vnet/vnet/ipsec/esp_decrypt.c

   1 /*
   2  * esp_decrypt.c : IPSec ESP decrypt node
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21
  22 #include <vnet/ipsec/ipsec.h>
  23 #include <vnet/ipsec/esp.h>
  24
  25 #define ESP_WINDOW_SIZE 64
  26
  27 #define foreach_esp_decrypt_next                \
  28 _(DROP, "error-drop")                           \
  29 _(IP4_INPUT, "ip4-input")                       \
  30 _(IP6_INPUT, "ip6-input")
  31
  32 #define _(v, s) ESP_DECRYPT_NEXT_##v,
  33 typedef enum
  34 {
  35   foreach_esp_decrypt_next
  36 #undef _
  37     ESP_DECRYPT_N_NEXT,
  38 } esp_decrypt_next_t;
  39
  40
  41 #define foreach_esp_decrypt_error                   \
  42  _(RX_PKTS, "ESP pkts received")                    \
  43  _(NO_BUFFER, "No buffer (packed dropped)")         \
  44  _(DECRYPTION_FAILED, "ESP decryption failed")      \
  45  _(INTEG_ERROR, "Integrity check failed")           \
  46  _(REPLAY, "SA replayed packet")                    \
  47  _(NOT_IP, "Not IP packet (dropped)")
  48
  49
  50 typedef enum
  51 {
  52 #define _(sym,str) ESP_DECRYPT_ERROR_##sym,
  53   foreach_esp_decrypt_error
  54 #undef _
  55     ESP_DECRYPT_N_ERROR,
  56 } esp_decrypt_error_t;
  57
  58 static char *esp_decrypt_error_strings[] = {
  59 #define _(sym,string) string,
  60   foreach_esp_decrypt_error
  61 #undef _
  62 };
  63
  64 typedef struct
  65 {
  66   ipsec_crypto_alg_t crypto_alg;
  67   ipsec_integ_alg_t integ_alg;
  68 } esp_decrypt_trace_t;
  69
  70 /* packet trace format function */
  71 static u8 *
  72 format_esp_decrypt_trace (u8 * s, va_list * args)
  73 {
  74   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
  75   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
  76   esp_decrypt_trace_t *t = va_arg (*args, esp_decrypt_trace_t *);
  77
  78   s = format (s, "esp: crypto %U integrity %U",
  79               format_ipsec_crypto_alg, t->crypto_alg,
  80               format_ipsec_integ_alg, t->integ_alg);
  81   return s;
  82 }
  83
  84 always_inline void
  85 esp_decrypt_aes_cbc (ipsec_crypto_alg_t alg,
  86                      u8 * in, u8 * out, size_t in_len, u8 * key, u8 * iv)
  87 {
  88   esp_main_t *em = &esp_main;
  89   u32 cpu_index = os_get_cpu_number ();
  90   EVP_CIPHER_CTX *ctx = &(em->per_thread_data[cpu_index].decrypt_ctx);
  91   const EVP_CIPHER *cipher = NULL;
  92   int out_len;
  93
  94   ASSERT (alg < IPSEC_CRYPTO_N_ALG);
  95
  96   if (PREDICT_FALSE (em->esp_crypto_algs[alg].type == 0))
  97     return;
  98
  99   if (PREDICT_FALSE (alg != em->per_thread_data[cpu_index].last_decrypt_alg))
 100     {
 101       cipher = em->esp_crypto_algs[alg].type;
 102       em->per_thread_data[cpu_index].last_decrypt_alg = alg;
 103     }
 104
 105   EVP_DecryptInit_ex (ctx, cipher, NULL, key, iv);
 106
 107   EVP_DecryptUpdate (ctx, out, &out_len, in, in_len);
 108   EVP_DecryptFinal_ex (ctx, out + out_len, &out_len);
 109 }
 110
 111 always_inline int
 112 esp_replay_check (ipsec_sa_t * sa, u32 seq)
 113 {
 114   u32 diff;
 115
 116   if (PREDICT_TRUE (seq > sa->last_seq))
 117     return 0;
 118
 119   diff = sa->last_seq - seq;
 120
 121   if (ESP_WINDOW_SIZE > diff)
 122     return (sa->replay_window & (1ULL << diff)) ? 1 : 0;
 123   else
 124     return 1;
 125
 126   return 0;
 127 }
 128
 129 always_inline int
 130 esp_replay_check_esn (ipsec_sa_t * sa, u32 seq)
 131 {
 132   u32 tl = sa->last_seq;
 133   u32 th = sa->last_seq_hi;
 134   u32 diff = tl - seq;
 135
 136   if (PREDICT_TRUE (tl >= (ESP_WINDOW_SIZE - 1)))
 137     {
 138       if (seq >= (tl - ESP_WINDOW_SIZE + 1))
 139         {
 140           sa->seq_hi = th;
 141           if (seq <= tl)
 142             return (sa->replay_window & (1ULL << diff)) ? 1 : 0;
 143           else
