FD.io VPP  v18.01.2-1-g9b554f3
Vector Packet Processing
ipsec_input.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel decapsulation
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/feature/feature.h>
22 
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 #include <vnet/ipsec/ah.h>
26 
27 #define foreach_ipsec_input_error \
28  _(RX_PKTS, "IPSEC pkts received") \
29  _(DECRYPTION_FAILED, "IPSEC decryption failed")
30 
31 typedef enum
32 {
33 #define _(sym,str) IPSEC_INPUT_ERROR_##sym,
35 #undef _
38 
39 static char *ipsec_input_error_strings[] = {
40 #define _(sym,string) string,
42 #undef _
43 };
44 
45 typedef struct
46 {
51 
52 /* packet trace format function */
53 static u8 *
54 format_ipsec_input_trace (u8 * s, va_list * args)
55 {
56  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
57  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
58  ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
59 
60  if (t->spi == 0 && t->seq == 0)
61  {
62  s = format (s, "esp: no esp packet");
63  return s;
64  }
65 
66  if (t->sa_id != 0)
67  {
68  s = format (s, "esp: sa_id %u spi %u seq %u", t->sa_id, t->spi, t->seq);
69  }
70  else
71  {
72  s = format (s, "esp: no sa spi %u seq %u", t->spi, t->seq);
73  }
74  return s;
75 }
76 
79 {
80  ipsec_main_t *im = &ipsec_main;
81  ipsec_policy_t *p;
82  ipsec_sa_t *s;
83  u32 *i;
84 
86  {
87  p = pool_elt_at_index (spd->policies, *i);
88  s = pool_elt_at_index (im->sad, p->sa_index);
89 
90  if (spi != s->spi)
91  continue;
92 
93  if (s->is_tunnel)
94  {
95  if (da != clib_net_to_host_u32 (s->tunnel_dst_addr.ip4.as_u32))
96  continue;
97 
98  if (sa != clib_net_to_host_u32 (s->tunnel_src_addr.ip4.as_u32))
99  continue;
100 
101  return p;
102  }
103 
104  if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
105  continue;
106 
107  if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
108  continue;
109 
110  if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
111  continue;
112 
113  if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
114  continue;
115 
116  return p;
117  }
118  return 0;
119 }
120 
123  ip6_address_t * ua)
124 {
125  if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
126  (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
127  return 1;
128  return 0;
129 }
130 
133  ip6_address_t * sa,
134  ip6_address_t * da, u32 spi)
135 {
136  ipsec_main_t *im = &ipsec_main;
137  ipsec_policy_t *p;
138  ipsec_sa_t *s;
139  u32 *i;
140 
142  {
143  p = pool_elt_at_index (spd->policies, *i);
144  s = pool_elt_at_index (im->sad, p->sa_index);
145 
146  if (spi != s->spi)
147  continue;
148 
149  if (s->is_tunnel)
150  {
151  if (!ip6_address_is_equal (sa, &s->tunnel_src_addr.ip6))
152  continue;
153 
154  if (!ip6_address_is_equal (da, &s->tunnel_dst_addr.ip6))
155  continue;
156 
157  return p;
158  }
159 
160  if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6))
161  continue;
162 
163  if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6))
164  continue;
165 
166  return p;
167  }
168  return 0;
169 }
170 
172 
173 static uword
175  vlib_node_runtime_t * node,
176  vlib_frame_t * from_frame)
177 {
178  u32 n_left_from, *from, next_index, *to_next;
179  ipsec_main_t *im = &ipsec_main;
180 
181  from = vlib_frame_vector_args (from_frame);
182  n_left_from = from_frame->n_vectors;
183 
184  next_index = node->cached_next_index;
185 
186  while (n_left_from > 0)
187  {
188  u32 n_left_to_next;
189 
190  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
191 
192  while (n_left_from > 0 && n_left_to_next > 0)
193  {
194  u32 bi0, next0;
195  vlib_buffer_t *b0;
196  ip4_header_t *ip0;
197  esp_header_t *esp0;
198  ah_header_t *ah0;
199  ip4_ipsec_config_t *c0;
200  ipsec_spd_t *spd0;
201  ipsec_policy_t *p0 = 0;
202 
203  bi0 = to_next[0] = from[0];
204  from += 1;
205  n_left_from -= 1;
206  to_next += 1;
207  n_left_to_next -= 1;
208 
209  b0 = vlib_get_buffer (vm, bi0);
210  c0 =
211  vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index
212  [VLIB_RX], &next0, b0,
213  sizeof (c0[0]));
214 
215  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
216 
217  ip0 = vlib_buffer_get_current (b0);
218 
219  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
220  {
221 #if 0
223  ("packet received from %U to %U spi %u size %u spd_id %u",
226  clib_net_to_host_u32 (esp0->spi),
227  clib_net_to_host_u16 (ip0->length), spd0->id);
228 #endif
229 
230  esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
232  clib_net_to_host_u32
233  (ip0->src_address.
