blob: cf955889420e895c0d574f7c75b9c0cd43f20ee7 [file] [log] [blame]
“mukeshyadav1984”430ac932017-11-23 02:39:33 -08001/*
2 * ah_decrypt.c : IPSec AH decrypt node
3 *
4 * Copyright (c) 2015 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17
18#include <vnet/vnet.h>
19#include <vnet/api_errno.h>
20#include <vnet/ip/ip.h>
21
22#include <vnet/ipsec/ipsec.h>
23#include <vnet/ipsec/esp.h>
24#include <vnet/ipsec/ah.h>
Neale Ranns918c1612019-02-21 23:34:59 -080025#include <vnet/ipsec/ipsec_io.h>
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080026
Klement Sekerabe5a5dd2018-10-09 16:05:48 +020027#define foreach_ah_decrypt_next \
28 _ (DROP, "error-drop") \
29 _ (IP4_INPUT, "ip4-input") \
30 _ (IP6_INPUT, "ip6-input") \
31 _ (IPSEC_GRE_INPUT, "ipsec-gre-input")
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080032
33#define _(v, s) AH_DECRYPT_NEXT_##v,
34typedef enum
35{
36 foreach_ah_decrypt_next
37#undef _
38 AH_DECRYPT_N_NEXT,
39} ah_decrypt_next_t;
40
Klement Sekerabe5a5dd2018-10-09 16:05:48 +020041#define foreach_ah_decrypt_error \
42 _ (RX_PKTS, "AH pkts received") \
43 _ (DECRYPTION_FAILED, "AH decryption failed") \
44 _ (INTEG_ERROR, "Integrity check failed") \
45 _ (REPLAY, "SA replayed packet")
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080046
47typedef enum
48{
49#define _(sym,str) AH_DECRYPT_ERROR_##sym,
50 foreach_ah_decrypt_error
51#undef _
52 AH_DECRYPT_N_ERROR,
53} ah_decrypt_error_t;
54
55static char *ah_decrypt_error_strings[] = {
56#define _(sym,string) string,
57 foreach_ah_decrypt_error
58#undef _
59};
60
61typedef struct
62{
63 ipsec_integ_alg_t integ_alg;
Neale Rannsde847272018-11-28 01:38:34 -080064 u32 seq_num;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080065} ah_decrypt_trace_t;
66
67/* packet trace format function */
68static u8 *
69format_ah_decrypt_trace (u8 * s, va_list * args)
70{
71 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
72 CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
73 ah_decrypt_trace_t *t = va_arg (*args, ah_decrypt_trace_t *);
74
Neale Rannsde847272018-11-28 01:38:34 -080075 s = format (s, "ah: integrity %U seq-num %d",
76 format_ipsec_integ_alg, t->integ_alg, t->seq_num);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080077 return s;
78}
79
Klement Sekerabe5a5dd2018-10-09 16:05:48 +020080always_inline uword
81ah_decrypt_inline (vlib_main_t * vm,
82 vlib_node_runtime_t * node, vlib_frame_t * from_frame,
83 int is_ip6)
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080084{
Neale Rannseba31ec2019-02-17 18:04:27 +000085 u32 n_left_from, *from, next_index, *to_next, thread_index;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080086 ipsec_main_t *im = &ipsec_main;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080087 from = vlib_frame_vector_args (from_frame);
88 n_left_from = from_frame->n_vectors;
Kingwel Xie561d1ca2019-03-05 22:56:17 -050089 int icv_size;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080090
91 next_index = node->cached_next_index;
Neale Rannseba31ec2019-02-17 18:04:27 +000092 thread_index = vm->thread_index;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -080093
94 while (n_left_from > 0)
95 {
96 u32 n_left_to_next;
97
98 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
99
100 while (n_left_from > 0 && n_left_to_next > 0)
