vnet/vnet/ipsec/ipsec_if.c

   1 /*
   2  * ipsec_if.c : IPSec interface support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21
  22 #include <vnet/ipsec/ipsec.h>
  23
  24 void vl_api_rpc_call_main_thread (void *fp, u8 * data, u32 data_length);
  25
  26 static u8 * format_ipsec_name (u8 * s, va_list * args)
  27 {
  28   u32 dev_instance = va_arg (*args, u32);
  29   return format (s, "ipsec%d", dev_instance);
  30 }
  31
  32 static uword dummy_interface_tx (vlib_main_t * vm,
  33                                  vlib_node_runtime_t * node,
  34                                  vlib_frame_t * frame)
  35 {
  36   clib_warning ("you shouldn't be here, leaking buffers...");
  37   return frame->n_vectors;
  38 }
  39
  40 VNET_DEVICE_CLASS (ipsec_device_class,static) = {
  41   .name = "IPSec",
  42   .format_device_name = format_ipsec_name,
  43   .format_tx_trace = format_ipsec_if_output_trace,
  44   .tx_function = dummy_interface_tx,
  45 };
  46
  47 VNET_HW_INTERFACE_CLASS (ipsec_hw_class) = {
  48   .name = "IPSec",
  49 };
  50
  51
  52 static int
  53 ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
  54                                   ipsec_add_del_tunnel_args_t * args);
  55
  56 static int
  57 ipsec_add_del_tunnel_if_rpc_callback (ipsec_add_del_tunnel_args_t *a)
  58 {
  59   vnet_main_t * vnm = vnet_get_main();
  60   ASSERT(os_get_cpu_number() == 0);
  61
  62   return ipsec_add_del_tunnel_if_internal(vnm, a);
  63 }
  64
  65 int
  66 ipsec_add_del_tunnel_if (ipsec_add_del_tunnel_args_t * args)
  67 {
  68   vl_api_rpc_call_main_thread (ipsec_add_del_tunnel_if_rpc_callback,
  69                                (u8 *) args, sizeof(*args));
  70   return 0;
  71 }
  72
  73 int
  74 ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, ipsec_add_del_tunnel_args_t * args)
  75 {
  76   ipsec_tunnel_if_t * t;
  77   ipsec_main_t * im = &ipsec_main;
  78   vnet_hw_interface_t * hi;
  79   u32 hw_if_index = ~0;
  80   uword *p;
  81   ipsec_sa_t * sa;
  82
  83   u64 key = (u64) args->remote_ip.as_u32 << 32 | (u64) args->remote_spi;
  84   p = hash_get (im->ipsec_if_pool_index_by_key, key);
  85
  86   if (args->is_add)
  87     {
  88       /* check if same src/dst pair exists */
  89       if (p)
  90         return VNET_API_ERROR_INVALID_VALUE;
  91
  92       pool_get_aligned (im->tunnel_interfaces, t, CLIB_CACHE_LINE_BYTES);
  93       memset (t, 0, sizeof (*t));
  94
  95       pool_get (im->sad, sa);
  96       memset (sa, 0, sizeof (*sa));
  97       t->input_sa_index = sa - im->sad;
  98       sa->spi = args->remote_spi;
  99       sa->tunnel_src_addr.ip4.as_u32 = args->remote_ip.as_u32;
 100       sa->tunnel_dst_addr.ip4.as_u32 = args->local_ip.as_u32;
 101       sa->is_tunnel = 1;
 102       sa->use_esn = args->esn;
 103       sa->use_anti_replay = args->anti_replay;
 104       sa->integ_alg = args->integ_alg;
 105       if (args->remote_integ_key_len <= sizeof(args->remote_integ_key))
 106         {
 107           sa->integ_key_len = args->remote_integ_key_len;
 108           clib_memcpy(sa->integ_key, args->remote_integ_key, args->remote_integ_key_len);
 109         }
 110       sa->crypto_alg = args->crypto_alg;
 111       if (args->remote_crypto_key_len <= sizeof(args->remote_crypto_key))
 112         {
 113           sa->crypto_key_len = args->remote_crypto_key_len;
 114           clib_memcpy(sa->crypto_key, args->remote_crypto_key, args->remote_crypto_key_len);
 115         }
 116
 117       pool_get (im->sad, sa);
 118       memset (sa, 0, sizeof (*sa));
 119       t->output_sa_index = sa - im->sad;
 120       sa->spi = args->local_spi;
 121       sa->tunnel_src_addr.ip4.as_u32 = args->local_ip.as_u32;
 122       sa->tunnel_dst_addr.ip4.as_u32 = args->remote_ip.as_u32;
 123       sa->is_tunnel = 1;
 124       sa->seq = 1;
 125       sa->use_esn = args->esn;
 126       sa->use_anti_replay = args->anti_replay;
 127       sa->integ_alg = args->integ_alg;
 128       if (args->local_integ_key_len <= sizeof(args->local_integ_key))
 129         {
 130           sa->integ_key_len = args->local_integ_key_len;
 131           clib_memcpy(sa->integ_key, args->local_integ_key, args->local_integ_key_len);
