diff options
| author |   Maxime Peim <mpeim@cisco.com> | 2022-12-22 11:26:57 +0000 |
|---|---|---|
| committer |   Beno�t Ganne <bganne@cisco.com> | 2023-10-30 15:23:13 +0000 |
| commit | 0e2f188f7c9872d7c946c14d785c6dc7c7c68847 (patch) | |
| tree | 1adc39db5e2e0e243811c8ce001d0bd056c0402e /src/vnet/ipsec/ipsec_sa.c | |
| parent | 21922cec7339f48989f230248de36a98816c4b1b (diff) | |
ipsec: huge anti-replay window support
Type: improvement
Since RFC4303 does not specify the anti-replay window size, VPP should
support multiple window size. It is done through a clib_bitmap.
Signed-off-by: Maxime Peim <mpeim@cisco.com>
Change-Id: I3dfe30efd20018e345418bef298ec7cec19b1cfc
Diffstat (limited to 'src/vnet/ipsec/ipsec_sa.c')
| -rw-r--r-- | src/vnet/ipsec/ipsec_sa.c | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c index 98160cde389..1656b9aa0cc 100644 --- a/src/vnet/ipsec/ipsec_sa.c +++ b/src/vnet/ipsec/ipsec_sa.c @@ -329,7 +329,8 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 salt, u16 src_port, - u16 dst_port, const tunnel_t *tun, u32 *sa_out_index) + u16 dst_port, u32 anti_replay_window_size, + const tunnel_t *tun, u32 *sa_out_index) { vlib_main_t *vm = vlib_get_main (); ipsec_main_t *im = &ipsec_main; @@ -379,6 +380,9 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, ipsec_sa_set_crypto_alg (sa, crypto_alg); ipsec_sa_set_async_op_ids (sa); + if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) && anti_replay_window_size > 64) + ipsec_sa_set_ANTI_REPLAY_HUGE (sa); + clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key)); sa->crypto_sync_key_index = vnet_crypto_key_add ( @@ -488,6 +492,18 @@ ipsec_sa_add_and_lock (u32 id, u32 spi, ipsec_protocol_t proto, !ipsec_sa_is_set_IS_TUNNEL_V6 (sa)); } + /* window size rounded up to next power of 2 */ + if (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa)) + { + anti_replay_window_size = 1 << max_log2 (anti_replay_window_size); + sa->replay_window_huge = + clib_bitmap_set_region (0, 0, 1, anti_replay_window_size); + } + else + { + sa->replay_window = ~0; + } + hash_set (im->sa_index_by_sa_id, sa->id, sa_index); if (sa_out_index) @@ -525,6 +541,8 @@ ipsec_sa_del (ipsec_sa_t * sa) vnet_crypto_key_del (vm, sa->crypto_sync_key_index); if (sa->integ_alg != IPSEC_INTEG_ALG_NONE) vnet_crypto_key_del (vm, sa->integ_sync_key_index); + if (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa)) + clib_bitmap_free (sa->replay_window_huge); pool_put (ipsec_sa_pool, sa); } |