2 * decap.c : IPSec tunnel support
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 #include <vnet/ipsec/ikev2.h>
28 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
31 ipsec_main_t *im = &ipsec_main;
33 ip_config_main_t *rx_cm;
34 ip4_ipsec_config_t config;
39 p = hash_get (im->spd_index_by_spd_id, spd_id);
41 return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
45 p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
47 return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
51 hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
55 hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
58 clib_warning ("sw_if_index %u spd_id %u spd_index %u",
59 sw_if_index, spd_id, spd_index);
61 /* enable IPsec on TX */
62 vnet_interface_add_del_feature (im->vnet_main, vm, sw_if_index,
63 INTF_OUTPUT_FEAT_IPSEC, is_add);
65 /* enable IPsec on RX */
66 config.spd_index = spd_index;
69 lm = &ip4_main.lookup_main;
70 rx_cm = &lm->rx_config_mains[VNET_UNICAST];
72 ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
74 ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
75 (vm, &rx_cm->config_main,
76 ci, ip4_main.ip4_unicast_rx_feature_ipsec, &config, sizeof (config));
77 rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
80 lm = &ip6_main.lookup_main;
81 rx_cm = &lm->rx_config_mains[VNET_UNICAST];
83 ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
85 ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
86 (vm, &rx_cm->config_main,
87 ci, ip6_main.ip6_unicast_rx_feature_ipsec, &config, sizeof (config));
88 rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
94 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
96 ipsec_main_t *im = &ipsec_main;
101 p = hash_get (im->spd_index_by_spd_id, spd_id);
103 return VNET_API_ERROR_INVALID_VALUE;
105 return VNET_API_ERROR_INVALID_VALUE;
107 if (!is_add) /* delete */
110 spd = pool_elt_at_index (im->spds, spd_index);
112 return VNET_API_ERROR_INVALID_VALUE;
114 hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
116 ipsec_set_interface_spd(vm, k, spd_id, 0);
119 hash_unset (im->spd_index_by_spd_id, spd_id);
120 pool_free (spd->policies);
121 vec_free (spd->ipv4_outbound_policies);
122 vec_free (spd->ipv6_outbound_policies);
123 vec_free (spd->ipv4_inbound_protect_policy_indices);
124 vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
125 pool_put (im->spds, spd);
127 else /* create new SPD */
129 pool_get (im->spds, spd);
130 memset (spd, 0, sizeof (*spd));
131 spd_index = spd - im->spds;
133 hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
139 ipsec_spd_entry_sort (void *a1, void *a2)
141 ipsec_main_t *im = &ipsec_main;
145 ipsec_policy_t *p1, *p2;
148 pool_foreach (spd, im->spds, ({
149 p1 = pool_elt_at_index(spd->policies, *id1);
150 p2 = pool_elt_at_index(spd->policies, *id2);
152 return p2->priority - p1->priority;
160 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
162 ipsec_main_t *im = &ipsec_main;
163 ipsec_spd_t *spd = 0;
168 clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
169 policy->priority, policy->is_outbound);
171 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
173 p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
175 return VNET_API_ERROR_SYSCALL_ERROR_1;
176 policy->sa_index = p[0];
179 p = hash_get (im->spd_index_by_spd_id, policy->id);
182 return VNET_API_ERROR_SYSCALL_ERROR_1;
185 spd = pool_elt_at_index (im->spds, spd_index);
187 return VNET_API_ERROR_SYSCALL_ERROR_1;
193 pool_get (spd->policies, vp);
194 clib_memcpy (vp, policy, sizeof (*vp));
195 policy_index = vp - spd->policies;
197 if (policy->is_outbound)
201 vec_add1 (spd->ipv6_outbound_policies, policy_index);
202 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
203 vec_sort_with_function (spd->ipv6_outbound_policies,
204 ipsec_spd_entry_sort);
208 vec_add1 (spd->ipv4_outbound_policies, policy_index);
209 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
210 vec_sort_with_function (spd->ipv4_outbound_policies,
211 ipsec_spd_entry_sort);
218 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
220 vec_add1 (spd->ipv6_inbound_protect_policy_indices,
222 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
223 vec_sort_with_function (spd->
224 ipv6_inbound_protect_policy_indices,
225 ipsec_spd_entry_sort);
230 ipv6_inbound_policy_discard_and_bypass_indices,
232 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
233 vec_sort_with_function (spd->
234 ipv6_inbound_policy_discard_and_bypass_indices,
235 ipsec_spd_entry_sort);
240 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
242 vec_add1 (spd->ipv4_inbound_protect_policy_indices,
244 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
245 vec_sort_with_function (spd->
246 ipv4_inbound_protect_policy_indices,
247 ipsec_spd_entry_sort);
252 ipv4_inbound_policy_discard_and_bypass_indices,
254 clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
255 vec_sort_with_function (spd->
256 ipv4_inbound_policy_discard_and_bypass_indices,
257 ipsec_spd_entry_sort);
267 pool_foreach_index(i, spd->policies, ({
268 vp = pool_elt_at_index(spd->policies, i);
269 if (vp->priority != policy->priority)
271 if (vp->is_outbound != policy->is_outbound)
273 if (vp->policy != policy->policy)