 144             return 0;
 145         }
 146       else
 147         {
 148           sa->seq_hi = th + 1;
 149           return 0;
 150         }
 151     }
 152   else
 153     {
 154       if (seq >= (tl - ESP_WINDOW_SIZE + 1))
 155         {
 156           sa->seq_hi = th - 1;
 157           return (sa->replay_window & (1ULL << diff)) ? 1 : 0;
 158         }
 159       else
 160         {
 161           sa->seq_hi = th;
 162           if (seq <= tl)
 163             return (sa->replay_window & (1ULL << diff)) ? 1 : 0;
 164           else
 165             return 0;
 166         }
 167     }
 168
 169   return 0;
 170 }
 171
 172 always_inline void
 173 esp_replay_advance (ipsec_sa_t * sa, u32 seq)
 174 {
 175   u32 pos;
 176
 177   if (seq > sa->last_seq)
 178     {
 179       pos = seq - sa->last_seq;
 180       if (pos < ESP_WINDOW_SIZE)
 181         sa->replay_window = ((sa->replay_window) << pos) | 1;
 182       else
 183         sa->replay_window = 1;
 184       sa->last_seq = seq;
 185     }
 186   else
 187     {
 188       pos = sa->last_seq - seq;
 189       sa->replay_window |= (1ULL << pos);
 190     }
 191 }
 192
 193 always_inline void
 194 esp_replay_advance_esn (ipsec_sa_t * sa, u32 seq)
 195 {
 196   int wrap = sa->seq_hi - sa->last_seq_hi;
 197   u32 pos;
 198
 199   if (wrap == 0 && seq > sa->last_seq)
 200     {
 201       pos = seq - sa->last_seq;
 202       if (pos < ESP_WINDOW_SIZE)
 203         sa->replay_window = ((sa->replay_window) << pos) | 1;
 204       else
 205         sa->replay_window = 1;
 206       sa->last_seq = seq;
 207     }
 208   else if (wrap > 0)
 209     {
 210       pos = ~seq + sa->last_seq + 1;
 211       if (pos < ESP_WINDOW_SIZE)
 212         sa->replay_window = ((sa->replay_window) << pos) | 1;
 213       else
 214         sa->replay_window = 1;
 215       sa->last_seq = seq;
 216       sa->last_seq_hi = sa->seq_hi;
 217     }
 218   else if (wrap < 0)
 219     {
 220       pos = ~seq + sa->last_seq + 1;
 221       sa->replay_window |= (1ULL << pos);
 222     }
 223   else
 224     {
 225       pos = sa->last_seq - seq;
 226       sa->replay_window |= (1ULL << pos);
 227     }
 228 }
 229
 230 static uword
 231 esp_decrypt_node_fn (vlib_main_t * vm,
 232                      vlib_node_runtime_t * node, vlib_frame_t * from_frame)
 233 {
 234   u32 n_left_from, *from, next_index, *to_next;
 235   ipsec_main_t *im = &ipsec_main;
 236   esp_main_t *em = &esp_main;
 237   u32 *recycle = 0;
 238   from = vlib_frame_vector_args (from_frame);
 239   n_left_from = from_frame->n_vectors;
 240   u32 cpu_index = os_get_cpu_number ();
 241
 242   ipsec_alloc_empty_buffers (vm, im);
 243
 244   u32 *empty_buffers = im->empty_buffers[cpu_index];
 245
 246   if (PREDICT_FALSE (vec_len (empty_buffers) < n_left_from))
 247     {
 248       vlib_node_increment_counter (vm, esp_decrypt_node.index,
 249                                    ESP_DECRYPT_ERROR_NO_BUFFER, n_left_from);
 250       goto free_buffers_and_exit;
 251     }
 252
 253   next_index = node->cached_next_index;
 254
 255   while (n_left_from > 0)
 256     {
 257       u32 n_left_to_next;
 258
 259       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 260
 261       while (n_left_from > 0 && n_left_to_next > 0)
 262         {
 263           u32 i_bi0, o_bi0 = (u32) ~ 0, next0;
 264           vlib_buffer_t *i_b0;
 265           vlib_buffer_t *o_b0 = 0;
 266           esp_header_t *esp0;
 267           ipsec_sa_t *sa0;
 268           u32 sa_index0 = ~0;
 269           u32 seq;
 270           ip4_header_t *ih4 = 0, *oh4 = 0;
 271           ip6_header_t *ih6 = 0, *oh6 = 0;
 272           u8 tunnel_mode = 1;
 273           u8 transport_ip6 = 0;
 274
 275
 276           i_bi0 = from[0];
 277           from += 1;
