FD.io VPP  v16.09
Vector Packet Processing
ipsec.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #if DPDK==1
16 #include <vnet/devices/dpdk/dpdk.h>
17 #endif
18 
19 #define IPSEC_FLAG_IPSEC_GRE_TUNNEL (1 << 0)
20 
21 #define foreach_ipsec_policy_action \
22  _(0, BYPASS, "bypass") \
23  _(1, DISCARD, "discard") \
24  _(2, RESOLVE, "resolve") \
25  _(3, PROTECT, "protect")
26 
27 typedef enum
28 {
29 #define _(v,f,s) IPSEC_POLICY_ACTION_##f = v,
31 #undef _
34 
35 #define foreach_ipsec_crypto_alg \
36  _(0, NONE, "none") \
37  _(1, AES_CBC_128, "aes-cbc-128") \
38  _(2, AES_CBC_192, "aes-cbc-192") \
39  _(3, AES_CBC_256, "aes-cbc-256")
40 
41 typedef enum
42 {
43 #define _(v,f,s) IPSEC_CRYPTO_ALG_##f = v,
45 #undef _
48 
49 #define foreach_ipsec_integ_alg \
50  _(0, NONE, "none") \
51  _(1, MD5_96, "md5-96") /* RFC2403 */ \
52  _(2, SHA1_96, "sha1-96") /* RFC2404 */ \
53  _(3, SHA_256_96, "sha-256-96") /* draft-ietf-ipsec-ciph-sha-256-00 */ \
54  _(4, SHA_256_128, "sha-256-128") /* RFC4868 */ \
55  _(5, SHA_384_192, "sha-384-192") /* RFC4868 */ \
56  _(6, SHA_512_256, "sha-512-256") /* RFC4868 */
57 
58 typedef enum
59 {
60 #define _(v,f,s) IPSEC_INTEG_ALG_##f = v,
62 #undef _
65 
66 typedef enum
67 {
71 
72 typedef struct
73 {
77 
80  u8 crypto_key[128];
81 
84  u8 integ_key[128];
85 
88 
91  ip46_address_t tunnel_src_addr;
92  ip46_address_t tunnel_dst_addr;
93 
94  /* runtime */
100 } ipsec_sa_t;
101 
102 typedef struct
103 {
104  ip46_address_t start, stop;
106 
107 typedef struct
108 {
109  u16 start, stop;
110 } port_range_t;
111 
112 typedef struct
113 {
122  u8 local_crypto_key[128];
124  u8 remote_crypto_key[128];
127  u8 local_integ_key[128];
129  u8 remote_integ_key[128];
131 
132 typedef struct
133 {
140 
141 typedef enum
142 {
149 
150 typedef struct
151 {
155 
156  // Selector
163 
164  // Policy
168 
169  // Counter
172 
173 typedef struct
174 {
176  /* pool of policies */
178  /* vectors of policy indices */
185 } ipsec_spd_t;
186 
187 typedef struct
188 {
191 
192 typedef struct
193 {
196 
197 typedef struct
198 {
203 
204 typedef struct
205 {
206  /* pool of tunnel instances */
209 
210  /* pool of tunnel interfaces */
213 
215 
217 
218  /* convenience */
221 
222  /* next node indices */
223  u32 feature_next_node_index[32];
224 
225  /* hashes */
230 
231  /* node indexes */
235 
236 } ipsec_main_t;
237 
239 
244 
245 
246 /*
247  * functions
248  */
249 int ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
250  int is_add);
251 int ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add);
253  int is_add);
254 int ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add);
255 int ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update);
256 
258 u8 *format_ipsec_if_output_trace (u8 * s, va_list * args);
259 u8 *format_ipsec_policy_action (u8 * s, va_list * args);
260 u8 *format_ipsec_crypto_alg (u8 * s, va_list * args);
261 u8 *format_ipsec_integ_alg (u8 * s, va_list * args);
262 u8 *format_ipsec_replay_window (u8 * s, va_list * args);
263 uword unformat_ipsec_policy_action (unformat_input_t * input, va_list * args);
264 uword unformat_ipsec_crypto_alg (unformat_input_t * input, va_list * args);
265 uword unformat_ipsec_integ_alg (unformat_input_t * input, va_list * args);
