FD.io VPP  v18.10-32-g1161dda
Vector Packet Processing
ipsec_input.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel decapsulation
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/feature/feature.h>
22 
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 #include <vnet/ipsec/ah.h>
26 
27 #define foreach_ipsec_input_error \
28  _(RX_PKTS, "IPSEC pkts received") \
29  _(DECRYPTION_FAILED, "IPSEC decryption failed")
30 
31 typedef enum
32 {
33 #define _(sym,str) IPSEC_INPUT_ERROR_##sym,
35 #undef _
38 
39 static char *ipsec_input_error_strings[] = {
40 #define _(sym,string) string,
42 #undef _
43 };
44 
45 typedef struct
46 {
51 
52 /* packet trace format function */
53 static u8 *
54 format_ipsec_input_trace (u8 * s, va_list * args)
55 {
56  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
57  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
58  ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
59 
60  if (t->spi == 0 && t->seq == 0)
61  {
62  s = format (s, "esp: no esp packet");
63  return s;
64  }
65 
66  if (t->sa_id != 0)
67  {
68  s = format (s, "esp: sa_id %u spi %u seq %u", t->sa_id, t->spi, t->seq);
69  }
70  else
71  {
72  s = format (s, "esp: no sa spi %u seq %u", t->spi, t->seq);
73  }
74  return s;
75 }
76 
79 {
80  ipsec_main_t *im = &ipsec_main;
81  ipsec_policy_t *p;
82  ipsec_sa_t *s;
83  u32 *i;
84 
86  {
87  p = pool_elt_at_index (spd->policies, *i);
88  s = pool_elt_at_index (im->sad, p->sa_index);
89 
90  if (spi != s->spi)
91  continue;
92 
93  if (s->is_tunnel)
94  {
95  if (da != clib_net_to_host_u32 (s->tunnel_dst_addr.ip4.as_u32))
96  continue;
97 
98  if (sa != clib_net_to_host_u32 (s->tunnel_src_addr.ip4.as_u32))
99  continue;
100 
101  return p;
102  }
103 
104  if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
105  continue;
106 
107  if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
108  continue;
109 
110  if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
111  continue;
112 
113  if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
114  continue;
115 
116  return p;
117  }
118  return 0;
119 }
120 
123  ip6_address_t * ua)
124 {
125  if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
126  (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
127  return 1;
128  return 0;
129 }
130 
133  ip6_address_t * sa,
134  ip6_address_t * da, u32 spi)
135 {
136  ipsec_main_t *im = &ipsec_main;
137  ipsec_policy_t *p;
138  ipsec_sa_t *s;
139  u32 *i;
140 
142  {
143  p = pool_elt_at_index (spd->policies, *i);
144  s = pool_elt_at_index (im->sad, p->sa_index);
145 
146  if (spi != s->spi)
147  continue;
148 
149  if (s->is_tunnel)
150  {
151  if (!ip6_address_is_equal (sa, &s->tunnel_src_addr.ip6))
152  continue;
153 
154  if (!ip6_address_is_equal (da, &s->tunnel_dst_addr.ip6))
155  continue;
156 
157  return p;
158  }
159 
160  if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6))
161  continue;
162 
163  if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6))
164  continue;
165 
166  return p;
167  }
168  return 0;
169 }
170 
172 
173 static uword
175  vlib_node_runtime_t * node,
176  vlib_frame_t * from_frame)
177 {
178  u32 n_left_from, *from, next_index, *to_next;
179  ipsec_main_t *im = &ipsec_main;
180 
181  from = vlib_frame_vector_args (from_frame);
182  n_left_from = from_frame->n_vectors;
183 
184  next_index = node->cached_next_index;
185 
186  while (n_left_from > 0)
187  {
188  u32 n_left_to_next;
189 
190  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
191 
192  while (n_left_from > 0 && n_left_to_next > 0)
193  {
194  u32 bi0, next0;
195  vlib_buffer_t *b0;
196  ip4_header_t *ip0;
197  esp_header_t *esp0;
198  ah_header_t *ah0;
199  ip4_ipsec_config_t *c0;
200  ipsec_spd_t *spd0;
201  ipsec_policy_t *p0 = 0;
202 
203  bi0 = to_next[0] = from[0];
204  from += 1;
205  n_left_from -= 1;
206  to_next += 1;
207  n_left_to_next -= 1;
208 
209  b0 = vlib_get_buffer (vm, bi0);
210  b0->flags |= VNET_BUFFER_F_IS_IP4;
211  b0->flags &= ~VNET_BUFFER_F_IS_IP6;
212  c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
213 
214  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
215 
216  ip0 = vlib_buffer_get_current (b0);
217 
218  if (PREDICT_TRUE
219  (ip0->protocol == IP_PROTOCOL_IPSEC_ESP
220  || ip0->protocol == IP_PROTOCOL_UDP))
221  {
222 #if 0
224  ("packet received from %U to %U spi %u size %u spd_id %u",
227  clib_net_to_host_u32 (esp0->spi),
228  clib_net_to_host_u16 (ip0->length), spd0->id);
229 #endif
230 
231  esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
232  if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_UDP))
233  {
234  esp0 =
235  (esp_header_t *) ((u8 *) esp0 + sizeof (udp_header_t));
236  }
237  /* FIXME TODO missing check whether there is enough data inside
238  * IP/UDP to contain ESP header & stuff ? */
240  clib_net_to_host_u32
241  (ip0->src_address.
