IPSEC: support GCM in ESP

Change-Id: Id2ddb77b4ec3dd543d6e638bc882923f2bac011d
Signed-off-by: Neale Ranns <nranns@cisco.com>

13 files changed, 127 insertions, 13 deletions

diff --git a/src/vnet/crypto/crypto.h b/src/vnet/crypto/crypto.h
index 06f7e534e11..901c363342b 100644
--- a/src/vnet/crypto/crypto.h
+++ b/src/vnet/crypto/crypto.h
@@ -115,7 +115,7 @@ typedef struct
   u8 flags;
 #define VNET_CRYPTO_OP_FLAG_INIT_IV (1 << 0)
 #define VNET_CRYPTO_OP_FLAG_HMAC_CHECK (1 << 1)
-  u32 len;
+  u32 len, salt;
   u16 aad_len;
   u8 key_len, iv_len, digest_len, tag_len;
   u8 *key;
diff --git a/src/vnet/ipsec/esp.h b/src/vnet/ipsec/esp.h
index 1e7f08277ca..052bbfc1d88 100644
--- a/src/vnet/ipsec/esp.h
+++ b/src/vnet/ipsec/esp.h
@@ -54,6 +54,20 @@ typedef CLIB_PACKED (struct {
 }) ip6_and_esp_header_t;
 /* *INDENT-ON* */
 
+/**
+ * AES GCM Additional Authentication data
+ */
+typedef struct esp_aead_t_
+{
+  /**
+   * for GCM: when using ESN it's:
+   *   SPI, seq-hi, seg-low
+   * else
+   *   SPI, seq-low
+   */
+  u32 data[3];
+} __clib_packed esp_aead_t;
+
 #define ESP_SEQ_MAX		(4294967295UL)
 #define ESP_MAX_BLOCK_SIZE	(16)
 #define ESP_MAX_IV_SIZE		(16)
@@ -117,6 +131,26 @@ hmac_calc (vlib_main_t * vm, ipsec_sa_t * sa, u8 * data, int data_len,
   return sa->integ_icv_size;
 }
 
+always_inline void
+esp_aad_fill (vnet_crypto_op_t * op,
+	      const esp_header_t * esp, const ipsec_sa_t * sa)
+{
+  esp_aead_t *aad;
+
+  aad = (esp_aead_t *) op->aad;
+  clib_memcpy_fast (aad, esp, 8);
+
+  if (ipsec_sa_is_set_USE_ESN (sa))
+    {
+      /* SPI, seq-hi, seq-low */
+      aad->data[2] = aad->data[1];
+      aad->data[1] = clib_host_to_net_u32 (sa->seq_hi);
+      op->aad_len = 12;
+    }
+  else
+    /* SPI, seq-low */
+    op->aad_len = 8;
+}
 #endif /* __ESP_H__ */
 
 /*
diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index c94577a5d5a..d2365fce2d8 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -197,7 +197,7 @@ esp_decrypt_inline (vlib_main_t * vm,
       current_sa_pkts += 1;
       current_sa_bytes += pd->current_length;
 
-      if (PREDICT_TRUE (cpd.icv_sz > 0))
+      if (PREDICT_TRUE (sa0->integ_op_id != VNET_CRYPTO_OP_NONE))
 	{
 	  vnet_crypto_op_t *op;
 	  vec_add2_aligned (ptd->integ_ops, op, 1, CLIB_CACHE_LINE_BYTES);
@@ -233,6 +233,39 @@ esp_decrypt_inline (vlib_main_t * vm,
 	  vnet_crypto_op_init (op, sa0->crypto_dec_op_id);
 	  op->key = sa0->crypto_key.data;
 	  op->iv = payload;
+
+	  if (ipsec_sa_is_set_IS_AEAD (sa0))
+	    {
+	      esp_header_t *esp0;
+	      esp_aead_t *aad;
+	      u8 *scratch;
+	      u32 salt;
+
+	      /*
+	       * construct the AAD and the nonce (Salt || IV) in a scratch
+	       * space in front of the IP header.
+	       */
+	      scratch = payload - esp_sz;
+	      esp0 = (esp_header_t *) (scratch);
+
+	      scratch -= (sizeof (*aad) + pd->hdr_sz);
+	      op->aad = scratch;
+
+	      esp_aad_fill (op, esp0, sa0);
+
+	      /*
+	       * we don't need to refer to the ESP header anymore so we
+	       * can overwrite it with the salt and use the IV where it is
+	       * to form the nonce = (Salt + IV)
+	       */
+	      salt = clib_host_to_net_u32 (sa0->salt);
+	      op->iv -= sizeof (sa0->salt);
+	      clib_memcpy_fast (op->iv, &salt, sizeof (sa0->salt));
+	      op->iv_len = cpd.iv_sz + sizeof (sa0->salt);
+
+	      op->tag = payload + len;
+	      op->tag_len = 16;
+	    }
 	  op->src = op->dst = payload += cpd.iv_sz;
 	  op->len = len - cpd.iv_sz;
 	  op->user_data = b - bufs;
diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index fbc5166b946..e319a9628f4 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -436,6 +436,21 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  op->len = payload_len - icv_sz;
 	  op->flags = VNET_CRYPTO_OP_FLAG_INIT_IV;
 	  op->user_data = b - bufs;
+	  op->salt = sa0->salt;
+
+	  if (ipsec_sa_is_set_IS_AEAD (sa0))
+	    {
+	      /*
+	       * construct the AAD in a scratch space in front
+	       * of the IP header.
+	       */
+	      op->aad = payload - hdr_len - sizeof (esp_aead_t);
+
+	      esp_aad_fill (op, esp, sa0);
+
+	      op->tag = payload + op->len;
+	      op->tag_len = 16;
+	    }
 	}
 
