“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 1 | /* |
| 2 | * ah_decrypt.c : IPSec AH decrypt node |
| 3 | * |
| 4 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at: |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <vnet/vnet.h> |
| 19 | #include <vnet/api_errno.h> |
| 20 | #include <vnet/ip/ip.h> |
| 21 | |
| 22 | #include <vnet/ipsec/ipsec.h> |
| 23 | #include <vnet/ipsec/esp.h> |
| 24 | #include <vnet/ipsec/ah.h> |
Neale Ranns | 918c161 | 2019-02-21 23:34:59 -0800 | [diff] [blame] | 25 | #include <vnet/ipsec/ipsec_io.h> |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 26 | |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 27 | #define foreach_ah_decrypt_next \ |
| 28 | _(DROP, "error-drop") \ |
| 29 | _(IP4_INPUT, "ip4-input") \ |
| 30 | _(IP6_INPUT, "ip6-input") \ |
| 31 | _(HANDOFF, "handoff") |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 32 | |
| 33 | #define _(v, s) AH_DECRYPT_NEXT_##v, |
| 34 | typedef enum |
| 35 | { |
| 36 | foreach_ah_decrypt_next |
| 37 | #undef _ |
| 38 | AH_DECRYPT_N_NEXT, |
| 39 | } ah_decrypt_next_t; |
| 40 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 41 | #define foreach_ah_decrypt_error \ |
| 42 | _ (RX_PKTS, "AH pkts received") \ |
| 43 | _ (DECRYPTION_FAILED, "AH decryption failed") \ |
| 44 | _ (INTEG_ERROR, "Integrity check failed") \ |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 45 | _ (NO_TAIL_SPACE, "not enough buffer tail space (dropped)") \ |
| 46 | _ (DROP_FRAGMENTS, "IP fragments drop") \ |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 47 | _ (REPLAY, "SA replayed packet") |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 48 | |
| 49 | typedef enum |
| 50 | { |
| 51 | #define _(sym,str) AH_DECRYPT_ERROR_##sym, |
| 52 | foreach_ah_decrypt_error |
| 53 | #undef _ |
| 54 | AH_DECRYPT_N_ERROR, |
| 55 | } ah_decrypt_error_t; |
| 56 | |
| 57 | static char *ah_decrypt_error_strings[] = { |
| 58 | #define _(sym,string) string, |
| 59 | foreach_ah_decrypt_error |
| 60 | #undef _ |
| 61 | }; |
| 62 | |
| 63 | typedef struct |
| 64 | { |
| 65 | ipsec_integ_alg_t integ_alg; |
Neale Ranns | de84727 | 2018-11-28 01:38:34 -0800 | [diff] [blame] | 66 | u32 seq_num; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 67 | } ah_decrypt_trace_t; |
| 68 | |
| 69 | /* packet trace format function */ |
| 70 | static u8 * |
| 71 | format_ah_decrypt_trace (u8 * s, va_list * args) |
| 72 | { |
| 73 | CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); |
| 74 | CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); |
| 75 | ah_decrypt_trace_t *t = va_arg (*args, ah_decrypt_trace_t *); |
| 76 | |
Neale Ranns | de84727 | 2018-11-28 01:38:34 -0800 | [diff] [blame] | 77 | s = format (s, "ah: integrity %U seq-num %d", |
| 78 | format_ipsec_integ_alg, t->integ_alg, t->seq_num); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 79 | return s; |
| 80 | } |
| 81 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 82 | typedef struct |
| 83 | { |
| 84 | union |
| 85 | { |
| 86 | struct |
| 87 | { |
| 88 | u8 hop_limit; |
| 89 | u8 nexthdr; |
| 90 | u32 ip_version_traffic_class_and_flow_label; |
| 91 | }; |
| 92 | |
| 93 | struct |
| 94 | { |
| 95 | u8 ttl; |
| 96 | u8 tos; |
| 97 | }; |
| 98 | }; |
| 99 | u32 sa_index; |
| 100 | u32 seq; |
| 101 | u8 icv_padding_len; |
| 102 | u8 icv_size; |
| 103 | u8 ip_hdr_size; |
| 104 | i16 current_data; |
| 105 | u8 nexthdr_cached; |
| 106 | } ah_decrypt_packet_data_t; |