275 if (vp->sa_id != policy->sa_id)
277 if (vp->protocol != policy->protocol)
279 if (vp->lport.start != policy->lport.start)
281 if (vp->lport.stop != policy->lport.stop)
283 if (vp->rport.start != policy->rport.start)
285 if (vp->rport.stop != policy->rport.stop)
287 if (vp->is_ipv6 != policy->is_ipv6)
291 if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
293 if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
295 if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
297 if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
299 if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
301 if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
303 if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
305 if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
307 if (policy->is_outbound)
309 vec_foreach_index(j, spd->ipv6_outbound_policies) {
310 if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
311 vec_del1 (spd->ipv6_outbound_policies, j);
318 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
320 vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
321 if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
322 vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
329 vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
330 if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
331 vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
340 if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
342 if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
344 if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
346 if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
348 if (policy->is_outbound)
350 vec_foreach_index(j, spd->ipv4_outbound_policies) {
351 if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
352 vec_del1 (spd->ipv4_outbound_policies, j);
359 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
361 vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
362 if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
363 vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
370 vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
371 if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
372 vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
378 pool_put (spd->policies, vp);
389 ipsec_is_sa_used (u32 sa_index)
391 ipsec_main_t *im = &ipsec_main;
396 pool_foreach(spd, im->spds, ({
397 pool_foreach(p, spd->policies, ({
398 if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
400 if (p->sa_index == sa_index)
411 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
413 ipsec_main_t *im = &ipsec_main;
418 clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
420 p = hash_get (im->sa_index_by_sa_id, new_sa->id);
422 return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
424 return VNET_API_ERROR_SYSCALL_ERROR_1;
426 if (!is_add) /* delete */
429 sa = pool_elt_at_index (im->sad, sa_index);
430 if (ipsec_is_sa_used (sa_index))
432 clib_warning ("sa_id %u used in policy", sa->id);
433 return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
435 hash_unset (im->sa_index_by_sa_id, sa->id);
436 pool_put (im->sad, sa);
438 else /* create new SA */
440 pool_get (im->sad, sa);
441 clib_memcpy (sa, new_sa, sizeof (*sa));
442 sa_index = sa - im->sad;
443 hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
449 ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
451 ipsec_main_t *im = &ipsec_main;
456 p = hash_get (im->sa_index_by_sa_id, sa_update->id);
458 return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
461 sa = pool_elt_at_index (im->sad, sa_index);
464 if (0 < sa_update->crypto_key_len)
466 clib_memcpy (sa->crypto_key, sa_update->crypto_key,
467 sa_update->crypto_key_len);
468 sa->crypto_key_len = sa_update->crypto_key_len;
472 if (0 < sa_update->integ_key_len)
474 clib_memcpy (sa->integ_key, sa_update->integ_key,
475 sa_update->integ_key_len);
476 sa->integ_key_len = sa_update->integ_key_len;
483 ipsec_rand_seed (void)
492 seed_data.time = time (NULL);
493 seed_data.pid = getpid ();
494 seed_data.p = (void *) &seed_data;
496 RAND_seed ((const void *) &seed_data, sizeof (seed_data));
499 static clib_error_t *
500 ipsec_init (vlib_main_t * vm)
503 ipsec_main_t *im = &ipsec_main;
504 vlib_thread_main_t *tm = vlib_get_thread_main ();
509 memset (im, 0, sizeof (im[0]));
511 im->vnet_main = vnet_get_main ();
514 im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
515 im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
516 im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
518 vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1,
519 CLIB_CACHE_LINE_BYTES);
521 node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
523 im->error_drop_node_index = node->index;
525 node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
527 im->esp_encrypt_node_index = node->index;
529 node = vlib_get_node_by_name (vm, (u8 *) "ip4-lookup");
531 im->ip4_lookup_node_index = node->index;
534 if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
537 if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
542 if ((error = ikev2_init (vm)))
548 VLIB_INIT_FUNCTION (ipsec_init);
551 * fd.io coding-style-patch-verification: ON
554 * eval: (c-set-style "gnu")