       if (sa0->integ_op_id)
diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c
index dc2f4cdbb60..73c5cf4d7ab 100644
--- a/src/vnet/ipsec/ipsec.c
+++ b/src/vnet/ipsec/ipsec.c
@@ -38,13 +38,6 @@ ipsec_check_ah_support (ipsec_sa_t * sa)
 static clib_error_t *
 ipsec_check_esp_support (ipsec_sa_t * sa)
 {
-  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
-    return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
-  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_192)
-    return clib_error_return (0, "unsupported aes-gcm-192 crypto-alg");
-  if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_256)
-    return clib_error_return (0, "unsupported aes-gcm-256 crypto-alg");
-
   return 0;
 }
 
@@ -293,6 +286,24 @@ ipsec_init (vlib_main_t * vm)
   a->dec_op_id = VNET_CRYPTO_OP_AES_256_CBC_DEC;
   a->iv_size = a->block_size = 16;
 
+  a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_128;
+  a->enc_op_id = VNET_CRYPTO_OP_AES_128_GCM_ENC;
+  a->dec_op_id = VNET_CRYPTO_OP_AES_128_GCM_DEC;
+  a->iv_size = a->block_size = 8;
+  a->icv_size = 16;
+
+  a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_192;
+  a->enc_op_id = VNET_CRYPTO_OP_AES_192_GCM_ENC;
+  a->dec_op_id = VNET_CRYPTO_OP_AES_192_GCM_DEC;
+  a->iv_size = a->block_size = 8;
+  a->icv_size = 16;
+
+  a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_256;
+  a->enc_op_id = VNET_CRYPTO_OP_AES_256_GCM_ENC;
+  a->dec_op_id = VNET_CRYPTO_OP_AES_256_GCM_DEC;
+  a->iv_size = a->block_size = 8;
+  a->icv_size = 16;
+
   vec_validate (im->integ_algs, IPSEC_INTEG_N_ALG - 1);
   ipsec_main_integ_alg_t *i;
 
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index b6332d672fb..110bbcb3e5a 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -70,6 +70,7 @@ typedef struct
   vnet_crypto_op_id_t dec_op_id;
   u8 iv_size;
   u8 block_size;
+  u8 icv_size;
 } ipsec_main_crypto_alg_t;
 
 typedef struct
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index 753d7530de4..767cd2fb076 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -390,7 +390,7 @@ static void vl_api_ipsec_sad_entry_add_del_t_handler
     rv = ipsec_sa_add (id, spi, proto,
 		       crypto_alg, &crypto_key,
 		       integ_alg, &integ_key, flags,
-		       0, &tun_src, &tun_dst, &sa_index);
+		       0, 0, &tun_src, &tun_dst, &sa_index);
   else
     rv = ipsec_sa_del (id);
 
diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index b247d5d87c6..096060865e9 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -141,7 +141,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
   if (is_add)
     rv = ipsec_sa_add (id, spi, proto, crypto_alg,
 		       &ck, integ_alg, &ik, flags,
-		       0, &tun_src, &tun_dst, NULL);
+		       0, 0, &tun_src, &tun_dst, NULL);
   else
     rv = ipsec_sa_del (id);
 
@@ -790,6 +790,8 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
 	num_m_args++;
       else if (unformat (line_input, "instance %u", &a.show_instance))
 	a.renumber = 1;
+      else if (unformat (line_input, "salt 0x%x", &a.salt))
+	;
       else if (unformat (line_input, "udp-encap"))
 	a.udp_encap = 1;
       else if (unformat (line_input, "use-esn"))
diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index 6e6007eed2a..80691f2836c 100644
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -290,6 +290,7 @@ format_ipsec_sa (u8 * s, va_list * args)
   if (!(flags & IPSEC_FORMAT_DETAIL))
     goto done;
 
