FD.io VPP  v16.06
Vector Packet Processing
ipsec_if.c
Go to the documentation of this file.
1 /*
2  * ipsec_if.c : IPSec interface support
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 
22 #include <vnet/ipsec/ipsec.h>
23 
24 static u8 * format_ipsec_name (u8 * s, va_list * args)
25 {
26  u32 dev_instance = va_arg (*args, u32);
27  return format (s, "ipsec%d", dev_instance);
28 }
29 
31  vlib_node_runtime_t * node,
32  vlib_frame_t * frame)
33 {
34  clib_warning ("you shouldn't be here, leaking buffers...");
35  return frame->n_vectors;
36 }
37 
38 VNET_DEVICE_CLASS (ipsec_device_class,static) = {
39  .name = "IPSec",
40  .format_device_name = format_ipsec_name,
41  .format_tx_trace = format_ipsec_if_output_trace,
42  .tx_function = dummy_interface_tx,
43 };
44 
45 VNET_HW_INTERFACE_CLASS (ipsec_hw_class) = {
46  .name = "IPSec",
47 };
48 
49 u32
51 {
53  ipsec_main_t * im = &ipsec_main;
55  u32 hw_if_index = ~0;
56  uword *p;
57  ipsec_sa_t * sa;
58 
59  u64 key = (u64) args->remote_ip.as_u32 << 32 | (u64) args->remote_spi;
60  p = hash_get (im->ipsec_if_pool_index_by_key, key);
61 
62  if (args->is_add)
63  {
64  /* check if same src/dst pair exists */
65  if (p)
66  return VNET_API_ERROR_INVALID_VALUE;
67 
69  memset (t, 0, sizeof (*t));
70 
71  pool_get (im->sad, sa);
72  memset (sa, 0, sizeof (*sa));
73  t->input_sa_index = sa - im->sad;
74  sa->spi = args->remote_spi;
75  sa->tunnel_src_addr.ip4.as_u32 = args->remote_ip.as_u32;
76  sa->tunnel_dst_addr.ip4.as_u32 = args->local_ip.as_u32;
77  sa->is_tunnel = 1;
78  sa->use_esn = args->esn;
79  sa->use_anti_replay = args->anti_replay;
80 
81  pool_get (im->sad, sa);
82  memset (sa, 0, sizeof (*sa));
83  t->output_sa_index = sa - im->sad;
84  sa->spi = args->local_spi;
85  sa->tunnel_src_addr.ip4.as_u32 = args->local_ip.as_u32;
86  sa->tunnel_dst_addr.ip4.as_u32 = args->remote_ip.as_u32;
87  sa->is_tunnel = 1;
88  sa->seq = 1;
89  sa->use_esn = args->esn;
90  sa->use_anti_replay = args->anti_replay;
91 
93 
94  if (vec_len (im->free_tunnel_if_indices) > 0)
95  {
96  hw_if_index =
98  _vec_len (im->free_tunnel_if_indices) -= 1;
99  }
100  else
101  {
102  hw_if_index = vnet_register_interface(vnm, ipsec_device_class.index,
103  t - im->tunnel_interfaces,
104  ipsec_hw_class.index,
105  t - im->tunnel_interfaces);
106 
107  hi = vnet_get_hw_interface (vnm, hw_if_index);
109  }
110  t->hw_if_index = hw_if_index;
111 
112  /*1st interface, register protocol */
113  if (pool_elts(im->tunnel_interfaces) == 1)
114  ip4_register_protocol(IP_PROTOCOL_IPSEC_ESP, ipsec_if_input_node.index);
115 
116  return hw_if_index;
117  }
118  else
119  {
120  /* check if exists */
121  if (!p)
122  return VNET_API_ERROR_INVALID_VALUE;
123 
124  t = pool_elt_at_index(im->tunnel_interfaces, p[0]);
125  hi = vnet_get_hw_interface (vnm, t->hw_if_index);
126  vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
128 
129  /* delete input and output SA */
130  sa = pool_elt_at_index(im->sad, t->input_sa_index);
131  pool_put (im->sad, sa);
132  sa = pool_elt_at_index(im->sad, t->output_sa_index);
133  pool_put (im->sad, sa);
134 
136  pool_put (im->tunnel_interfaces, t);
137  }
138  return 0;
139 }
140 
141 int
143  ipsec_if_set_key_type_t type, u8 alg, u8 * key)
144 {
145  ipsec_main_t * im = &ipsec_main;
147  ipsec_tunnel_if_t * t;
148  ipsec_sa_t * sa;
149 
150  hi = vnet_get_hw_interface (vnm, hw_if_index);
152 
154  {
155  sa = pool_elt_at_index(im->sad, t->output_sa_index);
156  sa->crypto_alg = alg;
157  sa->crypto_key_len = vec_len(key);
158  clib_memcpy(sa->crypto_key, key, vec_len(key));
159  }
160  else if (type == IPSEC_IF_SET_KEY_TYPE_LOCAL_INTEG)
161  {
162  sa = pool_elt_at_index(im->sad, t->output_sa_index);
163  sa->integ_alg = alg;
164  sa->integ_key_len = vec_len(key);
165  clib_memcpy(sa->integ_key, key, vec_len(key));
166  }
167  else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_CRYPTO)
168  {
169  sa = pool_elt_at_index(im->sad, t->input_sa_index);
170  sa->crypto_alg = alg;
171  sa->crypto_key_len = vec_len(key);