| 107 | |
| 108 | static_always_inline void |
| 109 | ah_process_ops (vlib_main_t * vm, vlib_node_runtime_t * node, |
| 110 | vnet_crypto_op_t * ops, vlib_buffer_t * b[], u16 * nexts) |
| 111 | { |
| 112 | u32 n_fail, n_ops = vec_len (ops); |
| 113 | vnet_crypto_op_t *op = ops; |
| 114 | |
| 115 | if (n_ops == 0) |
| 116 | return; |
| 117 | |
| 118 | n_fail = n_ops - vnet_crypto_process_ops (vm, op, n_ops); |
| 119 | |
| 120 | while (n_fail) |
| 121 | { |
| 122 | ASSERT (op - ops < n_ops); |
| 123 | |
| 124 | if (op->status != VNET_CRYPTO_OP_STATUS_COMPLETED) |
| 125 | { |
| 126 | u32 bi = op->user_data; |
| 127 | b[bi]->error = node->errors[AH_DECRYPT_ERROR_INTEG_ERROR]; |
| 128 | nexts[bi] = AH_DECRYPT_NEXT_DROP; |
| 129 | n_fail--; |
| 130 | } |
| 131 | op++; |
| 132 | } |
| 133 | } |
| 134 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 135 | always_inline uword |
| 136 | ah_decrypt_inline (vlib_main_t * vm, |
| 137 | vlib_node_runtime_t * node, vlib_frame_t * from_frame, |
| 138 | int is_ip6) |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 139 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 140 | u32 n_left, *from; |
| 141 | u32 thread_index = vm->thread_index; |
| 142 | u16 buffer_data_size = vlib_buffer_get_default_data_size (vm); |
| 143 | ah_decrypt_packet_data_t pkt_data[VLIB_FRAME_SIZE], *pd = pkt_data; |
| 144 | vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs; |
| 145 | u16 nexts[VLIB_FRAME_SIZE], *next = nexts; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 146 | ipsec_main_t *im = &ipsec_main; |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 147 | ipsec_per_thread_data_t *ptd = vec_elt_at_index (im->ptd, thread_index); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 148 | from = vlib_frame_vector_args (from_frame); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 149 | n_left = from_frame->n_vectors; |
| 150 | ipsec_sa_t *sa0 = 0; |
| 151 | u32 current_sa_index = ~0, current_sa_bytes = 0, current_sa_pkts = 0; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 152 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 153 | clib_memset (pkt_data, 0, VLIB_FRAME_SIZE * sizeof (pkt_data[0])); |
| 154 | vlib_get_buffers (vm, from, b, n_left); |
| 155 | clib_memset_u16 (nexts, -1, n_left); |
| 156 | vec_reset_length (ptd->integ_ops); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 157 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 158 | while (n_left > 0) |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 159 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 160 | ah_header_t *ah0; |
| 161 | ip4_header_t *ih4; |
| 162 | ip6_header_t *ih6; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 163 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 164 | if (vnet_buffer (b[0])->ipsec.sad_index != current_sa_index) |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 165 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 166 | if (current_sa_index != ~0) |
| 167 | vlib_increment_combined_counter (&ipsec_sa_counters, thread_index, |
| 168 | current_sa_index, |
| 169 | current_sa_pkts, |
| 170 | current_sa_bytes); |
| 171 | current_sa_index = vnet_buffer (b[0])->ipsec.sad_index; |
| 172 | sa0 = pool_elt_at_index (im->sad, current_sa_index); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 173 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 174 | current_sa_bytes = current_sa_pkts = 0; |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 175 | vlib_prefetch_combined_counter (&ipsec_sa_counters, |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 176 | thread_index, current_sa_index); |
