static_always_inline void
esp_update_ip4_hdr (ip4_header_t * ip4, u16 len, int is_transport, int is_udp)
{
- ip_csum_t sum = ip4->checksum;
- u16 old_len = 0;
+ ip_csum_t sum;
+ u16 old_len;
+
+ len = clib_net_to_host_u16 (len);
+ old_len = ip4->length;
if (is_transport)
{
u8 prot = is_udp ? IP_PROTOCOL_UDP : IP_PROTOCOL_IPSEC_ESP;
- old_len = ip4->length;
- sum = ip_csum_update (sum, ip4->protocol, prot, ip4_header_t, protocol);
+
+ sum = ip_csum_update (ip4->checksum, ip4->protocol,
+ prot, ip4_header_t, protocol);
ip4->protocol = prot;
+
+ sum = ip_csum_update (sum, old_len, len, ip4_header_t, length);
}
+ else
+ sum = ip_csum_update (ip4->checksum, old_len, len, ip4_header_t, length);
- ip4->length = len = clib_net_to_host_u16 (len);
- sum = ip_csum_update (ip4->checksum, old_len, len, ip4_header_t, length);
+ ip4->length = len;
ip4->checksum = ip_csum_fold (sum);
}
}
}
+typedef struct
+{
+ u32 salt;
+ u64 iv;
+} __clib_packed esp_gcm_nonce_t;
+
+STATIC_ASSERT_SIZEOF (esp_gcm_nonce_t, 12);
+
always_inline uword
esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
vlib_frame_t * frame, int is_ip6, int is_tun)
u32 n_left = frame->n_vectors;
vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
+ esp_gcm_nonce_t nonces[VLIB_FRAME_SIZE], *nonce = nonces;
u32 thread_index = vm->thread_index;
u16 buffer_data_size = vlib_buffer_get_default_data_size (vm);
u32 current_sa_index = ~0, current_sa_packets = 0;
while (n_left > 0)
{
- u32 sa_index0 = vnet_buffer (b[0])->ipsec.sad_index;
+ u32 sa_index0;
dpo_id_t *dpo;
esp_header_t *esp;
u8 *payload, *next_hdr_ptr;
if (sa_index0 != current_sa_index)
{
+ if (current_sa_packets)
+ vlib_increment_combined_counter (&ipsec_sa_counters, thread_index,
+ current_sa_index,
+ current_sa_packets,
+ current_sa_bytes);
+ current_sa_packets = current_sa_bytes = 0;
+
sa0 = pool_elt_at_index (im->sad, sa_index0);
current_sa_index = sa_index0;
- vlib_increment_combined_counter (&ipsec_sa_counters, thread_index,
- sa_index0, current_sa_packets,
- current_sa_bytes);
- current_sa_packets = current_sa_bytes = 0;
spi = clib_net_to_host_u32 (sa0->spi);
block_sz = sa0->crypto_block_size;
- icv_sz = sa0->integ_trunc_size;
+ icv_sz = sa0->integ_icv_size;
iv_sz = sa0->crypto_iv_size;
}
esp_update_ip4_hdr (ip4, len, /* is_transport */ 0, 0);
}
- dpo = sa0->dpo + IPSEC_PROTOCOL_ESP;
+ dpo = &sa0->dpo;
if (!is_tun)
{
next[0] = dpo->dpoi_next_node;
ip_hdr = payload - hdr_len;
/* L2 header */
- l2_len = vnet_buffer (b[0])->ip.save_rewrite_length;
- hdr_len += l2_len;
- l2_hdr = payload - hdr_len;
+ if (!is_tun)
+ {
+ l2_len = vnet_buffer (b[0])->ip.save_rewrite_length;
+ hdr_len += l2_len;
+ l2_hdr = payload - hdr_len;
+
+ /* copy l2 and ip header */
+ clib_memcpy_le32 (l2_hdr, old_ip_hdr - l2_len, l2_len);
+ }
+ else
+ l2_len = 0;
- /* copy l2 and ip header */
- clib_memcpy_le32 (l2_hdr, old_ip_hdr - l2_len, l2_len);
clib_memcpy_le64 (ip_hdr, old_ip_hdr, ip_len);
if (is_ip6)
ip6_header_t *ip6 = (ip6_header_t *) (ip_hdr);
*next_hdr_ptr = ip6->protocol;
ip6->protocol = IP_PROTOCOL_IPSEC_ESP;
- ip6->payload_length = payload_len + hdr_len - l2_len - ip_len;
+ ip6->payload_length =
+ clib_host_to_net_u16 (payload_len + hdr_len - l2_len -
+ ip_len);
}
else
{
u16 len;
ip4_header_t *ip4 = (ip4_header_t *) (ip_hdr);
*next_hdr_ptr = ip4->protocol;
- len = payload_len + hdr_len + l2_len;
+ len = payload_len + hdr_len - l2_len;
if (udp)
{
esp_update_ip4_hdr (ip4, len, /* is_transport */ 1, 1);
esp_update_ip4_hdr (ip4, len, /* is_transport */ 1, 0);
}
- next[0] = ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT;
+ if (!is_tun)
+ next[0] = ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT;
}
esp->spi = spi;
esp->seq = clib_net_to_host_u32 (sa0->seq);
- if (sa0->crypto_enc_op_type)
+ if (sa0->crypto_enc_op_id)
{
vnet_crypto_op_t *op;
vec_add2_aligned (ptd->crypto_ops, op, 1, CLIB_CACHE_LINE_BYTES);
- vnet_crypto_op_init (op, sa0->crypto_enc_op_type);
- op->iv = payload - iv_sz;
+ vnet_crypto_op_init (op, sa0->crypto_enc_op_id);
op->src = op->dst = payload;
- op->key = sa0->crypto_key.data;
+ op->key_index = sa0->crypto_key_index;
op->len = payload_len - icv_sz;
- op->flags = VNET_CRYPTO_OP_FLAG_INIT_IV;
op->user_data = b - bufs;
+
+ if (ipsec_sa_is_set_IS_AEAD (sa0))
+ {
+ /*
+ * construct the AAD in a scratch space in front
+ * of the IP header.
