X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fikev2%2Fikev2.c;h=a260bb166174c78d41cbd713222bc6b12beb3d0d;hb=9534696b4;hp=d6988704b49f3a8b241c2e7a6008feab09e7f204;hpb=c41217ab85f8bdd68db717e95eecb5edc58d620b;p=vpp.git diff --git a/src/plugins/ikev2/ikev2.c b/src/plugins/ikev2/ikev2.c index d6988704b49..a260bb16617 100644 --- a/src/plugins/ikev2/ikev2.c +++ b/src/plugins/ikev2/ikev2.c @@ -15,6 +15,7 @@ #include #include +#include #include #include #include @@ -245,19 +246,24 @@ ikev2_sa_free_proposal_vector (ikev2_sa_proposal_t ** v) vec_free (*v); }; +static void +ikev2_sa_free_child_sa (ikev2_child_sa_t * c) +{ + ikev2_sa_free_proposal_vector (&c->r_proposals); + ikev2_sa_free_proposal_vector (&c->i_proposals); + vec_free (c->sk_ai); + vec_free (c->sk_ar); + vec_free (c->sk_ei); + vec_free (c->sk_er); + vec_free (c->tsi); + vec_free (c->tsr); +} + static void ikev2_sa_free_all_child_sa (ikev2_child_sa_t ** childs) { ikev2_child_sa_t *c; - vec_foreach (c, *childs) - { - ikev2_sa_free_proposal_vector (&c->r_proposals); - ikev2_sa_free_proposal_vector (&c->i_proposals); - vec_free (c->sk_ai); - vec_free (c->sk_ar); - vec_free (c->sk_ei); - vec_free (c->sk_er); - } + vec_foreach (c, *childs) ikev2_sa_free_child_sa (c); vec_free (*childs); } @@ -265,13 +271,7 @@ ikev2_sa_free_all_child_sa (ikev2_child_sa_t ** childs) static void ikev2_sa_del_child_sa (ikev2_sa_t * sa, ikev2_child_sa_t * child) { - ikev2_sa_free_proposal_vector (&child->r_proposals); - ikev2_sa_free_proposal_vector (&child->i_proposals); - vec_free (child->sk_ai); - vec_free (child->sk_ar); - vec_free (child->sk_ei); - vec_free (child->sk_er); - + ikev2_sa_free_child_sa (child); vec_del1 (sa->childs, child - sa->childs); } @@ -1308,7 +1308,7 @@ ikev2_sa_match_ts (ikev2_sa_t * sa) { if (ikev2_ts_cmp(p_tsi, ts)) { - tsi = vec_dup(ts); + vec_add1 (tsi, ts[0]); break; } } @@ -1317,7 +1317,7 @@ ikev2_sa_match_ts (ikev2_sa_t * sa) { if (ikev2_ts_cmp(p_tsr, ts)) { - tsr = vec_dup(ts); + vec_add1 (tsr, ts[0]); break; } } @@ -1508,34 +1508,78 @@ ikev2_sa_auth_init (ikev2_sa_t * sa) } static u32 -ikev2_mk_local_sa_id (u32 ti) +ikev2_mk_local_sa_id (u32 sai, u32 ci, u32 ti) { - return (0x80000000 | ti); + return (0x80000000 | (ti << 24) | (sai << 12) | ci); } static u32 -ikev2_mk_remote_sa_id (u32 ti) +ikev2_mk_remote_sa_id (u32 sai, u32 ci, u32 ti) { - return (0xc0000000 | ti); + return (0xc0000000 | (ti << 24) | (sai << 12) | ci); +} + +typedef struct +{ + u32 salt_local; + u32 salt_remote; + u32 local_sa_id; + u32 remote_sa_id; + ipsec_sa_flags_t flags; + u32 local_spi; + u32 remote_spi; + ipsec_crypto_alg_t encr_type; + ipsec_integ_alg_t integ_type; + ip46_address_t local_ip; + ip46_address_t remote_ip; + ipsec_key_t