blob: 070726faa3435dde9f11c781cb1184f8823a0911 [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000015#ifndef __ESP_H__
16#define __ESP_H__
Ed Warnickecb9cada2015-12-08 15:45:58 -070017
Sergio Gonzalez Monroydb93cd92017-08-26 15:22:05 +010018#include <vnet/ip/ip.h>
Damjan Marion91f17dc2019-03-18 18:59:25 +010019#include <vnet/crypto/crypto.h>
Sergio Gonzalez Monroydb93cd92017-08-26 15:22:05 +010020#include <vnet/ipsec/ipsec.h>
21
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070022typedef struct
23{
Ed Warnickecb9cada2015-12-08 15:45:58 -070024 u32 spi;
25 u32 seq;
26 u8 data[0];
27} esp_header_t;
28
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070029typedef struct
30{
Ed Warnickecb9cada2015-12-08 15:45:58 -070031 u8 pad_length;
32 u8 next_header;
33} esp_footer_t;
34
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070035/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070036typedef CLIB_PACKED (struct {
37 ip4_header_t ip4;
38 esp_header_t esp;
39}) ip4_and_esp_header_t;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070040/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070041
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070042/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070043typedef CLIB_PACKED (struct {
Klement Sekera4b089f22018-04-17 18:04:57 +020044 ip4_header_t ip4;
45 udp_header_t udp;
46 esp_header_t esp;
47}) ip4_and_udp_and_esp_header_t;
48/* *INDENT-ON* */
49
50/* *INDENT-OFF* */
51typedef CLIB_PACKED (struct {
Ed Warnickecb9cada2015-12-08 15:45:58 -070052 ip6_header_t ip6;
53 esp_header_t esp;
54}) ip6_and_esp_header_t;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070055/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070056
Neale Ranns47feb112019-04-11 15:14:07 +000057/**
58 * AES GCM Additional Authentication data
59 */
60typedef struct esp_aead_t_
61{
62 /**
63 * for GCM: when using ESN it's:
64 * SPI, seq-hi, seg-low
65 * else
66 * SPI, seq-low
67 */
68 u32 data[3];
69} __clib_packed esp_aead_t;
70
Damjan Marionc59b9a22019-03-19 15:38:40 +010071#define ESP_SEQ_MAX (4294967295UL)
72#define ESP_MAX_BLOCK_SIZE (16)
Damjan Marionb4fff3a2019-03-25 15:54:40 +010073#define ESP_MAX_IV_SIZE (16)
Neale Ranns1091c4a2019-04-08 14:48:23 +000074#define ESP_MAX_ICV_SIZE (32)
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000075
Sergio Gonzalez Monroydb93cd92017-08-26 15:22:05 +010076u8 *format_esp_header (u8 * s, va_list * args);
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000077
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000078/* TODO seq increment should be atomic to be accessed by multiple workers */
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000079always_inline int
80esp_seq_advance (ipsec_sa_t * sa)
81{
Damjan Marion1e3aa5e2019-03-28 10:58:59 +010082 if (PREDICT_TRUE (ipsec_sa_is_set_USE_ESN (sa)))
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000083 {
84 if (PREDICT_FALSE (sa->seq == ESP_SEQ_MAX))
85 {
Damjan Mariond709cbc2019-03-26 13:16:42 +010086 if (PREDICT_FALSE (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) &&
87 sa->seq_hi == ESP_SEQ_MAX))
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000088 return 1;
89 sa->seq_hi++;
90 }
91 sa->seq++;
92 }
93 else
94 {
Damjan Mariond709cbc2019-03-26 13:16:42 +010095 if (PREDICT_FALSE (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) &&
96 sa->seq == ESP_SEQ_MAX))
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000097 return 1;
98 sa->seq++;
99 }
100
101 return 0;
102}
103
Ed Warnickecb9cada2015-12-08 15:45:58 -0700104
105always_inline unsigned int
Damjan Marionb966e8b2019-03-20 16:07:09 +0100106hmac_calc (vlib_main_t * vm, ipsec_sa_t * sa, u8 * data, int data_len,
107 u8 * signature)
Ed Warnickecb9cada2015-12-08 15:45:58 -0700108{
Damjan Marion91f17dc2019-03-18 18:59:25 +0100109 vnet_crypto_op_t _op, *op = &_op;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700110
Damjan Marion060bfb92019-03-29 13:47:54 +0100111 if (PREDICT_FALSE (sa->integ_op_id == 0))
Ed Warnickecb9cada2015-12-08 15:45:58 -0700112 return 0;
113
Damjan Marion060bfb92019-03-29 13:47:54 +0100114 vnet_crypto_op_init (op, sa->integ_op_id);
Damjan Mariond1bed682019-04-24 15:20:35 +0200115 op->key_index = sa->integ_key_index;
Damjan Marion91f17dc2019-03-18 18:59:25 +0100116 op->src = data;
117 op->len = data_len;
Damjan Marion060bfb92019-03-29 13:47:54 +0100118 op->digest = signature;
119 op->digest_len = sa->integ_icv_size;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700120
Damjan Marion1e3aa5e2019-03-28 10:58:59 +0100121 if (ipsec_sa_is_set_USE_ESN (sa))
Damjan Marionaf73eda2019-03-20 16:30:54 +0100122 {
Neale Ranns3833ffd2019-03-21 14:34:09 +0000123 u32 seq_hi = clib_host_to_net_u32 (sa->seq_hi);
124
Damjan Marionaf73eda2019-03-20 16:30:54 +0100125 op->len += 4;
Neale Ranns3833ffd2019-03-21 14:34:09 +0000126 clib_memcpy (data + data_len, &seq_hi, 4);
Damjan Marionaf73eda2019-03-20 16:30:54 +0100127 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700128
Damjan Marion91f17dc2019-03-18 18:59:25 +0100129 vnet_crypto_process_ops (vm, op, 1);
Damjan Marion7c22ff72019-04-04 12:25:44 +0200130 return sa->integ_icv_size;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700131}
132
Neale Ranns47feb112019-04-11 15:14:07 +0000133always_inline void
134esp_aad_fill (vnet_crypto_op_t * op,
135 const esp_header_t * esp, const ipsec_sa_t * sa)
136{
137 esp_aead_t *aad;
138
139 aad = (esp_aead_t *) op->aad;
140 clib_memcpy_fast (aad, esp, 8);
141
142 if (ipsec_sa_is_set_USE_ESN (sa))
143 {
144 /* SPI, seq-hi, seq-low */
145 aad->data[2] = aad->data[1];
146 aad->data[1] = clib_host_to_net_u32 (sa->seq_hi);
147 op->aad_len = 12;
148 }
149 else
150 /* SPI, seq-low */
151 op->aad_len = 8;
152}
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +0000153#endif /* __ESP_H__ */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700154
155/*
156 * fd.io coding-style-patch-verification: ON
157 *
158 * Local Variables:
159 * eval: (c-set-style "gnu")
160 * End:
161 */