src/vnet/ipsec/ipsec_tun.c

   1 /*
   2  * ipsec_tun.h : IPSEC tunnel protection
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/ipsec/ipsec_tun.h>
  19 #include <vnet/ipsec/esp.h>
  20 #include <vnet/udp/udp.h>
  21
  22 /**
  23  * Pool of tunnel protection objects
  24  */
  25 ipsec_tun_protect_t *ipsec_protect_pool;
  26
  27 /**
  28  * DB of protected tunnels
  29  */
  30 typedef struct ipsec_protect_db_t_
  31 {
  32   u32 *tunnels;
  33   u32 count;
  34 } ipsec_protect_db_t;
  35
  36 static ipsec_protect_db_t ipsec_protect_db;
  37
  38 static void
  39 ipsec_tun_protect_feature_set (ipsec_tun_protect_t * itp, u8 enable)
  40 {
  41   u32 sai;
  42
  43   sai = itp->itp_out_sa;
  44
  45   if (itp->itp_flags & IPSEC_PROTECT_L2)
  46     {
  47       /* l2-GRE only supported by the vnet ipsec code */
  48       vnet_feature_enable_disable ("ethernet-output",
  49                                    (ip46_address_is_ip4 (&itp->itp_tun.src) ?
  50                                     "esp4-encrypt-tun" :
  51                                     "esp6-encrypt-tun"),
  52                                    itp->itp_sw_if_index, enable,
  53                                    &sai, sizeof (sai));
  54     }
  55   else
  56     {
  57       ipsec_main_t *im;
  58       ipsec_sa_t *sa;
  59       u32 fi4, fi6;
  60
  61       im = &ipsec_main;
  62       sa = ipsec_sa_get (sai);
  63
  64       if (sa->crypto_alg == IPSEC_CRYPTO_ALG_NONE &&
  65           sa->integ_alg == IPSEC_INTEG_ALG_NONE)
  66         {
  67           fi4 = im->esp4_no_crypto_tun_feature_index;
  68           fi6 = im->esp6_no_crypto_tun_feature_index;
  69         }
  70       else
  71         {
  72           if (ip46_address_is_ip4 (&itp->itp_tun.src))
  73             {
  74               /* tunnel destination is v4 so we need the Xo4 indexes */
  75               fi4 = im->esp44_encrypt_tun_feature_index;
  76               fi6 = im->esp64_encrypt_tun_feature_index;
  77             }
  78           else
  79             {
  80               /* tunnel destination is v6 so we need the Xo6 indexes */
  81               fi4 = im->esp46_encrypt_tun_feature_index;
  82               fi6 = im->esp66_encrypt_tun_feature_index;
  83             }
  84         }
  85
  86       vnet_feature_enable_disable_with_index
  87         (vnet_get_feature_arc_index ("ip4-output"),
  88          fi4, itp->itp_sw_if_index, enable, &sai, sizeof (sai));
  89       vnet_feature_enable_disable_with_index
  90         (vnet_get_feature_arc_index ("ip6-output"),
  91          fi6, itp->itp_sw_if_index, enable, &sai, sizeof (sai));
  92     }
  93 }
  94
  95 static void
  96 ipsec_tun_protect_db_add (ipsec_main_t * im, const ipsec_tun_protect_t * itp)
  97 {
  98   const ipsec_sa_t *sa;
  99   u32 sai;
 100
 101   /* *INDENT-OFF* */
 102   FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai,
 103   ({
 104       sa = ipsec_sa_get (sai);
 105
 106       ipsec_tun_lkup_result_t res = {
 107         .tun_index = itp - ipsec_protect_pool,
 108         .sa_index = sai,
 109       };
 110
 111       /*
 112        * The key is formed from the tunnel's destination
 113        * as the packet lookup is done from the packet's source
 114        */
 115       if (ip46_address_is_ip4 (&itp->itp_crypto.dst))
 116         {
