src/vnet/ipsec/ipsec_itf.c

   1 /*
   2  * ipsec_itf.c: IPSec dedicated interface type
   3  *
   4  * Copyright (c) 2020 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/ip/ip.h>
  19 #include <vnet/ipsec/ipsec_itf.h>
  20 #include <vnet/ipsec/ipsec_tun.h>
  21 #include <vnet/ipsec/ipsec.h>
  22 #include <vnet/adj/adj_midchain.h>
  23 #include <vnet/ethernet/mac_address.h>
  24
  25 /* bitmap of Allocated IPSEC_ITF instances */
  26 static uword *ipsec_itf_instances;
  27
  28 /* pool of interfaces */
  29 static ipsec_itf_t *ipsec_itf_pool;
  30
  31 static u32 *ipsec_itf_index_by_sw_if_index;
  32
  33 ipsec_itf_t *
  34 ipsec_itf_get (index_t ii)
  35 {
  36   return (pool_elt_at_index (ipsec_itf_pool, ii));
  37 }
  38
  39 static ipsec_itf_t *
  40 ipsec_itf_find_by_sw_if_index (u32 sw_if_index)
  41 {
  42   if (vec_len (ipsec_itf_index_by_sw_if_index) <= sw_if_index)
  43     return NULL;
  44   u32 ti = ipsec_itf_index_by_sw_if_index[sw_if_index];
  45   if (ti == ~0)
  46     return NULL;
  47   return pool_elt_at_index (ipsec_itf_pool, ti);
  48 }
  49
  50 static u8 *
  51 format_ipsec_itf_name (u8 * s, va_list * args)
  52 {
  53   u32 dev_instance = va_arg (*args, u32);
  54   return format (s, "ipsec%d", dev_instance);
  55 }
  56
  57 void
  58 ipsec_itf_adj_unstack (adj_index_t ai)
  59 {
  60   adj_midchain_delegate_unstack (ai);
  61 }
  62
  63 void
  64 ipsec_itf_adj_stack (adj_index_t ai, u32 sai)
  65 {
  66   const vnet_hw_interface_t *hw;
  67
  68   hw = vnet_get_sup_hw_interface (vnet_get_main (), adj_get_sw_if_index (ai));
  69
  70   if (hw->flags & VNET_HW_INTERFACE_FLAG_LINK_UP)
  71     {
  72       const ipsec_sa_t *sa;
  73       fib_prefix_t dst;
  74
  75       sa = ipsec_sa_get (sai);
  76       ip_address_to_fib_prefix (&sa->tunnel.t_dst, &dst);
  77       adj_midchain_delegate_stack (ai, sa->tunnel.t_fib_index, &dst);
  78     }
  79   else
  80     adj_midchain_delegate_unstack (ai);
  81 }
  82
  83 static adj_walk_rc_t
  84 ipsec_itf_adj_stack_cb (adj_index_t ai, void *arg)
  85 {
  86   ipsec_tun_protect_t *itp = arg;
  87
  88   ipsec_itf_adj_stack (ai, itp->itp_out_sa);
  89
  90   return (ADJ_WALK_RC_CONTINUE);
  91 }
  92
  93 static void
  94 ipsec_itf_restack (index_t itpi, const ipsec_itf_t * itf)
  95 {
  96   ipsec_tun_protect_t *itp;
  97   fib_protocol_t proto;
  98
  99   itp = ipsec_tun_protect_get (itpi);
 100
 101   /*
 102    * walk all the adjacencies on the interface and restack them
 103    */
 104   FOR_EACH_FIB_IP_PROTOCOL (proto)
 105   {
 106     adj_nbr_walk (itf->ii_sw_if_index, proto, ipsec_itf_adj_stack_cb, itp);
 107   }
 108 }
 109
 110 static walk_rc_t
 111 ipsec_tun_protect_walk_state_change (index_t itpi, void *arg)
 112 {
 113   const ipsec_itf_t *itf = arg;
 114
 115   ipsec_itf_restack (itpi, itf);
 116
 117   return (WALK_CONTINUE);
 118 }
 119
 120 static clib_error_t *
 121 ipsec_itf_admin_up_down (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
 122 {
 123   vnet_hw_interface_t *hi;
 124   ipsec_itf_t *itf;
 125   u32 hw_flags;
 126
 127   hi = vnet_get_hw_interface (vnm, hw_if_index);
 128   hw_flags = (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP ?
