summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNeale Ranns <nranns@cisco.com>2020-01-20 02:28:00 +0000
committerNeale Ranns <nranns@cisco.com>2020-01-22 21:04:58 +0000
commitda5dedfe33ca3cafb4cd6d90d34219d31cf69acb (patch)
tree78b9e094e862e348c1ba3fa26683898b6dc2759f
parentc0c4eec3bc309bcc656eade82f17754875f9ed7c (diff)
fib: FIB crash removing labelled route (VPP-1818)
Type: fix The crash occured trying to retreive a NULL path list to walk the path extensions. A walk shoul not be required, because there should be no extensins, since all paths are removed. The problem is that when the paths were added, they were not sorted, hence neither were the extensions and when they were updated, duplicate extensions were added, and hence a path removal did not remove them all. Fix is to make sure paths are sorted. Change-Id: I069d937de8e7bc8aae3d92f588db4daff727d863 Signed-off-by: Neale Ranns <nranns@cisco.com> (cherry picked from commit 257749c40946a9269140d322e374d74c3b6eefb8)
Diffstat
-rw-r--r--src/vnet/fib/fib_table.c19
1 files changed, 12 insertions, 7 deletions
diff --git a/src/vnet/fib/fib_table.c b/src/vnet/fib/fib_table.c
index ac0f2da6696..ec2acc59c52 100644
--- a/src/vnet/fib/fib_table.c
+++ b/src/vnet/fib/fib_table.c
@@ -580,6 +580,13 @@ fib_table_entry_path_add (u32 fib_index,
return (fib_entry_index);
}
+static int
+fib_route_path_cmp_for_sort (void * v1,
+ void * v2)
+{
+ return (fib_route_path_cmp(v1, v2));
+}
+
fib_node_index_t
fib_table_entry_path_add2 (u32 fib_index,
const fib_prefix_t *prefix,
@@ -598,6 +605,11 @@ fib_table_entry_path_add2 (u32 fib_index,
{
fib_table_route_path_fixup(prefix, &flags, &rpaths[ii]);
}
+ /*
+ * sort the paths provided by the control plane. this means
+ * the paths and the extension on the entry will be sorted.
+ */
+ vec_sort_with_function(rpaths, fib_route_path_cmp_for_sort);
if (FIB_NODE_INDEX_INVALID == fib_entry_index)
{
@@ -740,13 +752,6 @@ fib_table_entry_path_remove (u32 fib_index,
vec_free(paths);
}
-static int
-fib_route_path_cmp_for_sort (void * v1,
- void * v2)
-{
- return (fib_route_path_cmp(v1, v2));
-}
-
fib_node_index_t
fib_table_entry_update (u32 fib_index,
const fib_prefix_t *prefix,
203' href='#n203'>203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 
/*
 * Copyright (c) 2020 Cisco and/or its affiliates.
 * Copyright (c) 2020 Doc.ai and/or its affiliates.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <vnet/adj/adj_midchain.h>
#include <vnet/udp/udp.h>

#include <wireguard/wireguard_messages.h>
#include <wireguard/wireguard_if.h>
#include <wireguard/wireguard.h>
#include <wireguard/wireguard_peer.h>

/* pool of interfaces */
wg_if_t *wg_if_pool;

/* bitmap of Allocated WG_ITF instances */
static uword *wg_if_instances;

/* vector of interfaces key'd on their sw_if_index */
static index_t *wg_if_index_by_sw_if_index;

