Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
| 15 | #ifndef __IPSEC_SPD_SA_H__ |
| 16 | #define __IPSEC_SPD_SA_H__ |
| 17 | |
| 18 | #include <vlib/vlib.h> |
Filip Tehlar | e5d3491 | 2020-03-02 15:17:37 +0000 | [diff] [blame^] | 19 | #include <vnet/crypto/crypto.h> |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 20 | #include <vnet/ip/ip.h> |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 21 | #include <vnet/fib/fib_node.h> |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 22 | |
| 23 | #define foreach_ipsec_crypto_alg \ |
| 24 | _ (0, NONE, "none") \ |
| 25 | _ (1, AES_CBC_128, "aes-cbc-128") \ |
| 26 | _ (2, AES_CBC_192, "aes-cbc-192") \ |
| 27 | _ (3, AES_CBC_256, "aes-cbc-256") \ |
| 28 | _ (4, AES_CTR_128, "aes-ctr-128") \ |
| 29 | _ (5, AES_CTR_192, "aes-ctr-192") \ |
| 30 | _ (6, AES_CTR_256, "aes-ctr-256") \ |
| 31 | _ (7, AES_GCM_128, "aes-gcm-128") \ |
| 32 | _ (8, AES_GCM_192, "aes-gcm-192") \ |
| 33 | _ (9, AES_GCM_256, "aes-gcm-256") \ |
| 34 | _ (10, DES_CBC, "des-cbc") \ |
| 35 | _ (11, 3DES_CBC, "3des-cbc") |
| 36 | |
| 37 | typedef enum |
| 38 | { |
| 39 | #define _(v, f, s) IPSEC_CRYPTO_ALG_##f = v, |
| 40 | foreach_ipsec_crypto_alg |
| 41 | #undef _ |
| 42 | IPSEC_CRYPTO_N_ALG, |
| 43 | } ipsec_crypto_alg_t; |
| 44 | |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 45 | #define IPSEC_CRYPTO_ALG_IS_GCM(_alg) \ |
| 46 | (((_alg == IPSEC_CRYPTO_ALG_AES_GCM_128) || \ |
| 47 | (_alg == IPSEC_CRYPTO_ALG_AES_GCM_192) || \ |
| 48 | (_alg == IPSEC_CRYPTO_ALG_AES_GCM_256))) |
| 49 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 50 | #define foreach_ipsec_integ_alg \ |
| 51 | _ (0, NONE, "none") \ |
| 52 | _ (1, MD5_96, "md5-96") /* RFC2403 */ \ |
| 53 | _ (2, SHA1_96, "sha1-96") /* RFC2404 */ \ |
| 54 | _ (3, SHA_256_96, "sha-256-96") /* draft-ietf-ipsec-ciph-sha-256-00 */ \ |
| 55 | _ (4, SHA_256_128, "sha-256-128") /* RFC4868 */ \ |
| 56 | _ (5, SHA_384_192, "sha-384-192") /* RFC4868 */ \ |
| 57 | _ (6, SHA_512_256, "sha-512-256") /* RFC4868 */ |
| 58 | |
| 59 | typedef enum |
| 60 | { |
| 61 | #define _(v, f, s) IPSEC_INTEG_ALG_##f = v, |
| 62 | foreach_ipsec_integ_alg |
| 63 | #undef _ |
| 64 | IPSEC_INTEG_N_ALG, |
| 65 | } ipsec_integ_alg_t; |
| 66 | |
| 67 | typedef enum |
| 68 | { |
| 69 | IPSEC_PROTOCOL_AH = 0, |
| 70 | IPSEC_PROTOCOL_ESP = 1 |
| 71 | } ipsec_protocol_t; |
| 72 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 73 | #define IPSEC_KEY_MAX_LEN 128 |
| 74 | typedef struct ipsec_key_t_ |
| 75 | { |
| 76 | u8 len; |
| 77 | u8 data[IPSEC_KEY_MAX_LEN]; |
| 78 | } ipsec_key_t; |
| 79 | |
| 80 | /* |
| 81 | * Enable extended sequence numbers |
| 82 | * Enable Anti-replay |
| 83 | * IPsec tunnel mode if non-zero, else transport mode |
| 84 | * IPsec tunnel mode is IPv6 if non-zero, |
| 85 | * else IPv4 tunnel only valid if is_tunnel is non-zero |
| 86 | * enable UDP encapsulation for NAT traversal |
| 87 | */ |
| 88 | #define foreach_ipsec_sa_flags \ |
| 89 | _ (0, NONE, "none") \ |
Damjan Marion | 1e3aa5e | 2019-03-28 10:58:59 +0100 | [diff] [blame] | 90 | _ (1, USE_ESN, "esn") \ |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 91 | _ (2, USE_ANTI_REPLAY, "anti-replay") \ |
| 92 | _ (4, IS_TUNNEL, "tunnel") \ |
| 93 | _ (8, IS_TUNNEL_V6, "tunnel-v6") \ |
| 94 | _ (16, UDP_ENCAP, "udp-encap") \ |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 95 | _ (32, IS_PROTECT, "Protect") \ |
