X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fesp_encrypt.c;h=dd47053874caef13dcd70be1871ec43a03c3ce37;hb=2f4586d9b3507243918c11ce99b9d151d5bde7a0;hp=88e93b9b2d455411d4203c4e2c2254b6fd6a6455;hpb=ad95b06181c354291f4433c5e550cb89c5122252;p=vpp.git diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c index 88e93b9b2d4..dd47053874c 100644 --- a/src/vnet/ipsec/esp_encrypt.c +++ b/src/vnet/ipsec/esp_encrypt.c @@ -18,6 +18,7 @@ #include #include #include +#include #include @@ -94,8 +95,7 @@ format_esp_post_encrypt_trace (u8 * s, va_list * args) /* pad packet in input buffer */ static_always_inline u8 * esp_add_footer_and_icv (vlib_main_t *vm, vlib_buffer_t **last, u8 esp_align, - u8 icv_sz, vlib_node_runtime_t *node, - u16 buffer_data_size, uword total_len) + u8 icv_sz, u16 buffer_data_size, uword total_len) { static const u8 pad_data[ESP_MAX_BLOCK_SIZE] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, @@ -149,11 +149,9 @@ esp_update_ip4_hdr (ip4_header_t * ip4, u16 len, int is_transport, int is_udp) if (is_transport) { u8 prot = is_udp ? IP_PROTOCOL_UDP : IP_PROTOCOL_IPSEC_ESP; - - sum = ip_csum_update (ip4->checksum, ip4->protocol, - prot, ip4_header_t, protocol); + sum = ip_csum_update (ip4->checksum, ip4->protocol, prot, ip4_header_t, + protocol); ip4->protocol = prot; - sum = ip_csum_update (sum, old_len, len, ip4_header_t, length); } else @@ -182,9 +180,9 @@ ext_hdr_is_pre_esp (u8 nexthdr) return !u8x16_is_all_zero (ext_hdr_types == u8x16_splat (nexthdr)); #else - return ((nexthdr ^ IP_PROTOCOL_IP6_HOP_BY_HOP_OPTIONS) | - (nexthdr ^ IP_PROTOCOL_IPV6_ROUTE) | - ((nexthdr ^ IP_PROTOCOL_IPV6_FRAGMENTATION) != 0)); + return (!(nexthdr ^ IP_PROTOCOL_IP6_HOP_BY_HOP_OPTIONS) || + !(nexthdr ^ IP_PROTOCOL_IPV6_ROUTE) || + !(nexthdr ^ IP_PROTOCOL_IPV6_FRAGMENTATION)); #endif } @@ -219,17 +217,18 @@ esp_get_ip6_hdr_len (ip6_header_t * ip6, ip6_ext_header_t ** ext_hdr) * encryption mode: IVs must be unpredictable for AES-CBC whereas it can * be predictable but should never be reused with the same key material * for CTR and GCM. - * We use a packet counter as the IV for CTR and GCM, and to ensure the - * IV is unpredictable for CBC, it is then encrypted using the same key - * as the message. You can refer to NIST SP800-38a and NIST SP800-38d - * for more details. */ + * To avoid reusing the same IVs between multiple VPP instances and between + * restarts, we use a properly chosen PRNG to generate IVs. To ensure the IV is + * unpredictable for CBC, it is then encrypted using the same key as the + * message. You can refer to NIST SP800-38a and NIST SP800-38d for more + * details. */ static_always_inline void * esp_generate_iv (ipsec_sa_t *sa, void *payload, int iv_sz) { ASSERT (iv_sz >= sizeof (u64)); u64 *iv = (u64 *) (payload - iv_sz); clib_memset_u8 (iv, 0, iv_sz); - *iv = sa->iv_counter++; + *iv = clib_pcg64i_random_r (&sa->iv_prng); return iv; } @@ -414,6 +413,12 @@ esp_prepare_sync_op (vlib_main_t *vm, ipsec_per_thread_data_t *ptd, op->aad_len = esp_aad_fill (op->aad, esp, sa0, seq_hi); op->tag = payload + crypto_len; op->tag_len = 16; + if (PREDICT_FALSE (ipsec_sa_is_set_IS_NULL_GMAC (sa0))) + { + /* RFC-4543 ENCR_NULL_AUTH_AES_GMAC: IV is part of AAD */ + crypto_start -= iv_sz; + crypto_len += iv_sz; + } } else { @@ -434,7 +439,7 @@ esp_prepare_sync_op (vlib_main_t *vm, ipsec_per_thread_data_t *ptd, crypto_len += iv_sz; } - if (lb != b[0]) + if (PREDICT_FALSE (lb != b[0])) { /* is chained */ op->flags |= VNET_CRYPTO_OP_FLAG_CHAINED_BUFFERS; @@ -497,7 +502,7 @@ esp_prepare_async_frame (vlib_main_t *vm, ipsec_per_thread_data_t *ptd, esp_post_data_t *post = esp_post_data (b); u8 *tag, *iv, *aad = 0; u8 flag = 0; - u32 key_index; + const u32 key_index = sa->crypto_key_index; i16 crypto_start_offset, integ_start_offset; u16 crypto_total_len, integ_total_len; @@ -508,8 +513,6 @@ esp_prepare_async_frame (vlib_main_t *vm, ipsec_per_thread_data_t *ptd, crypto_total_len = integ_total_len = payload_len - icv_sz; tag = payload + crypto_total_len; - key_index = sa->linked_key_index; - /* generate the IV in front of the payload */ void *pkt_iv = esp_generate_iv (sa, payload, iv_sz); @@ -523,7 +526,12 @@ esp_prepare_async_frame (vlib_main_t *vm, ipsec_per_thread_data_t *ptd, /* constuct aad in a scratch space in front of the nonce */ aad = (u8 *) nonce - sizeof (esp_aead_t); esp_aad_fill (aad, esp, sa, sa->seq_hi); - key_index = sa->crypto_key_index; + if (PREDICT_FALSE (ipsec_sa_is_set_IS_NULL_GMAC (sa))) + { + /* RFC-4543 ENCR_NULL_AUTH_AES_GMAC: IV is part of AAD */ + crypto_start_offset -= iv_sz; + crypto_total_len += iv_sz; + } } else { @@ -597,6 +605,7 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, u32 current_sa_bytes = 0, spi = 0; u8 esp_align = 4, iv_sz = 0, icv_sz = 0; ipsec_sa_t *sa0 = 0; + u8 sa_drop_no_crypto = 0; vlib_buffer_t *lb; vnet_crypto_op_t **crypto_ops = &ptd->crypto_ops; vnet_crypto_op_t **integ_ops = &ptd->integ_ops; @@ -653,6 +662,10 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, CLIB_CACHE_LINE_BYTES, LOAD); } + vnet_calc_checksums_inline (vm, b[0], b[0]->flags & VNET_BUFFER_F_IS_IP4, + b[0]->flags & VNET_BUFFER_F_IS_IP6); + vnet_calc_outer_checksums_inline (vm, b[0]); + if (is_tun) { /* we are on a ipsec tunnel's feature arc */ @@ -680,18 +693,12 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, current_sa_packets = current_sa_bytes = 0; sa0 = ipsec_sa_get (sa_index0); - - if (PREDICT_FALSE ((sa0->crypto_alg == IPSEC_CRYPTO_ALG_NONE && - sa0->integ_alg == IPSEC_INTEG_ALG_NONE) && - !ipsec_sa_is_set_NO_ALGO_NO_DROP (sa0))) - { - err = ESP_ENCRYPT_ERROR_NO_ENCRYPTION; - esp_encrypt_set_next_index (b[0], node, thread_index, err, - n_noop, noop_nexts, drop_next, - sa_index0); - goto trace; - } current_sa_index = sa_index0; + + sa_drop_no_crypto = ((sa0->crypto_alg == IPSEC_CRYPTO_ALG_NONE && + sa0->integ_alg == IPSEC_INTEG_ALG_NONE) && + !ipsec_sa_is_set_NO_ALGO_NO_DROP (sa0)); + vlib_prefetch_combined_counter (&ipsec_sa_counters, thread_index, current_sa_index); @@ -705,7 +712,15 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, is_async = im->async_mode | ipsec_sa_is_set_IS_ASYNC (sa0); } - if (PREDICT_FALSE (~0 == sa0->thread_index)) + if (PREDICT_FALSE (sa_drop_no_crypto != 0)) + { + err = ESP_ENCRYPT_ERROR_NO_ENCRYPTION; + esp_encrypt_set_next_index (b[0], node, thread_index, err, n_noop, + noop_nexts, drop_next, sa_index0); + goto trace; + } + + if (PREDICT_FALSE ((u16) ~0 == sa0->thread_index)) { /* this is the first packet to use this SA, claim the SA * for this thread. this could happen simultaneously on @@ -756,7 +771,7 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, { payload = vlib_buffer_get_current (b[0]); next_hdr_ptr = esp_add_footer_and_icv ( - vm, &lb, esp_align, icv_sz, node, buffer_data_size, + vm, &lb, esp_align, icv_sz, buffer_data_size, vlib_buffer_length_in_chain (vm, b[0])); if (!next_hdr_ptr) { @@ -893,7 +908,7 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_buffer_advance (b[0], ip_len); payload = vlib_buffer_get_current (b[0]); next_hdr_ptr = esp_add_footer_and_icv ( - vm, &lb, esp_align, icv_sz, node, buffer_data_size, + vm, &lb, esp_align, icv_sz, buffer_data_size, vlib_buffer_length_in_chain (vm, b[0])); if (!next_hdr_ptr) { @@ -1001,6 +1016,16 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, { async_frames[async_op] = vnet_crypto_async_get_frame (vm, async_op); + + if (PREDICT_FALSE (!async_frames[async_op])) + { + err = ESP_ENCRYPT_ERROR_NO_AVAIL_FRAME; + esp_encrypt_set_next_index (b[0], node, thread_index, err, + n_noop, noop_nexts, drop_next, + current_sa_index); + goto trace; + } + /* Save the frame to the list we'll submit at the end */ vec_add1 (ptd->async_frames, async_frames[async_op]); } @@ -1090,7 +1115,7 @@ esp_encrypt_inline (vlib_main_t *vm, vlib_node_runtime_t *node, n_noop += esp_async_recycle_failed_submit ( vm, *async_frame, node, ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR, IPSEC_SA_ERROR_CRYPTO_ENGINE_ERROR, n_noop, noop_bi, - noop_nexts, drop_next); + noop_nexts, drop_next, true); vnet_crypto_async_reset_frame (*async_frame); vnet_crypto_async_free_frame (vm, *async_frame); } @@ -1199,7 +1224,6 @@ VLIB_NODE_FN (esp4_encrypt_node) (vlib_main_t * vm, esp_encrypt_async_next.esp4_post_next); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (esp4_encrypt_node) = { .name = "esp4-encrypt", .vector_size = sizeof (u32), @@ -1218,7 +1242,6 @@ VLIB_REGISTER_NODE (esp4_encrypt_node) = { [ESP_ENCRYPT_NEXT_HANDOFF_MPLS] = "error-drop", [ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "interface-output" }, }; -/* *INDENT-ON* */ VLIB_NODE_FN (esp4_encrypt_post_node) (vlib_main_t * vm, vlib_node_runtime_t * node, @@ -1227,7 +1250,6 @@ VLIB_NODE_FN (esp4_encrypt_post_node) (vlib_main_t * vm, return esp_encrypt_post_inline (vm, node, from_frame); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (esp4_encrypt_post_node) = { .name = "esp4-encrypt-post", .vector_size = sizeof (u32), @@ -1238,7 +1260,6 @@ VLIB_REGISTER_NODE (esp4_encrypt_post_node) = { .n_errors = ESP_ENCRYPT_N_ERROR, .error_counters = esp_encrypt_error_counters, }; -/* *INDENT-ON* */ VLIB_NODE_FN (esp6_encrypt_node) (vlib_main_t * vm, vlib_node_runtime_t * node, @@ -1248,7 +1269,6 @@ VLIB_NODE_FN (esp6_encrypt_node) (vlib_main_t * vm, esp_encrypt_async_next.esp6_post_next); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (esp6_encrypt_node) = { .name = "esp6-encrypt", .vector_size = sizeof (u32), @@ -1259,7 +1279,6 @@ VLIB_REGISTER_NODE (esp6_encrypt_node) = { .n_errors = ESP_ENCRYPT_N_ERROR, .error_counters = esp_encrypt_error_counters, }; -/* *INDENT-ON* */ VLIB_NODE_FN (esp6_encrypt_post_node) (vlib_main_t * vm, vlib_node_runtime_t * node, @@ -1268,7 +1287,6 @@ VLIB_NODE_FN (esp6_encrypt_post_node) (vlib_main_t * vm, return esp_encrypt_post_inline (vm, node, from_frame); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (esp6_encrypt_post_node) = { .name = "esp6-encrypt-post", .vector_size = sizeof (u32), @@ -1279,7 +1297,6 @@ VLIB_REGISTER_NODE (esp6_encrypt_post_node) = { .n_errors = ESP_ENCRYPT_N_ERROR, .error_counters = esp_encrypt_error_counters, }; -/* *INDENT-ON* */ VLIB_NODE_FN (esp4_encrypt_tun_node) (vlib_main_t * vm, vlib_node_runtime_t * node, @@ -1289,7 +1306,6 @@ VLIB_NODE_FN (esp4_encrypt_tun_node) (vlib_main_t * vm, esp_encrypt_async_next.esp4_tun_post_next); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (esp4_encrypt_tun_node) = { .name = "esp4-encrypt-tun", .vector_size = sizeof (u32), @@ -1318,7 +1334,6 @@ VLIB_NODE_FN (esp4_encrypt_tun_post_node) (vlib_main_t * vm, return esp_encrypt_post_inline (vm, node, from_frame); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (esp4_encrypt_tun_post_node) = { .name = "esp4-encrypt-tun-post", .vector_size = sizeof (u32), @@ -1329,7 +1344,6 @@ VLIB_REGISTER_NODE (esp4_encrypt_tun_post_node) = { .n_errors = ESP_ENCRYPT_N_ERROR, .error_counters = esp_encrypt_error_counters, }; -/* *INDENT-ON* */ VLIB_NODE_FN (esp6_encrypt_tun_node) (vlib_main_t * vm, vlib_node_runtime_t * node, @@ -1339,7 +1353,6 @@ VLIB_NODE_FN (esp6_encrypt_tun_node) (vlib_main_t * vm, esp_encrypt_async_next.esp6_tun_post_next); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (esp6_encrypt_tun_node) = { .name = "esp6-encrypt-tun", .vector_size = sizeof (u32), @@ -1361,7 +1374,6 @@ VLIB_REGISTER_NODE (esp6_encrypt_tun_node) = { }, }; -/* *INDENT-ON* */ VLIB_NODE_FN (esp6_encrypt_tun_post_node) (vlib_main_t * vm, vlib_node_runtime_t * node, @@ -1370,7 +1382,6 @@ VLIB_NODE_FN (esp6_encrypt_tun_post_node) (vlib_main_t * vm, return esp_encrypt_post_inline (vm, node, from_frame); } -/* *INDENT-OFF* */ VLIB_REGISTER_NODE (esp6_encrypt_tun_post_node) = { .name = "esp6-encrypt-tun-post", .vector_size = sizeof (u32), @@ -1381,7 +1392,6 @@ VLIB_REGISTER_NODE (esp6_encrypt_tun_post_node) = { .n_errors = ESP_ENCRYPT_N_ERROR, .error_counters = esp_encrypt_error_counters, }; -/* *INDENT-ON* */ VLIB_NODE_FN (esp_mpls_encrypt_tun_node) (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)