242  as_u32),
243  clib_net_to_host_u32
244  (ip0->dst_address.
245  as_u32),
246  clib_net_to_host_u32
247  (esp0->spi));
248 
249  if (PREDICT_TRUE (p0 != 0))
250  {
251  p0->counter.packets++;
252  p0->counter.bytes += clib_net_to_host_u16 (ip0->length);
253  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
254  vnet_buffer (b0)->ipsec.flags = 0;
255  next0 = im->esp_decrypt_next_index;
256  vlib_buffer_advance (b0, ((u8 *) esp0 - (u8 *) ip0));
257  goto trace0;
258  }
259 
260  /* FIXME bypass and discard */
261  trace0:
262  if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
263  {
264  ipsec_input_trace_t *tr =
265  vlib_add_trace (vm, node, b0, sizeof (*tr));
266  if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP ||
267  ip0->protocol == IP_PROTOCOL_UDP)
268  {
269  if (p0)
270  tr->sa_id = p0->sa_id;
271  tr->spi = clib_host_to_net_u32 (esp0->spi);
272  tr->seq = clib_host_to_net_u32 (esp0->seq);
273  }
274  }
275 
276  }
277 
278 
279  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_AH))
280  {
281  ah0 = (ah_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
283  clib_net_to_host_u32
284  (ip0->src_address.
285  as_u32),
286  clib_net_to_host_u32
287  (ip0->dst_address.
288  as_u32),
289  clib_net_to_host_u32
290  (ah0->spi));
291 
292  if (PREDICT_TRUE (p0 != 0))
293  {
294  p0->counter.packets++;
295  p0->counter.bytes += clib_net_to_host_u16 (ip0->length);
296  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
297  vnet_buffer (b0)->ipsec.flags = 0;
298  next0 = im->ah_decrypt_next_index;
299  goto trace1;
300  }
301  /* FIXME bypass and discard */
302  trace1:
303  if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
304  {
305  ipsec_input_trace_t *tr =
306  vlib_add_trace (vm, node, b0, sizeof (*tr));
307  if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
308  {
309  if (p0)
310  tr->sa_id = p0->sa_id;
311  tr->spi = clib_host_to_net_u32 (ah0->spi);
312  tr->seq = clib_host_to_net_u32 (ah0->seq_no);
313  }
314  }
315  }
316 
317  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
318  to_next, n_left_to_next, bi0,
319  next0);
320  }
321  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
322  }
324  IPSEC_INPUT_ERROR_RX_PKTS,
325  from_frame->n_vectors);
326 
327  return from_frame->n_vectors;
328 }
329 
330 
331 /* *INDENT-OFF* */
333  .function = ipsec_input_ip4_node_fn,
334  .name = "ipsec-input-ip4",
335  .vector_size = sizeof (u32),
336  .format_trace = format_ipsec_input_trace,
337  .type = VLIB_NODE_TYPE_INTERNAL,
338 
340  .error_strings = ipsec_input_error_strings,
341 
342  .n_next_nodes = IPSEC_INPUT_N_NEXT,
343  .next_nodes = {
344 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
346 #undef _
347  },
348 };
349 /* *INDENT-ON* */
350 
353 
354 static uword
356  vlib_node_runtime_t * node,
357  vlib_frame_t * from_frame)
358 {
359  u32 n_left_from, *from, next_index, *to_next;
360  ipsec_main_t *im = &ipsec_main;
361 
362  from = vlib_frame_vector_args (from_frame);
363  n_left_from = from_frame->n_vectors;
364 
365  next_index = node->cached_next_index;
366 
367  while (n_left_from > 0)
368  {
369  u32 n_left_to_next;
370 
371  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
372 
373  while (n_left_from > 0 && n_left_to_next > 0)
374  {
375  u32 bi0, next0;
376  vlib_buffer_t *b0;
377  ip6_header_t *ip0;
378  esp_header_t *esp0;
379  ip4_ipsec_config_t *c0;
380  ipsec_spd_t *spd0;
381  ipsec_policy_t *p0 = 0;
382  ah_header_t *ah0;
383  u32 header_size = sizeof (ip0[0]);
384 
385  bi0 = to_next[0] = from[0];
386  from += 1;
387  n_left_from -= 1;
388  to_next += 1;
389  n_left_to_next -= 1;
390 
391  b0 = vlib_get_buffer (vm, bi0);
392  b0->flags |= VNET_BUFFER_F_IS_IP6;
