FD.io VPP  v17.01.1-3-gc6833f8
Vector Packet Processing
ipsec_input.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel decapsulation
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/feature/feature.h>
22 
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 
26 #if DPDK_CRYPTO==1
27 #define ESP_NODE "dpdk-esp-decrypt"
28 #else
29 #define ESP_NODE "esp-decrypt"
30 #endif
31 
32 #define foreach_ipsec_input_next \
33 _(DROP, "error-drop") \
34 _(ESP_DECRYPT, ESP_NODE)
35 
36 #define _(v, s) IPSEC_INPUT_NEXT_##v,
37 typedef enum
38 {
40 #undef _
43 
44 
45 #define foreach_ipsec_input_error \
46  _(RX_PKTS, "IPSEC pkts received") \
47  _(DECRYPTION_FAILED, "IPSEC decryption failed")
48 
49 
50 typedef enum
51 {
52 #define _(sym,str) IPSEC_INPUT_ERROR_##sym,
54 #undef _
57 
58 static char *ipsec_input_error_strings[] = {
59 #define _(sym,string) string,
61 #undef _
62 };
63 
64 typedef struct
65 {
70 
71 /* packet trace format function */
72 static u8 *
73 format_ipsec_input_trace (u8 * s, va_list * args)
74 {
75  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
76  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
77  ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
78 
79  if (t->spi == 0 && t->seq == 0)
80  {
81  s = format (s, "esp: no esp packet");
82  return s;
83  }
84 
85  if (t->sa_id != 0)
86  {
87  s = format (s, "esp: sa_id %u spi %u seq %u", t->sa_id, t->spi, t->seq);
88  }
89  else
90  {
91  s = format (s, "esp: no sa spi %u seq %u", t->spi, t->seq);
92  }
93  return s;
94 }
95 
98 {
99  ipsec_main_t *im = &ipsec_main;
100  ipsec_policy_t *p;
101  ipsec_sa_t *s;
102  u32 *i;
103 
105  {
106  p = pool_elt_at_index (spd->policies, *i);
107  s = pool_elt_at_index (im->sad, p->sa_index);
108 
109  if (spi != s->spi)
110  continue;
111 
112  if (s->is_tunnel)
113  {
114  if (da != clib_net_to_host_u32 (s->tunnel_dst_addr.ip4.as_u32))
115  continue;
116 
117  if (sa != clib_net_to_host_u32 (s->tunnel_src_addr.ip4.as_u32))
118  continue;
119 
120  return p;
121  }
122 
123  if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
124  continue;
125 
126  if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
127  continue;
128 
129  if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
130  continue;
131 
132  if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
133  continue;
134 
135  return p;
136  }
137  return 0;
138 }
139 
142  ip6_address_t * ua)
143 {
144  if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
145  (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
146  return 1;
147  return 0;
148 }
149 
152  ip6_address_t * sa,
153  ip6_address_t * da, u32 spi)
154 {
155  ipsec_main_t *im = &ipsec_main;
156  ipsec_policy_t *p;
157  ipsec_sa_t *s;
158  u32 *i;
159 
161  {
162  p = pool_elt_at_index (spd->policies, *i);
163  s = pool_elt_at_index (im->sad, p->sa_index);
164 
165  if (spi != s->spi)
166  continue;
167 
168  if (s->is_tunnel)
169  {
170  if (!ip6_address_is_equal (sa, &s->tunnel_src_addr.ip6))
171  continue;
172 
173  if (!ip6_address_is_equal (da, &s->tunnel_dst_addr.ip6))
174  continue;
175 
176  return p;
177  }
178 
179  if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6))
180  continue;
181 
182  if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6))
183  continue;
184 
185  return p;
186  }
187  return 0;
188 }
189 
191 
192 static uword
194  vlib_node_runtime_t * node,
195  vlib_frame_t * from_frame)
196 {
197  u32 n_left_from, *from, next_index, *to_next;
198  ipsec_main_t *im = &ipsec_main;
199 
