ipsec: Fix setting the hi-sequence number for decrypt

Type: fix

two problems;
 1 - just because anti-reply is not enabled doesn't mean the high sequence
number should not be used.
   - fix, there needs to be some means to detect a wrapped packet, so we
use a window size of 2^30.
 2 - The SA object was used as a scratch pad for the high-sequence
number used during decryption. That means that once the batch has been
processed the high-sequence number used is lost. This means it is not
possible to distinguish this case:
      if (seq < IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND (tl))
	{
	  ...
	  if (post_decrypt)
	    {
	      if (hi_seq_used == sa->seq_hi)
		/* the high sequence number used to succesfully decrypt this
		 * packet is the same as the last-sequnence number of the SA.
		 * that means this packet did not cause a wrap.
		 * this packet is thus out of window and should be dropped */
		return 1;
	      else
		/* The packet decrypted with a different high sequence number
		 * to the SA, that means it is the wrap packet and should be
		 * accepted */
		return 0;
	    }
  - fix: don't use the SA as a scratch pad, use the 'packet_data' - the
same place that is used as the scratch pad for the low sequence number.

other consequences:
 - An SA doesn't have seq and last_seq, it has only seq; the sequence
numnber of the last packet tx'd or rx'd.
 - there's 64bits of space available on the SA's first cache line. move
the AES CTR mode IV there.
 - test the ESN/AR combinations to catch the bugs this fixes. This
doubles the amount of tests, but without AR on they only run for 2
seconds. In the AR tests, the time taken to wait for packets that won't
arrive is dropped from 1 to 0.2 seconds thus reducing the runtime of
these tests from 10-15 to about 5 sceonds.

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: Iaac78905289a272dc01930d70decd8109cf5e7a5

1 files changed, 132 insertions, 46 deletions

diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h
index 7827ef18084..14461ad2cdd 100644
--- a/src/vnet/ipsec/ipsec_sa.h
+++ b/src/vnet/ipsec/ipsec_sa.h
@@ -131,9 +131,8 @@ typedef struct
   u32 spi;
   u32 seq;
   u32 seq_hi;
-  u32 last_seq;
-  u32 last_seq_hi;
   u64 replay_window;
+  u64 ctr_iv_counter;
   dpo_id_t dpo;
 
   vnet_crypto_key_index_t crypto_key_index;
@@ -162,7 +161,6 @@ typedef struct
 
   CLIB_CACHE_LINE_ALIGN_MARK (cacheline1);
 
-  u64 ctr_iv_counter;
   union
   {
     ip4_header_t ip4_hdr;
@@ -312,45 +310,104 @@ extern uword unformat_ipsec_key (unformat_input_t * input, va_list * args);
  */
 #define IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND(_tl) (_tl - IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE + 1)
 
+always_inline int
+ipsec_sa_anti_replay_check (const ipsec_sa_t *sa, u32 seq)
+{
+  if (ipsec_sa_is_set_USE_ANTI_REPLAY (sa) &&
+      sa->replay_window & (1ULL << (sa->seq - seq)))
+    return 1;
+  else
+    return 0;
+}
+
 /*
  * Anti replay check.
  *  inputs need to be in host byte order.
+ *
+ * The function runs in two contexts. pre and post decrypt.
+ * Pre-decrypt it:
+ *  1 - determines if a packet is a replay - a simple check in the window
+ *  2 - returns the hi-seq number that should be used to decrypt.
+ * post-decrypt:
+ *  Checks whether the packet is a replay or falls out of window
+ *
+ * This funcion should be called even without anti-replay enabled to ensure
+ * the high sequence number is set.
  */
 always_inline int
-ipsec_sa_anti_replay_check (ipsec_sa_t * sa, u32 seq)
+ipsec_sa_anti_replay_and_sn_advance (const ipsec_sa_t *sa, u32 seq,
+				     u32 hi_seq_used, bool post_decrypt,
+				     u32 *hi_seq_req)
 {
-  u32 diff, tl, th;
-
-  if ((sa->flags & IPSEC_SA_FLAG_USE_ANTI_REPLAY) == 0)
-    return 0;
+  ASSERT ((post_decrypt == false) == (hi_seq_req != 0));
 
   if (!ipsec_sa_is_set_USE_ESN (sa))
     {
-      if (PREDICT_TRUE (seq > sa->last_seq))
+      if (hi_seq_req)
+	/* no ESN, therefore the hi-seq is always 0 */
+	*hi_seq_req = 0;
+
+      if (!ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
 	return 0;
 
