src/vnet/ipsec/ipsec_spd_policy.c

   1 /*
   2  * Copyright (c) 2015 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15
  16 #include <vnet/ipsec/ipsec.h>
  17
  18 /**
  19  * @brief
  20  * Policy packet & bytes counters
  21  */
  22 vlib_combined_counter_main_t ipsec_spd_policy_counters = {
  23   .name = "policy",
  24   .stat_segment_name = "/net/ipsec/policy",
  25 };
  26
  27 static int
  28 ipsec_policy_is_equal (ipsec_policy_t * p1, ipsec_policy_t * p2)
  29 {
  30   if (p1->priority != p2->priority)
  31     return 0;
  32   if (p1->is_outbound != p2->is_outbound)
  33     return (0);
  34   if (p1->policy != p2->policy)
  35     return (0);
  36   if (p1->sa_id != p2->sa_id)
  37     return (0);
  38   if (p1->protocol != p2->protocol)
  39     return (0);
  40   if (p1->lport.start != p2->lport.start)
  41     return (0);
  42   if (p1->lport.stop != p2->lport.stop)
  43     return (0);
  44   if (p1->rport.start != p2->rport.start)
  45     return (0);
  46   if (p1->rport.stop != p2->rport.stop)
  47     return (0);
  48   if (p1->is_ipv6 != p2->is_ipv6)
  49     return (0);
  50   if (p2->is_ipv6)
  51     {
  52       if (p1->laddr.start.ip6.as_u64[0] != p2->laddr.start.ip6.as_u64[0])
  53         return (0);
  54       if (p1->laddr.start.ip6.as_u64[1] != p2->laddr.start.ip6.as_u64[1])
  55         return (0);
  56       if (p1->laddr.stop.ip6.as_u64[0] != p2->laddr.stop.ip6.as_u64[0])
  57         return (0);
  58       if (p1->laddr.stop.ip6.as_u64[1] != p2->laddr.stop.ip6.as_u64[1])
  59         return (0);
  60       if (p1->raddr.start.ip6.as_u64[0] != p2->raddr.start.ip6.as_u64[0])
  61         return (0);
  62       if (p1->raddr.start.ip6.as_u64[1] != p2->raddr.start.ip6.as_u64[1])
  63         return (0);
  64       if (p1->raddr.stop.ip6.as_u64[0] != p2->raddr.stop.ip6.as_u64[0])
  65         return (0);
  66       if (p1->laddr.stop.ip6.as_u64[1] != p2->laddr.stop.ip6.as_u64[1])
  67         return (0);
  68     }
  69   else
  70     {
  71       if (p1->laddr.start.ip4.as_u32 != p2->laddr.start.ip4.as_u32)
  72         return (0);
  73       if (p1->laddr.stop.ip4.as_u32 != p2->laddr.stop.ip4.as_u32)
  74         return (0);
  75       if (p1->raddr.start.ip4.as_u32 != p2->raddr.start.ip4.as_u32)
  76         return (0);
  77       if (p1->raddr.stop.ip4.as_u32 != p2->raddr.stop.ip4.as_u32)
  78         return (0);
  79     }
  80   return (1);
  81 }
  82
  83 static int
  84 ipsec_spd_entry_sort (void *a1, void *a2)
  85 {
  86   ipsec_main_t *im = &ipsec_main;
  87   u32 *id1 = a1;
  88   u32 *id2 = a2;
  89   ipsec_policy_t *p1, *p2;
  90
  91   p1 = pool_elt_at_index (im->policies, *id1);
  92   p2 = pool_elt_at_index (im->policies, *id2);
  93   if (p1 && p2)
  94     return p2->priority - p1->priority;
  95
  96   return 0;
  97 }
  98
  99 int
 100 ipsec_add_del_policy (vlib_main_t * vm,
 101                       ipsec_policy_t * policy, int is_add, u32 * stat_index)
 102 {
 103   ipsec_main_t *im = &ipsec_main;
 104   ipsec_spd_t *spd = 0;
 105   ipsec_policy_t *vp;
 106   u32 spd_index;
 107   uword *p;
 108
 109   clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
 110                 policy->priority, policy->is_outbound);
 111
 112   if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 113     {
 114       p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
 115       if (!p)
 116         return VNET_API_ERROR_SYSCALL_ERROR_1;
 117       policy->sa_index = p[0];
 118     }
 119
 120   p = hash_get (im->spd_index_by_spd_id, policy->id);
 121
 122   if (!p)
 123     return VNET_API_ERROR_SYSCALL_ERROR_1;
 124
 125   spd_index = p[0];
 126   spd = pool_elt_at_index (im->spds, spd_index);
 127   if (!spd)
 128     return VNET_API_ERROR_SYSCALL_ERROR_1;
 129
 130   if (is_add)
 131     {
 132       u32 policy_index;
 133
 134       pool_get (im->policies, vp);
 135       clib_memcpy (vp, policy, sizeof (*vp));
