FD.io VPP  v18.10-34-gcce845e
Vector Packet Processing
interface.c
Go to the documentation of this file.
1 /*
2  * gre_interface.c: gre interfaces
3  *
4  * Copyright (c) 2016 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 /**
18  * @file
19  * @brief L2-GRE over IPSec tunnel interface.
20  *
21  * Creates ipsec-gre tunnel interface.
22  * Provides a command line interface so humans can interact with VPP.
23  */
24 
25 #include <vnet/vnet.h>
26 #include <vnet/pg/pg.h>
28 #include <vnet/ip/format.h>
29 #include <vnet/ipsec/ipsec.h>
30 #include <vnet/l2/l2_input.h>
31 
32 #include <vnet/ipsec/esp.h>
33 
34 u8 *
35 format_ipsec_gre_tunnel (u8 * s, va_list * args)
36 {
37  ipsec_gre_tunnel_t *t = va_arg (*args, ipsec_gre_tunnel_t *);
39 
40  s = format (s,
41  "[%d] %U (src) %U (dst) local-sa %d remote-sa %d",
42  t - gm->tunnels,
45  t->local_sa_id, t->remote_sa_id);
46  return s;
47 }
48 
49 static clib_error_t *
51  unformat_input_t * input,
52  vlib_cli_command_t * cmd)
53 {
56 
57  if (pool_elts (igm->tunnels) == 0)
58  vlib_cli_output (vm, "No IPSec GRE tunnels configured...");
59 
60  /* *INDENT-OFF* */
61  pool_foreach (t, igm->tunnels,
62  ({
63  vlib_cli_output (vm, "%U", format_ipsec_gre_tunnel, t);
64  }));
65  /* *INDENT-ON* */
66 
67  return 0;
68 }
69 
70 /* *INDENT-OFF* */
71 VLIB_CLI_COMMAND (show_ipsec_gre_tunnel_command, static) = {
72  .path = "show ipsec gre tunnel",
74 };
75 /* *INDENT-ON* */
76 
77 /* force inclusion from application's main.c */
80 {
81  return 0;
82 }
83 
85 
86 /**
87  * @brief Add or delete ipsec-gre tunnel interface.
88  *
89  * @param *a vnet_ipsec_gre_add_del_tunnel_args_t - tunnel interface parameters
90  * @param *sw_if_indexp u32 - software interface index
91  * @return int - 0 if success otherwise <code>VNET_API_ERROR_</code>
92  */
93 int
95  u32 * sw_if_indexp)
96 {
98  vnet_main_t *vnm = igm->vnet_main;
99  ip4_main_t *im = &ip4_main;
102  u32 hw_if_index, sw_if_index;
103  u32 slot;
104  uword *p;
105  u64 key;
107 
108  memset (&args, 0, sizeof (args));
109  args.is_add = a->is_add;
110  args.local_sa_id = a->lsa;
111  args.remote_sa_id = a->rsa;
112  args.local_ip.as_u32 = a->src.as_u32;
113  args.remote_ip.as_u32 = a->dst.as_u32;
114 
115  key = (u64) a->src.as_u32 << 32 | (u64) a->dst.as_u32;
116  p = hash_get (igm->tunnel_by_key, key);
117 
118  if (a->is_add)
119  {
120  /* check if same src/dst pair exists */
121  if (p)
122  return VNET_API_ERROR_INVALID_VALUE;
123 
125  memset (t, 0, sizeof (*t));
126 
128  {
130 
131  hw_if_index = igm->free_ipsec_gre_tunnel_hw_if_indices
133  _vec_len (igm->free_ipsec_gre_tunnel_hw_if_indices) -= 1;
134 
135  hi = vnet_get_hw_interface (vnm, hw_if_index);
136  hi->dev_instance = t - igm->tunnels;
137  hi->hw_instance = hi->dev_instance;
138 
139  /* clear old stats of freed tunnel before reuse */
140  sw_if_index = hi->sw_if_index;
144  sw_if_index);
147  sw_if_index);
149  (&im->sw_if_counters[VNET_INTERFACE_COUNTER_DROP], sw_if_index);
151  }
152  else
153  {
154  hw_if_index = vnet_register_interface
155  (vnm, ipsec_gre_device_class.index, t - igm->tunnels,
156  ipsec_gre_hw_interface_class.index, t - igm->tunnels);
157  hi = vnet_get_hw_interface (vnm, hw_if_index);
158  sw_if_index = hi->sw_if_index;
159  }
160 
161  t->hw_if_index = hw_if_index;
163  t->local_sa_id = a->lsa;
164  t->remote_sa_id = a->rsa;
167 
168  ip4_sw_interface_enable_disable (sw_if_index, 1);
169 
171  sw_if_index, ~0);
173 