 129               VNET_HW_INTERFACE_FLAG_LINK_UP : 0);
 130   vnet_hw_interface_set_flags (vnm, hw_if_index, hw_flags);
 131
 132   itf = ipsec_itf_find_by_sw_if_index (hi->sw_if_index);
 133
 134   if (itf)
 135     ipsec_tun_protect_walk_itf (itf->ii_sw_if_index,
 136                                 ipsec_tun_protect_walk_state_change, itf);
 137
 138   return (NULL);
 139 }
 140
 141 static int
 142 ipsec_itf_tunnel_desc (u32 sw_if_index,
 143                        ip46_address_t * src, ip46_address_t * dst, u8 * is_l2)
 144 {
 145   ip46_address_reset (src);
 146   ip46_address_reset (dst);
 147   *is_l2 = 0;
 148
 149   return (0);
 150 }
 151
 152 static u8 *
 153 ipsec_itf_build_rewrite (void)
 154 {
 155   /*
 156    * passing the adj code a NULL rewrite means 'i don't have one cos
 157    * t'other end is unresolved'. That's not the case here. For the ipsec
 158    * tunnel there are just no bytes of encap to apply in the adj.
 159    * So return a zero length rewrite. Encap will be added by a tunnel mode SA.
 160    */
 161   u8 *rewrite = NULL;
 162
 163   vec_validate (rewrite, 0);
 164   vec_reset_length (rewrite);
 165
 166   return (rewrite);
 167 }
 168
 169 static u8 *
 170 ipsec_itf_build_rewrite_i (vnet_main_t * vnm,
 171                            u32 sw_if_index,
 172                            vnet_link_t link_type, const void *dst_address)
 173 {
 174   return (ipsec_itf_build_rewrite ());
 175 }
 176
 177 void
 178 ipsec_itf_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
 179 {
 180   adj_nbr_midchain_update_rewrite
 181     (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK, ipsec_itf_build_rewrite ());
 182 }
 183
 184 /* *INDENT-OFF* */
 185 VNET_DEVICE_CLASS (ipsec_itf_device_class) = {
 186   .name = "IPSEC Tunnel",
 187   .format_device_name = format_ipsec_itf_name,
 188   .admin_up_down_function = ipsec_itf_admin_up_down,
 189   .ip_tun_desc = ipsec_itf_tunnel_desc,
 190 };
 191
 192 VNET_HW_INTERFACE_CLASS(ipsec_hw_interface_class) = {
 193   .name = "IPSec",
 194   .build_rewrite = ipsec_itf_build_rewrite_i,
 195   .update_adjacency = ipsec_itf_update_adj,
 196   .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
 197 };
 198 VNET_HW_INTERFACE_CLASS(ipsec_p2mp_hw_interface_class) = {
 199   .name = "IPSec",
 200   .build_rewrite = ipsec_itf_build_rewrite_i,
 201   .update_adjacency = ipsec_itf_update_adj,
 202   .flags = VNET_HW_INTERFACE_CLASS_FLAG_NBMA,
 203 };
 204 /* *INDENT-ON* */
 205
 206 /*
 207  * Maintain a bitmap of allocated ipsec_itf instance numbers.
 208  */
 209 #define IPSEC_ITF_MAX_INSTANCE          (16 * 1024)
 210
 211 static u32
 212 ipsec_itf_instance_alloc (u32 want)
 213 {
 214   /*
 215    * Check for dynamically allocated instance number.
 216    */
 217   if (~0 == want)
 218     {
 219       u32 bit;
 220
 221       bit = clib_bitmap_first_clear (ipsec_itf_instances);
 222       if (bit >= IPSEC_ITF_MAX_INSTANCE)
 223         {
 224           return ~0;
 225         }
 226       ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, bit, 1);
 227       return bit;
 228     }
 229
 230   /*
 231    * In range?
 232    */
 233   if (want >= IPSEC_ITF_MAX_INSTANCE)
 234     {
 235       return ~0;
 236     }
 237
 238   /*
 239    * Already in use?
