2 * ipsec_if.c : IPSec interface support
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
22 #include <vnet/ipsec/ipsec.h>
24 static u8 * format_ipsec_name (u8 * s, va_list * args)
26 u32 dev_instance = va_arg (*args, u32);
27 return format (s, "ipsec%d", dev_instance);
30 static uword dummy_interface_tx (vlib_main_t * vm,
31 vlib_node_runtime_t * node,
34 clib_warning ("you shouldn't be here, leaking buffers...");
35 return frame->n_vectors;
38 VNET_DEVICE_CLASS (ipsec_device_class,static) = {
40 .format_device_name = format_ipsec_name,
41 .format_tx_trace = format_ipsec_if_output_trace,
42 .tx_function = dummy_interface_tx,
45 VNET_HW_INTERFACE_CLASS (ipsec_hw_class) = {
50 ipsec_add_del_tunnel_if (vnet_main_t * vnm, ipsec_add_del_tunnel_args_t * args)
52 ipsec_tunnel_if_t * t;
53 ipsec_main_t * im = &ipsec_main;
54 vnet_hw_interface_t * hi;
59 u64 key = (u64) args->remote_ip.as_u32 << 32 | (u64) args->remote_spi;
60 p = hash_get (im->ipsec_if_pool_index_by_key, key);
64 /* check if same src/dst pair exists */
66 return VNET_API_ERROR_INVALID_VALUE;
68 pool_get_aligned (im->tunnel_interfaces, t, CLIB_CACHE_LINE_BYTES);
69 memset (t, 0, sizeof (*t));
71 pool_get (im->sad, sa);
72 memset (sa, 0, sizeof (*sa));
73 t->input_sa_index = sa - im->sad;
74 sa->spi = args->remote_spi;
75 sa->tunnel_src_addr.ip4.as_u32 = args->remote_ip.as_u32;
76 sa->tunnel_dst_addr.ip4.as_u32 = args->local_ip.as_u32;
78 sa->use_esn = args->esn;
79 sa->use_anti_replay = args->anti_replay;
81 pool_get (im->sad, sa);
82 memset (sa, 0, sizeof (*sa));
83 t->output_sa_index = sa - im->sad;
84 sa->spi = args->local_spi;
85 sa->tunnel_src_addr.ip4.as_u32 = args->local_ip.as_u32;
86 sa->tunnel_dst_addr.ip4.as_u32 = args->remote_ip.as_u32;
89 sa->use_esn = args->esn;
90 sa->use_anti_replay = args->anti_replay;
92 hash_set (im->ipsec_if_pool_index_by_key, key, t - im->tunnel_interfaces);
94 if (vec_len (im->free_tunnel_if_indices) > 0)
97 im->free_tunnel_if_indices[vec_len(im->free_tunnel_if_indices)-1];
98 _vec_len (im->free_tunnel_if_indices) -= 1;
102 hw_if_index = vnet_register_interface(vnm, ipsec_device_class.index,
103 t - im->tunnel_interfaces,
104 ipsec_hw_class.index,
105 t - im->tunnel_interfaces);
107 hi = vnet_get_hw_interface (vnm, hw_if_index);
108 hi->output_node_index = ipsec_if_output_node.index;
110 t->hw_if_index = hw_if_index;
112 /*1st interface, register protocol */
113 if (pool_elts(im->tunnel_interfaces) == 1)
114 ip4_register_protocol(IP_PROTOCOL_IPSEC_ESP, ipsec_if_input_node.index);
120 /* check if exists */
122 return VNET_API_ERROR_INVALID_VALUE;
124 t = pool_elt_at_index(im->tunnel_interfaces, p[0]);
125 hi = vnet_get_hw_interface (vnm, t->hw_if_index);
126 vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
127 vec_add1 (im->free_tunnel_if_indices, t->hw_if_index);
129 /* delete input and output SA */
130 sa = pool_elt_at_index(im->sad, t->input_sa_index);
131 pool_put (im->sad, sa);
132 sa = pool_elt_at_index(im->sad, t->output_sa_index);
133 pool_put (im->sad, sa);
135 hash_unset (im->ipsec_if_pool_index_by_key, key);
136 pool_put (im->tunnel_interfaces, t);
142 ipsec_set_interface_key(vnet_main_t * vnm, u32 hw_if_index,
143 ipsec_if_set_key_type_t type, u8 alg, u8 * key)
145 ipsec_main_t * im = &ipsec_main;
146 vnet_hw_interface_t * hi;
147 ipsec_tunnel_if_t * t;
150 hi = vnet_get_hw_interface (vnm, hw_if_index);
151 t = pool_elt_at_index (im->tunnel_interfaces, hi->dev_instance);
153 if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO)
155 sa = pool_elt_at_index(im->sad, t->output_sa_index);
156 sa->crypto_alg = alg;
157 sa->crypto_key_len = vec_len(key);
158 memcpy(sa->crypto_key, key, vec_len(key));
160 else if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG)
162 sa = pool_elt_at_index(im->sad, t->output_sa_index);
164 sa->integ_key_len = vec_len(key);
165 memcpy(sa->integ_key, key, vec_len(key));
167 else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO)
169 sa = pool_elt_at_index(im->sad, t->input_sa_index);
170 sa->crypto_alg = alg;
171 sa->crypto_key_len = vec_len(key);
172 memcpy(sa->crypto_key, key, vec_len(key));
174 else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG)
176 sa = pool_elt_at_index(im->sad, t->input_sa_index);
178 sa->integ_key_len = vec_len(key);
179 memcpy(sa->integ_key, key, vec_len(key));
182 return VNET_API_ERROR_INVALID_VALUE;
189 ipsec_tunnel_if_init (vlib_main_t * vm)
191 ipsec_main_t * im = &ipsec_main;
193 im->ipsec_if_pool_index_by_key = hash_create (0, sizeof (uword));
198 VLIB_INIT_FUNCTION (ipsec_tunnel_if_init);