diff options
Diffstat (limited to 'src/vnet')
| -rw-r--r-- | src/vnet/ipsec/ipsec.c | 55 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec.h | 14 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_api.c | 12 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_cli.c | 13 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_format.c | 3 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_sa.c | 23 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_sa.h | 2 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_tun.c | 6 | ||||
| -rw-r--r-- | src/vnet/ipsec/ipsec_types.api | 6 |
9 files changed, 110 insertions, 24 deletions
diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c index 95e322e87a6..0ef90673596 100644 --- a/src/vnet/ipsec/ipsec.c +++ b/src/vnet/ipsec/ipsec.c @@ -124,6 +124,61 @@ ipsec_add_node (vlib_main_t * vm, const char *node_name, *out_next_index = vlib_node_add_next (vm, prev_node->index, node->index); } +void +ipsec_add_feature (const char *arc_name, + const char *node_name, u32 * out_feature_index) +{ + u8 arc; + + arc = vnet_get_feature_arc_index (arc_name); + ASSERT (arc != (u8) ~ 0); + *out_feature_index = vnet_get_feature_index (arc, node_name); +} + +void +ipsec_unregister_udp_port (u16 port) +{ + ipsec_main_t *im = &ipsec_main; + u32 n_regs; + uword *p; + + p = hash_get (im->udp_port_registrations, port); + + ASSERT (p); + + n_regs = p[0]; + + if (0 == --n_regs) + { + udp_unregister_dst_port (vlib_get_main (), port, 1); + hash_unset (im->udp_port_registrations, port); + } + else + { + hash_unset (im->udp_port_registrations, port); + hash_set (im->udp_port_registrations, port, n_regs); + } +} + +void +ipsec_register_udp_port (u16 port) +{ + ipsec_main_t *im = &ipsec_main; + u32 n_regs; + uword *p; + + p = hash_get (im->udp_port_registrations, port); + + n_regs = (p ? p[0] : 0); + + if (0 == n_regs++) + udp_register_dst_port (vlib_get_main (), port, + ipsec4_tun_input_node.index, 1); + + hash_unset (im->udp_port_registrations, port); + hash_set (im->udp_port_registrations, port, n_regs); +} + u32 ipsec_register_ah_backend (vlib_main_t * vm, ipsec_main_t * im, const char *name, diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h index 7646ffb2ddd..603bc33ba4d 100644 --- a/src/vnet/ipsec/ipsec.h +++ b/src/vnet/ipsec/ipsec.h @@ -108,6 +108,9 @@ typedef struct /* pool of policies */ ipsec_policy_t *policies; + /* hash tables of UDP port registrations */ + uword *udp_port_registrations; + uword *tunnel_index_by_key; /* convenience */ @@ -225,8 +228,8 @@ extern vlib_node_registration_t esp4_encrypt_tun_node; extern vlib_node_registration_t esp6_encrypt_tun_node; extern vlib_node_registration_t esp4_decrypt_tun_node; extern vlib_node_registration_t esp6_decrypt_tun_node; -extern vlib_node_registration_t ipsec4_if_input_node; -extern vlib_node_registration_t ipsec6_if_input_node; +extern vlib_node_registration_t ipsec4_tun_input_node; +extern vlib_node_registration_t ipsec6_tun_input_node; /* * functions @@ -284,6 +287,13 @@ ipsec_sa_get (u32 sa_index) return (pool_elt_at_index (ipsec_main.sad, sa_index)); } +void ipsec_add_feature (const char *arc_name, const char *node_name, + u32 * out_feature_index); + +void ipsec_set_async_mode (u32 is_enabled); +extern void ipsec_register_udp_port (u16 udp_port); +extern void ipsec_unregister_udp_port (u16 udp_port); + #endif /* __IPSEC_H__ */ /* diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c index 4a55a29c288..ad2665a250c 100644 --- a/src/vnet/ipsec/ipsec_api.c +++ b/src/vnet/ipsec/ipsec_api.c @@ -374,7 +374,8 @@ static void vl_api_ipsec_sad_entry_add_del_t_handler crypto_alg, &crypto_key, integ_alg, &integ_key, flags, 