plugins/sixrd-plugin/sixrd/ip4_sixrd.c

   1 /*---------------------------------------------------------------------------
   2  * Copyright (c) 2009-2014 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  *---------------------------------------------------------------------------
  15  */
  16 #include "sixrd.h"
  17
  18 static vlib_node_registration_t ip4_sixrd_node;
  19
  20 typedef enum {
  21   IP4_SIXRD_NEXT_IP6_LOOKUP,
  22   IP4_SIXRD_NEXT_DROP,
  23   IP4_SIXRD_N_NEXT,
  24 } ip4_sixrd_next_t;
  25
  26 /*
  27  * ip4_sixrd_sec_check
  28  */
  29 static_always_inline void
  30 ip4_sixrd_sec_check (sixrd_domain_t *d, ip4_address_t sa4, ip6_address_t sa6, u8 *error)
  31 {
  32   u32 a = sixrd_get_addr(d, sa6.as_u64[0]);
  33   clib_warning("Security check: %U %U", format_ip4_address, &a, format_ip4_address, &sa4);
  34   if (PREDICT_FALSE(sixrd_get_addr(d, sa6.as_u64[0]) != sa4.as_u32))
  35     *error = SIXRD_ERROR_SEC_CHECK;
  36 }
  37
  38 /*
  39  * ip4_sixrd
  40  */
  41 static uword
  42 ip4_sixrd (vlib_main_t *vm,
  43            vlib_node_runtime_t *node,
  44            vlib_frame_t *frame)
  45 {
  46   u32 n_left_from, *from, next_index, *to_next, n_left_to_next;
  47   vlib_node_runtime_t *error_node = vlib_node_get_runtime(vm, ip4_sixrd_node.index);
  48   u32 decap = 0;
  49
  50   from = vlib_frame_vector_args(frame);
  51   n_left_from = frame->n_vectors;
  52   next_index = node->cached_next_index;
  53   while (n_left_from > 0) {
  54     vlib_get_next_frame(vm, node, next_index, to_next, n_left_to_next);
  55
  56     /* Single loop */
  57     while (n_left_from > 0 && n_left_to_next > 0) {
  58       u32 pi0;
  59       vlib_buffer_t *p0;
  60       u8 error0 = SIXRD_ERROR_NONE;
  61       sixrd_domain_t *d0 = 0;
  62       ip4_header_t *ip40;
  63       ip6_header_t *ip60;
  64       u32 sixrd_domain_index0 = ~0;
  65       u32 next0;
  66
  67       pi0 = to_next[0] = from[0];
  68       from += 1;
  69       n_left_from -= 1;
  70       to_next +=1;
  71       n_left_to_next -= 1;
  72
  73       p0 = vlib_get_buffer(vm, pi0);
  74       ip40 = vlib_buffer_get_current(p0);
  75
  76       /* Throw away anything that isn't IP in IP. */
  77       if (PREDICT_TRUE(ip40->protocol == IP_PROTOCOL_IPV6 && clib_net_to_host_u16(ip40->length) >= 60)) {
  78         vlib_buffer_advance(p0, sizeof(ip4_header_t));
  79         ip60 = vlib_buffer_get_current(p0);
  80         d0 = ip4_sixrd_get_domain(vnet_buffer(p0)->ip.adj_index[VLIB_TX], (ip6_address_t *)&ip60->src_address,
  81                                 &sixrd_domain_index0, &error0);
  82       } else {
  83         error0 = SIXRD_ERROR_BAD_PROTOCOL;
  84       }
  85       if (d0) {
  86         /* SIXRD inbound security check */
  87         ip4_sixrd_sec_check(d0, ip40->src_address, ip60->src_address, &error0);
  88       }
  89
  90       next0 = error0 == SIXRD_ERROR_NONE ? IP4_SIXRD_NEXT_IP6_LOOKUP : IP4_SIXRD_NEXT_DROP;
  91
  92       if (PREDICT_FALSE(p0->flags & VLIB_BUFFER_IS_TRACED)) {
  93         sixrd_trace_t *tr = vlib_add_trace(vm, node, p0, sizeof(*tr));
  94         tr->sixrd_domain_index = sixrd_domain_index0;
  95       }
  96
  97       p0->error = error_node->errors[error0];
  98       if (PREDICT_TRUE(error0 == SIXRD_ERROR_NONE)) decap++;
  99       vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, pi0, next0);
 100
 101     }
 102     vlib_put_next_frame(vm, node, next_index, n_left_to_next);
 103   }
 104   vlib_node_increment_counter(vm, ip4_sixrd_node.index, SIXRD_ERROR_DECAPSULATED, decap);
 105
 106   return frame->n_vectors;
 107 }
 108
 109 static char *sixrd_error_strings[] = {
 110 #define _(sym,string) string,
 111   foreach_sixrd_error
 112 #undef _
 113 };
 114
 115 VLIB_REGISTER_NODE(ip4_sixrd_node,static) = {
 116   .function = ip4_sixrd,
 117   .name = "ip4-sixrd",
 118   .vector_size = sizeof(u32),
 119   .format_trace = format_sixrd_trace,
 120   .n_errors = SIXRD_N_ERROR,
 121   .error_strings = sixrd_error_strings,
 122   .n_next_nodes = IP4_SIXRD_N_NEXT,
 123   .next_nodes = {
 124     [IP4_SIXRD_NEXT_IP6_LOOKUP] = "ip6-lookup",
 125     [IP4_SIXRD_NEXT_DROP] = "error-drop",
 126   },
 127 };