“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 1 | /* |
| 2 | * ah_decrypt.c : IPSec AH decrypt node |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | |
| 22 | #include <vnet/ipsec/ipsec.h> |
| 23 | #include <vnet/ipsec/esp.h> |
| 24 | #include <vnet/ipsec/ah.h> |
Neale Ranns | 918c161 | 2019-02-21 23:34:59 -0800 | [diff] [blame] | 25 | #include <vnet/ipsec/ipsec_io.h> |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 26 | |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 27 | #define foreach_ah_decrypt_next \ |
| 28 | _(DROP, "error-drop") \ |
| 29 | _(IP4_INPUT, "ip4-input") \ |
| 30 | _(IP6_INPUT, "ip6-input") \ |
| 31 | _(HANDOFF, "handoff") |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 32 | |
| 33 | #define _(v, s) AH_DECRYPT_NEXT_##v, |
| 34 | typedef enum |
| 35 | { |
| 36 | foreach_ah_decrypt_next |
| 37 | #undef _ |
| 38 | AH_DECRYPT_N_NEXT, |
| 39 | } ah_decrypt_next_t; |
| 40 | |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 41 | typedef struct |
| 42 | { |
| 43 | ipsec_integ_alg_t integ_alg; |
Neale Ranns | de84727 | 2018-11-28 01:38:34 -0800 | [diff] [blame] | 44 | u32 seq_num; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 45 | } ah_decrypt_trace_t; |
| 46 | |
| 47 | /* packet trace format function */ |
| 48 | static u8 * |
| 49 | format_ah_decrypt_trace (u8 * s, va_list * args) |
| 50 | { |
| 51 | CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); |
| 52 | CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); |
| 53 | ah_decrypt_trace_t *t = va_arg (*args, ah_decrypt_trace_t *); |
| 54 | |
Neale Ranns | de84727 | 2018-11-28 01:38:34 -0800 | [diff] [blame] | 55 | s = format (s, "ah: integrity %U seq-num %d", |
| 56 | format_ipsec_integ_alg, t->integ_alg, t->seq_num); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 57 | return s; |
| 58 | } |
| 59 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 60 | typedef struct |
| 61 | { |
| 62 | union |
| 63 | { |
| 64 | struct |
| 65 | { |
| 66 | u8 hop_limit; |
| 67 | u8 nexthdr; |
| 68 | u32 ip_version_traffic_class_and_flow_label; |
| 69 | }; |
| 70 | |
| 71 | struct |
| 72 | { |
| 73 | u8 ttl; |
| 74 | u8 tos; |
| 75 | }; |
| 76 | }; |
| 77 | u32 sa_index; |
| 78 | u32 seq; |
Neale Ranns | 5b89110 | 2021-06-28 13:31:28 +0000 | [diff] [blame] | 79 | u32 seq_hi; |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 80 | u8 icv_padding_len; |
| 81 | u8 icv_size; |
| 82 | u8 ip_hdr_size; |
| 83 | i16 current_data; |
| 84 | u8 nexthdr_cached; |
| 85 | } ah_decrypt_packet_data_t; |
| 86 | |
| 87 | static_always_inline void |
| 88 | ah_process_ops (vlib_main_t * vm, vlib_node_runtime_t * node, |
| 89 | vnet_crypto_op_t * ops, vlib_buffer_t * b[], u16 * nexts) |
| 90 | { |
| 91 | u32 n_fail, n_ops = vec_len (ops); |
| 92 | vnet_crypto_op_t *op = ops; |
| 93 | |
| 94 | if (n_ops == 0) |
| 95 | return; |
| 96 | |
| 97 | n_fail = n_ops - vnet_crypto_process_ops (vm, op, n_ops); |
| 98 | |
| 99 | while (n_fail) |
| 100 | { |
| 101 | ASSERT (op - ops < n_ops); |
| 102 | |
| 103 | if (op->status != VNET_CRYPTO_OP_STATUS_COMPLETED) |
| 104 | { |
| 105 | u32 bi = op->user_data; |
Arthur de Kerhor | ad95b06 | 2022-11-16 19:12:05 +0100 | [diff] [blame] | 106 | ah_decrypt_set_next_index ( |
| 107 | b[bi], node, vm->thread_index, AH_DECRYPT_ERROR_INTEG_ERROR, bi, |
| 108 | nexts, AH_DECRYPT_NEXT_DROP, vnet_buffer (b[bi])->ipsec.sad_index); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 109 | n_fail--; |
| 110 | } |
| 111 | op++; |
| 112 | } |
| 113 | } |
| 114 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 115 | always_inline uword |