234  as_u32),
235  clib_net_to_host_u32
236  (ip0->dst_address.
237  as_u32),
238  clib_net_to_host_u32
239  (esp0->spi));
240 
241  if (PREDICT_TRUE (p0 != 0))
242  {
243  p0->counter.packets++;
244  p0->counter.bytes += clib_net_to_host_u16 (ip0->length);
245  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
246  vnet_buffer (b0)->ipsec.flags = 0;
247  next0 = im->esp_decrypt_next_index;
249  goto trace0;
250  }
251 
252  /* FIXME bypass and discard */
253  trace0:
255  {
256  ipsec_input_trace_t *tr =
257  vlib_add_trace (vm, node, b0, sizeof (*tr));
258  if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
259  {
260  if (p0)
261  tr->sa_id = p0->sa_id;
262  tr->spi = clib_host_to_net_u32 (esp0->spi);
263  tr->seq = clib_host_to_net_u32 (esp0->seq);
264  }
265  }
266 
267  }
268 
269 
270  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_AH))
271  {
272  ah0 = (ah_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
274  clib_net_to_host_u32
275  (ip0->src_address.
276  as_u32),
277  clib_net_to_host_u32
278  (ip0->dst_address.
279  as_u32),
280  clib_net_to_host_u32
281  (ah0->spi));
282 
283  if (PREDICT_TRUE (p0 != 0))
284  {
285  p0->counter.packets++;
286  p0->counter.bytes += clib_net_to_host_u16 (ip0->length);
287  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
288  vnet_buffer (b0)->ipsec.flags = 0;
289  next0 = im->ah_decrypt_next_index;
290  goto trace1;
291  }
292  /* FIXME bypass and discard */
293  trace1:
295  {
296  ipsec_input_trace_t *tr =
297  vlib_add_trace (vm, node, b0, sizeof (*tr));
298  if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
299  {
300  if (p0)
301  tr->sa_id = p0->sa_id;
302  tr->spi = clib_host_to_net_u32 (ah0->spi);
303  tr->seq = clib_host_to_net_u32 (ah0->seq_no);
304  }
305  }
306  }
307 
308  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
309  to_next, n_left_to_next, bi0,
310  next0);
311  }
312  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
313  }
315  IPSEC_INPUT_ERROR_RX_PKTS,
316  from_frame->n_vectors);
317 
318  return from_frame->n_vectors;
319 }
320 
321 
322 /* *INDENT-OFF* */
324  .function = ipsec_input_ip4_node_fn,
325  .name = "ipsec-input-ip4",
326  .vector_size = sizeof (u32),
327  .format_trace = format_ipsec_input_trace,
328  .type = VLIB_NODE_TYPE_INTERNAL,
329 
331  .error_strings = ipsec_input_error_strings,
332 
333  .n_next_nodes = IPSEC_INPUT_N_NEXT,
334  .next_nodes = {
335 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
337 #undef _
338  },
339 };
340 /* *INDENT-ON* */
341 
344 
345  static uword
347  vlib_node_runtime_t * node,
348  vlib_frame_t * from_frame)
349 {
350  u32 n_left_from, *from, next_index, *to_next;
351  ipsec_main_t *im = &ipsec_main;
352 
353  from = vlib_frame_vector_args (from_frame);
354  n_left_from = from_frame->n_vectors;
355 
356  next_index = node->cached_next_index;
357 
358  while (n_left_from > 0)
359  {
360  u32 n_left_to_next;
361 
362  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
363 
364  while (n_left_from > 0 && n_left_to_next > 0)
365  {
366  u32 bi0, next0;
367  vlib_buffer_t *b0;
368  ip6_header_t *ip0;
369  esp_header_t *esp0;
370  ip4_ipsec_config_t *c0;
371  ipsec_spd_t *spd0;
372  ipsec_policy_t *p0 = 0;
373  u32 header_size = sizeof (ip0[0]);
374 
375  bi0 = to_next[0] = from[0];
376  from += 1;
377  n_left_from -= 1;
378  to_next += 1;
379  n_left_to_next -= 1;
380 
381  b0 = vlib_get_buffer (vm, bi0);
382  c0 =
