FD.io VPP  v19.04.2-12-g66b1689
Vector Packet Processing
ipsec_input.c
Go to the documentation of this file.
1 /*
2  * decap.c : IPSec tunnel decapsulation
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/feature/feature.h>
22 
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/esp.h>
25 #include <vnet/ipsec/ah.h>
26 #include <vnet/ipsec/ipsec_io.h>
27 
28 #define foreach_ipsec_input_error \
29 _(RX_PKTS, "IPSEC pkts received") \
30 _(RX_MATCH_PKTS, "IPSEC pkts matched")
31 
32 typedef enum
33 {
34 #define _(sym,str) IPSEC_INPUT_ERROR_##sym,
36 #undef _
39 
40 static char *ipsec_input_error_strings[] = {
41 #define _(sym,string) string,
43 #undef _
44 };
45 
46 typedef struct
47 {
55 
56 /* packet trace format function */
57 static u8 *
58 format_ipsec_input_trace (u8 * s, va_list * args)
59 {
60  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
61  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
62  ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
63 
64  s = format (s, "%U: sa_id %u spd %u policy %d spi %u seq %u",
66  t->spd, t->policy_index, t->spi, t->seq);
67 
68  return s;
69 }
70 
73 {
74  ipsec_main_t *im = &ipsec_main;
75  ipsec_policy_t *p;
76  ipsec_sa_t *s;
77  u32 *i;
78 
79  vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP4_INBOUND_PROTECT])
80  {
81  p = pool_elt_at_index (im->policies, *i);
82  s = pool_elt_at_index (im->sad, p->sa_index);
83 
84  if (spi != s->spi)
85  continue;
86 
87  if (ipsec_sa_is_set_IS_TUNNEL (s))
88  {
89  if (da != clib_net_to_host_u32 (s->tunnel_dst_addr.ip4.as_u32))
90  continue;
91 
92  if (sa != clib_net_to_host_u32 (s->tunnel_src_addr.ip4.as_u32))
93  continue;
94 
95  return p;
96  }
97 
98  if (da < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
99  continue;
100 
101  if (da > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
102  continue;
103 
104  if (sa < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
105  continue;
106 
107  if (sa > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
108  continue;
109 
110  return p;
111  }
112  return 0;
113 }
114 
117  ip6_address_t * ua)
118 {
119  if ((memcmp (a->as_u64, la->as_u64, 2 * sizeof (u64)) >= 0) &&
120  (memcmp (a->as_u64, ua->as_u64, 2 * sizeof (u64)) <= 0))
121  return 1;
122  return 0;
123 }
124 
127  ip6_address_t * sa,
128  ip6_address_t * da, u32 spi)
129 {
130  ipsec_main_t *im = &ipsec_main;
131  ipsec_policy_t *p;
132  ipsec_sa_t *s;
133  u32 *i;
134 
135  vec_foreach (i, spd->policies[IPSEC_SPD_POLICY_IP6_INBOUND_PROTECT])
136  {
137  p = pool_elt_at_index (im->policies, *i);
138  s = pool_elt_at_index (im->sad, p->sa_index);
139 
140  if (spi != s->spi)
141  continue;
142 
143  if (ipsec_sa_is_set_IS_TUNNEL (s))
144  {
145  if (!ip6_address_is_equal (sa, &s->tunnel_src_addr.ip6))
146  continue;
147 
148  if (!ip6_address_is_equal (da, &s->tunnel_dst_addr.ip6))
149  continue;
150 
151  return p;
152  }
153 
154  if (!ip6_addr_match_range (sa, &p->raddr.start.ip6, &p->raddr.stop.ip6))
155  continue;
156 
157  if (!ip6_addr_match_range (da, &p->laddr.start.ip6, &p->laddr.stop.ip6))
158  continue;
159 
160  return p;
161  }
162  return 0;
163 }
164 
166 
168  vlib_node_runtime_t * node,