200  from = vlib_frame_vector_args (from_frame);
201  n_left_from = from_frame->n_vectors;
202 
203  next_index = node->cached_next_index;
204 
205  while (n_left_from > 0)
206  {
207  u32 n_left_to_next;
208 
209  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
210 
211  while (n_left_from > 0 && n_left_to_next > 0)
212  {
213  u32 bi0, next0;
214  vlib_buffer_t *b0;
215  ip4_header_t *ip0;
216  esp_header_t *esp0;
217  ip4_ipsec_config_t *c0;
218  ipsec_spd_t *spd0;
219  ipsec_policy_t *p0 = 0;
220 
221  bi0 = to_next[0] = from[0];
222  from += 1;
223  n_left_from -= 1;
224  to_next += 1;
225  n_left_to_next -= 1;
226 
227  b0 = vlib_get_buffer (vm, bi0);
228  c0 =
229  vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index
230  [VLIB_RX], &next0, b0,
231  sizeof (c0[0]));
232 
233  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
234 
235  ip0 = vlib_buffer_get_current (b0);
236  esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
237 
238  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
239  {
240 #if 0
242  ("packet received from %U to %U spi %u size %u spd_id %u",
245  clib_net_to_host_u32 (esp0->spi),
246  clib_net_to_host_u16 (ip0->length), spd0->id);
247 #endif
248 
250  clib_net_to_host_u32
251  (ip0->src_address.
252  as_u32),
253  clib_net_to_host_u32
254  (ip0->dst_address.
255  as_u32),
256  clib_net_to_host_u32
257  (esp0->spi));
258 
259  if (PREDICT_TRUE (p0 != 0))
260  {
261  p0->counter.packets++;
262  p0->counter.bytes += clib_net_to_host_u16 (ip0->length);
263  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
264  vnet_buffer (b0)->ipsec.flags = 0;
265  next0 = IPSEC_INPUT_NEXT_ESP_DECRYPT;
267  goto trace0;
268  }
269  }
270 
271  /* FIXME bypass and discard */
272 
273  trace0:
275  {
276  ipsec_input_trace_t *tr =
277  vlib_add_trace (vm, node, b0, sizeof (*tr));
278  if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
279  {
280  if (p0)
281  tr->sa_id = p0->sa_id;
282  tr->spi = clib_host_to_net_u32 (esp0->spi);
283  tr->seq = clib_host_to_net_u32 (esp0->seq);
284  }
285  }
286 
287  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
288  to_next, n_left_to_next, bi0,
289  next0);
290  }
291  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
292  }
294  IPSEC_INPUT_ERROR_RX_PKTS,
295  from_frame->n_vectors);
296 
297  return from_frame->n_vectors;
298 }
299 
300 
301 /* *INDENT-OFF* */
303  .function = ipsec_input_ip4_node_fn,
304  .name = "ipsec-input-ip4",
305  .vector_size = sizeof (u32),
306  .format_trace = format_ipsec_input_trace,
308 
310  .error_strings = ipsec_input_error_strings,
311 
312  .n_next_nodes = IPSEC_INPUT_N_NEXT,
313  .next_nodes = {
314 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
316 #undef _
317  },
318 };
319 /* *INDENT-ON* */
320 
323 
324  static uword
326  vlib_node_runtime_t * node,
327  vlib_frame_t * from_frame)
328 {
329  u32 n_left_from, *from, next_index, *to_next;
330  ipsec_main_t *im = &ipsec_main;
331 
332  from = vlib_frame_vector_args (from_frame);
333  n_left_from = from_frame->n_vectors;
334 
335  next_index = node->cached_next_index;
336 
337  while (n_left_from > 0)
338  {
339  u32 n_left_to_next;
340 
341  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
342 
343  while (n_left_from > 0 && n_left_to_next > 0)
344  {
345  u32 bi0, next0;
346  vlib_buffer_t *b0;
347  ip6_header_t *ip0;
348  esp_header_t *esp0;
349  ip4_ipsec_config_t *c0;
350  ipsec_spd_t *spd0;
351  ipsec_policy_t *p0 = 0;
352  u32 header_size = sizeof (ip0[0]);
353 
354  bi0 = to_next[0] = from[0];
