vnet/vnet/ipsec/ipsec.c

   1 /*
   2  * decap.c : IPSec tunnel support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21 #include <vnet/interface.h>
  22
  23 #include <vnet/ipsec/ipsec.h>
  24 #include <vnet/ipsec/esp.h>
  25 #include <vnet/ipsec/ikev2.h>
  26
  27 int
  28 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
  29                          int is_add)
  30 {
  31   ipsec_main_t *im = &ipsec_main;
  32   ip_lookup_main_t *lm;
  33   ip_config_main_t *rx_cm;
  34   ip4_ipsec_config_t config;
  35
  36   u32 spd_index, ci;
  37   uword *p;
  38
  39   p = hash_get (im->spd_index_by_spd_id, spd_id);
  40   if (!p)
  41     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such spd-id */
  42
  43   spd_index = p[0];
  44
  45   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
  46   if (p && is_add)
  47     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* spd already assigned */
  48
  49   if (is_add)
  50     {
  51       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
  52     }
  53   else
  54     {
  55       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
  56     }
  57
  58   clib_warning ("sw_if_index %u spd_id %u spd_index %u",
  59                 sw_if_index, spd_id, spd_index);
  60
  61   /* enable IPsec on TX */
  62   vnet_interface_add_del_feature (im->vnet_main, vm, sw_if_index,
  63                                   INTF_OUTPUT_FEAT_IPSEC, is_add);
  64
  65   /* enable IPsec on RX */
  66   config.spd_index = spd_index;
  67
  68   /* IPv4 */
  69   lm = &ip4_main.lookup_main;
  70   rx_cm = &lm->rx_config_mains[VNET_UNICAST];
  71
  72   ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
  73
  74   ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
  75     (vm, &rx_cm->config_main,
  76      ci, ip4_main.ip4_unicast_rx_feature_ipsec, &config, sizeof (config));
  77   rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
  78
  79   /* IPv6 */
  80   lm = &ip6_main.lookup_main;
  81   rx_cm = &lm->rx_config_mains[VNET_UNICAST];
  82
  83   ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
  84
  85   ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
  86     (vm, &rx_cm->config_main,
  87      ci, ip6_main.ip6_unicast_rx_feature_ipsec, &config, sizeof (config));
  88   rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
  89
  90   return 0;
  91 }
  92
  93 int
  94 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
  95 {
  96   ipsec_main_t *im = &ipsec_main;
  97   ipsec_spd_t *spd = 0;
  98   uword *p;
  99   u32 spd_index, k, v;
 100
 101   p = hash_get (im->spd_index_by_spd_id, spd_id);
 102   if (p && is_add)
 103     return VNET_API_ERROR_INVALID_VALUE;
 104   if (!p && !is_add)
 105     return VNET_API_ERROR_INVALID_VALUE;
 106
 107   if (!is_add)                  /* delete */
 108     {
 109       spd_index = p[0];
 110       spd = pool_elt_at_index (im->spds, spd_index);
 111       if (!spd)
 112         return VNET_API_ERROR_INVALID_VALUE;
 113       /* *INDENT-OFF* */
 114       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
 115         if (v == spd_index)
 116           ipsec_set_interface_spd(vm, k, spd_id, 0);
 117       }));
 118       /* *INDENT-ON* */
 119       hash_unset (im->spd_index_by_spd_id, spd_id);
 120       pool_free (spd->policies);
 121       vec_free (spd->ipv4_outbound_policies);
 122       vec_free (spd->ipv6_outbound_policies);
 123       vec_free (spd->ipv4_inbound_protect_policy_indices);
 124       vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
 125       pool_put (im->spds, spd);
 126     }
 127   else                          /* create new SPD */
 128     {
 129       pool_get (im->spds, spd);
 130       memset (spd, 0, sizeof (*spd));
 131       spd_index = spd - im->spds;
 132       spd->id = spd_id;
 133       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 134     }
 135   return 0;
 136 }
 137
 138 static int
 139 ipsec_spd_entry_sort (void *a1, void *a2)
 140 {
 141   ipsec_main_t *im = &ipsec_main;
 142   u32 *id1 = a1;
 143   u32 *id2 = a2;
 144   ipsec_spd_t *spd;
 145   ipsec_policy_t *p1, *p2;
 146
 147   /* *INDENT-OFF* */
 148   pool_foreach (spd, im->spds, ({
 149     p1 = pool_elt_at_index(spd->policies, *id1);
 150     p2 = pool_elt_at_index(spd->policies, *id2);
 151     if (p1 && p2)
 152       return p2->priority - p1->priority;
 153   }));
 154   /* *INDENT-ON* */
 155
 156   return 0;
 157 }
 158
 159 int
 160 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
 161 {
 162   ipsec_main_t *im = &ipsec_main;
 163   ipsec_spd_t *spd = 0;