383  vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index
384  [VLIB_RX], &next0, b0,
385  sizeof (c0[0]));
386 
387  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
388 
389  ip0 = vlib_buffer_get_current (b0);
390  esp0 = (esp_header_t *) ((u8 *) ip0 + header_size);
391 
392  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
393  {
394 #if 0
396  ("packet received from %U to %U spi %u size %u spd_id %u",
398  &ip0->dst_address, clib_net_to_host_u32 (esp0->spi),
399  clib_net_to_host_u16 (ip0->payload_length) + header_size,
400  spd0->id);
401 #endif
403  &ip0->src_address,
404  &ip0->dst_address,
405  clib_net_to_host_u32
406  (esp0->spi));
407 
408  if (PREDICT_TRUE (p0 != 0))
409  {
410  p0->counter.packets++;
411  p0->counter.bytes +=
412  clib_net_to_host_u16 (ip0->payload_length);
413  p0->counter.bytes += header_size;
414  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
415  vnet_buffer (b0)->ipsec.flags = 0;
416  next0 = im->esp_decrypt_next_index;
417  vlib_buffer_advance (b0, header_size);
418  goto trace0;
419  }
420  }
421 
422  trace0:
424  {
425  ipsec_input_trace_t *tr =
426  vlib_add_trace (vm, node, b0, sizeof (*tr));
427  if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
428  {
429  if (p0)
430  tr->sa_id = p0->sa_id;
431  tr->spi = clib_host_to_net_u32 (esp0->spi);
432  tr->seq = clib_host_to_net_u32 (esp0->seq);
433  }
434  }
435 
436  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
437  n_left_to_next, bi0, next0);
438  }
439  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
440  }
442  IPSEC_INPUT_ERROR_RX_PKTS,
443  from_frame->n_vectors);
444 
445  return from_frame->n_vectors;
446 }
447 
448 
449 /* *INDENT-OFF* */
451  .function = ipsec_input_ip6_node_fn,
452  .name = "ipsec-input-ip6",
453  .vector_size = sizeof (u32),
454  .format_trace = format_ipsec_input_trace,
455  .type = VLIB_NODE_TYPE_INTERNAL,
456 
458  .error_strings = ipsec_input_error_strings,
459 
460  .sibling_of = "ipsec-input-ip4",
461 };
462 /* *INDENT-ON* */
463 
465 /*
466  * fd.io coding-style-patch-verification: ON
467  *
468  * Local Variables:
469  * eval: (c-set-style "gnu")
470  * End:
471  */
ip46_address_t stop
Definition: ipsec.h:148
static char * ipsec_input_error_strings[]
Definition: ipsec_input.c:39
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:227
ipsec_spd_t * spds
Definition: ipsec.h:257
u32 ah_decrypt_next_index
Definition: ipsec.h:291
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:225
sll srl srl sll sra u16x4 i
Definition: vector_sse2.h:337
#define CLIB_UNUSED(x)
Definition: clib.h:79
ip46_address_t tunnel_src_addr
Definition: ipsec.h:130
a
Definition: bitmap.h:516
ip4_address_t src_address
Definition: ip4_packet.h:164
static uword ipsec_input_ip6_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
Definition: ipsec_input.c:346
#define PREDICT_TRUE(x)
Definition: clib.h:106
u64 as_u64[2]
Definition: ip6_packet.h:51
static int ip4_header_bytes(ip4_header_t *i)
Definition: ip4_packet.h:227
static ipsec_policy_t * ipsec_input_protect_policy_match(ipsec_spd_t *spd, u32 sa, u32 da, u32 spi)
Definition: ipsec_input.c:78
u8 is_tunnel
Definition: ipsec.h:128
struct _vlib_node_registration vlib_node_registration_t
static uword ip6_addr_match_range(ip6_address_t *a, ip6_address_t *la, ip6_address_t *ua)
Definition: ipsec_input.c:122
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
static u8 * format_ipsec_input_trace(u8 *s, va_list *args)
Definition: ipsec_input.c:54
