src/vnet/ipsec/ipsec_itf.c

   1 /*
   2  * ipsec_itf.c: IPSec dedicated interface type
   3  *
   4  * Copyright (c) 2020 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/ip/ip.h>
  19 #include <vnet/ipsec/ipsec_itf.h>
  20 #include <vnet/ipsec/ipsec_tun.h>
  21 #include <vnet/ipsec/ipsec.h>
  22 #include <vnet/adj/adj_midchain.h>
  23
  24 /* bitmap of Allocated IPSEC_ITF instances */
  25 static uword *ipsec_itf_instances;
  26
  27 /* pool of interfaces */
  28 static ipsec_itf_t *ipsec_itf_pool;
  29
  30 static u32 *ipsec_itf_index_by_sw_if_index;
  31
  32 ipsec_itf_t *
  33 ipsec_itf_get (index_t ii)
  34 {
  35   return (pool_elt_at_index (ipsec_itf_pool, ii));
  36 }
  37
  38 static ipsec_itf_t *
  39 ipsec_itf_find_by_sw_if_index (u32 sw_if_index)
  40 {
  41   if (vec_len (ipsec_itf_index_by_sw_if_index) <= sw_if_index)
  42     return NULL;
  43   u32 ti = ipsec_itf_index_by_sw_if_index[sw_if_index];
  44   if (ti == ~0)
  45     return NULL;
  46   return pool_elt_at_index (ipsec_itf_pool, ti);
  47 }
  48
  49 static u8 *
  50 format_ipsec_itf_name (u8 * s, va_list * args)
  51 {
  52   u32 dev_instance = va_arg (*args, u32);
  53   return format (s, "ipsec%d", dev_instance);
  54 }
  55
  56 void
  57 ipsec_itf_adj_unstack (adj_index_t ai)
  58 {
  59   adj_midchain_delegate_unstack (ai);
  60 }
  61
  62 void
  63 ipsec_itf_adj_stack (adj_index_t ai, u32 sai)
  64 {
  65   const vnet_hw_interface_t *hw;
  66
  67   hw = vnet_get_sup_hw_interface (vnet_get_main (), adj_get_sw_if_index (ai));
  68
  69   if (hw->flags & VNET_HW_INTERFACE_FLAG_LINK_UP)
  70     {
  71       const ipsec_sa_t *sa;
  72
  73       sa = ipsec_sa_get (sai);
  74
  75       /* *INDENT-OFF* */
  76       const fib_prefix_t dst = {
  77         .fp_len = (ipsec_sa_is_set_IS_TUNNEL_V6(sa) ? 128 : 32),
  78         .fp_proto = (ipsec_sa_is_set_IS_TUNNEL_V6(sa)?
  79                      FIB_PROTOCOL_IP6 :
  80                      FIB_PROTOCOL_IP4),
  81         .fp_addr = sa->tunnel_dst_addr,
  82       };
  83       /* *INDENT-ON* */
  84
  85       adj_midchain_delegate_stack (ai, sa->tx_fib_index, &dst);
  86     }
  87   else
  88     adj_midchain_delegate_unstack (ai);
  89 }
  90
  91 static adj_walk_rc_t
  92 ipsec_itf_adj_stack_cb (adj_index_t ai, void *arg)
  93 {
  94   ipsec_tun_protect_t *itp = arg;
  95
  96   ipsec_itf_adj_stack (ai, itp->itp_out_sa);
  97
  98   return (ADJ_WALK_RC_CONTINUE);
  99 }
 100
 101 static void
 102 ipsec_itf_restack (index_t itpi, const ipsec_itf_t * itf)
 103 {
 104   ipsec_tun_protect_t *itp;
 105   fib_protocol_t proto;
 106
 107   itp = ipsec_tun_protect_get (itpi);
 108
 109   /*
 110    * walk all the adjacencies on the interface and restack them
 111    */
 112   FOR_EACH_FIB_IP_PROTOCOL (proto)
 113   {
 114     adj_nbr_walk (itf->ii_sw_if_index, proto, ipsec_itf_adj_stack_cb, itp);
 115   }
 116 }
 117
 118 static walk_rc_t
 119 ipsec_tun_protect_walk_state_change (index_t itpi, void *arg)
 120 {
 121   const ipsec_itf_t *itf = arg;
 122
 123   ipsec_itf_restack (itpi, itf);
 124
 125   return (WALK_CONTINUE);
 126 }
 127
 128 static clib_error_t *
 129 ipsec_itf_admin_up_down (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
 130 {
 131   vnet_hw_interface_t *hi;
 132   ipsec_itf_t *itf;
 133   u32 hw_flags;
 134
 135   hi = vnet_get_hw_interface (vnm, hw_if_index);
 136   hw_flags = (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP ?