101 {
102 u32 i_bi0;
103 u32 next0;
104 vlib_buffer_t *i_b0;
105 ah_header_t *ah0;
106 ipsec_sa_t *sa0;
107 u32 sa_index0 = ~0;
108 u32 seq;
109 ip4_header_t *ih4 = 0, *oh4 = 0;
110 ip6_header_t *ih6 = 0, *oh6 = 0;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800111 u8 ip_hdr_size = 0;
112 u8 tos = 0;
113 u8 ttl = 0;
Klement Sekera611864f2018-09-26 11:19:00 +0200114 u32 ip_version_traffic_class_and_flow_label = 0;
115 u8 hop_limit = 0;
116 u8 nexthdr = 0;
117 u8 icv_padding_len = 0;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800118
119
120 i_bi0 = from[0];
121 from += 1;
122 n_left_from -= 1;
123 n_left_to_next -= 1;
124
125 next0 = AH_DECRYPT_NEXT_DROP;
126
127 i_b0 = vlib_get_buffer (vm, i_bi0);
128 to_next[0] = i_bi0;
129 to_next += 1;
130 ih4 = vlib_buffer_get_current (i_b0);
Klement Sekera611864f2018-09-26 11:19:00 +0200131 ih6 = vlib_buffer_get_current (i_b0);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800132 sa_index0 = vnet_buffer (i_b0)->ipsec.sad_index;
133 sa0 = pool_elt_at_index (im->sad, sa_index0);
134
Neale Rannseba31ec2019-02-17 18:04:27 +0000135 vlib_prefetch_combined_counter (&ipsec_sa_counters,
136 thread_index, sa_index0);
137
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200138 if (is_ip6)
Klement Sekera611864f2018-09-26 11:19:00 +0200139 {
140 ip6_ext_header_t *prev = NULL;
141 ip6_ext_header_find_t (ih6, prev, ah0, IP_PROTOCOL_IPSEC_AH);
142 ip_hdr_size = sizeof (ip6_header_t);
143 ASSERT ((u8 *) ah0 - (u8 *) ih6 == ip_hdr_size);
144 }
145 else
146 {
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200147 ip_hdr_size = ip4_header_bytes (ih4);
148 ah0 = (ah_header_t *) ((u8 *) ih4 + ip_hdr_size);
Klement Sekera611864f2018-09-26 11:19:00 +0200149 }
150
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800151 seq = clib_host_to_net_u32 (ah0->seq_no);
Neale Rannsde847272018-11-28 01:38:34 -0800152
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800153 /* anti-replay check */
Damjan Marion1f4e1cb2019-03-28 19:19:31 +0100154 if (ipsec_sa_anti_replay_check (sa0, &ah0->seq_no))
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800155 {
Damjan Marion1f4e1cb2019-03-28 19:19:31 +0100156 i_b0->error = node->errors[AH_DECRYPT_ERROR_REPLAY];
157 goto trace;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800158 }
159
Neale Rannseba31ec2019-02-17 18:04:27 +0000160 vlib_increment_combined_counter
161 (&ipsec_sa_counters, thread_index, sa_index0,
162 1, i_b0->current_length);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800163
Damjan Marionb966e8b2019-03-20 16:07:09 +0100164 icv_size = sa0->integ_trunc_size;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800165 if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE))
166 {
167 u8 sig[64];
Kingwel Xie561d1ca2019-03-05 22:56:17 -0500168 u8 digest[icv_size];
Klement Sekera611864f2018-09-26 11:19:00 +0200169 u8 *icv = ah0->auth_data;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800170 memcpy (digest, icv, icv_size);
Dave Barachb7b92992018-10-17 10:38:51 -0400171 clib_memset (icv, 0, icv_size);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800172
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200173 if (is_ip6)
Klement Sekera611864f2018-09-26 11:19:00 +0200174 {
175 ip_version_traffic_class_and_flow_label =