172  clib_memcpy(sa->crypto_key, key, vec_len(key));
173  }
174  else if (type == IPSEC_IF_SET_KEY_TYPE_REMOTE_INTEG)
175  {
176  sa = pool_elt_at_index(im->sad, t->input_sa_index);
177  sa->integ_alg = alg;
178  sa->integ_key_len = vec_len(key);
179  clib_memcpy(sa->integ_key, key, vec_len(key));
180  }
181  else
182  return VNET_API_ERROR_INVALID_VALUE;
183 
184  return 0;
185 }
186 
187 
188 clib_error_t *
190 {
191  ipsec_main_t * im = &ipsec_main;
192 
193  im->ipsec_if_pool_index_by_key = hash_create (0, sizeof (uword));
194 
195  return 0;
196 }
197 
199 
vmrglw vmrglh hi
VNET_DEVICE_CLASS(ipsec_device_class, static)
#define hash_set(h, key, value)
Definition: hash.h:237
ipsec_tunnel_if_t * tunnel_interfaces
Definition: ipsec.h:175
ip46_address_t tunnel_src_addr
Definition: ipsec.h:84
#define hash_unset(h, key)
Definition: hash.h:243
bad routing header type(not 4)") sr_error (NO_MORE_SEGMENTS
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:75
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:480
ipsec_main_t ipsec_main
Definition: ipsec.h:202
u8 is_tunnel
Definition: ipsec.h:82
static uword dummy_interface_tx(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: ipsec_if.c:30
ipsec_if_set_key_type_t
Definition: ipsec.h:112
void ip4_register_protocol(u32 protocol, u32 node_index)
Definition: ip4_forward.c:2125
#define pool_get(P, E)
Definition: pool.h:186
uword * ipsec_if_pool_index_by_key
Definition: ipsec.h:193
u8 crypto_key[128]
Definition: ipsec.h:73
u32 spi
Definition: ipsec.h:68
vlib_node_registration_t ipsec_if_input_node
clib_error_t * ipsec_tunnel_if_init(vlib_main_t *vm)
Definition: ipsec_if.c:189
u8 integ_key[128]
Definition: ipsec.h:77
u32 ipsec_add_del_tunnel_if(vnet_main_t *vnm, ipsec_add_del_tunnel_args_t *args)
Definition: ipsec_if.c:50
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:109
u8 use_esn
Definition: ipsec.h:79
ip4_address_t remote_ip
Definition: ipsec.h:107
always_inline uword pool_elts(void *v)
Definition: pool.h:97
#define clib_warning(format, args...)
Definition: error.h:59
unsigned long u64
Definition: types.h:89
int ipsec_set_interface_key(vnet_main_t *vnm, u32 hw_if_index, ipsec_if_set_key_type_t type, u8 alg, u8 *key)
Definition: ipsec_if.c:142
u32 vnet_register_interface(vnet_main_t *vnm, u32 dev_class_index, u32 dev_instance, u32 hw_class_index, u32 hw_instance)
Definition: interface.c:583
#define hash_get(h, key)
Definition: hash.h:231
#define pool_elt_at_index(p, i)
Definition: pool.h:346
#define pool_put(P, E)
Definition: pool.h:200
u8 * format_ipsec_if_output_trace(u8 *s, va_list *args)
Definition: ipsec_if_out.c:54
ip46_address_t tunnel_dst_addr
Definition: ipsec.h:85
#define pool_get_aligned(P, E, A)
Definition: pool.h:155
vlib_node_registration_t ipsec_if_output_node
(constructor) VLIB_REGISTER_NODE (ipsec_if_output_node)
Definition: ipsec_if_out.c:123
u16 n_vectors
Definition: node.h:307
#define clib_memcpy(a, b, c)
Definition: string.h:63
always_inline vnet_hw_interface_t * vnet_get_hw_interface(vnet_main_t *vnm, u32 hw_if_index)
u32 output_sa_index
Definition: ipsec.h:165
#define hash_create(elts, value_bytes)
Definition: hash.h:615
unsigned int u32
Definition: types.h:88
ip4_address_t local_ip
Definition: ipsec.h:107
ipsec_sa_t * sad
Definition: ipsec.h:172
u8 * format(u8 *s, char *fmt,...)
Definition: format.c:405
u8 integ_key_len
Definition: ipsec.h:76
u32 input_sa_index
Definition: ipsec.h:164
u32 seq
Definition: ipsec.h:88
u64 uword
Definition: types.h:112
u8 crypto_key_len
Definition: ipsec.h:72
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
unsigned char u8
Definition: types.h:56
VNET_HW_INTERFACE_CLASS(ipsec_hw_class)
u32 * free_tunnel_if_indices
Definition: ipsec.h:176
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:71
static u8 * format_ipsec_name(u8 *s, va_list *args)
Definition: ipsec_if.c:24
clib_error_t * vnet_sw_interface_set_flags(vnet_main_t *vnm, u32 sw_if_index, u32 flags)
Definition: interface.c:462
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:67
u8 use_anti_replay
Definition: ipsec.h:80