169  vlib_frame_t * from_frame)
170 {
171  u32 n_left_from, *from, next_index, *to_next, thread_index;
172  ipsec_main_t *im = &ipsec_main;
173  u32 ipsec_unprocessed = 0;
174  u32 ipsec_matched = 0;
175 
176  from = vlib_frame_vector_args (from_frame);
177  n_left_from = from_frame->n_vectors;
178  thread_index = vm->thread_index;
179 
180  next_index = node->cached_next_index;
181 
182  while (n_left_from > 0)
183  {
184  u32 n_left_to_next;
185 
186  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
187 
188  while (n_left_from > 0 && n_left_to_next > 0)
189  {
190  u32 bi0, next0, pi0;
191  vlib_buffer_t *b0;
192  ip4_header_t *ip0;
193  esp_header_t *esp0;
194  ah_header_t *ah0;
195  ip4_ipsec_config_t *c0;
196  ipsec_spd_t *spd0;
197  ipsec_policy_t *p0 = 0;
198 
199  bi0 = to_next[0] = from[0];
200  from += 1;
201  n_left_from -= 1;
202  to_next += 1;
203  n_left_to_next -= 1;
204 
205  b0 = vlib_get_buffer (vm, bi0);
206  b0->flags |= VNET_BUFFER_F_IS_IP4;
207  b0->flags &= ~VNET_BUFFER_F_IS_IP6;
208  c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
209 
210  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
211 
212  ip0 = vlib_buffer_get_current (b0);
213 
214  if (PREDICT_TRUE
215  (ip0->protocol == IP_PROTOCOL_IPSEC_ESP
216  || ip0->protocol == IP_PROTOCOL_UDP))
217  {
218 #if 0
220  ("packet received from %U to %U spi %u size %u spd_id %u",
223  clib_net_to_host_u32 (esp0->spi),
224  clib_net_to_host_u16 (ip0->length), spd0->id);
225 #endif
226 
227  esp0 = (esp_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
228  if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_UDP))
229  {
230  esp0 =
231  (esp_header_t *) ((u8 *) esp0 + sizeof (udp_header_t));
232  }
233  /* FIXME TODO missing check whether there is enough data inside
234  * IP/UDP to contain ESP header & stuff ? */
236  clib_net_to_host_u32
237  (ip0->src_address.
238  as_u32),
239  clib_net_to_host_u32
240  (ip0->dst_address.
241  as_u32),
242  clib_net_to_host_u32
243  (esp0->spi));
244 
245  if (PREDICT_TRUE (p0 != NULL))
246  {
247  ipsec_matched += 1;
248 
249  pi0 = p0 - im->policies;
252  thread_index, pi0, 1,
253  clib_net_to_host_u16 (ip0->length));
254 
255  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
256  next0 = im->esp4_decrypt_next_index;
257  vlib_buffer_advance (b0, ((u8 *) esp0 - (u8 *) ip0));
258  goto trace0;
259  }
260  else
261  {
262  pi0 = ~0;
263  };
264 
265  /* FIXME bypass and discard */
266  trace0:
267  if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
268  PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
269  {
270  ipsec_input_trace_t *tr =
271  vlib_add_trace (vm, node, b0, sizeof (*tr));
272 
273  tr->proto = ip0->protocol;
274  if (p0)
275  tr->sa_id = p0->sa_id;
276  tr->spi = clib_net_to_host_u32 (esp0->spi);
277  tr->seq = clib_net_to_host_u32 (esp0->seq);
278  tr->spd = spd0->id;
279  tr->policy_index = pi0;
280  }
281  }
282  else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
283  {
284  ah0 = (ah_header_t *) ((u8 *) ip0 + ip4_header_bytes (ip0));
286  clib_net_to_host_u32
287  (ip0->src_address.
288  as_u32),
289  clib_net_to_host_u32
290  (ip0->dst_address.