-      diff = sa->last_seq - seq;
+      if (PREDICT_TRUE (seq > sa->seq))
+	return 0;
+
+      u32 diff = sa->seq - seq;
 
       if (IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE > diff)
-	return (sa->replay_window & (1ULL << diff)) ? 1 : 0;
+	return ((sa->replay_window & (1ULL << diff)) ? 1 : 0);
       else
 	return 1;
 
       return 0;
     }
 
-  tl = sa->last_seq;
-  th = sa->last_seq_hi;
-  diff = tl - seq;
-
-  if (PREDICT_TRUE (tl >= (IPSEC_SA_ANTI_REPLAY_WINDOW_MAX_INDEX)))
+  if (!ipsec_sa_is_set_USE_ANTI_REPLAY (sa))
+    {
+      /* there's no AR configured for this SA, but in order
+       * to know whether a packet has wrapped the hi ESN we need
+       * to know whether it is out of window. if we use the default
+       * lower bound then we are effectively forcing AR because
+       * out of window packets will get the increased hi seq number
+       * and will thus fail to decrypt. IOW we need a window to know
+       * if the SN has wrapped, but we don't want a window to check for
+       * anti replay. to resolve the contradiction we use a huge window.
+       * if the packet is not within 2^30 of the current SN, we'll consider
+       * it a wrap.
+       */
+      if (hi_seq_req)
+	{
+	  if (seq >= sa->seq)
+	    /* The packet's sequence number is larger that the SA's.
+	     * that can't be a warp - unless we lost more than
+	     * 2^32 packets ... how could we know? */
+	    *hi_seq_req = sa->seq_hi;
+	  else
+	    {
+	      /* The packet's SN is less than the SAs, so either the SN has
+	       * wrapped or the SN is just old. */
+	      if (sa->seq - seq > (1 << 30))
+		/* It's really really really old => it wrapped */
+		*hi_seq_req = sa->seq_hi + 1;
+	      else
+		*hi_seq_req = sa->seq_hi;
+	    }
+	}
+      /*
+       * else
+       *   this is post-decrpyt and since it decrypted we accept it
+       */
+      return 0;
+    }
+  if (PREDICT_TRUE (sa->seq >= (IPSEC_SA_ANTI_REPLAY_WINDOW_MAX_INDEX)))
     {
       /*
        * the last sequence number VPP recieved is more than one
        * window size greater than zero.
        * Case A from RFC4303 Appendix A.
        */
-      if (seq < IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND (tl))
+      if (seq < IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND (sa->seq))
 	{
 	  /*
 	   * the received sequence number is lower than the lower bound
@@ -358,8 +415,28 @@ ipsec_sa_anti_replay_check (ipsec_sa_t * sa, u32 seq)
 	   * the high sequence number has wrapped. if it decrypts corrently
 	   * then it's the latter.
 	   */
-	  sa->seq_hi = th + 1;
-	  return 0;
+	  if (post_decrypt)
+	    {
+	      if (hi_seq_used == sa->seq_hi)
+		/* the high sequence number used to succesfully decrypt this
+		 * packet is the same as the last-sequnence number of the SA.
+		 * that means this packet did not cause a wrap.
+		 * this packet is thus out of window and should be dropped */
+		return 1;
+	      else
+		/* The packet decrypted with a different high sequence number
+		 * to the SA, that means it is the wrap packet and should be
+		 * accepted */
+		return 0;
+	    }
+	  else
+	    {
+	      /* pre-decrypt it might be the might that casues a wrap, we
+	       * need to decrpyt to find out */
+	      if (hi_seq_req)
+		*hi_seq_req = sa->seq_hi + 1;
+	      return 0;
+	    }
 	}
       else
 	{
@@ -367,13 +444,14 @@ ipsec_sa_anti_replay_check (ipsec_sa_t * sa, u32 seq)
 	   * the recieved sequence number greater than the low
 	   * end of the window.
 	   */
-	  sa->seq_hi = th;
-	  if (seq <= tl)
+	  if (hi_seq_req)
+	    *hi_seq_req = sa->seq_hi;
+	  if (seq <= sa->seq)
 	    /*
 	     * The recieved seq number is within bounds of the window
 	     * check if it's a duplicate
 	     */
-	    return (sa->replay_window & (1ULL << diff)) ? 1 : 0;
+	    return (ipsec_sa_anti_replay_check (sa, seq));
 	  else
 	    /*
 	     * The received sequence number is greater than the window
@@ -393,19 +471,20 @@ ipsec_sa_anti_replay_check (ipsec_sa_t * sa, u32 seq)
        * RHS will be a larger number.
        * Case B from RFC4303 Appendix A.
        */
-      if (seq < IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND (tl))
+      if (seq < IPSEC_SA_ANTI_REPLAY_WINDOW_LOWER_BOUND (sa->seq))
 	{
 	  /*
 	   * the sequence number is less than the lower bound.
 	   */
-	  if (seq <= tl)
+	  if (seq <= sa->seq)
 	    {
 	      /*
 	       * the packet is within the window upper bound.
 	       * check for duplicates.
 	       */
-	      sa->seq_hi = th;
-	      return (sa->replay_window & (1ULL << diff)) ? 1 : 0;
+	      if (hi_seq_req)
+		*hi_seq_req = sa->seq_hi;
+	      return (ipsec_sa_anti_replay_check (sa, seq));
 	    }
 	  else
 	    {
@@ -418,7 +497,8 @@ ipsec_sa_anti_replay_check (ipsec_sa_t * sa, u32 seq)
 	       * wrapped the high sequence again. If it were the latter then
 	       * we've lost close to 2^32 packets.
 	       */
-	      sa->seq_hi = th;
+	      if (hi_seq_req)
+		*hi_seq_req = sa->seq_hi;
 	      return 0;
 	    }
 	}
@@ -431,73 +511,79 @@ ipsec_sa_anti_replay_check (ipsec_sa_t * sa, u32 seq)
 	   * However, since TL is the other side of 0 to the received
 	   * packet, the SA has moved on to a higher sequence number.
 	   */
-	  sa->seq_hi = th - 1;
-	  return (sa->replay_window & (1ULL << diff)) ? 1 : 0;
+	  if (hi_seq_req)
+	    *hi_seq_req = sa->seq_hi - 1;
+	  return (ipsec_sa_anti_replay_check (sa, seq));
 	}
     }
 
