FD.io VPP  v20.05.1-6-gf53edbc3b
Vector Packet Processing
esp_encrypt.c
Go to the documentation of this file.
1 /*
2  * esp_encrypt.c : IPSec ESP encrypt node
3  *
4  * Copyright (c) 2015 Cisco and/or its affiliates.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/udp/udp.h>
22 
23 #include <vnet/crypto/crypto.h>
24 
25 #include <vnet/ipsec/ipsec.h>
26 #include <vnet/ipsec/ipsec_tun.h>
27 #include <vnet/ipsec/esp.h>
28 
29 #define foreach_esp_encrypt_next \
30 _(DROP4, "ip4-drop") \
31 _(DROP6, "ip6-drop") \
32 _(PENDING, "pending") \
33 _(HANDOFF4, "handoff4") \
34 _(HANDOFF6, "handoff6") \
35 _(INTERFACE_OUTPUT, "interface-output")
36 
37 #define _(v, s) ESP_ENCRYPT_NEXT_##v,
38 typedef enum
39 {
41 #undef _
44 
45 #define foreach_esp_encrypt_error \
46  _(RX_PKTS, "ESP pkts received") \
47  _(POST_RX_PKTS, "ESP-post pkts received") \
48  _(SEQ_CYCLED, "sequence number cycled (packet dropped)") \
49  _(CRYPTO_ENGINE_ERROR, "crypto engine error (packet dropped)") \
50  _(CRYPTO_QUEUE_FULL, "crypto queue full (packet dropped)") \
51  _(NO_BUFFERS, "no buffers (packet dropped)") \
52 
53 typedef enum
54 {
55 #define _(sym,str) ESP_ENCRYPT_ERROR_##sym,
57 #undef _
60 
61 static char *esp_encrypt_error_strings[] = {
62 #define _(sym,string) string,
64 #undef _
65 };
66 
67 typedef struct
68 {
74  ipsec_crypto_alg_t crypto_alg;
75  ipsec_integ_alg_t integ_alg;
77 
78 typedef struct
79 {
82 
83 /* packet trace format function */
84 static u8 *
85 format_esp_encrypt_trace (u8 * s, va_list * args)
86 {
87  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
88  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
89  esp_encrypt_trace_t *t = va_arg (*args, esp_encrypt_trace_t *);
90 
91  s =
92  format (s,
93  "esp: sa-index %d spi %u (0x%08x) seq %u sa-seq-hi %u crypto %U integrity %U%s",
94  t->sa_index, t->spi, t->spi, t->seq, t->sa_seq_hi,
97  t->udp_encap ? " udp-encap-enabled" : "");
98  return s;
99 }
100 
101 static u8 *
102 format_esp_post_encrypt_trace (u8 * s, va_list * args)
103 {
104  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
105  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
106  esp_encrypt_post_trace_t *t = va_arg (*args, esp_encrypt_post_trace_t *);
107 
108  s = format (s, "esp-post: next node index %u", t->next_index);
109  return s;
110 }
111 
112 /* pad packet in input buffer */
115  u8 block_size, u8 icv_sz,
116  u16 * next, vlib_node_runtime_t * node,
117  u16 buffer_data_size, uword total_len)
118 {
119  static const u8 pad_data[ESP_MAX_BLOCK_SIZE] = {
120  0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
121  0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x00,
122  };
123 
124  u16 min_length = total_len + sizeof (esp_footer_t);
125  u16 new_length = round_pow2 (min_length, block_size);
126  u8 pad_bytes = new_length - min_length;
128  last[0]->current_length + pad_bytes);
129  u16 tail_sz = sizeof (esp_footer_t) + pad_bytes + icv_sz;
130 
131  if (last[0]->current_length + tail_sz > buffer_data_size)
132  {
133  u32 tmp_bi = 0;
134  if (vlib_buffer_alloc (vm, &tmp_bi, 1) != 1)
135  return 0;
136 
137  vlib_buffer_t *tmp = vlib_get_buffer (vm, tmp_bi);
138  last[0]->next_buffer = tmp_bi;
139  last[0]->flags |= VLIB_BUFFER_NEXT_PRESENT;
140  f = (esp_footer_t *) (vlib_buffer_get_current (tmp) + pad_bytes);
141  tmp->current_length += tail_sz;
142  last[0] = tmp;
143  }
144  else
145  last[0]->current_length += tail_sz;
146 
147  f->pad_length = pad_bytes;
148  if (pad_bytes)
149  {
150  ASSERT (pad_bytes <= ESP_MAX_BLOCK_SIZE);
151  pad_bytes = clib_min (ESP_MAX_BLOCK_SIZE, pad_bytes);
152  clib_memcpy_fast ((u8 *) f - pad_bytes, pad_data, pad_bytes);
153  }
154 
155  return &f->next_header;
156 }
157 
159 esp_update_ip4_hdr (ip4_header_t * ip4, u16 len, int is_transport, int is_udp)
160 {
161  ip_csum_t sum;
162  u16 old_len;
163 
164  len = clib_net_to_host_u16 (len);
165  old_len = ip4->length;
166 
167  if (is_transport)
168  {
169  u8 prot = is_udp ? IP_PROTOCOL_UDP : IP_PROTOCOL_IPSEC_ESP;
170 
171  sum = ip_csum_update (ip4->checksum, ip4->protocol,
172  prot, ip4_header_t, protocol);
173  ip4->protocol = prot;
174 
175  sum = ip_csum_update (sum, old_len, len, ip4_header_t, length);
176  }
177  else
178  sum = ip_csum_update (ip4->checksum, old_len, len, ip4_header_t, length);
179 
180  ip4->length = len;
181  ip4->checksum = ip_csum_fold (sum);
182 }
183 
186 {
187  clib_memcpy_fast (udp, &sa->udp_hdr, sizeof (udp_header_t));
188  udp->length = clib_net_to_host_u16 (len);
189 }
190 
193 {
194 #ifdef CLIB_HAVE_VEC128
195  static const u8x16 ext_hdr_types = {
196  IP_PROTOCOL_IP6_HOP_BY_HOP_OPTIONS,
197  IP_PROTOCOL_IPV6_ROUTE,
198  IP_PROTOCOL_IPV6_FRAGMENTATION,
199  };
200 
201  return !u8x16_is_all_zero (ext_hdr_types == u8x16_splat (nexthdr));
202 #else
203  return ((nexthdr ^ IP_PROTOCOL_IP6_HOP_BY_HOP_OPTIONS) |
204  (nexthdr ^ IP_PROTOCOL_IPV6_ROUTE) |
205  (nexthdr ^ IP_PROTOCOL_IPV6_FRAGMENTATION) != 0);
206 #endif
207 }
208 
210 esp_get_ip6_hdr_len (ip6_header_t * ip6, ip6_ext_header_t ** ext_hdr)
211 {
212  /* this code assumes that HbH, route and frag headers will be before
213  others, if that is not the case, they will end up encrypted */
214  u8 len = sizeof (ip6_header_t);
215  ip6_ext_header_t *p;
216 
217  /* if next packet doesn't have ext header */
218  if (ext_hdr_is_pre_esp (ip6->protocol) == 0)
219  {
220  *ext_hdr = NULL;
221  return len;
222  }
223 
224  p = (void *) (ip6 + 1);
225  len += ip6_ext_header_len (p);
226 
227  while (ext_hdr_is_pre_esp (p->next_hdr))
228  {
229  len += ip6_ext_header_len (p);
230  p = ip6_ext_next_header (p);
231  }
232 
233  *ext_hdr = p;
234  return len;
235 }
236 
239  vnet_crypto_op_t * ops, vlib_buffer_t * b[],
240  u16 * nexts, vnet_crypto_op_chunk_t * chunks,
