FD.io VPP  v16.12-rc0-308-g931be3a
Vector Packet Processing
ipsec_gre.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2016 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 /**
16  * @file
17  * @brief L2-GRE over IPSec packet processing.
18  *
19  * Add GRE header to thr packet and send it to the esp-encrypt node.
20 */
21 
22 #include <vnet/vnet.h>
24 
26 
27 /**
28  * @brief IPv4 and GRE header union.
29  *
30 */
31 typedef struct
32 {
33  union
34  {
35  ip4_and_gre_header_t ip4_and_gre;
36  u64 as_u64[3];
37  };
39 
40 /**
41  * @brief Packet trace.
42  *
43 */
44 typedef struct
45 {
46  u32 tunnel_id; /**< Tunnel-id / index in tunnel vector */
47 
48  u32 length; /**< pkt length */
49 
50  ip4_address_t src; /**< tunnel src IPv4 address */
51  ip4_address_t dst; /**< tunnel dst IPv4 address */
52 
53  u32 sa_id; /**< tunnel IPSec SA id */
55 
56 u8 *
57 format_ipsec_gre_tx_trace (u8 * s, va_list * args)
58 {
59  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
60  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
61  ipsec_gre_tx_trace_t *t = va_arg (*args, ipsec_gre_tx_trace_t *);
62 
63  s = format (s, "GRE: tunnel %d len %d src %U dst %U sa-id %d",
64  t->tunnel_id, clib_net_to_host_u16 (t->length),
67  return s;
68 }
69 
70 /**
71  * @brief IPSec-GRE tunnel interface tx function.
72  *
73  * Add GRE header to the packet.
74  *
75  * @param vm vlib_main_t corresponding to the current thread.
76  * @param node vlib_node_runtime_t data for this node.
77  * @param frame vlib_frame_t whose contents should be dispatched.
78  *
79  * @par Graph mechanics: buffer metadata, next index usage
80  *
81  * <em>Uses:</em>
82  * - <code>node->runtime_data</code>
83  * - Match tunnel by <code>rd->dev_instance</code> in IPSec-GRE tunnels
84  * pool.
85  *
86  * <em>Sets:</em>
87  * - <code>vnet_buffer(b)->output_features.ipsec_sad_index</code>
88  * - Set IPSec Security Association for packet encryption.
89  * - <code>vnet_buffer(b)->sw_if_index[VLIB_TX]</code>
90  * - Reset output sw_if_index.
91  *
92  * <em>Nexd Index:</em>
93  * - Dispatches the packet to the esp-encrypt node.
94 */
95 static uword
97  vlib_node_runtime_t * node, vlib_frame_t * frame)
98 {
100  u32 next_index;
101  u32 *from, *to_next, n_left_from, n_left_to_next;
102  vnet_interface_output_runtime_t *rd = (void *) node->runtime_data;
104 
105  /* Vector of buffer / pkt indices we're supposed to process */
106  from = vlib_frame_vector_args (frame);
107 
108  /* Number of buffers / pkts */
109  n_left_from = frame->n_vectors;
110 
111  /* Speculatively send the first buffer to the last disposition we used */
112  next_index = node->cached_next_index;
113 
114  while (n_left_from > 0)
115  {
116  /* set up to enqueue to our disposition with index = next_index */
117  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
118 
119  /*
120  * As long as we have enough pkts left to process two pkts
121  * and prefetch two pkts...
