diff options
Diffstat (limited to 'src/vnet/ipsec/esp.h')
| -rw-r--r-- | src/vnet/ipsec/esp.h | 134 |
1 files changed, 100 insertions, 34 deletions
diff --git a/src/vnet/ipsec/esp.h b/src/vnet/ipsec/esp.h index d179233df49..1c3ce776ad2 100644 --- a/src/vnet/ipsec/esp.h +++ b/src/vnet/ipsec/esp.h @@ -18,6 +18,7 @@ #include <vnet/ip/ip.h> #include <vnet/crypto/crypto.h> #include <vnet/ipsec/ipsec.h> +#include <vnet/ipsec/ipsec.api_enum.h> typedef struct { @@ -36,27 +37,21 @@ typedef struct u8 next_header; } esp_footer_t; -/* *INDENT-OFF* */ typedef CLIB_PACKED (struct { ip4_header_t ip4; esp_header_t esp; }) ip4_and_esp_header_t; -/* *INDENT-ON* */ -/* *INDENT-OFF* */ typedef CLIB_PACKED (struct { ip4_header_t ip4; udp_header_t udp; esp_header_t esp; }) ip4_and_udp_and_esp_header_t; -/* *INDENT-ON* */ -/* *INDENT-OFF* */ typedef CLIB_PACKED (struct { ip6_header_t ip6; esp_header_t esp; }) ip6_and_esp_header_t; -/* *INDENT-ON* */ /** * AES counter mode nonce @@ -85,9 +80,6 @@ typedef struct esp_aead_t_ } __clib_packed esp_aead_t; #define ESP_SEQ_MAX (4294967295UL) -#define ESP_MAX_BLOCK_SIZE (16) -#define ESP_MAX_IV_SIZE (16) -#define ESP_MAX_ICV_SIZE (32) u8 *format_esp_header (u8 * s, va_list * args); @@ -141,39 +133,76 @@ esp_aad_fill (u8 *data, const esp_header_t *esp, const ipsec_sa_t *sa, } } -/* Special case to drop or hand off packets for sync/async modes. - * - * Different than sync mode, async mode only enqueue drop or hand-off packets - * to next nodes. - */ -always_inline void -esp_set_next_index (vlib_buffer_t *b, vlib_node_runtime_t *node, u32 err, - u16 index, u16 *nexts, u16 drop_next) +always_inline u32 +esp_encrypt_err_to_sa_err (u32 err) { - nexts[index] = drop_next; - b->error = node->errors[err]; + switch (err) + { + case ESP_ENCRYPT_ERROR_HANDOFF: + return IPSEC_SA_ERROR_HANDOFF; + case ESP_ENCRYPT_ERROR_SEQ_CYCLED: + return IPSEC_SA_ERROR_SEQ_CYCLED; + case ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR: + return IPSEC_SA_ERROR_CRYPTO_ENGINE_ERROR; + case ESP_ENCRYPT_ERROR_CRYPTO_QUEUE_FULL: + return IPSEC_SA_ERROR_CRYPTO_QUEUE_FULL; + case ESP_ENCRYPT_ERROR_NO_BUFFERS: + return IPSEC_SA_ERROR_NO_BUFFERS; + case ESP_ENCRYPT_ERROR_NO_ENCRYPTION: + return IPSEC_SA_ERROR_NO_ENCRYPTION; + } + return ~0; } -/* when submitting a frame is failed, drop all buffers in the frame */ always_inline u32 -esp_async_recycle_failed_submit (vlib_main_t *vm, vnet_crypto_async_frame_t *f, - vlib_node_runtime_t *node, u32 err, u16 index, - u32 *from, u16 *nexts, u16 drop_next_index) +esp_decrypt_err_to_sa_err (u32 err) { - u32 n_drop = f->n_elts; - u32 *bi = f->buffer_indices; - - while (n_drop--) + switch (err) { - from[index] = bi[0]; - esp_set_next_index (vlib_get_buffer (vm, bi[0]), node, err, index, nexts, - drop_next_index); - bi++; - index++; + case ESP_DECRYPT_ERROR_HANDOFF: + return IPSEC_SA_ERROR_HANDOFF; + case ESP_DECRYPT_ERROR_DECRYPTION_FAILED: + return IPSEC_SA_ERROR_DECRYPTION_FAILED; + case ESP_DECRYPT_ERROR_INTEG_ERROR: + return IPSEC_SA_ERROR_INTEG_ERROR; + case ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR: + return IPSEC_SA_ERROR_CRYPTO_ENGINE_ERROR; + case ESP_DECRYPT_ERROR_REPLAY: + return IPSEC_SA_ERROR_REPLAY; + case ESP_DECRYPT_ERROR_RUNT: + return IPSEC_SA_ERROR_RUNT; + case ESP_DECRYPT_ERROR_NO_BUFFERS: + return IPSEC_SA_ERROR_NO_BUFFERS; + case ESP_DECRYPT_ERROR_OVERSIZED_HEADER: + return IPSEC_SA_ERROR_OVERSIZED_HEADER; + case ESP_DECRYPT_ERROR_NO_TAIL_SPACE: + return IPSEC_SA_ERROR_NO_TAIL_SPACE; + case ESP_DECRYPT_ERROR_TUN_NO_PROTO: + return IPSEC_SA_ERROR_TUN_NO_PROTO; + case ESP_DECRYPT_ERROR_UNSUP_PAYLOAD: + return IPSEC_SA_ERROR_UNSUP_PAYLOAD; } - vnet_crypto_async_reset_frame (f); + return ~0; +} - return (f->n_elts); +always_inline void +esp_encrypt_set_next_index (vlib_buffer_t *b, vlib_node_runtime_t *node, + u32 thread_index, u32 err, u16 index, u16 *nexts, + u16 drop_next, u32 sa_index) +{ + ipsec_set_next_index (b, node, thread_index, err, + esp_encrypt_err_to_sa_err (err), index, nexts, + drop_next, sa_index); +} + +always_inline void +esp_decrypt_set_next_index (vlib_buffer_t *b, vlib_node_runtime_t *node, + u32 thread_index, u32 err, u16 index, u16 *nexts, + u16 drop_next, u32 sa_index) +{ + ipsec_set_next_index (b, node, thread_index, err, + esp_decrypt_err_to_sa_err (err), index, nexts, + drop_next, sa_index); } /** @@ -250,6 +279,43 @@ typedef struct extern esp_async_post_next_t esp_encrypt_async_next; extern esp_async_post_next_t esp_decrypt_async_next; +/* when submitting a frame is failed, drop all buffers in the frame */ +always_inline u32 +esp_async_recycle_failed_submit (vlib_main_t *vm, vnet_crypto_async_frame_t *f, + vlib_node_runtime_t *node, u32 err, + u32 ipsec_sa_err, u16 index, u32 *from, + u16 *nexts, u16 drop_next_index, + bool is_encrypt) +{ + vlib_buffer_t *b; + u32 n_drop = f->n_elts; + u32 *bi = f->buffer_indices; + + while (n_drop--) + { + u32 sa_index; + + from[index] = bi[0]; + b = vlib_get_buffer (vm, bi[0]); + + if (is_encrypt) + { + sa_index = vnet_buffer (b)->ipsec.sad_index; + } + else + { + sa_index = esp_post_data (b)->decrypt_data.sa_index; + } + + ipsec_set_next_index (b, node, vm->thread_index, err, ipsec_sa_err, + index, nexts, drop_next_index, sa_index); + bi++; + index++; + } + + return (f->n_elts); +} + #endif /* __ESP_H__ */ /* |