| 177 | } |
| 178 | |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 179 | if (PREDICT_FALSE (~0 == sa0->decrypt_thread_index)) |
| 180 | { |
| 181 | /* this is the first packet to use this SA, claim the SA |
| 182 | * for this thread. this could happen simultaneously on |
| 183 | * another thread */ |
| 184 | clib_atomic_cmp_and_swap (&sa0->decrypt_thread_index, ~0, |
| 185 | ipsec_sa_assign_thread (thread_index)); |
| 186 | } |
| 187 | |
| 188 | if (PREDICT_TRUE (thread_index != sa0->decrypt_thread_index)) |
| 189 | { |
| 190 | next[0] = AH_DECRYPT_NEXT_HANDOFF; |
| 191 | goto next; |
| 192 | } |
| 193 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 194 | pd->sa_index = current_sa_index; |
| 195 | |
| 196 | ih4 = vlib_buffer_get_current (b[0]); |
| 197 | ih6 = vlib_buffer_get_current (b[0]); |
| 198 | pd->current_data = b[0]->current_data; |
| 199 | |
| 200 | if (is_ip6) |
| 201 | { |
| 202 | ip6_ext_header_t *prev = NULL; |
Klement Sekera | 769145c | 2019-03-06 11:59:57 +0100 | [diff] [blame] | 203 | ah0 = |
| 204 | ip6_ext_header_find (vm, b[0], ih6, IP_PROTOCOL_IPSEC_AH, &prev); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 205 | pd->ip_hdr_size = sizeof (ip6_header_t); |
| 206 | ASSERT ((u8 *) ah0 - (u8 *) ih6 == pd->ip_hdr_size); |
| 207 | } |
| 208 | else |
| 209 | { |
| 210 | if (ip4_is_fragment (ih4)) |
| 211 | { |
| 212 | b[0]->error = node->errors[AH_DECRYPT_ERROR_DROP_FRAGMENTS]; |
| 213 | next[0] = AH_DECRYPT_NEXT_DROP; |
| 214 | goto next; |
| 215 | } |
| 216 | pd->ip_hdr_size = ip4_header_bytes (ih4); |
| 217 | ah0 = (ah_header_t *) ((u8 *) ih4 + pd->ip_hdr_size); |
| 218 | } |
| 219 | |
| 220 | pd->seq = clib_host_to_net_u32 (ah0->seq_no); |
| 221 | |
| 222 | /* anti-replay check */ |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 223 | if (ipsec_sa_anti_replay_check (sa0, pd->seq)) |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 224 | { |
| 225 | b[0]->error = node->errors[AH_DECRYPT_ERROR_REPLAY]; |
| 226 | next[0] = AH_DECRYPT_NEXT_DROP; |
| 227 | goto next; |
| 228 | } |
| 229 | |
| 230 | current_sa_bytes += b[0]->current_length; |
| 231 | current_sa_pkts += 1; |
| 232 | |
| 233 | pd->icv_size = sa0->integ_icv_size; |
| 234 | pd->nexthdr_cached = ah0->nexthdr; |
| 235 | if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE)) |
| 236 | { |
| 237 | if (PREDICT_FALSE (ipsec_sa_is_set_USE_ESN (sa0) && |
| 238 | pd->current_data + b[0]->current_length |
| 239 | + sizeof (u32) > buffer_data_size)) |
| 240 | { |
| 241 | b[0]->error = node->errors[AH_DECRYPT_ERROR_NO_TAIL_SPACE]; |
| 242 | next[0] = AH_DECRYPT_NEXT_DROP; |
| 243 | goto next; |
| 244 | } |
| 245 | |
| 246 | vnet_crypto_op_t *op; |
| 247 | vec_add2_aligned (ptd->integ_ops, op, 1, CLIB_CACHE_LINE_BYTES); |
| 248 | vnet_crypto_op_init (op, sa0->integ_op_id); |
| 249 | |
| 250 | op->src = (u8 *) ih4; |
| 251 | op->len = b[0]->current_length; |
| 252 | op->digest = (u8 *) ih4 - pd->icv_size; |
| 253 | op->flags = VNET_CRYPTO_OP_FLAG_HMAC_CHECK; |
| 254 | op->digest_len = pd->icv_size; |
| 255 | op->key_index = sa0->integ_key_index; |
| 256 | op->user_data = b - bufs; |
| 257 | if (ipsec_sa_is_set_USE_ESN (sa0)) |
| 258 | { |
| 259 | u32 seq_hi = clib_host_to_net_u32 (sa0->seq_hi); |
| 260 | |