Neale Ranns | 6b43ce5 | 2019-07-31 01:04:43 -0700 | [diff] [blame] | 96 | _ (64, IS_INBOUND, "inbound") \ |
Neale Ranns | 47feb11 | 2019-04-11 15:14:07 +0000 | [diff] [blame] | 97 | _ (128, IS_AEAD, "aead") \ |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 98 | |
| 99 | typedef enum ipsec_sad_flags_t_ |
| 100 | { |
| 101 | #define _(v, f, s) IPSEC_SA_FLAG_##f = v, |
| 102 | foreach_ipsec_sa_flags |
| 103 | #undef _ |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 104 | } __clib_packed ipsec_sa_flags_t; |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 105 | |
| 106 | STATIC_ASSERT (sizeof (ipsec_sa_flags_t) == 1, "IPSEC SA flags > 1 byte"); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 107 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 108 | typedef struct |
| 109 | { |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 110 | CLIB_CACHE_LINE_ALIGN_MARK (cacheline0); |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 111 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 112 | /* flags */ |
| 113 | ipsec_sa_flags_t flags; |
| 114 | |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 115 | u8 crypto_iv_size; |
| 116 | u8 crypto_block_size; |
Damjan Marion | 7c22ff7 | 2019-04-04 12:25:44 +0200 | [diff] [blame] | 117 | u8 integ_icv_size; |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 118 | u32 encrypt_thread_index; |
| 119 | u32 decrypt_thread_index; |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 120 | u32 spi; |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 121 | u32 seq; |
| 122 | u32 seq_hi; |
| 123 | u32 last_seq; |
| 124 | u32 last_seq_hi; |
| 125 | u64 replay_window; |
Neale Ranns | 72f2a3a | 2019-06-17 15:43:38 +0000 | [diff] [blame] | 126 | dpo_id_t dpo; |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 127 | |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 128 | vnet_crypto_key_index_t crypto_key_index; |
| 129 | vnet_crypto_key_index_t integ_key_index; |
| 130 | vnet_crypto_op_id_t crypto_enc_op_id:16; |
| 131 | vnet_crypto_op_id_t crypto_dec_op_id:16; |
| 132 | vnet_crypto_op_id_t integ_op_id:16; |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 133 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 134 | /* data accessed by dataplane code should be above this comment */ |
| 135 | CLIB_CACHE_LINE_ALIGN_MARK (cacheline1); |
| 136 | |
| 137 | union |
| 138 | { |
| 139 | ip4_header_t ip4_hdr; |
| 140 | ip6_header_t ip6_hdr; |
| 141 | }; |
| 142 | udp_header_t udp_hdr; |
| 143 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 144 | fib_node_t node; |
| 145 | u32 id; |
| 146 | u32 stat_index; |
| 147 | ipsec_protocol_t protocol; |
| 148 | |
| 149 | ipsec_crypto_alg_t crypto_alg; |
| 150 | ipsec_key_t crypto_key; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 151 | vnet_crypto_alg_t crypto_calg; |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 152 | |
| 153 | ipsec_integ_alg_t integ_alg; |
| 154 | ipsec_key_t integ_key; |
Damjan Marion | d1bed68 | 2019-04-24 15:20:35 +0200 | [diff] [blame] | 155 | vnet_crypto_alg_t integ_calg; |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 156 | |
| 157 | ip46_address_t tunnel_src_addr; |
| 158 | ip46_address_t tunnel_dst_addr; |
| 159 | |
| 160 | fib_node_index_t fib_entry_index; |
