IPSEC-AH: fix packet drop
[vpp.git] / src / vnet / ipsec / ah_decrypt.c
1 /*
2  * ah_decrypt.c : IPSec AH decrypt node
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  *     http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21
22 #include <vnet/ipsec/ipsec.h>
23 #include <vnet/ipsec/esp.h>
24 #include <vnet/ipsec/ah.h>
25
26 #define foreach_ah_decrypt_next \
27   _ (DROP, "error-drop")        \
28   _ (IP4_INPUT, "ip4-input")    \
29   _ (IP6_INPUT, "ip6-input")    \
30   _ (IPSEC_GRE_INPUT, "ipsec-gre-input")
31
32 #define _(v, s) AH_DECRYPT_NEXT_##v,
33 typedef enum
34 {
35   foreach_ah_decrypt_next
36 #undef _
37     AH_DECRYPT_N_NEXT,
38 } ah_decrypt_next_t;
39
40 #define foreach_ah_decrypt_error                \
41   _ (RX_PKTS, "AH pkts received")               \
42   _ (DECRYPTION_FAILED, "AH decryption failed") \
43   _ (INTEG_ERROR, "Integrity check failed")     \
44   _ (REPLAY, "SA replayed packet")
45
46 typedef enum
47 {
48 #define _(sym,str) AH_DECRYPT_ERROR_##sym,
49   foreach_ah_decrypt_error
50 #undef _
51     AH_DECRYPT_N_ERROR,
52 } ah_decrypt_error_t;
53
54 static char *ah_decrypt_error_strings[] = {
55 #define _(sym,string) string,
56   foreach_ah_decrypt_error
57 #undef _
58 };
59
60 typedef struct
61 {
62   ipsec_integ_alg_t integ_alg;
63 } ah_decrypt_trace_t;
64
65 /* packet trace format function */
66 static u8 *
67 format_ah_decrypt_trace (u8 * s, va_list * args)
68 {
69   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
70   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
71   ah_decrypt_trace_t *t = va_arg (*args, ah_decrypt_trace_t *);
72
73   s = format (s, "ah: integrity %U", format_ipsec_integ_alg, t->integ_alg);
74   return s;
75 }
76
77 always_inline uword
78 ah_decrypt_inline (vlib_main_t * vm,
79                    vlib_node_runtime_t * node, vlib_frame_t * from_frame,
80                    int is_ip6)
81 {
82   u32 n_left_from, *from, next_index, *to_next;
83   ipsec_main_t *im = &ipsec_main;
84   ipsec_proto_main_t *em = &ipsec_proto_main;
85   from = vlib_frame_vector_args (from_frame);
86   n_left_from = from_frame->n_vectors;
87   int icv_size = 0;
88
89   next_index = node->cached_next_index;
90
91   while (n_left_from > 0)
92     {
93       u32 n_left_to_next;
94
95       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
96
97       while (n_left_from > 0 && n_left_to_next > 0)
98         {
99           u32 i_bi0;
100           u32 next0;
101           vlib_buffer_t *i_b0;
102           ah_header_t *ah0;
103           ipsec_sa_t *sa0;
104           u32 sa_index0 = ~0;
105           u32 seq;
106           ip4_header_t *ih4 = 0, *oh4 = 0;
107           ip6_header_t *ih6 = 0, *oh6 = 0;
108           u8 ip_hdr_size = 0;
109           u8 tos = 0;
110           u8 ttl = 0;
111           u32 ip_version_traffic_class_and_flow_label = 0;
112           u8 hop_limit = 0;
113           u8 nexthdr = 0;
114           u8 icv_padding_len = 0;
115
116
117           i_bi0 = from[0];
118           from += 1;
119           n_left_from -= 1;
120           n_left_to_next -= 1;
121
122           next0 = AH_DECRYPT_NEXT_DROP;
123
124           i_b0 = vlib_get_buffer (vm, i_bi0);
125           to_next[0] = i_bi0;
126           to_next += 1;
127           ih4 = vlib_buffer_get_current (i_b0);
128           ih6 = vlib_buffer_get_current (i_b0);
129           sa_index0 = vnet_buffer (i_b0)->ipsec.sad_index;
130           sa0 = pool_elt_at_index (im->sad, sa_index0);
131
132           if (is_ip6)
133             {
134               ip6_ext_header_t *prev = NULL;
135               ip6_ext_header_find_t (ih6, prev, ah0, IP_PROTOCOL_IPSEC_AH);
136               ip_hdr_size = sizeof (ip6_header_t);
137               ASSERT ((u8 *) ah0 - (u8 *) ih6 == ip_hdr_size);
138             }
139           else
140             {
141               ip_hdr_size = ip4_header_bytes (ih4);
142               ah0 = (ah_header_t *) ((u8 *) ih4 + ip_hdr_size);
143             }
144
145           seq = clib_host_to_net_u32 (ah0->seq_no);
146           /* anti-replay check */
147           //TODO UT remaining
148           if (sa0->use_anti_replay)
149             {
150               int rv = 0;
151
152               if (PREDICT_TRUE (sa0->use_esn))
153                 rv = esp_replay_check_esn (sa0, seq);
154               else
155                 rv = esp_replay_check (sa0, seq);
156
157               if (PREDICT_FALSE (rv))
158                 {
159                   if (is_ip6)
160                     vlib_node_increment_counter (vm,
161                                                  ah6_decrypt_node.index,
162                                                  AH_DECRYPT_ERROR_REPLAY, 1);
163                   else