| 261 | op->len += sizeof (seq_hi); |
| 262 | clib_memcpy (op->src + b[0]->current_length, &seq_hi, |
| 263 | sizeof (seq_hi)); |
| 264 | } |
| 265 | clib_memcpy (op->digest, ah0->auth_data, pd->icv_size); |
| 266 | clib_memset (ah0->auth_data, 0, pd->icv_size); |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 267 | |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 268 | if (is_ip6) |
Klement Sekera | 611864f | 2018-09-26 11:19:00 +0200 | [diff] [blame] | 269 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 270 | pd->ip_version_traffic_class_and_flow_label = |
| 271 | ih6->ip_version_traffic_class_and_flow_label; |
| 272 | pd->hop_limit = ih6->hop_limit; |
| 273 | ih6->ip_version_traffic_class_and_flow_label = 0x60; |
| 274 | ih6->hop_limit = 0; |
| 275 | pd->nexthdr = ah0->nexthdr; |
| 276 | pd->icv_padding_len = |
| 277 | ah_calc_icv_padding_len (pd->icv_size, 1 /* is_ipv6 */ ); |
Klement Sekera | 611864f | 2018-09-26 11:19:00 +0200 | [diff] [blame] | 278 | } |
| 279 | else |
| 280 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 281 | pd->tos = ih4->tos; |
| 282 | pd->ttl = ih4->ttl; |
| 283 | ih4->tos = 0; |
| 284 | ih4->ttl = 0; |
| 285 | ih4->checksum = 0; |
| 286 | pd->icv_padding_len = |
| 287 | ah_calc_icv_padding_len (pd->icv_size, 0 /* is_ipv6 */ ); |
Klement Sekera | 611864f | 2018-09-26 11:19:00 +0200 | [diff] [blame] | 288 | } |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 289 | } |
Klement Sekera | 611864f | 2018-09-26 11:19:00 +0200 | [diff] [blame] | 290 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 291 | next: |
| 292 | n_left -= 1; |
| 293 | pd += 1; |
| 294 | next += 1; |
| 295 | b += 1; |
| 296 | } |
Neale Ranns | de84727 | 2018-11-28 01:38:34 -0800 | [diff] [blame] | 297 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 298 | n_left = from_frame->n_vectors; |
| 299 | next = nexts; |
| 300 | pd = pkt_data; |
| 301 | b = bufs; |
| 302 | |
| 303 | vlib_node_increment_counter (vm, node->node_index, AH_DECRYPT_ERROR_RX_PKTS, |
| 304 | n_left); |
| 305 | vlib_increment_combined_counter (&ipsec_sa_counters, thread_index, |
| 306 | current_sa_index, current_sa_pkts, |
| 307 | current_sa_bytes); |
| 308 | |
| 309 | ah_process_ops (vm, node, ptd->integ_ops, bufs, nexts); |
| 310 | |
| 311 | while (n_left > 0) |
| 312 | { |
| 313 | ip4_header_t *oh4; |
| 314 | ip6_header_t *oh6; |
| 315 | |
| 316 | if (next[0] < AH_DECRYPT_N_NEXT) |
| 317 | goto trace; |
| 318 | |
| 319 | sa0 = vec_elt_at_index (im->sad, pd->sa_index); |
| 320 | |
| 321 | if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE)) |
| 322 | { |
Neale Ranns | 3b9374f | 2019-08-01 04:45:15 -0700 | [diff] [blame] | 323 | /* redo the anit-reply check. see esp_decrypt for details */ |
| 324 | if (ipsec_sa_anti_replay_check (sa0, pd->seq)) |
| 325 | { |
| 326 | b[0]->error = node->errors[AH_DECRYPT_ERROR_REPLAY]; |
| 327 | next[0] = AH_DECRYPT_NEXT_DROP; |
| 328 | goto trace; |
| 329 | } |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 330 | ipsec_sa_anti_replay_advance (sa0, pd->seq); |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 331 | } |
| 332 | |
| 333 | u16 ah_hdr_len = sizeof (ah_header_t) + pd->icv_size |
| 334 | + pd->icv_padding_len; |
| 335 | vlib_buffer_advance (b[0], pd->ip_hdr_size + ah_hdr_len); |
| 336 | b[0]->flags |= VLIB_BUFFER_TOTAL_LENGTH_VALID; |
| 337 | |
| 338 | if (PREDICT_TRUE (ipsec_sa_is_set_IS_TUNNEL (sa0))) |
| 339 | { /* tunnel mode */ |
