vnet/vnet/ipsec/ipsec_if.c

   1 /*
   2  * ipsec_if.c : IPSec interface support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21
  22 #include <vnet/ipsec/ipsec.h>
  23
  24 static u8 * format_ipsec_name (u8 * s, va_list * args)
  25 {
  26   u32 dev_instance = va_arg (*args, u32);
  27   return format (s, "ipsec%d", dev_instance);
  28 }
  29
  30 static uword dummy_interface_tx (vlib_main_t * vm,
  31                                  vlib_node_runtime_t * node,
  32                                  vlib_frame_t * frame)
  33 {
  34   clib_warning ("you shouldn't be here, leaking buffers...");
  35   return frame->n_vectors;
  36 }
  37
  38 VNET_DEVICE_CLASS (ipsec_device_class,static) = {
  39   .name = "IPSec",
  40   .format_device_name = format_ipsec_name,
  41   .format_tx_trace = format_ipsec_if_output_trace,
  42   .tx_function = dummy_interface_tx,
  43 };
  44
  45 VNET_HW_INTERFACE_CLASS (ipsec_hw_class) = {
  46   .name = "IPSec",
  47 };
  48
  49 u32
  50 ipsec_add_del_tunnel_if (vnet_main_t * vnm, ipsec_add_del_tunnel_args_t * args)
  51 {
  52   ipsec_tunnel_if_t * t;
  53   ipsec_main_t * im = &ipsec_main;
  54   vnet_hw_interface_t * hi;
  55   u32 hw_if_index = ~0;
  56   uword *p;
  57   ipsec_sa_t * sa;
  58
  59   u64 key = (u64) args->remote_ip.as_u32 << 32 | (u64) args->remote_spi;
  60   p = hash_get (im->ipsec_if_pool_index_by_key, key);
  61
  62   if (args->is_add)
  63     {
  64       /* check if same src/dst pair exists */
  65       if (p)
  66         return VNET_API_ERROR_INVALID_VALUE;
  67
  68       pool_get_aligned (im->tunnel_interfaces, t, CLIB_CACHE_LINE_BYTES);
  69       memset (t, 0, sizeof (*t));
  70
  71       pool_get (im->sad, sa);
  72       memset (sa, 0, sizeof (*sa));
  73       t->input_sa_index = sa - im->sad;
  74       sa->spi = args->remote_spi;
  75       sa->tunnel_src_addr.ip4.as_u32 = args->remote_ip.as_u32;
  76       sa->tunnel_dst_addr.ip4.as_u32 = args->local_ip.as_u32;
  77       sa->is_tunnel = 1;
  78       sa->use_esn = args->esn;
  79       sa->use_anti_replay = args->anti_replay;
  80
  81       pool_get (im->sad, sa);
  82       memset (sa, 0, sizeof (*sa));
  83       t->output_sa_index = sa - im->sad;
  84       sa->spi = args->local_spi;
  85       sa->tunnel_src_addr.ip4.as_u32 = args->local_ip.as_u32;
  86       sa->tunnel_dst_addr.ip4.as_u32 = args->remote_ip.as_u32;
  87       sa->is_tunnel = 1;
  88       sa->seq = 1;
  89       sa->use_esn = args->esn;
  90       sa->use_anti_replay = args->anti_replay;
  91
  92       hash_set (im->ipsec_if_pool_index_by_key, key, t - im->tunnel_interfaces);
  93
  94       if (vec_len (im->free_tunnel_if_indices) > 0)
  95         {
  96           hw_if_index =
  97             im->free_tunnel_if_indices[vec_len(im->free_tunnel_if_indices)-1];
  98           _vec_len (im->free_tunnel_if_indices) -= 1;
  99         }
 100       else
 101         {
 102           hw_if_index = vnet_register_interface(vnm, ipsec_device_class.index,
 103                                                 t - im->tunnel_interfaces,
 104                                                 ipsec_hw_class.index,
 105                                                 t - im->tunnel_interfaces);
 106
 107           hi = vnet_get_hw_interface (vnm, hw_if_index);
 108           hi->output_node_index = ipsec_if_output_node.index;
 109         }
 110       t->hw_if_index = hw_if_index;
 111
 112       /*1st interface, register protocol */
 113       if (pool_elts(im->tunnel_interfaces) == 1)
 114         ip4_register_protocol(IP_PROTOCOL_IPSEC_ESP, ipsec_if_input_node.index);
 115
 116       return hw_if_index;
 117     }
 118   else
 119     {
 120       /* check if exists */
 121       if (!p)
 122         return VNET_API_ERROR_INVALID_VALUE;
 123
 124       t = pool_elt_at_index(im->tunnel_interfaces, p[0]);
 125       hi = vnet_get_hw_interface (vnm, t->hw_if_index);
 126       vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
 127       vec_add1 (im->free_tunnel_if_indices, t->hw_if_index);
 128
 129       /* delete input and output SA */
 130       sa = pool_elt_at_index(im->sad, t->input_sa_index);
 131       pool_put (im->sad, sa);
 132       sa = pool_elt_at_index(im->sad, t->output_sa_index);
 133       pool_put (im->sad, sa);
 134
 135       hash_unset (im->ipsec_if_pool_index_by_key, key);
 136       pool_put (im->tunnel_interfaces, t);
 137     }
 138   return 0;
 139 }
 140
 141 int
 142 ipsec_set_interface_key(vnet_main_t * vnm, u32 hw_if_index,
 143                         ipsec_if_set_key_type_t type, u8 alg, u8 * key)
 144 {
 145   ipsec_main_t * im = &ipsec_main;
 146   vnet_hw_interface_t * hi;
 147   ipsec_tunnel_if_t * t;
 148   ipsec_sa_t * sa;
 149
 150   hi = vnet_get_hw_interface (vnm, hw_if_index);
 151   t = pool_elt_at_index (im->tunnel_interfaces, hi->dev_instance);
 152
 153   if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO)
 154     {
 155       sa = pool_elt_at_index(im->sad, t->output_sa_index);
 156       sa->crypto_alg = alg;
 157       sa->crypto_key_len = vec_len(key);
 158       memcpy(sa->crypto_key, key, vec_len(key));
 159     }
 160   else if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG)
 161     {
 162       sa = pool_elt_at_index(im->sad, t->output_sa_index);
 163       sa->integ_alg = alg;
 164       sa->integ_key_len = vec_len(key);
 165       memcpy(sa->integ_key, key, vec_len(key));
 166     }
 167   else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO)
 168     {
 169       sa = pool_elt_at_index(im->sad, t->input_sa_index);
 170       sa->crypto_alg = alg;
 171       sa->crypto_key_len = vec_len(key);
 172       memcpy(sa->crypto_key, key, vec_len(key));
 173     }
 174   else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG)
 175     {
 176       sa = pool_elt_at_index(im->sad, t->input_sa_index);
 177       sa->integ_alg = alg;
 178       sa->integ_key_len = vec_len(key);
 179       memcpy(sa->integ_key, key, vec_len(key));
 180     }
 181   else
 182     return VNET_API_ERROR_INVALID_VALUE;
 183
 184   return 0;
 185 }
 186
 187
 188 clib_error_t *
 189 ipsec_tunnel_if_init (vlib_main_t * vm)
 190 {
 191   ipsec_main_t * im = &ipsec_main;
 192
 193   im->ipsec_if_pool_index_by_key = hash_create (0, sizeof (uword));
 194
 195   return 0;
 196 }
 197
 198 VLIB_INIT_FUNCTION (ipsec_tunnel_if_init);
 199