/* vector of interfaces key'd on their UDP port (in network order) */
index_t **wg_if_indexes_by_port;

static u8 *
format_wg_if_name (u8 * s, va_list * args)
{
  u32 dev_instance = va_arg (*args, u32);
  return format (s, "wg%d", dev_instance);
}

u8 *
format_wg_if (u8 * s, va_list * args)
{
  index_t wgii = va_arg (*args, u32);
  wg_if_t *wgi = wg_if_get (wgii);
  noise_local_t *local = noise_local_get (wgi->local_idx);
  u8 key[NOISE_KEY_LEN_BASE64];

  s = format (s, "[%d] %U src:%U port:%d",
	      wgii,
	      format_vnet_sw_if_index_name, vnet_get_main (),
	      wgi->sw_if_index, format_ip_address, &wgi->src_ip, wgi->port);

  key_to_base64 (local->l_private, NOISE_PUBLIC_KEY_LEN, key);

  s = format (s, " private-key:%s", key);
  s =
    format (s, " %U", format_hex_bytes, local->l_private,
	    NOISE_PUBLIC_KEY_LEN);

  key_to_base64 (local->l_public, NOISE_PUBLIC_KEY_LEN, key);

  s = format (s, " public-key:%s", key);

  s =
    format (s, " %U", format_hex_bytes, local->l_public,
	    NOISE_PUBLIC_KEY_LEN);

  s = format (s, " mac-key: %U", format_hex_bytes,
	      &wgi->cookie_checker.cc_mac1_key, NOISE_PUBLIC_KEY_LEN);

  return (s);
}

index_t
wg_if_find_by_sw_if_index (u32 sw_if_index)
{
  if (vec_len (wg_if_index_by_sw_if_index) <= sw_if_index)
    return INDEX_INVALID;
  u32 ti = wg_if_index_by_sw_if_index[sw_if_index];
  if (ti == ~0)
    return INDEX_INVALID;

  return (ti);
}

static walk_rc_t
wg_if_find_peer_by_public_key (index_t peeri, void *data)
{
  uint8_t *public = data;
  wg_peer_t *peer = wg_peer_get (peeri);

  if (!memcmp (peer->remote.r_public, public, NOISE_PUBLIC_KEY_LEN))
    return (WALK_STOP);
  return (WALK_CONTINUE);
}

static noise_remote_t *
wg_remote_get (const uint8_t public[NOISE_PUBLIC_KEY_LEN])
{
  index_t peeri;

  peeri = wg_peer_walk (wg_if_find_peer_by_public_key, (void *) public);

  if (INDEX_INVALID != peeri)
    return &wg_peer_get (peeri)->remote;

  return NULL;
}

static uint32_t
wg_index_set (noise_remote_t * remote)
{
  wg_main_t *wmp = &wg_main;
  u32 rnd_seed = (u32) (vlib_time_now (wmp->vlib_main) * 1e6);
  u32 ret =
    wg_index_table_add (&wmp->index_table, remote->r_peer_idx, rnd_seed);
  return ret;
}

static void
wg_index_drop (uint32_t key)
{
  wg_main_t *wmp = &wg_main;
  wg_index_table_del (&wmp->index_table, key);
}

static clib_error_t *
wg_if_admin_up_down (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
{
  vnet_hw_interface_t *hi;
  index_t wgii;
  u32 hw_flags;

  hi = vnet_get_hw_interface (vnm, hw_if_index);
  hw_flags = (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP ?
	      VNET_HW_INTERFACE_FLAG_LINK_UP : 0);
  vnet_hw_interface_set_flags (vnm, hw_if_index, hw_flags);

  wgii = wg_if_find_by_sw_if_index (hi->sw_if_index);

  wg_if_peer_walk (wg_if_get (wgii), wg_peer_if_admin_state_change, NULL);

  return (NULL);
}

void
wg_if_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
{
  index_t wgii;

  wgii = wg_if_find_by_sw_if_index (sw_if_index);
  wg_if_peer_walk (wg_if_get (wgii), wg_peer_if_adj_change, &ai);
}


/* *INDENT-OFF* */
VNET_DEVICE_CLASS (wg_if_device_class) = {
  .name = "Wireguard Tunnel",
  .format_device_name = format_wg_if_name,
  .admin_up_down_function = wg_if_admin_up_down,
};

VNET_HW_INTERFACE_CLASS(wg_hw_interface_class) = {
  .name = "Wireguard",
  .update_adjacency = wg_if_update_adj,
  .flags = VNET_HW_INTERFACE_CLASS_FLAG_NBMA,
};
/* *INDENT-ON* */