 278           n_left_from -= 1;
 279           n_left_to_next -= 1;
 280
 281           next0 = ESP_DECRYPT_NEXT_DROP;
 282
 283           i_b0 = vlib_get_buffer (vm, i_bi0);
 284           esp0 = vlib_buffer_get_current (i_b0);
 285
 286           sa_index0 = vnet_buffer (i_b0)->output_features.ipsec_sad_index;
 287           sa0 = pool_elt_at_index (im->sad, sa_index0);
 288
 289           seq = clib_host_to_net_u32 (esp0->seq);
 290
 291           /* anti-replay check */
 292           if (sa0->use_anti_replay)
 293             {
 294               int rv = 0;
 295
 296               if (PREDICT_TRUE (sa0->use_esn))
 297                 rv = esp_replay_check_esn (sa0, seq);
 298               else
 299                 rv = esp_replay_check (sa0, seq);
 300
 301               if (PREDICT_FALSE (rv))
 302                 {
 303                   clib_warning ("anti-replay SPI %u seq %u", sa0->spi, seq);
 304                   vlib_node_increment_counter (vm, esp_decrypt_node.index,
 305                                                ESP_DECRYPT_ERROR_REPLAY, 1);
 306                   o_bi0 = i_bi0;
 307                   goto trace;
 308                 }
 309             }
 310
 311           if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE))
 312             {
 313               u8 sig[64];
 314               int icv_size = em->esp_integ_algs[sa0->integ_alg].trunc_size;
 315               memset (sig, 0, sizeof (sig));
 316               u8 *icv =
 317                 vlib_buffer_get_current (i_b0) + i_b0->current_length -
 318                 icv_size;
 319               i_b0->current_length -= icv_size;
 320
 321               hmac_calc (sa0->integ_alg, sa0->integ_key, sa0->integ_key_len,
 322                          (u8 *) esp0, i_b0->current_length, sig, sa0->use_esn,
 323                          sa0->seq_hi);
 324
 325               if (PREDICT_FALSE (memcmp (icv, sig, icv_size)))
 326                 {
 327                   vlib_node_increment_counter (vm, esp_decrypt_node.index,
 328                                                ESP_DECRYPT_ERROR_INTEG_ERROR,
 329                                                1);
 330                   o_bi0 = i_bi0;
 331                   goto trace;
 332                 }
 333             }
 334
 335           if (PREDICT_TRUE (sa0->use_anti_replay))
 336             {
 337               if (PREDICT_TRUE (sa0->use_esn))
 338                 esp_replay_advance_esn (sa0, seq);
 339               else
 340                 esp_replay_advance (sa0, seq);
 341             }
 342
 343           /* grab free buffer */
 344           uword last_empty_buffer = vec_len (empty_buffers) - 1;
 345           o_bi0 = empty_buffers[last_empty_buffer];
 346           o_b0 = vlib_get_buffer (vm, o_bi0);
 347           vlib_prefetch_buffer_with_index (vm,
 348                                            empty_buffers[last_empty_buffer -
 349                                                          1], STORE);
 350           _vec_len (empty_buffers) = last_empty_buffer;
 351
 352           /* add old buffer to the recycle list */
 353           vec_add1 (recycle, i_bi0);
 354
 355           if (sa0->crypto_alg >= IPSEC_CRYPTO_ALG_AES_CBC_128 &&
 356               sa0->crypto_alg <= IPSEC_CRYPTO_ALG_AES_CBC_256)
 357             {
 358               const int BLOCK_SIZE = 16;
 359               const int IV_SIZE = 16;
 360               esp_footer_t *f0;
 361               u8 ip_hdr_size = 0;
 362
 363               int blocks =
 364                 (i_b0->current_length - sizeof (esp_header_t) -
 365                  IV_SIZE) / BLOCK_SIZE;
 366
 367               o_b0->current_data = sizeof (ethernet_header_t);
 368
 369               /* transport mode */