| 116 | ah_decrypt_inline (vlib_main_t * vm, |
| 117 | vlib_node_runtime_t * node, vlib_frame_t * from_frame, |
| 118 | int is_ip6) |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 119 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 120 | u32 n_left, *from; |
| 121 | u32 thread_index = vm->thread_index; |
| 122 | u16 buffer_data_size = vlib_buffer_get_default_data_size (vm); |
| 123 | ah_decrypt_packet_data_t pkt_data[VLIB_FRAME_SIZE], *pd = pkt_data; |
| 124 | vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs; |
| 125 | u16 nexts[VLIB_FRAME_SIZE], *next = nexts; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 126 | ipsec_main_t *im = &ipsec_main; |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 127 | ipsec_per_thread_data_t *ptd = vec_elt_at_index (im->ptd, thread_index); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 128 | from = vlib_frame_vector_args (from_frame); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 129 | n_left = from_frame->n_vectors; |
| 130 | ipsec_sa_t *sa0 = 0; |
Maxime Peim | 0e2f188 | 2022-12-22 11:26:57 +0000 | [diff] [blame] | 131 | bool anti_replay_result; |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 132 | u32 current_sa_index = ~0, current_sa_bytes = 0, current_sa_pkts = 0; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 133 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 134 | clib_memset (pkt_data, 0, VLIB_FRAME_SIZE * sizeof (pkt_data[0])); |
| 135 | vlib_get_buffers (vm, from, b, n_left); |
| 136 | clib_memset_u16 (nexts, -1, n_left); |
| 137 | vec_reset_length (ptd->integ_ops); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 138 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 139 | while (n_left > 0) |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 140 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 141 | ah_header_t *ah0; |
| 142 | ip4_header_t *ih4; |
| 143 | ip6_header_t *ih6; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 144 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 145 | if (vnet_buffer (b[0])->ipsec.sad_index != current_sa_index) |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 146 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 147 | if (current_sa_index != ~0) |
| 148 | vlib_increment_combined_counter (&ipsec_sa_counters, thread_index, |
Arthur de Kerhor | ad95b06 | 2022-11-16 19:12:05 +0100 | [diff] [blame] | 149 | current_sa_index, current_sa_pkts, |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 150 | current_sa_bytes); |
| 151 | current_sa_index = vnet_buffer (b[0])->ipsec.sad_index; |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 152 | sa0 = ipsec_sa_get (current_sa_index); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 153 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 154 | current_sa_bytes = current_sa_pkts = 0; |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 155 | vlib_prefetch_combined_counter (&ipsec_sa_counters, |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 156 | thread_index, current_sa_index); |
| 157 | } |
| 158 | |
Benoît Ganne | 5527a78 | 2022-01-18 15:56:41 +0100 | [diff] [blame] | 159 | if (PREDICT_FALSE ((u16) ~0 == sa0->thread_index)) |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 160 | { |
| 161 | /* this is the first packet to use this SA, claim the SA |
| 162 | * for this thread. this could happen simultaneously on |
| 163 | * another thread */ |