176 ih6->ip_version_traffic_class_and_flow_label;
177 hop_limit = ih6->hop_limit;
178 ih6->ip_version_traffic_class_and_flow_label = 0x60;
179 ih6->hop_limit = 0;
180 nexthdr = ah0->nexthdr;
181 icv_padding_len =
182 ah_calc_icv_padding_len (icv_size, 1 /* is_ipv6 */ );
183 }
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200184 else
185 {
186 tos = ih4->tos;
187 ttl = ih4->ttl;
188 ih4->tos = 0;
189 ih4->ttl = 0;
190 ih4->checksum = 0;
191 ih4->flags_and_fragment_offset = 0;
192 icv_padding_len =
193 ah_calc_icv_padding_len (icv_size, 0 /* is_ipv6 */ );
194 }
Damjan Marionb966e8b2019-03-20 16:07:09 +0100195 hmac_calc (vm, sa0, (u8 *) ih4, i_b0->current_length, sig);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800196
197 if (PREDICT_FALSE (memcmp (digest, sig, icv_size)))
198 {
Neale Ranns3833ffd2019-03-21 14:34:09 +0000199 i_b0->error = node->errors[AH_DECRYPT_ERROR_INTEG_ERROR];
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800200 goto trace;
201 }
202
Damjan Marion1f4e1cb2019-03-28 19:19:31 +0100203 ipsec_sa_anti_replay_advance (sa0, &ah0->seq_no);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800204 }
205
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800206 vlib_buffer_advance (i_b0,
Klement Sekera611864f2018-09-26 11:19:00 +0200207 ip_hdr_size + sizeof (ah_header_t) + icv_size +
208 icv_padding_len);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800209 i_b0->flags |= VLIB_BUFFER_TOTAL_LENGTH_VALID;
210
Damjan Mariond709cbc2019-03-26 13:16:42 +0100211 if (PREDICT_TRUE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200212 { /* tunnel mode */
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800213 if (PREDICT_TRUE (ah0->nexthdr == IP_PROTOCOL_IP_IN_IP))
214 next0 = AH_DECRYPT_NEXT_IP4_INPUT;
215 else if (ah0->nexthdr == IP_PROTOCOL_IPV6)
216 next0 = AH_DECRYPT_NEXT_IP6_INPUT;
217 else
218 {
Neale Ranns3833ffd2019-03-21 14:34:09 +0000219 i_b0->error =
220 node->errors[AH_DECRYPT_ERROR_DECRYPTION_FAILED];
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800221 goto trace;
222 }
223 }
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800224 else
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200225 { /* transport mode */
226 if (is_ip6)
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800227 {
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800228 vlib_buffer_advance (i_b0, -sizeof (ip6_header_t));
229 oh6 = vlib_buffer_get_current (i_b0);
230 memmove (oh6, ih6, sizeof (ip6_header_t));
231
232 next0 = AH_DECRYPT_NEXT_IP6_INPUT;
Klement Sekera611864f2018-09-26 11:19:00 +0200233 oh6->protocol = nexthdr;
234 oh6->hop_limit = hop_limit;
235 oh6->ip_version_traffic_class_and_flow_label =
236 ip_version_traffic_class_and_flow_label;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800237 oh6->payload_length =
238 clib_host_to_net_u16 (vlib_buffer_length_in_chain
239 (vm, i_b0) - sizeof (ip6_header_t));
240 }
241 else
242 {
243 vlib_buffer_advance (i_b0, -sizeof (ip4_header_t));
244 oh4 = vlib_buffer_get_current (i_b0);
245 memmove (oh4, ih4, sizeof (ip4_header_t));
246
247 next0 = AH_DECRYPT_NEXT_IP4_INPUT;
248 oh4->ip_version_and_header_length = 0x45;
249 oh4->fragment_id = 0;
250 oh4->flags_and_fragment_offset = 0;
251 oh4->protocol = ah0->nexthdr;
252 oh4->length =