0, mp->entry.salt, &tun_src, &tun_dst, - &sa_index, IPSEC_UDP_PORT_NONE); + &sa_index, htons (mp->entry.udp_src_port), + htons (mp->entry.udp_dst_port)); else rv = ipsec_sa_unlock_id (id); @@ -665,7 +666,7 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * (flags | IPSEC_SA_FLAG_IS_INBOUND), ntohl (mp->tx_table_id), mp->salt, &remote_ip, &local_ip, NULL, - IPSEC_UDP_PORT_NONE); + IPSEC_UDP_PORT_NONE, IPSEC_UDP_PORT_NONE); if (rv) goto done; @@ -680,7 +681,7 @@ vl_api_ipsec_tunnel_if_add_del_t_handler (vl_api_ipsec_tunnel_if_add_del_t * flags, ntohl (mp->tx_table_id), mp->salt, &local_ip, &remote_ip, NULL, - IPSEC_UDP_PORT_NONE); + IPSEC_UDP_PORT_NONE, IPSEC_UDP_PORT_NONE); if (rv) goto done; @@ -816,6 +817,11 @@ send_ipsec_sa_details (ipsec_sa_t * sa, void *arg) ip_address_encode (&sa->tunnel_dst_addr, IP46_TYPE_ANY, &mp->entry.tunnel_dst); } + if (ipsec_sa_is_set_UDP_ENCAP (sa)) + { + mp->entry.udp_src_port = sa->udp_hdr.src_port; + mp->entry.udp_dst_port = sa->udp_hdr.dst_port; + } mp->seq_outbound = clib_host_to_net_u64 (((u64) sa->seq)); mp->last_seq_inbound = clib_host_to_net_u64 (((u64) sa->last_seq)); diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c index 13f9efdf566..695e5f01c74 100644 --- a/src/vnet/ipsec/ipsec_cli.c +++ b/src/vnet/ipsec/ipsec_cli.c @@ -86,7 +86,8 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm, clib_error_t *error; ipsec_key_t ck = { 0 }; ipsec_key_t ik = { 0 }; - u32 id, spi, salt; + u32 id, spi, salt, sai; + u16 udp_src, udp_dst; int is_add, rv; salt = 0; @@ -96,6 +97,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm, proto = IPSEC_PROTOCOL_ESP; integ_alg = IPSEC_INTEG_ALG_NONE; crypto_alg = IPSEC_CRYPTO_ALG_NONE; + udp_src = udp_dst = IPSEC_UDP_PORT_NONE; if (!unformat_user (input, unformat_line_input, line_input)) return 0; @@ -149,8 +151,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm, rv = ipsec_sa_add_and_lock (id, spi, proto, crypto_alg, &ck, integ_alg, &ik, flags, 0, clib_host_to_net_u32 (salt), - &tun_src, &tun_dst, NULL, - IPSEC_UDP_PORT_NONE); + &tun_src, &tun_dst, &sai, udp_src, udp_dst); else rv = ipsec_sa_unlock_id (id); @@ -856,14 +857,16 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm, local_spi, IPSEC_PROTOCOL_ESP, crypto_alg, &lck, integ_alg, &lik, flags, table_id, clib_host_to_net_u32 (salt), &local_ip, - &remote_ip, NULL, IPSEC_UDP_PORT_NONE); + &remote_ip, NULL, IPSEC_UDP_PORT_NONE, + IPSEC_UDP_PORT_NONE); rv |= ipsec_sa_add_and_lock (ipsec_tun_mk_remote_sa_id (sw_if_index), remote_spi, IPSEC_PROTOCOL_ESP, crypto_alg, &rck, integ_alg, &rik, (flags | IPSEC_SA_FLAG_IS_INBOUND), table_id, clib_host_to_net_u32 (salt), &remote_ip, - &local_ip, NULL, IPSEC_UDP_PORT_NONE); + &local_ip, NULL, IPSEC_UDP_PORT_NONE, + IPSEC_UDP_PORT_NONE); rv |= ipsec_tun_protect_update_one (sw_if_index, &nh, ipsec_tun_mk_local_sa_id (sw_if_index), diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c index bf398cb2105..98de779b0de 100644 --- a/src/vnet/ipsec/ipsec_format.c +++ b/src/vnet/ipsec/ipsec_format.c @@ -310,6 +310,9 @@ format_ipsec_sa (u8 * s, va_list * args) s = format (s, " key %U", format_ipsec_key, &sa->integ_key); else s = format (s, " key [redacted]"); + s = format (s, "\n UDP:[src:%d dst:%d]", + clib_host_to_net_u16 (sa->udp_hdr.src_port), + clib_host_to_net_u16 (sa->udp_hdr.dst_port)); vlib_get_combined_counter (&ipsec_sa_counters, sai, &counts); s = format (s, "\n packets %u bytes %u", counts.packets, counts.bytes); diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c index f60566cba79..e5f01bff0d9 100644 --- a/src/vnet/ipsec/ipsec_sa.c +++ b/src/vnet/ipsec/ipsec_sa.c @@ -179,7 +179,7 @@ ipsec_sa_add_and_lock (u32 id, u32 salt, const