src/vnet/ipsec/ipsec_itf.c

   1 /*
   2  * ipsec_itf.c: IPSec dedicated interface type
   3  *
   4  * Copyright (c) 2020 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/ip/ip.h>
  19 #include <vnet/ipsec/ipsec_itf.h>
  20 #include <vnet/ipsec/ipsec_tun.h>
  21 #include <vnet/ipsec/ipsec.h>
  22 #include <vnet/adj/adj_midchain.h>
  23
  24 /* bitmap of Allocated IPSEC_ITF instances */
  25 static uword *ipsec_itf_instances;
  26
  27 /* pool of interfaces */
  28 static ipsec_itf_t *ipsec_itf_pool;
  29
  30 static u32 *ipsec_itf_index_by_sw_if_index;
  31
  32 static ipsec_itf_t *
  33 ipsec_itf_find_by_sw_if_index (u32 sw_if_index)
  34 {
  35   if (vec_len (ipsec_itf_index_by_sw_if_index) <= sw_if_index)
  36     return NULL;
  37   u32 ti = ipsec_itf_index_by_sw_if_index[sw_if_index];
  38   if (ti == ~0)
  39     return NULL;
  40   return pool_elt_at_index (ipsec_itf_pool, ti);
  41 }
  42
  43 static u8 *
  44 format_ipsec_itf_name (u8 * s, va_list * args)
  45 {
  46   u32 dev_instance = va_arg (*args, u32);
  47   return format (s, "ipsec%d", dev_instance);
  48 }
  49
  50 void
  51 ipsec_itf_adj_unstack (adj_index_t ai)
  52 {
  53   adj_midchain_delegate_unstack (ai);
  54 }
  55
  56 void
  57 ipsec_itf_adj_stack (adj_index_t ai, u32 sai)
  58 {
  59   const vnet_hw_interface_t *hw;
  60
  61   hw = vnet_get_sup_hw_interface (vnet_get_main (), adj_get_sw_if_index (ai));
  62
  63   if (hw->flags & VNET_HW_INTERFACE_FLAG_LINK_UP)
  64     {
  65       const ipsec_sa_t *sa;
  66
  67       sa = ipsec_sa_get (sai);
  68
  69       /* *INDENT-OFF* */
  70       const fib_prefix_t dst = {
  71         .fp_len = (ipsec_sa_is_set_IS_TUNNEL_V6(sa) ? 128 : 32),
  72         .fp_proto = (ipsec_sa_is_set_IS_TUNNEL_V6(sa)?
  73                      FIB_PROTOCOL_IP6 :
  74                      FIB_PROTOCOL_IP4),
  75         .fp_addr = sa->tunnel_dst_addr,
  76       };
  77       /* *INDENT-ON* */
  78
  79       adj_midchain_delegate_stack (ai, 0, &dst);
  80     }
  81   else
  82     adj_midchain_delegate_unstack (ai);
  83 }
  84
  85 static adj_walk_rc_t
  86 ipsec_itf_adj_stack_cb (adj_index_t ai, void *arg)
  87 {
  88   ipsec_tun_protect_t *itp = arg;
  89
  90   ipsec_itf_adj_stack (ai, itp->itp_out_sa);
  91
  92   return (ADJ_WALK_RC_CONTINUE);
  93 }
  94
  95 static void
  96 ipsec_itf_restack (index_t itpi, const ipsec_itf_t * itf)
  97 {
  98   ipsec_tun_protect_t *itp;
  99   fib_protocol_t proto;
 100
 101   itp = ipsec_tun_protect_get (itpi);
 102
 103   /*
 104    * walk all the adjacencies on the interface and restack them
 105    */
 106   FOR_EACH_FIB_IP_PROTOCOL (proto)
 107   {
 108     adj_nbr_walk (itf->ii_sw_if_index, proto, ipsec_itf_adj_stack_cb, itp);
 109   }
 110 }
 111
 112 static walk_rc_t
 113 ipsec_tun_protect_walk_state_change (index_t itpi, void *arg)
 114 {
 115   const ipsec_itf_t *itf = arg;
 116
 117   ipsec_itf_restack (itpi, itf);
 118
 119   return (WALK_CONTINUE);
 120 }
 121
 122 static clib_error_t *
 123 ipsec_itf_admin_up_down (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
 124 {
 125   vnet_hw_interface_t *hi;
 126   ipsec_itf_t *itf;
 127   u32 hw_flags;
 128
 129   hi = vnet_get_hw_interface (vnm, hw_if_index);
 130   hw_flags = (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP ?
