ipsec: add support for RFC-4543 ENCR_NULL_AUTH_AES_GMAC

[vpp.git] / src / vnet / ipsec / esp_decrypt.c

diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index 827d168..2c1efa2 100644 (file)
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -562,6 +562,12 @@ esp_decrypt_prepare_sync_op (vlib_main_t * vm, vlib_node_runtime_t * node,
              op->aad_len = esp_aad_fill (op->aad, esp0, sa0, pd->seq_hi);
              op->tag = payload + len;
              op->tag_len = 16;
+             if (PREDICT_FALSE (ipsec_sa_is_set_IS_NULL_GMAC (sa0)))
+               {
+                 /* RFC-4543 ENCR_NULL_AUTH_AES_GMAC: IV is part of AAD */
+                 payload -= iv_sz;
+                 len += iv_sz;
+               }
            }
          else
            {
@@ -682,6 +688,12 @@ out:
          aad = (u8 *) nonce - sizeof (esp_aead_t);
          esp_aad_fill (aad, esp0, sa0, pd->seq_hi);
          tag = payload + len;
+         if (PREDICT_FALSE (ipsec_sa_is_set_IS_NULL_GMAC (sa0)))
+           {
+             /* RFC-4543 ENCR_NULL_AUTH_AES_GMAC: IV is part of AAD */
+             payload -= iv_sz;
+             len += iv_sz;
+           }
        }
       else
        {
@@ -1183,6 +1195,15 @@ esp_decrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node,
            {
              async_frames[async_op] =
                vnet_crypto_async_get_frame (vm, async_op);
+             if (PREDICT_FALSE (!async_frames[async_op]))
+               {
+                 err = ESP_DECRYPT_ERROR_NO_AVAIL_FRAME;
+                 esp_decrypt_set_next_index (
+                   b[0], node, thread_index, err, n_noop, noop_nexts,
+                   ESP_DECRYPT_NEXT_DROP, current_sa_index);
+                 goto next;
+               }
+
              /* Save the frame to the list we'll submit at the end */
              vec_add1 (ptd->async_frames, async_frames[async_op]);
            }
@@ -1246,7 +1267,7 @@ esp_decrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node,
          n_noop += esp_async_recycle_failed_submit (
            vm, *async_frame, node, ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR,
            IPSEC_SA_ERROR_CRYPTO_ENGINE_ERROR, n_noop, noop_bi, noop_nexts,
-           ESP_DECRYPT_NEXT_DROP);
+           ESP_DECRYPT_NEXT_DROP, false);
          vnet_crypto_async_reset_frame (*async_frame);
          vnet_crypto_async_free_frame (vm, *async_frame);
        }