src/vnet/ipsec/ipsec_if_in.c

   1 /*
   2  * ipsec_if_in.c : IPSec interface input node
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21
  22 #include <vnet/ipsec/ipsec.h>
  23 #include <vnet/ipsec/esp.h>
  24 #include <vnet/ipsec/ipsec_io.h>
  25
  26 /* Statistics (not really errors) */
  27 #define foreach_ipsec_if_input_error                              \
  28 _(RX, "good packets received")                                    \
  29 _(DISABLED, "ipsec packets received on disabled interface")       \
  30 _(NO_TUNNEL, "no matching tunnel")
  31
  32 static char *ipsec_if_input_error_strings[] = {
  33 #define _(sym,string) string,
  34   foreach_ipsec_if_input_error
  35 #undef _
  36 };
  37
  38 typedef enum
  39 {
  40 #define _(sym,str) IPSEC_IF_INPUT_ERROR_##sym,
  41   foreach_ipsec_if_input_error
  42 #undef _
  43     IPSEC_IF_INPUT_N_ERROR,
  44 } ipsec_if_input_error_t;
  45
  46
  47 typedef struct
  48 {
  49   u32 spi;
  50   u32 seq;
  51 } ipsec_if_input_trace_t;
  52
  53 static u8 *
  54 format_ipsec_if_input_trace (u8 * s, va_list * args)
  55 {
  56   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
  57   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
  58   ipsec_if_input_trace_t *t = va_arg (*args, ipsec_if_input_trace_t *);
  59
  60   s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq);
  61   return s;
  62 }
  63
  64
  65 always_inline uword
  66 ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
  67                        vlib_frame_t * from_frame, int is_ip6)
  68 {
  69   ipsec_main_t *im = &ipsec_main;
  70   vnet_main_t *vnm = im->vnet_main;
  71   vnet_interface_main_t *vim = &vnm->interface_main;
  72
  73   int is_trace = node->flags & VLIB_NODE_FLAG_TRACE;
  74   u32 thread_index = vm->thread_index;
  75
  76   u32 n_left_from, *from;
  77   u16 nexts[VLIB_FRAME_SIZE], *next;
  78   vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
  79
  80   from = vlib_frame_vector_args (from_frame);
  81   n_left_from = from_frame->n_vectors;
  82
  83   vlib_get_buffers (vm, from, bufs, n_left_from);
  84   b = bufs;
  85   next = nexts;
  86
  87   clib_memset_u16 (nexts, im->esp4_decrypt_next_index, n_left_from);
  88
  89   u64 n_bytes = 0, n_packets = 0;
  90   u32 n_disabled = 0, n_no_tunnel = 0;
  91
  92   u32 last_sw_if_index = ~0;
  93   u32 last_tunnel_id = ~0;
  94   ipsec4_tunnel_key_t last_key4;
  95   ipsec6_tunnel_key_t last_key6;
  96
  97   vlib_combined_counter_main_t *rx_counter;
  98   vlib_combined_counter_main_t *drop_counter;
  99
 100   if (is_ip6)
 101     clib_memset (&last_key6, 0xff, sizeof (last_key6));
 102   else
 103     last_key4.as_u64 = ~0;
 104
 105   rx_counter = vim->combined_sw_if_counters + VNET_INTERFACE_COUNTER_RX;
 106   drop_counter = vim->combined_sw_if_counters + VNET_INTERFACE_COUNTER_DROP;
 107
 108   while (n_left_from >= 2)
 109     {
 110       u32 sw_if_index0, sw_if_index1;
 111       ip4_header_t *ip40, *ip41;
 112       ip6_header_t *ip60, *ip61;
 113       esp_header_t *esp0, *esp1;
 114       u32 len0, len1;
 115       u16 buf_adv0, buf_adv1;
 116       u32 tid0, tid1;
 117       ipsec_tunnel_if_t *t0, *t1;
 118       ipsec4_tunnel_key_t key40, key41;
 119       ipsec6_tunnel_key_t key60, key61;
 120
 121       if (n_left_from >= 4)
 122         {
 123           CLIB_PREFETCH (b[2], CLIB_CACHE_LINE_BYTES, STORE);
 124           CLIB_PREFETCH (b[2]->data, CLIB_CACHE_LINE_BYTES, LOAD);
 125           CLIB_PREFETCH (b[3], CLIB_CACHE_LINE_BYTES, STORE);
 126           CLIB_PREFETCH (b[3]->data, CLIB_CACHE_LINE_BYTES, LOAD);
 127         }
 128
 129       ip40 =
 130         (ip4_header_t *) (b[0]->data + vnet_buffer (b[0])->l3_hdr_offset);
 131       ip41 =
 132         (ip4_header_t *) (b[1]->data + vnet_buffer (b[1])->l3_hdr_offset);
 133
 134       if (is_ip6)
 135         {
 136           ip60 = (ip6_header_t *) ip40;
 137           ip61 = (ip6_header_t *) ip41;
 138           esp0 = (esp_header_t *) ((u8 *) ip60 + sizeof (ip6_header_t));
 139           esp1 = (esp_header_t *) ((u8 *) ip61 + sizeof (ip6_header_t));
 140           buf_adv0 = sizeof (ip6_header_t);
 141           buf_adv1 = sizeof (ip6_header_t);
