summaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec
diff options
context:
space:
mode:
Diffstat (limited to 'src/vnet/ipsec')
-rw-r--r--src/vnet/ipsec/esp_encrypt.c81
-rw-r--r--src/vnet/ipsec/ipsec.h8
-rw-r--r--src/vnet/ipsec/ipsec_if.c214
3 files changed, 178 insertions, 125 deletions
diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index 6e5007151b9..ebcf0ed8e08 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -220,7 +220,7 @@ esp_process_ops (vlib_main_t * vm, vlib_node_runtime_t * node,
always_inline uword
esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
- vlib_frame_t * frame, int is_ip6)
+ vlib_frame_t * frame, int is_ip6, int is_tun)
{
ipsec_main_t *im = &ipsec_main;
ipsec_per_thread_data_t *ptd = vec_elt_at_index (im->ptd, vm->thread_index);
@@ -258,7 +258,19 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
CLIB_PREFETCH (p, CLIB_CACHE_LINE_BYTES, LOAD);
}
- if (vnet_buffer (b[0])->ipsec.sad_index != current_sa_index)
+ if (is_tun)
+ {
+ /* we are on a ipsec tunnel's feature arc */
+ u32 next0;
+ sa_index0 = *(u32 *) vnet_feature_next_with_data (&next0, b[0],
+ sizeof
+ (sa_index0));
+ next[0] = next0;
+ }
+ else
+ sa_index0 = vnet_buffer (b[0])->ipsec.sad_index;
+
+ if (sa_index0 != current_sa_index)
{
sa0 = pool_elt_at_index (im->sad, sa_index0);
current_sa_index = sa_index0;
@@ -335,8 +347,11 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
}
dpo = sa0->dpo + IPSEC_PROTOCOL_ESP;
- next[0] = dpo->dpoi_next_node;
- vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
+ if (!is_tun)
+ {
+ next[0] = dpo->dpoi_next_node;
+ vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
+ }
}
else /* transport mode */
{
@@ -483,7 +498,7 @@ VLIB_NODE_FN (esp4_encrypt_node) (vlib_main_t * vm,
vlib_node_runtime_t * node,
vlib_frame_t * from_frame)
{
- return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
+ return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 0);
}
/* *INDENT-OFF* */
@@ -509,7 +524,7 @@ VLIB_NODE_FN (esp6_encrypt_node) (vlib_main_t * vm,
vlib_node_runtime_t * node,
vlib_frame_t * from_frame)
{
- return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
+ return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 0);
}
/* *INDENT-OFF* */
@@ -531,6 +546,60 @@ VLIB_REGISTER_NODE (esp6_encrypt_node) = {
};
/* *INDENT-ON* */
+VLIB_NODE_FN (esp4_encrypt_tun_node) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * from_frame)
+{
+ return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 1);
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (esp4_encrypt_tun_node) = {
+ .name = "esp4-encrypt-tun",
+ .vector_size = sizeof (u32),
+ .format_trace = format_esp_encrypt_trace,
+ .type = VLIB_NODE_TYPE_INTERNAL,
+
+ .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
+ .error_strings = esp_encrypt_error_strings,
+};
+
+VNET_FEATURE_INIT (esp4_encrypt_tun_feat_node, static) =
+{
+ .arc_name = "ip4-output",
+ .node_name = "esp4-encrypt-tun",
+ .runs_before = VNET_FEATURES ("ip4-frag",
+ "adj-midchain-tx"),
+};
+/* *INDENT-ON* */
+
+VLIB_NODE_FN (esp6_encrypt_tun_node) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * from_frame)