 117           ipsec4_tunnel_key_t key = {
 118             .remote_ip = itp->itp_crypto.dst.ip4,
 119             .spi = clib_host_to_net_u32 (sa->spi),
 120           };
 121           hash_set (im->tun4_protect_by_key, key.as_u64, res.as_u64);
 122           if (1 == hash_elts(im->tun4_protect_by_key))
 123             udp_register_dst_port (vlib_get_main(),
 124                                    UDP_DST_PORT_ipsec,
 125                                    ipsec4_tun_input_node.index, 1);
 126         }
 127       else
 128         {
 129           ipsec6_tunnel_key_t key = {
 130             .remote_ip = itp->itp_crypto.dst.ip6,
 131             .spi = clib_host_to_net_u32 (sa->spi),
 132           };
 133           hash_set_mem_alloc (&im->tun6_protect_by_key, &key, res.as_u64);
 134         }
 135   }))
 136   /* *INDENT-ON* */
 137 }
 138
 139 static void
 140 ipsec_tun_protect_db_remove (ipsec_main_t * im,
 141                              const ipsec_tun_protect_t * itp)
 142 {
 143   const ipsec_sa_t *sa;
 144
 145   /* *INDENT-OFF* */
 146   FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
 147   ({
 148       if (ip46_address_is_ip4 (&itp->itp_crypto.dst))
 149         {
 150           ipsec4_tunnel_key_t key = {
 151             .remote_ip = itp->itp_crypto.dst.ip4,
 152             .spi = clib_host_to_net_u32 (sa->spi),
 153           };
 154           hash_unset (im->tun4_protect_by_key, key.as_u64);
 155           if (0 == hash_elts(im->tun4_protect_by_key))
 156             udp_unregister_dst_port (vlib_get_main(),
 157                                      UDP_DST_PORT_ipsec,
 158                                      1);
 159         }
 160       else
 161         {
 162           ipsec6_tunnel_key_t key = {
 163             .remote_ip = itp->itp_crypto.dst.ip6,
 164             .spi = clib_host_to_net_u32 (sa->spi),
 165           };
 166           hash_unset_mem_free (&im->tun6_protect_by_key, &key);
 167         }
 168   }))
 169   /* *INDENT-ON* */
 170 }
 171
 172 static void
 173 ipsec_tun_protect_config (ipsec_main_t * im,
 174                           ipsec_tun_protect_t * itp, u32 sa_out, u32 * sas_in)
 175 {
 176   ipsec_sa_t *sa;
 177   index_t sai;
 178   u32 ii;
 179
 180   itp->itp_n_sa_in = vec_len (sas_in);
 181   for (ii = 0; ii < itp->itp_n_sa_in; ii++)
 182     itp->itp_in_sas[ii] = sas_in[ii];
 183   itp->itp_out_sa = sa_out;
 184
 185   ipsec_sa_lock (itp->itp_out_sa);
 186
 187   /* *INDENT-OFF* */
 188   FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai,
 189   ({
 190     ipsec_sa_lock(sai);
 191   }));
 192   FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
 193   ({
 194     if (ipsec_sa_is_set_IS_TUNNEL (sa))
 195       {
 196         itp->itp_crypto.src = sa->tunnel_dst_addr;
 197         itp->itp_crypto.dst = sa->tunnel_src_addr;
 198         ipsec_sa_set_IS_PROTECT (sa);
 199         itp->itp_flags |= IPSEC_PROTECT_ENCAPED;
 200       }
 201     else
 202       {
 203         itp->itp_crypto.src = itp->itp_tun.src;
 204         itp->itp_crypto.dst = itp->itp_tun.dst;
 205         itp->itp_flags &= ~IPSEC_PROTECT_ENCAPED;
 206       }
 207   }));
 208   /* *INDENT-ON* */
 209
 210   /*
 211    * add to the DB against each SA
 212    */
 213   ipsec_tun_protect_db_add (im, itp);
 214
 215   /*
 216    * enable the encrypt feature for egress.
