src/vnet/ipsec/ipsec.c

   1 /*
   2  * decap.c : IPSec tunnel support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21 #include <vnet/interface.h>
  22
  23 #include <vnet/ipsec/ipsec.h>
  24 #include <vnet/ipsec/ikev2.h>
  25 #include <vnet/ipsec/esp.h>
  26
  27 u32
  28 ipsec_get_sa_index_by_sa_id (u32 sa_id)
  29 {
  30   ipsec_main_t *im = &ipsec_main;
  31   uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
  32   if (!p)
  33     return ~0;
  34
  35   return p[0];
  36 }
  37
  38 int
  39 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
  40                          int is_add)
  41 {
  42   ipsec_main_t *im = &ipsec_main;
  43   ip4_ipsec_config_t config;
  44
  45   u32 spd_index;
  46   uword *p;
  47
  48   p = hash_get (im->spd_index_by_spd_id, spd_id);
  49   if (!p)
  50     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such spd-id */
  51
  52   spd_index = p[0];
  53
  54   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
  55   if (p && is_add)
  56     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* spd already assigned */
  57
  58   if (is_add)
  59     {
  60       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
  61     }
  62   else
  63     {
  64       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
  65     }
  66
  67   clib_warning ("sw_if_index %u spd_id %u spd_index %u",
  68                 sw_if_index, spd_id, spd_index);
  69
  70   /* enable IPsec on TX */
  71   vnet_feature_enable_disable ("ip4-output", "ipsec-output-ip4", sw_if_index,
  72                                is_add, 0, 0);
  73   vnet_feature_enable_disable ("ip6-output", "ipsec-output-ip6", sw_if_index,
  74                                is_add, 0, 0);
  75
  76   /* enable IPsec on RX */
  77   vnet_feature_enable_disable ("ip4-unicast", "ipsec-input-ip4", sw_if_index,
  78                                is_add, &config, sizeof (config));
  79   vnet_feature_enable_disable ("ip6-unicast", "ipsec-input-ip6", sw_if_index,
  80                                is_add, &config, sizeof (config));
  81
  82   return 0;
  83 }
  84
  85 int
  86 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
  87 {
  88   ipsec_main_t *im = &ipsec_main;
  89   ipsec_spd_t *spd = 0;
  90   uword *p;
  91   u32 spd_index, k, v;
  92
  93   p = hash_get (im->spd_index_by_spd_id, spd_id);
  94   if (p && is_add)
  95     return VNET_API_ERROR_INVALID_VALUE;
  96   if (!p && !is_add)
  97     return VNET_API_ERROR_INVALID_VALUE;
  98
  99   if (!is_add)                  /* delete */
 100     {
 101       spd_index = p[0];
 102       spd = pool_elt_at_index (im->spds, spd_index);
 103       if (!spd)
 104         return VNET_API_ERROR_INVALID_VALUE;
 105       /* *INDENT-OFF* */
 106       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
 107         if (v == spd_index)
 108           ipsec_set_interface_spd(vm, k, spd_id, 0);
 109       }));
 110       /* *INDENT-ON* */
 111       hash_unset (im->spd_index_by_spd_id, spd_id);
 112       pool_free (spd->policies);
 113       vec_free (spd->ipv4_outbound_policies);
 114       vec_free (spd->ipv6_outbound_policies);
 115       vec_free (spd->ipv4_inbound_protect_policy_indices);
 116       vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
 117       pool_put (im->spds, spd);
 118     }
 119   else                          /* create new SPD */
 120     {
 121       pool_get (im->spds, spd);
 122       memset (spd, 0, sizeof (*spd));
 123       spd_index = spd - im->spds;
 124       spd->id = spd_id;
 125       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 126     }
 127   return 0;
 128 }
 129
 130 static int
 131 ipsec_spd_entry_sort (void *a1, void *a2)
 132 {
 133   ipsec_main_t *im = &ipsec_main;
 134   u32 *id1 = a1;
 135   u32 *id2 = a2;
 136   ipsec_spd_t *spd;
 137   ipsec_policy_t *p1, *p2;
 138
 139   /* *INDENT-OFF* */
 140   pool_foreach (spd, im->spds, ({
 141     p1 = pool_elt_at_index(spd->policies, *id1);
 142     p2 = pool_elt_at_index(spd->policies, *id2);
 143     if (p1 && p2)
 144       return p2->priority - p1->priority;
 145   }));
 146   /* *INDENT-ON* */
 147
 148   return 0;
 149 }
 150
 151 int
 152 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
 153 {
 154   ipsec_main_t *im = &ipsec_main;
 155   ipsec_spd_t *spd = 0;
 156   ipsec_policy_t *vp;
 157   uword *p;
 158   u32 spd_index;
 159
 160   clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
 161                 policy->priority, policy->is_outbound);
 162
 163   if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 164     {
 165       p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
 166       if (!p)
 167         return VNET_API_ERROR_SYSCALL_ERROR_1;
 168       policy->sa_index = p[0];
 169     }
 170
 171   p = hash_get (im->spd_index_by_spd_id, policy->id);
 172
 173   if (!p)