 137               VNET_HW_INTERFACE_FLAG_LINK_UP : 0);
 138   vnet_hw_interface_set_flags (vnm, hw_if_index, hw_flags);
 139
 140   itf = ipsec_itf_find_by_sw_if_index (hi->sw_if_index);
 141
 142   if (itf)
 143     ipsec_tun_protect_walk_itf (itf->ii_sw_if_index,
 144                                 ipsec_tun_protect_walk_state_change, itf);
 145
 146   return (NULL);
 147 }
 148
 149 static int
 150 ipsec_itf_tunnel_desc (u32 sw_if_index,
 151                        ip46_address_t * src, ip46_address_t * dst, u8 * is_l2)
 152 {
 153   ip46_address_reset (src);
 154   ip46_address_reset (dst);
 155   *is_l2 = 0;
 156
 157   return (0);
 158 }
 159
 160 static u8 *
 161 ipsec_itf_build_rewrite (void)
 162 {
 163   /*
 164    * passing the adj code a NULL rewrite means 'i don't have one cos
 165    * t'other end is unresolved'. That's not the case here. For the ipsec
 166    * tunnel there are just no bytes of encap to apply in the adj.
 167    * So return a zero length rewrite. Encap will be added by a tunnel mode SA.
 168    */
 169   u8 *rewrite = NULL;
 170
 171   vec_validate (rewrite, 0);
 172   vec_reset_length (rewrite);
 173
 174   return (rewrite);
 175 }
 176
 177 static u8 *
 178 ipsec_itf_build_rewrite_i (vnet_main_t * vnm,
 179                            u32 sw_if_index,
 180                            vnet_link_t link_type, const void *dst_address)
 181 {
 182   return (ipsec_itf_build_rewrite ());
 183 }
 184
 185 void
 186 ipsec_itf_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
 187 {
 188   adj_nbr_midchain_update_rewrite
 189     (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK, ipsec_itf_build_rewrite ());
 190 }
 191
 192 /* *INDENT-OFF* */
 193 VNET_DEVICE_CLASS (ipsec_itf_device_class) = {
 194   .name = "IPSEC Tunnel",
 195   .format_device_name = format_ipsec_itf_name,
 196   .admin_up_down_function = ipsec_itf_admin_up_down,
 197   .ip_tun_desc = ipsec_itf_tunnel_desc,
 198 };
 199
 200 VNET_HW_INTERFACE_CLASS(ipsec_hw_interface_class) = {
 201   .name = "IPSec",
 202   .build_rewrite = ipsec_itf_build_rewrite_i,
 203   .update_adjacency = ipsec_itf_update_adj,
 204   .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
 205 };
 206 VNET_HW_INTERFACE_CLASS(ipsec_p2mp_hw_interface_class) = {
 207   .name = "IPSec",
 208   .build_rewrite = ipsec_itf_build_rewrite_i,
 209   .update_adjacency = ipsec_itf_update_adj,
 210 };
 211 /* *INDENT-ON* */
 212
 213 /*
 214  * Maintain a bitmap of allocated ipsec_itf instance numbers.
 215  */
 216 #define IPSEC_ITF_MAX_INSTANCE          (16 * 1024)
 217
 218 static u32
 219 ipsec_itf_instance_alloc (u32 want)
 220 {
 221   /*
 222    * Check for dynamically allocated instance number.
 223    */
 224   if (~0 == want)
 225     {
 226       u32 bit;
 227
 228       bit = clib_bitmap_first_clear (ipsec_itf_instances);
 229       if (bit >= IPSEC_ITF_MAX_INSTANCE)
 230         {
 231           return ~0;
 232         }
 233       ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, bit, 1);
 234       return bit;
 235     }
 236
 237   /*
 238    * In range?
 239    */
 240   if (want >= IPSEC_ITF_MAX_INSTANCE)
 241     {
 242       return ~0;
 243     }
 244
 245   /*
 246    * Already in use?
