1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(c) 2016 Intel Corporation
3 */
4
5 /*
6 * Security Policies
7 */
8 #include <sys/types.h>
9 #include <netinet/in.h>
10 #include <netinet/ip.h>
11
12 #include <rte_acl.h>
13 #include <rte_ip.h>
14
15 #include "ipsec.h"
16 #include "parser.h"
17
18 #define INIT_ACL_RULE_NUM 128
19
20 #define IPV4_DST_FROM_SP(acr) \
21 (rte_cpu_to_be_32((acr).field[DST_FIELD_IPV4].value.u32))
22
23 #define IPV4_SRC_FROM_SP(acr) \
24 (rte_cpu_to_be_32((acr).field[SRC_FIELD_IPV4].value.u32))
25
26 #define IPV4_DST_MASK_FROM_SP(acr) \
27 ((acr).field[DST_FIELD_IPV4].mask_range.u32)
28
29 #define IPV4_SRC_MASK_FROM_SP(acr) \
30 ((acr).field[SRC_FIELD_IPV4].mask_range.u32)
31
32 /*
33 * Rule and trace formats definitions.
34 */
35 enum {
36 PROTO_FIELD_IPV4,
37 SRC_FIELD_IPV4,
38 DST_FIELD_IPV4,
39 SRCP_FIELD_IPV4,
40 DSTP_FIELD_IPV4,
41 NUM_FIELDS_IPV4
42 };
43
44 /*
45 * That effectively defines order of IPV4 classifications:
46 * - PROTO
47 * - SRC IP ADDRESS
48 * - DST IP ADDRESS
49 * - PORTS (SRC and DST)
50 */
51 enum {
52 RTE_ACL_IPV4_PROTO,
53 RTE_ACL_IPV4_SRC,
54 RTE_ACL_IPV4_DST,
55 RTE_ACL_IPV4_PORTS,
56 RTE_ACL_IPV4_NUM
57 };
58
59 static struct rte_acl_field_def ip4_defs[NUM_FIELDS_IPV4] = {
60 {
61 .type = RTE_ACL_FIELD_TYPE_BITMASK,
62 .size = sizeof(uint8_t),
63 .field_index = PROTO_FIELD_IPV4,
64 .input_index = RTE_ACL_IPV4_PROTO,
65 .offset = 0,
66 },
67 {
68 .type = RTE_ACL_FIELD_TYPE_MASK,
69 .size = sizeof(uint32_t),
70 .field_index = SRC_FIELD_IPV4,
71 .input_index = RTE_ACL_IPV4_SRC,
72 .offset = offsetof(struct ip, ip_src) - offsetof(struct ip, ip_p)
73 },
74 {
75 .type = RTE_ACL_FIELD_TYPE_MASK,
76 .size = sizeof(uint32_t),
77 .field_index = DST_FIELD_IPV4,
78 .input_index = RTE_ACL_IPV4_DST,
79 .offset = offsetof(struct ip, ip_dst) - offsetof(struct ip, ip_p)
80 },
81 {
82 .type = RTE_ACL_FIELD_TYPE_RANGE,
83 .size = sizeof(uint16_t),
84 .field_index = SRCP_FIELD_IPV4,
85 .input_index = RTE_ACL_IPV4_PORTS,
86 .offset = sizeof(struct ip) - offsetof(struct ip, ip_p)
87 },
88 {
89 .type = RTE_ACL_FIELD_TYPE_RANGE,
90 .size = sizeof(uint16_t),
91 .field_index = DSTP_FIELD_IPV4,
92 .input_index = RTE_ACL_IPV4_PORTS,
93 .offset = sizeof(struct ip) - offsetof(struct ip, ip_p) +
94 sizeof(uint16_t)
95 },
96 };
97
98 RTE_ACL_RULE_DEF(acl4_rules, RTE_DIM(ip4_defs));
99
100 static struct acl4_rules *acl4_rules_out;
101 static uint32_t nb_acl4_rules_out;
102 static uint32_t sp_out_sz;
103
104 static struct acl4_rules *acl4_rules_in;
105 static uint32_t nb_acl4_rules_in;
106 static uint32_t sp_in_sz;
107
108 static int
extend_sp_arr(struct acl4_rules ** sp_tbl,uint32_t cur_cnt,uint32_t * cur_sz)109 extend_sp_arr(struct acl4_rules **sp_tbl, uint32_t cur_cnt, uint32_t *cur_sz)
110 {
111 if (*sp_tbl == NULL) {
112 *sp_tbl = calloc(INIT_ACL_RULE_NUM, sizeof(struct acl4_rules));
113 if (*sp_tbl == NULL)