+  s = format (s, "\n   salt 0x%x", sa->salt);
   s = format (s, "\n   seq %u seq-hi %u", sa->seq, sa->seq_hi);
   s = format (s, "\n   last-seq %u last-seq-hi %u window %U",
 	      sa->last_seq, sa->last_seq_hi,
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index 3c1f84576d4..f7cd95873db 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -308,6 +308,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 			 &integ_key,
 			 (flags | IPSEC_SA_FLAG_IS_INBOUND),
 			 args->tx_table_id,
+			 args->salt,
 			 &args->remote_ip,
 			 &args->local_ip, &t->input_sa_index);
 
@@ -328,6 +329,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 			 &integ_key,
 			 flags,
 			 args->tx_table_id,
+			 args->salt,
 			 &args->local_ip,
 			 &args->remote_ip, &t->output_sa_index);
 
diff --git a/src/vnet/ipsec/ipsec_if.h b/src/vnet/ipsec/ipsec_if.h
index 1e7f9df7c93..d1fa9bd4a91 100644
--- a/src/vnet/ipsec/ipsec_if.h
+++ b/src/vnet/ipsec/ipsec_if.h
@@ -61,6 +61,7 @@ typedef struct
   u32 show_instance;
   u8 udp_encap;
   u32 tx_table_id;
+  u32 salt;
 } ipsec_add_del_tunnel_args_t;
 
 /* *INDENT-OFF* */
diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c
index da12560bb7d..8f41c95159b 100644
--- a/src/vnet/ipsec/ipsec_sa.c
+++ b/src/vnet/ipsec/ipsec_sa.c
@@ -102,6 +102,11 @@ ipsec_sa_set_crypto_alg (ipsec_sa_t * sa, ipsec_crypto_alg_t crypto_alg)
   sa->crypto_dec_op_id = im->crypto_algs[crypto_alg].dec_op_id;
   ASSERT (sa->crypto_iv_size <= ESP_MAX_IV_SIZE);
   ASSERT (sa->crypto_block_size <= ESP_MAX_BLOCK_SIZE);
+  if (IPSEC_CRYPTO_ALG_IS_GCM (crypto_alg))
+    {
+      sa->integ_icv_size = im->crypto_algs[crypto_alg].icv_size;
+      ipsec_sa_set_IS_AEAD (sa);
+    }
 }
 
 void
@@ -124,6 +129,7 @@ ipsec_sa_add (u32 id,
 	      const ipsec_key_t * ik,
 	      ipsec_sa_flags_t flags,
 	      u32 tx_table_id,
+	      u32 salt,
 	      const ip46_address_t * tun_src,
 	      const ip46_address_t * tun_dst, u32 * sa_out_index)
 {
@@ -150,10 +156,11 @@ ipsec_sa_add (u32 id,
   sa->stat_index = sa_index;
   sa->protocol = proto;
   sa->flags = flags;
-  ipsec_sa_set_crypto_alg (sa, crypto_alg);
-  clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key));
+  sa->salt = salt;
   ipsec_sa_set_integ_alg (sa, integ_alg);
   clib_memcpy (&sa->integ_key, ik, sizeof (sa->integ_key));
+  ipsec_sa_set_crypto_alg (sa, crypto_alg);
+  clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key));
   ip46_address_copy (&sa->tunnel_src_addr, tun_src);
   ip46_address_copy (&sa->tunnel_dst_addr, tun_dst);
 
diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h
index 72a592984f6..f87e12e0204 100644
--- a/src/vnet/ipsec/ipsec_sa.h
+++ b/src/vnet/ipsec/ipsec_sa.h
@@ -43,6 +43,11 @@ typedef enum
     IPSEC_CRYPTO_N_ALG,
 } ipsec_crypto_alg_t;
 
+#define IPSEC_CRYPTO_ALG_IS_GCM(_alg)                     \
+  (((_alg == IPSEC_CRYPTO_ALG_AES_GCM_128) ||             \
+    (_alg == IPSEC_CRYPTO_ALG_AES_GCM_192) ||             \
+    (_alg == IPSEC_CRYPTO_ALG_AES_GCM_256)))
+
 #define foreach_ipsec_integ_alg                                            \
   _ (0, NONE, "none")                                                      \
   _ (1, MD5_96, "md5-96")           /* RFC2403 */                          \
@@ -92,6 +97,7 @@ typedef struct ipsec_key_t_
   _ (16, UDP_ENCAP, "udp-encap")                          \
   _ (32, IS_GRE, "GRE")                                   \
   _ (64, IS_INBOUND, "inboud")                            \
+  _ (128, IS_AEAD, "aead")                                \
 
 typedef enum ipsec_sad_flags_t_
 {
@@ -192,6 +198,7 @@ extern int ipsec_sa_add (u32 id,
 			 const ipsec_key_t * ik,
 			 ipsec_sa_flags_t flags,
 			 u32 tx_table_id,
+			 u32 salt,
 			 const ip46_address_t * tunnel_src_addr,
 			 const ip46_address_t * tunnel_dst_addr,
 			 u32 * sa_index);