FD.io VPP  v21.01.1
Vector Packet Processing
esp.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef __ESP_H__
16 #define __ESP_H__
17 
18 #include <vnet/ip/ip.h>
19 #include <vnet/crypto/crypto.h>
20 #include <vnet/ipsec/ipsec.h>
21 
22 typedef struct
23 {
24  union
25  {
27  u8 spi_bytes[4];
28  };
30  u8 data[0];
31 } esp_header_t;
32 
33 typedef struct
34 {
37 } esp_footer_t;
38 
39 /* *INDENT-OFF* */
40 typedef CLIB_PACKED (struct {
42  esp_header_t esp;
43 }) ip4_and_esp_header_t;
44 /* *INDENT-ON* */
45 
46 /* *INDENT-OFF* */
47 typedef CLIB_PACKED (struct {
49  udp_header_t udp;
50  esp_header_t esp;
51 }) ip4_and_udp_and_esp_header_t;
52 /* *INDENT-ON* */
53 
54 /* *INDENT-OFF* */
55 typedef CLIB_PACKED (struct {
57  esp_header_t esp;
58 }) ip6_and_esp_header_t;
59 /* *INDENT-ON* */
60 
61 /**
62  * AES GCM Additional Authentication data
63  */
64 typedef struct esp_aead_t_
65 {
66  /**
67  * for GCM: when using ESN it's:
68  * SPI, seq-hi, seg-low
69  * else
70  * SPI, seq-low
71  */
72  u32 data[3];
73 } __clib_packed esp_aead_t;
74 
75 #define ESP_SEQ_MAX (4294967295UL)
76 #define ESP_MAX_BLOCK_SIZE (16)
77 #define ESP_MAX_IV_SIZE (16)
78 #define ESP_MAX_ICV_SIZE (32)
79 
80 u8 *format_esp_header (u8 * s, va_list * args);
81 
82 /* TODO seq increment should be atomic to be accessed by multiple workers */
83 always_inline int
85 {
86  if (PREDICT_TRUE (ipsec_sa_is_set_USE_ESN (sa)))
87  {
88  if (PREDICT_FALSE (sa->seq == ESP_SEQ_MAX))
89  {
90  if (PREDICT_FALSE (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) &&
91  sa->seq_hi == ESP_SEQ_MAX))
92  return 1;
93  sa->seq_hi++;
94  }
95  sa->seq++;
96  }
97  else
98  {
99  if (PREDICT_FALSE (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) &&
100  sa->seq == ESP_SEQ_MAX))
101  return 1;
102  sa->seq++;
103  }
104 
105  return 0;
106 }
107 
109 esp_aad_fill (u8 * data, const esp_header_t * esp, const ipsec_sa_t * sa)
110 {
111  esp_aead_t *aad;
112 
113  aad = (esp_aead_t *) data;
114  aad->data[0] = esp->spi;
115 
116  if (ipsec_sa_is_set_USE_ESN (sa))
117  {
118  /* SPI, seq-hi, seq-low */
119  aad->data[1] = (u32) clib_host_to_net_u32 (sa->seq_hi);
120  aad->data[2] = esp->seq;
121  return 12;
122  }
123  else
124  {
125  /* SPI, seq-low */
126  aad->data[1] = esp->seq;
127  return 8;
128  }
129 }
130 
131 /* Special case to drop or hand off packets for sync/async modes.
132  *
133  * Different than sync mode, async mode only enqueue drop or hand-off packets
134  * to next nodes.
135  */
136 always_inline void
137 esp_set_next_index (int is_async, u32 * from, u16 * nexts, u32 bi,
138  u16 * drop_index, u16 drop_next, u16 * next)
139 {
140  if (is_async)
141  {
142  from[*drop_index] = bi;
143  nexts[*drop_index] = drop_next;
144  *drop_index += 1;
145  }
146  else
147  next[0] = drop_next;
148 }
149 
150 /* when submitting a frame is failed, drop all buffers in the frame */
151 always_inline void
153  vlib_buffer_t ** b, u32 * from, u16 * nexts,
154  u16 * n_dropped, u16 drop_next_index,
155  vlib_error_t err)
156 {
157  u32 n_drop = f->n_elts;
158  u32 *bi = f->buffer_indices;
159  b -= n_drop;
160  while (n_drop--)
161  {
162  b[0]->error = err;
163  esp_set_next_index (1, from, nexts, bi[0], n_dropped, drop_next_index,
164  NULL);
165  bi++;
166  b++;
167  }
169 }
170 
171 /**
172  * The post data structure to for esp_encrypt/decrypt_inline to write to
173  * vib_buffer_t opaque unused field, and for post nodes to pick up after
174  * dequeue.