114 return -1;
115 *cur_sz = INIT_ACL_RULE_NUM;
116 return 0;
117 }
118
119 if (cur_cnt >= *cur_sz) {
120 *sp_tbl = realloc(*sp_tbl,
121 *cur_sz * sizeof(struct acl4_rules) * 2);
122 if (*sp_tbl == NULL)
123 return -1;
124 /* clean reallocated extra space */
125 memset(&(*sp_tbl)[*cur_sz], 0,
126 *cur_sz * sizeof(struct acl4_rules));
127 *cur_sz *= 2;
128 }
129
130 return 0;
131 }
132
133
134 void
parse_sp4_tokens(char ** tokens,uint32_t n_tokens,struct parse_status * status)135 parse_sp4_tokens(char **tokens, uint32_t n_tokens,
136 struct parse_status *status)
137 {
138 struct acl4_rules *rule_ipv4 = NULL;
139
140 uint32_t *ri = NULL; /* rule index */
141 uint32_t ti = 0; /* token index */
142 uint32_t tv;
143
144 uint32_t esp_p = 0;
145 uint32_t protect_p = 0;
146 uint32_t bypass_p = 0;
147 uint32_t discard_p = 0;
148 uint32_t pri_p = 0;
149 uint32_t src_p = 0;
150 uint32_t dst_p = 0;
151 uint32_t proto_p = 0;
152 uint32_t sport_p = 0;
153 uint32_t dport_p = 0;
154
155 if (strcmp(tokens[1], "in") == 0) {
156 ri = &nb_acl4_rules_in;
157
158 if (extend_sp_arr(&acl4_rules_in, nb_acl4_rules_in,
159 &sp_in_sz) < 0)
160 return;
161
162 rule_ipv4 = &acl4_rules_in[*ri];
163
164 } else if (strcmp(tokens[1], "out") == 0) {
165 ri = &nb_acl4_rules_out;
166
167 if (extend_sp_arr(&acl4_rules_out, nb_acl4_rules_out,
168 &sp_out_sz) < 0)
169 return;
170
171 rule_ipv4 = &acl4_rules_out[*ri];
172 } else {
173 APP_CHECK(0, status, "unrecognized input \"%s\", expect"
174 " \"in\" or \"out\"\n", tokens[ti]);
175 return;
176 }
177
178 rule_ipv4->data.category_mask = 1;
179
180 for (ti = 2; ti < n_tokens; ti++) {
181 if (strcmp(tokens[ti], "esp") == 0) {
182 /* currently do nothing */
183 APP_CHECK_PRESENCE(esp_p, tokens[ti], status);
184 if (status->status < 0)
185 return;
186 esp_p = 1;
187 continue;
188 }
189
190 if (strcmp(tokens[ti], "protect") == 0) {
191 APP_CHECK_PRESENCE(protect_p, tokens[ti], status);
192 if (status->status < 0)
193 return;
194 APP_CHECK(bypass_p == 0, status, "conflict item "
195 "between \"%s\" and \"%s\"", tokens[ti],
196 "bypass");
197 if (status->status < 0)
198 return;
199 APP_CHECK(discard_p == 0, status, "conflict item "
200 "between \"%s\" and \"%s\"", tokens[ti],
201 "discard");
202 if (status->status < 0)
203 return;
204 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
205 if (status->status < 0)
206 return;
207 APP_CHECK_TOKEN_IS_NUM(tokens, ti, status);
208 if (status->status < 0)
209 return;
210
211 tv = atoi(tokens[ti]);
212 APP_CHECK(tv != DISCARD && tv != BYPASS, status,
213 "invalid SPI: %s", tokens[ti]);
214 if (status->status < 0)
215 return;
216 rule_ipv4->data.userdata = tv;
217
218 protect_p = 1;
219 continue;
220 }
221
222 if (strcmp(tokens[ti], "bypass") == 0) {
223 APP_CHECK_PRESENCE(bypass_p, tokens[ti], status);
224 if (status->status < 0)
225 return;
226 APP_CHECK(protect_p == 0, status, "conflict item "