241  u16 drop_next)
242 {
243  u32 n_fail, n_ops = vec_len (ops);
244  vnet_crypto_op_t *op = ops;
245 
246  if (n_ops == 0)
247  return;
248 
249  n_fail = n_ops - vnet_crypto_process_chained_ops (vm, op, chunks, n_ops);
250 
251  while (n_fail)
252  {
253  ASSERT (op - ops < n_ops);
254 
255  if (op->status != VNET_CRYPTO_OP_STATUS_COMPLETED)
256  {
257  u32 bi = op->user_data;
258  b[bi]->error = node->errors[ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR];
259  nexts[bi] = drop_next;
260  n_fail--;
261  }
262  op++;
263  }
264 }
265 
268  vnet_crypto_op_t * ops, vlib_buffer_t * b[], u16 * nexts,
269  u16 drop_next)
270 {
271  u32 n_fail, n_ops = vec_len (ops);
272  vnet_crypto_op_t *op = ops;
273 
274  if (n_ops == 0)
275  return;
276 
277  n_fail = n_ops - vnet_crypto_process_ops (vm, op, n_ops);
278 
279  while (n_fail)
280  {
281  ASSERT (op - ops < n_ops);
282 
283  if (op->status != VNET_CRYPTO_OP_STATUS_COMPLETED)
284  {
285  u32 bi = op->user_data;
286  b[bi]->error = node->errors[ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR];
287  nexts[bi] = drop_next;
288  n_fail--;
289  }
290  op++;
291  }
292 }
293 
294 typedef struct
295 {
296  u32 salt;
297  u64 iv;
298 } __clib_packed esp_gcm_nonce_t;
299 
300 STATIC_ASSERT_SIZEOF (esp_gcm_nonce_t, 12);
301 
304  ipsec_sa_t * sa0, vlib_buffer_t * b,
305  vlib_buffer_t * lb, u8 icv_sz, u8 * start,
306  u32 start_len, u16 * n_ch)
307 {
309  vlib_buffer_t *cb = b;
310  u32 n_chunks = 1;
311  u32 total_len;
312  vec_add2 (ptd->chunks, ch, 1);
313  total_len = ch->len = start_len;
314  ch->src = ch->dst = start;
315  cb = vlib_get_buffer (vm, cb->next_buffer);
316 
317  while (1)
318  {
319  vec_add2 (ptd->chunks, ch, 1);
320  n_chunks += 1;
321  if (lb == cb)
322  total_len += ch->len = cb->current_length - icv_sz;
323  else
324  total_len += ch->len = cb->current_length;
325  ch->src = ch->dst = vlib_buffer_get_current (cb);
326 
327  if (!(cb->flags & VLIB_BUFFER_NEXT_PRESENT))
328  break;
329 
330  cb = vlib_get_buffer (vm, cb->next_buffer);
331  }
332 
333  if (n_ch)
334  *n_ch = n_chunks;
335 
336  return total_len;
337 }
338 
341  ipsec_sa_t * sa0, vlib_buffer_t * b,
342  vlib_buffer_t * lb, u8 icv_sz, u8 * start,
343  u32 start_len, u8 * digest, u16 * n_ch)
344 {
346  vlib_buffer_t *cb = b;
347  u32 n_chunks = 1;
348  u32 total_len;
349  vec_add2 (ptd->chunks, ch, 1);
350  total_len = ch->len = start_len;
351  ch->src = start;
352  cb = vlib_get_buffer (vm, cb->next_buffer);
353 
354  while (1)
355  {
356  vec_add2 (ptd->chunks, ch, 1);
357  n_chunks += 1;
358  if (lb == cb)
359  {
360  total_len += ch->len = cb->current_length - icv_sz;
361  if (ipsec_sa_is_set_USE_ESN (sa0))
362  {
363  u32 seq_hi = clib_net_to_host_u32 (sa0->seq_hi);
364  clib_memcpy_fast (digest, &seq_hi, sizeof (seq_hi));
365  ch->len += sizeof (seq_hi);
366  total_len += sizeof (seq_hi);
367  }
368  }
369  else
370  total_len += ch->len = cb->current_length;
371  ch->src = vlib_buffer_get_current (cb);
372 
373  if (!(cb->flags & VLIB_BUFFER_NEXT_PRESENT))
374  break;
375 
376  cb = vlib_get_buffer (vm, cb->next_buffer);
377  }
378 
379  if (n_ch)
380  *n_ch = n_chunks;
381 
382  return total_len;
383 }
384 
385 always_inline void
387  vnet_crypto_op_t ** crypto_ops,
388  vnet_crypto_op_t ** integ_ops, ipsec_sa_t * sa0,
389  u8 * payload, u16 payload_len, u8 iv_sz, u8 icv_sz,
390  vlib_buffer_t ** bufs, vlib_buffer_t ** b,
391  vlib_buffer_t * lb, u32 hdr_len, esp_header_t * esp,
392  esp_gcm_nonce_t * nonce)
393 {
394  if (sa0->crypto_enc_op_id)
395  {
396  vnet_crypto_op_t *op;
397  vec_add2_aligned (crypto_ops[0], op, 1, CLIB_CACHE_LINE_BYTES);
399 
400  op->src = op->dst = payload;
401  op->key_index = sa0->crypto_key_index;
402  op->len = payload_len - icv_sz;
403  op->user_data = b - bufs;
404 
405  if (ipsec_sa_is_set_IS_AEAD (sa0))
406  {
407  /*
408  * construct the AAD in a scratch space in front
409  * of the IP header.
410  */
411  op->aad = payload - hdr_len - sizeof (esp_aead_t);
412  op->aad_len = esp_aad_fill (op->aad, esp, sa0);
413 
414  op->tag = payload + op->len;
415  op->tag_len = 16;
416 
417  u64 *iv = (u64 *) (payload - iv_sz);
418  nonce->salt = sa0->salt;
419  nonce->iv = *iv = clib_host_to_net_u64 (sa0->gcm_iv_counter++);
420  op->iv = (u8 *) nonce;
421  }
422  else
423  {
424  op->iv = payload - iv_sz;
426  }
427 
428  if (lb != b[0])
429  {
430  /* is chained */
432  op->chunk_index = vec_len (ptd->chunks);
433  op->tag = vlib_buffer_get_tail (lb) - icv_sz;
434  esp_encrypt_chain_crypto (vm, ptd, sa0, b[0], lb, icv_sz, payload,
435  payload_len, &op->n_chunks);
436  }
437  }
438 
439  if (sa0->integ_op_id)
440  {
441  vnet_crypto_op_t *op;
442  vec_add2_aligned (integ_ops[0], op, 1, CLIB_CACHE_LINE_BYTES);
443  vnet_crypto_op_init (op, sa0->integ_op_id);
444  op->src = payload - iv_sz - sizeof (esp_header_t);
445  op->digest = payload + payload_len - icv_sz;
446  op->key_index = sa0->integ_key_index;
447  op->digest_len = icv_sz;
448  op->len = payload_len - icv_sz + iv_sz + sizeof (esp_header_t);
449  op->user_data = b - bufs;
450 
451  if (lb != b[0])
452  {
453  /* is chained */
455  op->chunk_index = vec_len (ptd->chunks);
456  op->digest = vlib_buffer_get_tail (lb) - icv_sz;
457 
458  esp_encrypt_chain_integ (vm, ptd, sa0, b[0], lb, icv_sz,
459  payload - iv_sz - sizeof (esp_header_t),
460  payload_len + iv_sz +
461  sizeof (esp_header_t), op->digest,
462  &op->n_chunks);
463  }
464  else if (ipsec_sa_is_set_USE_ESN (sa0))
465  {
466  u32 seq_hi = clib_net_to_host_u32 (sa0->seq_hi);
467  clib_memcpy_fast (op->digest, &seq_hi, sizeof (seq_hi));
468  op->len += sizeof (seq_hi);
469  }
470  }
471 }
472 
475  vnet_crypto_async_frame_t ** async_frame,
476  ipsec_sa_t * sa, vlib_buffer_t * b,