 174     return VNET_API_ERROR_SYSCALL_ERROR_1;
 175
 176   spd_index = p[0];
 177   spd = pool_elt_at_index (im->spds, spd_index);
 178   if (!spd)
 179     return VNET_API_ERROR_SYSCALL_ERROR_1;
 180
 181   if (is_add)
 182     {
 183       u32 policy_index;
 184
 185       pool_get (spd->policies, vp);
 186       clib_memcpy (vp, policy, sizeof (*vp));
 187       policy_index = vp - spd->policies;
 188
 189       if (policy->is_outbound)
 190         {
 191           if (policy->is_ipv6)
 192             {
 193               vec_add1 (spd->ipv6_outbound_policies, policy_index);
 194               clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 195               vec_sort_with_function (spd->ipv6_outbound_policies,
 196                                       ipsec_spd_entry_sort);
 197             }
 198           else
 199             {
 200               vec_add1 (spd->ipv4_outbound_policies, policy_index);
 201               clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 202               vec_sort_with_function (spd->ipv4_outbound_policies,
 203                                       ipsec_spd_entry_sort);
 204             }
 205         }
 206       else
 207         {
 208           if (policy->is_ipv6)
 209             {
 210               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 211                 {
 212                   vec_add1 (spd->ipv6_inbound_protect_policy_indices,
 213                             policy_index);
 214                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 215                   vec_sort_with_function
 216                     (spd->ipv6_inbound_protect_policy_indices,
 217                      ipsec_spd_entry_sort);
 218                 }
 219               else
 220                 {
 221                   vec_add1
 222                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 223                      policy_index);
 224                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 225                   vec_sort_with_function
 226                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 227                      ipsec_spd_entry_sort);
 228                 }
 229             }
 230           else
 231             {
 232               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 233                 {
 234                   vec_add1 (spd->ipv4_inbound_protect_policy_indices,
 235                             policy_index);
 236                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 237                   vec_sort_with_function
 238                     (spd->ipv4_inbound_protect_policy_indices,
 239                      ipsec_spd_entry_sort);
 240                 }
 241               else
 242                 {
 243                   vec_add1
 244                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 245                      policy_index);
 246                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 247                   vec_sort_with_function
 248                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 249                      ipsec_spd_entry_sort);
 250                 }
 251             }
 252         }
 253
 254     }
 255   else
 256     {
 257       u32 i, j;
 258       /* *INDENT-OFF* */
 259       pool_foreach_index(i, spd->policies, ({
 260         vp = pool_elt_at_index(spd->policies, i);
 261         if (vp->priority != policy->priority)
 262           continue;
 263         if (vp->is_outbound != policy->is_outbound)
 264           continue;
 265         if (vp->policy != policy->policy)
 266           continue;
 267         if (vp->sa_id != policy->sa_id)
 268           continue;
 269         if (vp->protocol != policy->protocol)
 270           continue;
 271         if (vp->lport.start != policy->lport.start)
 272           continue;
 273         if (vp->lport.stop != policy->lport.stop)
 274           continue;
 275         if (vp->rport.start != policy->rport.start)
 276           continue;
 277         if (vp->rport.stop != policy->rport.stop)
 278           continue;
 279         if (vp->is_ipv6 != policy->is_ipv6)
 280           continue;
 281         if (policy->is_ipv6)
 282           {
 283             if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
 284               continue;
 285             if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
 286               continue;
 287             if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
 288               continue;
 289             if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 290               continue;
 291             if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
 292               continue;
 293             if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
 294               continue;