122  */
123  while (n_left_from >= 4 && n_left_to_next >= 2)
124  {
125  vlib_buffer_t *b0, *b1;
126  ip4_header_t *ip0, *ip1;
127  ip4_and_gre_union_t *h0, *h1;
128  u32 bi0, next0, bi1, next1;
129  __attribute__ ((unused)) u8 error0, error1;
130  u16 gre_protocol0, gre_protocol1;
131 
132  /* Prefetch the next iteration */
133  {
134  vlib_buffer_t *p2, *p3;
135 
136  p2 = vlib_get_buffer (vm, from[2]);
137  p3 = vlib_get_buffer (vm, from[3]);
138 
139  vlib_prefetch_buffer_header (p2, LOAD);
140  vlib_prefetch_buffer_header (p3, LOAD);
141 
142  /*
143  * Prefetch packet data. We expect to overwrite
144  * the inbound L2 header with an ip header and a
145  * gre header. Might want to prefetch the last line
146  * of rewrite space as well; need profile data
147  */
150  }
151 
152  /* Pick up the next two buffer indices */
153  bi0 = from[0];
154  bi1 = from[1];
155 
156  /* Speculatively enqueue them where we sent the last buffer */
157  to_next[0] = bi0;
158  to_next[1] = bi1;
159  from += 2;
160  to_next += 2;
161  n_left_to_next -= 2;
162  n_left_from -= 2;
163 
164  b0 = vlib_get_buffer (vm, bi0);
165  b1 = vlib_get_buffer (vm, bi1);
166 
167  ip0 = vlib_buffer_get_current (b0);
168  gre_protocol0 = clib_net_to_host_u16 (0x01);
169 
170  ip1 = vlib_buffer_get_current (b1);
171  gre_protocol1 = clib_net_to_host_u16 (0x01);
172 
173  vlib_buffer_advance (b0, -sizeof (*h0));
174  vlib_buffer_advance (b1, -sizeof (*h1));
175 
176  h0 = vlib_buffer_get_current (b0);
177  h1 = vlib_buffer_get_current (b1);
178  h0->as_u64[0] = 0;
179  h0->as_u64[1] = 0;
180  h0->as_u64[2] = 0;
181 
182  h1->as_u64[0] = 0;
183  h1->as_u64[1] = 0;
184  h1->as_u64[2] = 0;
185 
186  ip0 = &h0->ip4_and_gre.ip4;
187  h0->ip4_and_gre.gre.protocol = gre_protocol0;
188  ip0->ip_version_and_header_length = 0x45;
189  ip0->ttl = 254;
190  ip0->protocol = IP_PROTOCOL_GRE;
191 
192  ip1 = &h1->ip4_and_gre.ip4;
193  h1->ip4_and_gre.gre.protocol = gre_protocol1;
194  ip1->ip_version_and_header_length = 0x45;
195  ip1->ttl = 254;
196  ip1->protocol = IP_PROTOCOL_GRE;
197 
198  ip0->length =
199  clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0));
200  ip1->length =
201  clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b1));
202  ip0->src_address.as_u32 = t->tunnel_src.as_u32;
203  ip1->src_address.as_u32 = t->tunnel_src.as_u32;
204  ip0->dst_address.as_u32 = t->tunnel_dst.as_u32;
205  ip1->dst_address.as_u32 = t->tunnel_dst.as_u32;
206  ip0->checksum = ip4_header_checksum (ip0);
207  ip1->checksum = ip4_header_checksum (ip1);
208 
209  vnet_buffer (b0)->sw_if_index[VLIB_RX] =
210  vnet_buffer (b0)->sw_if_index[VLIB_TX];
211  vnet_buffer (b1)->sw_if_index[VLIB_RX] =
212  vnet_buffer (b1)->sw_if_index[VLIB_TX];
213 
214  vnet_buffer (b0)->output_features.ipsec_sad_index = t->local_sa;
215  vnet_buffer (b1)->output_features.ipsec_sad_index = t->local_sa;
216 
217  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
218  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
219 
222  error0 = IPSEC_GRE_ERROR_NONE;
223  error1 = IPSEC_GRE_ERROR_NONE;
224 
226  {
227  ipsec_gre_tx_trace_t *tr = vlib_add_trace (vm, node,
228  b0, sizeof (*tr));
229  tr->tunnel_id = t - igm->tunnels;
230  tr->length = ip0->length;
231  tr->src.as_u32 = ip0->src_address.as_u32;
232  tr->dst.as_u32 = ip0->dst_address.as_u32;
233  tr->sa_id = t->local_sa_id;
234  }
235 
237  {
238  ipsec_gre_tx_trace_t *tr = vlib_add_trace (vm, node,
239  b1, sizeof (*tr));
240  tr->tunnel_id = t - igm->tunnels;
241  tr->length = ip1->length;
242  tr->src.as_u32 = ip1->src_address.as_u32;
243  tr->dst.as_u32 = ip1->dst_address.as_u32;
244  tr->sa_id = t->local_sa_id;
245  }
246 
247  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
248  to_next, n_left_to_next,
249  bi0, bi1, next0, next1);
250  }
251 
252  while (n_left_from > 0 && n_left_to_next > 0)
253  {
254  vlib_buffer_t *b0;
255  ip4_header_t *ip0;