Neale Ranns | 1a52d37 | 2021-02-04 11:33:32 +0000 | [diff] [blame] | 164 | clib_atomic_cmp_and_swap (&sa0->thread_index, ~0, |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 165 | ipsec_sa_assign_thread (thread_index)); |
| 166 | } |
| 167 | |
Neale Ranns | 1a52d37 | 2021-02-04 11:33:32 +0000 | [diff] [blame] | 168 | if (PREDICT_TRUE (thread_index != sa0->thread_index)) |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 169 | { |
Neale Ranns | aa7d766 | 2021-02-10 08:42:49 +0000 | [diff] [blame] | 170 | vnet_buffer (b[0])->ipsec.thread_index = sa0->thread_index; |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 171 | next[0] = AH_DECRYPT_NEXT_HANDOFF; |
| 172 | goto next; |
| 173 | } |
| 174 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 175 | pd->sa_index = current_sa_index; |
| 176 | |
| 177 | ih4 = vlib_buffer_get_current (b[0]); |
| 178 | ih6 = vlib_buffer_get_current (b[0]); |
| 179 | pd->current_data = b[0]->current_data; |
| 180 | |
| 181 | if (is_ip6) |
| 182 | { |
| 183 | ip6_ext_header_t *prev = NULL; |
Klement Sekera | 769145c | 2019-03-06 11:59:57 +0100 | [diff] [blame] | 184 | ah0 = |
| 185 | ip6_ext_header_find (vm, b[0], ih6, IP_PROTOCOL_IPSEC_AH, &prev); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 186 | pd->ip_hdr_size = sizeof (ip6_header_t); |
| 187 | ASSERT ((u8 *) ah0 - (u8 *) ih6 == pd->ip_hdr_size); |
| 188 | } |
| 189 | else |
| 190 | { |
| 191 | if (ip4_is_fragment (ih4)) |
| 192 | { |
Arthur de Kerhor | ad95b06 | 2022-11-16 19:12:05 +0100 | [diff] [blame] | 193 | ah_decrypt_set_next_index ( |
| 194 | b[0], node, vm->thread_index, AH_DECRYPT_ERROR_DROP_FRAGMENTS, |
| 195 | 0, next, AH_DECRYPT_NEXT_DROP, current_sa_index); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 196 | goto next; |
| 197 | } |
| 198 | pd->ip_hdr_size = ip4_header_bytes (ih4); |
| 199 | ah0 = (ah_header_t *) ((u8 *) ih4 + pd->ip_hdr_size); |
| 200 | } |
| 201 | |
| 202 | pd->seq = clib_host_to_net_u32 (ah0->seq_no); |
| 203 | |
| 204 | /* anti-replay check */ |
Maxime Peim | 0e2f188 | 2022-12-22 11:26:57 +0000 | [diff] [blame] | 205 | if (PREDICT_FALSE (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa0))) |
| 206 | { |
| 207 | anti_replay_result = ipsec_sa_anti_replay_and_sn_advance ( |
| 208 | sa0, pd->seq, ~0, false, &pd->seq_hi, true); |
| 209 | } |
| 210 | else |
| 211 | { |
| 212 | anti_replay_result = ipsec_sa_anti_replay_and_sn_advance ( |
| 213 | sa0, pd->seq, ~0, false, &pd->seq_hi, false); |
| 214 | } |
| 215 | if (anti_replay_result) |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 216 | { |
Arthur de Kerhor | ad95b06 | 2022-11-16 19:12:05 +0100 | [diff] [blame] | 217 | ah_decrypt_set_next_index (b[0], node, vm->thread_index, |
| 218 | AH_DECRYPT_ERROR_REPLAY, 0, next, |
| 219 | AH_DECRYPT_NEXT_DROP, current_sa_index); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 220 | goto next; |
| 221 | } |
| 222 | |
| 223 | current_sa_bytes += b[0]->current_length; |
| 224 | current_sa_pkts += 1; |
| 225 | |
| 226 | pd->icv_size = sa0->integ_icv_size; |
| 227 | pd->nexthdr_cached = ah0->nexthdr; |
| 228 | if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE)) |
| 229 | { |
| 230 | if (PREDICT_FALSE (ipsec_sa_is_set_USE_ESN (sa0) && |
| 231 | pd->current_data + b[0]->current_length |
| 232 | + sizeof (u32) > buffer_data_size)) |
| 233 | { |
Arthur de Kerhor | ad95b06 | 2022-11-16 19:12:05 +0100 | [diff] [blame] | 234 | ah_decrypt_set_next_index ( |
| 235 | b[0], node, vm->thread_index, AH_DECRYPT_ERROR_NO_TAIL_SPACE, |
| 236 | 0, next, AH_DECRYPT_NEXT_DROP, current_sa_index); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 237 | goto next; |