 131               VNET_HW_INTERFACE_FLAG_LINK_UP : 0);
 132   vnet_hw_interface_set_flags (vnm, hw_if_index, hw_flags);
 133
 134   itf = ipsec_itf_find_by_sw_if_index (hi->sw_if_index);
 135
 136   if (itf)
 137     ipsec_tun_protect_walk_itf (itf->ii_sw_if_index,
 138                                 ipsec_tun_protect_walk_state_change, itf);
 139
 140   return (NULL);
 141 }
 142
 143 static int
 144 ipsec_itf_tunnel_desc (u32 sw_if_index,
 145                        ip46_address_t * src, ip46_address_t * dst, u8 * is_l2)
 146 {
 147   ip46_address_reset (src);
 148   ip46_address_reset (dst);
 149   *is_l2 = 0;
 150
 151   return (0);
 152 }
 153
 154 static u8 *
 155 ipsec_itf_build_rewrite (void)
 156 {
 157   /*
 158    * passing the adj code a NULL rewrite means 'i don't have one cos
 159    * t'other end is unresolved'. That's not the case here. For the ipsec
 160    * tunnel there are just no bytes of encap to apply in the adj.
 161    * So return a zero length rewrite. Encap will be added by a tunnel mode SA.
 162    */
 163   u8 *rewrite = NULL;
 164
 165   vec_validate (rewrite, 0);
 166   vec_reset_length (rewrite);
 167
 168   return (rewrite);
 169 }
 170
 171 static u8 *
 172 ipsec_itf_build_rewrite_i (vnet_main_t * vnm,
 173                            u32 sw_if_index,
 174                            vnet_link_t link_type, const void *dst_address)
 175 {
 176   return (ipsec_itf_build_rewrite ());
 177 }
 178
 179 void
 180 ipsec_itf_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
 181 {
 182   adj_nbr_midchain_update_rewrite
 183     (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK, ipsec_itf_build_rewrite ());
 184 }
 185
 186 /* *INDENT-OFF* */
 187 VNET_DEVICE_CLASS (ipsec_itf_device_class) = {
 188   .name = "IPSEC Tunnel",
 189   .format_device_name = format_ipsec_itf_name,
 190   .admin_up_down_function = ipsec_itf_admin_up_down,
 191   .ip_tun_desc = ipsec_itf_tunnel_desc,
 192 };
 193
 194 VNET_HW_INTERFACE_CLASS(ipsec_hw_interface_class) = {
 195   .name = "IPSec",
 196   .build_rewrite = ipsec_itf_build_rewrite_i,
 197   .update_adjacency = ipsec_itf_update_adj,
 198   .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
 199 };
 200 /* *INDENT-ON* */
 201
 202 /*
 203  * Maintain a bitmap of allocated ipsec_itf instance numbers.
 204  */
 205 #define IPSEC_ITF_MAX_INSTANCE          (16 * 1024)
 206
 207 static u32
 208 ipsec_itf_instance_alloc (u32 want)
 209 {
 210   /*
 211    * Check for dynamically allocated instance number.
 212    */
 213   if (~0 == want)
 214     {
 215       u32 bit;
 216
 217       bit = clib_bitmap_first_clear (ipsec_itf_instances);
 218       if (bit >= IPSEC_ITF_MAX_INSTANCE)
 219         {
 220           return ~0;
 221         }
 222       ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, bit, 1);
 223       return bit;
 224     }
 225
 226   /*
 227    * In range?