291  as_u32),
292  clib_net_to_host_u32
293  (ah0->spi));
294 
295  if (PREDICT_TRUE (p0 != 0))
296  {
297  ipsec_matched += 1;
298 
299  pi0 = p0 - im->policies;
302  thread_index, pi0, 1,
303  clib_net_to_host_u16 (ip0->length));
304 
305  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
306  next0 = im->ah4_decrypt_next_index;
307  goto trace1;
308  }
309  else
310  {
311  pi0 = ~0;
312  }
313  /* FIXME bypass and discard */
314  trace1:
315  if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
316  PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
317  {
318  ipsec_input_trace_t *tr =
319  vlib_add_trace (vm, node, b0, sizeof (*tr));
320 
321  tr->proto = ip0->protocol;
322  if (p0)
323  tr->sa_id = p0->sa_id;
324  tr->spi = clib_net_to_host_u32 (ah0->spi);
325  tr->seq = clib_net_to_host_u32 (ah0->seq_no);
326  tr->spd = spd0->id;
327  tr->policy_index = pi0;
328  }
329  }
330  else
331  {
332  ipsec_unprocessed += 1;
333  }
334 
335  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
336  to_next, n_left_to_next, bi0,
337  next0);
338  }
339  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
340  }
341 
343  IPSEC_INPUT_ERROR_RX_PKTS,
344  from_frame->n_vectors - ipsec_unprocessed);
345 
347  IPSEC_INPUT_ERROR_RX_MATCH_PKTS,
348  ipsec_matched);
349  return from_frame->n_vectors;
350 }
351 
352 
353 /* *INDENT-OFF* */
355  .name = "ipsec4-input-feature",
356  .vector_size = sizeof (u32),
357  .format_trace = format_ipsec_input_trace,
358  .type = VLIB_NODE_TYPE_INTERNAL,
360  .error_strings = ipsec_input_error_strings,
361  .n_next_nodes = IPSEC_INPUT_N_NEXT,
362  .next_nodes = {
363 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
365 #undef _
366  },
367 };
368 /* *INDENT-ON* */
369 
371 
372 
374  vlib_node_runtime_t * node,
375  vlib_frame_t * from_frame)
376 {
377  u32 n_left_from, *from, next_index, *to_next, thread_index;
378  ipsec_main_t *im = &ipsec_main;
379  u32 ipsec_unprocessed = 0;
380  u32 ipsec_matched = 0;
381 
382  from = vlib_frame_vector_args (from_frame);
383  n_left_from = from_frame->n_vectors;
384  thread_index = vm->thread_index;
385 
386  next_index = node->cached_next_index;
387 
388  while (n_left_from > 0)
389  {
390  u32 n_left_to_next;
391 
392  vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
393 
394  while (n_left_from > 0 && n_left_to_next > 0)
395  {
396  u32 bi0, next0, pi0;
397  vlib_buffer_t *b0;
398  ip6_header_t *ip0;
399  esp_header_t *esp0;
400  ip4_ipsec_config_t *c0;
401  ipsec_spd_t *spd0;
402  ipsec_policy_t *p0 = 0;
403  ah_header_t *ah0;
404  u32 header_size = sizeof (ip0[0]);
405 
406  bi0 = to_next[0] = from[0];
407  from += 1;
408  n_left_from -= 1;
409  to_next += 1;
410  n_left_to_next -= 1;
411 
412  b0 = vlib_get_buffer (vm, bi0);
413  b0->flags |= VNET_BUFFER_F_IS_IP6;
414  b0->flags &= ~VNET_BUFFER_F_IS_IP4;
415  c0 = vnet_feature_next_with_data (&next0, b0, sizeof (c0[0]));
416 
417  spd0 = pool_elt_at_index (im->spds, c0->spd_index);
418 
419  ip0 = vlib_buffer_get_current (b0);
420  esp0 = (esp_header_t *) ((u8 *) ip0 + header_size);
421  ah0 = (ah_header_t *) ((u8 *) ip0 + header_size);
422 
423  if (PREDICT_TRUE (ip0->protocol == IP_PROTOCOL_IPSEC_ESP))
424  {
425 #if 0
427  ("packet received from %U to %U spi %u size %u spd_id %u",
429  &ip0->dst_address, clib_net_to_host_u32 (esp0->spi),
430  clib_net_to_host_u16 (ip0->payload_length) + header_size,
431  spd0->id);
432 #endif
434  &ip0->src_address,
435  &ip0->dst_address,