 142         }
 143       else
 144         {
 145           /* NAT UDP port 4500 case, don't advance any more */
 146           if (ip40->protocol == IP_PROTOCOL_UDP)
 147             {
 148               esp0 =
 149                 (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40) +
 150                                   sizeof (udp_header_t));
 151               buf_adv0 = 0;
 152             }
 153           else
 154             {
 155               esp0 = (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40));
 156               buf_adv0 = ip4_header_bytes (ip40);
 157             }
 158           /* NAT UDP port 4500 case, don't advance any more */
 159           if (ip41->protocol == IP_PROTOCOL_UDP)
 160             {
 161               esp1 =
 162                 (esp_header_t *) ((u8 *) ip41 + ip4_header_bytes (ip41) +
 163                                   sizeof (udp_header_t));
 164               buf_adv1 = 0;
 165             }
 166           else
 167             {
 168               esp1 = (esp_header_t *) ((u8 *) ip41 + ip4_header_bytes (ip41));
 169               buf_adv1 = ip4_header_bytes (ip41);
 170             }
 171         }
 172
 173       vlib_buffer_advance (b[0], buf_adv0);
 174       vlib_buffer_advance (b[1], buf_adv1);
 175
 176       len0 = vlib_buffer_length_in_chain (vm, b[0]);
 177       len1 = vlib_buffer_length_in_chain (vm, b[1]);
 178
 179       if (is_ip6)
 180         {
 181           key60.remote_ip = ip60->src_address;
 182           key60.spi = esp0->spi;
 183
 184           if (memcmp (&key60, &last_key6, sizeof (last_key6)) == 0)
 185             {
 186               tid0 = last_tunnel_id;
 187             }
 188           else
 189             {
 190               uword *p =
 191                 hash_get_mem (im->ipsec6_if_pool_index_by_key, &key60);
 192               if (p)
 193                 {
 194                   tid0 = p[0];
 195                   last_tunnel_id = tid0;
 196                   clib_memcpy_fast (&last_key6, &key60, sizeof (key60));
 197                 }
 198               else
 199                 {
 200                   n_no_tunnel++;
 201                   next[0] = IPSEC_INPUT_NEXT_DROP;
 202                   goto pkt1;
 203                 }
 204             }
 205         }
 206       else                      /* !is_ip6 */
 207         {
 208           key40.remote_ip = ip40->src_address.as_u32;
 209           key40.spi = esp0->spi;
 210
 211           if (key40.as_u64 == last_key4.as_u64)
 212             {
 213               tid0 = last_tunnel_id;
 214             }
 215           else
 216             {
 217               uword *p =
 218                 hash_get (im->ipsec4_if_pool_index_by_key, key40.as_u64);
 219               if (p)
 220                 {
 221                   tid0 = p[0];
 222                   last_tunnel_id = tid0;
 223                   last_key4.as_u64 = key40.as_u64;
 224                 }
 225               else
 226                 {
 227                   n_no_tunnel++;
 228                   next[0] = IPSEC_INPUT_NEXT_DROP;
 229                   goto pkt1;
 230                 }
 231             }
 232         }
 233
 234       t0 = pool_elt_at_index (im->tunnel_interfaces, tid0);
 235       vnet_buffer (b[0])->ipsec.sad_index = t0->input_sa_index;
 236
 237       if (PREDICT_TRUE (t0->hw_if_index != ~0))
 238         {
 239           vnet_buffer (b[0])->ipsec.flags = 0;
 240           sw_if_index0 = t0->sw_if_index;
 241           vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0;
 242
 243           if (PREDICT_FALSE (!(t0->flags & VNET_HW_INTERFACE_FLAG_LINK_UP)))
 244             {
 245               vlib_increment_combined_counter
 246                 (drop_counter, thread_index, sw_if_index0, 1, len0);
 247               n_disabled++;
 248               next[0] = IPSEC_INPUT_NEXT_DROP;
 249               goto pkt1;
 250             }
 251
 252           if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index))
 253             {
 254               n_packets++;
 255               n_bytes += len0;
 256             }
 257           else
 258             {
