vnet/vnet/ipsec/ipsec.c

   1 /*
   2  * decap.c : IPSec tunnel support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21 #include <vnet/interface.h>
  22
  23 #include <vnet/ipsec/ipsec.h>
  24 #include <vnet/ipsec/esp.h>
  25 #include <vnet/ipsec/ikev2.h>
  26
  27 int
  28 ipsec_set_interface_spd(vlib_main_t * vm, u32 sw_if_index, u32 spd_id, int is_add)
  29 {
  30   ipsec_main_t *im = &ipsec_main;
  31   ip_lookup_main_t * lm;
  32   ip_config_main_t * rx_cm;
  33   ip4_ipsec_config_t config;
  34
  35   u32 spd_index, ci;
  36   uword *p;
  37
  38   p = hash_get (im->spd_index_by_spd_id, spd_id);
  39   if (!p)
  40     return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such spd-id */
  41
  42   spd_index = p[0];
  43
  44   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
  45   if (p && is_add)
  46     return VNET_API_ERROR_SYSCALL_ERROR_1; /* spd already assigned */
  47
  48   if (is_add)
  49     {
  50       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
  51     }
  52   else
  53     {
  54       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
  55     }
  56
  57   clib_warning("sw_if_index %u spd_id %u spd_index %u",
  58                sw_if_index, spd_id, spd_index);
  59
  60   /* enable IPsec on TX */
  61   vnet_interface_add_del_feature(im->vnet_main, vm, sw_if_index,
  62                                  INTF_OUTPUT_FEAT_IPSEC, is_add);
  63
  64   /* enable IPsec on RX */
  65   config.spd_index = spd_index;
  66
  67   /* IPv4 */
  68   lm = &ip4_main.lookup_main;
  69   rx_cm = &lm->rx_config_mains[VNET_UNICAST];
  70
  71   ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
  72
  73   ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
  74     (vm, &rx_cm->config_main,
  75      ci,
  76      IP4_RX_FEATURE_IPSEC,
  77      &config,
  78      sizeof (config));
  79   rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
  80
  81   /* IPv6 */
  82   lm = &ip6_main.lookup_main;
  83   rx_cm = &lm->rx_config_mains[VNET_UNICAST];
  84
  85   ci = rx_cm->config_index_by_sw_if_index[sw_if_index];
  86
  87   ci = (is_add ? vnet_config_add_feature : vnet_config_del_feature)
  88     (vm, &rx_cm->config_main,
  89      ci,
  90      IP6_RX_FEATURE_IPSEC,
  91      &config,
  92      sizeof (config));
  93   rx_cm->config_index_by_sw_if_index[sw_if_index] = ci;
  94
  95   return 0;
  96 }
  97
  98 int
  99 ipsec_add_del_spd(vlib_main_t * vm, u32 spd_id, int is_add)
 100 {
 101   ipsec_main_t *im = &ipsec_main;
 102   ipsec_spd_t * spd = 0;
 103   uword *p;
 104   u32 spd_index, k, v;
 105
 106   p = hash_get (im->spd_index_by_spd_id, spd_id);
 107   if (p && is_add)
 108     return VNET_API_ERROR_INVALID_VALUE;
 109   if (!p && !is_add)
 110     return VNET_API_ERROR_INVALID_VALUE;
 111
 112   if (!is_add) /* delete */
 113     {
 114       spd_index = p[0];
 115       spd = pool_elt_at_index(im->spds, spd_index);
 116       if (!spd)
 117         return VNET_API_ERROR_INVALID_VALUE;
 118       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
 119         if (v == spd_index)
 120           ipsec_set_interface_spd(vm, k, spd_id, 0);
 121       }));
 122       hash_unset (im->spd_index_by_spd_id, spd_id);
 123       pool_free (spd->policies);
 124       vec_free (spd->ipv4_outbound_policies);
 125       vec_free (spd->ipv6_outbound_policies);
 126       vec_free (spd->ipv4_inbound_protect_policy_indices);
 127       vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
 128       pool_put (im->spds, spd);
 129     }
 130   else /* create new SPD */
 131     {
 132       pool_get (im->spds, spd);
 133       memset (spd, 0, sizeof (*spd));
 134       spd_index = spd - im->spds;
 135       spd->id = spd_id;
 136       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 137     }
 138   return 0;
 139 }
 140
 141 static int
 142 ipsec_spd_entry_sort(void * a1, void * a2)
 143 {
 144   ipsec_main_t *im = &ipsec_main;
 145   u32 * id1 = a1;
 146   u32 * id2 = a2;
 147   ipsec_spd_t * spd;
 148   ipsec_policy_t * p1, * p2;
 149
 150   pool_foreach (spd, im->spds, ({
 151     p1 = pool_elt_at_index(spd->policies, *id1);
 152     p2 = pool_elt_at_index(spd->policies, *id2);
 153     if (p1 && p2)
 154       return p2->priority - p1->priority;
 155   }));
 156
 157   return 0;
 158 }
 159
 160 int