| 161 | u32 sibling; |
| 162 | |
| 163 | u32 tx_fib_index; |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 164 | |
Neale Ranns | 80f6fd5 | 2019-04-16 02:41:34 +0000 | [diff] [blame] | 165 | /* Salt used in GCM modes - stored in network byte order */ |
| 166 | u32 salt; |
Damjan Marion | d97918e | 2019-04-25 18:28:31 +0200 | [diff] [blame] | 167 | u64 gcm_iv_counter; |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 168 | } ipsec_sa_t; |
| 169 | |
Damjan Marion | d709cbc | 2019-03-26 13:16:42 +0100 | [diff] [blame] | 170 | STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline1, CLIB_CACHE_LINE_BYTES); |
| 171 | |
| 172 | #define _(a,v,s) \ |
| 173 | always_inline int \ |
| 174 | ipsec_sa_is_set_##v (const ipsec_sa_t *sa) { \ |
| 175 | return (sa->flags & IPSEC_SA_FLAG_##v); \ |
| 176 | } |
| 177 | foreach_ipsec_sa_flags |
| 178 | #undef _ |
| 179 | #define _(a,v,s) \ |
| 180 | always_inline int \ |
| 181 | ipsec_sa_set_##v (ipsec_sa_t *sa) { \ |
| 182 | return (sa->flags |= IPSEC_SA_FLAG_##v); \ |
| 183 | } |
| 184 | foreach_ipsec_sa_flags |
| 185 | #undef _ |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 186 | #define _(a,v,s) \ |
| 187 | always_inline int \ |
| 188 | ipsec_sa_unset_##v (ipsec_sa_t *sa) { \ |
| 189 | return (sa->flags &= ~IPSEC_SA_FLAG_##v); \ |
| 190 | } |
| 191 | foreach_ipsec_sa_flags |
| 192 | #undef _ |
Neale Ranns | eba31ec | 2019-02-17 18:04:27 +0000 | [diff] [blame] | 193 | /** |
| 194 | * @brief |
| 195 | * SA packet & bytes counters |
| 196 | */ |
| 197 | extern vlib_combined_counter_main_t ipsec_sa_counters; |
| 198 | |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 199 | extern void ipsec_mk_key (ipsec_key_t * key, const u8 * data, u8 len); |
| 200 | |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 201 | extern int ipsec_sa_add_and_lock (u32 id, |
| 202 | u32 spi, |
| 203 | ipsec_protocol_t proto, |
| 204 | ipsec_crypto_alg_t crypto_alg, |
| 205 | const ipsec_key_t * ck, |
| 206 | ipsec_integ_alg_t integ_alg, |
| 207 | const ipsec_key_t * ik, |
| 208 | ipsec_sa_flags_t flags, |
| 209 | u32 tx_table_id, |
| 210 | u32 salt, |
| 211 | const ip46_address_t * tunnel_src_addr, |
| 212 | const ip46_address_t * tunnel_dst_addr, |
Filip Tehlar | e5d3491 | 2020-03-02 15:17:37 +0000 | [diff] [blame^] | 213 | u32 * sa_index, u16 dst_port); |
Neale Ranns | 495d7ff | 2019-07-12 09:15:26 +0000 | [diff] [blame] | 214 | extern index_t ipsec_sa_find_and_lock (u32 id); |
| 215 | extern int ipsec_sa_unlock_id (u32 id); |
| 216 | extern void ipsec_sa_unlock (index_t sai); |
Neale Ranns | 12989b5 | 2019-09-26 16:20:19 +0000 | [diff] [blame] | 217 | extern void ipsec_sa_lock (index_t sai); |
Neale Ranns | c87b66c | 2019-02-07 07:26:12 -0800 | [diff] [blame] | 218 | extern void ipsec_sa_clear (index_t sai); |
Damjan Marion | b966e8b | 2019-03-20 16:07:09 +0100 | [diff] [blame] | 219 | extern void ipsec_sa_set_crypto_alg (ipsec_sa_t * sa, |
| 220 | ipsec_crypto_alg_t crypto_alg); |
| 221 | extern void ipsec_sa_set_integ_alg (ipsec_sa_t * sa, |
| 222 | ipsec_integ_alg_t integ_alg); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 223 | |
Neale Ranns | b4cfd55 | 2019-02-13 02:08:06 -0800 | [diff] [blame] | 224 | typedef walk_rc_t (*ipsec_sa_walk_cb_t) (ipsec_sa_t * sa, void *ctx); |
| 225 | extern void ipsec_sa_walk (ipsec_sa_walk_cb_t cd, void *ctx); |