 259               if (n_packets)
 260                 {
 261                   vlib_increment_combined_counter
 262                     (rx_counter, thread_index, last_sw_if_index,
 263                      n_packets, n_bytes);
 264                 }
 265
 266               last_sw_if_index = sw_if_index0;
 267               n_packets = 1;
 268               n_bytes = len0;
 269             }
 270         }
 271       else
 272         {
 273           vnet_buffer (b[0])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
 274         }
 275
 276     pkt1:
 277       if (is_ip6)
 278         {
 279           key61.remote_ip = ip61->src_address;
 280           key61.spi = esp1->spi;
 281
 282           if (memcmp (&key61, &last_key6, sizeof (last_key6)) == 0)
 283             {
 284               tid1 = last_tunnel_id;
 285             }
 286           else
 287             {
 288               uword *p =
 289                 hash_get_mem (im->ipsec6_if_pool_index_by_key, &key61);
 290               if (p)
 291                 {
 292                   tid1 = p[0];
 293                   last_tunnel_id = tid1;
 294                   clib_memcpy_fast (&last_key6, &key61, sizeof (key61));
 295                 }
 296               else
 297                 {
 298                   n_no_tunnel++;
 299                   next[1] = IPSEC_INPUT_NEXT_DROP;
 300                   goto trace1;
 301                 }
 302             }
 303         }
 304       else                      /* !is_ip6 */
 305         {
 306           key41.remote_ip = ip41->src_address.as_u32;
 307           key41.spi = esp1->spi;
 308
 309           if (key41.as_u64 == last_key4.as_u64)
 310             {
 311               tid1 = last_tunnel_id;
 312             }
 313           else
 314             {
 315               uword *p =
 316                 hash_get (im->ipsec4_if_pool_index_by_key, key41.as_u64);
 317               if (p)
 318                 {
 319                   tid1 = p[0];
 320                   last_tunnel_id = tid1;
 321                   last_key4.as_u64 = key41.as_u64;
 322                 }
 323               else
 324                 {
 325                   n_no_tunnel++;
 326                   next[1] = IPSEC_INPUT_NEXT_DROP;
 327                   goto trace1;
 328                 }
 329             }
 330         }
 331
 332       t1 = pool_elt_at_index (im->tunnel_interfaces, tid1);
 333       vnet_buffer (b[1])->ipsec.sad_index = t1->input_sa_index;
 334
 335       if (PREDICT_TRUE (t1->hw_if_index != ~0))
 336         {
 337           vnet_buffer (b[1])->ipsec.flags = 0;
 338           sw_if_index1 = t1->sw_if_index;
 339           vnet_buffer (b[1])->sw_if_index[VLIB_RX] = sw_if_index1;
 340
 341           if (PREDICT_FALSE (!(t1->flags & VNET_HW_INTERFACE_FLAG_LINK_UP)))
 342             {
 343               vlib_increment_combined_counter
 344                 (drop_counter, thread_index, sw_if_index1, 1, len1);
 345               n_disabled++;
 346               next[1] = IPSEC_INPUT_NEXT_DROP;
 347               goto trace1;
 348             }
 349
 350           if (PREDICT_TRUE (sw_if_index1 == last_sw_if_index))
 351             {
 352               n_packets++;
 353               n_bytes += len1;
 354             }
 355           else
 356             {
 357               if (n_packets)
 358                 {
 359                   vlib_increment_combined_counter
 360                     (rx_counter, thread_index, last_sw_if_index,
 361                      n_packets, n_bytes);
 362                 }
 363
 364               last_sw_if_index = sw_if_index1;
 365               n_packets = 1;
 366               n_bytes = len1;
 367             }
 368         }
 369       else
 370         {
 371           vnet_buffer (b[1])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
 372         }
 373
 374     trace1:
 375       if (PREDICT_FALSE (is_trace))
 376         {
 377           if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
 378             {
 379               ipsec_if_input_trace_t *tr =
 380                 vlib_add_trace (vm, node, b[0], sizeof (*tr));
 381               tr->spi = clib_host_to_net_u32 (esp0->spi);