436  clib_net_to_host_u32
437  (esp0->spi));
438 
439  if (PREDICT_TRUE (p0 != 0))
440  {
441  ipsec_matched += 1;
442 
443  pi0 = p0 - im->policies;
446  thread_index, pi0, 1,
447  clib_net_to_host_u16 (ip0->payload_length) +
448  header_size);
449 
450  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
451  next0 = im->esp6_decrypt_next_index;
452  vlib_buffer_advance (b0, header_size);
453  goto trace0;
454  }
455  else
456  {
457  pi0 = ~0;
458  }
459  }
460  else if (ip0->protocol == IP_PROTOCOL_IPSEC_AH)
461  {
463  &ip0->src_address,
464  &ip0->dst_address,
465  clib_net_to_host_u32
466  (ah0->spi));
467 
468  if (PREDICT_TRUE (p0 != 0))
469  {
470  ipsec_matched += 1;
471  pi0 = p0 - im->policies;
474  thread_index, pi0, 1,
475  clib_net_to_host_u16 (ip0->payload_length) +
476  header_size);
477 
478  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
479  next0 = im->ah6_decrypt_next_index;
480  goto trace0;
481  }
482  else
483  {
484  pi0 = ~0;
485  }
486  }
487  else
488  {
489  ipsec_unprocessed += 1;
490  }
491 
492  trace0:
493  if (PREDICT_FALSE (node->flags & VLIB_NODE_FLAG_TRACE) &&
494  PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
495  {
496  ipsec_input_trace_t *tr =
497  vlib_add_trace (vm, node, b0, sizeof (*tr));
498 
499  if (p0)
500  tr->sa_id = p0->sa_id;
501  tr->proto = ip0->protocol;
502  tr->spi = clib_net_to_host_u32 (esp0->spi);
503  tr->seq = clib_net_to_host_u32 (esp0->seq);
504  tr->spd = spd0->id;
505  }
506 
507  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
508  n_left_to_next, bi0, next0);
509  }
510  vlib_put_next_frame (vm, node, next_index, n_left_to_next);
511  }
512 
514  IPSEC_INPUT_ERROR_RX_PKTS,
515  from_frame->n_vectors - ipsec_unprocessed);
516 
518  IPSEC_INPUT_ERROR_RX_MATCH_PKTS,
519  ipsec_matched);
520 
521  return from_frame->n_vectors;
522 }
523 
524 
525 /* *INDENT-OFF* */
527  .name = "ipsec6-input-feature",
528  .vector_size = sizeof (u32),
529  .format_trace = format_ipsec_input_trace,
530  .type = VLIB_NODE_TYPE_INTERNAL,
532  .error_strings = ipsec_input_error_strings,
533  .n_next_nodes = IPSEC_INPUT_N_NEXT,
534  .next_nodes = {
535 #define _(s,n) [IPSEC_INPUT_NEXT_##s] = n,
537 #undef _
538  },
539 };
540 /* *INDENT-ON* */
541 
542 /*
543  * fd.io coding-style-patch-verification: ON
544  *
545  * Local Variables:
546  * eval: (c-set-style "gnu")
547  * End:
548  */
static char * ipsec_input_error_strings[]
Definition: ipsec_input.c:40
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
format_function_t format_ip_protocol
Definition: format.h:45
ipsec_spd_t * spds
Definition: ipsec.h:93
#define CLIB_UNUSED(x)
Definition: clib.h:82
ip46_address_t tunnel_src_addr
Definition: ipsec_sa.h:156
u32 ah4_decrypt_next_index
Definition: ipsec.h:131
a
Definition: bitmap.h:538
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
Definition: counter.h:220
ip4_address_t src_address
Definition: ip4_packet.h:170
#define PREDICT_TRUE(x)
Definition: clib.h:112
u64 as_u64[2]
Definition: ip6_packet.h:51
unsigned long u64
Definition: types.h:89
ip46_address_range_t laddr
#define NULL
Definition: clib.h:58
u32 thread_index
Definition: main.h:197
static ipsec_policy_t * ipsec_input_protect_policy_match(ipsec_spd_t *spd, u32 sa, u32 da, u32 spi)
Definition: ipsec_input.c:72
int i
static uword ip6_addr_match_range(ip6_address_t *a, ip6_address_t *la, ip6_address_t *ua)
Definition: ipsec_input.c:116
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
A Secruity Policy Database.