 136       policy_index = vp - im->policies;
 137
 138       vlib_validate_combined_counter (&ipsec_spd_policy_counters,
 139                                       policy_index);
 140       vlib_zero_combined_counter (&ipsec_spd_policy_counters, policy_index);
 141
 142       if (policy->is_outbound)
 143         {
 144           if (policy->is_ipv6)
 145             {
 146               vec_add1 (spd->policies[IPSEC_SPD_POLICY_IP6_OUTBOUND],
 147                         policy_index);
 148               vec_sort_with_function (spd->policies
 149                                       [IPSEC_SPD_POLICY_IP6_OUTBOUND],
 150                                       ipsec_spd_entry_sort);
 151             }
 152           else
 153             {
 154               vec_add1 (spd->policies[IPSEC_SPD_POLICY_IP4_OUTBOUND],
 155                         policy_index);
 156               vec_sort_with_function (spd->policies
 157                                       [IPSEC_SPD_POLICY_IP4_OUTBOUND],
 158                                       ipsec_spd_entry_sort);
 159             }
 160         }
 161       else
 162         {
 163           if (policy->is_ipv6)
 164             {
 165               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 166                 {
 167                   vec_add1 (spd->policies
 168                             [IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT],
 169                             policy_index);
 170                   vec_sort_with_function (spd->policies
 171                                           [IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT],
 172                                           ipsec_spd_entry_sort);
 173                 }
 174               else
 175                 {
 176                   vec_add1
 177                     (spd->policies[IPSEC_SPD_POLICY_IP6_INBOUND_BYPASS],
 178                      policy_index);
 179                   vec_sort_with_function
 180                     (spd->policies[IPSEC_SPD_POLICY_IP6_INBOUND_BYPASS],
 181                      ipsec_spd_entry_sort);
 182                 }
 183             }
 184           else
 185             {
 186               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 187                 {
 188                   vec_add1 (spd->policies
 189                             [IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT],
 190                             policy_index);
 191                   vec_sort_with_function (spd->policies
 192                                           [IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT],
 193                                           ipsec_spd_entry_sort);
 194                 }
 195               else
 196                 {
 197                   vec_add1
 198                     (spd->policies[IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS],
 199                      policy_index);
 200                   vec_sort_with_function
 201                     (spd->policies[IPSEC_SPD_POLICY_IP4_INBOUND_BYPASS],
 202                      ipsec_spd_entry_sort);
 203                 }
 204             }
 205         }
 206       *stat_index = policy_index;
 207     }
 208   else
 209     {
 210       ipsec_spd_policy_t ptype;
 211       u32 ii;
 212
 213       FOR_EACH_IPSEC_SPD_POLICY_TYPE (ptype)
 214       {
 215         vec_foreach_index (ii, (spd->policies[ptype]))
 216         {
 217           vp = pool_elt_at_index (im->policies, spd->policies[ptype][ii]);
 218           if (ipsec_policy_is_equal (vp, policy))
 219             {
 220               vec_del1 (spd->policies[ptype], ii);
 221               pool_put (im->policies, vp);
 222               goto done;
 223             }
 224         }
 225       }
 226     done:;
 227     }
 228
 229   return 0;
 230 }
 231
 232 /*
 233  * fd.io coding-style-patch-verification: ON
 234  *
 235  * Local Variables:
 236  * eval: (c-set-style "gnu")
 237  * End:
 238  */