 295             if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
 296               continue;
 297            if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 298               continue;
 299            if (policy->is_outbound)
 300              {
 301                vec_foreach_index(j, spd->ipv6_outbound_policies) {
 302                  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
 303                    vec_del1 (spd->ipv6_outbound_policies, j);
 304                    break;
 305                  }
 306                }
 307              }
 308            else
 309              {
 310                if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 311                  {
 312                    vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
 313                      if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
 314                        vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
 315                        break;
 316                      }
 317                    }
 318                  }
 319                else
 320                  {
 321                    vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
 322                      if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
 323                        vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
 324                        break;
 325                      }
 326                    }
 327                  }
 328              }
 329           }
 330         else
 331           {
 332             if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
 333               continue;
 334             if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
 335               continue;
 336             if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
 337               continue;
 338             if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
 339               continue;
 340             if (policy->is_outbound)
 341               {
 342                 vec_foreach_index(j, spd->ipv4_outbound_policies) {
 343                   if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
 344                     vec_del1 (spd->ipv4_outbound_policies, j);
 345                     break;
 346                   }
 347                 }
 348               }
 349             else
 350               {
 351                 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 352                   {
 353                     vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
 354                       if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
 355                         vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
 356                         break;
 357                       }
 358                     }
 359                   }
 360                 else
 361                   {
 362                     vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
 363                       if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
 364                         vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
 365                         break;
 366                     }
 367                   }
 368               }
 369           }
 370           pool_put (spd->policies, vp);
 371           break;
 372         }
 373       }));
 374       /* *INDENT-ON* */
 375     }
 376
 377   return 0;
 378 }
 379
 380 static u8
 381 ipsec_is_sa_used (u32 sa_index)
 382 {
 383   ipsec_main_t *im = &ipsec_main;
 384   ipsec_spd_t *spd;
 385   ipsec_policy_t *p;
 386   ipsec_tunnel_if_t *t;
 387
 388   /* *INDENT-OFF* */
 389   pool_foreach(spd, im->spds, ({
 390     pool_foreach(p, spd->policies, ({
 391       if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
 392         {
 393           if (p->sa_index == sa_index)
 394             return 1;
 395         }
 396     }));
 397   }));
 398
 399   pool_foreach(t, im->tunnel_interfaces, ({
 400     if (t->input_sa_index == sa_index)
 401       return 1;
 402     if (t->output_sa_index == sa_index)
 403       return 1;
 404   }));
 405   /* *INDENT-ON* */
 406
 407   return 0;
 408 }
 409
 410 int
 411 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
 412 {
 413   ipsec_main_t *im = &ipsec_main;
 414   ipsec_sa_t *sa = 0;
 415   uword *p;
 416   u32 sa_index;
 417   clib_error_t *err;
 418
 419   clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
 420
 421   p = hash_get (im->sa_index_by_sa_id, new_sa->id);
 422   if (p && is_add)
 423     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* already exists */
 424   if (!p && !is_add)
 425     return VNET_API_ERROR_SYSCALL_ERROR_1;
 426
 427   if (!is_add)                  /* delete */
 428     {
 429       sa_index = p[0];
 430       sa = pool_elt_at_index (im->sad, sa_index);
 431       if (ipsec_is_sa_used (sa_index))