loc_ckey, rem_ckey, loc_ikey, rem_ikey; +} ikev2_add_ipsec_tunnel_args_t; + +static void +ikev2_add_tunnel_from_main (ikev2_add_ipsec_tunnel_args_t * a) +{ + u32 sw_if_index; + int rv; + + rv = ipip_add_tunnel (IPIP_TRANSPORT_IP4, ~0, + &a->local_ip, &a->remote_ip, 0, + IPIP_TUNNEL_FLAG_NONE, IP_DSCP_CS0, &sw_if_index); + + rv |= ipsec_sa_add_and_lock (a->local_sa_id, + a->local_spi, + IPSEC_PROTOCOL_ESP, a->encr_type, + &a->loc_ckey, a->integ_type, &a->loc_ikey, + a->flags, 0, a->salt_local, &a->local_ip, + &a->remote_ip, NULL); + rv |= ipsec_sa_add_and_lock (a->remote_sa_id, a->remote_spi, + IPSEC_PROTOCOL_ESP, a->encr_type, &a->rem_ckey, + a->integ_type, &a->rem_ikey, + (a->flags | IPSEC_SA_FLAG_IS_INBOUND), 0, + a->salt_remote, &a->remote_ip, + &a->local_ip, NULL); + + u32 *sas_in = NULL; + vec_add1 (sas_in, a->remote_sa_id); + rv |= ipsec_tun_protect_update (sw_if_index, a->local_sa_id, sas_in); } static int -ikev2_create_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, - ikev2_child_sa_t * child) +ikev2_create_tunnel_interface (vnet_main_t * vnm, + u32 thread_index, + ikev2_sa_t * sa, + ikev2_child_sa_t * child, u32 sa_index, + u32 child_index) { ikev2_main_t *km = &ikev2_main; + ipsec_crypto_alg_t encr_type; + ipsec_integ_alg_t integ_type; ikev2_profile_t *p = 0; - ipsec_key_t loc_ckey, rem_ckey, loc_ikey, rem_ikey; ikev2_sa_transform_t *tr; ikev2_sa_proposal_t *proposals; - ipsec_sa_flags_t flags = 0; - ipsec_crypto_alg_t encr_type; - ipsec_integ_alg_t integ_type; - u32 local_spi, remote_spi; u8 is_aead = 0; - u32 salt_local = 0, salt_remote = 0; - ip46_address_t local_ip, remote_ip; - int rv; + ikev2_add_ipsec_tunnel_args_t a; + + clib_memset (&a, 0, sizeof (a)); if (!child->r_proposals) { @@ -1545,26 +1589,26 @@ ikev2_create_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, if (sa->is_initiator) { - ip46_address_set_ip4 (&local_ip, &sa->iaddr); - ip46_address_set_ip4 (&remote_ip, &sa->raddr); + ip46_address_set_ip4 (&a.local_ip, &sa->iaddr); + ip46_address_set_ip4 (&a.remote_ip, &sa->raddr); proposals = child->i_proposals; - local_spi = child->r_proposals[0].spi; - remote_spi = child->i_proposals[0].spi; + a.local_spi = child->r_proposals[0].spi; + a.remote_spi = child->i_proposals[0].spi; } else { - ip46_address_set_ip4 (&local_ip, &sa->raddr); - ip46_address_set_ip4 (&remote_ip, &sa->iaddr); + ip46_address_set_ip4 (&a.local_ip, &sa->raddr); + ip46_address_set_ip4 (&a.remote_ip, &sa->iaddr); proposals = child->r_proposals; - local_spi = child->i_proposals[0].spi; - remote_spi = child->r_proposals[0].spi; + a.local_spi = child->i_proposals[0].spi; + a.remote_spi = child->r_proposals[0].spi; } - flags = IPSEC_SA_FLAG_USE_ANTI_REPLAY; + a.flags = IPSEC_SA_FLAG_USE_ANTI_REPLAY; tr = ikev2_sa_get_td_for_type (proposals, IKEV2_TRANSFORM_TYPE_ESN); if (tr && tr->esn_type) - flags |= IPSEC_SA_FLAG_USE_ESN; + a.flags |= IPSEC_SA_FLAG_USE_ESN; tr = ikev2_sa_get_td_for_type (proposals, IKEV2_TRANSFORM_TYPE_ENCR); if (tr) @@ -1620,6 +1664,7 @@ ikev2_create_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, ikev2_set_state (sa, IKEV2_STATE_NO_PROPOSAL_CHOSEN); return 1; } + a.encr_type = encr_type; if (!is_aead) { @@ -1656,30 +1701,31 @@ ikev2_create_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, integ_type = IPSEC_INTEG_ALG_NONE; } + a.integ_type = integ_type; ikev2_calc_child_keys (sa, child); if (sa->is_initiator) { - ipsec_mk_key (&loc_ikey, child->sk_ai, vec_len (child->sk_ai)); - ipsec_mk_key (&rem_ikey, child->sk_ar, vec_len (child->sk_ar)); - ipsec_mk_key (&loc_ckey, child->sk_ei, vec_len (child->sk_ei)); - ipsec_mk_key (&rem_ckey, child->sk_er, vec_len (child->sk_er)); + ipsec_mk_key (&a.loc_ikey, child->sk_ai, vec_len (child->sk_ai)); + ipsec_mk_key (&a.rem_ikey, child->sk_ar, vec_len (child->sk_ar)); + ipsec_mk_key (&a.loc_ckey, child->sk_ei, vec_len (child->sk_ei)); + ipsec_mk_key (&a.rem_ckey, child->sk_er, vec_len (child->sk_er)); if (is_aead) { - salt_remote = child->salt_er; - salt_local = child->salt_ei; + a.salt_remote = child->salt_er; + a.salt_local = child->salt_ei; } } else { - ipsec_mk_key (&loc_ikey, child->sk_ar, vec_len (child->sk_ar)); - ipsec_mk_key (&rem_ikey, child->sk_ai, vec_len (child->sk_ai)); - ipsec_mk_key (&loc_ckey, child->sk_er, vec_len (child->sk_er)); - ipsec_mk_key (&rem_ckey, child->sk_ei, vec_len (child->sk_ei)); + ipsec_mk_key (&a.loc_ikey, child->sk_ar, vec_len (child->sk_ar)); + ipsec_mk_key (&a.rem_ikey, child->sk_ai, vec_len (child->sk_ai)); + ipsec_mk_key (&a.loc_ckey, child->sk_er, vec_len (child->sk_er)); + ipsec_mk_key (&a.rem_ckey, child->sk_ei, vec_len (child->sk_ei)); if (is_aead) { - salt_remote = child->salt_ei; - salt_local = child->salt_er; + a.salt_remote = child->salt_ei; + a.salt_local = child->salt_er; } } @@ -1704,40 +1750,80 @@ ikev2_create_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, } } - rv = ipip_add_tunnel (IPIP_TRANSPORT_IP4, ~0, - &local_ip, &remote_ip, 0, 0, &child->sw_if_index); - - child->local_sa = ikev2_mk_local_sa_id (child->sw_if_index); - child->remote_sa = ikev2_mk_remote_sa_id (child->sw_if_index); - - rv |= ipsec_sa_add_and_lock (child->local_sa, - local_spi, - IPSEC_PROTOCOL_ESP, encr_type, - &loc_ckey, integ_type, &loc_ikey, flags, - 0, salt_local, &local_ip, &remote_ip, NULL); - rv |= ipsec_sa_add_and_lock (child->remote_sa, - remote_spi, - IPSEC_PROTOCOL_ESP, encr_type, - &rem_ckey, integ_type, &rem_ikey, - (flags | IPSEC_SA_FLAG_IS_INBOUND), - 0, salt_remote, &remote_ip, &local_ip, NULL); + if (thread_index & 0xffffffc0) + clib_warning ("error: thread