 240    */
 241   if (clib_bitmap_get (ipsec_itf_instances, want))
 242     {
 243       return ~0;
 244     }
 245
 246   /*
 247    * Grant allocation request.
 248    */
 249   ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, want, 1);
 250
 251   return want;
 252 }
 253
 254 static int
 255 ipsec_itf_instance_free (u32 instance)
 256 {
 257   if (instance >= IPSEC_ITF_MAX_INSTANCE)
 258     {
 259       return -1;
 260     }
 261
 262   if (clib_bitmap_get (ipsec_itf_instances, instance) == 0)
 263     {
 264       return -1;
 265     }
 266
 267   ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, instance, 0);
 268   return 0;
 269 }
 270
 271 int
 272 ipsec_itf_create (u32 user_instance, tunnel_mode_t mode, u32 * sw_if_indexp)
 273 {
 274   vnet_main_t *vnm = vnet_get_main ();
 275   u32 instance, hw_if_index;
 276   vnet_hw_interface_t *hi;
 277   ipsec_itf_t *ipsec_itf;
 278
 279   ASSERT (sw_if_indexp);
 280
 281   *sw_if_indexp = (u32) ~ 0;
 282
 283   /*
 284    * Allocate a ipsec_itf instance.  Either select on dynamically
 285    * or try to use the desired user_instance number.
 286    */
 287   instance = ipsec_itf_instance_alloc (user_instance);
 288   if (instance == ~0)
 289     return VNET_API_ERROR_INVALID_REGISTRATION;
 290
 291   pool_get (ipsec_itf_pool, ipsec_itf);
 292
 293   /* tunnel index (or instance) */
 294   u32 t_idx = ipsec_itf - ipsec_itf_pool;
 295
 296   ipsec_itf->ii_mode = mode;
 297   ipsec_itf->ii_user_instance = instance;
 298
 299   hw_if_index = vnet_register_interface (vnm,
 300                                          ipsec_itf_device_class.index,
 301                                          ipsec_itf->ii_user_instance,
 302                                          (mode == TUNNEL_MODE_P2P ?
 303                                           ipsec_hw_interface_class.index :
 304                                           ipsec_p2mp_hw_interface_class.index),
 305                                          t_idx);
 306
 307   hi = vnet_get_hw_interface (vnm, hw_if_index);
 308
 309   vec_validate_init_empty (ipsec_itf_index_by_sw_if_index, hi->sw_if_index,
 310                            INDEX_INVALID);
 311   ipsec_itf_index_by_sw_if_index[hi->sw_if_index] = t_idx;
 312
 313   ipsec_itf->ii_sw_if_index = *sw_if_indexp = hi->sw_if_index;
 314
 315   return 0;
 316 }
 317
 318 int
 319 ipsec_itf_delete (u32 sw_if_index)
 320 {
 321   vnet_main_t *vnm = vnet_get_main ();
 322
 323   if (pool_is_free_index (vnm->interface_main.sw_interfaces, sw_if_index))
 324     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 325
 326   vnet_hw_interface_t *hw = vnet_get_sup_hw_interface (vnm, sw_if_index);
 327   if (hw == 0 || hw->dev_class_index != ipsec_itf_device_class.index)
 328     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 329
 330   ipsec_itf_t *ipsec_itf;
 331   ipsec_itf = ipsec_itf_find_by_sw_if_index (sw_if_index);
 332   if (NULL == ipsec_itf)
 333     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 334
 335   if (ipsec_itf_instance_free (hw->dev_instance) < 0)
 336     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 337
 338   vnet_delete_hw_interface (vnm, hw->hw_if_index);
 339   pool_put (ipsec_itf_pool, ipsec_itf);
 340
 341   return 0;
 342 }
 343
 344 static clib_error_t *
 345 ipsec_itf_create_cli (vlib_main_t * vm,
 346                       unformat_input_t * input, vlib_cli_command_t * cmd)
 347 {
 348   unformat_input_t _line_input, *line_input = &_line_input;
 349   u32 instance, sw_if_index;
 350   clib_error_t *error;
 351   mac_address_t mac;
 352   int rv;
 353
 354   error = NULL;
 355   instance = sw_if_index = ~0;
 356   mac_address_set_zero (&mac);
 357
 358   if (unformat_user (input, unformat_line_input, line_input))
 359     {
 360       while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
 361         {
 362           if (unformat (line_input, "instance %d", &instance))
 363             ;
 364           else
 365             {
 366               error = clib_error_return (0, "unknown input: %U",
 367                                          format_unformat_error, line_input);
 368               break;
 369             }
 370         }
 371
 372       unformat_free (line_input);
 373
 374       if (error)
 375         return error;
 376     }
 377
 378   rv = ipsec_itf_create (instance, TUNNEL_MODE_P2P, &sw_if_index);
 379
 380   if (rv)
 381     return clib_error_return (0, "iPSec interface create failed");
 382
 383   vlib_cli_output (vm, "%U\n", format_vnet_sw_if_index_name, vnet_get_main (),
 384                    sw_if_index);
 385   return 0;
 386 }
 387
 388 /*?