 247    */
 248   if (clib_bitmap_get (ipsec_itf_instances, want))
 249     {
 250       return ~0;
 251     }
 252
 253   /*
 254    * Grant allocation request.
 255    */
 256   ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, want, 1);
 257
 258   return want;
 259 }
 260
 261 static int
 262 ipsec_itf_instance_free (u32 instance)
 263 {
 264   if (instance >= IPSEC_ITF_MAX_INSTANCE)
 265     {
 266       return -1;
 267     }
 268
 269   if (clib_bitmap_get (ipsec_itf_instances, instance) == 0)
 270     {
 271       return -1;
 272     }
 273
 274   ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, instance, 0);
 275   return 0;
 276 }
 277
 278 int
 279 ipsec_itf_create (u32 user_instance, tunnel_mode_t mode, u32 * sw_if_indexp)
 280 {
 281   vnet_main_t *vnm = vnet_get_main ();
 282   u32 instance, hw_if_index;
 283   vnet_hw_interface_t *hi;
 284   ipsec_itf_t *ipsec_itf;
 285
 286   ASSERT (sw_if_indexp);
 287
 288   *sw_if_indexp = (u32) ~ 0;
 289
 290   /*
 291    * Allocate a ipsec_itf instance.  Either select on dynamically
 292    * or try to use the desired user_instance number.
 293    */
 294   instance = ipsec_itf_instance_alloc (user_instance);
 295   if (instance == ~0)
 296     return VNET_API_ERROR_INVALID_REGISTRATION;
 297
 298   pool_get (ipsec_itf_pool, ipsec_itf);
 299
 300   /* tunnel index (or instance) */
 301   u32 t_idx = ipsec_itf - ipsec_itf_pool;
 302
 303   ipsec_itf->ii_mode = mode;
 304   ipsec_itf->ii_user_instance = instance;
 305
 306   hw_if_index = vnet_register_interface (vnm,
 307                                          ipsec_itf_device_class.index,
 308                                          ipsec_itf->ii_user_instance,
 309                                          (mode == TUNNEL_MODE_P2P ?
 310                                           ipsec_hw_interface_class.index :
 311                                           ipsec_p2mp_hw_interface_class.index),
 312                                          t_idx);
 313
 314   hi = vnet_get_hw_interface (vnm, hw_if_index);
 315
 316   vec_validate_init_empty (ipsec_itf_index_by_sw_if_index, hi->sw_if_index,
 317                            INDEX_INVALID);
 318   ipsec_itf_index_by_sw_if_index[hi->sw_if_index] = t_idx;
 319
 320   ipsec_itf->ii_sw_if_index = *sw_if_indexp = hi->sw_if_index;
 321
 322   return 0;
 323 }
 324
 325 int
 326 ipsec_itf_delete (u32 sw_if_index)
 327 {
 328   vnet_main_t *vnm = vnet_get_main ();
 329
 330   if (pool_is_free_index (vnm->interface_main.sw_interfaces, sw_if_index))
 331     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 332
 333   vnet_hw_interface_t *hw = vnet_get_sup_hw_interface (vnm, sw_if_index);
 334   if (hw == 0 || hw->dev_class_index != ipsec_itf_device_class.index)
 335     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 336
 337   ipsec_itf_t *ipsec_itf;
 338   ipsec_itf = ipsec_itf_find_by_sw_if_index (sw_if_index);
 339   if (NULL == ipsec_itf)
 340     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 341
 342   if (ipsec_itf_instance_free (hw->dev_instance) < 0)
 343     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 344
 345   vnet_delete_hw_interface (vnm, hw->hw_if_index);
 346   pool_put (ipsec_itf_pool, ipsec_itf);
 347
 348   return 0;
 349 }
 350
 351 static clib_error_t *
 352 ipsec_itf_create_cli (vlib_main_t * vm,
 353                       unformat_input_t * input, vlib_cli_command_t * cmd)
 354 {
 355   unformat_input_t _line_input, *line_input = &_line_input;
 356   u32 instance, sw_if_index;
 357   clib_error_t *error;
 358   mac_address_t mac;
 359   int rv;
 360
 361   error = NULL;
 362   instance = sw_if_index = ~0;
 363   mac_address_set_zero (&mac);
 364
 365   if (unformat_user (input, unformat_line_input, line_input))
 366     {
 367       while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
 368         {
 369           if (unformat (line_input, "instance %d", &instance))
 370             ;
 371           else
 372             {
 373               error = clib_error_return (0, "unknown input: %U",
 374                                          format_unformat_error, line_input);
 375               break;
 376             }
 377         }
 378
 379       unformat_free (line_input);
 380
 381       if (error)
 382         return error;
 383     }
 384
 385   rv = ipsec_itf_create (instance, TUNNEL_MODE_P2P, &sw_if_index);
 386
 387   if (rv)
 388     return clib_error_return (0, "iPSec interface create failed");
 389
 390   vlib_cli_output (vm, "%U\n", format_vnet_sw_if_index_name, vnet_get_main (),
 391                    sw_if_index);
 392   return 0;
 393 }
 394
 395 /*?