+  /* unhandled case */
+  ASSERT (0);
   return 0;
 }
 
 /*
  * Anti replay window advance
  *  inputs need to be in host byte order.
+ * This function both advances the anti-replay window and the sequence number
+ * We always need to move on the SN but the window updates are only needed
+ * if AR is on.
+ * However, updating the window is trivial, so we do it anyway to save
+ * the branch cost.
  */
 always_inline void
-ipsec_sa_anti_replay_advance (ipsec_sa_t * sa, u32 seq)
+ipsec_sa_anti_replay_advance (ipsec_sa_t *sa, u32 seq, u32 hi_seq)
 {
   u32 pos;
-  if (PREDICT_TRUE (sa->flags & IPSEC_SA_FLAG_USE_ANTI_REPLAY) == 0)
-    return;
 
-  if (PREDICT_TRUE (sa->flags & IPSEC_SA_FLAG_USE_ESN))
+  if (ipsec_sa_is_set_USE_ESN (sa))
     {
-      int wrap = sa->seq_hi - sa->last_seq_hi;
+      int wrap = hi_seq - sa->seq_hi;
 
-      if (wrap == 0 && seq > sa->last_seq)
+      if (wrap == 0 && seq > sa->seq)
 	{
-	  pos = seq - sa->last_seq;
+	  pos = seq - sa->seq;
 	  if (pos < IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE)
 	    sa->replay_window = ((sa->replay_window) << pos) | 1;
 	  else
 	    sa->replay_window = 1;
-	  sa->last_seq = seq;
+	  sa->seq = seq;
 	}
       else if (wrap > 0)
 	{
-	  pos = ~seq + sa->last_seq + 1;
+	  pos = ~seq + sa->seq + 1;
 	  if (pos < IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE)
 	    sa->replay_window = ((sa->replay_window) << pos) | 1;
 	  else
 	    sa->replay_window = 1;
-	  sa->last_seq = seq;
-	  sa->last_seq_hi = sa->seq_hi;
+	  sa->seq = seq;
+	  sa->seq_hi = hi_seq;
 	}
       else if (wrap < 0)
 	{
-	  pos = ~seq + sa->last_seq + 1;
+	  pos = ~seq + sa->seq + 1;
 	  sa->replay_window |= (1ULL << pos);
 	}
       else
 	{
-	  pos = sa->last_seq - seq;
+	  pos = sa->seq - seq;
 	  sa->replay_window |= (1ULL << pos);
 	}
     }
   else
     {
-      if (seq > sa->last_seq)
+      if (seq > sa->seq)
 	{
-	  pos = seq - sa->last_seq;
+	  pos = seq - sa->seq;
 	  if (pos < IPSEC_SA_ANTI_REPLAY_WINDOW_SIZE)
 	    sa->replay_window = ((sa->replay_window) << pos) | 1;
 	  else
 	    sa->replay_window = 1;
-	  sa->last_seq = seq;
+	  sa->seq = seq;
 	}
       else
 	{
-	  pos = sa->last_seq - seq;
+	  pos = sa->seq - seq;
 	  sa->replay_window |= (1ULL << pos);
 	}
     }