/* * ipsec_tun.h : IPSEC tunnel protection * * Copyright (c) 2015 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include #include #include /** * Pool of tunnel protection objects */ ipsec_tun_protect_t *ipsec_protect_pool; /** * DB of protected tunnels */ typedef struct ipsec_protect_db_t_ { u32 *tunnels; u32 count; } ipsec_protect_db_t; static ipsec_protect_db_t ipsec_protect_db; static int ipsec_tun_protect_feature_set (ipsec_tun_protect_t * itp, u8 enable) { u32 sai = itp->itp_out_sa; int rv; const char *enc_node = (ip46_address_is_ip4 (&itp->itp_tun.src) ? "esp4-encrypt-tun" : "esp6-encrypt-tun"); if (itp->itp_flags & IPSEC_PROTECT_L2) { rv = vnet_feature_enable_disable ("ethernet-output", enc_node, itp->itp_sw_if_index, enable, &sai, sizeof (sai)); } else { rv = vnet_feature_enable_disable ("ip4-output", enc_node, itp->itp_sw_if_index, enable, &sai, sizeof (sai)); rv = vnet_feature_enable_disable ("ip6-output", enc_node, itp->itp_sw_if_index, enable, &sai, sizeof (sai)); } ASSERT (!rv); return (rv); } static void ipsec_tun_protect_db_add (ipsec_main_t * im, const ipsec_tun_protect_t * itp) { const ipsec_sa_t *sa; u32 sai; /* *INDENT-OFF* */ FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai, ({ sa = ipsec_sa_get (sai); ipsec_tun_lkup_result_t res = { .tun_index = itp - ipsec_protect_pool, .sa_index = sai, }; /* * The key is formed from the tunnel's destination * as the packet lookup is done from the packet's source */ if (ip46_address_is_ip4 (&itp->itp_crypto.dst)) { ipsec4_tunnel_key_t key = { .remote_ip = itp->itp_crypto.dst.ip4, .spi = clib_host_to_net_u32 (sa->spi), }; hash_set (im->tun4_protect_by_key, key.as_u64, res.as_u64); if (1 == hash_elts(im->tun4_protect_by_key)) udp_register_dst_port (vlib_get_main(), UDP_DST_PORT_ipsec, ipsec4_tun_input_node.index, 1); } else { ipsec6_tunnel_key_t key = { .remote_ip = itp->itp_crypto.dst.ip6, .spi = clib_host_to_net_u32 (sa->spi), }; hash_set_mem_alloc (&im->tun6_protect_by_key, &key, res.as_u64); } })) /* *INDENT-ON* */ } static void ipsec_tun_protect_db_remove (ipsec_main_t * im, const ipsec_tun_protect_t * itp) { const ipsec_sa_t *sa; /* *INDENT-OFF* */ FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa, ({ if (ip46_address_is_ip4 (&itp->itp_crypto.dst)) { ipsec4_tunnel_key_t key = { .remote_ip = itp->itp_crypto.dst.ip4, .spi = clib_host_to_net_u32 (sa->spi), }; hash_unset (im->tun4_protect_by_key, key.as_u64); if (0 == hash_elts(im->tun4_protect_by_key)) udp_unregister_dst_port (vlib_get_main(), UDP_DST_PORT_ipsec, 1); } else { ipsec6_tunnel_key_t key = { .remote_ip = itp->itp_crypto.dst.ip6, .spi = clib_host_to_net_u32 (sa->spi), }; hash_unset_mem_free (&im->tun6_protect_by_key, &key); } })) /* *INDENT-ON* */ } static void ipsec_tun_protect_config (ipsec_main_t * im, ipsec_tun_protect_t * itp, u32 sa_out, u32 * sas_in) { ipsec_sa_t *sa; u32 ii; itp->itp_n_sa_in = vec_len (sas_in); for (ii = 0; ii < itp->itp_n_sa_in; ii++) itp->itp_in_sas[ii] = sas_in[ii]; itp->itp_out_sa = sa_out; /* *INDENT-OFF* */ FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa, ({ if (ipsec_sa_is_set_IS_TUNNEL (sa)) { itp->itp_crypto.src = sa->tunnel_dst_addr; itp->itp_crypto.dst = sa->tunnel_src_addr; ipsec_sa_set_IS_PROTECT (sa); itp->itp_flags |= IPSEC_PROTECT_ENCAPED; } else { itp->itp_crypto.src = itp->itp_tun.src; itp->itp_crypto.dst = itp->itp_tun.dst; itp->itp_flags &= ~IPSEC_PROTECT_ENCAPED; } })); /* *INDENT-ON* */ /* * add to the DB against each SA */ ipsec_tun_protect_db_add (im, itp); /* * enable the encrypt feature for egress. */ ipsec_tun_protect_feature_set (itp, 1); } static void ipsec_tun_protect_unconfig (ipsec_main_t * im, ipsec_tun_protect_t * itp) { ipsec_sa_t *sa; index_t sai; ipsec_tun_protect_feature_set (itp, 0); /* *INDENT-OFF* */ FOR_EACH_IPSEC_PROTECT_INPUT_SA(itp, sa, ({ ipsec_sa_unset_IS_PROTECT (sa); })); ipsec_tun_protect_db_remove (im, itp); ipsec_sa_unlock(itp->itp_out_sa); FOR_EACH_IPSEC_PROTECT_INPUT_SAI(itp, sai, ({ ipsec_sa_unlock(sai); })); /* *INDENT-ON* */ } index_t ipsec_tun_protect_find (u32 sw_if_index) { if (vec_len (ipsec_protect_db.tunnels) < sw_if_index) return (INDEX_INVALID); return (ipsec_protect_db.tunnels[sw_if_index]); } int ipsec_tun_protect_update (u32 sw_if_index, u32 sa_out, u32 * sas_in) { u32 itpi, ii; ipsec_tun_protect_t *itp; ipsec_main_t *im; int rv; rv = 0; im = &ipsec_main; vec_validate_init_empty (ipsec_protect_db.tunnels, sw_if_index, INDEX_INVALID); itpi = ipsec_protect_db.tunnels[sw_if_index]; vec_foreach_index (ii, sas_in) { sas_in[ii] = ipsec_sa_find_and_lock (sas_in[ii]); if (~0 == sas_in[ii]) { rv = VNET_API_ERROR_INVALID_VALUE; goto out; } } sa_out = ipsec_sa_find_and_lock (sa_out); if (~0 == sa_out) { rv = VNET_API_ERROR_INVALI