ip6_address_t src_address
Definition: ip6_packet.h:341
u32 spi
Definition: ipsec.h:114
format_function_t format_ip4_address
Definition: format.h:79
static vlib_node_registration_t ipsec_input_ip6_node
(constructor) VLIB_REGISTER_NODE (ipsec_input_ip6_node)
Definition: ipsec_input.c:343
ipsec_main_t ipsec_main
Definition: ipsec.c:28
unsigned int seq_no
Definition: ah.h:33
#define always_inline
Definition: clib.h:92
ip4_address_t dst_address
Definition: ip4_packet.h:164
static uword ip6_address_is_equal(ip6_address_t *a, ip6_address_t *b)
Definition: ip6_packet.h:208
#define foreach_ipsec_input_next
Definition: ipsec.h:38
unsigned long u64
Definition: types.h:89
ipsec_policy_t * policies
Definition: ipsec.h:221
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:459
counter_t packets
packet counter
Definition: counter.h:141
ipsec_input_error_t
Definition: ipsec_input.c:31
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:195
#define PREDICT_FALSE(x)
Definition: clib.h:105
ip46_address_range_t laddr
Definition: ipsec.h:202
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:364
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1158
ip46_address_t tunnel_dst_addr
Definition: ipsec.h:131
u16 n_vectors
Definition: node.h:344
format_function_t format_ip6_address
Definition: format.h:95
vlib_main_t * vm
Definition: buffer.c:283
u32 sa_index
Definition: ipsec.h:211
u32 esp_decrypt_next_index
Definition: ipsec.h:289
ip46_address_t start
Definition: ipsec.h:148
#define clib_warning(format, args...)
Definition: error.h:59
#define VLIB_BUFFER_IS_TRACED
Definition: buffer.h:93
#define ARRAY_LEN(x)
Definition: clib.h:59
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:454
ip46_address_range_t raddr
Definition: ipsec.h:203
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
Definition: node.h:456
unsigned int u32
Definition: types.h:88
static vlib_node_registration_t ipsec_input_ip4_node
(constructor) VLIB_REGISTER_NODE (ipsec_input_ip4_node)
Definition: ipsec_input.c:171
ipsec_sa_t * sad
Definition: ipsec.h:258
u32 seq
Definition: esp.h:28
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:208
static uword ipsec_input_ip4_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
Definition: ipsec_input.c:174
u32 spi
Definition: esp.h:27
static ipsec_policy_t * ipsec_input_ip6_protect_policy_match(ipsec_spd_t *spd, ip6_address_t *sa, ip6_address_t *da, u32 spi)
Definition: ipsec_input.c:132
u64 uword
Definition: types.h:112
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
counter_t bytes
byte counter
Definition: counter.h:142
#define foreach_ipsec_input_error
Definition: ipsec_input.c:27
u16 payload_length
Definition: ip6_packet.h:332
unsigned char u8
Definition: types.h:56
vlib_counter_t counter
Definition: ipsec.h:214
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:267
static_always_inline void * vnet_feature_next_with_data(u32 sw_if_index, u32 *next0, vlib_buffer_t *b0, u32 n_data_bytes)
Definition: feature.h:208
u32 id
Definition: ipsec.h:219
#define vnet_buffer(b)
Definition: buffer.h:326
#define VLIB_NODE_FUNCTION_MULTIARCH(node, fn)
Definition: node.h:158
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:143
Definition: ah.h:27
#define vec_foreach(var, vec)
Vector iterator.
unsigned int spi
Definition: ah.h:32
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:75
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:57
Definition: defs.h:46
ip6_address_t dst_address
Definition: ip6_packet.h:341