summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/plugins/crypto_openssl/main.c8
-rw-r--r--src/vnet/crypto/crypto.h2
-rw-r--r--src/vnet/ipsec/esp.h34
-rw-r--r--src/vnet/ipsec/esp_decrypt.c35
-rw-r--r--src/vnet/ipsec/esp_encrypt.c15
-rw-r--r--src/vnet/ipsec/ipsec.c25
-rw-r--r--src/vnet/ipsec/ipsec.h1
-rw-r--r--src/vnet/ipsec/ipsec_api.c2
-rw-r--r--src/vnet/ipsec/ipsec_cli.c4
-rw-r--r--src/vnet/ipsec/ipsec_format.c1
-rw-r--r--src/vnet/ipsec/ipsec_if.c2
-rw-r--r--src/vnet/ipsec/ipsec_if.h1
-rw-r--r--src/vnet/ipsec/ipsec_sa.c11
-rw-r--r--src/vnet/ipsec/ipsec_sa.h7
14 files changed, 133 insertions, 15 deletions
diff --git a/src/plugins/crypto_openssl/main.c b/src/plugins/crypto_openssl/main.c
index 5b661504b7d..ac586c2af77 100644
--- a/src/plugins/crypto_openssl/main.c
+++ b/src/plugins/crypto_openssl/main.c
@@ -115,14 +115,18 @@ openssl_ops_enc_gcm (vlib_main_t * vm, vnet_crypto_op_t * ops[], u32 n_ops,
for (i = 0; i < n_ops; i++)
{
vnet_crypto_op_t *op = ops[i];
+ u32 nonce[3];
int len;
if (op->flags & VNET_CRYPTO_OP_FLAG_INIT_IV)
RAND_bytes (op->iv, 8);
+ nonce[0] = op->salt;
+ clib_memcpy_fast (nonce + 1, op->iv, 8);
+
EVP_EncryptInit_ex (ctx, cipher, 0, 0, 0);
- EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_IVLEN, 8, NULL);
- EVP_EncryptInit_ex (ctx, 0, 0, op->key, op->iv);
+ EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_IVLEN, 12, NULL);
+ EVP_EncryptInit_ex (ctx, 0, 0, op->key, (u8 *) nonce);
if (op->aad_len)
EVP_EncryptUpdate (ctx, NULL, &len, op->aad, op->aad_len);
EVP_EncryptUpdate (ctx, op->dst, &len, op->src, op->len);
diff --git a/src/vnet/crypto/crypto.h b/src/vnet/crypto/crypto.h
index 06f7e534e11..901c363342b 100644
--- a/src/vnet/crypto/crypto.h
+++ b/src/vnet/crypto/crypto.h
@@ -115,7 +115,7 @@ typedef struct
u8 flags;
#define VNET_CRYPTO_OP_FLAG_INIT_IV (1 << 0)
#define VNET_CRYPTO_OP_FLAG_HMAC_CHECK (1 << 1)
- u32 len;
+ u32 len, salt;
u16 aad_len;
u8 key_len, iv_len, digest_len, tag_len;
u8 *key;
diff --git a/src/vnet/ipsec/esp.h b/src/vnet/ipsec/esp.h
index 1e7f08277ca..052bbfc1d88 100644
--- a/src/vnet/ipsec/esp.h
+++ b/src/vnet/ipsec/esp.h
@@ -54,6 +54,20 @@ typedef CLIB_PACKED (struct {
}) ip6_and_esp_header_t;
/* *INDENT-ON* */
+/**
+ * AES GCM Additional Authentication data
+ */
+typedef struct esp_aead_t_
+{
+ /**
+ * for GCM: when using ESN it's:
+ * SPI, seq-hi, seg-low
+ * else
+ * SPI, seq-low
+ */
+ u32 data[3];
+} __clib_packed esp_aead_t;
+
#define ESP_SEQ_MAX (4294967295UL)
#define ESP_MAX_BLOCK_SIZE (16)
#define ESP_MAX_IV_SIZE (16)