+ */
+ op->aad = payload - hdr_len - sizeof (esp_aead_t);
+
+ esp_aad_fill (op, esp, sa0);
+
+ op->tag = payload + op->len;
+ op->tag_len = 16;
+
+ u64 *iv = (u64 *) (payload - iv_sz);
+ nonce->salt = sa0->salt;
+ nonce->iv = *iv = clib_host_to_net_u64 (sa0->gcm_iv_counter++);
+ op->iv = (u8 *) nonce;
+ nonce++;
+ }
+ else
+ {
+ op->iv = payload - iv_sz;
+ op->flags = VNET_CRYPTO_OP_FLAG_INIT_IV;
+ }
}
- if (sa0->integ_op_type)
+ if (sa0->integ_op_id)
{
vnet_crypto_op_t *op;
vec_add2_aligned (ptd->integ_ops, op, 1, CLIB_CACHE_LINE_BYTES);
- vnet_crypto_op_init (op, sa0->integ_op_type);
+ vnet_crypto_op_init (op, sa0->integ_op_id);
op->src = payload - iv_sz - sizeof (esp_header_t);
- op->dst = payload + payload_len - icv_sz;
- op->key = sa0->integ_key.data;
- op->key_len = sa0->integ_key.len;
- op->hmac_trunc_len = icv_sz;
+ op->digest = payload + payload_len - icv_sz;
+ op->key_index = sa0->integ_key_index;
+ op->digest_len = icv_sz;
op->len = payload_len - icv_sz + iv_sz + sizeof (esp_header_t);
op->user_data = b - bufs;
if (ipsec_sa_is_set_USE_ESN (sa0))
{
u32 seq_hi = clib_net_to_host_u32 (sa0->seq_hi);
- clib_memcpy_fast (op->dst, &seq_hi, sizeof (seq_hi));
+ clib_memcpy_fast (op->digest, &seq_hi, sizeof (seq_hi));
op->len += sizeof (seq_hi);
}
}
vlib_increment_combined_counter (&ipsec_sa_counters, thread_index,
current_sa_index, current_sa_packets,
current_sa_bytes);
-
esp_process_ops (vm, node, ptd->crypto_ops, bufs, nexts);
esp_process_ops (vm, node, ptd->integ_ops, bufs, nexts);
.n_errors = ARRAY_LEN(esp_encrypt_error_strings),
.error_strings = esp_encrypt_error_strings,
+
+ .n_next_nodes = 1,
+ .next_nodes = {
+ [ESP_ENCRYPT_NEXT_DROP] = "ip4-drop",
+ },
};
VNET_FEATURE_INIT (esp4_encrypt_tun_feat_node, static) =
{
.arc_name = "ip4-output",
.node_name = "esp4-encrypt-tun",
- .runs_before = VNET_FEATURES ("ip4-frag",
- "adj-midchain-tx"),
+ .runs_before = VNET_FEATURES ("adj-midchain-tx"),
+};
+
+VNET_FEATURE_INIT (esp4_ethernet_encrypt_tun_feat_node, static) =
+{
+ .arc_name = "ethernet-output",
+ .node_name = "esp4-encrypt-tun",
+ .runs_before = VNET_FEATURES ("adj-midchain-tx", "adj-midchain-tx-no-count"),
};
/* *INDENT-ON* */
.n_errors = ARRAY_LEN(esp_encrypt_error_strings),
.error_strings = esp_encrypt_error_strings,
+
+ .n_next_nodes = 1,
+ .next_nodes = {
+ [ESP_ENCRYPT_NEXT_DROP] = "ip6-drop",
+ },
};
VNET_FEATURE_INIT (esp6_encrypt_tun_feat_node, static) =
{
.arc_name = "ip6-output",
.node_name = "esp6-encrypt-tun",
- .runs_before = VNET_FEATURES ("ip6-frag",
- "adj-midchain-tx"),
+ .runs_before = VNET_FEATURES ("adj-midchain-tx"),
};
/* *INDENT-ON* */
Code Review / vpp.git / blobdiff