355  from += 1;
356  n_left_from -= 1;
357  to_next += 1;
358  n_left_to_next -= 1;
359 
360  b0 = vlib_get_buffer (vm, bi0);
361  c0 =
362  vnet_feature_next_with_data (vnet_buffer (b0)->sw_if_index
363  [VLIB_RX], &next0, b0,
364  sizeof (c0[0]));
365 
366  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
367 
368  ip0 = vlib_buffer_get_current (b0);
369  esp0 = (esp_header_t *) ((u8 *) ip0 + header_size);
370 
371  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
372  {
373 #if 0
375  ("packet received from %U to %U spi %u size %u spd_id %u",
377  &ip0->dst_address, clib_net_to_host_u32 (esp0->spi),
378  clib_net_to_host_u16 (ip0->payload_length) + header_size,
379  spd0->id);
380 #endif
382  &ip0->src_address,
383  &ip0->dst_address,
384  clib_net_to_host_u32
385  (esp0->spi));
386 
387  if (PREDICT_TRUE (p0 != 0))
388  {
389  p0->counter.packets++;
390  p0->counter.bytes +=
391  clib_net_to_host_u16 (ip0->payload_length);
392  p0->counter.bytes += header_size;
393  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
394  vnet_buffer (b0)->ipsec.flags = 0;
395  next0 = IPSEC_INPUT_NEXT_ESP_DECRYPT;
396  vlib_buffer_advance (b0, header_size);
397  goto trace0;
398  }
399  }
400 
401  trace0:
403  {
404  ipsec_input_trace_t *tr =
405  vlib_add_trace (vm, node, b0, sizeof (*tr));
406  if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
407  {
408  if (p0)
409  tr->sa_id = p0->sa_id;
410  tr->spi = clib_host_to_net_u32 (esp0->spi);
411  tr->seq = clib_host_to_net_u32 (esp0->seq);
412  }
413  }
414 
415  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
416  n_left_to_next, bi0, next0);
417  }
418  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
419  }
421  IPSEC_INPUT_ERROR_RX_PKTS,
422  from_frame->n_vectors);
423 
424  return from_frame->n_vectors;
425 }
426 
427 
428 /* *INDENT-OFF* */
430  .function = ipsec_input_ip6_node_fn,
431  .name = "ipsec-input-ip6",
432  .vector_size = sizeof (u32),
433  .format_trace = format_ipsec_input_trace,
435 
437  .error_strings = ipsec_input_error_strings,
438 
439  .n_next_nodes = IPSEC_INPUT_N_NEXT,
440  .next_nodes = {
441 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
443 #undef _
444  },
445 };
446 /* *INDENT-ON* */
447 
449 /*
450  * fd.io coding-style-patch-verification: ON
451  *
452  * Local Variables:
453  * eval: (c-set-style "gnu")
454  * End:
455  */
ip46_address_t stop
Definition: ipsec.h:126
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:459
static char * ipsec_input_error_strings[]
Definition: ipsec_input.c:58
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:205
ipsec_spd_t * spds
Definition: ipsec.h:229
u64 packets
packet counter
Definition: counter.h:166
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:203
sll srl srl sll sra u16x4 i
Definition: vector_sse2.h:343
#define CLIB_UNUSED(x)
Definition: clib.h:79
ip46_address_t tunnel_src_addr
Definition: ipsec.h:111
a
Definition: bitmap.h:516
format_function_t format_ip6_address
Definition: format.h:95
ip4_address_t src_address
Definition: ip4_packet.h:163
bad routing header type(not 4)") sr_error (NO_MORE_SEGMENTS
static uword ipsec_input_ip6_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
Definition: ipsec_input.c:325
#define PREDICT_TRUE(x)
Definition: clib.h:98
u64 as_u64[2]
Definition: ip6_packet.h:51
static int ip4_header_bytes(ip4_header_t *i)
Definition: ip4_packet.h:226
static ipsec_policy_t * ipsec_input_protect_policy_match(ipsec_spd_t *spd, u32 sa, u32 da, u32 spi)
Definition: ipsec_input.c:97
u8 is_tunnel