 217    */
 218   ipsec_tun_protect_feature_set (itp, 1);
 219 }
 220
 221 static void
 222 ipsec_tun_protect_unconfig (ipsec_main_t * im, ipsec_tun_protect_t * itp)
 223 {
 224   ipsec_sa_t *sa;
 225   index_t sai;
 226
 227   ipsec_tun_protect_feature_set (itp, 0);
 228
 229   /* *INDENT-OFF* */
 230   FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa,
 231   ({
 232     ipsec_sa_unset_IS_PROTECT (sa);
 233   }));
 234
 235   ipsec_tun_protect_db_remove (im, itp);
 236
 237   ipsec_sa_unlock(itp->itp_out_sa);
 238
 239   FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai,
 240   ({
 241     ipsec_sa_unlock(sai);
 242   }));
 243   /* *INDENT-ON* */
 244 }
 245
 246 index_t
 247 ipsec_tun_protect_find (u32 sw_if_index)
 248 {
 249   if (vec_len (ipsec_protect_db.tunnels) < sw_if_index)
 250     return (INDEX_INVALID);
 251
 252   return (ipsec_protect_db.tunnels[sw_if_index]);
 253 }
 254
 255 int
 256 ipsec_tun_protect_update_one (u32 sw_if_index, u32 sa_out, u32 sa_in)
 257 {
 258   u32 *sas_in = NULL;
 259   int rv;
 260
 261   vec_add1 (sas_in, sa_in);
 262   rv = ipsec_tun_protect_update (sw_if_index, sa_out, sas_in);
 263
 264   return (rv);
 265 }
 266
 267 int
 268 ipsec_tun_protect_update_out (u32 sw_if_index, u32 sa_out)
 269 {
 270   u32 itpi, *sas_in, sai, *saip;
 271   ipsec_tun_protect_t *itp;
 272   ipsec_main_t *im;
 273   int rv;
 274
 275   sas_in = NULL;
 276   rv = 0;
 277   im = &ipsec_main;
 278   vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index,
 279                            INDEX_INVALID);
 280   itpi = ipsec_protect_db.tunnels[sw_if_index];
 281
 282   if (INDEX_INVALID == itpi)
 283     {
 284       return (VNET_API_ERROR_INVALID_INTERFACE);
 285     }
 286
 287   itp = pool_elt_at_index (ipsec_protect_pool, itpi);
 288
 289   /* *INDENT-0FF* */
 290   FOR_EACH_IPSEC_PROTECT_INPUT_SAI (itp, sai, (
 291                                                 {
 292                                                 ipsec_sa_lock (sai);
 293                                                 vec_add1 (sas_in, sai);
 294                                                 }
 295                                     ));
 296   /* *INDENT-ON* */
 297
 298   sa_out = ipsec_sa_find_and_lock (sa_out);
 299
 300   if (~0 == sa_out)
 301     {
 302       rv = VNET_API_ERROR_INVALID_VALUE;
 303       goto out;
 304     }
 305
 306   ipsec_tun_protect_unconfig (im, itp);
 307   ipsec_tun_protect_config (im, itp, sa_out, sas_in);
 308
 309   ipsec_sa_unlock (sa_out);
 310   vec_foreach (saip, sas_in) ipsec_sa_unlock (*saip);
 311
 312 out:
 313   vec_free (sas_in);
 314   return (rv);
 315 }
 316
 317 int
 318 ipsec_tun_protect_update_in (u32 sw_if_index, u32 sa_in)
 319 {
 320   u32 itpi, *sas_in, sa_out;
 321   ipsec_tun_protect_t *itp;
 322   ipsec_main_t *im;
 323   int rv;
 324
 325   sas_in = NULL;
 326   rv = 0;
 327   im = &ipsec_main;
 328   vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index,
 329                            INDEX_INVALID);
 330   itpi = ipsec_protect_db.tunnels[sw_if_index];
 331
 332   if (INDEX_INVALID == itpi)
 333     {
 334       return (VNET_API_ERROR_INVALID_INTERFACE);
 335     }
 336
 337   sa_in = ipsec_sa_find_and_lock (sa_in);
 338
 339   if (~0 == sa_in)
 340     {
 341       rv = VNET_API_ERROR_INVALID_VALUE;
 342       goto out;
 343     }
 344   vec_add1 (sas_in, sa_in);
 345