174  vec_validate (im->fib_index_by_sw_if_index, sw_if_index);
175 
176  hi->min_packet_bytes = 64 + sizeof (gre_header_t) +
177  sizeof (ip4_header_t) + sizeof (esp_header_t) + sizeof (esp_footer_t);
178 
179  /* Standard default gre MTU. */
180  /* TODO: Should take tunnel overhead into consideration */
181  vnet_sw_interface_set_mtu (vnm, sw_if_index, 9000);
182 
183  clib_memcpy (&t->tunnel_src, &a->src, sizeof (t->tunnel_src));
184  clib_memcpy (&t->tunnel_dst, &a->dst, sizeof (t->tunnel_dst));
185 
186  hash_set (igm->tunnel_by_key, key, t - igm->tunnels);
187 
189  (vnm->vlib_main, hi->tx_node_index, "esp-encrypt",
191 
193 
194  }
195  else
196  { /* !is_add => delete */
197  /* tunnel needs to exist */
198  if (!p)
199  return VNET_API_ERROR_NO_SUCH_ENTRY;
200 
201  t = pool_elt_at_index (igm->tunnels, p[0]);
202 
203  sw_if_index = t->sw_if_index;
204  ip4_sw_interface_enable_disable (sw_if_index, 0);
205  vnet_sw_interface_set_flags (vnm, sw_if_index, 0 /* down */ );
206  /* make sure tunnel is removed from l2 bd or xconnect */
207  set_int_l2_mode (igm->vlib_main, vnm, MODE_L3, sw_if_index, 0,
208  L2_BD_PORT_TYPE_NORMAL, 0, 0);
211 
212  hash_unset (igm->tunnel_by_key, key);
213  pool_put (igm->tunnels, t);
214  }
215 
216  if (sw_if_indexp)
217  *sw_if_indexp = sw_if_index;
218 
219  return ipsec_add_del_ipsec_gre_tunnel (vnm, &args);
220 }
221 
222 static clib_error_t *
224  unformat_input_t * input,
225  vlib_cli_command_t * cmd)
226 {
227  unformat_input_t _line_input, *line_input = &_line_input;
228  u8 is_add = 1;
229  u32 num_m_args = 0;
231  u32 lsa = 0, rsa = 0;
233  int rv;
235  clib_error_t *error = NULL;
236 
237  /* Get a line of input. */
238  if (!unformat_user (input, unformat_line_input, line_input))
239  return 0;
240 
241  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
242  {
243  if (unformat (line_input, "del"))
244  is_add = 0;
245  else if (unformat (line_input, "src %U", unformat_ip4_address, &src))
246  num_m_args++;
247  else if (unformat (line_input, "dst %U", unformat_ip4_address, &dst))
248  num_m_args++;
249  else if (unformat (line_input, "local-sa %d", &lsa))
250  num_m_args++;
251  else if (unformat (line_input, "remote-sa %d", &rsa))
252  num_m_args++;
253  else
254  {
255  error = clib_error_return (0, "unknown input `%U'",
256  format_unformat_error, line_input);
257  goto done;
258  }
259  }
260 
261  if (num_m_args < 4)
262  {
263  error = clib_error_return (0, "mandatory argument(s) missing");
264  goto done;
265  }
266 
267  if (memcmp (&src, &dst, sizeof (src)) == 0)
268  {
269  error = clib_error_return (0, "src and dst are identical");
270  goto done;
271  }
272 
273  memset (a, 0, sizeof (*a));
274  a->is_add = is_add;
275  a->lsa = lsa;
276  a->rsa = rsa;
277  clib_memcpy (&a->src, &src, sizeof (src));
278  clib_memcpy (&a->dst, &dst, sizeof (dst));
279 
280  rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index);
281 
282  switch (rv)
283  {
284  case 0:
286  vnet_get_main (), sw_if_index);
287  break;
288  case VNET_API_ERROR_INVALID_VALUE:
289  error = clib_error_return (0, "GRE tunnel already exists...");
290  goto done;
291  default:
292  error = clib_error_return (0,
293  "vnet_ipsec_gre_add_del_tunnel returned %d",
294  rv);
295  goto done;
296  }
297 
298 done:
299  unformat_free (line_input);
300 
301  return error;
302 }
303 
304 /* *INDENT-OFF* */
305 VLIB_CLI_COMMAND (create_ipsec_gre_tunnel_command, static) = {
306  .path = "create ipsec gre tunnel",