477  esp_header_t * esp, u8 * payload, u32 payload_len,
478  u8 iv_sz, u8 icv_sz, u32 bi, u16 * next, u32 hdr_len,
479  u16 async_next, vlib_buffer_t * lb)
480 {
481  esp_post_data_t *post = esp_post_data (b);
482  u8 *tag, *iv, *aad = 0;
483  u8 flag = 0;
484  u32 key_index;
485  i16 crypto_start_offset, integ_start_offset = 0;
486  u16 crypto_total_len, integ_total_len;
487 
488  post->next_index = next[0];
489  next[0] = ESP_ENCRYPT_NEXT_PENDING;
490 
491  /* crypto */
492  crypto_start_offset = payload - b->data;
493  crypto_total_len = integ_total_len = payload_len - icv_sz;
494  tag = payload + crypto_total_len;
495 
496  /* aead */
497  if (ipsec_sa_is_set_IS_AEAD (sa))
498  {
499  esp_gcm_nonce_t *nonce;
500  u64 *pkt_iv = (u64 *) (payload - iv_sz);
501 
502  aad = payload - hdr_len - sizeof (esp_aead_t);
503  esp_aad_fill (aad, esp, sa);
504  nonce = (esp_gcm_nonce_t *) (aad - sizeof (*nonce));
505  nonce->salt = sa->salt;
506  nonce->iv = *pkt_iv = clib_host_to_net_u64 (sa->gcm_iv_counter++);
507  iv = (u8 *) nonce;
508  key_index = sa->crypto_key_index;
509 
510  if (lb != b)
511  {
512  /* chain */
514  tag = vlib_buffer_get_tail (lb) - icv_sz;
515  crypto_total_len = esp_encrypt_chain_crypto (vm, ptd, sa, b, lb,
516  icv_sz, payload,
517  payload_len, 0);
518  }
519  goto out;
520  }
521 
522  /* cipher then hash */
523  iv = payload - iv_sz;
524  integ_start_offset = crypto_start_offset - iv_sz - sizeof (esp_header_t);
525  integ_total_len += iv_sz + sizeof (esp_header_t);
527  key_index = sa->linked_key_index;
528 
529  if (b != lb)
530  {
532  crypto_total_len = esp_encrypt_chain_crypto (vm, ptd, sa, b, lb,
533  icv_sz, payload,
534  payload_len, 0);
535  tag = vlib_buffer_get_tail (lb) - icv_sz;
536  integ_total_len = esp_encrypt_chain_integ (vm, ptd, sa, b, lb, icv_sz,
537  payload - iv_sz -
538  sizeof (esp_header_t),
539  payload_len + iv_sz +
540  sizeof (esp_header_t),
541  tag, 0);
542  }
543  else if (ipsec_sa_is_set_USE_ESN (sa) && !ipsec_sa_is_set_IS_AEAD (sa))
544  {
545  u32 seq_hi = clib_net_to_host_u32 (sa->seq_hi);
546  clib_memcpy_fast (tag, &seq_hi, sizeof (seq_hi));
547  integ_total_len += sizeof (seq_hi);
548  }
549 
550 out:
551  return vnet_crypto_async_add_to_frame (vm, async_frame, key_index,
552  crypto_total_len,
553  integ_total_len - crypto_total_len,
554  crypto_start_offset,
555  integ_start_offset, bi, async_next,
556  iv, tag, aad, flag);
557 }
558 
559 /* when submitting a frame is failed, drop all buffers in the frame */
562  vlib_buffer_t ** b, u16 * next,
563  u16 drop_next)
564 {
565  u32 n_drop = f->n_elts;
566  while (--n_drop)
567  {
568  (b - n_drop)[0]->error = ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR;
569  (next - n_drop)[0] = drop_next;
570  }
572 }
573 
576  vlib_frame_t * frame, int is_ip6, int is_tun,
577  u16 async_next)
578 {
579  ipsec_main_t *im = &ipsec_main;
581  u32 *from = vlib_frame_vector_args (frame);
582  u32 n_left = frame->n_vectors;
583  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
584  u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
585  esp_gcm_nonce_t nonces[VLIB_FRAME_SIZE], *nonce = nonces;
586  u32 thread_index = vm->thread_index;
587  u16 buffer_data_size = vlib_buffer_get_default_data_size (vm);
588  u32 current_sa_index = ~0, current_sa_packets = 0;
589  u32 current_sa_bytes = 0, spi = 0;
590  u8 block_sz = 0, iv_sz = 0, icv_sz = 0;
591  ipsec_sa_t *sa0 = 0;
592  vlib_buffer_t *lb;
593  vnet_crypto_op_t **crypto_ops = &ptd->crypto_ops;
594  vnet_crypto_op_t **integ_ops = &ptd->integ_ops;
595  vnet_crypto_async_frame_t *async_frame = 0;
596  int is_async = im->async_mode;
597  vnet_crypto_async_op_id_t last_async_op = ~0;
598  u16 drop_next = (is_ip6 ? ESP_ENCRYPT_NEXT_DROP6 : ESP_ENCRYPT_NEXT_DROP4);
599 
600  vlib_get_buffers (vm, from, b, n_left);
601  if (!is_async)
602  {
607  }
608  vec_reset_length (ptd->chunks);
609 
610  while (n_left > 0)
611  {
612  u32 sa_index0;
613  dpo_id_t *dpo;
614  esp_header_t *esp;
615  u8 *payload, *next_hdr_ptr;
616  u16 payload_len, payload_len_total, n_bufs;
617  u32 hdr_len;
618 
619  if (n_left > 2)
620  {
621  u8 *p;
622  vlib_prefetch_buffer_header (b[2], LOAD);
623  p = vlib_buffer_get_current (b[1]);
627  }
628 
629  if (is_tun)
630  {
631  /* we are on a ipsec tunnel's feature arc */
632  vnet_buffer (b[0])->ipsec.sad_index =
633  sa_index0 = ipsec_tun_protect_get_sa_out
634  (vnet_buffer (b[0])->ip.adj_index[VLIB_TX]);
635  }
636  else
637  sa_index0 = vnet_buffer (b[0])->ipsec.sad_index;
638 
639  if (sa_index0 != current_sa_index)
640  {
641  if (current_sa_packets)
643  current_sa_index,
644  current_sa_packets,
645  current_sa_bytes);
646  current_sa_packets = current_sa_bytes = 0;
647 
648  sa0 = pool_elt_at_index (im->sad, sa_index0);
649  current_sa_index = sa_index0;
650  spi = clib_net_to_host_u32 (sa0->spi);
651  block_sz = sa0->crypto_block_size;
652  icv_sz = sa0->integ_icv_size;
653  iv_sz = sa0->crypto_iv_size;
654 
655  /* submit frame when op_id is different then the old one */
656  if (is_async && sa0->crypto_async_enc_op_id != last_async_op)
657  {
658  if (async_frame && async_frame->n_elts)
659  {
660  if (vnet_crypto_async_submit_open_frame (vm, async_frame)
661  < 0)
662  esp_async_recycle_failed_submit (async_frame, b,
663  next, drop_next);
664  }
665  async_frame =
667  last_async_op = sa0->crypto_async_enc_op_id;
668  }
669  }
670 
671  if (PREDICT_FALSE (~0 == sa0->encrypt_thread_index))
672  {
673  /* this is the first packet to use this SA, claim the SA
674  * for this thread. this could happen simultaneously on
675  * another thread */
677  ipsec_sa_assign_thread (thread_index));
678  }
679 
680  if (PREDICT_TRUE (thread_index != sa0->encrypt_thread_index))
681  {
682  next[0] = (is_ip6 ?