164                     vlib_node_increment_counter (vm,
165                                                  ah4_decrypt_node.index,
166                                                  AH_DECRYPT_ERROR_REPLAY, 1);
167                   goto trace;
168                 }
169             }
170
171
172           sa0->total_data_size += i_b0->current_length;
173           icv_size =
174             em->ipsec_proto_main_integ_algs[sa0->integ_alg].trunc_size;
175           if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE))
176             {
177               u8 sig[64];
178               u8 digest[64];
179               clib_memset (sig, 0, sizeof (sig));
180               clib_memset (digest, 0, sizeof (digest));
181               u8 *icv = ah0->auth_data;
182               memcpy (digest, icv, icv_size);
183               clib_memset (icv, 0, icv_size);
184
185               if (is_ip6)
186                 {
187                   ip_version_traffic_class_and_flow_label =
188                     ih6->ip_version_traffic_class_and_flow_label;
189                   hop_limit = ih6->hop_limit;
190                   ih6->ip_version_traffic_class_and_flow_label = 0x60;
191                   ih6->hop_limit = 0;
192                   nexthdr = ah0->nexthdr;
193                   icv_padding_len =
194                     ah_calc_icv_padding_len (icv_size, 1 /* is_ipv6 */ );
195                 }
196               else
197                 {
198                   tos = ih4->tos;
199                   ttl = ih4->ttl;
200                   ih4->tos = 0;
201                   ih4->ttl = 0;
202                   ih4->checksum = 0;
203                   ih4->flags_and_fragment_offset = 0;
204                   icv_padding_len =
205                     ah_calc_icv_padding_len (icv_size, 0 /* is_ipv6 */ );
206                 }
207               hmac_calc (sa0->integ_alg, sa0->integ_key, sa0->integ_key_len,
208                          (u8 *) ih4, i_b0->current_length, sig, sa0->use_esn,
209                          sa0->seq_hi);
210
211               if (PREDICT_FALSE (memcmp (digest, sig, icv_size)))
212                 {
213                   if (is_ip6)
214                     vlib_node_increment_counter (vm,
215                                                  ah6_decrypt_node.index,
216                                                  AH_DECRYPT_ERROR_INTEG_ERROR,
217                                                  1);
218                   else
219                     vlib_node_increment_counter (vm,
220                                                  ah4_decrypt_node.index,
221                                                  AH_DECRYPT_ERROR_INTEG_ERROR,
222                                                  1);
223                   goto trace;
224                 }
225
226               //TODO UT remaining
227               if (PREDICT_TRUE (sa0->use_anti_replay))
228                 {
229                   if (PREDICT_TRUE (sa0->use_esn))
230                     esp_replay_advance_esn (sa0, seq);
231                   else
232                     esp_replay_advance (sa0, seq);
233                 }
234
235             }
236
237           vlib_buffer_advance (i_b0,
238                                ip_hdr_size + sizeof (ah_header_t) + icv_size +
239                                icv_padding_len);
240           i_b0->flags |= VLIB_BUFFER_TOTAL_LENGTH_VALID;
241
242           if (PREDICT_TRUE (sa0->is_tunnel))
243             {                   /* tunnel mode */
244               if (PREDICT_TRUE (ah0->nexthdr == IP_PROTOCOL_IP_IN_IP))
245                 next0 = AH_DECRYPT_NEXT_IP4_INPUT;
246               else if (ah0->nexthdr == IP_PROTOCOL_IPV6)
247                 next0 = AH_DECRYPT_NEXT_IP6_INPUT;
248               else
249                 {
250                   clib_warning ("next header: 0x%x", ah0->nexthdr);
251                   if (is_ip6)
252                     vlib_node_increment_counter (vm,
253                                                  ah6_decrypt_node.index,
254                                                  AH_DECRYPT_ERROR_DECRYPTION_FAILED,
255                                                  1);
256                   else
257                     vlib_node_increment_counter (vm,
258                                                  ah4_decrypt_node.index,
259                                                  AH_DECRYPT_ERROR_DECRYPTION_FAILED,
260                                                  1);
261                   goto trace;
262                 }
263             }
264           else
265             {                   /* transport mode */
266               if (is_ip6)
267                 {