 161 ipsec_add_del_policy(vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
 162 {
 163   ipsec_main_t *im = &ipsec_main;
 164   ipsec_spd_t * spd = 0;
 165   ipsec_policy_t * vp;
 166   uword *p;
 167   u32 spd_index;
 168
 169   clib_warning("policy-id %u priority %d is_outbound %u",policy->id, policy->priority, policy->is_outbound);
 170
 171   if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 172     {
 173       p = hash_get(im->sa_index_by_sa_id, policy->sa_id);
 174       if (!p)
 175         return VNET_API_ERROR_SYSCALL_ERROR_1;
 176       policy->sa_index = p[0];
 177     }
 178
 179   p = hash_get (im->spd_index_by_spd_id, policy->id);
 180
 181   if (!p)
 182     return VNET_API_ERROR_SYSCALL_ERROR_1;
 183
 184   spd_index = p[0];
 185   spd = pool_elt_at_index(im->spds, spd_index);
 186   if (!spd)
 187     return VNET_API_ERROR_SYSCALL_ERROR_1;
 188
 189   if (is_add)
 190     {
 191       u32 policy_index;
 192
 193       pool_get (spd->policies, vp);
 194       memcpy (vp, policy, sizeof (*vp));
 195       policy_index = vp - spd->policies;
 196
 197       if (policy->is_outbound)
 198         {
 199           if (policy->is_ipv6)
 200             {
 201               vec_add1 (spd->ipv6_outbound_policies, policy_index);
 202               memcpy(vp, policy, sizeof(ipsec_policy_t));
 203               vec_sort_with_function (spd->ipv6_outbound_policies,
 204                                       ipsec_spd_entry_sort);
 205             }
 206           else
 207             {
 208               vec_add1 (spd->ipv4_outbound_policies, policy_index);
 209               memcpy(vp, policy, sizeof(ipsec_policy_t));
 210               vec_sort_with_function (spd->ipv4_outbound_policies,
 211                                       ipsec_spd_entry_sort);
 212             }
 213         }
 214       else
 215         {
 216           if (policy->is_ipv6)
 217             {
 218               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 219                 {
 220                   vec_add1 (spd->ipv6_inbound_protect_policy_indices,
 221                             policy_index);
 222                   memcpy(vp, policy, sizeof(ipsec_policy_t));
 223                   vec_sort_with_function (
 224                      spd->ipv6_inbound_protect_policy_indices,
 225                      ipsec_spd_entry_sort);
 226                 }
 227               else
 228                 {
 229                   vec_add1 (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 230                             policy_index);
 231                   memcpy(vp, policy, sizeof(ipsec_policy_t));
 232                   vec_sort_with_function (
 233                      spd->ipv6_inbound_policy_discard_and_bypass_indices,
 234                      ipsec_spd_entry_sort);
 235                 }
 236             }
 237           else
 238             {
 239               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 240                 {
 241                   vec_add1 (spd->ipv4_inbound_protect_policy_indices,
 242                             policy_index);
 243                   memcpy(vp, policy, sizeof(ipsec_policy_t));
 244                   vec_sort_with_function (
 245                      spd->ipv4_inbound_protect_policy_indices,
 246                      ipsec_spd_entry_sort);
 247                 }
 248               else
 249                 {
 250                   vec_add1 (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 251                             policy_index);
 252                   memcpy(vp, policy, sizeof(ipsec_policy_t));
 253                   vec_sort_with_function (
 254                     spd->ipv4_inbound_policy_discard_and_bypass_indices,
 255                     ipsec_spd_entry_sort);
 256                 }
 257             }
 258         }
 259
 260     }
 261   else
 262     {
 263       u32 i, j;
 264       pool_foreach_index(i, spd->policies, ({
 265         vp = pool_elt_at_index(spd->policies, i);
 266         if (vp->priority != policy->priority)
 267           continue;
 268         if (vp->is_outbound != policy->is_outbound)
 269           continue;
 270         if (vp->policy != policy->policy)
 271           continue;
 272         if (vp->sa_id != policy->sa_id)
 273           continue;
 274         if (vp->protocol != policy->protocol)