 132         }
 133       sa->crypto_alg = args->crypto_alg;
 134       if (args->local_crypto_key_len <= sizeof(args->local_crypto_key))
 135         {
 136           sa->crypto_key_len = args->local_crypto_key_len;
 137           clib_memcpy(sa->crypto_key, args->local_crypto_key, args->local_crypto_key_len);
 138         }
 139
 140       hash_set (im->ipsec_if_pool_index_by_key, key, t - im->tunnel_interfaces);
 141
 142       if (vec_len (im->free_tunnel_if_indices) > 0)
 143         {
 144           hw_if_index =
 145             im->free_tunnel_if_indices[vec_len(im->free_tunnel_if_indices)-1];
 146           _vec_len (im->free_tunnel_if_indices) -= 1;
 147         }
 148       else
 149         {
 150           hw_if_index = vnet_register_interface(vnm, ipsec_device_class.index,
 151                                                 t - im->tunnel_interfaces,
 152                                                 ipsec_hw_class.index,
 153                                                 t - im->tunnel_interfaces);
 154
 155           hi = vnet_get_hw_interface (vnm, hw_if_index);
 156           hi->output_node_index = ipsec_if_output_node.index;
 157         }
 158       t->hw_if_index = hw_if_index;
 159
 160       /*1st interface, register protocol */
 161       if (pool_elts(im->tunnel_interfaces) == 1)
 162         ip4_register_protocol(IP_PROTOCOL_IPSEC_ESP, ipsec_if_input_node.index);
 163
 164       return hw_if_index;
 165     }
 166   else
 167     {
 168       /* check if exists */
 169       if (!p)
 170         return VNET_API_ERROR_INVALID_VALUE;
 171
 172       t = pool_elt_at_index(im->tunnel_interfaces, p[0]);
 173       hi = vnet_get_hw_interface (vnm, t->hw_if_index);
 174       vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
 175       vec_add1 (im->free_tunnel_if_indices, t->hw_if_index);
 176
 177       /* delete input and output SA */
 178       sa = pool_elt_at_index(im->sad, t->input_sa_index);
 179       pool_put (im->sad, sa);
 180       sa = pool_elt_at_index(im->sad, t->output_sa_index);
 181       pool_put (im->sad, sa);
 182
 183       hash_unset (im->ipsec_if_pool_index_by_key, key);
 184       pool_put (im->tunnel_interfaces, t);
 185     }
 186   return 0;
 187 }
 188
 189 int
 190 ipsec_set_interface_key(vnet_main_t * vnm, u32 hw_if_index,
 191                         ipsec_if_set_key_type_t type, u8 alg, u8 * key)
 192 {
 193   ipsec_main_t * im = &ipsec_main;
 194   vnet_hw_interface_t * hi;
 195   ipsec_tunnel_if_t * t;
 196   ipsec_sa_t * sa;
 197
 198   hi = vnet_get_hw_interface (vnm, hw_if_index);
 199   t = pool_elt_at_index (im->tunnel_interfaces, hi->dev_instance);
 200
 201   if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO)
 202     {
 203       sa = pool_elt_at_index(im->sad, t->output_sa_index);
 204       sa->crypto_alg = alg;
 205       sa->crypto_key_len = vec_len(key);
 206       clib_memcpy(sa->crypto_key, key, vec_len(key));
 207     }
 208   else if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG)
 209     {
 210       sa = pool_elt_at_index(im->sad, t->output_sa_index);
 211       sa->integ_alg = alg;
 212       sa->integ_key_len = vec_len(key);
 213       clib_memcpy(sa->integ_key, key, vec_len(key));
 214     }
 215   else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO)
 216     {
 217       sa = pool_elt_at_index(im->sad, t->input_sa_index);
 218       sa->crypto_alg = alg;
 219       sa->crypto_key_len = vec_len(key);
 220       clib_memcpy(sa->crypto_key, key, vec_len(key));
 221     }
 222   else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG)
 223     {
 224       sa = pool_elt_at_index(im->sad, t->input_sa_index);
 225       sa->integ_alg = alg;
 226       sa->integ_key_len = vec_len(key);
 227       clib_memcpy(sa->integ_key, key, vec_len(key));
 228     }
 229   else
 230     return VNET_API_ERROR_INVALID_VALUE;
 231
 232   return 0;
 233 }
 234
 235
 236 clib_error_t *
 237 ipsec_tunnel_if_init (vlib_main_t * vm)
 238 {
 239   ipsec_main_t * im = &ipsec_main;
 240
 241   im->ipsec_if_pool_index_by_key = hash_create (0, sizeof (uword));
 242
 243   return 0;
 244 }
 245
 246 VLIB_INIT_FUNCTION (ipsec_tunnel_if_init);
 247