 346   itp = pool_elt_at_index (ipsec_protect_pool, itpi);
 347   sa_out = itp->itp_out_sa;
 348
 349   ipsec_sa_lock (sa_out);
 350
 351   ipsec_tun_protect_unconfig (im, itp);
 352   ipsec_tun_protect_config (im, itp, sa_out, sas_in);
 353
 354   ipsec_sa_unlock (sa_out);
 355   ipsec_sa_unlock (sa_in);
 356 out:
 357   vec_free (sas_in);
 358   return (rv);
 359 }
 360
 361 int
 362 ipsec_tun_protect_update (u32 sw_if_index, u32 sa_out, u32 * sas_in)
 363 {
 364   ipsec_tun_protect_t *itp;
 365   u32 itpi, ii, *saip;
 366   ipsec_main_t *im;
 367   int rv;
 368
 369   rv = 0;
 370   im = &ipsec_main;
 371   vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index,
 372                            INDEX_INVALID);
 373   itpi = ipsec_protect_db.tunnels[sw_if_index];
 374
 375   vec_foreach_index (ii, sas_in)
 376   {
 377     sas_in[ii] = ipsec_sa_find_and_lock (sas_in[ii]);
 378     if (~0 == sas_in[ii])
 379       {
 380         rv = VNET_API_ERROR_INVALID_VALUE;
 381         goto out;
 382       }
 383   }
 384
 385   sa_out = ipsec_sa_find_and_lock (sa_out);
 386
 387   if (~0 == sa_out)
 388     {
 389       rv = VNET_API_ERROR_INVALID_VALUE;
 390       goto out;
 391     }
 392
 393   if (INDEX_INVALID == itpi)
 394     {
 395       vnet_device_class_t *dev_class;
 396       vnet_hw_interface_t *hi;
 397       vnet_main_t *vnm;
 398       u8 is_l2;
 399
 400       vnm = vnet_get_main ();
 401       hi = vnet_get_sup_hw_interface (vnm, sw_if_index);
 402       dev_class = vnet_get_device_class (vnm, hi->dev_class_index);
 403
 404       if (NULL == dev_class->ip_tun_desc)
 405         {
 406           rv = VNET_API_ERROR_INVALID_SW_IF_INDEX;
 407           goto out;
 408         }
 409
 410       pool_get_zero (ipsec_protect_pool, itp);
 411
 412       itp->itp_sw_if_index = sw_if_index;
 413       ipsec_protect_db.tunnels[sw_if_index] = itp - ipsec_protect_pool;
 414       ipsec_protect_db.count++;
 415
 416       itp->itp_n_sa_in = vec_len (sas_in);
 417       for (ii = 0; ii < itp->itp_n_sa_in; ii++)
 418         itp->itp_in_sas[ii] = sas_in[ii];
 419       itp->itp_out_sa = sa_out;
 420
 421       rv = dev_class->ip_tun_desc (sw_if_index,
 422                                    &itp->itp_tun.src,
 423                                    &itp->itp_tun.dst, &is_l2);
 424
 425       if (rv)
 426         goto out;
 427
 428       if (is_l2)
 429         itp->itp_flags |= IPSEC_PROTECT_L2;
 430
 431       /*
 432        * add to the tunnel DB for ingress
 433        *  - if the SA is in trasnport mode, then the packates will arrivw
 434        *    with the IP src,dst of the protected tunnel, in which case we can
 435        *    simply strip the IP header and hand the payload to the protocol
 436        *    appropriate input handler
 437        *  - if the SA is in tunnel mode then there are two IP headers present
 438        *    one for the crytpo tunnel endpoints (described in the SA) and one
 439        *    for the tunnel endpoints. The outer IP headers in the srriving
 440        *    packets will have the crypto endpoints. So the DB needs to contain
 441        *    the crpto endpoint. Once the crypto header is stripped, revealing,
 442        *    the tunnel-IP we have 2 choices:
 443        *     1) do a tunnel lookup based on the revealed header
 444        *     2) skip the tunnel lookup and assume that the packet matches the
 445        *        one that is protected here.