 228    */
 229   if (want >= IPSEC_ITF_MAX_INSTANCE)
 230     {
 231       return ~0;
 232     }
 233
 234   /*
 235    * Already in use?
 236    */
 237   if (clib_bitmap_get (ipsec_itf_instances, want))
 238     {
 239       return ~0;
 240     }
 241
 242   /*
 243    * Grant allocation request.
 244    */
 245   ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, want, 1);
 246
 247   return want;
 248 }
 249
 250 static int
 251 ipsec_itf_instance_free (u32 instance)
 252 {
 253   if (instance >= IPSEC_ITF_MAX_INSTANCE)
 254     {
 255       return -1;
 256     }
 257
 258   if (clib_bitmap_get (ipsec_itf_instances, instance) == 0)
 259     {
 260       return -1;
 261     }
 262
 263   ipsec_itf_instances = clib_bitmap_set (ipsec_itf_instances, instance, 0);
 264   return 0;
 265 }
 266
 267 int
 268 ipsec_itf_create (u32 user_instance, tunnel_mode_t mode, u32 * sw_if_indexp)
 269 {
 270   vnet_main_t *vnm = vnet_get_main ();
 271   u32 instance, hw_if_index;
 272   vnet_hw_interface_t *hi;
 273   ipsec_itf_t *ipsec_itf;
 274
 275   ASSERT (sw_if_indexp);
 276
 277   *sw_if_indexp = (u32) ~ 0;
 278
 279   if (mode != TUNNEL_MODE_P2P)
 280     return VNET_API_ERROR_UNSUPPORTED;
 281
 282   /*
 283    * Allocate a ipsec_itf instance.  Either select on dynamically
 284    * or try to use the desired user_instance number.
 285    */
 286   instance = ipsec_itf_instance_alloc (user_instance);
 287   if (instance == ~0)
 288     return VNET_API_ERROR_INVALID_REGISTRATION;
 289
 290   pool_get (ipsec_itf_pool, ipsec_itf);
 291
 292   /* tunnel index (or instance) */
 293   u32 t_idx = ipsec_itf - ipsec_itf_pool;
 294
 295   ipsec_itf->ii_mode = mode;
 296   ipsec_itf->ii_user_instance = instance;
 297
 298   hw_if_index = vnet_register_interface (vnm,
 299                                          ipsec_itf_device_class.index,
 300                                          ipsec_itf->ii_user_instance,
 301                                          ipsec_hw_interface_class.index,
 302                                          t_idx);
 303
 304   hi = vnet_get_hw_interface (vnm, hw_if_index);
 305
 306   vec_validate_init_empty (ipsec_itf_index_by_sw_if_index, hi->sw_if_index,
 307                            INDEX_INVALID);
 308   ipsec_itf_index_by_sw_if_index[hi->sw_if_index] = t_idx;
 309
 310   ipsec_itf->ii_sw_if_index = *sw_if_indexp = hi->sw_if_index;
 311
 312   return 0;
 313 }
 314
 315 int
 316 ipsec_itf_delete (u32 sw_if_index)
 317 {
 318   vnet_main_t *vnm = vnet_get_main ();
 319
 320   if (pool_is_free_index (vnm->interface_main.sw_interfaces, sw_if_index))
 321     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 322
 323   vnet_hw_interface_t *hw = vnet_get_sup_hw_interface (vnm, sw_if_index);
 324   if (hw == 0 || hw->dev_class_index != ipsec_itf_device_class.index)
 325     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 326
 327   ipsec_itf_t *ipsec_itf;
 328   ipsec_itf = ipsec_itf_find_by_sw_if_index (sw_if_index);
 329   if (NULL == ipsec_itf)
 330     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 331
 332   if (ipsec_itf_instance_free (hw->dev_instance) < 0)
 333     return VNET_API_ERROR_INVALID_SW_IF_INDEX;
 334
 335   vnet_delete_hw_interface (vnm, hw->hw_if_index);
 336   pool_put (ipsec_itf_pool, ipsec_itf);
 337
 338   return 0;
 339 }
 340
 341 static clib_error_t *
 342 ipsec_itf_create_cli (vlib_main_t * vm,