 370               if (PREDICT_FALSE (!sa0->is_tunnel && !sa0->is_tunnel_ip6))
 371                 {
 372                   tunnel_mode = 0;
 373                   ih4 =
 374                     (ip4_header_t *) (i_b0->data +
 375                                       sizeof (ethernet_header_t));
 376                   if (PREDICT_TRUE
 377                       ((ih4->ip_version_and_header_length & 0xF0) != 0x40))
 378                     {
 379                       if (PREDICT_TRUE
 380                           ((ih4->ip_version_and_header_length & 0xF0) ==
 381                            0x60))
 382                         {
 383                           transport_ip6 = 1;
 384                           ip_hdr_size = sizeof (ip6_header_t);
 385                           ih6 =
 386                             (ip6_header_t *) (i_b0->data +
 387                                               sizeof (ethernet_header_t));
 388                           oh6 = vlib_buffer_get_current (o_b0);
 389                         }
 390                       else
 391                         {
 392                           vlib_node_increment_counter (vm,
 393                                                        esp_decrypt_node.index,
 394                                                        ESP_DECRYPT_ERROR_NOT_IP,
 395                                                        1);
 396                           o_b0 = 0;
 397                           goto trace;
 398                         }
 399                     }
 400                   else
 401                     {
 402                       oh4 = vlib_buffer_get_current (o_b0);
 403                       ip_hdr_size = sizeof (ip4_header_t);
 404                     }
 405                 }
 406
 407               esp_decrypt_aes_cbc (sa0->crypto_alg,
 408                                    esp0->data + IV_SIZE,
 409                                    (u8 *) vlib_buffer_get_current (o_b0) +
 410                                    ip_hdr_size, BLOCK_SIZE * blocks,
 411                                    sa0->crypto_key, esp0->data);
 412
 413               o_b0->current_length = (blocks * 16) - 2 + ip_hdr_size;
 414               o_b0->flags = VLIB_BUFFER_TOTAL_LENGTH_VALID;
 415               f0 =
 416                 (esp_footer_t *) ((u8 *) vlib_buffer_get_current (o_b0) +
 417                                   o_b0->current_length);
 418               o_b0->current_length -= f0->pad_length;
 419
 420               /* tunnel mode */
 421               if (PREDICT_TRUE (tunnel_mode))
 422                 {
 423                   if (PREDICT_TRUE (f0->next_header == IP_PROTOCOL_IP_IN_IP))
 424                     next0 = ESP_DECRYPT_NEXT_IP4_INPUT;
 425                   else if (f0->next_header == IP_PROTOCOL_IPV6)
 426                     next0 = ESP_DECRYPT_NEXT_IP6_INPUT;
 427                   else
 428                     {
 429                       clib_warning ("next header: 0x%x", f0->next_header);
 430                       vlib_node_increment_counter (vm, esp_decrypt_node.index,
 431                                                    ESP_DECRYPT_ERROR_DECRYPTION_FAILED,
 432                                                    1);
 433                       o_b0 = 0;
 434                       goto trace;
 435                     }
 436                 }
 437               /* transport mode */
 438               else
 439                 {
 440                   if (PREDICT_FALSE (transport_ip6))
 441                     {
 442                       next0 = ESP_DECRYPT_NEXT_IP6_INPUT;
 443                       oh6->ip_version_traffic_class_and_flow_label =
 444                         ih6->ip_version_traffic_class_and_flow_label;
 445                       oh6->protocol = f0->next_header;