+{
+ return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 1);
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (esp6_encrypt_tun_node) = {
+ .name = "esp6-encrypt-tun",
+ .vector_size = sizeof (u32),
+ .format_trace = format_esp_encrypt_trace,
+ .type = VLIB_NODE_TYPE_INTERNAL,
+
+ .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
+ .error_strings = esp_encrypt_error_strings,
+};
+
+VNET_FEATURE_INIT (esp6_encrypt_tun_feat_node, static) =
+{
+ .arc_name = "ip6-output",
+ .node_name = "esp6-encrypt-tun",
+ .runs_before = VNET_FEATURES ("ip6-frag",
+ "adj-midchain-tx"),
+};
+/* *INDENT-ON* */
+
/*
* fd.io coding-style-patch-verification: ON
*
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index 9a5dbb3e8b2..47b3ed370b8 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -109,6 +109,7 @@ typedef struct
uword *ipsec4_if_pool_index_by_key;
uword *ipsec6_if_pool_index_by_key;
uword *ipsec_if_real_dev_by_show_dev;
+ uword *ipsec_if_by_sw_if_index;
/* node indices */
u32 error_drop_node_index;
@@ -212,6 +213,13 @@ u32 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx);
int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx);
+
+always_inline ipsec_sa_t *
+ipsec_sa_get (u32 sa_index)
+{
+ return (pool_elt_at_index (ipsec_main.sad, sa_index));
+}
+
#endif /* __IPSEC_H__ */
/*
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index b1c05346dd0..304c52eac7c 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -20,6 +20,7 @@
#include <vnet/ip/ip.h>
#include <vnet/fib/fib.h>
#include <vnet/udp/udp.h>
+#include <vnet/adj/adj_midchain.h>
#include <vnet/ipsec/ipsec.h>
#include <vnet/ipsec/esp.h>
@@ -40,121 +41,68 @@ format_ipsec_name (u8 * s, va_list * args)
#define foreach_ipsec_if_tx_error \
_(TX, "good packets transmitted")
-static char *ipsec_if_tx_error_strings[] = {
-#define _(sym,string) string,
- foreach_ipsec_if_tx_error
-#undef _
-};
-
-typedef enum
-{
-#define _(sym,str) IPSEC_IF_OUTPUT_ERROR_##sym,
- foreach_ipsec_if_tx_error
-#undef _
- IPSEC_IF_TX_N_ERROR,
-} ipsec_if_tx_error_t;
-
-typedef struct
-{
- u32 spi;
- u32 seq;
-} ipsec_if_tx_trace_t;
-
-u8 *
-format_ipsec_if_tx_trace (u8 * s, va_list * args)
+static void
+ipsec_if_tunnel_stack (adj_index_t ai)
{
- CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
- CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
- ipsec_if_tx_trace_t *t = va_arg (*args, ipsec_if_tx_trace_t *);
+ ipsec_main_t *ipm = &ipsec_main;
+ ipsec_tunnel_if_t *it;
+ ip_adjacency_t *adj;
+ u32 sw_if_index;
- s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq);
- return s;
-}
+ adj = adj_get (ai);
+ sw_if_index = adj->rewrite_header.sw_if_index;
-static void
-ipsec_output_trace (vlib_main_t * vm,
- vlib_node_runtime_t * node,
- vlib_frame_t * frame, const ipsec_tunnel_if_t * t0)
-{
- ipsec_main_t *im = &ipsec_main;
- u32 *from, n_left;
+ if ((vec_len (ipm->ipsec_if_by_sw_if_index) <= sw_if_index) ||
+ (~0 == ipm->ipsec_if_by_sw_if_index[sw_if_index]))
+ return;
- n_left = frame->n_vectors;
- from = vlib_frame_vector_args (frame);
+ it = pool_elt_at_index (ipm->tunnel_interfaces,