268                   vlib_buffer_advance (i_b0, -sizeof (ip6_header_t));
269                   oh6 = vlib_buffer_get_current (i_b0);
270                   memmove (oh6, ih6, sizeof (ip6_header_t));
271
272                   next0 = AH_DECRYPT_NEXT_IP6_INPUT;
273                   oh6->protocol = nexthdr;
274                   oh6->hop_limit = hop_limit;
275                   oh6->ip_version_traffic_class_and_flow_label =
276                     ip_version_traffic_class_and_flow_label;
277                   oh6->payload_length =
278                     clib_host_to_net_u16 (vlib_buffer_length_in_chain
279                                           (vm, i_b0) - sizeof (ip6_header_t));
280                 }
281               else
282                 {
283                   vlib_buffer_advance (i_b0, -sizeof (ip4_header_t));
284                   oh4 = vlib_buffer_get_current (i_b0);
285                   memmove (oh4, ih4, sizeof (ip4_header_t));
286
287                   next0 = AH_DECRYPT_NEXT_IP4_INPUT;
288                   oh4->ip_version_and_header_length = 0x45;
289                   oh4->fragment_id = 0;
290                   oh4->flags_and_fragment_offset = 0;
291                   oh4->protocol = ah0->nexthdr;
292                   oh4->length =
293                     clib_host_to_net_u16 (vlib_buffer_length_in_chain
294                                           (vm, i_b0));
295                   oh4->ttl = ttl;
296                   oh4->tos = tos;
297                   oh4->checksum = ip4_header_checksum (oh4);
298                 }
299             }
300
301           /* for IPSec-GRE tunnel next node is ipsec-gre-input */
302           if (PREDICT_FALSE
303               ((vnet_buffer (i_b0)->ipsec.flags) &
304                IPSEC_FLAG_IPSEC_GRE_TUNNEL))
305             next0 = AH_DECRYPT_NEXT_IPSEC_GRE_INPUT;
306
307
308           vnet_buffer (i_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
309         trace:
310           if (PREDICT_FALSE (i_b0->flags & VLIB_BUFFER_IS_TRACED))
311             {
312               i_b0->flags |= VLIB_BUFFER_IS_TRACED;
313               ah_decrypt_trace_t *tr =
314                 vlib_add_trace (vm, node, i_b0, sizeof (*tr));
315               tr->integ_alg = sa0->integ_alg;
316             }
317           vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
318                                            n_left_to_next, i_bi0, next0);
319         }
320       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
321     }
322   if (is_ip6)
323     vlib_node_increment_counter (vm, ah6_decrypt_node.index,
324                                  AH_DECRYPT_ERROR_RX_PKTS,
325                                  from_frame->n_vectors);
326   else
327     vlib_node_increment_counter (vm, ah4_decrypt_node.index,
328                                  AH_DECRYPT_ERROR_RX_PKTS,
329                                  from_frame->n_vectors);
330
331   return from_frame->n_vectors;
332 }
333
334 VLIB_NODE_FN (ah4_decrypt_node) (vlib_main_t * vm,
335                                  vlib_node_runtime_t * node,
336                                  vlib_frame_t * from_frame)
337 {
338   return ah_decrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
339 }
340
341 /* *INDENT-OFF* */
342 VLIB_REGISTER_NODE (ah4_decrypt_node) = {
343   .name = "ah4-decrypt",
344   .vector_size = sizeof (u32),
345   .format_trace = format_ah_decrypt_trace,
346   .type = VLIB_NODE_TYPE_INTERNAL,
347
348   .n_errors = ARRAY_LEN(ah_decrypt_error_strings),
349   .error_strings = ah_decrypt_error_strings,
350
351   .n_next_nodes = AH_DECRYPT_N_NEXT,
352   .next_nodes = {
353 #define _(s,n) [AH_DECRYPT_NEXT_##s] = n,
354     foreach_ah_decrypt_next
355 #undef _
356   },
357 };
358 /* *INDENT-ON* */
359
360 VLIB_NODE_FN (ah6_decrypt_node) (vlib_main_t * vm,
361                                  vlib_node_runtime_t * node,
362                                  vlib_frame_t * from_frame)
363 {
364   return ah_decrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
365 }
366
367 /* *INDENT-OFF* */
368 VLIB_REGISTER_NODE (ah6_decrypt_node) = {
369   .name = "ah6-decrypt",
370   .vector_size = sizeof (u32),
371   .format_trace = format_ah_decrypt_trace,
372   .type = VLIB_NODE_TYPE_INTERNAL,
373
374   .n_errors = ARRAY_LEN(ah_decrypt_error_strings),
375   .error_strings = ah_decrypt_error_strings,
376
377   .n_next_nodes = AH_DECRYPT_N_NEXT,
378   .next_nodes = {
379 #define _(s,n) [AH_DECRYPT_NEXT_##s] = n,
380     foreach_ah_decrypt_next
381 #undef _
382   },
383 };
384 /* *INDENT-ON* */
385
386 /*
387  * fd.io coding-style-patch-verification: ON
388  *
389  * Local Variables:
390  * eval: (c-set-style "gnu")
391  * End:
392  */