| 226 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 227 | extern u8 *format_ipsec_crypto_alg (u8 * s, va_list * args); |
| 228 | extern u8 *format_ipsec_integ_alg (u8 * s, va_list * args); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 229 | extern u8 *format_ipsec_sa (u8 * s, va_list * args); |
| 230 | extern u8 *format_ipsec_key (u8 * s, va_list * args); |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 231 | extern uword unformat_ipsec_crypto_alg (unformat_input_t * input, |
| 232 | va_list * args); |
| 233 | extern uword unformat_ipsec_integ_alg (unformat_input_t * input, |
| 234 | va_list * args); |
Neale Ranns | 8d7c502 | 2019-02-06 01:41:05 -0800 | [diff] [blame] | 235 | extern uword unformat_ipsec_key (unformat_input_t * input, va_list * args); |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 236 | |
Filip Tehlar | e5d3491 | 2020-03-02 15:17:37 +0000 | [diff] [blame^] | 237 | #define IPSEC_UDP_PORT_NONE ((u16)~0) |
| 238 | |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 239 | /* |
| 240 | * Anti Replay definitions |
| 241 | */ |
| 242 | |
| 243 | #define IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE (64) |
| 244 | #define IPSEC_SA_ANTI_REPLAY_WINDOW_MAX_INDEX (IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE-1) |
| 245 | |
| 246 | /* |
| 247 | * sequence number less than the lower bound are outside of the window |
| 248 | * From RFC4303 Appendix A: |
| 249 | * Bl = Tl - W + 1 |
| 250 | */ |
| 251 | #define IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND(_tl) (_tl - IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE + 1) |
| 252 | |
| 253 | /* |
| 254 | * Anti replay check. |
| 255 | * inputs need to be in host byte order. |
| 256 | */ |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 257 | always_inline int |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 258 | ipsec_sa_anti_replay_check (ipsec_sa_t * sa, u32 seq) |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 259 | { |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 260 | u32 diff, tl, th; |
| 261 | |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 262 | if ((sa->flags & IPSEC_SA_FLAG_USE_ANTI_REPLAY) == 0) |
| 263 | return 0; |
| 264 | |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 265 | if (!ipsec_sa_is_set_USE_ESN (sa)) |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 266 | { |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 267 | if (PREDICT_TRUE (seq > sa->last_seq)) |
| 268 | return 0; |
| 269 | |
| 270 | diff = sa->last_seq - seq; |
| 271 | |
| 272 | if (IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE > diff) |
| 273 | return (sa->replay_window & (1ULL << diff)) ? 1 : 0; |
| 274 | else |
| 275 | return 1; |
| 276 | |
| 277 | return 0; |
| 278 | } |
| 279 | |
| 280 | tl = sa->last_seq; |
| 281 | th = sa->last_seq_hi; |
| 282 | diff = tl - seq; |
| 283 | |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 284 | if (PREDICT_TRUE (tl >= (IPSEC_SA_ANTI_REPLAY_WINDOW_MAX_INDEX))) |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 285 | { |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 286 | /* |
| 287 | * the last sequence number VPP recieved is more than one |
| 288 | * window size greater than zero. |
| 289 | * Case A from RFC4303 Appendix A. |
| 290 | */ |