227 "between \"%s\" and \"%s\"", tokens[ti],
228 "protect");
229 if (status->status < 0)
230 return;
231 APP_CHECK(discard_p == 0, status, "conflict item "
232 "between \"%s\" and \"%s\"", tokens[ti],
233 "discard");
234 if (status->status < 0)
235 return;
236
237 rule_ipv4->data.userdata = BYPASS;
238
239 bypass_p = 1;
240 continue;
241 }
242
243 if (strcmp(tokens[ti], "discard") == 0) {
244 APP_CHECK_PRESENCE(discard_p, tokens[ti], status);
245 if (status->status < 0)
246 return;
247 APP_CHECK(protect_p == 0, status, "conflict item "
248 "between \"%s\" and \"%s\"", tokens[ti],
249 "protect");
250 if (status->status < 0)
251 return;
252 APP_CHECK(bypass_p == 0, status, "conflict item "
253 "between \"%s\" and \"%s\"", tokens[ti],
254 "discard");
255 if (status->status < 0)
256 return;
257
258 rule_ipv4->data.userdata = DISCARD;
259
260 discard_p = 1;
261 continue;
262 }
263
264 if (strcmp(tokens[ti], "pri") == 0) {
265 APP_CHECK_PRESENCE(pri_p, tokens[ti], status);
266 if (status->status < 0)
267 return;
268 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
269 if (status->status < 0)
270 return;
271 APP_CHECK_TOKEN_IS_NUM(tokens, ti, status);
272 if (status->status < 0)
273 return;
274
275 rule_ipv4->data.priority = atoi(tokens[ti]);
276
277 pri_p = 1;
278 continue;
279 }
280
281 if (strcmp(tokens[ti], "src") == 0) {
282 struct in_addr ip;
283 uint32_t depth;
284
285 APP_CHECK_PRESENCE(src_p, tokens[ti], status);
286 if (status->status < 0)
287 return;
288 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
289 if (status->status < 0)
290 return;
291
292 APP_CHECK(parse_ipv4_addr(tokens[ti], &ip,
293 &depth) == 0, status, "unrecognized "
294 "input \"%s\", expect valid ipv4 addr",
295 tokens[ti]);
296 if (status->status < 0)
297 return;
298
299 rule_ipv4->field[1].value.u32 =
300 rte_bswap32(ip.s_addr);
301 rule_ipv4->field[1].mask_range.u32 =
302 depth;
303
304 src_p = 1;
305 continue;
306 }
307
308 if (strcmp(tokens[ti], "dst") == 0) {
309 struct in_addr ip;
310 uint32_t depth;
311
312 APP_CHECK_PRESENCE(dst_p, tokens[ti], status);
313 if (status->status < 0)
314 return;
315 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
316 if (status->status < 0)
317 return;
318 APP_CHECK(parse_ipv4_addr(tokens[ti], &ip,
319 &depth) == 0, status, "unrecognized "
320 "input \"%s\", expect valid ipv4 addr",
321 tokens[ti]);
322 if (status->status < 0)
323 return;
324
325 rule_ipv4->field[2].value.u32 =
326 rte_bswap32(ip.s_addr);
327 rule_ipv4->field[2].mask_range.u32 =
328 depth;
329
330 dst_p = 1;
331 continue;
332 }
333
334 if (strcmp(tokens[ti], "proto") == 0) {
335 uint16_t low, high;
336
337 APP_CHECK_PRESENCE(proto_p, tokens[ti], status);
338 if (status->status < 0)
339 return;
340 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
341 if (status->status < 0)
342 return;
343
344 APP_CHECK(parse_range(tokens[ti], &low, &high)
