27 #define foreach_ah_decrypt_next \ 28 _(DROP, "error-drop") \ 29 _(IP4_INPUT, "ip4-input") \ 30 _(IP6_INPUT, "ip6-input") \ 33 #define _(v, s) AH_DECRYPT_NEXT_##v, 41 #define foreach_ah_decrypt_error \ 42 _ (RX_PKTS, "AH pkts received") \ 43 _ (DECRYPTION_FAILED, "AH decryption failed") \ 44 _ (INTEG_ERROR, "Integrity check failed") \ 45 _ (NO_TAIL_SPACE, "not enough buffer tail space (dropped)") \ 46 _ (DROP_FRAGMENTS, "IP fragments drop") \ 47 _ (REPLAY, "SA replayed packet") 51 #define _(sym,str) AH_DECRYPT_ERROR_##sym, 58 #define _(sym,string) string, 77 s =
format (s,
"ah: integrity %U seq-num %d",
122 ASSERT (op - ops < n_ops);
124 if (op->
status != VNET_CRYPTO_OP_STATUS_COMPLETED)
127 b[bi]->
error = node->
errors[AH_DECRYPT_ERROR_INTEG_ERROR];
128 nexts[bi] = AH_DECRYPT_NEXT_DROP;
151 u32 current_sa_index = ~0, current_sa_bytes = 0, current_sa_pkts = 0;
164 if (
vnet_buffer (b[0])->ipsec.sad_index != current_sa_index)
166 if (current_sa_index != ~0)
171 current_sa_index =
vnet_buffer (b[0])->ipsec.sad_index;
174 current_sa_bytes = current_sa_pkts = 0;
176 thread_index, current_sa_index);
190 next[0] = AH_DECRYPT_NEXT_HANDOFF;
202 ip6_ext_header_t *prev = NULL;
212 b[0]->
error = node->
errors[AH_DECRYPT_ERROR_DROP_FRAGMENTS];
213 next[0] = AH_DECRYPT_NEXT_DROP;
220 pd->
seq = clib_host_to_net_u32 (ah0->
seq_no);
225 b[0]->
error = node->
errors[AH_DECRYPT_ERROR_REPLAY];
226 next[0] = AH_DECRYPT_NEXT_DROP;
231 current_sa_pkts += 1;
239 + sizeof (
u32) > buffer_data_size))
241 b[0]->
error = node->
errors[AH_DECRYPT_ERROR_NO_TAIL_SPACE];
242 next[0] = AH_DECRYPT_NEXT_DROP;
250 op->
src = (
u8 *) ih4;
257 if (ipsec_sa_is_set_USE_ESN (sa0))
259 u32 seq_hi = clib_host_to_net_u32 (sa0->
seq_hi);
261 op->
len +=
sizeof (seq_hi);
306 current_sa_index, current_sa_pkts,
326 b[0]->
error = node->
errors[AH_DECRYPT_ERROR_REPLAY];
327 next[0] = AH_DECRYPT_NEXT_DROP;
336 b[0]->
flags |= VLIB_BUFFER_TOTAL_LENGTH_VALID;
341 next[0] = AH_DECRYPT_NEXT_IP4_INPUT;
343 next[0] = AH_DECRYPT_NEXT_IP6_INPUT;
346 b[0]->
error = node->
errors[AH_DECRYPT_ERROR_DECRYPTION_FAILED];
347 next[0] = AH_DECRYPT_NEXT_DROP;
364 next[0] = AH_DECRYPT_NEXT_IP6_INPUT;
384 next[0] = AH_DECRYPT_NEXT_IP4_INPUT;
430 .name =
"ah4-decrypt",
431 .vector_size =
sizeof (
u32),
440 [AH_DECRYPT_NEXT_DROP] =
"ip4-drop",
441 [AH_DECRYPT_NEXT_IP4_INPUT] =
"ip4-input-no-checksum",
442 [AH_DECRYPT_NEXT_IP6_INPUT] =
"ip6-input",
443 [AH_DECRYPT_NEXT_HANDOFF] =
"ah4-decrypt-handoff",
457 .name =
"ah6-decrypt",
458 .vector_size =
sizeof (
u32),
467 [AH_DECRYPT_NEXT_DROP] =
"ip6-drop",
468 [AH_DECRYPT_NEXT_IP4_INPUT] =
"ip4-input-no-checksum",
469 [AH_DECRYPT_NEXT_IP6_INPUT] =
"ip6-input",
470 [AH_DECRYPT_NEXT_HANDOFF] =
"ah6-decrypt-handoff",
u32 vnet_crypto_process_ops(vlib_main_t *vm, vnet_crypto_op_t ops[], u32 n_ops)
static char * ah_decrypt_error_strings[]
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
static vlib_cli_command_t trace
(constructor) VLIB_CLI_COMMAND (trace)
ipsec_per_thread_data_t * ptd
vnet_crypto_op_t * integ_ops
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
i16 current_data
signed offset in data[], pre_data[] that we are currently processing.