| 291 | if (seq < IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND (tl)) |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 292 | { |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 293 | /* |
| 294 | * the received sequence number is lower than the lower bound |
| 295 | * of the window, this could mean either a replay packet or that |
| 296 | * the high sequence number has wrapped. if it decrypts corrently |
| 297 | * then it's the latter. |
| 298 | */ |
| 299 | sa->seq_hi = th + 1; |
| 300 | return 0; |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 301 | } |
| 302 | else |
| 303 | { |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 304 | /* |
| 305 | * the recieved sequence number greater than the low |
| 306 | * end of the window. |
| 307 | */ |
| 308 | sa->seq_hi = th; |
| 309 | if (seq <= tl) |
| 310 | /* |
| 311 | * The recieved seq number is within bounds of the window |
| 312 | * check if it's a duplicate |
| 313 | */ |
| 314 | return (sa->replay_window & (1ULL << diff)) ? 1 : 0; |
| 315 | else |
| 316 | /* |
| 317 | * The received sequence number is greater than the window |
| 318 | * upper bound. this packet will move the window along, assuming |
| 319 | * it decrypts correctly. |
| 320 | */ |
| 321 | return 0; |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 322 | } |
| 323 | } |
| 324 | else |
| 325 | { |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 326 | /* |
| 327 | * the last sequence number VPP recieved is within one window |
| 328 | * size of zero, i.e. 0 < TL < WINDOW_SIZE, the lower bound is thus a |
| 329 | * large sequence number. |
| 330 | * Note that the check below uses unsiged integer arthimetic, so the |
| 331 | * RHS will be a larger number. |
| 332 | * Case B from RFC4303 Appendix A. |
| 333 | */ |
| 334 | if (seq < IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND (tl)) |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 335 | { |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 336 | /* |
| 337 | * the sequence number is less than the lower bound. |
| 338 | */ |
| 339 | if (seq <= tl) |
| 340 | { |
| 341 | /* |
| 342 | * the packet is within the window upper bound. |
| 343 | * check for duplicates. |
| 344 | */ |
| 345 | sa->seq_hi = th; |
| 346 | return (sa->replay_window & (1ULL << diff)) ? 1 : 0; |
| 347 | } |
| 348 | else |
| 349 | { |
| 350 | /* |
| 351 | * the packet is less the window lower bound or greater than |
| 352 | * the higher bound, depending on how you look at it... |
| 353 | * We're assuming, given that the last sequence number received, |
| 354 | * TL < WINDOW_SIZE, that a largeer seq num is more likely to be |
| 355 | * a packet that moves the window forward, than a packet that has |
| 356 | * wrapped the high sequence again. If it were the latter then |
| 357 | * we've lost close to 2^32 packets. |
| 358 | */ |
| 359 | sa->seq_hi = th; |
| 360 | return 0; |
| 361 | } |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 362 | } |
| 363 | else |
| 364 | { |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 365 | /* |
| 366 | * the packet seq number is between the lower bound (a large nubmer) |
| 367 | * and MAX_SEQ_NUM. This is in the window since the window upper bound |
| 368 | * tl > 0. |
| 369 | * However, since TL is the other side of 0 to the received |
| 370 | * packet, the SA has moved on to a higher sequence number. |
| 371 | */ |