| 340 | if (PREDICT_TRUE (pd->nexthdr_cached == IP_PROTOCOL_IP_IN_IP)) |
| 341 | next[0] = AH_DECRYPT_NEXT_IP4_INPUT; |
| 342 | else if (pd->nexthdr_cached == IP_PROTOCOL_IPV6) |
| 343 | next[0] = AH_DECRYPT_NEXT_IP6_INPUT; |
| 344 | else |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 345 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 346 | b[0]->error = node->errors[AH_DECRYPT_ERROR_DECRYPTION_FAILED]; |
| 347 | next[0] = AH_DECRYPT_NEXT_DROP; |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 348 | goto trace; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 349 | } |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 350 | } |
| 351 | else |
| 352 | { /* transport mode */ |
| 353 | if (is_ip6) |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 354 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 355 | vlib_buffer_advance (b[0], -sizeof (ip6_header_t)); |
| 356 | oh6 = vlib_buffer_get_current (b[0]); |
| 357 | if (ah_hdr_len >= sizeof (ip6_header_t)) |
| 358 | clib_memcpy (oh6, b[0]->data + pd->current_data, |
| 359 | sizeof (ip6_header_t)); |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 360 | else |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 361 | memmove (oh6, b[0]->data + pd->current_data, |
| 362 | sizeof (ip6_header_t)); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 363 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 364 | next[0] = AH_DECRYPT_NEXT_IP6_INPUT; |
| 365 | oh6->protocol = pd->nexthdr; |
| 366 | oh6->hop_limit = pd->hop_limit; |
| 367 | oh6->ip_version_traffic_class_and_flow_label = |
| 368 | pd->ip_version_traffic_class_and_flow_label; |
| 369 | oh6->payload_length = |
| 370 | clib_host_to_net_u16 (vlib_buffer_length_in_chain |
| 371 | (vm, b[0]) - sizeof (ip6_header_t)); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 372 | } |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 373 | else |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 374 | { |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 375 | vlib_buffer_advance (b[0], -sizeof (ip4_header_t)); |
| 376 | oh4 = vlib_buffer_get_current (b[0]); |
| 377 | if (ah_hdr_len >= sizeof (ip4_header_t)) |
| 378 | clib_memcpy (oh4, b[0]->data + pd->current_data, |
| 379 | sizeof (ip4_header_t)); |
| 380 | else |
| 381 | memmove (oh4, b[0]->data + pd->current_data, |
| 382 | sizeof (ip4_header_t)); |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 383 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 384 | next[0] = AH_DECRYPT_NEXT_IP4_INPUT; |
| 385 | oh4->ip_version_and_header_length = 0x45; |
| 386 | oh4->fragment_id = 0; |
| 387 | oh4->flags_and_fragment_offset = 0; |
| 388 | oh4->protocol = pd->nexthdr_cached; |
| 389 | oh4->length = |
| 390 | clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b[0])); |
| 391 | oh4->ttl = pd->ttl; |
| 392 | oh4->tos = pd->tos; |
| 393 | oh4->checksum = ip4_header_checksum (oh4); |
| 394 | } |
| 395 | } |
| 396 | |
Filip Tehlar | 6230eea | 2019-05-21 08:11:21 +0000 | [diff] [blame] | 397 | vnet_buffer (b[0])->sw_if_index[VLIB_TX] = (u32) ~ 0; |
| 398 | trace: |
| 399 | if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED)) |
| 400 | { |
| 401 | sa0 = pool_elt_at_index (im->sad, |
| 402 | vnet_buffer (b[0])->ipsec.sad_index); |
| 403 | ah_decrypt_trace_t *tr = |
| 404 | vlib_add_trace (vm, node, b[0], sizeof (*tr)); |
| 405 | tr->integ_alg = sa0->integ_alg; |
| 406 | tr->seq_num = pd->seq; |