Definition: ipsec_spd.h:44
#define VLIB_NODE_FN(node)
Definition: node.h:201
static vlib_node_registration_t ipsec6_input_node
(constructor) VLIB_REGISTER_NODE (ipsec6_input_node)
Definition: ipsec_input.c:370
static u8 * format_ipsec_input_trace(u8 *s, va_list *args)
Definition: ipsec_input.c:58
ip6_address_t src_address
Definition: ip6_packet.h:385
unsigned char u8
Definition: types.h:56
format_function_t format_ip4_address
Definition: format.h:75
ipsec_main_t ipsec_main
Definition: ipsec.c:28
unsigned int seq_no
Definition: ah.h:27
#define always_inline
Definition: clib.h:98
ip4_address_t dst_address
Definition: ip4_packet.h:170
u32 esp4_decrypt_next_index
Definition: ipsec.h:129
unsigned int u32
Definition: types.h:88
static_always_inline void * vnet_feature_next_with_data(u32 *next0, vlib_buffer_t *b0, u32 n_data_bytes)
Definition: feature.h:282
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:514
vlib_combined_counter_main_t ipsec_spd_policy_counters
Policy packet & bytes counters.
ipsec_input_error_t
Definition: ipsec_input.c:32
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
#define PREDICT_FALSE(x)
Definition: clib.h:111
static vlib_node_registration_t ipsec4_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_input_node)
Definition: ipsec_input.c:165
enum ip_protocol ip_protocol_t
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
Definition: buffer_node.h:218
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
Definition: node_funcs.h:368
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1180
ip46_address_t tunnel_dst_addr
Definition: ipsec_sa.h:157
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
format_function_t format_ip6_address
Definition: format.h:93
vlib_main_t * vm
Definition: buffer.c:312
ip46_address_t start
#define clib_warning(format, args...)
Definition: error.h:59
u32 esp6_decrypt_next_index
Definition: ipsec.h:133
#define ARRAY_LEN(x)
Definition: clib.h:62
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
Definition: main.c:465
A Secruity Policy.
ip_protocol_t proto
Definition: ipsec_input.c:48
u32 spi
Definition: ipsec.api:270
ipsec_policy_t * policies
Definition: ipsec.h:97
ipsec_sa_t * sad
Definition: ipsec.h:95
u32 * policies[IPSEC_SPD_POLICY_N_TYPES]
vectors for each of the policy types
Definition: ipsec_spd.h:49
u32 seq
Definition: esp.h:25
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:248
static uword ip6_address_is_equal(const ip6_address_t *a, const ip6_address_t *b)
Definition: ip6_packet.h:242
u32 spi
Definition: esp.h:24
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:57
struct _vlib_node_registration vlib_node_registration_t
#define foreach_ipsec_input_error
Definition: ipsec_input.c:28
u32 ah6_decrypt_next_index
Definition: ipsec.h:135
u16 payload_length
Definition: ip6_packet.h:376
ip46_address_range_t raddr
VLIB buffer representation.
Definition: buffer.h:102
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:274
u32 id
the User&#39;s ID for this policy
Definition: ipsec_spd.h:47
#define vnet_buffer(b)
Definition: buffer.h:369
Definition: ah.h:21
#define vec_foreach(var, vec)
Vector iterator.
static int ip4_header_bytes(const ip4_header_t *i)
Definition: ip4_packet.h:235
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:301
unsigned int spi
Definition: ah.h:26
static ipsec_policy_t * ipsec6_input_protect_policy_match(ipsec_spd_t *spd, ip6_address_t *sa, ip6_address_t *da, u32 spi)
Definition: ipsec_input.c:126
#define foreach_ipsec_input_next
Definition: ipsec_io.h:29
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
ip6_address_t dst_address
Definition: ip6_packet.h:385