345 == 0, status, "unrecognized input \"%s\""
346 ", expect \"from:to\"", tokens[ti]);
347 if (status->status < 0)
348 return;
349 APP_CHECK(low <= 0xff, status, "proto low "
350 "over-limit");
351 if (status->status < 0)
352 return;
353 APP_CHECK(high <= 0xff, status, "proto high "
354 "over-limit");
355 if (status->status < 0)
356 return;
357
358 rule_ipv4->field[0].value.u8 = (uint8_t)low;
359 rule_ipv4->field[0].mask_range.u8 = (uint8_t)high;
360
361 proto_p = 1;
362 continue;
363 }
364
365 if (strcmp(tokens[ti], "sport") == 0) {
366 uint16_t port_low, port_high;
367
368 APP_CHECK_PRESENCE(sport_p, tokens[ti], status);
369 if (status->status < 0)
370 return;
371 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
372 if (status->status < 0)
373 return;
374
375 APP_CHECK(parse_range(tokens[ti], &port_low,
376 &port_high) == 0, status, "unrecognized "
377 "input \"%s\", expect \"port_from:"
378 "port_to\"", tokens[ti]);
379 if (status->status < 0)
380 return;
381
382 rule_ipv4->field[3].value.u16 = port_low;
383 rule_ipv4->field[3].mask_range.u16 = port_high;
384
385 sport_p = 1;
386 continue;
387 }
388
389 if (strcmp(tokens[ti], "dport") == 0) {
390 uint16_t port_low, port_high;
391
392 APP_CHECK_PRESENCE(dport_p, tokens[ti], status);
393 if (status->status < 0)
394 return;
395 INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
396 if (status->status < 0)
397 return;
398
399 APP_CHECK(parse_range(tokens[ti], &port_low,
400 &port_high) == 0, status, "unrecognized "
401 "input \"%s\", expect \"port_from:"
402 "port_to\"", tokens[ti]);
403 if (status->status < 0)
404 return;
405
406 rule_ipv4->field[4].value.u16 = port_low;
407 rule_ipv4->field[4].mask_range.u16 = port_high;
408
409 dport_p = 1;
410 continue;
411 }
412
413 /* unrecognizable input */
414 APP_CHECK(0, status, "unrecognized input \"%s\"",
415 tokens[ti]);
416 return;
417 }
418
419 /* check if argument(s) are missing */
420 APP_CHECK(esp_p == 1, status, "missing argument \"esp\"");
421 if (status->status < 0)
422 return;
423
424 APP_CHECK(protect_p | bypass_p | discard_p, status, "missing "
425 "argument \"protect\", \"bypass\", or \"discard\"");
426 if (status->status < 0)
427 return;
428
429 *ri = *ri + 1;
430 }
431
432 static void
print_one_ip4_rule(const struct acl4_rules * rule,int32_t extra)433 print_one_ip4_rule(const struct acl4_rules *rule, int32_t extra)
434 {
435 uint8_t a, b, c, d;
436
437 uint32_t_to_char(rule->field[SRC_FIELD_IPV4].value.u32,
438 &a, &b, &c, &d);
439 printf("%hhu.%hhu.%hhu.%hhu/%u ", a, b, c, d,
440 rule->field[SRC_FIELD_IPV4].mask_range.u32);
441 uint32_t_to_char(rule->field[DST_FIELD_IPV4].value.u32,
442 &a, &b, &c, &d);
443 printf("%hhu.%hhu.%hhu.%hhu/%u ", a, b, c, d,
444 rule->field[DST_FIELD_IPV4].mask_range.u32);
445 printf("%hu : %hu %hu : %hu 0x%hhx/0x%hhx ",
446 rule->field[SRCP_FIELD_IPV4].value.u16,
447 rule->field[SRCP_FIELD_IPV4].mask_range.u16,