 164   ipsec_policy_t *vp;
 165   uword *p;
 166   u32 spd_index;
 167
 168   clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
 169                 policy->priority, policy->is_outbound);
 170
 171   if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 172     {
 173       p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
 174       if (!p)
 175         return VNET_API_ERROR_SYSCALL_ERROR_1;
 176       policy->sa_index = p[0];
 177     }
 178
 179   p = hash_get (im->spd_index_by_spd_id, policy->id);
 180
 181   if (!p)
 182     return VNET_API_ERROR_SYSCALL_ERROR_1;
 183
 184   spd_index = p[0];
 185   spd = pool_elt_at_index (im->spds, spd_index);
 186   if (!spd)
 187     return VNET_API_ERROR_SYSCALL_ERROR_1;
 188
 189   if (is_add)
 190     {
 191       u32 policy_index;
 192
 193       pool_get (spd->policies, vp);
 194       clib_memcpy (vp, policy, sizeof (*vp));
 195       policy_index = vp - spd->policies;
 196
 197       if (policy->is_outbound)
 198         {
 199           if (policy->is_ipv6)
 200             {
 201               vec_add1 (spd->ipv6_outbound_policies, policy_index);
 202               clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 203               vec_sort_with_function (spd->ipv6_outbound_policies,
 204                                       ipsec_spd_entry_sort);
 205             }
 206           else
 207             {
 208               vec_add1 (spd->ipv4_outbound_policies, policy_index);
 209               clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 210               vec_sort_with_function (spd->ipv4_outbound_policies,
 211                                       ipsec_spd_entry_sort);
 212             }
 213         }
 214       else
 215         {
 216           if (policy->is_ipv6)
 217             {
 218               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 219                 {
 220                   vec_add1 (spd->ipv6_inbound_protect_policy_indices,
 221                             policy_index);
 222                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 223                   vec_sort_with_function (spd->
 224                                           ipv6_inbound_protect_policy_indices,
 225                                           ipsec_spd_entry_sort);
 226                 }
 227               else
 228                 {
 229                   vec_add1 (spd->
 230                             ipv6_inbound_policy_discard_and_bypass_indices,
 231                             policy_index);
 232                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 233                   vec_sort_with_function (spd->
 234                                           ipv6_inbound_policy_discard_and_bypass_indices,
 235                                           ipsec_spd_entry_sort);
 236                 }
 237             }
 238           else
 239             {
 240               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 241                 {
 242                   vec_add1 (spd->ipv4_inbound_protect_policy_indices,
 243                             policy_index);
 244                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 245                   vec_sort_with_function (spd->
 246                                           ipv4_inbound_protect_policy_indices,
 247                                           ipsec_spd_entry_sort);
 248                 }
 249               else
 250                 {
 251                   vec_add1 (spd->
 252                             ipv4_inbound_policy_discard_and_bypass_indices,
 253                             policy_index);
 254                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 255                   vec_sort_with_function (spd->
 256                                           ipv4_inbound_policy_discard_and_bypass_indices,
 257                                           ipsec_spd_entry_sort);
 258                 }
 259             }
 260         }
 261
 262     }
 263   else
 264     {
 265       u32 i, j;
 266       /* *INDENT-OFF* */
 267       pool_foreach_index(i, spd->policies, ({
 268         vp = pool_elt_at_index(spd->policies, i);
 269         if (vp->priority != policy->priority)
 270           continue;
 271         if (vp->is_outbound != policy->is_outbound)
 272           continue;
 273         if (vp->policy != policy->policy)
 274           continue;
 275         if (vp->sa_id != policy->sa_id)
 276           continue;
 277         if (vp->protocol != policy->protocol)
 278           continue;