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
static u32 ipsec_sa_assign_thread(u32 thread_id)
#define vec_add2_aligned(V, P, N, A)
Add N elements to end of vector V, return pointer to new elements in P.
ipsec_integ_alg_t integ_alg
u16 current_length
Nbytes between current data and the end of this buffer.
static uword ah_decrypt_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *from_frame, int is_ip6)
#define VLIB_NODE_FN(node)
vlib_error_t * errors
Vector of errors for this node.
vnet_crypto_op_id_t integ_op_id
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
#define vec_reset_length(v)
Reset vector length to zero NULL-pointer tolerant.
static int ip4_is_fragment(const ip4_header_t *i)
#define clib_memcpy(d, s, n)
vlib_node_registration_t ah6_decrypt_node
(constructor) VLIB_REGISTER_NODE (ah6_decrypt_node)
#define static_always_inline
u32 ip_version_traffic_class_and_flow_label
static_always_inline void vnet_crypto_op_init(vnet_crypto_op_t *op, vnet_crypto_op_id_t type)
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
static u8 * format_ah_decrypt_trace(u8 *s, va_list *args)
static void * ip6_ext_header_find(vlib_main_t *vm, vlib_buffer_t *b, ip6_header_t *ip6_header, u8 header_type, ip6_ext_header_t **prev_ext_header)
static u8 ah_calc_icv_padding_len(u8 icv_size, int is_ipv6)
vl_api_fib_path_type_t type
vlib_error_t error
Error code for buffers to be enqueued to error handler.
#define foreach_ah_decrypt_error
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
static void ipsec_sa_anti_replay_advance(ipsec_sa_t *sa, u32 seq)
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
static void vlib_prefetch_combined_counter(const vlib_combined_counter_main_t *cm, u32 thread_index, u32 index)
Pre-fetch a per-thread combined counter for the given object index.
u32 node_index
Node index.
#define VNET_CRYPTO_OP_FLAG_HMAC_CHECK
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
static_always_inline u32 vlib_buffer_get_default_data_size(vlib_main_t *vm)
#define VLIB_REGISTER_NODE(x,...)
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
vlib_node_registration_t ah4_decrypt_node
(constructor) VLIB_REGISTER_NODE (ah4_decrypt_node)
static_always_inline void ah_process_ops(vlib_main_t *vm, vlib_node_runtime_t *node, vnet_crypto_op_t *ops, vlib_buffer_t *b[], u16 *nexts)
vlib_main_t vlib_node_runtime_t * node
#define foreach_ah_decrypt_next
#define clib_atomic_cmp_and_swap(addr, old, new)
vlib_combined_counter_main_t ipsec_sa_counters
SA packet & bytes counters.
static int ipsec_sa_anti_replay_check(ipsec_sa_t *sa, u32 seq)
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
vnet_crypto_key_index_t integ_key_index
static void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
static_always_inline void clib_memset_u16(void *p, u16 val, uword count)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
VLIB buffer representation.
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
vnet_crypto_op_status_t status
static int ip4_header_bytes(const ip4_header_t *i)
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
#define CLIB_CACHE_LINE_BYTES
ipsec_integ_alg_t integ_alg
static u16 ip4_header_checksum(ip4_header_t *i)