 432         {
 433           clib_warning ("sa_id %u used in policy", sa->id);
 434           return VNET_API_ERROR_SYSCALL_ERROR_1;        /* sa used in policy */
 435         }
 436       hash_unset (im->sa_index_by_sa_id, sa->id);
 437       if (im->cb.add_del_sa_sess_cb)
 438         {
 439           err = im->cb.add_del_sa_sess_cb (sa_index, 0);
 440           if (err)
 441             return VNET_API_ERROR_SYSCALL_ERROR_1;
 442         }
 443       pool_put (im->sad, sa);
 444     }
 445   else                          /* create new SA */
 446     {
 447       pool_get (im->sad, sa);
 448       clib_memcpy (sa, new_sa, sizeof (*sa));
 449       sa_index = sa - im->sad;
 450       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
 451       if (im->cb.add_del_sa_sess_cb)
 452         {
 453           err = im->cb.add_del_sa_sess_cb (sa_index, 1);
 454           if (err)
 455             return VNET_API_ERROR_SYSCALL_ERROR_1;
 456         }
 457     }
 458   return 0;
 459 }
 460
 461 int
 462 ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
 463 {
 464   ipsec_main_t *im = &ipsec_main;
 465   uword *p;
 466   u32 sa_index;
 467   ipsec_sa_t *sa = 0;
 468   clib_error_t *err;
 469
 470   p = hash_get (im->sa_index_by_sa_id, sa_update->id);
 471   if (!p)
 472     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such sa-id */
 473
 474   sa_index = p[0];
 475   sa = pool_elt_at_index (im->sad, sa_index);
 476
 477   /* new crypto key */
 478   if (0 < sa_update->crypto_key_len)
 479     {
 480       clib_memcpy (sa->crypto_key, sa_update->crypto_key,
 481                    sa_update->crypto_key_len);
 482       sa->crypto_key_len = sa_update->crypto_key_len;
 483     }
 484
 485   /* new integ key */
 486   if (0 < sa_update->integ_key_len)
 487     {
 488       clib_memcpy (sa->integ_key, sa_update->integ_key,
 489                    sa_update->integ_key_len);
 490       sa->integ_key_len = sa_update->integ_key_len;
 491     }
 492
 493   if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
 494     {
 495       if (im->cb.add_del_sa_sess_cb)
 496         {
 497           err = im->cb.add_del_sa_sess_cb (sa_index, 0);
 498           if (err)
 499             return VNET_API_ERROR_SYSCALL_ERROR_1;
 500         }
 501     }
 502
 503   return 0;
 504 }
 505
 506 static void
 507 ipsec_rand_seed (void)
 508 {
 509   struct
 510   {
 511     time_t time;
 512     pid_t pid;
 513     void *p;
 514   } seed_data;
 515
 516   seed_data.time = time (NULL);
 517   seed_data.pid = getpid ();
 518   seed_data.p = (void *) &seed_data;
 519
 520   RAND_seed ((const void *) &seed_data, sizeof (seed_data));
 521 }
 522
 523 static clib_error_t *
 524 ipsec_check_support (ipsec_sa_t * sa)
 525 {
 526   if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
 527     return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
 528   if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
 529     return clib_error_return (0, "unsupported none integ-alg");
 530
 531   return 0;
 532 }
 533
 534 static clib_error_t *
 535 ipsec_init (vlib_main_t * vm)
 536 {
 537   clib_error_t *error;
 538   ipsec_main_t *im = &ipsec_main;
 539   vlib_thread_main_t *tm = vlib_get_thread_main ();
 540   vlib_node_t *node;
 541
 542   ipsec_rand_seed ();
 543
 544   memset (im, 0, sizeof (im[0]));
 545
 546   im->vnet_main = vnet_get_main ();
 547   im->vlib_main = vm;
 548
 549   im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
 550   im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
 551   im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
 552
 553   vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1,
 554                         CLIB_CACHE_LINE_BYTES);
 555
 556   node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
 557   ASSERT (node);
 558   im->error_drop_node_index = node->index;
 559
 560   node = vlib_get_node_by_name (vm, (u8 *) "esp-encrypt");
 561   ASSERT (node);
 562   im->esp_encrypt_node_index = node->index;
 563
 564   node = vlib_get_node_by_name (vm, (u8 *) "esp-decrypt");
 565   ASSERT (node);
 566   im->esp_decrypt_node_index = node->index;
 567
 568   im->esp_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP_ENCRYPT;
 569   im->esp_decrypt_next_index = IPSEC_INPUT_NEXT_ESP_DECRYPT;
 570
 571   im->cb.check_support_cb = ipsec_check_support;
 572
 573   if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
 574     return error;
 575
 576   if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
 577     return error;
 578
 579   esp_init ();
 580
 581   if ((error = ikev2_init (vm)))
 582     return error;
 583
 584   return 0;
 585 }
 586
 587 VLIB_INIT_FUNCTION (ipsec_init);
 588
 589 /*
 590  * fd.io coding-style-patch-verification: ON
 591  *
 592  * Local Variables:
 593  * eval: (c-set-style "gnu")
 594  * End:
 595  */