683  ESP_ENCRYPT_NEXT_HANDOFF6 : ESP_ENCRYPT_NEXT_HANDOFF4);
684  goto trace;
685  }
686 
687  lb = b[0];
688  n_bufs = vlib_buffer_chain_linearize (vm, b[0]);
689  if (n_bufs == 0)
690  {
691  b[0]->error = node->errors[ESP_ENCRYPT_ERROR_NO_BUFFERS];
692  next[0] = drop_next;
693  goto trace;
694  }
695 
696  if (n_bufs > 1)
697  {
698  /* find last buffer in the chain */
699  while (lb->flags & VLIB_BUFFER_NEXT_PRESENT)
700  lb = vlib_get_buffer (vm, lb->next_buffer);
701  }
702 
703  if (PREDICT_FALSE (esp_seq_advance (sa0)))
704  {
705  b[0]->error = node->errors[ESP_ENCRYPT_ERROR_SEQ_CYCLED];
706  next[0] = drop_next;
707  goto trace;
708  }
709 
710  /* space for IV */
711  hdr_len = iv_sz;
712 
713  if (ipsec_sa_is_set_IS_TUNNEL (sa0))
714  {
715  payload = vlib_buffer_get_current (b[0]);
716  next_hdr_ptr = esp_add_footer_and_icv (vm, &lb, block_sz, icv_sz,
717  next, node,
718  buffer_data_size,
720  (vm, b[0]));
721  if (!next_hdr_ptr)
722  {
723  b[0]->error = node->errors[ESP_ENCRYPT_ERROR_NO_BUFFERS];
724  next[0] = drop_next;
725  goto trace;
726  }
727  b[0]->flags &= ~VLIB_BUFFER_TOTAL_LENGTH_VALID;
728  payload_len = b[0]->current_length;
729  payload_len_total = vlib_buffer_length_in_chain (vm, b[0]);
730 
731  /* ESP header */
732  hdr_len += sizeof (*esp);
733  esp = (esp_header_t *) (payload - hdr_len);
734 
735  /* optional UDP header */
736  if (ipsec_sa_is_set_UDP_ENCAP (sa0))
737  {
738  hdr_len += sizeof (udp_header_t);
739  esp_fill_udp_hdr (sa0, (udp_header_t *) (payload - hdr_len),
740  payload_len_total + hdr_len);
741  }
742 
743  /* IP header */
744  if (ipsec_sa_is_set_IS_TUNNEL_V6 (sa0))
745  {
746  ip6_header_t *ip6;
747  u16 len = sizeof (ip6_header_t);
748  hdr_len += len;
749  ip6 = (ip6_header_t *) (payload - hdr_len);
750  clib_memcpy_fast (ip6, &sa0->ip6_hdr, len);
751  *next_hdr_ptr = (is_ip6 ?
752  IP_PROTOCOL_IPV6 : IP_PROTOCOL_IP_IN_IP);
753  len = payload_len_total + hdr_len - len;
754  ip6->payload_length = clib_net_to_host_u16 (len);
755  }
756  else
757  {
758  ip4_header_t *ip4;
759  u16 len = sizeof (ip4_header_t);
760  hdr_len += len;
761  ip4 = (ip4_header_t *) (payload - hdr_len);
762  clib_memcpy_fast (ip4, &sa0->ip4_hdr, len);
763  *next_hdr_ptr = (is_ip6 ?
764  IP_PROTOCOL_IPV6 : IP_PROTOCOL_IP_IN_IP);
765  len = payload_len_total + hdr_len;
766  esp_update_ip4_hdr (ip4, len, /* is_transport */ 0, 0);
767  }
768 
769  dpo = &sa0->dpo;
770  if (!is_tun)
771  {
772  next[0] = dpo->dpoi_next_node;
773  vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
774  }
775  else
776  next[0] = ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT;
777  }
778  else /* transport mode */
779  {
780  u8 *l2_hdr, l2_len, *ip_hdr, ip_len;
781  ip6_ext_header_t *ext_hdr;
782  udp_header_t *udp = 0;
783  u16 udp_len = 0;
784  u8 *old_ip_hdr = vlib_buffer_get_current (b[0]);
785 
786  ip_len = is_ip6 ?
787  esp_get_ip6_hdr_len ((ip6_header_t *) old_ip_hdr, &ext_hdr) :
788  ip4_header_bytes ((ip4_header_t *) old_ip_hdr);
789 
790  vlib_buffer_advance (b[0], ip_len);
791  payload = vlib_buffer_get_current (b[0]);
792  next_hdr_ptr = esp_add_footer_and_icv (vm, &lb, block_sz, icv_sz,
793  next, node,
794  buffer_data_size,
796  (vm, b[0]));
797  if (!next_hdr_ptr)
798  goto trace;
799 
800  b[0]->flags &= ~VLIB_BUFFER_TOTAL_LENGTH_VALID;
801  payload_len = b[0]->current_length;
802  payload_len_total = vlib_buffer_length_in_chain (vm, b[0]);
803 
804  /* ESP header */
805  hdr_len += sizeof (*esp);
806  esp = (esp_header_t *) (payload - hdr_len);
807 
808  /* optional UDP header */
809  if (ipsec_sa_is_set_UDP_ENCAP (sa0))
810  {
811  hdr_len += sizeof (udp_header_t);
812  udp = (udp_header_t *) (payload - hdr_len);
813  }
814 
815  /* IP header */
816  hdr_len += ip_len;
817  ip_hdr = payload - hdr_len;
818 
819  /* L2 header */
820  if (!is_tun)
821  {
822  l2_len = vnet_buffer (b[0])->ip.save_rewrite_length;
823  hdr_len += l2_len;
824  l2_hdr = payload - hdr_len;
825 
826  /* copy l2 and ip header */
827  clib_memcpy_le32 (l2_hdr, old_ip_hdr - l2_len, l2_len);
828  }
829  else
830  l2_len = 0;
831 
832  if (is_ip6)
833  {
834  ip6_header_t *ip6 = (ip6_header_t *) (old_ip_hdr);
835  if (PREDICT_TRUE (NULL == ext_hdr))
836  {
837  *next_hdr_ptr = ip6->protocol;
838  ip6->protocol = IP_PROTOCOL_IPSEC_ESP;
839  }
840  else
841  {
842  *next_hdr_ptr = ext_hdr->next_hdr;
843  ext_hdr->next_hdr = IP_PROTOCOL_IPSEC_ESP;
844  }
845  ip6->payload_length =
846  clib_host_to_net_u16 (payload_len_total + hdr_len - l2_len -
847  sizeof (ip6_header_t));
848  }
849  else
850  {
851  u16 len;
852  ip4_header_t *ip4 = (ip4_header_t *) (old_ip_hdr);
853  *next_hdr_ptr = ip4->protocol;
854  len = payload_len_total + hdr_len - l2_len;
855  if (udp)
856  {
857  esp_update_ip4_hdr (ip4, len, /* is_transport */ 1, 1);
858  udp_len = len - ip_len;
859  }
860  else
861  esp_update_ip4_hdr (ip4, len, /* is_transport */ 1, 0);
862  }
863 
864  clib_memcpy_le64 (ip_hdr, old_ip_hdr, ip_len);
865 
866  if (udp)
867  {
868  esp_fill_udp_hdr (sa0, udp, udp_len);
869  }
870 
871  next[0] = ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT;
872  }
873 
874  if (lb != b[0])
875  {
876  crypto_ops = &ptd->chained_crypto_ops;
877  integ_ops = &ptd->chained_integ_ops;
878  }
879  else
880  {
881  crypto_ops = &ptd->crypto_ops;
882  integ_ops = &ptd->integ_ops;
883  }
884 
885  esp->spi = spi;
886  esp->seq = clib_net_to_host_u32 (sa0->seq);
887 
888  if (is_async)
889  {
890  if (PREDICT_FALSE (sa0->crypto_async_enc_op_id == 0))
891  goto trace;
892 
893  if (esp_prepare_async_frame (vm, ptd, &async_frame, sa0, b[0], esp,
894  payload, payload_len, iv_sz,
895  icv_sz, from[b - bufs], next, hdr_len,
896  async_next, lb))
897  {
898  esp_async_recycle_failed_submit (async_frame, b, next,
899  drop_next);
900  goto trace;
901  }
902  }
903  else
904  {
905  esp_prepare_sync_op (vm, ptd, crypto_ops, integ_ops, sa0, payload,
906  payload_len, iv_sz, icv_sz, bufs, b, lb,
907  hdr_len, esp, nonce++);
908  }
909 
910  vlib_buffer_advance (b[0], 0LL - hdr_len);
911 
912  current_sa_packets += 1;
913  current_sa_bytes += payload_len_total;
914 
915  trace:
916  if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
917  {
918  esp_encrypt_trace_t *tr = vlib_add_trace (vm, node, b[0],
919  sizeof (*tr));
920  tr->sa_index = sa_index0;
921  tr->spi = sa0->spi;
922  tr->seq = sa0->seq;