| 238 | } |
| 239 | |
| 240 | vnet_crypto_op_t *op; |
| 241 | vec_add2_aligned (ptd->integ_ops, op, 1, CLIB_CACHE_LINE_BYTES); |
| 242 | vnet_crypto_op_init (op, sa0->integ_op_id); |
| 243 | |
| 244 | op->src = (u8 *) ih4; |
| 245 | op->len = b[0]->current_length; |
| 246 | op->digest = (u8 *) ih4 - pd->icv_size; |
| 247 | op->flags = VNET_CRYPTO_OP_FLAG_HMAC_CHECK; |
| 248 | op->digest_len = pd->icv_size; |
| 249 | op->key_index = sa0->integ_key_index; |
| 250 | op->user_data = b - bufs; |
| 251 | if (ipsec_sa_is_set_USE_ESN (sa0)) |
| 252 | { |
Neale Ranns | 5b89110 | 2021-06-28 13:31:28 +0000 | [diff] [blame] | 253 | u32 seq_hi = clib_host_to_net_u32 (pd->seq_hi); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 254 | |
| 255 | op->len += sizeof (seq_hi); |
| 256 | clib_memcpy (op->src + b[0]->current_length, &seq_hi, |
| 257 | sizeof (seq_hi)); |
| 258 | } |
| 259 | clib_memcpy (op->digest, ah0->auth_data, pd->icv_size); |
| 260 | clib_memset (ah0->auth_data, 0, pd->icv_size); |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 261 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 262 | if (is_ip6) |
Klement Sekera | 611864f | 2018-09-26 11:19:00 +0200 | [diff] [blame] | 263 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 264 | pd->ip_version_traffic_class_and_flow_label = |
| 265 | ih6->ip_version_traffic_class_and_flow_label; |
| 266 | pd->hop_limit = ih6->hop_limit; |
| 267 | ih6->ip_version_traffic_class_and_flow_label = 0x60; |
| 268 | ih6->hop_limit = 0; |
| 269 | pd->nexthdr = ah0->nexthdr; |
| 270 | pd->icv_padding_len = |
| 271 | ah_calc_icv_padding_len (pd->icv_size, 1 /* is_ipv6 */ ); |
Klement Sekera | 611864f | 2018-09-26 11:19:00 +0200 | [diff] [blame] | 272 | } |
| 273 | else |
| 274 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 275 | pd->tos = ih4->tos; |
| 276 | pd->ttl = ih4->ttl; |
| 277 | ih4->tos = 0; |
| 278 | ih4->ttl = 0; |
| 279 | ih4->checksum = 0; |
| 280 | pd->icv_padding_len = |
| 281 | ah_calc_icv_padding_len (pd->icv_size, 0 /* is_ipv6 */ ); |
Klement Sekera | 611864f | 2018-09-26 11:19:00 +0200 | [diff] [blame] | 282 | } |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 283 | } |
Klement Sekera | 611864f | 2018-09-26 11:19:00 +0200 | [diff] [blame] | 284 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 285 | next: |
| 286 | n_left -= 1; |
| 287 | pd += 1; |
| 288 | next += 1; |
| 289 | b += 1; |
| 290 | } |
Neale Ranns | de84727 | 2018-11-28 01:38:34 -0800 | [diff] [blame] | 291 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 292 | n_left = from_frame->n_vectors; |
| 293 | next = nexts; |
| 294 | pd = pkt_data; |
| 295 | b = bufs; |
| 296 | |
| 297 | vlib_node_increment_counter (vm, node->node_index, AH_DECRYPT_ERROR_RX_PKTS, |
| 298 | n_left); |
| 299 | vlib_increment_combined_counter (&ipsec_sa_counters, thread_index, |
| 300 | current_sa_index, current_sa_pkts, |
| 301 | current_sa_bytes); |
| 302 | |
| 303 | ah_process_ops (vm, node, ptd->integ_ops, bufs, nexts); |
| 304 | |
| 305 | while (n_left > 0) |
| 306 | { |
| 307 | ip4_header_t *oh4; |
| 308 | ip6_header_t *oh6; |
Neale Ranns | e11203e | 2021-09-21 12:34:19 +0000 | [diff] [blame] | 309 | u64 n_lost = 0; |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 310 | |
| 311 | if (next[0] < AH_DECRYPT_N_NEXT) |
| 312 | goto trace; |
| 313 | |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 314 | sa0 = ipsec_sa_get (pd->sa_index); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 315 | |
| 316 | if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE)) |
| 317 | { |