| 372 | sa->seq_hi = th - 1; |
| 373 | return (sa->replay_window & (1ULL << diff)) ? 1 : 0; |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 374 | } |
| 375 | } |
| 376 | |
| 377 | return 0; |
| 378 | } |
| 379 | |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 380 | /* |
| 381 | * Anti replay window advance |
| 382 | * inputs need to be in host byte order. |
| 383 | */ |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 384 | always_inline void |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 385 | ipsec_sa_anti_replay_advance (ipsec_sa_t * sa, u32 seq) |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 386 | { |
Neale Ranns | 6afaae1 | 2019-07-17 15:07:14 +0000 | [diff] [blame] | 387 | u32 pos; |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 388 | if (PREDICT_TRUE (sa->flags & IPSEC_SA_FLAG_USE_ANTI_REPLAY) == 0) |
| 389 | return; |
| 390 | |
Damjan Marion | 1e3aa5e | 2019-03-28 10:58:59 +0100 | [diff] [blame] | 391 | if (PREDICT_TRUE (sa->flags & IPSEC_SA_FLAG_USE_ESN)) |
Damjan Marion | 1f4e1cb | 2019-03-28 19:19:31 +0100 | [diff] [blame] | 392 | { |
| 393 | int wrap = sa->seq_hi - sa->last_seq_hi; |
| 394 | |
| 395 | if (wrap == 0 && seq > sa->last_seq) |
| 396 | { |
| 397 | pos = seq - sa->last_seq; |
| 398 | if (pos < IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE) |
| 399 | sa->replay_window = ((sa->replay_window) << pos) | 1; |
| 400 | else |
| 401 | sa->replay_window = 1; |
| 402 | sa->last_seq = seq; |
| 403 | } |
| 404 | else if (wrap > 0) |
| 405 | { |
| 406 | pos = ~seq + sa->last_seq + 1; |
| 407 | if (pos < IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE) |
| 408 | sa->replay_window = ((sa->replay_window) << pos) | 1; |
| 409 | else |
| 410 | sa->replay_window = 1; |
| 411 | sa->last_seq = seq; |
| 412 | sa->last_seq_hi = sa->seq_hi; |
| 413 | } |
| 414 | else if (wrap < 0) |
| 415 | { |
| 416 | pos = ~seq + sa->last_seq + 1; |
| 417 | sa->replay_window |= (1ULL << pos); |
| 418 | } |
| 419 | else |
| 420 | { |
| 421 | pos = sa->last_seq - seq; |
| 422 | sa->replay_window |= (1ULL << pos); |
| 423 | } |
| 424 | } |
| 425 | else |
| 426 | { |
| 427 | if (seq > sa->last_seq) |
| 428 | { |
| 429 | pos = seq - sa->last_seq; |
| 430 | if (pos < IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE) |
| 431 | sa->replay_window = ((sa->replay_window) << pos) | 1; |
| 432 | else |
| 433 | sa->replay_window = 1; |
| 434 | sa->last_seq = seq; |
| 435 | } |
| 436 | else |
| 437 | { |
| 438 | pos = sa->last_seq - seq; |
| 439 | sa->replay_window |= (1ULL << pos); |
| 440 | } |
| 441 | } |
| 442 | } |
| 443 | |
Neale Ranns | f62a8c0 | 2019-04-02 08:13:33 +0000 | [diff] [blame] | 444 | |
| 445 | /* |
| 446 | * Makes choice for thread_id should be assigned. |
| 447 | * if input ~0, gets random worker_id based on unix_time_now_nsec |
| 448 | */ |
| 449 | always_inline u32 |
| 450 | ipsec_sa_assign_thread (u32 thread_id) |
| 451 | { |
| 452 | return ((thread_id) ? thread_id |
| 453 | : (unix_time_now_nsec () % vlib_num_workers ()) + 1); |
| 454 | } |
| 455 | |
Neale Ranns | 999c8ee | 2019-02-01 03:31:24 -0800 | [diff] [blame] | 456 | #endif /* __IPSEC_SPD_SA_H__ */ |
| 457 | |
| 458 | /* |
| 459 | * fd.io coding-style-patch-verification: ON |
| 460 | * |
| 461 | * Local Variables: |
| 462 | * eval: (c-set-style "gnu") |
| 463 | * End: |
| 464 | */ |