253 clib_host_to_net_u16 (vlib_buffer_length_in_chain
254 (vm, i_b0));
255 oh4->ttl = ttl;
256 oh4->tos = tos;
257 oh4->checksum = ip4_header_checksum (oh4);
258 }
259 }
260
261 /* for IPSec-GRE tunnel next node is ipsec-gre-input */
262 if (PREDICT_FALSE
263 ((vnet_buffer (i_b0)->ipsec.flags) &
264 IPSEC_FLAG_IPSEC_GRE_TUNNEL))
265 next0 = AH_DECRYPT_NEXT_IPSEC_GRE_INPUT;
266
267
268 vnet_buffer (i_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
269 trace:
270 if (PREDICT_FALSE (i_b0->flags & VLIB_BUFFER_IS_TRACED))
271 {
272 i_b0->flags |= VLIB_BUFFER_IS_TRACED;
273 ah_decrypt_trace_t *tr =
274 vlib_add_trace (vm, node, i_b0, sizeof (*tr));
275 tr->integ_alg = sa0->integ_alg;
Neale Rannsde847272018-11-28 01:38:34 -0800276 tr->seq_num = seq;
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800277 }
278 vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
279 n_left_to_next, i_bi0, next0);
280 }
281 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
282 }
Klement Sekera2e02ba02018-11-30 14:37:03 +0100283 vlib_node_increment_counter (vm, node->node_index, AH_DECRYPT_ERROR_RX_PKTS,
284 from_frame->n_vectors);
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800285
286 return from_frame->n_vectors;
287}
288
Klement Sekerab8f35442018-10-29 13:38:19 +0100289VLIB_NODE_FN (ah4_decrypt_node) (vlib_main_t * vm,
290 vlib_node_runtime_t * node,
291 vlib_frame_t * from_frame)
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200292{
293 return ah_decrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
294}
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800295
296/* *INDENT-OFF* */
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200297VLIB_REGISTER_NODE (ah4_decrypt_node) = {
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200298 .name = "ah4-decrypt",
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800299 .vector_size = sizeof (u32),
300 .format_trace = format_ah_decrypt_trace,
301 .type = VLIB_NODE_TYPE_INTERNAL,
302
303 .n_errors = ARRAY_LEN(ah_decrypt_error_strings),
304 .error_strings = ah_decrypt_error_strings,
305
306 .n_next_nodes = AH_DECRYPT_N_NEXT,
307 .next_nodes = {
308#define _(s,n) [AH_DECRYPT_NEXT_##s] = n,
309 foreach_ah_decrypt_next
310#undef _
311 },
312};
313/* *INDENT-ON* */
314
Klement Sekerab8f35442018-10-29 13:38:19 +0100315VLIB_NODE_FN (ah6_decrypt_node) (vlib_main_t * vm,
316 vlib_node_runtime_t * node,
317 vlib_frame_t * from_frame)
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200318{
319 return ah_decrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
320}
321
322/* *INDENT-OFF* */
323VLIB_REGISTER_NODE (ah6_decrypt_node) = {
Klement Sekerabe5a5dd2018-10-09 16:05:48 +0200324 .name = "ah6-decrypt",
325 .vector_size = sizeof (u32),
326 .format_trace = format_ah_decrypt_trace,
327 .type = VLIB_NODE_TYPE_INTERNAL,
328
329 .n_errors = ARRAY_LEN(ah_decrypt_error_strings),
330 .error_strings = ah_decrypt_error_strings,
331
332 .n_next_nodes = AH_DECRYPT_N_NEXT,
333 .next_nodes = {
334#define _(s,n) [AH_DECRYPT_NEXT_##s] = n,
335 foreach_ah_decrypt_next
336#undef _
337 },
338};
339/* *INDENT-ON* */
340
“mukeshyadav1984”430ac932017-11-23 02:39:33 -0800341/*
342 * fd.io coding-style-patch-verification: ON
343 *
344 * Local Variables:
345 * eval: (c-set-style "gnu")
346 * End:
347 */