393  b0->flags &= ~VNET_BUFFER_F_IS_IP4;
394  c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
395 
396  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
397 
398  ip0 = vlib_buffer_get_current (b0);
399  esp0 = (esp_header_t *) ((u8 *) ip0 + header_size);
400  ah0 = (ah_header_t *) ((u8 *) ip0 + header_size);
401 
402  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
403  {
404 #if 0
406  ("packet received from %U to %U spi %u size %u spd_id %u",
408  &ip0->dst_address, clib_net_to_host_u32 (esp0->spi),
409  clib_net_to_host_u16 (ip0->payload_length) + header_size,
410  spd0->id);
411 #endif
413  &ip0->src_address,
414  &ip0->dst_address,
415  clib_net_to_host_u32
416  (esp0->spi));
417 
418  if (PREDICT_TRUE (p0 != 0))
419  {
420  p0->counter.packets++;
421  p0->counter.bytes +=
422  clib_net_to_host_u16 (ip0->payload_length);
423  p0->counter.bytes += header_size;
424  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
425  vnet_buffer (b0)->ipsec.flags = 0;
426  next0 = im->esp_decrypt_next_index;
427  vlib_buffer_advance (b0, header_size);
428  goto trace0;
429  }
430  }
431  else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
432  {
434  &ip0->src_address,
435  &ip0->dst_address,
436  clib_net_to_host_u32
437  (ah0->spi));
438 
439  if (PREDICT_TRUE (p0 != 0))
440  {
441  p0->counter.packets++;
442  p0->counter.bytes +=
443  clib_net_to_host_u16 (ip0->payload_length);
444  p0->counter.bytes += header_size;
445  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
446  vnet_buffer (b0)->ipsec.flags = 0;
447  next0 = im->ah_decrypt_next_index;
448  goto trace0;
449  }
450  }
451 
452  trace0:
453  if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
454  {
455  ipsec_input_trace_t *tr =
456  vlib_add_trace (vm, node, b0, sizeof (*tr));
457  if (ip0->protocol == IP_PROTOCOL_IPSEC_ESP)
458  {
459  if (p0)
460  tr->sa_id = p0->sa_id;
461  tr->spi = clib_host_to_net_u32 (esp0->spi);
462  tr->seq = clib_host_to_net_u32 (esp0->seq);
463  }
464  }
465 
466  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
467  n_left_to_next, bi0, next0);
468  }
469  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
470  }
472  IPSEC_INPUT_ERROR_RX_PKTS,
473  from_frame->n_vectors);
474 
475  return from_frame->n_vectors;
476 }
477 
478 
479 /* *INDENT-OFF* */
481  .function = ipsec_input_ip6_node_fn,
482  .name = "ipsec-input-ip6",
483  .vector_size = sizeof (u32),
484  .format_trace = format_ipsec_input_trace,
485  .type = VLIB_NODE_TYPE_INTERNAL,
486 
488  .error_strings = ipsec_input_error_strings,
489 
490  .sibling_of = "ipsec-input-ip4",
491 };
492 /* *INDENT-ON* */
493 
495 /*
496  * fd.io coding-style-patch-verification: ON
497  *
498  * Local Variables:
499  * eval: (c-set-style "gnu")
500  * End:
501  */
ip46_address_t stop
Definition: ipsec.h:149
static char * ipsec_input_error_strings[]
Definition: ipsec_input.c:39
u32 * ipv6_inbound_protect_policy_indices
Definition: ipsec.h:231
ipsec_spd_t * spds
Definition: ipsec.h:264
u32 ah_decrypt_next_index
Definition: ipsec.h:299
u32 * ipv4_inbound_protect_policy_indices
Definition: ipsec.h:229
#define CLIB_UNUSED(x)
Definition: clib.h:81
ip46_address_t tunnel_src_addr
Definition: ipsec.h:131
a
Definition: bitmap.h:538
ip4_address_t src_address
Definition: ip4_packet.h:169
static uword ipsec_input_ip6_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
Definition: ipsec_input.c:355
#define PREDICT_TRUE(x)
Definition: clib.h:108
u64 as_u64[2]
Definition: ip6_packet.h:51
unsigned long u64
Definition: types.h:89
static ipsec_policy_t * ipsec_input_protect_policy_match(ipsec_spd_t *spd, u32 sa, u32 da, u32 spi)
Definition: ipsec_input.c:78
u8 is_tunnel
Definition: ipsec.h:128
int i