Neale Ranns | e11203e | 2021-09-21 12:34:19 +0000 | [diff] [blame] | 318 | /* redo the anti-reply check. see esp_decrypt for details */ |
Maxime Peim | 0e2f188 | 2022-12-22 11:26:57 +0000 | [diff] [blame] | 319 | if (PREDICT_FALSE (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa0))) |
Neale Ranns | 3b9374f | 2019-08-01 04:45:15 -0700 | [diff] [blame] | 320 | { |
Maxime Peim | 0e2f188 | 2022-12-22 11:26:57 +0000 | [diff] [blame] | 321 | if (ipsec_sa_anti_replay_and_sn_advance ( |
| 322 | sa0, pd->seq, pd->seq_hi, true, NULL, true)) |
| 323 | { |
| 324 | ah_decrypt_set_next_index ( |
| 325 | b[0], node, vm->thread_index, AH_DECRYPT_ERROR_REPLAY, 0, |
| 326 | next, AH_DECRYPT_NEXT_DROP, pd->sa_index); |
| 327 | goto trace; |
| 328 | } |
| 329 | n_lost = ipsec_sa_anti_replay_advance ( |
| 330 | sa0, thread_index, pd->seq, pd->seq_hi, true); |
Neale Ranns | 3b9374f | 2019-08-01 04:45:15 -0700 | [diff] [blame] | 331 | } |
Maxime Peim | 0e2f188 | 2022-12-22 11:26:57 +0000 | [diff] [blame] | 332 | else |
| 333 | { |
| 334 | if (ipsec_sa_anti_replay_and_sn_advance ( |
| 335 | sa0, pd->seq, pd->seq_hi, true, NULL, false)) |
| 336 | { |
| 337 | ah_decrypt_set_next_index ( |
| 338 | b[0], node, vm->thread_index, AH_DECRYPT_ERROR_REPLAY, 0, |
| 339 | next, AH_DECRYPT_NEXT_DROP, pd->sa_index); |
| 340 | goto trace; |
| 341 | } |
| 342 | n_lost = ipsec_sa_anti_replay_advance ( |
| 343 | sa0, thread_index, pd->seq, pd->seq_hi, false); |
| 344 | } |
Arthur de Kerhor | ad95b06 | 2022-11-16 19:12:05 +0100 | [diff] [blame] | 345 | vlib_prefetch_simple_counter ( |
| 346 | &ipsec_sa_err_counters[IPSEC_SA_ERROR_LOST], thread_index, |
| 347 | pd->sa_index); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 348 | } |
| 349 | |
| 350 | u16 ah_hdr_len = sizeof (ah_header_t) + pd->icv_size |
| 351 | + pd->icv_padding_len; |
| 352 | vlib_buffer_advance (b[0], pd->ip_hdr_size + ah_hdr_len); |
| 353 | b[0]->flags |= VLIB_BUFFER_TOTAL_LENGTH_VALID; |
Frédéric Perrin | a4157ae | 2023-07-14 11:13:42 +0100 | [diff] [blame] | 354 | b[0]->flags &= ~(VNET_BUFFER_F_L4_CHECKSUM_COMPUTED | |
| 355 | VNET_BUFFER_F_L4_CHECKSUM_CORRECT); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 356 | |
| 357 | if (PREDICT_TRUE (ipsec_sa_is_set_IS_TUNNEL (sa0))) |
| 358 | { /* tunnel mode */ |
| 359 | if (PREDICT_TRUE (pd->nexthdr_cached == IP_PROTOCOL_IP_IN_IP)) |
| 360 | next[0] = AH_DECRYPT_NEXT_IP4_INPUT; |
| 361 | else if (pd->nexthdr_cached == IP_PROTOCOL_IPV6) |
| 362 | next[0] = AH_DECRYPT_NEXT_IP6_INPUT; |
| 363 | else |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 364 | { |
Arthur de Kerhor | ad95b06 | 2022-11-16 19:12:05 +0100 | [diff] [blame] | 365 | ah_decrypt_set_next_index (b[0], node, vm->thread_index, |
| 366 | AH_DECRYPT_ERROR_DECRYPTION_FAILED, 0, |
| 367 | next, AH_DECRYPT_NEXT_DROP, |
| 368 | pd->sa_index); |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 369 | goto trace; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 370 | } |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 371 | } |
| 372 | else |
| 373 | { /* transport mode */ |
| 374 | if (is_ip6) |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 375 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 376 | vlib_buffer_advance (b[0], -sizeof (ip6_header_t)); |
| 377 | oh6 = vlib_buffer_get_current (b[0]); |
| 378 | if (ah_hdr_len >= sizeof (ip6_header_t)) |
| 379 | clib_memcpy (oh6, b[0]->data + pd->current_data, |
| 380 | sizeof (ip6_header_t)); |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 381 | else |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 382 | memmove (oh6, b[0]->data + pd->current_data, |