266 
267 /*u32 ipsec_add_del_tunnel_if (vnet_main_t * vnm, ipsec_add_del_tunnel_args_t * args); */
271  args);
272 int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index,
273  ipsec_if_set_key_type_t type, u8 alg, u8 * key);
274 
275 
276 /*
277  * inline functions
278  */
279 
280 always_inline void
282 {
283 #if DPDK==1
284  dpdk_main_t *dm = &dpdk_main;
285  u32 free_list_index = dm->vlib_buffer_free_list_index;
286 #else
287  u32 free_list_index = VLIB_BUFFER_DEFAULT_FREE_LIST_INDEX;
288 #endif
289  u32 cpu_index = os_get_cpu_number ();
290  uword l = vec_len (im->empty_buffers[cpu_index]);
291  uword n_alloc = 0;
292 
293  if (PREDICT_FALSE (l < VLIB_FRAME_SIZE))
294  {
295  if (!im->empty_buffers[cpu_index])
296  {
297  vec_alloc (im->empty_buffers[cpu_index], 2 * VLIB_FRAME_SIZE);
298  }
299 
300  n_alloc = vlib_buffer_alloc_from_free_list (vm,
301  im->empty_buffers[cpu_index]
302  + l,
303  2 * VLIB_FRAME_SIZE - l,
304  free_list_index);
305 
306  _vec_len (im->empty_buffers[cpu_index]) = l + n_alloc;
307  }
308 }
309 
310 static_always_inline u32 /* FIXME move to interface???.h */
312 {
313  vlib_main_t *vm = vlib_get_main ();
314  vlib_node_t *node;
315  u32 r;
316  intf_output_feat_t next_feature;
317 
318  u8 *node_names[] = {
319 #define _(sym, str) (u8 *) str,
321 #undef _
322  };
323 
324  count_trailing_zeros (next_feature,
325  vnet_buffer (b)->output_features.bitmap);
326 
327  if (next_feature >= INTF_OUTPUT_FEAT_DONE)
328  {
329  u32 sw_if_index = vnet_buffer (b)->sw_if_index[VLIB_TX];
330  vnet_hw_interface_t *hw = vnet_get_sup_hw_interface (vnm, sw_if_index);
331  r = hw->output_node_index;
332  }
333  else
334  {
335  vnet_buffer (b)->output_features.bitmap &= ~(1 << next_feature);
336  /* FIXME */
337  node = vlib_get_node_by_name (vm, node_names[next_feature]);
338  r = node->index;
339  }
340 
341  return r;
342 }
343 
344 /*
345  * fd.io coding-style-patch-verification: ON
346  *
347  * Local Variables:
348  * eval: (c-set-style "gnu")
349  * End:
350  */
ip46_address_t stop
Definition: ipsec.h:104
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:183
ipsec_spd_t * spds
Definition: ipsec.h:207
u8 * format_ipsec_replay_window(u8 *s, va_list *args)
Definition: ipsec_format.c:122
#define foreach_ipsec_integ_alg
Definition: ipsec.h:49
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:181
ipsec_tunnel_if_t * tunnel_interfaces
Definition: ipsec.h:211
u16 stop
Definition: ipsec.h:109
ip46_address_t tunnel_src_addr
Definition: ipsec.h:91
uword * tunnel_index_by_key
Definition: ipsec.h:216
#define INTF_OUTPUT_FEAT_DONE
Definition: interface.h:552
u32 id
Definition: ipsec.h:74
ipsec_policy_action_t
Definition: ipsec.h:27
dpdk_main_t dpdk_main
Definition: dpdk.h:443
static vlib_main_t * vlib_get_main(void)
Definition: global_funcs.h:23
bad routing header type(not 4)") sr_error (NO_MORE_SEGMENTS
static vnet_hw_interface_t * vnet_get_sup_hw_interface(vnet_main_t *vnm, u32 sw_if_index)
#define foreach_ipsec_crypto_alg
Definition: ipsec.h:35
i32 priority
Definition: ipsec.h:153
u32 index
Definition: node.h:237
u32 vlib_buffer_alloc_from_free_list(vlib_main_t *vm, u32 *buffers, u32 n_buffers, u32 free_list_index)
Allocate buffers from specific freelist into supplied array.