 382               tr->seq = clib_host_to_net_u32 (esp0->seq);
 383             }
 384           if (b[1]->flags & VLIB_BUFFER_IS_TRACED)
 385             {
 386               ipsec_if_input_trace_t *tr =
 387                 vlib_add_trace (vm, node, b[1], sizeof (*tr));
 388               tr->spi = clib_host_to_net_u32 (esp1->spi);
 389               tr->seq = clib_host_to_net_u32 (esp1->seq);
 390             }
 391         }
 392
 393       /* next */
 394       b += 2;
 395       next += 2;
 396       n_left_from -= 2;
 397     }
 398   while (n_left_from > 0)
 399     {
 400       u32 sw_if_index0;
 401       ip4_header_t *ip40;
 402       ip6_header_t *ip60;
 403       esp_header_t *esp0;
 404       u32 len0;
 405       u16 buf_adv0;
 406       u32 tid0;
 407       ipsec_tunnel_if_t *t0;
 408       ipsec4_tunnel_key_t key40;
 409       ipsec6_tunnel_key_t key60;
 410
 411       ip40 =
 412         (ip4_header_t *) (b[0]->data + vnet_buffer (b[0])->l3_hdr_offset);
 413
 414       if (is_ip6)
 415         {
 416           ip60 = (ip6_header_t *) ip40;
 417           esp0 = (esp_header_t *) ((u8 *) ip60 + sizeof (ip6_header_t));
 418           buf_adv0 = sizeof (ip6_header_t);
 419         }
 420       else
 421         {
 422           /* NAT UDP port 4500 case, don't advance any more */
 423           if (ip40->protocol == IP_PROTOCOL_UDP)
 424             {
 425               esp0 =
 426                 (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40) +
 427                                   sizeof (udp_header_t));
 428               buf_adv0 = 0;
 429             }
 430           else
 431             {
 432               esp0 = (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40));
 433               buf_adv0 = ip4_header_bytes (ip40);
 434             }
 435         }
 436
 437       /* stats for the tunnel include all the data after the IP header
 438          just like a norml IP-IP tunnel */
 439       vlib_buffer_advance (b[0], buf_adv0);
 440       len0 = vlib_buffer_length_in_chain (vm, b[0]);
 441
 442       if (is_ip6)
 443         {
 444           key60.remote_ip = ip60->src_address;
 445           key60.spi = esp0->spi;
 446
 447           if (memcmp (&key60, &last_key6, sizeof (last_key6)) == 0)
 448             {
 449               tid0 = last_tunnel_id;
 450             }
 451           else
 452             {
 453               uword *p =
 454                 hash_get_mem (im->ipsec6_if_pool_index_by_key, &key60);
 455               if (p)
 456                 {
 457                   tid0 = p[0];
 458                   last_tunnel_id = tid0;
 459                   clib_memcpy_fast (&last_key6, &key60, sizeof (key60));
 460                 }
 461               else
 462                 {
 463                   n_no_tunnel++;
 464                   next[0] = IPSEC_INPUT_NEXT_DROP;
 465                   goto trace00;
 466                 }
 467             }
 468         }
 469       else                      /* !is_ip6 */
 470         {
 471           key40.remote_ip = ip40->src_address.as_u32;
 472           key40.spi = esp0->spi;
 473
 474           if (key40.as_u64 == last_key4.as_u64)
 475             {
 476               tid0 = last_tunnel_id;
 477             }
 478           else
 479             {
 480               uword *p =
 481                 hash_get (im->ipsec4_if_pool_index_by_key, key40.as_u64);
 482               if (p)
 483                 {
 484                   tid0 = p[0];
 485                   last_tunnel_id = tid0;
 486                   last_key4.as_u64 = key40.as_u64;
 487                 }
 488               else
 489                 {
 490                   n_no_tunnel++;
 491                   next[0] = IPSEC_INPUT_NEXT_DROP;
 492                   goto trace00;
 493                 }
 494             }
 495         }
 496
 497       t0 = pool_elt_at_index (im->tunnel_interfaces, tid0);
 498       vnet_buffer (b[0])->ipsec.sad_index = t0->input_sa_index;
 499
 500       if (PREDICT_TRUE (t0->hw_if_index != ~0))
 501         {
 502           vnet_buffer (b[0])->ipsec.flags = 0;
 503           sw_if_index0 = t0->sw_if_index;