| 383 | sizeof (ip6_header_t)); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 384 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 385 | next[0] = AH_DECRYPT_NEXT_IP6_INPUT; |
| 386 | oh6->protocol = pd->nexthdr; |
| 387 | oh6->hop_limit = pd->hop_limit; |
| 388 | oh6->ip_version_traffic_class_and_flow_label = |
| 389 | pd->ip_version_traffic_class_and_flow_label; |
| 390 | oh6->payload_length = |
| 391 | clib_host_to_net_u16 (vlib_buffer_length_in_chain |
| 392 | (vm, b[0]) - sizeof (ip6_header_t)); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 393 | } |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 394 | else |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 395 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 396 | vlib_buffer_advance (b[0], -sizeof (ip4_header_t)); |
| 397 | oh4 = vlib_buffer_get_current (b[0]); |
| 398 | if (ah_hdr_len >= sizeof (ip4_header_t)) |
| 399 | clib_memcpy (oh4, b[0]->data + pd->current_data, |
| 400 | sizeof (ip4_header_t)); |
| 401 | else |
| 402 | memmove (oh4, b[0]->data + pd->current_data, |
| 403 | sizeof (ip4_header_t)); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 404 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 405 | next[0] = AH_DECRYPT_NEXT_IP4_INPUT; |
| 406 | oh4->ip_version_and_header_length = 0x45; |
| 407 | oh4->fragment_id = 0; |
| 408 | oh4->flags_and_fragment_offset = 0; |
| 409 | oh4->protocol = pd->nexthdr_cached; |
| 410 | oh4->length = |
| 411 | clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b[0])); |
| 412 | oh4->ttl = pd->ttl; |
| 413 | oh4->tos = pd->tos; |
| 414 | oh4->checksum = ip4_header_checksum (oh4); |
| 415 | } |
| 416 | } |
| 417 | |
Neale Ranns | e11203e | 2021-09-21 12:34:19 +0000 | [diff] [blame] | 418 | if (PREDICT_FALSE (n_lost)) |
Arthur de Kerhor | ad95b06 | 2022-11-16 19:12:05 +0100 | [diff] [blame] | 419 | vlib_increment_simple_counter ( |
| 420 | &ipsec_sa_err_counters[IPSEC_SA_ERROR_LOST], thread_index, |
| 421 | pd->sa_index, n_lost); |
Neale Ranns | e11203e | 2021-09-21 12:34:19 +0000 | [diff] [blame] | 422 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 423 | vnet_buffer (b[0])->sw_if_index[VLIB_TX] = (u32) ~ 0; |
| 424 | trace: |
| 425 | if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED)) |
| 426 | { |
Neale Ranns | c5fe57d | 2021-02-25 16:01:28 +0000 | [diff] [blame] | 427 | sa0 = ipsec_sa_get (vnet_buffer (b[0])->ipsec.sad_index); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 428 | ah_decrypt_trace_t *tr = |
| 429 | vlib_add_trace (vm, node, b[0], sizeof (*tr)); |
| 430 | tr->integ_alg = sa0->integ_alg; |
| 431 | tr->seq_num = pd->seq; |
| 432 | } |
| 433 | |
| 434 | n_left -= 1; |
| 435 | pd += 1; |
| 436 | next += 1; |
| 437 | b += 1; |
| 438 | } |
| 439 | |
| 440 | n_left = from_frame->n_vectors; |
| 441 | vlib_buffer_enqueue_to_next (vm, node, from, nexts, n_left); |
| 442 | |
| 443 | return n_left; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 444 | } |
| 445 | |
Klement Sekera | b8f3544 | 2018-10-29 13:38:19 +0100 | [diff] [blame] | 446 | VLIB_NODE_FN (ah4_decrypt_node) (vlib_main_t * vm, |
| 447 | vlib_node_runtime_t * node, |
| 448 | vlib_frame_t * from_frame) |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 449 | { |
| 450 | return ah_decrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ ); |
