26 #define foreach_ah_encrypt_next \ 27 _(DROP, "error-drop") \ 28 _(IP4_LOOKUP, "ip4-lookup") \ 29 _(IP6_LOOKUP, "ip6-lookup") \ 30 _(INTERFACE_OUTPUT, "interface-output") 32 #define _(v, s) AH_ENCRYPT_NEXT_##v, 40 #define foreach_ah_encrypt_error \ 41 _(RX_PKTS, "AH pkts received") \ 42 _(SEQ_CYCLED, "sequence number cycled") 47 #define _(sym,str) AH_ENCRYPT_ERROR_##sym, 54 #define _(sym,string) string, 76 s =
format (s,
"ah: spi %u seq %u integrity %U",
85 u32 n_left_from, *from, *to_next = 0, next_index;
93 while (n_left_from > 0)
99 while (n_left_from > 0 && n_left_to_next > 0)
105 ip4_and_ah_header_t *ih0, *oh0 = 0;
106 ip6_and_ah_header_t *ih6_0, *oh6_0 = 0;
110 u8 transport_mode = 0;
118 next0 = AH_ENCRYPT_NEXT_DROP;
128 clib_warning (
"sequence number counter has cycled SPI %u",
131 AH_ENCRYPT_ERROR_SEQ_CYCLED, 1);
146 is_ipv6 = (ih0->ip4.ip_version_and_header_length & 0xF0) == 0x60;
151 adv = -
sizeof (ip4_and_ah_header_t);
153 adv = -
sizeof (ip6_and_ah_header_t);
178 ih6_0 = (ip6_and_ah_header_t *) ih0;
184 next_hdr_type = IP_PROTOCOL_IPV6;
185 oh6_0->ip6.ip_version_traffic_class_and_flow_label =
186 ih6_0->ip6.ip_version_traffic_class_and_flow_label;
190 next_hdr_type = ih6_0->ip6.protocol;
194 oh6_0->ip6.protocol = IP_PROTOCOL_IPSEC_AH;
195 oh6_0->ip6.hop_limit = 254;
196 oh6_0->ah.spi = clib_net_to_host_u32 (sa0->
spi);
197 oh6_0->ah.seq_no = clib_net_to_host_u32 (sa0->
seq);
198 oh6_0->ip6.payload_length =
206 memset (oh0, 0,
sizeof (ip4_and_ah_header_t));
210 next_hdr_type = IP_PROTOCOL_IP_IN_IP;
214 next_hdr_type = ih0->ip4.protocol;
220 oh0->ip4.ip_version_and_header_length = 0x45;
221 oh0->ip4.fragment_id = 0;
222 oh0->ip4.flags_and_fragment_offset = 0;
225 oh0->ip4.protocol = IP_PROTOCOL_IPSEC_AH;
226 oh0->ah.spi = clib_net_to_host_u32 (sa0->
spi);
227 oh0->ah.seq_no = clib_net_to_host_u32 (sa0->
seq);
228 oh0->ip4.checksum = 0;
229 oh0->ah.nexthdr = next_hdr_type;
241 next0 = AH_ENCRYPT_NEXT_IP4_LOOKUP;
246 oh6_0->ip6.src_address.as_u64[0] =
248 oh6_0->ip6.src_address.as_u64[1] =
250 oh6_0->ip6.dst_address.as_u64[0] =
252 oh6_0->ip6.dst_address.as_u64[1] =
255 next0 = AH_ENCRYPT_NEXT_IP6_LOOKUP;
261 next0 = AH_ENCRYPT_NEXT_INTERFACE_OUTPUT;
265 memset (sig, 0,
sizeof (sig));
269 memset (digest, 0, icv_size);
277 memcpy (digest, (
char *) &sig[0], 12);
304 to_next, n_left_to_next, i_bi0,
310 AH_ENCRYPT_ERROR_RX_PKTS,
320 .name =
"ah-encrypt",
321 .vector_size =
sizeof (
u32),
330 #define _(s,n) [AH_ENCRYPT_NEXT_##s] = n,
ip46_address_t tunnel_src_addr
static vlib_cli_command_t trace
(constructor) VLIB_CLI_COMMAND (trace)
ipsec_proto_main_integ_alg_t * ipsec_proto_main_integ_algs
static unsigned int hmac_calc(ipsec_integ_alg_t alg, u8 *key, int key_len, u8 *data, int data_len, u8 *signature, u8 use_esn, u32 seq_hi)
ipsec_integ_alg_t integ_alg
struct _vlib_node_registration vlib_node_registration_t
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
static int esp_seq_advance(ipsec_sa_t *sa)
ipsec_integ_alg_t integ_alg
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
u16 current_length
Nbytes between current data and the end of this buffer.
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
#define vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, n_left_to_next, bi0, next0)
Finish enqueueing one buffer forward in the graph.
#define vlib_get_next_frame(vm, node, next_index, vectors, n_vectors_left)
Get pointer to next frame vector data by (vlib_node_runtime_t, next_index).
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
ip46_address_t tunnel_dst_addr
static u8 * format_ah_encrypt_trace(u8 *s, va_list *args)
static char * ah_encrypt_error_strings[]
#define clib_warning(format, args...)
#define VLIB_BUFFER_IS_TRACED
#define clib_memcpy(a, b, c)
void vlib_put_next_frame(vlib_main_t *vm, vlib_node_runtime_t *r, u32 next_index, u32 n_vectors_left)
Release pointer to next frame vector data.
u16 cached_next_index
Next frame index that vector arguments were last enqueued to last time this node ran.
#define foreach_ah_encrypt_error
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
u8 * format_ipsec_integ_alg(u8 *s, va_list *args)
static uword ah_encrypt_node_fn(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame)
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
#define VLIB_NODE_FUNCTION_MULTIARCH(node, fn)
#define VLIB_REGISTER_NODE(x,...)
ipsec_proto_main_t ipsec_proto_main
#define foreach_ah_encrypt_next
vlib_node_registration_t ah_encrypt_node
(constructor) VLIB_REGISTER_NODE (ah_encrypt_node)
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
static u16 ip4_header_checksum(ip4_header_t *i)