448 rule->field[DSTP_FIELD_IPV4].value.u16,
449 rule->field[DSTP_FIELD_IPV4].mask_range.u16,
450 rule->field[PROTO_FIELD_IPV4].value.u8,
451 rule->field[PROTO_FIELD_IPV4].mask_range.u8);
452 if (extra)
453 printf("0x%x-0x%x-0x%x ",
454 rule->data.category_mask,
455 rule->data.priority,
456 rule->data.userdata);
457 }
458
459 static inline void
dump_ip4_rules(const struct acl4_rules * rule,int32_t num,int32_t extra)460 dump_ip4_rules(const struct acl4_rules *rule, int32_t num, int32_t extra)
461 {
462 int32_t i;
463
464 for (i = 0; i < num; i++, rule++) {
465 printf("\t%d:", i + 1);
466 print_one_ip4_rule(rule, extra);
467 printf("\n");
468 }
469 }
470
471 static struct rte_acl_ctx *
acl4_init(const char * name,int32_t socketid,const struct acl4_rules * rules,uint32_t rules_nb)472 acl4_init(const char *name, int32_t socketid, const struct acl4_rules *rules,
473 uint32_t rules_nb)
474 {
475 char s[PATH_MAX];
476 struct rte_acl_param acl_param;
477 struct rte_acl_config acl_build_param;
478 struct rte_acl_ctx *ctx;
479
480 printf("Creating SP context with %u rules\n", rules_nb);
481
482 memset(&acl_param, 0, sizeof(acl_param));
483
484 /* Create ACL contexts */
485 snprintf(s, sizeof(s), "%s_%d", name, socketid);
486
487 printf("IPv4 %s entries [%u]:\n", s, rules_nb);
488 dump_ip4_rules(rules, rules_nb, 1);
489
490 acl_param.name = s;
491 acl_param.socket_id = socketid;
492 acl_param.rule_size = RTE_ACL_RULE_SZ(RTE_DIM(ip4_defs));
493 acl_param.max_rule_num = rules_nb;
494
495 ctx = rte_acl_create(&acl_param);
496 if (ctx == NULL)
497 rte_exit(EXIT_FAILURE, "Failed to create ACL context\n");
498
499 if (rte_acl_add_rules(ctx, (const struct rte_acl_rule *)rules,
500 rules_nb) < 0)
501 rte_exit(EXIT_FAILURE, "add rules failed\n");
502
503 /* Perform builds */
504 memset(&acl_build_param, 0, sizeof(acl_build_param));
505
506 acl_build_param.num_categories = DEFAULT_MAX_CATEGORIES;
507 acl_build_param.num_fields = RTE_DIM(ip4_defs);
508 memcpy(&acl_build_param.defs, ip4_defs, sizeof(ip4_defs));
509
510 if (rte_acl_build(ctx, &acl_build_param) != 0)
511 rte_exit(EXIT_FAILURE, "Failed to build ACL trie\n");
512
513 rte_acl_dump(ctx);
514
515 return ctx;
516 }
517
518 /*
519 * check that for each rule it's SPI has a correspondent entry in SAD
520 */
521 static int
check_spi_value(struct sa_ctx * sa_ctx,int inbound)522 check_spi_value(struct sa_ctx *sa_ctx, int inbound)
523 {
524 uint32_t i, num, spi;
525 int32_t spi_idx;
526 struct acl4_rules *acr;
527
528 if (inbound != 0) {
529 acr = acl4_rules_in;
530 num = nb_acl4_rules_in;
531 } else {
532 acr = acl4_rules_out;
533 num = nb_acl4_rules_out;
534 }
535
536 for (i = 0; i != num; i++) {
537 spi = acr[i].data.userdata;
538 if (spi != DISCARD && spi != BYPASS) {
539 spi_idx = sa_spi_present(sa_ctx, spi, inbound);
540 if (spi_idx < 0) {
541 RTE_LOG(ERR, IPSEC,
542 "SPI %u is not present in SAD\n",
543 spi);
544 return -ENOENT;