 275           continue;
 276         if (vp->lport.start != policy->lport.start)
 277           continue;
 278         if (vp->lport.stop != policy->lport.stop)
 279           continue;
 280         if (vp->rport.start != policy->rport.start)
 281           continue;
 282         if (vp->rport.stop != policy->rport.stop)
 283           continue;
 284         if (vp->is_ipv6 != policy->is_ipv6)
 285           continue;
 286         if (policy->is_ipv6)
 287           {
 288             if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
 289               continue;
 290             if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
 291               continue;
 292             if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
 293               continue;
 294             if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 295               continue;
 296             if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
 297               continue;
 298             if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
 299               continue;
 300             if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
 301               continue;
 302            if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 303               continue;
 304            if (policy->is_outbound)
 305              {
 306                vec_foreach_index(j, spd->ipv6_outbound_policies) {
 307                  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
 308                    vec_del1 (spd->ipv6_outbound_policies, j);
 309                    break;
 310                  }
 311                }
 312              }
 313            else
 314              {
 315                if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 316                  {
 317                    vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
 318                      if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
 319                        vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
 320                        break;
 321                      }
 322                    }
 323                  }
 324                else
 325                  {
 326                    vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
 327                      if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
 328                        vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
 329                        break;
 330                      }
 331                    }
 332                  }
 333              }
 334           }
 335         else
 336           {
 337             if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
 338               continue;
 339             if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
 340               continue;
 341             if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
 342               continue;
 343             if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
 344               continue;
 345             if (policy->is_outbound)
 346               {
 347                 vec_foreach_index(j, spd->ipv4_outbound_policies) {
 348                   if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
 349                     vec_del1 (spd->ipv4_outbound_policies, j);
 350                     break;
 351                   }
 352                 }
 353               }
 354             else
 355               {
 356                 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 357                   {
 358                     vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
 359                       if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
 360                         vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
 361                         break;
 362                       }
 363                     }
 364                   }
 365                 else
 366                   {
 367                     vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
 368                       if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
 369                         vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
 370                         break;
 371                     }
 372                   }
 373               }
 374           }