+ ipm->ipsec_if_by_sw_if_index[sw_if_index]);
- while (n_left > 0)
+ if (!vnet_hw_interface_is_link_up (vnet_get_main (), it->hw_if_index))
{
- vlib_buffer_t *b0;
+ adj_midchain_delegate_unstack (ai);
+ }
+ else
+ {
+ ipsec_sa_t *sa;
- b0 = vlib_get_buffer (vm, from[0]);
+ sa = ipsec_sa_get (it->output_sa_index);
- if (b0->flags & VLIB_BUFFER_IS_TRACED)
- {
- ipsec_if_tx_trace_t *tr =
- vlib_add_trace (vm, node, b0, sizeof (*tr));
- ipsec_sa_t *sa0 = pool_elt_at_index (im->sad, t0->output_sa_index);
- tr->spi = sa0->spi;
- tr->seq = sa0->seq;
- }
+ fib_prefix_t pfx = {
+ .fp_addr = sa->tunnel_dst_addr,
+ .fp_len = (sa->is_tunnel_ip6 ? 128 : 32),
+ .fp_proto = (sa->is_tunnel_ip6 ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4),
+ };
- from += 1;
- n_left -= 1;
+ adj_midchain_delegate_stack (ai, sa->tx_fib_index, &pfx);
}
}
-VNET_DEVICE_CLASS_TX_FN (ipsec_device_class) (vlib_main_t * vm,
- vlib_node_runtime_t * node,
- vlib_frame_t * frame)
+/**
+ * @brief Call back when restacking all adjacencies on a GRE interface
+ */
+static adj_walk_rc_t
+ipsec_if_adj_walk_cb (adj_index_t ai, void *ctx)
{
- ipsec_main_t *im = &ipsec_main;
- u32 *from, n_left;
- vnet_interface_output_runtime_t *rd = (void *) node->runtime_data;
- const ipsec_tunnel_if_t *t0;
- vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
- u16 nexts[VLIB_FRAME_SIZE];
-
- from = vlib_frame_vector_args (frame);
- t0 = pool_elt_at_index (im->tunnel_interfaces, rd->dev_instance);
- n_left = frame->n_vectors;
- b = bufs;
-
- /* All going to encrypt */
- clib_memset (nexts, 0, sizeof (nexts));
-
- if (node->flags & VLIB_NODE_FLAG_TRACE)
- ipsec_output_trace (vm, node, frame, t0);
-
- vlib_get_buffers (vm, from, bufs, n_left);
+ ipsec_if_tunnel_stack (ai);
- while (n_left >= 8)
- {
- /* Prefetch the buffer header for the N+2 loop iteration */
- vlib_prefetch_buffer_header (b[4], STORE);
- vlib_prefetch_buffer_header (b[5], STORE);
- vlib_prefetch_buffer_header (b[6], STORE);
- vlib_prefetch_buffer_header (b[7], STORE);
-
- vnet_buffer (b[0])->ipsec.sad_index = t0->output_sa_index;
- vnet_buffer (b[1])->ipsec.sad_index = t0->output_sa_index;
- vnet_buffer (b[2])->ipsec.sad_index = t0->output_sa_index;
- vnet_buffer (b[3])->ipsec.sad_index = t0->output_sa_index;
-
- n_left -= 4;
- b += 4;
- }
- while (n_left > 0)
- {
- vnet_buffer (b[0])->ipsec.sad_index = t0->output_sa_index;
-
- n_left -= 1;
- b += 1;
- }
-
- vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
-
- return frame->n_vectors;
+ return (ADJ_WALK_RC_CONTINUE);
}
+static void
+ipsec_if_tunnel_restack (ipsec_tunnel_if_t * it)
+{
+ fib_protocol_t proto;
+
+ /*
+ * walk all the adjacencies on th GRE interface and restack them
+ */
+ FOR_EACH_FIB_IP_PROTOCOL (proto)
+ {
+ adj_nbr_walk (it->sw_if_index, proto, ipsec_if_adj_walk_cb, NULL);
+ }
+}
static clib_error_t *
ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
@@ -207,18 +155,34 @@ ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
return err;
}
- return /* no error */ 0;
+ ipsec_if_tunnel_restack (t);
+
+ return (NULL);
}
+static u8 *