index exceeds max range 0x3f!"); - u32 *sas_in = NULL; - vec_add1 (sas_in, child->remote_sa); - rv |= - ipsec_tun_protect_update (child->sw_if_index, child->local_sa, sas_in); + if (child_index & 0xfffff000 || sa_index & 0xfffff000) + clib_warning ("error: sa/child index exceeds max range 0xfff!"); + child->local_sa_id = + a.local_sa_id = + ikev2_mk_local_sa_id (sa_index, child_index, thread_index); + child->remote_sa_id = + a.remote_sa_id = + ikev2_mk_remote_sa_id (sa_index, child_index, thread_index); + + vl_api_rpc_call_main_thread (ikev2_add_tunnel_from_main, + (u8 *) & a, sizeof (a)); return 0; } +typedef struct +{ + ip46_address_t local_ip; + ip46_address_t remote_ip; + u32 remote_sa_id; + u32 local_sa_id; +} ikev2_del_ipsec_tunnel_args_t; + +static void +ikev2_del_tunnel_from_main (ikev2_del_ipsec_tunnel_args_t * a) +{ + /* *INDENT-OFF* */ + ipip_tunnel_key_t key = { + .src = a->local_ip, + .dst = a->remote_ip, + .transport = IPIP_TRANSPORT_IP4, + .fib_index = 0, + }; + ipip_tunnel_t *ipip; + /* *INDENT-ON* */ + + ipip = ipip_tunnel_db_find (&key); + + if (ipip) + { + ipsec_tun_protect_del (ipip->sw_if_index); + ipsec_sa_unlock_id (a->remote_sa_id); + ipsec_sa_unlock_id (a->local_sa_id); + ipip_del_tunnel (ipip->sw_if_index); + } +} + static int ikev2_delete_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, ikev2_child_sa_t * child) { - ipsec_tun_protect_del (child->sw_if_index); - ipsec_sa_unlock_id (child->remote_sa); - ipsec_sa_unlock_id (child->local_sa); - ipip_del_tunnel (child->sw_if_index); + ikev2_del_ipsec_tunnel_args_t a; + + clib_memset (&a, 0, sizeof (a)); + + if (sa->is_initiator) + { + ip46_address_set_ip4 (&a.local_ip, &sa->iaddr); + ip46_address_set_ip4 (&a.remote_ip, &sa->raddr); + } + else + { + ip46_address_set_ip4 (&a.local_ip, &sa->raddr); + ip46_address_set_ip4 (&a.remote_ip, &sa->iaddr); + } + + a.remote_sa_id = child->remote_sa_id; + a.local_sa_id = child->local_sa_id; + + vl_api_rpc_call_main_thread (ikev2_del_tunnel_from_main, (u8 *) & a, + sizeof (a)); return 0; } @@ -2326,8 +2412,10 @@ ikev2_node_fn (vlib_main_t * vm, ikev2_initial_contact_cleanup (sa0); ikev2_sa_match_ts (sa0); if (sa0->state != IKEV2_STATE_TS_UNACCEPTABLE) - ikev2_create_tunnel_interface (km->vnet_main, sa0, - &sa0->childs[0]); + ikev2_create_tunnel_interface (km->vnet_main, + thread_index, sa0, + &sa0->childs[0], + p[0], 0); } if (sa0->is_initiator) @@ -2453,8 +2541,10 @@ ikev2_node_fn (vlib_main_t * vm, child->i_proposals = sa0->rekey[0].i_proposal; child->tsi = sa0->rekey[0].tsi; child->tsr = sa0->rekey[0].tsr; - ikev2_create_tunnel_interface (km->vnet_main, sa0, - child); + ikev2_create_tunnel_interface (km->vnet_main, + thread_index, sa0, + child, p[0], + child - sa0->childs); } if (sa0->is_initiator) {