 396  * Create a IPSec interface.
 397  *
 398  * @cliexpar
 399  * The following two command syntaxes are equivalent:
 400  * @cliexcmd{ipsec itf create [instance <instance>]}
 401  * Example of how to create a ipsec interface:
 402  * @cliexcmd{ipsec itf create}
 403 ?*/
 404 /* *INDENT-OFF* */
 405 VLIB_CLI_COMMAND (ipsec_itf_create_command, static) = {
 406   .path = "ipsec itf create",
 407   .short_help = "ipsec itf create [instance <instance>]",
 408   .function = ipsec_itf_create_cli,
 409 };
 410 /* *INDENT-ON* */
 411
 412 static clib_error_t *
 413 ipsec_itf_delete_cli (vlib_main_t * vm,
 414                       unformat_input_t * input, vlib_cli_command_t * cmd)
 415 {
 416   vnet_main_t *vnm;
 417   u32 sw_if_index;
 418   int rv;
 419
 420   vnm = vnet_get_main ();
 421   sw_if_index = ~0;
 422
 423   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
 424     {
 425       if (unformat
 426           (input, "%U", unformat_vnet_sw_interface, vnm, &sw_if_index))
 427         ;
 428       else
 429         break;
 430     }
 431
 432   if (~0 != sw_if_index)
 433     {
 434       rv = ipsec_itf_delete (sw_if_index);
 435
 436       if (rv)
 437         return clib_error_return (0, "ipsec interface delete failed");
 438     }
 439   else
 440     return clib_error_return (0, "no such interface: %U",
 441                               format_unformat_error, input);
 442
 443   return 0;
 444 }
 445
 446 /*?
 447  * Delete a IPSEC_ITF interface.
 448  *
 449  * @cliexpar
 450  * The following two command syntaxes are equivalent:
 451  * @cliexcmd{ipsec itf delete <interface>}
 452  * Example of how to create a ipsec_itf interface:
 453  * @cliexcmd{ipsec itf delete ipsec0}
 454 ?*/
 455 /* *INDENT-OFF* */
 456 VLIB_CLI_COMMAND (ipsec_itf_delete_command, static) = {
 457   .path = "ipsec itf delete",
 458   .short_help = "ipsec itf delete <interface>",
 459   .function = ipsec_itf_delete_cli,
 460 };
 461 /* *INDENT-ON* */
 462
 463 static clib_error_t *
 464 ipsec_interface_show (vlib_main_t * vm,
 465                       unformat_input_t * input, vlib_cli_command_t * cmd)
 466 {
 467   index_t ii;
 468
 469   /* *INDENT-OFF* */
 470   pool_foreach_index (ii, ipsec_itf_pool,
 471   ({
 472     vlib_cli_output (vm, "%U", format_ipsec_itf, ii);
 473   }));
 474   /* *INDENT-ON* */
 475
 476   return NULL;
 477 }
 478
 479 /**
 480  * show IPSEC tunnel protection hash tables
 481  */
 482 /* *INDENT-OFF* */
 483 VLIB_CLI_COMMAND (ipsec_interface_show_node, static) =
 484 {
 485   .path = "show ipsec interface",
 486   .function = ipsec_interface_show,
 487   .short_help =  "show ipsec interface",
 488 };
 489 /* *INDENT-ON* */
 490
 491 /*
 492  * fd.io coding-style-patch-verification: ON
 493  *
 494  * Local Variables:
 495  * eval: (c-set-style "gnu")
 496  * End:
 497  */