static uword ip6_addr_match_range(ip6_address_t *a, ip6_address_t *la, ip6_address_t *ua)
Definition: ipsec_input.c:122
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
static u8 * format_ipsec_input_trace(u8 *s, va_list *args)
Definition: ipsec_input.c:54
ip6_address_t src_address
Definition: ip6_packet.h:378
unsigned char u8
Definition: types.h:56
u32 spi
Definition: ipsec.h:114
format_function_t format_ip4_address
Definition: format.h:75
static vlib_node_registration_t ipsec_input_ip6_node
(constructor) VLIB_REGISTER_NODE (ipsec_input_ip6_node)
Definition: ipsec_input.c:352
ipsec_main_t ipsec_main
Definition: ipsec.c:30
unsigned int seq_no
Definition: ah.h:33
#define always_inline
Definition: clib.h:94
ip4_address_t dst_address
Definition: ip4_packet.h:169
#define foreach_ipsec_input_next
Definition: ipsec.h:38
unsigned int u32
Definition: types.h:88
ipsec_policy_t * policies
Definition: ipsec.h:225
static_always_inline void * vnet_feature_next_with_data(u32 *next0, vlib_buffer_t *b0, u32 n_data_bytes)
Definition: feature.h:233
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:464
counter_t packets
packet counter
Definition: counter_types.h:28
ipsec_input_error_t
Definition: ipsec_input.c:31
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:205
#define PREDICT_FALSE(x)
Definition: clib.h:107
ip46_address_range_t laddr
Definition: ipsec.h:206
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:364
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1176
ip46_address_t tunnel_dst_addr
Definition: ipsec.h:132
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:155
u16 n_vectors
Definition: node.h:401
format_function_t format_ip6_address
Definition: format.h:93
vlib_main_t * vm
Definition: buffer.c:294
u32 sa_index
Definition: ipsec.h:215
u32 esp_decrypt_next_index
Definition: ipsec.h:297
ip46_address_t start
Definition: ipsec.h:149
#define clib_warning(format, args...)
Definition: error.h:59
#define ARRAY_LEN(x)
Definition: clib.h:61
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:455
ip46_address_range_t raddr
Definition: ipsec.h:207
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
Definition: node.h:513
static vlib_node_registration_t ipsec_input_ip4_node
(constructor) VLIB_REGISTER_NODE (ipsec_input_ip4_node)
Definition: ipsec_input.c:171
ipsec_sa_t * sad
Definition: ipsec.h:265
u32 seq
Definition: esp.h:28
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:218
static uword ipsec_input_ip4_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
Definition: ipsec_input.c:174
static uword ip6_address_is_equal(const ip6_address_t *a, const ip6_address_t *b)
Definition: ip6_packet.h:235
u32 spi
Definition: esp.h:27
static ipsec_policy_t * ipsec_input_ip6_protect_policy_match(ipsec_spd_t *spd, ip6_address_t *sa, ip6_address_t *da, u32 spi)
Definition: ipsec_input.c:132
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:57
struct _vlib_node_registration vlib_node_registration_t
counter_t bytes
byte counter
Definition: counter_types.h:29
#define foreach_ipsec_input_error
Definition: ipsec_input.c:27
u16 payload_length
Definition: ip6_packet.h:369
vlib_counter_t counter
Definition: ipsec.h:218
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:267
VLIB_NODE_FUNCTION_MULTIARCH(ipsec_input_ip4_node, ipsec_input_ip4_node_fn)
u32 id
Definition: ipsec.h:223
#define vnet_buffer(b)
Definition: buffer.h:344
Definition: ah.h:27
#define vec_foreach(var, vec)
Vector iterator.
static int ip4_header_bytes(const ip4_header_t *i)
Definition: ip4_packet.h:234
unsigned int spi
Definition: ah.h:32
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:116
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:58
ip6_address_t dst_address
Definition: ip6_packet.h:378