307  .short_help = "create ipsec gre tunnel src <addr> dst <addr> "
308  "local-sa <id> remote-sa <id> [del]",
310 };
311 /* *INDENT-ON* */
312 
313 /*
314 * fd.io coding-style-patch-verification: ON
315 *
316 * Local Variables:
317 * eval: (c-set-style "gnu")
318 * End:
319 */
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
Definition: vec.h:437
vmrglw vmrglh hi
#define hash_set(h, key, value)
Definition: hash.h:255
ip4_address_t tunnel_dst
tunnel IPv4 dst address
Definition: ipsec_gre.h:55
vl_api_address_t src
Definition: vxlan_gbp.api:33
#define hash_unset(h, key)
Definition: hash.h:261
a
Definition: bitmap.h:538
vnet_main_t * vnet_get_main(void)
Definition: misc.c:47
u32 remote_sa
remote IPSec SA index
Definition: ipsec_gre.h:57
L2-GRE over IPSec packet processing.
vnet_interface_main_t interface_main
Definition: vnet.h:56
uword vlib_node_add_named_next_with_slot(vlib_main_t *vm, uword node, char *name, uword slot)
Definition: node.c:262
unsigned long u64
Definition: types.h:89
#define NULL
Definition: clib.h:57
static vnet_hw_interface_t * vnet_get_hw_interface(vnet_main_t *vnm, u32 hw_if_index)
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:523
static clib_error_t * show_ipsec_gre_tunnel_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: interface.c:50
uword unformat_user(unformat_input_t *input, unformat_function_t *func,...)
Definition: unformat.c:983
u32 * fib_index_by_sw_if_index
Table index indexed by software interface.
Definition: ip4.h:112
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
u32 ipsec_get_sa_index_by_sa_id(u32 sa_id)
Definition: ipsec.c:33
u8 * format_ipsec_gre_tunnel(u8 *s, va_list *args)
Definition: interface.c:35
format_function_t format_vnet_sw_if_index_name
unsigned char u8
Definition: types.h:56
#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT
Definition: ipsec_gre.h:89
ipsec_gre_tunnel_t * tunnels
pool of tunnel instances
Definition: ipsec_gre.h:70
format_function_t format_ip4_address
Definition: format.h:75
memset(h->entries, 0, sizeof(h->entries[0])*entries)
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:443
unformat_function_t unformat_ip4_address
Definition: format.h:70
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:163
u32 sw_if_index
Definition: vxlan_gbp.api:39
vlib_combined_counter_main_t * combined_sw_if_counters
Definition: interface.h:855
ipsec_gre_main_t ipsec_gre_main
Definition: ipsec_gre.c:25
int ipsec_add_del_ipsec_gre_tunnel(vnet_main_t *vnm, ipsec_add_del_ipsec_gre_tunnel_args_t *args)
Definition: ipsec_if.c:424
#define clib_error_return(e, args...)
Definition: error.h:99
vnet_hw_interface_class_t ipsec_gre_hw_interface_class
unsigned int u32
Definition: types.h:88
u32 vnet_register_interface(vnet_main_t *vnm, u32 dev_class_index, u32 dev_instance, u32 hw_class_index, u32 hw_instance)
Definition: interface.c:703
u32 sw_if_index
hardware interface index
Definition: ipsec_gre.h:60
u32 remote_sa_id
remote IPSec SA id
Definition: ipsec_gre.h:59
IPSec-GRE tunnel add/del arguments.
Definition: ipsec_gre.h:95
unformat_function_t unformat_line_input
Definition: format.h:282
uword * tunnel_by_key
hash mapping src/dst addr pair to tunnel
Definition: ipsec_gre.h:72
#define hash_get(h, key)
Definition: hash.h:249
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:464
static void vlib_zero_combined_counter(vlib_combined_counter_main_t *cm, u32 index)
Clear a combined counter Clears the set of per-thread counters.