| 407 | } |
| 408 | |
| 409 | n_left -= 1; |
| 410 | pd += 1; |
| 411 | next += 1; |
| 412 | b += 1; |
| 413 | } |
| 414 | |
| 415 | n_left = from_frame->n_vectors; |
| 416 | vlib_buffer_enqueue_to_next (vm, node, from, nexts, n_left); |
| 417 | |
| 418 | return n_left; |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 419 | } |
| 420 | |
Klement Sekera | b8f3544 | 2018-10-29 13:38:19 +0100 | [diff] [blame] | 421 | VLIB_NODE_FN (ah4_decrypt_node) (vlib_main_t * vm, |
| 422 | vlib_node_runtime_t * node, |
| 423 | vlib_frame_t * from_frame) |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 424 | { |
| 425 | return ah_decrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ ); |
| 426 | } |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 427 | |
| 428 | /* *INDENT-OFF* */ |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 429 | VLIB_REGISTER_NODE (ah4_decrypt_node) = { |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 430 | .name = "ah4-decrypt", |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 431 | .vector_size = sizeof (u32), |
| 432 | .format_trace = format_ah_decrypt_trace, |
| 433 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 434 | |
| 435 | .n_errors = ARRAY_LEN(ah_decrypt_error_strings), |
| 436 | .error_strings = ah_decrypt_error_strings, |
| 437 | |
| 438 | .n_next_nodes = AH_DECRYPT_N_NEXT, |
| 439 | .next_nodes = { |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 440 | [AH_DECRYPT_NEXT_DROP] = "ip4-drop", |
| 441 | [AH_DECRYPT_NEXT_IP4_INPUT] = "ip4-input-no-checksum", |
| 442 | [AH_DECRYPT_NEXT_IP6_INPUT] = "ip6-input", |
Neale Ranns | 4a56f4e | 2019-12-23 04:10:25 +0000 | [diff] [blame^] | 443 | [AH_DECRYPT_NEXT_HANDOFF] = "ah4-decrypt-handoff", |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 444 | }, |
| 445 | }; |
| 446 | /* *INDENT-ON* */ |
| 447 | |
Klement Sekera | b8f3544 | 2018-10-29 13:38:19 +0100 | [diff] [blame] | 448 | VLIB_NODE_FN (ah6_decrypt_node) (vlib_main_t * vm, |
| 449 | vlib_node_runtime_t * node, |
| 450 | vlib_frame_t * from_frame) |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 451 | { |
| 452 | return ah_decrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ ); |
| 453 | } |
| 454 | |
| 455 | /* *INDENT-OFF* */ |
| 456 | VLIB_REGISTER_NODE (ah6_decrypt_node) = { |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 457 | .name = "ah6-decrypt", |
| 458 | .vector_size = sizeof (u32), |
| 459 | .format_trace = format_ah_decrypt_trace, |
| 460 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 461 | |
| 462 | .n_errors = ARRAY_LEN(ah_decrypt_error_strings), |
| 463 | .error_strings = ah_decrypt_error_strings, |
| 464 | |
| 465 | .n_next_nodes = AH_DECRYPT_N_NEXT, |
| 466 | .next_nodes = { |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 467 | [AH_DECRYPT_NEXT_DROP] = "ip6-drop", |
| 468 | [AH_DECRYPT_NEXT_IP4_INPUT] = "ip4-input-no-checksum", |
| 469 | [AH_DECRYPT_NEXT_IP6_INPUT] = "ip6-input", |
Neale Ranns | 4a56f4e | 2019-12-23 04:10:25 +0000 | [diff] [blame^] | 470 | [AH_DECRYPT_NEXT_HANDOFF] = "ah6-decrypt-handoff", |
Klement Sekera | be5a5dd | 2018-10-09 16:05:48 +0200 | [diff] [blame] | 471 | }, |
| 472 | }; |
| 473 | /* *INDENT-ON* */ |
| 474 | |
“mukeshyadav1984” | 430ac93 | 2017-11-23 02:39:33 -0800 | [diff] [blame] | 475 | /* |
| 476 | * fd.io coding-style-patch-verification: ON |
| 477 | * |
| 478 | * Local Variables: |
| 479 | * eval: (c-set-style "gnu") |
| 480 | * End: |
| 481 | */ |