923  tr->sa_seq_hi = sa0->seq_hi;
924  tr->udp_encap = ipsec_sa_is_set_UDP_ENCAP (sa0);
925  tr->crypto_alg = sa0->crypto_alg;
926  tr->integ_alg = sa0->integ_alg;
927  }
928  /* next */
929  n_left -= 1;
930  next += 1;
931  b += 1;
932  }
933 
935  current_sa_index, current_sa_packets,
936  current_sa_bytes);
937  if (!is_async)
938  {
939  esp_process_ops (vm, node, ptd->crypto_ops, bufs, nexts, drop_next);
940  esp_process_chained_ops (vm, node, ptd->chained_crypto_ops, bufs, nexts,
941  ptd->chunks, drop_next);
942 
943  esp_process_ops (vm, node, ptd->integ_ops, bufs, nexts, drop_next);
944  esp_process_chained_ops (vm, node, ptd->chained_integ_ops, bufs, nexts,
945  ptd->chunks, drop_next);
946  }
947  else if (async_frame && async_frame->n_elts)
948  {
949  if (vnet_crypto_async_submit_open_frame (vm, async_frame) < 0)
950  esp_async_recycle_failed_submit (async_frame, b, next, drop_next);
951  }
952 
954  ESP_ENCRYPT_ERROR_RX_PKTS, frame->n_vectors);
955 
956  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
957  return frame->n_vectors;
958 }
959 
963 {
964  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
965  u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
966  u32 *from = vlib_frame_vector_args (frame);
967  u32 n_left = frame->n_vectors;
968 
969  vlib_get_buffers (vm, from, b, n_left);
970 
971  if (n_left >= 4)
972  {
973  vlib_prefetch_buffer_header (b[0], LOAD);
974  vlib_prefetch_buffer_header (b[1], LOAD);
975  vlib_prefetch_buffer_header (b[2], LOAD);
976  vlib_prefetch_buffer_header (b[3], LOAD);
977  }
978 
979  while (n_left > 8)
980  {
981  vlib_prefetch_buffer_header (b[4], LOAD);
982  vlib_prefetch_buffer_header (b[5], LOAD);
983  vlib_prefetch_buffer_header (b[6], LOAD);
984  vlib_prefetch_buffer_header (b[7], LOAD);
985 
986  next[0] = (esp_post_data (b[0]))->next_index;
987  next[1] = (esp_post_data (b[1]))->next_index;
988  next[2] = (esp_post_data (b[2]))->next_index;
989  next[3] = (esp_post_data (b[3]))->next_index;
990 
992  {
993  if (b[0]->flags & VLIB_BUFFER_IS_TRACED)
994  {
995  esp_encrypt_post_trace_t *tr = vlib_add_trace (vm, node, b[0],
996  sizeof (*tr));
997  tr->next_index = next[0];
998  }
999  if (b[1]->flags & VLIB_BUFFER_IS_TRACED)
1000  {
1001  esp_encrypt_post_trace_t *tr = vlib_add_trace (vm, node, b[1],
1002  sizeof (*tr));
1003  tr->next_index = next[1];
1004  }
1005  if (b[2]->flags & VLIB_BUFFER_IS_TRACED)
1006  {
1007  esp_encrypt_post_trace_t *tr = vlib_add_trace (vm, node, b[2],
1008  sizeof (*tr));
1009  tr->next_index = next[2];
1010  }
1011  if (b[3]->flags & VLIB_BUFFER_IS_TRACED)
1012  {
1013  esp_encrypt_post_trace_t *tr = vlib_add_trace (vm, node, b[3],
1014  sizeof (*tr));
1015  tr->next_index = next[3];
1016  }
1017  }
1018 
1019  b += 4;
1020  next += 4;
1021  n_left -= 4;
1022  }
1023 
1024  while (n_left > 0)
1025  {
1026  next[0] = (esp_post_data (b[0]))->next_index;
1027  if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
1028  {
1029  esp_encrypt_post_trace_t *tr = vlib_add_trace (vm, node, b[0],
1030  sizeof (*tr));
1031  tr->next_index = next[0];
1032  }
1033 
1034  b += 1;
1035  next += 1;
1036  n_left -= 1;
1037  }
1038 
1040  ESP_ENCRYPT_ERROR_POST_RX_PKTS,
1041  frame->n_vectors);
1042  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
1043  return frame->n_vectors;
1044 }
1045 
1048  vlib_frame_t * from_frame)
1049 {
1050  return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 0,
1052 }
1053 
1054 /* *INDENT-OFF* */
1056  .name = "esp4-encrypt",
1057  .vector_size = sizeof (u32),
1058  .format_trace = format_esp_encrypt_trace,
1060 
1061  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
1062  .error_strings = esp_encrypt_error_strings,
1063 
1064  .n_next_nodes = ESP_ENCRYPT_N_NEXT,
1065  .next_nodes = {
1066  [ESP_ENCRYPT_NEXT_DROP4] = "ip4-drop",
1067  [ESP_ENCRYPT_NEXT_DROP6] = "ip6-drop",
1068  [ESP_ENCRYPT_NEXT_HANDOFF4] = "esp4-encrypt-handoff",
1069  [ESP_ENCRYPT_NEXT_HANDOFF6] = "esp6-encrypt-handoff",
1070  [ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "interface-output",
1071  [ESP_ENCRYPT_NEXT_PENDING] = "esp-encrypt-pending",
1072  },
1073 };
1074 /* *INDENT-ON* */
1075 
1078  vlib_frame_t * from_frame)
1079 {
1080  return esp_encrypt_post_inline (vm, node, from_frame);
1081 }
1082 
1083 /* *INDENT-OFF* */
1085  .name = "esp4-encrypt-post",
1086  .vector_size = sizeof (u32),
1087  .format_trace = format_esp_post_encrypt_trace,
1089  .sibling_of = "esp4-encrypt",
1090 
1091  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
1092  .error_strings = esp_encrypt_error_strings,
1093 };
1094 /* *INDENT-ON* */
1095 
1098  vlib_frame_t * from_frame)
1099 {
1100  return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 0,
1102 }
1103 
1104 /* *INDENT-OFF* */
1106  .name = "esp6-encrypt",
1107  .vector_size = sizeof (u32),
1108  .format_trace = format_esp_encrypt_trace,
1110  .sibling_of = "esp4-encrypt",
1111 
1112  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
1113  .error_strings = esp_encrypt_error_strings,
1114 };
1115 /* *INDENT-ON* */
1116 
1119  vlib_frame_t * from_frame)
1120 {
1121  return esp_encrypt_post_inline (vm, node, from_frame);
1122 }
1123 
1124 /* *INDENT-OFF* */
1126  .name = "esp6-encrypt-post",
1127  .vector_size = sizeof (u32),
1128  .format_trace = format_esp_post_encrypt_trace,
1130  .sibling_of = "esp4-encrypt",
1131 
1132  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
1133  .error_strings = esp_encrypt_error_strings,
1134 };
1135 /* *INDENT-ON* */
1136 
1139  vlib_frame_t * from_frame)
1140 {
1141  return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 1,
1143 }
1144 
1145 /* *INDENT-OFF* */
1147  .name = "esp4-encrypt-tun",
1148  .vector_size = sizeof (u32),
1149  .format_trace = format_esp_encrypt_trace,
1151 
1152  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
1153  .error_strings = esp_encrypt_error_strings,
1154 
1155  .n_next_nodes = ESP_ENCRYPT_N_NEXT,
1156  .next_nodes = {
1157  [ESP_ENCRYPT_NEXT_DROP4] = "ip4-drop",
1158  [ESP_ENCRYPT_NEXT_DROP6] = "ip6-drop",
1159  [ESP_ENCRYPT_NEXT_HANDOFF4] = "esp4-encrypt-tun-handoff",
1160  [ESP_ENCRYPT_NEXT_HANDOFF6] = "error-drop",
1161  [ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "adj-midchain-tx",
1162  [ESP_ENCRYPT_NEXT_PENDING] = "esp-encrypt-pending",
1163  },
1164 };
1165 
1168  vlib_frame_t * from_frame)
1169 {