257  u32 bi0, next0;
258  __attribute__ ((unused)) u8 error0;
259  u16 gre_protocol0;
260 
261  bi0 = to_next[0] = from[0];
262  from += 1;
263  n_left_from -= 1;
264  to_next += 1;
265  n_left_to_next -= 1;
266 
267  b0 = vlib_get_buffer (vm, bi0);
268 
269  gre_protocol0 = clib_net_to_host_u16 (0x01);
270 
271  vlib_buffer_advance (b0, -sizeof (*h0));
272 
273  h0 = vlib_buffer_get_current (b0);
274  h0->as_u64[0] = 0;
275  h0->as_u64[1] = 0;
276  h0->as_u64[2] = 0;
277 
278  ip0 = &h0->ip4_and_gre.ip4;
279  h0->ip4_and_gre.gre.protocol = gre_protocol0;
280  ip0->ip_version_and_header_length = 0x45;
281  ip0->ttl = 254;
282  ip0->protocol = IP_PROTOCOL_GRE;
283  ip0->length =
284  clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0));
285  ip0->src_address.as_u32 = t->tunnel_src.as_u32;
286  ip0->dst_address.as_u32 = t->tunnel_dst.as_u32;
287  ip0->checksum = ip4_header_checksum (ip0);
288 
289  vnet_buffer (b0)->sw_if_index[VLIB_RX] =
290  vnet_buffer (b0)->sw_if_index[VLIB_TX];
291  vnet_buffer (b0)->output_features.ipsec_sad_index = t->local_sa;
292  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
293 
295  error0 = IPSEC_GRE_ERROR_NONE;
296 
298  {
299  ipsec_gre_tx_trace_t *tr = vlib_add_trace (vm, node,
300  b0, sizeof (*tr));
301  tr->tunnel_id = t - igm->tunnels;
302  tr->length = ip0->length;
303  tr->src.as_u32 = ip0->src_address.as_u32;
304  tr->dst.as_u32 = ip0->dst_address.as_u32;
305  tr->sa_id = t->local_sa_id;
306  }
307 
308  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
309  to_next, n_left_to_next,
310  bi0, next0);
311  }
312 
313  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
314  }
315 
317  IPSEC_GRE_ERROR_PKTS_ENCAP, frame->n_vectors);
318 
319  return frame->n_vectors;
320 }
321 
322 static clib_error_t *
324  u32 flags)
325 {
327  vnet_hw_interface_set_flags (vnm, hw_if_index,
329  else
330  vnet_hw_interface_set_flags (vnm, hw_if_index, 0 /* down */ );
331 
332  return /* no error */ 0;
333 }
334 
335 static u8 *
336 format_ipsec_gre_tunnel_name (u8 * s, va_list * args)
337 {
338  u32 dev_instance = va_arg (*args, u32);
339  return format (s, "ipsec-gre%d", dev_instance);
340 }
341 
342 static u8 *
343 format_ipsec_gre_device (u8 * s, va_list * args)
344 {
345  u32 dev_instance = va_arg (*args, u32);
346  CLIB_UNUSED (int verbose) = va_arg (*args, int);
347 
348  s = format (s, "IPSEC-GRE tunnel: id %d\n", dev_instance);
349  return s;
350 }
351 
352 /* *INDENT-OFF* */
354  .name = "IPSec GRE tunnel device",
355  .format_device_name = format_ipsec_gre_tunnel_name,
356  .format_device = format_ipsec_gre_device,
357  .format_tx_trace = format_ipsec_gre_tx_trace,
358  .tx_function = ipsec_gre_interface_tx,
359  .admin_up_down_function = ipsec_gre_interface_admin_up_down,
360 };
361 
364 
365 
367  .name = "IPSEC-GRE",
368 };
369 /* *INDENT-ON* */
370 
371 static clib_error_t *
373 {
375  clib_error_t *error;
376 
377  memset (igm, 0, sizeof (igm[0]));
378  igm->vlib_main = vm;
379  igm->vnet_main = vnet_get_main ();
380 
381  if ((error = vlib_call_init_function (vm, ip_main_init)))
382  return error;
383 
384  if ((error = vlib_call_init_function (vm, ip4_lookup_init)))
385  return error;
386 
387  igm->tunnel_by_key = hash_create (0, sizeof (uword));
388 
390 }
391 
393 
396 {
398  return &ipsec_gre_main;
399 }
400 
401 /*
402 * fd.io coding-style-patch-verification: ON
403 *
404 * Local Variables:
405 * eval: (c-set-style "gnu")
406 * End:
407 */
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:457
#define CLIB_UNUSED(x)
Definition: clib.h:79
clib_error_t * vnet_hw_interface_set_flags(vnet_main_t *vnm, u32 hw_if_index, u32 flags)
Definition: interface.c:522
u8 * format_ipsec_gre_tx_trace(u8 *s, va_list *args)
Definition: ipsec_gre.c:57
u8 runtime_data[0]
Definition: node.h:472
ip4_address_t src_address
Definition: ip4_packet.h:138
L2-GRE over IPSec packet processing.
#define VNET_HW_INTERFACE_CLASS(x,...)
