ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IPSEC: IPv6 ESP transport mode incorrect packet length and checksum (VPP-1654)

Browse Source 
Change-Id: Ia3474e5bfea5764eae9b2987bf78296535df6778
Signed-off-by: Neale Ranns <nranns@cisco.com>
This commit is contained in:
Neale Ranns
2019-04-18 19:49:13 -07:00
committed by Dave Wallace
parent 1b52ca965c
commit 1b582b8e92
2 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
src/vnet/ipsec/esp_encrypt.c
View File

@ -112,19 +112,26 @@ esp_add_footer_and_icv (vlib_buffer_t * b, u8 block_size, u8 icv_sz)
static_always_inline void static_always_inline void
esp_update_ip4_hdr (ip4_header_t * ip4, u16 len, int is_transport, int is_udp) esp_update_ip4_hdr (ip4_header_t * ip4, u16 len, int is_transport, int is_udp)
{ {
ip_csum_t sum = ip4->checksum; ip_csum_t sum;
u16 old_len = 0; u16 old_len;
len = clib_net_to_host_u16 (len);
old_len = ip4->length;
if (is_transport) if (is_transport)
{ {
u8 prot = is_udp ? IP_PROTOCOL_UDP : IP_PROTOCOL_IPSEC_ESP; u8 prot = is_udp ? IP_PROTOCOL_UDP : IP_PROTOCOL_IPSEC_ESP;
old_len = ip4->length;
sum = ip_csum_update (sum, ip4->protocol, prot, ip4_header_t, protocol);
ip4->protocol = prot;
}
ip4->length = len = clib_net_to_host_u16 (len); sum = ip_csum_update (ip4->checksum, ip4->protocol,
sum = ip_csum_update (ip4->checksum, old_len, len, ip4_header_t, length); prot, ip4_header_t, protocol);
ip4->protocol = prot;
sum = ip_csum_update (sum, old_len, len, ip4_header_t, length);
}
else
sum = ip_csum_update (ip4->checksum, old_len, len, ip4_header_t, length);
ip4->length = len;
ip4->checksum = ip_csum_fold (sum); ip4->checksum = ip_csum_fold (sum);
} }
@ -411,7 +418,7 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
u16 len; u16 len;
ip4_header_t *ip4 = (ip4_header_t *) (ip_hdr); ip4_header_t *ip4 = (ip4_header_t *) (ip_hdr);
*next_hdr_ptr = ip4->protocol; *next_hdr_ptr = ip4->protocol;
len = payload_len + hdr_len + l2_len; len = payload_len + hdr_len - l2_len;
if (udp) if (udp)
{ {
esp_update_ip4_hdr (ip4, len, /* is_transport */ 1, 1); esp_update_ip4_hdr (ip4, len, /* is_transport */ 1, 1);

4
test/template_ipsec.py
View File

@ -412,6 +412,8 @@ class IpsecTra4(object):
recv_pkts = self.send_and_expect(self.tra_if, send_pkts, recv_pkts = self.send_and_expect(self.tra_if, send_pkts,
self.tra_if) self.tra_if)
for rx in recv_pkts: for rx in recv_pkts:
self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
self.assert_packet_checksums_valid(rx)
try: try:
decrypted = p.vpp_tra_sa.decrypt(rx[IP]) decrypted = p.vpp_tra_sa.decrypt(rx[IP])
self.assert_packet_checksums_valid(decrypted) self.assert_packet_checksums_valid(decrypted)
@ -534,6 +536,8 @@ class IpsecTun4(object):
def verify_encrypted(self, p, sa, rxs): def verify_encrypted(self, p, sa, rxs):
decrypt_pkts = [] decrypt_pkts = []
for rx in rxs: for rx in rxs:
self.assert_packet_checksums_valid(rx)
self.assertEqual(len(rx) - len(Ether()), rx[IP].len)
try: try:
decrypt_pkt = p.vpp_tun_sa.decrypt(rx[IP]) decrypt_pkt = p.vpp_tun_sa.decrypt(rx[IP])
if not decrypt_pkt.haslayer(IP): if not decrypt_pkt.haslayer(IP):