 389  * Create a IPSec interface.
 390  *
 391  * @cliexpar
 392  * The following two command syntaxes are equivalent:
 393  * @cliexcmd{ipsec itf create [instance <instance>]}
 394  * Example of how to create a ipsec interface:
 395  * @cliexcmd{ipsec itf create}
 396 ?*/
 397 /* *INDENT-OFF* */
 398 VLIB_CLI_COMMAND (ipsec_itf_create_command, static) = {
 399   .path = "ipsec itf create",
 400   .short_help = "ipsec itf create [instance <instance>]",
 401   .function = ipsec_itf_create_cli,
 402 };
 403 /* *INDENT-ON* */
 404
 405 static clib_error_t *
 406 ipsec_itf_delete_cli (vlib_main_t * vm,
 407                       unformat_input_t * input, vlib_cli_command_t * cmd)
 408 {
 409   vnet_main_t *vnm;
 410   u32 sw_if_index;
 411   int rv;
 412
 413   vnm = vnet_get_main ();
 414   sw_if_index = ~0;
 415
 416   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
 417     {
 418       if (unformat
 419           (input, "%U", unformat_vnet_sw_interface, vnm, &sw_if_index))
 420         ;
 421       else
 422         break;
 423     }
 424
 425   if (~0 != sw_if_index)
 426     {
 427       rv = ipsec_itf_delete (sw_if_index);
 428
 429       if (rv)
 430         return clib_error_return (0, "ipsec interface delete failed");
 431     }
 432   else
 433     return clib_error_return (0, "no such interface: %U",
 434                               format_unformat_error, input);
 435
 436   return 0;
 437 }
 438
 439 /*?
 440  * Delete a IPSEC_ITF interface.
 441  *
 442  * @cliexpar
 443  * The following two command syntaxes are equivalent:
 444  * @cliexcmd{ipsec itf delete <interface>}
 445  * Example of how to create a ipsec_itf interface:
 446  * @cliexcmd{ipsec itf delete ipsec0}
 447 ?*/
 448 /* *INDENT-OFF* */
 449 VLIB_CLI_COMMAND (ipsec_itf_delete_command, static) = {
 450   .path = "ipsec itf delete",
 451   .short_help = "ipsec itf delete <interface>",
 452   .function = ipsec_itf_delete_cli,
 453 };
 454 /* *INDENT-ON* */
 455
 456 static clib_error_t *
 457 ipsec_interface_show (vlib_main_t * vm,
 458                       unformat_input_t * input, vlib_cli_command_t * cmd)
 459 {
 460   index_t ii;
 461
 462   /* *INDENT-OFF* */
 463   pool_foreach_index (ii, ipsec_itf_pool)
 464    {
 465     vlib_cli_output (vm, "%U", format_ipsec_itf, ii);
 466   }
 467   /* *INDENT-ON* */
 468
 469   return NULL;
 470 }
 471
 472 /**
 473  * show IPSEC tunnel protection hash tables
 474  */
 475 /* *INDENT-OFF* */
 476 VLIB_CLI_COMMAND (ipsec_interface_show_node, static) =
 477 {
 478   .path = "show ipsec interface",
 479   .function = ipsec_interface_show,
 480   .short_help =  "show ipsec interface",
 481 };
 482 /* *INDENT-ON* */
 483
 484 /*
 485  * fd.io coding-style-patch-verification: ON
 486  *
 487  * Local Variables:
 488  * eval: (c-set-style "gnu")
 489  * End:
 490  */