@@ -117,6 +131,26 @@ hmac_calc (vlib_main_t * vm, ipsec_sa_t * sa, u8 * data, int data_len,
return sa->integ_icv_size;
}
+always_inline void
+esp_aad_fill (vnet_crypto_op_t * op,
+ const esp_header_t * esp, const ipsec_sa_t * sa)
+{
+ esp_aead_t *aad;
+
+ aad = (esp_aead_t *) op->aad;
+ clib_memcpy_fast (aad, esp, 8);
+
+ if (ipsec_sa_is_set_USE_ESN (sa))
+ {
+ /* SPI, seq-hi, seq-low */
+ aad->data[2] = aad->data[1];
+ aad->data[1] = clib_host_to_net_u32 (sa->seq_hi);
+ op->aad_len = 12;
+ }
+ else
+ /* SPI, seq-low */
+ op->aad_len = 8;
+}
#endif /* __ESP_H__ */
/*
diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index c94577a5d5a..d2365fce2d8 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -197,7 +197,7 @@ esp_decrypt_inline (vlib_main_t * vm,
current_sa_pkts += 1;
current_sa_bytes += pd->current_length;
- if (PREDICT_TRUE (cpd.icv_sz > 0))
+ if (PREDICT_TRUE (sa0->integ_op_id != VNET_CRYPTO_OP_NONE))
{
vnet_crypto_op_t *op;
vec_add2_aligned (ptd->integ_ops, op, 1, CLIB_CACHE_LINE_BYTES);
@@ -233,6 +233,39 @@ esp_decrypt_inline (vlib_main_t * vm,
vnet_crypto_op_init (op, sa0->crypto_dec_op_id);
op->key = sa0->crypto_key.data;
op->iv = payload;
+
+ if (ipsec_sa_is_set_IS_AEAD (sa0))
+ {
+ esp_header_t *esp0;
+ esp_aead_t *aad;
+ u8 *scratch;
+ u32 salt;
+
+ /*
+ * construct the AAD and the nonce (Salt || IV) in a scratch
+ * space in front of the IP header.
+ */
+ scratch = payload - esp_sz;
+ esp0 = (esp_header_t *) (scratch);
+
+ scratch -= (sizeof (*aad) + pd->hdr_sz);
+ op->aad = scratch;
+
+ esp_aad_fill (op, esp0, sa0);
+
+ /*
+ * we don't need to refer to the ESP header anymore so we
+ * can overwrite it with the salt and use the IV where it is
+ * to form the nonce = (Salt + IV)
+ */
+ salt = clib_host_to_net_u32 (sa0->salt);
+ op->iv -= sizeof (sa0->salt);
+ clib_memcpy_fast (op->iv, &salt, sizeof (sa0->salt));
+ op->iv_len = cpd.iv_sz + sizeof (sa0->salt);
+
+ op->tag = payload + len;
+ op->tag_len = 16;
+ }
op->src = op->dst = payload += cpd.iv_sz;
op->len = len - cpd.iv_sz;
op->user_data = b - bufs;
diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index fbc5166b946..e319a9628f4 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -436,6 +436,21 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
op->len = payload_len - icv_sz;
op->flags = VNET_CRYPTO_OP_FLAG_INIT_IV;
op->user_data = b - bufs;
+ op->salt = sa0->salt;
+
+ if (ipsec_sa_is_set_IS_AEAD (sa0))
+ {
+ /*
+ * construct the AAD in a scratch space in front
+ * of the IP header.