Definition: ipsec.h:109
struct _vlib_node_registration vlib_node_registration_t
static uword ip6_addr_match_range(ip6_address_t *a, ip6_address_t *la, ip6_address_t *ua)
Definition: ipsec_input.c:141
static u8 * format_ipsec_input_trace(u8 *s, va_list *args)
Definition: ipsec_input.c:73
format_function_t format_ip4_address
Definition: format.h:79
ip6_address_t src_address
Definition: ip6_packet.h:337
u32 spi
Definition: ipsec.h:95
static vlib_node_registration_t ipsec_input_ip6_node
(constructor) VLIB_REGISTER_NODE (ipsec_input_ip6_node)
Definition: ipsec_input.c:322
#define always_inline
Definition: clib.h:84
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:194
ip4_address_t dst_address
Definition: ip4_packet.h:163
static uword ip6_address_is_equal(ip6_address_t *a, ip6_address_t *b)
Definition: ip6_packet.h:204
#define clib_warning(format, args...)
Definition: error.h:59
unsigned long u64
Definition: types.h:89
ipsec_policy_t * policies
Definition: ipsec.h:199
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:369
ipsec_input_error_t
Definition: ipsec_input.c:50
#define PREDICT_FALSE(x)
Definition: clib.h:97
ip46_address_range_t laddr
Definition: ipsec.h:180
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:216
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:350
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1113
ip46_address_t tunnel_dst_addr
Definition: ipsec.h:112
ipsec_main_t ipsec_main
Definition: ipsec.h:260
u16 n_vectors
Definition: node.h:344
ipsec_input_next_t
Definition: ipsec_input.c:37
u32 sa_index
Definition: ipsec.h:189
u64 bytes
byte counter
Definition: counter.h:167
ip46_address_t start
Definition: ipsec.h:126
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:207
#define ARRAY_LEN(x)
Definition: clib.h:59
ip46_address_range_t raddr
Definition: ipsec.h:181
u16 cached_next_index
Definition: node.h:463
unsigned int u32
Definition: types.h:88
static vlib_node_registration_t ipsec_input_ip4_node
(constructor) VLIB_REGISTER_NODE (ipsec_input_ip4_node)
Definition: ipsec_input.c:190
#define vnet_buffer(b)
Definition: buffer.h:361
ipsec_sa_t * sad
Definition: ipsec.h:230
u32 seq
Definition: esp.h:25
static uword ipsec_input_ip4_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
Definition: ipsec_input.c:193
u32 spi
Definition: esp.h:24
static ipsec_policy_t * ipsec_input_ip6_protect_policy_match(ipsec_spd_t *spd, ip6_address_t *sa, ip6_address_t *da, u32 spi)
Definition: ipsec_input.c:151
#define VLIB_BUFFER_IS_TRACED
Definition: buffer.h:95
u64 uword
Definition: types.h:112
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
#define foreach_ipsec_input_error
Definition: ipsec_input.c:45
u16 payload_length
Definition: ip6_packet.h:328
unsigned char u8
Definition: types.h:56
vlib_counter_t counter
Definition: ipsec.h:192
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:253
static_always_inline void * vnet_feature_next_with_data(u32 sw_if_index, u32 *next0, vlib_buffer_t *b0, u32 n_data_bytes)
Definition: feature.h:210
u32 id
Definition: ipsec.h:197
#define VLIB_NODE_FUNCTION_MULTIARCH(node, fn)
Definition: node.h:158
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:143
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:418
#define vec_foreach(var, vec)
Vector iterator.
#define foreach_ipsec_input_next
Definition: ipsec_input.c:32
u32 flags
buffer flags: VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:85
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:57
Definition: defs.h:46
ip6_address_t dst_address
Definition: ip6_packet.h:337