+ipsec_if_build_rewrite (vnet_main_t * vnm,
+ u32 sw_if_index,
+ vnet_link_t link_type, const void *dst_address)
+{
+ return (NULL);
+}
+
+static void
+ipsec_if_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
+{
+ adj_nbr_midchain_update_rewrite
+ (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK,
+ ipsec_if_build_rewrite (vnm, sw_if_index, adj_get_link_type (ai), NULL));
+
+ ipsec_if_tunnel_stack (ai);
+}
/* *INDENT-OFF* */
VNET_DEVICE_CLASS (ipsec_device_class) =
{
.name = "IPSec",
.format_device_name = format_ipsec_name,
- .format_tx_trace = format_ipsec_if_tx_trace,
- .tx_function_n_errors = IPSEC_IF_TX_N_ERROR,
- .tx_function_error_strings = ipsec_if_tx_error_strings,
.admin_up_down_function = ipsec_admin_up_down_function,
};
/* *INDENT-ON* */
@@ -228,6 +192,7 @@ VNET_HW_INTERFACE_CLASS (ipsec_hw_class) =
{
.name = "IPSec",
.build_rewrite = default_build_rewrite,
+ .update_adjacency = ipsec_if_update_adj,
.flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
};
/* *INDENT-ON* */
@@ -380,21 +345,25 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
hi = vnet_get_hw_interface (vnm, hw_if_index);
- /* add esp4/6 as the next-node-index of this tx-node */
- uword slot = vlib_node_add_next_with_slot
- (vnm->vlib_main, hi->tx_node_index,
- is_ip6 ? im->esp6_encrypt_node_index : im->esp4_encrypt_node_index,
- 0);
-
- ASSERT (slot == 0);
-
t->hw_if_index = hw_if_index;
t->sw_if_index = hi->sw_if_index;
- vnet_feature_enable_disable ("interface-output",
- args->is_ip6 ? "ipsec6-if-output" :
- "ipsec4-if-output", hi->sw_if_index, 1, 0,
- 0);
+ /* Add the new tunnel to the DB of tunnels per sw_if_index ... */
+ vec_validate_init_empty (im->ipsec_if_by_sw_if_index, t->sw_if_index,
+ ~0);
+ im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance;
+
+ vnet_feature_enable_disable ("ip4-output",
+ "esp4-encrypt-tun",
+ t->sw_if_index, 1,
+ &t->output_sa_index,
+ sizeof (t->output_sa_index));
+ vnet_feature_enable_disable ("ip6-output",
+ "esp6-encrypt-tun",
+ t->sw_if_index, 1,
+ &t->output_sa_index,
+ sizeof (t->output_sa_index));
+
/*1st interface, register protocol */
if (pool_elts (im->tunnel_interfaces) == 1)
{
@@ -418,10 +387,16 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
hi = vnet_get_hw_interface (vnm, t->hw_if_index);
vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0); /* admin down */
- vnet_feature_enable_disable ("interface-output",
- args->is_ip6 ? "ipsec6-if-output" :
- "ipsec4-if-output", hi->sw_if_index, 0, 0,
- 0);
+ vnet_feature_enable_disable ("ip4-output",
+ "esp4-encrypt-tun",
+ hi->sw_if_index, 0,
+ &t->output_sa_index,
+ sizeof (t->output_sa_index));
+ vnet_feature_enable_disable ("ip6-output",
+ "esp6-encrypt-tun",
+ hi->sw_if_index, 0,
+ &t->output_sa_index,
+ sizeof (t->output_sa_index));
vnet_delete_hw_interface (vnm, t->hw_if_index);
if (is_ip6)
@@ -430,6 +405,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
hash_unset (im->ipsec4_if_pool_index_by_key, key4.as_u64);
hash_unset (im->ipsec_if_real_dev_by_show_dev, t->show_instance);
+ im->ipsec_if_by_sw_if_index[t->sw_if_index] = ~0;
pool_put (im->tunnel_interfaces, t);