/*
 * Maintain a bitmap of allocated wg_if instance numbers.
 */
#define WG_ITF_MAX_INSTANCE		(16 * 1024)

static u32
wg_if_instance_alloc (u32 want)
{
  /*
   * Check for dynamically allocated instance number.
   */
  if (~0 == want)
    {
      u32 bit;

      bit = clib_bitmap_first_clear (wg_if_instances);
      if (bit >= WG_ITF_MAX_INSTANCE)
	{
	  return ~0;
	}
      wg_if_instances = clib_bitmap_set (wg_if_instances, bit, 1);
      return bit;
    }

  /*
   * In range?
   */
  if (want >= WG_ITF_MAX_INSTANCE)
    {
      return ~0;
    }

  /*
   * Already in use?
   */
  if (clib_bitmap_get (wg_if_instances, want))
    {
      return ~0;
    }

  /*
   * Grant allocation request.
   */
  wg_if_instances = clib_bitmap_set (wg_if_instances, want, 1);

  return want;
}

static int
wg_if_instance_free (u32 instance)
{
  if (instance >= WG_ITF_MAX_INSTANCE)
    {
      return -1;
    }

  if (clib_bitmap_get (wg_if_instances, instance) == 0)
    {
      return -1;
    }

  wg_if_instances = clib_bitmap_set (wg_if_instances, instance, 0);
  return 0;
}


int
wg_if_create (u32 user_instance,
	      const u8 private_key[NOISE_PUBLIC_KEY_LEN],
	      u16 port, const ip_address_t * src_ip, u32 * sw_if_indexp)
{
  vnet_main_t *vnm = vnet_get_main ();
  u32 instance, hw_if_index;
  vnet_hw_interface_t *hi;
  wg_if_t *wg_if;
  noise_local_t *local;

  ASSERT (sw_if_indexp);

  *sw_if_indexp = (u32) ~ 0;

  /*
   * Allocate a wg_if instance. Either select on dynamically
   * or try to use the desired user_instance number.
   */
  instance = wg_if_instance_alloc (user_instance);
  if (instance == ~0)
    return VNET_API_ERROR_INVALID_REGISTRATION;

  /* *INDENT-OFF* */
  struct noise_upcall upcall =  {
    .u_remote_get = wg_remote_get,
    .u_index_set = wg_index_set,
    .u_index_drop = wg_index_drop,
  };
  /* *INDENT-ON* */

  pool_get (noise_local_pool, local);

  noise_local_init (local, &upcall);
  if (!noise_local_set_private (local, private_key))
    {
      pool_put (noise_local_pool, local);
      wg_if_instance_free (instance);
      return VNET_API_ERROR_INVALID_REGISTRATION;
    }

  pool_get (wg_if_pool, wg_if);

  /* tunnel index (or instance) */
  u32 t_idx = wg_if - wg_if_pool;

  wg_if->user_instance = instance;
  if (~0 == wg_if->user_instance)
    wg_if->user_instance = t_idx;

  vec_validate_init_empty (wg_if_indexes_by_port, port, NULL);
  if (vec_len (wg_if_indexes_by_port[port]) == 0)
    {
      udp_register_dst_port (vlib_get_main (), port, wg4_input_node.index,
			     UDP_IP4);
      udp_register_dst_port (vlib_get_main (), port, wg6_input_node.index,
			     UDP_IP6);
    }

  vec_add1 (wg_if_indexes_by_port[port], t_idx);

  wg_if->port = port;
  wg_if->local_idx = local - noise_local_pool;
  cookie_checker_update (&wg_if->cookie_checker, local->l_public);

  hw_if_index = vnet_register_interface (vnm,
					 wg_if_device_class.index,
					 t_idx,
					 wg_hw_interface_class.index, t_idx);

  hi = vnet_get_hw_interface (vnm, hw_if_index);

  vec_validate_init_empty (wg_if_index_by_sw_if_index, hi->sw_if_index,
			   INDEX_INVALID);
  wg_if_index_by_sw_if_index[hi->sw_if_index] = t_idx;