Definition: interface.h:327
u64 as_u64
Definition: bihash_doc.h:63
VLIB_DEVICE_TX_FUNCTION_MULTIARCH(ipsec_gre_device_class, ipsec_gre_interface_tx)
Definition: ipsec_gre.c:362
#define VNET_HW_INTERFACE_FLAG_LINK_UP
Definition: interface.h:348
static clib_error_t * ipsec_gre_init(vlib_main_t *vm)
Definition: ipsec_gre.c:372
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
Definition: buffer_funcs.h:112
format_function_t format_ip4_address
Definition: format.h:78
static uword ipsec_gre_interface_tx(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
IPSec-GRE tunnel interface tx function.
Definition: ipsec_gre.c:96
static clib_error_t * ipsec_gre_interface_admin_up_down(vnet_main_t *vnm, u32 hw_if_index, u32 flags)
Definition: ipsec_gre.c:323
#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT
Definition: ipsec_gre.h:87
ipsec_gre_tunnel_t * tunnels
pool of tunnel instances
Definition: ipsec_gre.h:68
vnet_main_t * vnet_get_main(void)
Definition: misc.c:46
ip4_and_gre_header_t ip4_and_gre
Definition: gre.c:26
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:111
IPv4 and GRE header union.
Definition: gre.c:24
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:190
ip4_address_t dst_address
Definition: ip4_packet.h:138
ipsec_gre_main_t ipsec_gre_main
Definition: ipsec_gre.c:25
Packet trace.
Definition: ipsec_gre.c:44
vnet_hw_interface_class_t ipsec_gre_hw_interface_class
unsigned long u64
Definition: types.h:89
static u8 * format_ipsec_gre_tunnel_name(u8 *s, va_list *args)
Definition: ipsec_gre.c:336
u64 as_u64[3]
Definition: gre.c:27
#define vlib_call_init_function(vm, x)
Definition: init.h:161
ip4_address_t dst
tunnel dst IPv4 address
Definition: ipsec_gre.c:51
uword * tunnel_by_key
hash mapping src/dst addr pair to tunnel
Definition: ipsec_gre.h:70
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:369
u32 length
pkt length
Definition: ipsec_gre.c:48
VNET_DEVICE_CLASS(ipsec_gre_device_class)
#define PREDICT_FALSE(x)
Definition: clib.h:97
#define vlib_validate_buffer_enqueue_x2(vm, node, next_index, to_next, n_left_to_next, bi0, bi1, next0, next1)
Finish enqueueing two buffers forward in the graph.
Definition: buffer_node.h:70
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:216
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:350
ip4_address_t src
tunnel src IPv4 address
Definition: ipsec_gre.c:50
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1113
vlib_node_registration_t ipsec_gre_input_node
(constructor) VLIB_REGISTER_NODE (ipsec_gre_input_node)
Definition: node.c:400
clib_error_t * ip_main_init(vlib_main_t *vm)
Definition: ip_init.c:45
u16 n_vectors
Definition: node.h:344
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:82
u32 sa_id
tunnel IPSec SA id
Definition: ipsec_gre.c:53
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:203
IPSec-GRE state.
Definition: ipsec_gre.h:66
#define hash_create(elts, value_bytes)
Definition: hash.h:658
u16 cached_next_index
Definition: node.h:463
#define VNET_SW_INTERFACE_FLAG_ADMIN_UP
Definition: interface.h:490
unsigned int u32
Definition: types.h:88
#define vnet_buffer(b)
Definition: buffer.h:333
vnet_device_class_t ipsec_gre_device_class
IPSec-GRE tunnel parameters.
Definition: ipsec_gre.h:50
vnet_main_t * vnet_main
convenience
Definition: ipsec_gre.h:78
clib_error_t * ip4_lookup_init(vlib_main_t *vm)
Definition: ip4_forward.c:1063
#define VLIB_BUFFER_IS_TRACED
Definition: buffer.h:95
u64 uword
Definition: types.h:112
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
Definition: defs.h:47
unsigned short u16
Definition: types.h:57
unsigned char u8
Definition: types.h:56
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:253
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
Definition: buffer.h:166
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:418
u8 data[0]
Packet data.
Definition: buffer.h:154
u32 tunnel_id
Tunnel-id / index in tunnel vector.
Definition: ipsec_gre.c:46
u8 ip_version_and_header_length
Definition: ip4_packet.h:108
u32 flags
Definition: vhost-user.h:75
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:67
u32 flags
buffer flags: VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:85
ipsec_gre_main_t * ipsec_gre_get_main(vlib_main_t *vm)
Definition: ipsec_gre.c:395
static clib_error_t * ipsec_gre_input_init(vlib_main_t *vm)
Definition: node.c:421
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:69
static u16 ip4_header_checksum(ip4_header_t *i)
Definition: ip4_packet.h:194
vlib_main_t * vlib_main
convenience
Definition: ipsec_gre.h:77
Definition: defs.h:46
static u8 * format_ipsec_gre_device(u8 *s, va_list *args)
Definition: ipsec_gre.c:343