Definition: dpdk_buffer.c:655
int ipsec_add_del_sa(vlib_main_t *vm, ipsec_sa_t *new_sa, int is_add)
Definition: ipsec.c:430
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:82
u32 ipsec_get_sa_index_by_sa_id(u32 sa_id)
Definition: ipsec.c:28
ipsec_main_t ipsec_main
Definition: ipsec.h:238
Combined counter to hold both packets and byte differences.
Definition: counter.h:164
u8 is_tunnel
Definition: ipsec.h:89
struct _vlib_node_registration vlib_node_registration_t
uword unformat_ipsec_integ_alg(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:108
intf_output_feat_t
Definition: interface.h:543
u32 * ipv4_outbound_policies
Definition: ipsec.h:179
int ipsec_set_interface_spd(vlib_main_t *vm, u32 sw_if_index, u32 spd_id, int is_add)
Definition: ipsec.c:39
ipsec_if_set_key_type_t
Definition: ipsec.h:141
static void ipsec_alloc_empty_buffers(vlib_main_t *vm, ipsec_main_t *im)
Definition: ipsec.h:281
uword * ipsec_if_pool_index_by_key
Definition: ipsec.h:229
#define vec_alloc(V, N)
Allocate space for N more elements (no header, unspecified alignment)
Definition: vec.h:239
u32 spi
Definition: ipsec.h:75
port_range_t lport
Definition: ipsec.h:161
u32 seq_hi
Definition: ipsec.h:96
uword * spd_index_by_sw_if_index
Definition: ipsec.h:227
vlib_node_registration_t ipsec_if_input_node
(constructor) VLIB_REGISTER_NODE (ipsec_if_input_node)
Definition: ipsec_if_in.c:144
u64 replay_window
Definition: ipsec.h:99
#define static_always_inline
Definition: clib.h:85
#define always_inline
Definition: clib.h:84
ipsec_protocol_t
Definition: ipsec.h:66
u8 use_esn
Definition: ipsec.h:86
int i32
Definition: types.h:81
ip4_address_t remote_ip
Definition: ipsec.h:117
unsigned long u64
Definition: types.h:89
u8 * format_ipsec_integ_alg(u8 *s, va_list *args)
Definition: ipsec_format.c:90
ipsec_policy_t * policies
Definition: ipsec.h:177
int ipsec_add_del_policy(vlib_main_t *vm, ipsec_policy_t *policy, int is_add)
Definition: ipsec.c:171
u32 ip4_lookup_node_index
Definition: ipsec.h:233
static_always_inline u32 get_next_output_feature_node_index(vnet_main_t *vnm, vlib_buffer_t *b)
Definition: ipsec.h:311
u32 last_seq
Definition: ipsec.h:97
u32 error_drop_node_index
Definition: ipsec.h:232
vlib_node_registration_t esp_encrypt_node
(constructor) VLIB_REGISTER_NODE (esp_encrypt_node)
Definition: esp_encrypt.c:62
uword unformat_ipsec_policy_action(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:44
u8 is_tunnel_ip6
Definition: ipsec.h:90
vnet_main_t * vnet_main
Definition: ipsec.h:220
uword os_get_cpu_number(void)
Definition: unix-misc.c:224
int ipsec_set_sa_key(vlib_main_t *vm, ipsec_sa_t *sa_update)
Definition: ipsec.c:468
u32 last_seq_hi
Definition: ipsec.h:98
#define PREDICT_FALSE(x)
Definition: clib.h:97
#define VLIB_FRAME_SIZE
Definition: node.h:328
ip46_address_range_t laddr
Definition: ipsec.h:158
u8 * format_ipsec_if_output_trace(u8 *s, va_list *args)
Definition: ipsec_if_out.c:58
uword * spd_index_by_spd_id