 375           pool_put (spd->policies, vp);
 376           break;
 377         }
 378       }));
 379     }
 380
 381   return 0;
 382 }
 383
 384 static u8
 385 ipsec_is_sa_used(u32 sa_index)
 386 {
 387   ipsec_main_t * im = &ipsec_main;
 388   ipsec_spd_t * spd;
 389   ipsec_policy_t * p;
 390
 391   pool_foreach(spd, im->spds, ({
 392     pool_foreach(p, spd->policies, ({
 393       if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
 394         {
 395           if (p->sa_index == sa_index)
 396             return 1;
 397         }
 398     }));
 399   }));
 400
 401   return 0;
 402 }
 403
 404 int
 405 ipsec_add_del_sa(vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
 406 {
 407   ipsec_main_t *im = &ipsec_main;
 408   ipsec_sa_t * sa = 0;
 409   uword *p;
 410   u32 sa_index;
 411
 412   clib_warning("id %u spi %u", new_sa->id, new_sa->spi);
 413
 414   p = hash_get (im->sa_index_by_sa_id, new_sa->id);
 415   if (p && is_add)
 416     return VNET_API_ERROR_SYSCALL_ERROR_1; /* already exists */
 417   if (!p && !is_add)
 418     return VNET_API_ERROR_SYSCALL_ERROR_1;
 419
 420   if (!is_add) /* delete */
 421     {
 422       sa_index = p[0];
 423       sa = pool_elt_at_index(im->sad, sa_index);
 424       if (ipsec_is_sa_used(sa_index))
 425         {
 426           clib_warning("sa_id %u used in policy", sa->id);
 427           return VNET_API_ERROR_SYSCALL_ERROR_1; /* sa used in policy */
 428         }
 429       hash_unset (im->sa_index_by_sa_id, sa->id);
 430       pool_put (im->sad, sa);
 431     }
 432   else /* create new SA */
 433     {
 434       pool_get (im->sad, sa);
 435       memcpy (sa, new_sa, sizeof (*sa));
 436       sa_index = sa - im->sad;
 437       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
 438     }
 439   return 0;
 440 }
 441
 442 int
 443 ipsec_set_sa_key(vlib_main_t * vm, ipsec_sa_t * sa_update)
 444 {
 445   ipsec_main_t *im = &ipsec_main;
 446   uword *p;
 447   u32 sa_index;
 448   ipsec_sa_t * sa = 0;
 449
 450   p = hash_get (im->sa_index_by_sa_id, sa_update->id);
 451   if (!p)
 452     return VNET_API_ERROR_SYSCALL_ERROR_1; /* no such sa-id */
 453
 454   sa_index = p[0];
 455   sa = pool_elt_at_index(im->sad, sa_index);
 456
 457   /* new crypto key */
 458   if (0 < sa_update->crypto_key_len)
 459     {
 460       memcpy(sa->crypto_key, sa_update->crypto_key, sa_update->crypto_key_len);
 461       sa->crypto_key_len = sa_update->crypto_key_len;
 462     }
 463
 464   /* new integ key */
 465   if (0 < sa_update->integ_key_len)
 466     {
 467       memcpy(sa->integ_key, sa_update->integ_key, sa_update->integ_key_len);
 468       sa->integ_key_len = sa_update->integ_key_len;
 469     }
 470
 471   return 0;
 472 }
 473
 474 static void
 475 ipsec_rand_seed(void)
 476 {
 477   struct {
 478     time_t time;
 479     pid_t pid;
 480     void * p;
 481   } seed_data;
 482
 483   seed_data.time = time(NULL);
 484   seed_data.pid = getpid();
 485   seed_data.p = (void *)&seed_data;
 486
 487   RAND_seed((const void *)&seed_data, sizeof(seed_data));
 488 }
 489
 490 static clib_error_t *
 491 ipsec_init (vlib_main_t * vm)
 492 {
 493   clib_error_t * error;
 494   ipsec_main_t * im = &ipsec_main;
 495   vlib_node_t * node;
 496
 497   ipsec_rand_seed();
 498
 499   memset (im, 0, sizeof (im[0]));
 500
 501   im->vnet_main = vnet_get_main();
 502   im->vlib_main = vm;
 503
 504   im->spd_index_by_spd_id      = hash_create (0, sizeof (uword));
 505   im->sa_index_by_sa_id        = hash_create (0, sizeof (uword));
 506   im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
 507
 508   node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
 509   ASSERT(node);
 510   im->error_drop_node_index = node->index;
 511
 512   node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
 513   ASSERT(node);
 514   im->esp_encrypt_node_index = node->index;
 515
 516   node = vlib_get_node_by_name (vm, (u8 *) "ip4-lookup");
 517   ASSERT(node);
 518   im->ip4_lookup_node_index = node->index;
 519
 520
 521   if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
 522     return error;
 523
 524   if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
 525     return error;
 526
 527   esp_init();
 528
 529   if ((error = ikev2_init (vm)))
 530     return error;
 531
 532   return 0;
 533 }
 534
 535 VLIB_INIT_FUNCTION (ipsec_init);