 504           vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0;
 505
 506           if (PREDICT_FALSE (!(t0->flags & VNET_HW_INTERFACE_FLAG_LINK_UP)))
 507             {
 508               vlib_increment_combined_counter
 509                 (drop_counter, thread_index, sw_if_index0, 1, len0);
 510               n_disabled++;
 511               next[0] = IPSEC_INPUT_NEXT_DROP;
 512               goto trace00;
 513             }
 514
 515           if (PREDICT_TRUE (sw_if_index0 == last_sw_if_index))
 516             {
 517               n_packets++;
 518               n_bytes += len0;
 519             }
 520           else
 521             {
 522               if (n_packets)
 523                 {
 524                   vlib_increment_combined_counter
 525                     (rx_counter, thread_index, last_sw_if_index,
 526                      n_packets, n_bytes);
 527                 }
 528
 529               last_sw_if_index = sw_if_index0;
 530               n_packets = 1;
 531               n_bytes = len0;
 532             }
 533         }
 534       else
 535         {
 536           vnet_buffer (b[0])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
 537         }
 538
 539     trace00:
 540       if (PREDICT_FALSE (is_trace))
 541         {
 542           if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
 543             {
 544               ipsec_if_input_trace_t *tr =
 545                 vlib_add_trace (vm, node, b[0], sizeof (*tr));
 546               tr->spi = clib_host_to_net_u32 (esp0->spi);
 547               tr->seq = clib_host_to_net_u32 (esp0->seq);
 548             }
 549         }
 550
 551       /* next */
 552       b += 1;
 553       next += 1;
 554       n_left_from -= 1;
 555     }
 556
 557   if (n_packets)
 558     {
 559       vlib_increment_combined_counter (rx_counter,
 560                                        thread_index,
 561                                        last_sw_if_index, n_packets, n_bytes);
 562     }
 563
 564   vlib_node_increment_counter (vm, node->node_index,
 565                                IPSEC_IF_INPUT_ERROR_RX,
 566                                from_frame->n_vectors - n_disabled);
 567   vlib_node_increment_counter (vm, node->node_index,
 568                                IPSEC_IF_INPUT_ERROR_DISABLED, n_disabled);
 569   vlib_node_increment_counter (vm, node->node_index,
 570                                IPSEC_IF_INPUT_ERROR_NO_TUNNEL, n_no_tunnel);
 571
 572   vlib_buffer_enqueue_to_next (vm, node, from, nexts, from_frame->n_vectors);
 573
 574   return from_frame->n_vectors;
 575 }
 576
 577 VLIB_NODE_FN (ipsec4_if_input_node) (vlib_main_t * vm,
 578                                      vlib_node_runtime_t * node,
 579                                      vlib_frame_t * from_frame)
 580 {
 581   return ipsec_if_input_inline (vm, node, from_frame, 0 /* is_ip6 */ );
 582 }
 583
 584 /* *INDENT-OFF* */
 585 VLIB_REGISTER_NODE (ipsec4_if_input_node) = {
 586   .name = "ipsec4-if-input",
 587   .vector_size = sizeof (u32),
 588   .format_trace = format_ipsec_if_input_trace,
 589   .type = VLIB_NODE_TYPE_INTERNAL,
 590   .n_errors = ARRAY_LEN(ipsec_if_input_error_strings),
 591   .error_strings = ipsec_if_input_error_strings,
 592   .sibling_of = "ipsec4-input-feature",
 593 };
 594 /* *INDENT-ON* */
 595
 596 VLIB_NODE_FN (ipsec6_if_input_node) (vlib_main_t * vm,
 597                                      vlib_node_runtime_t * node,
 598                                      vlib_frame_t * from_frame)
 599 {
 600   return ipsec_if_input_inline (vm, node, from_frame, 1 /* is_ip6 */ );
 601 }
 602
 603 /* *INDENT-OFF* */
 604 VLIB_REGISTER_NODE (ipsec6_if_input_node) = {
 605   .name = "ipsec6-if-input",
 606   .vector_size = sizeof (u32),
 607   .format_trace = format_ipsec_if_input_trace,
 608   .type = VLIB_NODE_TYPE_INTERNAL,
 609   .n_errors = ARRAY_LEN(ipsec_if_input_error_strings),
 610   .error_strings = ipsec_if_input_error_strings,
 611   .sibling_of = "ipsec6-input-feature",
 612 };
 613 /* *INDENT-ON* */
 614
 615 /*
 616  * fd.io coding-style-patch-verification: ON
 617  *
 618  * Local Variables:
 619  * eval: (c-set-style "gnu")
 620  * End:
 621  */