Definition: counter.h:269
clib_error_t * ipsec_gre_interface_init(vlib_main_t *vm)
Definition: interface.c:79
void ip4_sw_interface_enable_disable(u32 sw_if_index, u32 is_enable)
Definition: ip4_forward.c:524
vlib_main_t * vlib_main
Definition: vnet.h:80
#define gm
Definition: dlmalloc.c:1217
struct _unformat_input_t unformat_input_t
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:274
u32 local_sa
local IPSec SA index
Definition: ipsec_gre.h:56
vlib_simple_counter_main_t * sw_if_counters
Definition: interface.h:854
#define pool_get_aligned(P, E, A)
Allocate an object E from a pool P (general version).
Definition: pool.h:188
u8 is_add
1 - add, 0 - delete
Definition: ipsec_gre.h:97
u32 * tunnel_index_by_sw_if_index
mapping from sw_if_index to tunnel index
Definition: ipsec_gre.h:76
#define UNFORMAT_END_OF_INPUT
Definition: format.h:144
vlib_main_t * vm
Definition: buffer.c:294
vl_api_address_t dst
Definition: vxlan_gbp.api:34
#define clib_memcpy(a, b, c)
Definition: string.h:75
static void vnet_interface_counter_unlock(vnet_interface_main_t *im)
Definition: interface.h:880
IPSec-GRE state.
Definition: ipsec_gre.h:68
u32 rsa
remote IPSec SA id
Definition: ipsec_gre.h:102
int vnet_ipsec_gre_add_del_tunnel(vnet_ipsec_gre_add_del_tunnel_args_t *a, u32 *sw_if_indexp)
Add or delete ipsec-gre tunnel interface.
Definition: interface.c:94
#define VLIB_CLI_COMMAND(x,...)
Definition: cli.h:155
static void vnet_interface_counter_lock(vnet_interface_main_t *im)
Definition: interface.h:872
ip4_address_t src
tunnel IPv4 src address
Definition: ipsec_gre.h:99
#define ASSERT(truth)
vnet_device_class_t ipsec_gre_device_class
IPSec-GRE tunnel parameters.
Definition: ipsec_gre.h:50
IPv4 main type.
Definition: ip4.h:96
u32 set_int_l2_mode(vlib_main_t *vm, vnet_main_t *vnet_main, u32 mode, u32 sw_if_index, u32 bd_index, l2_bd_port_type_t port_type, u32 shg, u32 xc_sw_if_index)
Set the subinterface to run in l2 or l3 mode.
Definition: l2_input.c:572
static void vlib_zero_simple_counter(vlib_simple_counter_main_t *cm, u32 index)
Clear a simple counter Clears the set of per-thread u16 counters, and the u64 counter.
Definition: counter.h:123
vnet_main_t * vnet_main
convenience
Definition: ipsec_gre.h:80
u32 local_sa_id
local IPSec SA id
Definition: ipsec_gre.h:58
ip4_address_t dst
tunnel IPv4 dst address
Definition: ipsec_gre.h:100
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
u64 uword
Definition: types.h:112
static void unformat_free(unformat_input_t *i)
Definition: format.h:162
void vnet_sw_interface_set_mtu(vnet_main_t *vnm, u32 sw_if_index, u32 mtu)
Definition: interface.c:605
u32 * free_ipsec_gre_tunnel_hw_if_indices
free vlib hw_if_indices
Definition: ipsec_gre.h:74
u8 * format_unformat_error(u8 *s, va_list *va)
Definition: unformat.c:91
ip4_main_t ip4_main
Global ip4 main structure.
Definition: ip4_forward.c:900
clib_error_t * vnet_sw_interface_set_flags(vnet_main_t *vnm, u32 sw_if_index, u32 flags)
Definition: interface.c:477
static clib_error_t * create_ipsec_gre_tunnel_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
Definition: interface.c:223
#define vec_validate_init_empty(V, I, INIT)
Make sure vector is long enough for given index and initialize empty space (no header, unspecified alignment)
Definition: vec.h:486
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
Definition: cli.c:725
vlib_main_t * vlib_main
convenience
Definition: ipsec_gre.h:79
uword unformat(unformat_input_t *i, const char *fmt,...)
Definition: unformat.c:972
ip4_address_t tunnel_src
tunnel IPv4 src address
Definition: ipsec_gre.h:54
static uword unformat_check_input(unformat_input_t *i)
Definition: format.h:170
#define MODE_L3
Definition: l2_input.h:205
static uword pool_elts(void *v)
Number of active elements in a pool.
Definition: pool.h:128