 279         if (vp->lport.start != policy->lport.start)
 280           continue;
 281         if (vp->lport.stop != policy->lport.stop)
 282           continue;
 283         if (vp->rport.start != policy->rport.start)
 284           continue;
 285         if (vp->rport.stop != policy->rport.stop)
 286           continue;
 287         if (vp->is_ipv6 != policy->is_ipv6)
 288           continue;
 289         if (policy->is_ipv6)
 290           {
 291             if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
 292               continue;
 293             if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
 294               continue;
 295             if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
 296               continue;
 297             if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 298               continue;
 299             if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
 300               continue;
 301             if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
 302               continue;
 303             if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
 304               continue;
 305            if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 306               continue;
 307            if (policy->is_outbound)
 308              {
 309                vec_foreach_index(j, spd->ipv6_outbound_policies) {
 310                  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
 311                    vec_del1 (spd->ipv6_outbound_policies, j);
 312                    break;
 313                  }
 314                }
 315              }
 316            else
 317              {
 318                if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 319                  {
 320                    vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
 321                      if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
 322                        vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
 323                        break;
 324                      }
 325                    }
 326                  }
 327                else
 328                  {
 329                    vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
 330                      if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
 331                        vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
 332                        break;
 333                      }
 334                    }
 335                  }
 336              }
 337           }
 338         else
 339           {
 340             if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
 341               continue;
 342             if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
 343               continue;
 344             if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
 345               continue;
 346             if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
 347               continue;
 348             if (policy->is_outbound)
 349               {
 350                 vec_foreach_index(j, spd->ipv4_outbound_policies) {
 351                   if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
 352                     vec_del1 (spd->ipv4_outbound_policies, j);
 353                     break;
 354                   }
 355                 }
 356               }
 357             else
 358               {
 359                 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 360                   {
 361                     vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
 362                       if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
 363                         vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
 364                         break;
 365                       }
 366                     }
 367                   }
 368                 else
 369                   {
 370                     vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
 371                       if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
 372                         vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
 373                         break;
 374                     }
 375                   }
 376               }
 377           }
 378           pool_put (spd->policies, vp);
 379           break;
 380         }
 381       }));
 382       /* *INDENT-ON* */
 383     }
 384
 385   return 0;
 386 }
 387
 388 static u8
 389 ipsec_is_sa_used (u32 sa_index)
 390 {
 391   ipsec_main_t *im = &ipsec_main;
 392   ipsec_spd_t *spd;