+ */
+ op->aad = payload - hdr_len - sizeof (esp_aead_t);
+
+ esp_aad_fill (op, esp, sa0);
+
+ op->tag = payload + op->len;
+ op->tag_len = 16;
+ }
}
if (sa0->integ_op_id)
diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c
index dc2f4cdbb60..73c5cf4d7ab 100644
--- a/src/vnet/ipsec/ipsec.c
+++ b/src/vnet/ipsec/ipsec.c
@@ -38,13 +38,6 @@ ipsec_check_ah_support (ipsec_sa_t * sa)
static clib_error_t *
ipsec_check_esp_support (ipsec_sa_t * sa)
{
- if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
- return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
- if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_192)
- return clib_error_return (0, "unsupported aes-gcm-192 crypto-alg");
- if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_256)
- return clib_error_return (0, "unsupported aes-gcm-256 crypto-alg");
-
return 0;
}
@@ -293,6 +286,24 @@ ipsec_init (vlib_main_t * vm)
a->dec_op_id = VNET_CRYPTO_OP_AES_256_CBC_DEC;
a->iv_size = a->block_size = 16;
+ a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_128;
+ a->enc_op_id = VNET_CRYPTO_OP_AES_128_GCM_ENC;
+ a->dec_op_id = VNET_CRYPTO_OP_AES_128_GCM_DEC;
+ a->iv_size = a->block_size = 8;
+ a->icv_size = 16;
+
+ a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_192;
+ a->enc_op_id = VNET_CRYPTO_OP_AES_192_GCM_ENC;
+ a->dec_op_id = VNET_CRYPTO_OP_AES_192_GCM_DEC;
+ a->iv_size = a->block_size = 8;
+ a->icv_size = 16;
+
+ a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_256;
+ a->enc_op_id = VNET_CRYPTO_OP_AES_256_GCM_ENC;
+ a->dec_op_id = VNET_CRYPTO_OP_AES_256_GCM_DEC;
+ a->iv_size = a->block_size = 8;
+ a->icv_size = 16;
+
vec_validate (im->integ_algs, IPSEC_INTEG_N_ALG - 1);
ipsec_main_integ_alg_t *i;
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index b6332d672fb..110bbcb3e5a 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -70,6 +70,7 @@ typedef struct
vnet_crypto_op_id_t dec_op_id;
u8 iv_size;
u8 block_size;
+ u8 icv_size;
} ipsec_main_crypto_alg_t;
typedef struct
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index 753d7530de4..767cd2fb076 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -390,7 +390,7 @@ static void vl_api_ipsec_sad_entry_add_del_t_handler
rv = ipsec_sa_add (id, spi, proto,
crypto_alg, &crypto_key,
integ_alg, &integ_key, flags,
- 0, &tun_src, &tun_dst, &sa_index);
+ 0, 0, &tun_src, &tun_dst, &sa_index);
else
rv = ipsec_sa_del (id);
diff --git a/src/vnet/ipsec/ipsec_cli.c b/src/vnet/ipsec/ipsec_cli.c
index b247d5d87c6..096060865e9 100644
--- a/src/vnet/ipsec/ipsec_cli.c
+++ b/src/vnet/ipsec/ipsec_cli.c
@@ -141,7 +141,7 @@ ipsec_sa_add_del_command_fn (vlib_main_t * vm,
if (is_add)
rv = ipsec_sa_add (id, spi, proto, crypto_alg,
&ck, integ_alg, &ik, flags,
- 0, &tun_src, &tun_dst, NULL);
+ 0, 0, &tun_src, &tun_dst, NULL);
else
rv = ipsec_sa_del (id);
@@ -790,6 +790,8 @@ create_ipsec_tunnel_command_fn (vlib_main_t * vm,
num_m_args++;
else if (unformat (line_input, "instance %u", &a.show_instance))
a.renumber = 1;
+ else if (unformat (line_input, "salt 0x%x", &a.salt))
+ ;
else if (unformat (line_input, "udp-encap"))
a.udp_encap = 1;
else if (unformat (line_input, "use-esn"))
diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index 6e6007eed2a..80691f2836c 100644
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -290,6 +290,7 @@ format_ipsec_sa (u8 * s, va_list * args)
