Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 15 | #ifndef __ESP_H__ |
| 16 | #define __ESP_H__ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 17 | |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 18 | #include <vnet/ip/ip.h> |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 19 | #include <vnet/crypto/crypto.h> |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 20 | #include <vnet/ipsec/ipsec.h> |
| 21 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 22 | typedef struct |
| 23 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 24 | u32 spi; |
| 25 | u32 seq; |
| 26 | u8 data[0]; |
| 27 | } esp_header_t; |
| 28 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 29 | typedef struct |
| 30 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 31 | u8 pad_length; |
| 32 | u8 next_header; |
| 33 | } esp_footer_t; |
| 34 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 35 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 36 | typedef CLIB_PACKED (struct { |
| 37 | ip4_header_t ip4; |
| 38 | esp_header_t esp; |
| 39 | }) ip4_and_esp_header_t; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 40 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 41 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 42 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 43 | typedef CLIB_PACKED (struct { |
Klement Sekera | 4b089f2 | 2018-04-17 18:04:57 +0200 | [diff] [blame] | 44 | ip4_header_t ip4; |
| 45 | udp_header_t udp; |
| 46 | esp_header_t esp; |
| 47 | }) ip4_and_udp_and_esp_header_t; |
| 48 | /* *INDENT-ON* */ |
| 49 | |
| 50 | /* *INDENT-OFF* */ |
| 51 | typedef CLIB_PACKED (struct { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 52 | ip6_header_t ip6; |
| 53 | esp_header_t esp; |
| 54 | }) ip6_and_esp_header_t; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 55 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 56 | |
Damjan Marion | c59b9a2 | 2019-03-19 15:38:40 +0100 | [diff] [blame] | 57 | #define ESP_SEQ_MAX (4294967295UL) |
| 58 | #define ESP_MAX_BLOCK_SIZE (16) |
| 59 | #define ESP_MAX_ICV_SIZE (16) |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 60 | |
Sergio Gonzalez Monroy | db93cd9 | 2017-08-26 15:22:05 +0100 | [diff] [blame] | 61 | u8 *format_esp_header (u8 * s, va_list * args); |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 62 | |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 63 | /* TODO seq increment should be atomic to be accessed by multiple workers */ |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 64 | always_inline int |
| 65 | esp_seq_advance (ipsec_sa_t * sa) |
| 66 | { |
Damjan Marion | 1e3aa5e | 2019-03-28 10:58:59 +0100 | [diff] [blame] | 67 | if (PREDICT_TRUE (ipsec_sa_is_set_USE_ESN (sa))) |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 68 | { |
| 69 | if (PREDICT_FALSE (sa->seq == ESP_SEQ_MAX)) |
| 70 | { |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 71 | if (PREDICT_FALSE (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) && |
| 72 | sa->seq_hi == ESP_SEQ_MAX)) |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 73 | return 1; |
| 74 | sa->seq_hi++; |
| 75 | } |
| 76 | sa->seq++; |
| 77 | } |
| 78 | else |
| 79 | { |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 80 | if (PREDICT_FALSE (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) && |
| 81 | sa->seq == ESP_SEQ_MAX)) |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 82 | return 1; |
| 83 | sa->seq++; |
| 84 | } |
| 85 | |
| 86 | return 0; |
| 87 | } |
| 88 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 89 | |
| 90 | always_inline unsigned int |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 91 | hmac_calc (vlib_main_t * vm, ipsec_sa_t * sa, u8 * data, int data_len, |
| 92 | u8 * signature) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 93 | { |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 94 | vnet_crypto_op_t _op, *op = &_op; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 95 | |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 96 | if (PREDICT_FALSE (sa->integ_op_type == 0)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 97 | return 0; |
| 98 | |
Damjan Marion | a03d182 | 2019-03-28 21:40:48 +0100 | [diff] [blame^] | 99 | vnet_crypto_op_init (op, sa->integ_op_type); |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 100 | op->key = sa->integ_key.data; |
| 101 | op->key_len = sa->integ_key.len; |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 102 | op->src = data; |
| 103 | op->len = data_len; |
| 104 | op->dst = signature; |
Damjan Marion | 8863123 | 2019-03-20 16:30:54 +0100 | [diff] [blame] | 105 | op->hmac_trunc_len = sa->integ_trunc_size; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 106 | |
Damjan Marion | 1e3aa5e | 2019-03-28 10:58:59 +0100 | [diff] [blame] | 107 | if (ipsec_sa_is_set_USE_ESN (sa)) |
Damjan Marion | af73eda | 2019-03-20 16:30:54 +0100 | [diff] [blame] | 108 | { |
Neale Ranns | 3833ffd | 2019-03-21 14:34:09 +0000 | [diff] [blame] | 109 | u32 seq_hi = clib_host_to_net_u32 (sa->seq_hi); |
| 110 | |
Damjan Marion | af73eda | 2019-03-20 16:30:54 +0100 | [diff] [blame] | 111 | op->len += 4; |
Neale Ranns | 3833ffd | 2019-03-21 14:34:09 +0000 | [diff] [blame] | 112 | clib_memcpy (data + data_len, &seq_hi, 4); |
Damjan Marion | af73eda | 2019-03-20 16:30:54 +0100 | [diff] [blame] | 113 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 114 | |
Damjan Marion | 91f17dc | 2019-03-18 18:59:25 +0100 | [diff] [blame] | 115 | vnet_crypto_process_ops (vm, op, 1); |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 116 | return sa->integ_trunc_size; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 117 | } |
| 118 | |
Sergio Gonzalez Monroy | a10f62b | 2016-11-25 13:36:12 +0000 | [diff] [blame] | 119 | #endif /* __ESP_H__ */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 120 | |
| 121 | /* |
| 122 | * fd.io coding-style-patch-verification: ON |
| 123 | * |
| 124 | * Local Variables: |
| 125 | * eval: (c-set-style "gnu") |
| 126 | * End: |
| 127 | */ |