1170  return esp_encrypt_post_inline (vm, node, from_frame);
1171 }
1172 
1173 /* *INDENT-OFF* */
1175  .name = "esp4-encrypt-tun-post",
1176  .vector_size = sizeof (u32),
1177  .format_trace = format_esp_post_encrypt_trace,
1179  .sibling_of = "esp4-encrypt-tun",
1180 
1181  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
1182  .error_strings = esp_encrypt_error_strings,
1183 };
1184 /* *INDENT-ON* */
1185 
1188  vlib_frame_t * from_frame)
1189 {
1190  return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 1,
1192 }
1193 
1194 /* *INDENT-OFF* */
1196  .name = "esp6-encrypt-tun",
1197  .vector_size = sizeof (u32),
1198  .format_trace = format_esp_encrypt_trace,
1200 
1201  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
1202  .error_strings = esp_encrypt_error_strings,
1203 
1204  .n_next_nodes = ESP_ENCRYPT_N_NEXT,
1205  .next_nodes = {
1206  [ESP_ENCRYPT_NEXT_DROP4] = "ip4-drop",
1207  [ESP_ENCRYPT_NEXT_DROP6] = "ip6-drop",
1208  [ESP_ENCRYPT_NEXT_HANDOFF4] = "error-drop",
1209  [ESP_ENCRYPT_NEXT_HANDOFF6] = "esp6-encrypt-tun-handoff",
1210  [ESP_ENCRYPT_NEXT_PENDING] = "esp-encrypt-pending",
1211  [ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "adj-midchain-tx",
1212  },
1213 };
1214 
1215 /* *INDENT-ON* */
1216 
1219  vlib_frame_t * from_frame)
1220 {
1221  return esp_encrypt_post_inline (vm, node, from_frame);
1222 }
1223 
1224 /* *INDENT-OFF* */
1226  .name = "esp6-encrypt-tun-post",
1227  .vector_size = sizeof (u32),
1228  .format_trace = format_esp_post_encrypt_trace,
1230  .sibling_of = "esp6-encrypt-tun",
1231 
1232  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
1233  .error_strings = esp_encrypt_error_strings,
1234 };
1235 /* *INDENT-ON* */
1236 
1237 typedef struct
1238 {
1241 
1242 static u8 *
1243 format_esp_no_crypto_trace (u8 * s, va_list * args)
1244 {
1245  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
1246  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
1247  esp_no_crypto_trace_t *t = va_arg (*args, esp_no_crypto_trace_t *);
1248 
1249  s = format (s, "esp-no-crypto: sa-index %u", t->sa_index);
1250 
1251  return s;
1252 }
1253 
1254 enum
1255 {
1258 };
1259 
1260 enum
1261 {
1263 };
1264 
1266  "Outbound ESP packets received",
1267 };
1268 
1271  vlib_frame_t * frame)
1272 {
1273  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b = bufs;
1274  u32 *from = vlib_frame_vector_args (frame);
1275  u32 n_left = frame->n_vectors;
1276 
1277  vlib_get_buffers (vm, from, b, n_left);
1278 
1279  while (n_left > 0)
1280  {
1281  u32 sa_index0;
1282 
1283  /* packets are always going to be dropped, but get the sa_index */
1284  sa_index0 = ipsec_tun_protect_get_sa_out
1285  (vnet_buffer (b[0])->ip.adj_index[VLIB_TX]);
1286 
1287  if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
1288  {
1289  esp_no_crypto_trace_t *tr = vlib_add_trace (vm, node, b[0],
1290  sizeof (*tr));
1291  tr->sa_index = sa_index0;
1292  }
1293 
1294  n_left -= 1;
1295  b += 1;
1296  }
1297 
1300 
1301  vlib_buffer_enqueue_to_single_next (vm, node, from,
1303  frame->n_vectors);
1304 
1305  return frame->n_vectors;
1306 }
1307 
1310  vlib_frame_t * from_frame)
1311 {
1312  return esp_no_crypto_inline (vm, node, from_frame);
1313 }
1314 
1315 /* *INDENT-OFF* */
1317 {
1318  .name = "esp4-no-crypto",
1319  .vector_size = sizeof (u32),
1320  .format_trace = format_esp_no_crypto_trace,
1322  .error_strings = esp_no_crypto_error_strings,
1323  .n_next_nodes = ESP_NO_CRYPTO_N_NEXT,
1324  .next_nodes = {
1325  [ESP_NO_CRYPTO_NEXT_DROP] = "ip4-drop",
1326  },
1327 };
1328 
1331  vlib_frame_t * from_frame)
1332 {
1333  return esp_no_crypto_inline (vm, node, from_frame);
1334 }
1335 
1336 /* *INDENT-OFF* */
1338 {
1339  .name = "esp6-no-crypto",
1340  .vector_size = sizeof (u32),
1341  .format_trace = format_esp_no_crypto_trace,
1343  .error_strings = esp_no_crypto_error_strings,
1344  .n_next_nodes = ESP_NO_CRYPTO_N_NEXT,
1345  .next_nodes = {
1346  [ESP_NO_CRYPTO_NEXT_DROP] = "ip6-drop",
1347  },
1348 };
1349 /* *INDENT-ON* */
1350 
1353  vlib_frame_t * from_frame)
1354 {
1355  return from_frame->n_vectors;
1356 }
1357 
1358 /* *INDENT-OFF* */
1360  .name = "esp-encrypt-pending",
1361  .vector_size = sizeof (u32),
1363 
1364  .n_next_nodes = 0
1365 };
1366 /* *INDENT-ON* */
1367 
1368 /*
1369  * fd.io coding-style-patch-verification: ON
1370  *
1371  * Local Variables:
1372  * eval: (c-set-style "gnu")
1373  * End:
1374  */
u32 vnet_crypto_process_ops(vlib_main_t *vm, vnet_crypto_op_t ops[], u32 n_ops)
Definition: crypto.c:99
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
u32 spi
u8 * format_ipsec_integ_alg(u8 *s, va_list *args)
Definition: ipsec_format.c:110
#define esp_post_data(b)
Definition: esp.h:179
static_always_inline int vnet_crypto_async_add_to_frame(vlib_main_t *vm, vnet_crypto_async_frame_t **frame, u32 key_index, u32 crypto_len, i16 integ_len_adj, i16 crypto_start_offset, u16 integ_start_offset, u32 buffer_index, u16 next_node, u8 *iv, u8 *tag, u8 *aad, u8 flags)
Definition: crypto.h:571
static vlib_cli_command_t trace
(constructor) VLIB_CLI_COMMAND (trace)
Definition: vlib_api_cli.c:899
static u8 * vlib_buffer_get_tail(vlib_buffer_t *b)
Get pointer to the end of buffer&#39;s data.
Definition: buffer.h:310
#define clib_min(x, y)
Definition: clib.h:319
#define CLIB_UNUSED(x)
Definition: clib.h:86
static_always_inline void vnet_crypto_async_reset_frame(vnet_crypto_async_frame_t *f)
Definition: crypto.h:615
ipsec_per_thread_data_t * ptd
Definition: ipsec.h:185
vnet_crypto_op_t * integ_ops
Definition: ipsec.h:96
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
Definition: counter.h:220
static_always_inline u8 esp_get_ip6_hdr_len(ip6_header_t *ip6, ip6_ext_header_t **ext_hdr)
Definition: esp_encrypt.c:210
static char * esp_no_crypto_error_strings[]
Definition: esp_encrypt.c:1265
static u16 esp_aad_fill(u8 *data, const esp_header_t *esp, const ipsec_sa_t *sa)
Definition: esp.h:109
#define PREDICT_TRUE(x)
Definition: clib.h:119
ipsec_integ_alg_t
Definition: ipsec_sa.h:59
esp_encrypt_next_t
Definition: esp_encrypt.c:38
unsigned long u64
Definition: types.h:89
#define clib_memcpy_fast(a, b, c)
Definition: string.h:81
#define VNET_CRYPTO_OP_FLAG_CHAINED_BUFFERS
Definition: crypto.h:237
static u32 ipsec_sa_assign_thread(u32 thread_id)
Definition: ipsec_sa.h:490
#define vec_add2_aligned(V, P, N, A)
Add N elements to end of vector V, return pointer to new elements in P.