 393   ipsec_policy_t *p;
 394
 395   /* *INDENT-OFF* */
 396   pool_foreach(spd, im->spds, ({
 397     pool_foreach(p, spd->policies, ({
 398       if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
 399         {
 400           if (p->sa_index == sa_index)
 401             return 1;
 402         }
 403     }));
 404   }));
 405   /* *INDENT-ON* */
 406
 407   return 0;
 408 }
 409
 410 int
 411 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
 412 {
 413   ipsec_main_t *im = &ipsec_main;
 414   ipsec_sa_t *sa = 0;
 415   uword *p;
 416   u32 sa_index;
 417
 418   clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
 419
 420   p = hash_get (im->sa_index_by_sa_id, new_sa->id);
 421   if (p && is_add)
 422     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* already exists */
 423   if (!p && !is_add)
 424     return VNET_API_ERROR_SYSCALL_ERROR_1;
 425
 426   if (!is_add)                  /* delete */
 427     {
 428       sa_index = p[0];
 429       sa = pool_elt_at_index (im->sad, sa_index);
 430       if (ipsec_is_sa_used (sa_index))
 431         {
 432           clib_warning ("sa_id %u used in policy", sa->id);
 433           return VNET_API_ERROR_SYSCALL_ERROR_1;        /* sa used in policy */
 434         }
 435       hash_unset (im->sa_index_by_sa_id, sa->id);
 436       pool_put (im->sad, sa);
 437     }
 438   else                          /* create new SA */
 439     {
 440       pool_get (im->sad, sa);
 441       clib_memcpy (sa, new_sa, sizeof (*sa));
 442       sa_index = sa - im->sad;
 443       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
 444     }
 445   return 0;
 446 }
 447
 448 int
 449 ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
 450 {
 451   ipsec_main_t *im = &ipsec_main;
 452   uword *p;
 453   u32 sa_index;
 454   ipsec_sa_t *sa = 0;
 455
 456   p = hash_get (im->sa_index_by_sa_id, sa_update->id);
 457   if (!p)
 458     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such sa-id */
 459
 460   sa_index = p[0];
 461   sa = pool_elt_at_index (im->sad, sa_index);
 462
 463   /* new crypto key */
 464   if (0 < sa_update->crypto_key_len)
 465     {
 466       clib_memcpy (sa->crypto_key, sa_update->crypto_key,
 467                    sa_update->crypto_key_len);
 468       sa->crypto_key_len = sa_update->crypto_key_len;
 469     }
 470
 471   /* new integ key */
 472   if (0 < sa_update->integ_key_len)
 473     {
 474       clib_memcpy (sa->integ_key, sa_update->integ_key,
 475                    sa_update->integ_key_len);
 476       sa->integ_key_len = sa_update->integ_key_len;
 477     }
 478
 479   return 0;
 480 }
 481
 482 static void
 483 ipsec_rand_seed (void)
 484 {
 485   struct
 486   {
 487     time_t time;
 488     pid_t pid;
 489     void *p;
 490   } seed_data;
 491
 492   seed_data.time = time (NULL);
 493   seed_data.pid = getpid ();
 494   seed_data.p = (void *) &seed_data;
 495
 496   RAND_seed ((const void *) &seed_data, sizeof (seed_data));
 497 }
 498
 499 static clib_error_t *
 500 ipsec_init (vlib_main_t * vm)
 501 {
 502   clib_error_t *error;
 503   ipsec_main_t *im = &ipsec_main;
 504   vlib_thread_main_t *tm = vlib_get_thread_main ();
 505   vlib_node_t *node;
 506
 507   ipsec_rand_seed ();
 508
 509   memset (im, 0, sizeof (im[0]));
 510
 511   im->vnet_main = vnet_get_main ();
 512   im->vlib_main = vm;
 513
 514   im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
 515   im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
 516   im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
 517
 518   vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1,
 519                         CLIB_CACHE_LINE_BYTES);
 520
 521   node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
 522   ASSERT (node);
 523   im->error_drop_node_index = node->index;
 524
 525   node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
 526   ASSERT (node);
 527   im->esp_encrypt_node_index = node->index;
 528
 529   node = vlib_get_node_by_name (vm, (u8 *) "ip4-lookup");
 530   ASSERT (node);
 531   im->ip4_lookup_node_index = node->index;
 532
 533
 534   if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
 535     return error;
 536
 537   if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
 538     return error;
 539
 540   esp_init ();
 541
 542   if ((error = ikev2_init (vm)))
 543     return error;
 544
 545   return 0;
 546 }
 547
 548 VLIB_INIT_FUNCTION (ipsec_init);
 549
 550 /*
 551  * fd.io coding-style-patch-verification: ON
 552  *
 553  * Local Variables:
 554  * eval: (c-set-style "gnu")
 555  * End:
 556  */