545 }
546 /* Update userdata with spi index */
547 acr[i].data.userdata = spi_idx + 1;
548 }
549 }
550
551 return 0;
552 }
553
554 void
sp4_init(struct socket_ctx * ctx,int32_t socket_id)555 sp4_init(struct socket_ctx *ctx, int32_t socket_id)
556 {
557 const char *name;
558
559 if (ctx == NULL)
560 rte_exit(EXIT_FAILURE, "NULL context.\n");
561
562 if (ctx->sp_ip4_in != NULL)
563 rte_exit(EXIT_FAILURE, "Inbound SP DB for socket %u already "
564 "initialized\n", socket_id);
565
566 if (ctx->sp_ip4_out != NULL)
567 rte_exit(EXIT_FAILURE, "Outbound SP DB for socket %u already "
568 "initialized\n", socket_id);
569
570 if (check_spi_value(ctx->sa_in, 1) < 0)
571 rte_exit(EXIT_FAILURE,
572 "Inbound IPv4 SP DB has unmatched in SAD SPIs\n");
573
574 if (check_spi_value(ctx->sa_out, 0) < 0)
575 rte_exit(EXIT_FAILURE,
576 "Outbound IPv4 SP DB has unmatched in SAD SPIs\n");
577
578 if (nb_acl4_rules_in > 0) {
579 name = "sp_ip4_in";
580 ctx->sp_ip4_in = (struct sp_ctx *)acl4_init(name,
581 socket_id, acl4_rules_in, nb_acl4_rules_in);
582 } else
583 RTE_LOG(WARNING, IPSEC, "No IPv4 SP Inbound rule "
584 "specified\n");
585
586 if (nb_acl4_rules_out > 0) {
587 name = "sp_ip4_out";
588 ctx->sp_ip4_out = (struct sp_ctx *)acl4_init(name,
589 socket_id, acl4_rules_out, nb_acl4_rules_out);
590 } else
591 RTE_LOG(WARNING, IPSEC, "No IPv4 SP Outbound rule "
592 "specified\n");
593 }
594
595 static int
sp_cmp(const void * p,const void * q)596 sp_cmp(const void *p, const void *q)
597 {
598 uint32_t spi1 = ((const struct acl4_rules *)p)->data.userdata;
599 uint32_t spi2 = ((const struct acl4_rules *)q)->data.userdata;
600
601 return (int)(spi1 - spi2);
602 }
603
604
605 /*
606 * Search though SP rules for given SPI.
607 */
608 int
sp4_spi_present(uint32_t spi,int inbound,struct ip_addr ip_addr[2],uint32_t mask[2])609 sp4_spi_present(uint32_t spi, int inbound, struct ip_addr ip_addr[2],
610 uint32_t mask[2])
611 {
612 uint32_t num;
613 struct acl4_rules *rule;
614 const struct acl4_rules *acr;
615 struct acl4_rules tmpl;
616
617 if (inbound != 0) {
618 acr = acl4_rules_in;
619 num = nb_acl4_rules_in;
620 } else {
621 acr = acl4_rules_out;
622 num = nb_acl4_rules_out;
623 }
624
625 tmpl.data.userdata = spi;
626
627 rule = bsearch(&tmpl, acr, num, sizeof(struct acl4_rules), sp_cmp);
628 if (rule != NULL) {
629 if (NULL != ip_addr && NULL != mask) {
630 ip_addr[0].ip.ip4 = IPV4_SRC_FROM_SP(*rule);
631 ip_addr[1].ip.ip4 = IPV4_DST_FROM_SP(*rule);
632 mask[0] = IPV4_SRC_MASK_FROM_SP(*rule);
633 mask[1] = IPV4_DST_MASK_FROM_SP(*rule);
634 }
635 return RTE_PTR_DIFF(rule, acr) / sizeof(struct acl4_rules);
636 }
637
638 return -ENOENT;
639 }
640
641 void
sp4_sort_arr(void)642 sp4_sort_arr(void)
643 {
644 qsort(acl4_rules_in, nb_acl4_rules_in, sizeof(struct acl4_rules),
645 sp_cmp);
646 qsort(acl4_rules_out, nb_acl4_rules_out, sizeof(struct acl4_rules),
647 sp_cmp);
648 }
649