| 451 | } |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 452 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 453 | VLIB_REGISTER_NODE (ah4_decrypt_node) = { |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 454 | .name = "ah4-decrypt", |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 455 | .vector_size = sizeof (u32), |
| 456 | .format_trace = format_ah_decrypt_trace, |
| 457 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 458 | |
Neale Ranns | 93688d7 | 2022-08-09 03:34:51 +0000 | [diff] [blame] | 459 | .n_errors = AH_DECRYPT_N_ERROR, |
| 460 | .error_counters = ah_decrypt_error_counters, |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 461 | |
| 462 | .n_next_nodes = AH_DECRYPT_N_NEXT, |
| 463 | .next_nodes = { |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 464 | [AH_DECRYPT_NEXT_DROP] = "ip4-drop", |
| 465 | [AH_DECRYPT_NEXT_IP4_INPUT] = "ip4-input-no-checksum", |
| 466 | [AH_DECRYPT_NEXT_IP6_INPUT] = "ip6-input", |
Neale Ranns | 4a56f4e | 2019-12-23 04:10:25 +0000 | [diff] [blame] | 467 | [AH_DECRYPT_NEXT_HANDOFF] = "ah4-decrypt-handoff", |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 468 | }, |
| 469 | }; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 470 | |
Klement Sekera | b8f3544 | 2018-10-29 13:38:19 +0100 | [diff] [blame] | 471 | VLIB_NODE_FN (ah6_decrypt_node) (vlib_main_t * vm, |
| 472 | vlib_node_runtime_t * node, |
| 473 | vlib_frame_t * from_frame) |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 474 | { |
| 475 | return ah_decrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ ); |
| 476 | } |
| 477 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 478 | VLIB_REGISTER_NODE (ah6_decrypt_node) = { |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 479 | .name = "ah6-decrypt", |
| 480 | .vector_size = sizeof (u32), |
| 481 | .format_trace = format_ah_decrypt_trace, |
| 482 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 483 | |
Neale Ranns | 93688d7 | 2022-08-09 03:34:51 +0000 | [diff] [blame] | 484 | .n_errors = AH_DECRYPT_N_ERROR, |
| 485 | .error_counters = ah_decrypt_error_counters, |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 486 | |
| 487 | .n_next_nodes = AH_DECRYPT_N_NEXT, |
| 488 | .next_nodes = { |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 489 | [AH_DECRYPT_NEXT_DROP] = "ip6-drop", |
| 490 | [AH_DECRYPT_NEXT_IP4_INPUT] = "ip4-input-no-checksum", |
| 491 | [AH_DECRYPT_NEXT_IP6_INPUT] = "ip6-input", |
Neale Ranns | 4a56f4e | 2019-12-23 04:10:25 +0000 | [diff] [blame] | 492 | [AH_DECRYPT_NEXT_HANDOFF] = "ah6-decrypt-handoff", |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 493 | }, |
| 494 | }; |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 495 | |
Neale Ranns | 2d49830 | 2021-02-25 08:38:58 +0000 | [diff] [blame] | 496 | #ifndef CLIB_MARCH_VARIANT |
| 497 | |
| 498 | static clib_error_t * |
| 499 | ah_decrypt_init (vlib_main_t *vm) |
| 500 | { |
| 501 | ipsec_main_t *im = &ipsec_main; |
| 502 | |
Dau Do | ea92116 | 2024-04-29 03:00:55 +0000 | [diff] [blame] | 503 | im->ah4_dec_fq_index = vlib_frame_queue_main_init (ah4_decrypt_node.index, |
| 504 | im->handoff_queue_size); |
| 505 | im->ah6_dec_fq_index = vlib_frame_queue_main_init (ah6_decrypt_node.index, |
| 506 | im->handoff_queue_size); |
Neale Ranns | 2d49830 | 2021-02-25 08:38:58 +0000 | [diff] [blame] | 507 | |
| 508 | return 0; |
| 509 | } |
| 510 | |
| 511 | VLIB_INIT_FUNCTION (ah_decrypt_init); |
| 512 | |
| 513 | #endif |
| 514 | |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 515 | /* |
| 516 | * fd.io coding-style-patch-verification: ON |
| 517 | * |
| 518 | * Local Variables: |
| 519 | * eval: (c-set-style "gnu") |
| 520 | * End: |
| 521 | */ |