 446        *    If we did 1) then we would allow our peer to use the SA for tunnel
 447        *    X to inject traffic onto tunnel Y, this is not good. If we do 2)
 448        *    then we don't verify that the peer is indeed using SA for tunnel
 449        *    X and addressing tunnel X. So we take a compromise, once the SA
 450        *    matches to tunnel X we veriy that the inner IP matches the value
 451        *    of the tunnel we are protecting, else it's dropped.
 452        */
 453       ipsec_tun_protect_config (im, itp, sa_out, sas_in);
 454
 455       if (1 == hash_elts (im->tun4_protect_by_key))
 456         ip4_register_protocol (IP_PROTOCOL_IPSEC_ESP,
 457                                ipsec4_tun_input_node.index);
 458       if (1 == hash_elts (im->tun6_protect_by_key))
 459         ip6_register_protocol (IP_PROTOCOL_IPSEC_ESP,
 460                                ipsec6_tun_input_node.index);
 461     }
 462   else
 463     {
 464       /* updating SAs only */
 465       itp = pool_elt_at_index (ipsec_protect_pool, itpi);
 466
 467       ipsec_tun_protect_unconfig (im, itp);
 468       ipsec_tun_protect_config (im, itp, sa_out, sas_in);
 469     }
 470
 471   ipsec_sa_unlock (sa_out);
 472   vec_foreach (saip, sas_in) ipsec_sa_unlock (*saip);
 473   vec_free (sas_in);
 474
 475 out:
 476   return (rv);
 477 }
 478
 479 int
 480 ipsec_tun_protect_del (u32 sw_if_index)
 481 {
 482   ipsec_tun_protect_t *itp;
 483   ipsec_main_t *im;
 484   index_t itpi;
 485
 486   im = &ipsec_main;
 487
 488   vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index,
 489                            INDEX_INVALID);
 490   itpi = ipsec_protect_db.tunnels[sw_if_index];
 491
 492   if (INDEX_INVALID == itpi)
 493     return (VNET_API_ERROR_NO_SUCH_ENTRY);
 494
 495   itp = ipsec_tun_protect_get (itpi);
 496   ipsec_tun_protect_unconfig (im, itp);
 497
 498   ipsec_protect_db.tunnels[itp->itp_sw_if_index] = INDEX_INVALID;
 499
 500   pool_put (ipsec_protect_pool, itp);
 501
 502   if (0 == hash_elts (im->tun4_protect_by_key))
 503     ip4_unregister_protocol (IP_PROTOCOL_IPSEC_ESP);
 504   if (0 == hash_elts (im->tun6_protect_by_key))
 505     ip6_unregister_protocol (IP_PROTOCOL_IPSEC_ESP);
 506
 507   return (0);
 508 }
 509
 510 void
 511 ipsec_tun_protect_walk (ipsec_tun_protect_walk_cb_t fn, void *ctx)
 512 {
 513   index_t itpi;
 514
 515   /* *INDENT-OFF* */
 516   pool_foreach_index(itpi, ipsec_protect_pool,
 517   ({
 518     fn (itpi, ctx);
 519   }));
 520   /* *INDENT-ON* */
 521 }
 522
 523 clib_error_t *
 524 ipsec_tunnel_protect_init (vlib_main_t * vm)
 525 {
 526   ipsec_main_t *im;
 527
 528   im = &ipsec_main;
 529   im->tun6_protect_by_key = hash_create_mem (0,
 530                                              sizeof (ipsec6_tunnel_key_t),
 531                                              sizeof (u64));
 532   im->tun4_protect_by_key = hash_create (0, sizeof (u64));
 533
 534   /* set up feature nodes to drop outbound packets with no crypto alg set */
 535   ipsec_add_feature ("ip4-output", "esp4-no-crypto",
 536                      &im->esp4_no_crypto_tun_feature_index);
 537   ipsec_add_feature ("ip6-output", "esp6-no-crypto",
 538                      &im->esp6_no_crypto_tun_feature_index);
 539
 540   return 0;
 541 }
 542
 543 VLIB_INIT_FUNCTION (ipsec_tunnel_protect_init);
 544
 545
 546 /*
 547  * fd.io coding-style-patch-verification: ON
 548  *
 549  * Local Variables:
 550  * eval: (c-set-style "gnu")
 551  * End:
 552  */