  ip_address_copy (&wg_if->src_ip, src_ip);
  wg_if->sw_if_index = *sw_if_indexp = hi->sw_if_index;
  vnet_set_interface_l3_output_node (vnm->vlib_main, hi->sw_if_index,
				     (u8 *) "tunnel-output");

  return 0;
}

int
wg_if_delete (u32 sw_if_index)
{
  vnet_main_t *vnm = vnet_get_main ();

  if (pool_is_free_index (vnm->interface_main.sw_interfaces, sw_if_index))
    return VNET_API_ERROR_INVALID_SW_IF_INDEX;

  vnet_hw_interface_t *hw = vnet_get_sup_hw_interface (vnm, sw_if_index);
  if (hw == 0 || hw->dev_class_index != wg_if_device_class.index)
    return VNET_API_ERROR_INVALID_VALUE;

  wg_if_t *wg_if;
  index_t wgii = wg_if_find_by_sw_if_index (sw_if_index);
  wg_if = wg_if_get (wgii);
  if (NULL == wg_if)
    return VNET_API_ERROR_INVALID_SW_IF_INDEX_2;

  if (wg_if_instance_free (wg_if->user_instance) < 0)
    return VNET_API_ERROR_INVALID_VALUE_2;

  // Remove peers before interface deletion
  wg_if_peer_walk (wg_if, wg_peer_if_delete, NULL);

  index_t *ii;
  index_t *ifs = wg_if_indexes_get_by_port (wg_if->port);
  vec_foreach (ii, ifs)
    {
      if (*ii == wgii)
	{
	  vec_del1 (ifs, ifs - ii);
	  break;
	}
    }
  if (vec_len (ifs) == 0)
    {
      udp_unregister_dst_port (vlib_get_main (), wg_if->port, 1);
      udp_unregister_dst_port (vlib_get_main (), wg_if->port, 0);
    }

  vnet_reset_interface_l3_output_node (vnm->vlib_main, sw_if_index);
  vnet_delete_hw_interface (vnm, hw->hw_if_index);
  pool_put_index (noise_local_pool, wg_if->local_idx);
  pool_put (wg_if_pool, wg_if);

  return 0;
}

void
wg_if_peer_add (wg_if_t * wgi, index_t peeri)
{
  hash_set (wgi->peers, peeri, peeri);

  if (1 == hash_elts (wgi->peers))
    {
      vnet_feature_enable_disable ("ip4-output", "wg4-output-tun",
				   wgi->sw_if_index, 1, 0, 0);
      vnet_feature_enable_disable ("ip6-output", "wg6-output-tun",
				   wgi->sw_if_index, 1, 0, 0);
    }
}

void
wg_if_peer_remove (wg_if_t * wgi, index_t peeri)
{
  hash_unset (wgi->peers, peeri);

  if (0 == hash_elts (wgi->peers))
    {
      vnet_feature_enable_disable ("ip4-output", "wg4-output-tun",
				   wgi->sw_if_index, 0, 0, 0);
      vnet_feature_enable_disable ("ip6-output", "wg6-output-tun",
				   wgi->sw_if_index, 0, 0, 0);
    }
}

void
wg_if_walk (wg_if_walk_cb_t fn, void *data)
{
  index_t wgii;

  /* *INDENT-OFF* */
  pool_foreach_index (wgii, wg_if_pool)
  {
    if (WALK_STOP == fn(wgii, data))
      break;
  }
  /* *INDENT-ON* */
}

index_t
wg_if_peer_walk (wg_if_t * wgi, wg_if_peer_walk_cb_t fn, void *data)
{
  index_t peeri, val;

  /* *INDENT-OFF* */
  hash_foreach (peeri, val, wgi->peers, {
    if (WALK_STOP == fn (peeri, data))
      return peeri;
  });
  /* *INDENT-ON* */

  return INDEX_INVALID;
}

/*
 * fd.io coding-style-patch-verification: ON
 *
 * Local Variables:
 * eval: (c-set-style "gnu")
 * End:
 */