 343                       unformat_input_t * input, vlib_cli_command_t * cmd)
 344 {
 345   unformat_input_t _line_input, *line_input = &_line_input;
 346   u32 instance, sw_if_index;
 347   clib_error_t *error;
 348   mac_address_t mac;
 349   int rv;
 350
 351   error = NULL;
 352   instance = sw_if_index = ~0;
 353   mac_address_set_zero (&mac);
 354
 355   if (unformat_user (input, unformat_line_input, line_input))
 356     {
 357       while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
 358         {
 359           if (unformat (line_input, "instance %d", &instance))
 360             ;
 361           else
 362             {
 363               error = clib_error_return (0, "unknown input: %U",
 364                                          format_unformat_error, line_input);
 365               break;
 366             }
 367         }
 368
 369       unformat_free (line_input);
 370
 371       if (error)
 372         return error;
 373     }
 374
 375   rv = ipsec_itf_create (instance, TUNNEL_MODE_P2P, &sw_if_index);
 376
 377   if (rv)
 378     return clib_error_return (0, "iPSec interface create failed");
 379
 380   vlib_cli_output (vm, "%U\n", format_vnet_sw_if_index_name, vnet_get_main (),
 381                    sw_if_index);
 382   return 0;
 383 }
 384
 385 /*?
 386  * Create a IPSec interface.
 387  *
 388  * @cliexpar
 389  * The following two command syntaxes are equivalent:
 390  * @cliexcmd{ipsec itf create [instance <instance>]}
 391  * Example of how to create a ipsec interface:
 392  * @cliexcmd{ipsec itf create}
 393 ?*/
 394 /* *INDENT-OFF* */
 395 VLIB_CLI_COMMAND (ipsec_itf_create_command, static) = {
 396   .path = "ipsec itf create",
 397   .short_help = "ipsec itf create [instance <instance>]",
 398   .function = ipsec_itf_create_cli,
 399 };
 400 /* *INDENT-ON* */
 401
 402 static clib_error_t *
 403 ipsec_itf_delete_cli (vlib_main_t * vm,
 404                       unformat_input_t * input, vlib_cli_command_t * cmd)
 405 {
 406   vnet_main_t *vnm;
 407   u32 sw_if_index;
 408   int rv;
 409
 410   vnm = vnet_get_main ();
 411   sw_if_index = ~0;
 412
 413   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
 414     {
 415       if (unformat
 416           (input, "%U", unformat_vnet_sw_interface, vnm, &sw_if_index))
 417         ;
 418       else
 419         break;
 420     }
 421
 422   if (~0 != sw_if_index)
 423     {
 424       rv = ipsec_itf_delete (sw_if_index);
 425
 426       if (rv)
 427         return clib_error_return (0, "ipsec interface delete failed");
 428     }
 429   else
 430     return clib_error_return (0, "no such interface: %U",
 431                               format_unformat_error, input);
 432
 433   return 0;
 434 }
 435
 436 /*?
 437  * Delete a IPSEC_ITF interface.
 438  *
 439  * @cliexpar
 440  * The following two command syntaxes are equivalent:
 441  * @cliexcmd{ipsec itf delete <interface>}
 442  * Example of how to create a ipsec_itf interface:
 443  * @cliexcmd{ipsec itf delete ipsec0}
 444 ?*/
 445 /* *INDENT-OFF* */
 446 VLIB_CLI_COMMAND (ipsec_itf_delete_command, static) = {
 447   .path = "ipsec itf delete",
 448   .short_help = "ipsec itf delete <interface>",
 449   .function = ipsec_itf_delete_cli,
 450 };
 451 /* *INDENT-ON* */
 452
 453
 454 /*
 455  * fd.io coding-style-patch-verification: ON
 456  *
 457  * Local Variables:
 458  * eval: (c-set-style "gnu")
 459  * End:
 460  */