Definition: vec.h:640
vlib_node_registration_t esp_encrypt_pending_node
(constructor) VLIB_REGISTER_NODE (esp_encrypt_pending_node)
Definition: esp_encrypt.c:1359
u32 esp6_post_next
Definition: esp.h:195
ipsec_integ_alg_t integ_alg
Definition: ipsec_sa.h:171
u32 thread_index
Definition: main.h:218
u16 current_length
Nbytes between current data and the end of this buffer.
Definition: buffer.h:113
vnet_crypto_op_t * crypto_ops
Definition: ipsec.h:95
struct esp_aead_t_ esp_aead_t
AES GCM Additional Authentication data.
static heap_elt_t * last(heap_header_t *h)
Definition: heap.c:53
static void * ip6_ext_next_header(ip6_ext_header_t *ext_hdr)
Definition: ip6_packet.h:513
#define vec_add2(V, P, N)
Add N elements to end of vector V, return pointer to new elements in P.
Definition: vec.h:628
static u8 * format_esp_encrypt_trace(u8 *s, va_list *args)
Definition: esp_encrypt.c:85
ipsec_integ_alg_t integ_alg
Definition: esp_encrypt.c:76
uword ip_csum_t
Definition: ip_packet.h:244
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
ipsec_crypto_alg_t crypto_alg
Definition: esp_encrypt.c:75
#define VLIB_NODE_FN(node)
Definition: node.h:202
vnet_crypto_op_chunk_t * chunks
Definition: ipsec.h:99
static_always_inline void esp_process_chained_ops(vlib_main_t *vm, vlib_node_runtime_t *node, vnet_crypto_op_t *ops, vlib_buffer_t *b[], u16 *nexts, vnet_crypto_op_chunk_t *chunks, u16 drop_next)
Definition: esp_encrypt.c:238
vlib_error_t * errors
Vector of errors for this node.
Definition: node.h:472
vnet_crypto_op_id_t integ_op_id
Definition: ipsec_sa.h:139
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
Definition: buffer_funcs.h:402
unsigned char u8
Definition: types.h:56
vlib_node_registration_t esp4_encrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp4_encrypt_tun_node)
Definition: esp_encrypt.c:1146
#define vec_reset_length(v)
Reset vector length to zero NULL-pointer tolerant.
u32 seq_hi
Definition: ipsec_sa.h:122
static_always_inline int esp_prepare_async_frame(vlib_main_t *vm, ipsec_per_thread_data_t *ptd, vnet_crypto_async_frame_t **async_frame, ipsec_sa_t *sa, vlib_buffer_t *b, esp_header_t *esp, u8 *payload, u32 payload_len, u8 iv_sz, u8 icv_sz, u32 bi, u16 *next, u32 hdr_len, u16 async_next, vlib_buffer_t *lb)
Definition: esp_encrypt.c:474
static int esp_seq_advance(ipsec_sa_t *sa)
Definition: esp.h:84
vnet_crypto_key_index_t linked_key_index
Definition: ipsec_sa.h:146
vnet_crypto_key_index_t crypto_key_index
Definition: ipsec_sa.h:128
vl_api_ip_proto_t protocol
Definition: lb_types.api:71
static uword esp_no_crypto_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: esp_encrypt.c:1270
#define static_always_inline
Definition: clib.h:106
#define foreach_esp_encrypt_next
Definition: esp_encrypt.c:29
static_always_inline void esp_async_recycle_failed_submit(vnet_crypto_async_frame_t *f, vlib_buffer_t **b, u16 *next, u16 drop_next)
Definition: esp_encrypt.c:561
ipsec_main_t ipsec_main
Definition: ipsec.c:28
static u8 * format_esp_post_encrypt_trace(u8 *s, va_list *args)
Definition: esp_encrypt.c:102
vl_api_ip6_address_t ip6
Definition: one.api:424
u32 esp4_tun_post_next
Definition: esp.h:196
static_always_inline void esp_fill_udp_hdr(ipsec_sa_t *sa, udp_header_t *udp, u16 len)
Definition: esp_encrypt.c:185
#define vlib_prefetch_buffer_header(b, type)
Prefetch buffer metadata.
Definition: buffer.h:203
static_always_inline void vnet_crypto_op_init(vnet_crypto_op_t *op, vnet_crypto_op_id_t type)
Definition: crypto.h:483
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
static_always_inline void vlib_buffer_enqueue_to_single_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 next_index, u32 count)
Definition: buffer_node.h:459
static_always_inline u8 ext_hdr_is_pre_esp(u8 nexthdr)
Definition: esp_encrypt.c:192
u8 * format_ipsec_crypto_alg(u8 *s, va_list *args)
Definition: ipsec_format.c:78
u32 salt
unsigned int u32
Definition: types.h:88
static const u8 pad_data[]
Definition: ipsec.h:176
#define VLIB_FRAME_SIZE
Definition: node.h:380
STATIC_ASSERT_SIZEOF(esp_gcm_nonce_t, 12)
bool is_ip6
Definition: ip.api:43
static u8 * format_esp_no_crypto_trace(u8 *s, va_list *args)
Definition: esp_encrypt.c:1243
vl_api_fib_path_type_t type
Definition: fib_types.api:123
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
static_always_inline u32 esp_encrypt_chain_integ(vlib_main_t *vm, ipsec_per_thread_data_t *ptd, ipsec_sa_t *sa0, vlib_buffer_t *b, vlib_buffer_t *lb, u8 icv_sz, u8 *start, u32 start_len, u8 *digest, u16 *n_ch)
Definition: esp_encrypt.c:340
vlib_node_registration_t esp6_encrypt_node
(constructor) VLIB_REGISTER_NODE (esp6_encrypt_node)
Definition: esp_encrypt.c:1105
static u32 vlib_buffer_chain_linearize(vlib_main_t *vm, vlib_buffer_t *b)
The identity of a DPO is a combination of its type and its instance number/index of objects of that t...
Definition: dpo.h:170
u32 encrypt_thread_index
Definition: ipsec_sa.h:118
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:534
vlib_node_registration_t esp6_encrypt_tun_node
(constructor) VLIB_REGISTER_NODE (esp6_encrypt_tun_node)
Definition: esp_encrypt.c:1195
static u8 iv[]
Definition: aes_cbc.c:24
static index_t ipsec_tun_protect_get_sa_out(adj_index_t ai)
Definition: ipsec_tun.h:159
uword user_data
Definition: crypto.h:231
u32 salt
Definition: ipsec_sa.h:184
unsigned short u16
Definition: types.h:57
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
esp_async_post_next_t esp_encrypt_async_next
Definition: ipsec.c:29
vlib_node_registration_t esp4_no_crypto_tun_node
(constructor) VLIB_REGISTER_NODE (esp4_no_crypto_tun_node)
Definition: esp_encrypt.c:1316
#define PREDICT_FALSE(x)
Definition: clib.h:118
#define always_inline
Definition: ipsec.h:28
vl_api_ip4_address_t ip4
Definition: one.api:376
static void esp_prepare_sync_op(vlib_main_t *vm, ipsec_per_thread_data_t *ptd, vnet_crypto_op_t **crypto_ops, vnet_crypto_op_t **integ_ops, ipsec_sa_t *sa0, u8 *payload, u16 payload_len, u8 iv_sz, u8 icv_sz, vlib_buffer_t **bufs, vlib_buffer_t **b, vlib_buffer_t *lb, u32 hdr_len, esp_header_t *esp, esp_gcm_nonce_t *nonce)
Definition: esp_encrypt.c:386
u32 node_index
Node index.
