blob: 6ba2e7c75795a812399736dd9553f338cc4dad8b [file] [log] [blame]
Ed Warnickecb9cada2015-12-08 15:45:58 -07001/*
2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000015#ifndef __ESP_H__
16#define __ESP_H__
Ed Warnickecb9cada2015-12-08 15:45:58 -070017
Sergio Gonzalez Monroydb93cd92017-08-26 15:22:05 +010018#include <vnet/ip/ip.h>
Damjan Marion91f17dc2019-03-18 18:59:25 +010019#include <vnet/crypto/crypto.h>
Sergio Gonzalez Monroydb93cd92017-08-26 15:22:05 +010020#include <vnet/ipsec/ipsec.h>
21
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070022typedef struct
23{
Ed Warnickecb9cada2015-12-08 15:45:58 -070024 u32 spi;
25 u32 seq;
26 u8 data[0];
27} esp_header_t;
28
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070029typedef struct
30{
Ed Warnickecb9cada2015-12-08 15:45:58 -070031 u8 pad_length;
32 u8 next_header;
33} esp_footer_t;
34
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070035/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070036typedef CLIB_PACKED (struct {
37 ip4_header_t ip4;
38 esp_header_t esp;
39}) ip4_and_esp_header_t;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070040/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070041
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070042/* *INDENT-OFF* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070043typedef CLIB_PACKED (struct {
Klement Sekera4b089f22018-04-17 18:04:57 +020044 ip4_header_t ip4;
45 udp_header_t udp;
46 esp_header_t esp;
47}) ip4_and_udp_and_esp_header_t;
48/* *INDENT-ON* */
49
50/* *INDENT-OFF* */
51typedef CLIB_PACKED (struct {
Ed Warnickecb9cada2015-12-08 15:45:58 -070052 ip6_header_t ip6;
53 esp_header_t esp;
54}) ip6_and_esp_header_t;
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -070055/* *INDENT-ON* */
Ed Warnickecb9cada2015-12-08 15:45:58 -070056
Damjan Marionc59b9a22019-03-19 15:38:40 +010057#define ESP_SEQ_MAX (4294967295UL)
58#define ESP_MAX_BLOCK_SIZE (16)
59#define ESP_MAX_ICV_SIZE (16)
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000060
Sergio Gonzalez Monroydb93cd92017-08-26 15:22:05 +010061u8 *format_esp_header (u8 * s, va_list * args);
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000062
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000063/* TODO seq increment should be atomic to be accessed by multiple workers */
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000064always_inline int
65esp_seq_advance (ipsec_sa_t * sa)
66{
Damjan Marion1e3aa5e2019-03-28 10:58:59 +010067 if (PREDICT_TRUE (ipsec_sa_is_set_USE_ESN (sa)))
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000068 {
69 if (PREDICT_FALSE (sa->seq == ESP_SEQ_MAX))
70 {
Damjan Mariond709cbc2019-03-26 13:16:42 +010071 if (PREDICT_FALSE (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) &&
72 sa->seq_hi == ESP_SEQ_MAX))
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000073 return 1;
74 sa->seq_hi++;
75 }
76 sa->seq++;
77 }
78 else
79 {
Damjan Mariond709cbc2019-03-26 13:16:42 +010080 if (PREDICT_FALSE (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) &&
81 sa->seq == ESP_SEQ_MAX))
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +000082 return 1;
83 sa->seq++;
84 }
85
86 return 0;
87}
88
Ed Warnickecb9cada2015-12-08 15:45:58 -070089
90always_inline unsigned int
Damjan Marionb966e8b2019-03-20 16:07:09 +010091hmac_calc (vlib_main_t * vm, ipsec_sa_t * sa, u8 * data, int data_len,
92 u8 * signature)
Ed Warnickecb9cada2015-12-08 15:45:58 -070093{
Damjan Marion91f17dc2019-03-18 18:59:25 +010094 vnet_crypto_op_t _op, *op = &_op;
Ed Warnickecb9cada2015-12-08 15:45:58 -070095
Damjan Marionb966e8b2019-03-20 16:07:09 +010096 if (PREDICT_FALSE (sa->integ_op_type == 0))
Ed Warnickecb9cada2015-12-08 15:45:58 -070097 return 0;
98
Damjan Mariona03d1822019-03-28 21:40:48 +010099 vnet_crypto_op_init (op, sa->integ_op_type);
Damjan Marionb966e8b2019-03-20 16:07:09 +0100100 op->key = sa->integ_key.data;
101 op->key_len = sa->integ_key.len;
Damjan Marion91f17dc2019-03-18 18:59:25 +0100102 op->src = data;
103 op->len = data_len;
104 op->dst = signature;
Damjan Marion88631232019-03-20 16:30:54 +0100105 op->hmac_trunc_len = sa->integ_trunc_size;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700106
Damjan Marion1e3aa5e2019-03-28 10:58:59 +0100107 if (ipsec_sa_is_set_USE_ESN (sa))
Damjan Marionaf73eda2019-03-20 16:30:54 +0100108 {
Neale Ranns3833ffd2019-03-21 14:34:09 +0000109 u32 seq_hi = clib_host_to_net_u32 (sa->seq_hi);
110
Damjan Marionaf73eda2019-03-20 16:30:54 +0100111 op->len += 4;
Neale Ranns3833ffd2019-03-21 14:34:09 +0000112 clib_memcpy (data + data_len, &seq_hi, 4);
Damjan Marionaf73eda2019-03-20 16:30:54 +0100113 }
Ed Warnickecb9cada2015-12-08 15:45:58 -0700114
Damjan Marion91f17dc2019-03-18 18:59:25 +0100115 vnet_crypto_process_ops (vm, op, 1);
Damjan Marionb966e8b2019-03-20 16:07:09 +0100116 return sa->integ_trunc_size;
Ed Warnickecb9cada2015-12-08 15:45:58 -0700117}
118
Sergio Gonzalez Monroya10f62b2016-11-25 13:36:12 +0000119#endif /* __ESP_H__ */
Keith Burns (alagalah)166a9d42016-08-06 11:00:56 -0700120
121/*
122 * fd.io coding-style-patch-verification: ON
123 *
124 * Local Variables:
125 * eval: (c-set-style "gnu")
126 * End:
127 */