ip46_address_t * tun_src, const ip46_address_t * tun_dst, u32 * sa_out_index, - u16 dst_port) + u16 src_port, u16 dst_port) { vlib_main_t *vm = vlib_get_main (); ipsec_main_t *im = &ipsec_main; @@ -329,15 +329,17 @@ ipsec_sa_add_and_lock (u32 id, if (ipsec_sa_is_set_UDP_ENCAP (sa)) { if (dst_port == IPSEC_UDP_PORT_NONE) - { - sa->udp_hdr.src_port = clib_host_to_net_u16 (UDP_DST_PORT_ipsec); - sa->udp_hdr.dst_port = clib_host_to_net_u16 (UDP_DST_PORT_ipsec); - } + sa->udp_hdr.dst_port = clib_host_to_net_u16 (UDP_DST_PORT_ipsec); else - { - sa->udp_hdr.src_port = clib_host_to_net_u16 (dst_port); - sa->udp_hdr.dst_port = clib_host_to_net_u16 (dst_port); - } + sa->udp_hdr.dst_port = clib_host_to_net_u16 (dst_port); + + if (src_port == IPSEC_UDP_PORT_NONE) + sa->udp_hdr.src_port = clib_host_to_net_u16 (UDP_DST_PORT_ipsec); + else + sa->udp_hdr.src_port = clib_host_to_net_u16 (src_port); + + if (ipsec_sa_is_set_IS_INBOUND (sa)) + ipsec_register_udp_port (clib_host_to_net_u16 (sa->udp_hdr.dst_port)); } hash_set (im->sa_index_by_sa_id, sa->id, sa_index); @@ -361,6 +363,9 @@ ipsec_sa_del (ipsec_sa_t * sa) /* no recovery possible when deleting an SA */ (void) ipsec_call_add_del_callbacks (im, sa, sa_index, 0); + if (ipsec_sa_is_set_UDP_ENCAP (sa) && ipsec_sa_is_set_IS_INBOUND (sa)) + ipsec_unregister_udp_port (clib_net_to_host_u16 (sa->udp_hdr.dst_port)); + if (ipsec_sa_is_set_IS_TUNNEL (sa) && !ipsec_sa_is_set_IS_INBOUND (sa)) { fib_entry_untrack (sa->fib_entry_index, sa->sibling); diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h index de9b51ea66a..5950d6f53b3 100644 --- a/src/vnet/ipsec/ipsec_sa.h +++ b/src/vnet/ipsec/ipsec_sa.h @@ -250,7 +250,7 @@ extern int ipsec_sa_add_and_lock (u32 id, u32 salt, const ip46_address_t * tunnel_src_addr, const ip46_address_t * tunnel_dst_addr, - u32 * sa_index, u16 dst_port); + u32 * sa_index, u16 src_port, u16 dst_port); extern index_t ipsec_sa_find_and_lock (u32 id); extern int ipsec_sa_unlock_id (u32 id); extern void ipsec_sa_unlock (index_t sai); diff --git a/src/vnet/ipsec/ipsec_tun.c b/src/vnet/ipsec/ipsec_tun.c index a93e66a8775..9b76d311bc2 100644 --- a/src/vnet/ipsec/ipsec_tun.c +++ b/src/vnet/ipsec/ipsec_tun.c @@ -91,9 +91,7 @@ ipsec_tun_register_nodes (ip_address_family_t af) { if (AF_IP4 == af) { - udp_register_dst_port (vlib_get_main (), - UDP_DST_PORT_ipsec, - ipsec4_tun_input_node.index, 1); + ipsec_register_udp_port (UDP_DST_PORT_ipsec); ip4_register_protocol (IP_PROTOCOL_IPSEC_ESP, ipsec4_tun_input_node.index); } @@ -111,7 +109,7 @@ ipsec_tun_unregister_nodes (ip_address_family_t af) { if (AF_IP4 == af) { - udp_unregister_dst_port (vlib_get_main (), UDP_DST_PORT_ipsec, 1); + ipsec_unregister_udp_port (UDP_DST_PORT_ipsec); ip4_unregister_protocol (IP_PROTOCOL_IPSEC_ESP); } else diff --git a/src/vnet/ipsec/ipsec_types.api b/src/vnet/ipsec/ipsec_types.api index f393fc879b9..715f3de0e12 100644 --- a/src/vnet/ipsec/ipsec_types.api +++ b/src/vnet/ipsec/ipsec_types.api @@ -104,6 +104,10 @@ typedef key @param tunnel_dst_address - IPsec tunnel destination address IPv6 if is_tunnel_ipv6 is non-zero, else IPv4. Only valid if is_tunnel is non-zero @param tx_table_id - the FIB id used for encapsulated packets @param salt - for use with counter mode ciphers + @param udp_src_port - If using UDP Encapsulation, use this source port for + TX. It is ignored for RX. + @param udp_dst_port - If using UDP Encapsulation, use this destination port + for TX. Expect traffic on this port for RX. */ typedef ipsec_sad_entry { @@ -125,6 +129,8 @@ typedef ipsec_sad_entry vl_api_address_t tunnel_dst; u32 tx_table_id; u32 salt; + u16 udp_src_port [default=4500]; + u16 udp_dst_port [default=4500]; }; /* |