Definition: ipsec.h:226
ip46_address_t tunnel_dst_addr
Definition: ipsec.h:92
vlib_node_registration_t ipsec_if_output_node
(constructor) VLIB_REGISTER_NODE (ipsec_if_output_node)
Definition: ipsec_if_out.c:131
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:120
u32 esp_encrypt_node_index
Definition: ipsec.h:234
u32 sa_index
Definition: ipsec.h:167
uword * sa_index_by_sa_id
Definition: ipsec.h:228
u32 output_sa_index
Definition: ipsec.h:200
vlib_main_t * vlib_main
Definition: ipsec.h:219
int ipsec_add_del_spd(vlib_main_t *vm, u32 spd_id, int is_add)
Definition: ipsec.c:105
port_range_t rport
Definition: ipsec.h:162
ip46_address_range_t raddr
Definition: ipsec.h:159
#define VLIB_BUFFER_DEFAULT_FREE_LIST_INDEX
Definition: buffer.h:303
#define foreach_ipsec_policy_action
Definition: ipsec.h:21
unsigned int u32
Definition: types.h:88
#define vnet_buffer(b)
Definition: buffer.h:335
ipsec_integ_alg_t integ_alg
Definition: ipsec.h:125
ipsec_sa_t * sad
Definition: ipsec.h:208
ipsec_crypto_alg_t
Definition: ipsec.h:41
u8 integ_key_len
Definition: ipsec.h:83
ipsec_protocol_t protocol
Definition: ipsec.h:76
u32 input_sa_index
Definition: ipsec.h:199
u32 seq
Definition: ipsec.h:95
u64 uword
Definition: types.h:112
u8 crypto_key_len
Definition: ipsec.h:79
vlib_node_t * vlib_get_node_by_name(vlib_main_t *vm, u8 *name)
Definition: node.c:45
Definition: defs.h:47
int ipsec_add_del_ipsec_gre_tunnel(vnet_main_t *vnm, ipsec_add_del_ipsec_gre_tunnel_args_t *args)
Definition: ipsec_if.c:198
unsigned short u16
Definition: types.h:57
u32 * ipv4_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:182
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
u8 * format_ipsec_policy_action(u8 *s, va_list *args)
Definition: ipsec_format.c:26
unsigned char u8
Definition: types.h:56
vlib_counter_t counter
Definition: ipsec.h:170
u8 is_outbound
Definition: ipsec.h:154
u32 * free_tunnel_if_indices
Definition: ipsec.h:212
u32 * ipv6_inbound_policy_discard_and_bypass_indices
Definition: ipsec.h:184
u32 * ipv6_outbound_policies
Definition: ipsec.h:180
u32 id
Definition: ipsec.h:175
#define foreach_intf_output_feat
Definition: interface.h:539
ipsec_crypto_alg_t crypto_alg
Definition: ipsec.h:78
u32 vlib_buffer_free_list_index
Definition: dpdk.h:391
struct _unformat_input_t unformat_input_t
u8 * format_ipsec_crypto_alg(u8 *s, va_list *args)
Definition: ipsec_format.c:58
u32 ** empty_buffers
Definition: ipsec.h:214
u8 use_anti_replay
Definition: ipsec.h:87
uword unformat_ipsec_crypto_alg(unformat_input_t *input, va_list *args)
Definition: ipsec_format.c:76
int ipsec_set_interface_key(vnet_main_t *vnm, u32 hw_if_index, ipsec_if_set_key_type_t type, u8 alg, u8 *key)
Definition: ipsec_if.c:260
int ipsec_add_del_tunnel_if(ipsec_add_del_tunnel_args_t *args)
Definition: ipsec_if.c:65
vlib_node_registration_t esp_decrypt_node
(constructor) VLIB_REGISTER_NODE (esp_decrypt_node)
Definition: esp_decrypt.c:522
ipsec_integ_alg_t
Definition: ipsec.h:58