 446                       oh6->hop_limit = ih6->hop_limit;
 447                       oh6->src_address.as_u64[0] = ih6->src_address.as_u64[0];
 448                       oh6->src_address.as_u64[1] = ih6->src_address.as_u64[1];
 449                       oh6->dst_address.as_u64[0] = ih6->dst_address.as_u64[0];
 450                       oh6->dst_address.as_u64[1] = ih6->dst_address.as_u64[1];
 451                       oh6->payload_length =
 452                         clib_host_to_net_u16 (vlib_buffer_length_in_chain
 453                                               (vm,
 454                                                o_b0) - sizeof (ip6_header_t));
 455                     }
 456                   else
 457                     {
 458                       next0 = ESP_DECRYPT_NEXT_IP4_INPUT;
 459                       oh4->ip_version_and_header_length = 0x45;
 460                       oh4->tos = ih4->tos;
 461                       oh4->fragment_id = 0;
 462                       oh4->flags_and_fragment_offset = 0;
 463                       oh4->ttl = ih4->ttl;
 464                       oh4->protocol = f0->next_header;
 465                       oh4->src_address.as_u32 = ih4->src_address.as_u32;
 466                       oh4->dst_address.as_u32 = ih4->dst_address.as_u32;
 467                       oh4->length =
 468                         clib_host_to_net_u16 (vlib_buffer_length_in_chain
 469                                               (vm, o_b0));
 470                       oh4->checksum = ip4_header_checksum (oh4);
 471                     }
 472                 }
 473
 474               to_next[0] = o_bi0;
 475               to_next += 1;
 476
 477               vnet_buffer (o_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
 478             }
 479
 480         trace:
 481           if (PREDICT_FALSE (i_b0->flags & VLIB_BUFFER_IS_TRACED))
 482             {
 483               if (o_b0)
 484                 {
 485                   o_b0->flags |= VLIB_BUFFER_IS_TRACED;
 486                   o_b0->trace_index = i_b0->trace_index;
 487                 }
 488               esp_decrypt_trace_t *tr =
 489                 vlib_add_trace (vm, node, o_b0, sizeof (*tr));
 490               tr->crypto_alg = sa0->crypto_alg;
 491               tr->integ_alg = sa0->integ_alg;
 492             }
 493
 494           vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
 495                                            n_left_to_next, o_bi0, next0);
 496         }
 497       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 498     }
 499   vlib_node_increment_counter (vm, esp_decrypt_node.index,
 500                                ESP_DECRYPT_ERROR_RX_PKTS,
 501                                from_frame->n_vectors);
 502
 503 free_buffers_and_exit:
 504   vlib_buffer_free (vm, recycle, vec_len (recycle));
 505   vec_free (recycle);
 506   return from_frame->n_vectors;
 507 }
 508
 509
 510 /* *INDENT-OFF* */
 511 VLIB_REGISTER_NODE (esp_decrypt_node) = {
 512   .function = esp_decrypt_node_fn,
 513   .name = "esp-decrypt",
 514   .vector_size = sizeof (u32),
 515   .format_trace = format_esp_decrypt_trace,
 516   .type = VLIB_NODE_TYPE_INTERNAL,
 517
 518   .n_errors = ARRAY_LEN(esp_decrypt_error_strings),
 519   .error_strings = esp_decrypt_error_strings,
 520
 521   .n_next_nodes = ESP_DECRYPT_N_NEXT,
 522   .next_nodes = {
 523 #define _(s,n) [ESP_DECRYPT_NEXT_##s] = n,
 524     foreach_esp_decrypt_next
 525 #undef _
 526   },
 527 };
 528 /* *INDENT-ON* */
 529
 530 VLIB_NODE_FUNCTION_MULTIARCH (esp_decrypt_node, esp_decrypt_node_fn)
 531 /*
 532  * fd.io coding-style-patch-verification: ON
 533  *
 534  * Local Variables:
 535  * eval: (c-set-style "gnu")
 536  * End:
 537  */