Definition: node.h:498
static char * esp_encrypt_error_strings[]
Definition: esp_encrypt.c:61
vlib_main_t * vm
Definition: in2out_ed.c:1599
static_always_inline u32 esp_encrypt_chain_crypto(vlib_main_t *vm, ipsec_per_thread_data_t *ptd, ipsec_sa_t *sa0, vlib_buffer_t *b, vlib_buffer_t *lb, u8 icv_sz, u8 *start, u32 start_len, u16 *n_ch)
Definition: esp_encrypt.c:303
u32 next_index
Definition: esp_encrypt.c:80
static uword esp_encrypt_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, int is_ip6, int is_tun, u16 async_next)
Definition: esp_encrypt.c:575
static_always_inline vnet_crypto_async_frame_t * vnet_crypto_async_get_frame(vlib_main_t *vm, vnet_crypto_async_op_id_t opt)
async crypto inline functions
Definition: crypto.h:518
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1150
u8 len
Definition: ip_types.api:92
#define ip6_ext_header_len(p)
Definition: ip6_packet.h:509
vnet_crypto_op_t * chained_crypto_ops
Definition: ipsec.h:97
static_always_inline u32 vlib_buffer_get_default_data_size(vlib_main_t *vm)
Definition: buffer_funcs.h:96
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
u32 flags
Definition: vhost_user.h:248
u16 n_vectors
Definition: node.h:399
#define VNET_CRYPTO_OP_FLAG_INIT_IV
Definition: crypto.h:235
#define CLIB_PREFETCH(addr, size, type)
Definition: cache.h:80
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
Definition: buffer_node.h:339
vlib_node_registration_t esp6_no_crypto_tun_node
(constructor) VLIB_REGISTER_NODE (esp6_no_crypto_tun_node)
Definition: esp_encrypt.c:1337
vlib_node_registration_t esp4_encrypt_node
(constructor) VLIB_REGISTER_NODE (esp4_encrypt_node)
Definition: esp_encrypt.c:1055
u8 data[]
Packet data.
Definition: buffer.h:181
udp_header_t udp_hdr
Definition: ipsec_sa.h:160
#define ARRAY_LEN(x)
Definition: clib.h:66
static uword round_pow2(uword x, uword pow2)
Definition: clib.h:256
vlib_node_registration_t esp4_encrypt_post_node
(constructor) VLIB_REGISTER_NODE (esp4_encrypt_post_node)
Definition: esp_encrypt.c:1084
vlib_node_registration_t esp6_encrypt_post_node
(constructor) VLIB_REGISTER_NODE (esp6_encrypt_post_node)
Definition: esp_encrypt.c:1125
vlib_node_registration_t esp6_encrypt_tun_post_node
(constructor) VLIB_REGISTER_NODE (esp6_encrypt_tun_post_node)
Definition: esp_encrypt.c:1225
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1599
u32 esp4_post_next
Definition: esp.h:194
#define ESP_MAX_BLOCK_SIZE
Definition: esp.h:76
#define clib_atomic_cmp_and_swap(addr, old, new)
Definition: atomics.h:37
u32 esp6_tun_post_next
Definition: esp.h:197
Definition: esp_encrypt.c:78
static uword esp_encrypt_post_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: esp_encrypt.c:961
vlib_combined_counter_main_t ipsec_sa_counters
SA packet & bytes counters.
Definition: ipsec_sa.c:27
#define ASSERT(truth)
u32 vnet_crypto_process_chained_ops(vlib_main_t *vm, vnet_crypto_op_t ops[], vnet_crypto_op_chunk_t *chunks, u32 n_ops)
Definition: crypto.c:105
ip6_header_t ip6_hdr
Definition: ipsec_sa.h:158
ipsec_sa_t * sad
Definition: ipsec.h:107
esp_encrypt_error_t
Definition: esp_encrypt.c:54
static_always_inline void esp_update_ip4_hdr(ip4_header_t *ip4, u16 len, int is_transport, int is_udp)
Definition: esp_encrypt.c:159
static_always_inline void esp_process_ops(vlib_main_t *vm, vlib_node_runtime_t *node, vnet_crypto_op_t *ops, vlib_buffer_t *b[], u16 *nexts, u16 drop_next)
Definition: esp_encrypt.c:267
u32 seq
Definition: esp.h:29
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:248
vnet_crypto_async_op_id_t
Definition: crypto.h:156
u32 spi
Definition: esp.h:26
vnet_crypto_key_index_t integ_key_index
Definition: ipsec_sa.h:129
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace_funcs.h:55
static_always_inline int vnet_crypto_async_submit_open_frame(vlib_main_t *vm, vnet_crypto_async_frame_t *frame)
Definition: crypto.h:547
u16 next_index
Definition: esp.h:171
static_always_inline void clib_memcpy_le64(u8 *dst, u8 *src, u8 len)
Definition: string.h:283
Definition: defs.h:47
u16 payload_length
Definition: ip6_packet.h:301
index_t dpoi_index
the index of objects of that type
Definition: dpo.h:186
vl_api_address_t ip
Definition: l2.api:501
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
u32 next_buffer
Next buffer for this linked-list of buffers.
Definition: buffer.h:140
VLIB buffer representation.
Definition: buffer.h:102
u64 uword
Definition: types.h:112
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:244
ipsec_crypto_alg_t
Definition: ipsec_sa.h:37
#define ip_csum_update(sum, old, new, type, field)
Definition: ip_packet.h:294
u64 gcm_iv_counter
Definition: ipsec_sa.h:185
vnet_crypto_op_id_t crypto_enc_op_id
Definition: ipsec_sa.h:137
vnet_crypto_op_t * chained_integ_ops
Definition: ipsec.h:98
vnet_crypto_op_status_t status
Definition: crypto.h:233
#define vnet_buffer(b)
Definition: buffer.h:417
dpo_id_t dpo
Definition: ipsec_sa.h:126
ipsec_crypto_alg_t crypto_alg
Definition: ipsec_sa.h:167
vlib_node_registration_t esp4_encrypt_tun_post_node
(constructor) VLIB_REGISTER_NODE (esp4_encrypt_tun_post_node)
Definition: esp_encrypt.c:1174
vnet_crypto_async_op_id_t crypto_async_enc_op_id
Definition: ipsec_sa.h:144
ip4_header_t ip4_hdr
Definition: ipsec_sa.h:157
u8 crypto_block_size
Definition: ipsec_sa.h:116
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
Definition: in2out_ed.c:1600
u16 flags
Copy of main node flags.
Definition: node.h:511
u16 dpoi_next_node
The next VLIB node to follow.
Definition: dpo.h:182
static int ip4_header_bytes(const ip4_header_t *i)
Definition: ip4_packet.h:235
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
Definition: buffer_funcs.h:280
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:304
u8 crypto_iv_size
Definition: ipsec_sa.h:115
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
static u32 vlib_buffer_alloc(vlib_main_t *vm, u32 *buffers, u32 n_buffers)
Allocate buffers into supplied array.
Definition: buffer_funcs.h:677
#define foreach_esp_encrypt_error
Definition: esp_encrypt.c:45
u8 async_mode
Definition: ipsec.h:202
u8 integ_icv_size
Definition: ipsec_sa.h:117
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
static u16 ip_csum_fold(ip_csum_t c)
Definition: ip_packet.h:300
static_always_inline u8 * esp_add_footer_and_icv(vlib_main_t *vm, vlib_buffer_t **last, u8 block_size, u8 icv_sz, u16 *next, vlib_node_runtime_t *node, u16 buffer_data_size, uword total_len)
Definition: esp_encrypt.c:114
static_always_inline void clib_memcpy_le32(u8 *dst, u8 *src, u8 len)
Definition: string.h:289
signed short i16
Definition: types.h:46
Definition: esp.h:169