175  **/
176 typedef struct
177 {
178  union
179  {
180  struct
181  {
186  };
188  };
189 
197 
199 
200 /* we are forced to store the decrypt post data into 2 separate places -
201  vlib_opaque and opaque2. */
202 typedef struct
203 {
208 
209 typedef union
210 {
214 
215 STATIC_ASSERT (sizeof (esp_post_data_t) <=
217  "Custom meta-data too large for vnet_buffer_opaque_t");
218 
219 #define esp_post_data(b) \
220  ((esp_post_data_t *)((u8 *)((b)->opaque) \
221  + STRUCT_OFFSET_OF (vnet_buffer_opaque_t, unused)))
222 
225  "Custom meta-data too large for vnet_buffer_opaque2_t");
226 
227 #define esp_post_data2(b) \
228  ((esp_decrypt_packet_data2_t *)((u8 *)((b)->opaque2) \
229  + STRUCT_OFFSET_OF (vnet_buffer_opaque2_t, unused)))
230 
231 typedef struct
232 {
233  /* esp post node index for async crypto */
239 
242 
243 #endif /* __ESP_H__ */
244 
245 /*
246  * fd.io coding-style-patch-verification: ON
247  *
248  * Local Variables:
249  * eval: (c-set-style "gnu")
250  * End:
251  */
The post data structure to for esp_encrypt/decrypt_inline to write to vib_buffer_t opaque unused fiel...
Definition: esp.h:176
static_always_inline void vnet_crypto_async_reset_frame(vnet_crypto_async_frame_t *f)
Definition: crypto.h:647
static u16 esp_aad_fill(u8 *data, const esp_header_t *esp, const ipsec_sa_t *sa)
Definition: esp.h:109
#define PREDICT_TRUE(x)
Definition: clib.h:122
unsigned long u64
Definition: types.h:89
u32 esp6_post_next
Definition: esp.h:235
struct esp_aead_t_ esp_aead_t
AES GCM Additional Authentication data.
Definition: esp.h:231
u16 vlib_error_t
Definition: error.h:43
AES GCM Additional Authentication data.
Definition: esp.h:64
STATIC_ASSERT(sizeof(esp_post_data_t)<=STRUCT_SIZE_OF(vnet_buffer_opaque_t, unused), "Custom meta-data too large for vnet_buffer_opaque_t")
unsigned char u8
Definition: types.h:56
u8 data[128]
Definition: ipsec_types.api:90
u32 seq_hi
Definition: ipsec_sa.h:123
static int esp_seq_advance(ipsec_sa_t *sa)
Definition: esp.h:84
vl_api_ip6_address_t ip6
Definition: one.api:424
u32 esp4_tun_post_next
Definition: esp.h:236
u32 data[3]
for GCM: when using ESN it&#39;s: SPI, seq-hi, seg-low else SPI, seq-low
Definition: esp.h:72
const cJSON *const b
Definition: cJSON.h:255
unsigned int u32
Definition: types.h:88
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:136
static void esp_async_recycle_failed_submit(vnet_crypto_async_frame_t *f, vlib_buffer_t **b, u32 *from, u16 *nexts, u16 *n_dropped, u16 drop_next_index, vlib_error_t err)
Definition: esp.h:152
esp_async_post_next_t esp_decrypt_async_next
Definition: ipsec.c:30
typedef CLIB_PACKED(struct { ip4_header_t ip4;esp_header_t esp;}) ip4_and_esp_header_t
unsigned short u16
Definition: types.h:57
esp_async_post_next_t esp_encrypt_async_next
Definition: ipsec.c:29
#define PREDICT_FALSE(x)
Definition: clib.h:121
#define always_inline
Definition: ipsec.h:28
vl_api_ip4_address_t ip4
Definition: one.api:376
STATIC_ASSERT_SIZEOF(esp_decrypt_packet_data_t, 3 *sizeof(u64))
u32 buffer_indices[VNET_CRYPTO_FRAME_SIZE]
Definition: crypto.h:332
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
u32 esp4_post_next
Definition: esp.h:234
u32 esp6_tun_post_next
Definition: esp.h:237
u8 * format_esp_header(u8 *s, va_list *args)
Definition: esp_format.c:23
ipsec_sa_flags_t flags
Definition: esp.h:184
u32 seq
Definition: esp.h:29
#define ESP_SEQ_MAX
Definition: esp.h:75
u32 spi
Definition: esp.h:26
u16 next_index
Definition: esp.h:211
VLIB buffer representation.
Definition: buffer.h:102
esp_decrypt_packet_data_t decrypt_data
Definition: esp.h:212
#define STRUCT_SIZE_OF(t, f)
Definition: clib.h:72
vlib_buffer_t * lb
Definition: esp.h:204
static void esp_set_next_index(int is_async, u32 *from, u16 *nexts, u32 bi, u16 *drop_index, u16 drop_next, u16 *next)
Definition: esp.h:137
signed short i16
Definition: types.h:46
Definition: esp.h:209