316 if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
318 if (policy->is_outbound)
320 vec_foreach_index(j, spd->ipv6_outbound_policies) {
321 if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
322 vec_del1 (spd->ipv6_outbound_policies, j);
329 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
331 vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
332 if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
333 vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
340 vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
341 if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
342 vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
351 if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
353 if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
355 if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
357 if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
359 if (policy->is_outbound)
361 vec_foreach_index(j, spd->ipv4_outbound_policies) {
362 if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
363 vec_del1 (spd->ipv4_outbound_policies, j);
370 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
372 vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
373 if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
374 vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
381 vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
382 if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
383 vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
389 pool_put (spd->policies, vp);
400 ipsec_is_sa_used (u32 sa_index)
402 ipsec_main_t *im = &ipsec_main;
405 ipsec_tunnel_if_t *t;
408 pool_foreach(spd, im->spds, ({
409 pool_foreach(p, spd->policies, ({
410 if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
412 if (p->sa_index == sa_index)
418 pool_foreach(t, im->tunnel_interfaces, ({
419 if (t->input_sa_index == sa_index)
421 if (t->output_sa_index == sa_index)
430 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
432 ipsec_main_t *im = &ipsec_main;
437 clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
439 p = hash_get (im->sa_index_by_sa_id, new_sa->id);
441 return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
443 return VNET_API_ERROR_SYSCALL_ERROR_1;
445 if (!is_add) /* delete */
448 sa = pool_elt_at_index (im->sad, sa_index);
449 if (ipsec_is_sa_used (sa_index))
451 clib_warning ("sa_id %u used in policy", sa->id);
452 return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
454 hash_unset (im->sa_index_by_sa_id, sa->id);
455 pool_put (im->sad, sa);
457 else /* create new SA */
459 pool_get (im->sad, sa);
460 clib_memcpy (sa, new_sa, sizeof (*sa));
461 sa_index = sa - im->sad;
462 hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
468 ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
470 ipsec_main_t *im = &ipsec_main;
475 p = hash_get (im->sa_index_by_sa_id, sa_update->id);
477 return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
480 sa = pool_elt_at_index (im->sad, sa_index);
483 if (0 < sa_update->crypto_key_len)
485 clib_memcpy (sa->crypto_key, sa_update->crypto_key,
486 sa_update->crypto_key_len);
487 sa->crypto_key_len = sa_update->crypto_key_len;
491 if (0 < sa_update->integ_key_len)
493 clib_memcpy (sa->integ_key, sa_update->integ_key,
494 sa_update->integ_key_len);
495 sa->integ_key_len = sa_update->integ_key_len;
502 ipsec_rand_seed (void)
511 seed_data.time = time (NULL);
512 seed_data.pid = getpid ();
513 seed_data.p = (void *) &seed_data;
515 RAND_seed ((const void *) &seed_data, sizeof (seed_data));
518 static clib_error_t *
519 ipsec_init (vlib_main_t * vm)
522 ipsec_main_t *im = &ipsec_main;
523 vlib_thread_main_t *tm = vlib_get_thread_main ();
528 memset (im, 0, sizeof (im[0]));
530 im->vnet_main = vnet_get_main ();
533 im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
534 im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
535 im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
537 vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1,
538 CLIB_CACHE_LINE_BYTES);
540 node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
542 im->error_drop_node_index = node->index;
544 node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
546 im->esp_encrypt_node_index = node->index;
548 node = vlib_get_node_by_name (vm, (u8 *) "ip4-lookup");
550 im->ip4_lookup_node_index = node->index;
553 if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
556 if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
561 if ((error = ikev2_init (vm)))
567 VLIB_INIT_FUNCTION (ipsec_init);
570 * fd.io coding-style-patch-verification: ON
573 * eval: (c-set-style "gnu")