if (!(flags & IPSEC_FORMAT_DETAIL))
goto done;
+ s = format (s, "\n salt 0x%x", sa->salt);
s = format (s, "\n seq %u seq-hi %u", sa->seq, sa->seq_hi);
s = format (s, "\n last-seq %u last-seq-hi %u window %U",
sa->last_seq, sa->last_seq_hi,
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index 3c1f84576d4..f7cd95873db 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -308,6 +308,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
&integ_key,
(flags | IPSEC_SA_FLAG_IS_INBOUND),
args->tx_table_id,
+ args->salt,
&args->remote_ip,
&args->local_ip, &t->input_sa_index);
@@ -328,6 +329,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
&integ_key,
flags,
args->tx_table_id,
+ args->salt,
&args->local_ip,
&args->remote_ip, &t->output_sa_index);
diff --git a/src/vnet/ipsec/ipsec_if.h b/src/vnet/ipsec/ipsec_if.h
index 1e7f9df7c93..d1fa9bd4a91 100644
--- a/src/vnet/ipsec/ipsec_if.h
+++ b/src/vnet/ipsec/ipsec_if.h
@@ -61,6 +61,7 @@ typedef struct
u32 show_instance;
u8 udp_encap;
u32 tx_table_id;
+ u32 salt;
} ipsec_add_del_tunnel_args_t;
/* *INDENT-OFF* */
diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c
index da12560bb7d..8f41c95159b 100644
--- a/src/vnet/ipsec/ipsec_sa.c
+++ b/src/vnet/ipsec/ipsec_sa.c
@@ -102,6 +102,11 @@ ipsec_sa_set_crypto_alg (ipsec_sa_t * sa, ipsec_crypto_alg_t crypto_alg)
sa->crypto_dec_op_id = im->crypto_algs[crypto_alg].dec_op_id;
ASSERT (sa->crypto_iv_size <= ESP_MAX_IV_SIZE);
ASSERT (sa->crypto_block_size <= ESP_MAX_BLOCK_SIZE);
+ if (IPSEC_CRYPTO_ALG_IS_GCM (crypto_alg))
+ {
+ sa->integ_icv_size = im->crypto_algs[crypto_alg].icv_size;
+ ipsec_sa_set_IS_AEAD (sa);
+ }
}
void
@@ -124,6 +129,7 @@ ipsec_sa_add (u32 id,
const ipsec_key_t * ik,
ipsec_sa_flags_t flags,
u32 tx_table_id,
+ u32 salt,
const ip46_address_t * tun_src,
const ip46_address_t * tun_dst, u32 * sa_out_index)
{
@@ -150,10 +156,11 @@ ipsec_sa_add (u32 id,
sa->stat_index = sa_index;
sa->protocol = proto;
sa->flags = flags;
- ipsec_sa_set_crypto_alg (sa, crypto_alg);
- clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key));
+ sa->salt = salt;
ipsec_sa_set_integ_alg (sa, integ_alg);
clib_memcpy (&sa->integ_key, ik, sizeof (sa->integ_key));
+ ipsec_sa_set_crypto_alg (sa, crypto_alg);
+ clib_memcpy (&sa->crypto_key, ck, sizeof (sa->crypto_key));
ip46_address_copy (&sa->tunnel_src_addr, tun_src);
ip46_address_copy (&sa->tunnel_dst_addr, tun_dst);
diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h
index 72a592984f6..f87e12e0204 100644
--- a/src/vnet/ipsec/ipsec_sa.h
+++ b/src/vnet/ipsec/ipsec_sa.h
@@ -43,6 +43,11 @@ typedef enum
IPSEC_CRYPTO_N_ALG,
} ipsec_crypto_alg_t;
+#define IPSEC_CRYPTO_ALG_IS_GCM(_alg) \
+ (((_alg == IPSEC_CRYPTO_ALG_AES_GCM_128) || \
+ (_alg == IPSEC_CRYPTO_ALG_AES_GCM_192) || \
+ (_alg == IPSEC_CRYPTO_ALG_AES_GCM_256)))
+
#define foreach_ipsec_integ_alg \
_ (0, NONE, "none") \
_ (1, MD5_96, "md5-96") /* RFC2403 */ \
@@ -92,6 +97,7 @@ typedef struct ipsec_key_t_
_ (16, UDP_ENCAP, "udp-encap") \
_ (32, IS_GRE, "GRE") \
_ (64, IS_INBOUND, "inboud") \
+ _ (128, IS_AEAD, "aead") \
typedef enum ipsec_sad_flags_t_
{
@@ -192,6 +198,7 @@ extern int ipsec_sa_add (u32 id,
const ipsec_key_t * ik,
ipsec_sa_flags_t flags,
u32 tx_table_id,
+ u32 salt,
const ip46_address_t * tunnel_src_addr,
const ip46_address_t * tunnel_dst_addr,
u32 * sa_index);