X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_if.c;h=8e4f3f1359db76dfd2e352d1d5ebd72704107606;hb=c87b66c86201458c0475d50c6e93f1497f9eec2e;hp=7d6c725e5397a8f94a349bf6e84dafbef3868811;hpb=1e3aa5e213c23588981ee17d1413a0441a40527a;p=vpp.git diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c index 7d6c725e539..8e4f3f1359d 100644 --- a/src/vnet/ipsec/ipsec_if.c +++ b/src/vnet/ipsec/ipsec_if.c @@ -84,7 +84,7 @@ ipsec_if_tunnel_stack (adj_index_t ai) } /** - * @brief Call back when restacking all adjacencies on a GRE interface + * @brief Call back when restacking all adjacencies on a IPSec interface */ static adj_walk_rc_t ipsec_if_adj_walk_cb (adj_index_t ai, void *ctx) @@ -100,7 +100,7 @@ ipsec_if_tunnel_restack (ipsec_tunnel_if_t * it) fib_protocol_t proto; /* - * walk all the adjacencies on th GRE interface and restack them + * walk all the adjacencies on the IPSec interface and restack them */ FOR_EACH_FIB_IP_PROTOCOL (proto) { @@ -230,6 +230,28 @@ ipsec_tun_mk_output_sa_id (u32 ti) return (0xc0000000 | ti); } +static void +ipsec_tunnel_feature_set (ipsec_main_t * im, ipsec_tunnel_if_t * t, u8 enable) +{ + u8 arc; + + arc = vnet_get_feature_arc_index ("ip4-output"); + + vnet_feature_enable_disable_with_index (arc, + im->esp4_encrypt_tun_feature_index, + t->sw_if_index, enable, + &t->output_sa_index, + sizeof (t->output_sa_index)); + + arc = vnet_get_feature_arc_index ("ip6-output"); + + vnet_feature_enable_disable_with_index (arc, + im->esp6_encrypt_tun_feature_index, + t->sw_if_index, enable, + &t->output_sa_index, + sizeof (t->output_sa_index)); +} + int ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, ipsec_add_del_tunnel_args_t * args, @@ -306,13 +328,14 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, &crypto_key, args->integ_alg, &integ_key, - flags, + (flags | IPSEC_SA_FLAG_IS_INBOUND), args->tx_table_id, + args->salt, &args->remote_ip, &args->local_ip, &t->input_sa_index); if (rv) - return VNET_API_ERROR_INVALID_SRC_ADDRESS; + return rv; ipsec_mk_key (&crypto_key, args->local_crypto_key, args->local_crypto_key_len); @@ -328,11 +351,12 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, &integ_key, flags, args->tx_table_id, + args->salt, &args->local_ip, &args->remote_ip, &t->output_sa_index); if (rv) - return VNET_API_ERROR_INVALID_DST_ADDRESS; + return rv; /* copy the key */ if (is_ip6) @@ -352,21 +376,15 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, t->hw_if_index = hw_if_index; t->sw_if_index = hi->sw_if_index; + /* Standard default jumbo MTU. */ + vnet_sw_interface_set_mtu (vnm, t->sw_if_index, 9000); + /* Add the new tunnel to the DB of tunnels per sw_if_index ... */ vec_validate_init_empty (im->ipsec_if_by_sw_if_index, t->sw_if_index, ~0); im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance; - vnet_feature_enable_disable ("ip4-output", - "esp4-encrypt-tun", - t->sw_if_index, 1, - &t->output_sa_index, - sizeof (t->output_sa_index)); - vnet_feature_enable_disable ("ip6-output", - "esp6-encrypt-tun", - t->sw_if_index, 1, - &t->output_sa_index, - sizeof (t->output_sa_index)); + ipsec_tunnel_feature_set (im, t, 1); /*1st interface, register protocol */ if (pool_elts (im->tunnel_interfaces) == 1) @@ -391,16 +409,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, hi = vnet_get_hw_interface (vnm, t->hw_if_index); vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */ - vnet_feature_enable_disable ("ip4-output", - "esp4-encrypt-tun", - hi->sw_if_index, 0, - &t->output_sa_index, - sizeof (t->output_sa_index)); - vnet_feature_enable_disable ("ip6-output", - "esp6-encrypt-tun", - hi->sw_if_index, 0, - &t->output_sa_index, - sizeof (t->output_sa_index)); + ipsec_tunnel_feature_set (im, t, 0); vnet_delete_hw_interface (vnm, t->hw_if_index); if (is_ip6) @@ -424,127 +433,6 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm, return 0; } -int -ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm, - ipsec_add_del_ipsec_gre_tunnel_args_t * args) -{ - ipsec_tunnel_if_t *t = 0; - ipsec_main_t *im = &ipsec_main; - uword *p; - ipsec_sa_t *sa; - ipsec4_tunnel_key_t key; - u32 isa, osa; - - p = hash_get (im->sa_index_by_sa_id, args->local_sa_id); - if (!p) - return VNET_API_ERROR_INVALID_VALUE; - isa = p[0]; - - p = hash_get (im->sa_index_by_sa_id, args->remote_sa_id); - if (!p) - return VNET_API_ERROR_INVALID_VALUE; - osa = p[0]; - sa = pool_elt_at_index (im->sad, p[0]); - - if (ipsec_sa_is_set_IS_TUNNEL (sa)) - { - key.remote_ip = sa->tunnel_dst_addr.ip4.as_u32; - key.spi = clib_host_to_net_u32 (sa->spi); - } - else - { - key.remote_ip = args->remote_ip.as_u32; - key.spi = clib_host_to_net_u32 (sa->spi); - } - - p = hash_get (im->ipsec4_if_pool_index_by_key, key.as_u64); - - if (args->is_add) - { - /* check if same src/dst pair exists */ - if (p) - return VNET_API_ERROR_INVALID_VALUE; - - pool_get_aligned (im->tunnel_interfaces, t, CLIB_CACHE_LINE_BYTES); - clib_memset (t, 0, sizeof (*t)); - - t->input_sa_index = isa; - t->output_sa_index = osa; - t->hw_if_index = ~0; - hash_set (im->ipsec4_if_pool_index_by_key, key.as_u64, - t - im->tunnel_interfaces); - - /*1st interface, register protocol */ - if (pool_elts (im->tunnel_interfaces) == 1) - { - ip4_register_protocol (IP_PROTOCOL_IPSEC_ESP, - ipsec4_if_input_node.index); - /* TBD, GRE IPSec6 - * - ip6_register_protocol (IP_PROTOCOL_IPSEC_ESP, - ipsec6_if_input_node.index); - */ - } - } - else - { - /* check if exists */ - if (!p) - return VNET_API_ERROR_INVALID_VALUE; - - t = pool_elt_at_index (im->tunnel_interfaces, p[0]); - hash_unset (im->ipsec4_if_pool_index_by_key, key.as_u64); - pool_put (im->tunnel_interfaces, t); - } - return 0; -} - -int -ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index, - ipsec_if_set_key_type_t type, u8 alg, u8 * key) -{ - ipsec_main_t *im = &ipsec_main; - vnet_hw_interface_t *hi; - ipsec_tunnel_if_t *t; - ipsec_sa_t *sa; - - hi = vnet_get_hw_interface (vnm, hw_if_index); - t = pool_elt_at_index (im->tunnel_interfaces, hi->dev_instance); - - if (hi->flags & VNET_HW_INTERFACE_FLAG_LINK_UP) - return VNET_API_ERROR_SYSCALL_ERROR_1; - - if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_CRYPTO) - { - sa = pool_elt_at_index (im->sad, t->output_sa_index); - ipsec_sa_set_crypto_alg (sa, alg); - ipsec_mk_key (&sa->crypto_key, key, vec_len (key)); - } - else if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG) - { - sa = pool_elt_at_index (im->sad, t->output_sa_index); - ipsec_sa_set_integ_alg (sa, alg); - ipsec_mk_key (&sa->integ_key, key, vec_len (key)); - } - else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO) - { - sa = pool_elt_at_index (im->sad, t->input_sa_index); - ipsec_sa_set_crypto_alg (sa, alg); - ipsec_mk_key (&sa->crypto_key, key, vec_len (key)); - } - else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG) - { - sa = pool_elt_at_index (im->sad, t->input_sa_index); - ipsec_sa_set_integ_alg (sa, alg); - ipsec_mk_key (&sa->integ_key, key, vec_len (key)); - } - else - return VNET_API_ERROR_INVALID_VALUE; - - return 0; -} - - int ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, u8 is_outbound) @@ -639,7 +527,13 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, return VNET_API_ERROR_INVALID_VALUE; } + /* + * re-enable the feature to get the new SA in + * the workers are stopped so no packets are sent in the clear + */ + ipsec_tunnel_feature_set (im, t, 0); t->output_sa_index = sa_index; + ipsec_tunnel_feature_set (im, t, 1); } /* remove sa_id to sa_index mapping on old SA */ @@ -651,12 +545,11 @@ ipsec_set_interface_sa (vnet_main_t * vnm, u32 hw_if_index, u32 sa_id, clib_warning ("IPsec backend add/del callback returned error"); return VNET_API_ERROR_SYSCALL_ERROR_1; } - pool_put (im->sad, old_sa); + ipsec_sa_del (old_sa->id); return 0; } - clib_error_t * ipsec_tunnel_if_init (vlib_main_t * vm) {