ipsec: Revert "ipsec: fix chained ESP"
This reverts commit c2c1bfd9b7.
Reason for revert: Seems it's breaking ipsec esp tests
Type: fix
Change-Id: Iac590eee23cbf92a10c62dafa789aa9c3b2284dd
Signed-off-by: Florin Coras <fcoras@cisco.com>
This commit is contained in:
Florin Coras
committed by
Dave Barach
Dave Barach
parent
ef633187e2
commit
ae8102ec0e
@ -214,7 +214,7 @@ esp_remove_tail (vlib_main_t * vm, vlib_buffer_t * b, vlib_buffer_t * last,
|
||||
return pointer to it */
|
||||
static_always_inline u8 *
|
||||
esp_move_icv (vlib_main_t * vm, vlib_buffer_t * first,
|
||||
esp_decrypt_packet_data_t * pd, u16 icv_sz, u16 * dif)
|
||||
esp_decrypt_packet_data_t * pd, u16 icv_sz)
|
||||
{
|
||||
vlib_buffer_t *before_last, *bp;
|
||||
u16 last_sz = pd->lb->current_length;
|
||||
@ -232,8 +232,6 @@ esp_move_icv (vlib_main_t * vm, vlib_buffer_t * first,
|
||||
clib_memcpy_fast (lb_curr, vlib_buffer_get_tail (before_last) - first_sz,
|
||||
first_sz);
|
||||
before_last->current_length -= first_sz;
|
||||
if (dif)
|
||||
dif[0] = first_sz;
|
||||
pd->lb = before_last;
|
||||
pd->icv_removed = 1;
|
||||
pd->free_buffer_index = before_last->next_buffer;
|
||||
@ -241,76 +239,6 @@ esp_move_icv (vlib_main_t * vm, vlib_buffer_t * first,
|
||||
return lb_curr;
|
||||
}
|
||||
|
||||
static_always_inline int
|
||||
esp_insert_esn (vlib_main_t * vm, ipsec_sa_t * sa,
|
||||
esp_decrypt_packet_data_t * pd, vnet_crypto_op_t * op,
|
||||
u16 * len, vlib_buffer_t * b, u8 * payload)
|
||||
{
|
||||
if (!ipsec_sa_is_set_USE_ESN (sa))
|
||||
return 1;
|
||||
|
||||
/* shift ICV by 4 bytes to insert ESN */
|
||||
u32 seq_hi = clib_host_to_net_u32 (sa->seq_hi);
|
||||
u8 tmp[ESP_MAX_ICV_SIZE], sz = sizeof (sa->seq_hi);
|
||||
|
||||
if (pd->icv_removed)
|
||||
{
|
||||
u16 space_left = vlib_buffer_space_left_at_end (vm, pd->lb);
|
||||
if (space_left >= sz)
|
||||
{
|
||||
clib_memcpy_fast (vlib_buffer_get_tail (pd->lb), &seq_hi, sz);
|
||||
op->len += sz;
|
||||
}
|
||||
else
|
||||
return 0;
|
||||
|
||||
len[0] = b->current_length;
|
||||
}
|
||||
else
|
||||
{
|
||||
clib_memcpy_fast (tmp, payload + len[0], ESP_MAX_ICV_SIZE);
|
||||
clib_memcpy_fast (payload + len[0], &seq_hi, sz);
|
||||
clib_memcpy_fast (payload + len[0] + sz, tmp, ESP_MAX_ICV_SIZE);
|
||||
op->len += sz;
|
||||
op->digest += sz;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
static_always_inline u8 *
|
||||
esp_move_icv_esn (vlib_main_t * vm, vlib_buffer_t * first,
|
||||
esp_decrypt_packet_data_t * pd, u16 icv_sz, ipsec_sa_t * sa,
|
||||
u8 * extra_esn, vnet_crypto_op_t * op)
|
||||
{
|
||||
u16 dif = 0;
|
||||
u8 *digest = esp_move_icv (vm, first, pd, icv_sz, &dif);
|
||||
if (dif)
|
||||
op->len -= dif;
|
||||
|
||||
if (ipsec_sa_is_set_USE_ESN (sa))
|
||||
{
|
||||
u8 sz = sizeof (sa->seq_hi);
|
||||
u32 seq_hi = clib_host_to_net_u32 (sa->seq_hi);
|
||||
u16 space_left = vlib_buffer_space_left_at_end (vm, pd->lb);
|
||||
|
||||
if (space_left >= sz)
|
||||
{
|
||||
clib_memcpy_fast (vlib_buffer_get_tail (pd->lb), &seq_hi, sz);
|
||||
op->len += sz;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* no space for ESN at the tail, use the next buffer
|
||||
* (with ICV data) */
|
||||
ASSERT (pd->icv_removed);
|
||||
vlib_buffer_t *tmp = vlib_get_buffer (vm, pd->free_buffer_index);
|
||||
clib_memcpy_fast (vlib_buffer_get_current (tmp) - sz, &seq_hi, sz);
|
||||
extra_esn[0] = 1;
|
||||
}
|
||||
}
|
||||
return digest;
|
||||
}
|
||||
|
||||
always_inline uword
|
||||
esp_decrypt_inline (vlib_main_t * vm,
|
||||
vlib_node_runtime_t * node, vlib_frame_t * from_frame,
|
||||
@ -318,6 +246,7 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
{
|
||||
ipsec_main_t *im = &ipsec_main;
|
||||
u32 thread_index = vm->thread_index;
|
||||
u16 buffer_data_size = vlib_buffer_get_default_data_size (vm);
|
||||
u16 len;
|
||||
ipsec_per_thread_data_t *ptd = vec_elt_at_index (im->ptd, thread_index);
|
||||
u32 *from = vlib_frame_vector_args (from_frame);
|
||||
@ -329,7 +258,6 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
u32 current_sa_index = ~0, current_sa_bytes = 0, current_sa_pkts = 0;
|
||||
const u8 esp_sz = sizeof (esp_header_t);
|
||||
ipsec_sa_t *sa0 = 0;
|
||||
vnet_crypto_op_t _op, *op = &_op;
|
||||
vnet_crypto_op_chunk_t *ch;
|
||||
vnet_crypto_op_t **crypto_ops = &ptd->crypto_ops;
|
||||
vnet_crypto_op_t **integ_ops = &ptd->integ_ops;
|
||||
@ -399,6 +327,7 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
/* store packet data for next round for easier prefetch */
|
||||
pd->sa_data = cpd.sa_data;
|
||||
pd->current_data = b[0]->current_data;
|
||||
pd->current_length = b[0]->current_length;
|
||||
pd->hdr_sz = pd->current_data - vnet_buffer (b[0])->l3_hdr_offset;
|
||||
payload = b[0]->data + pd->current_data;
|
||||
pd->seq = clib_host_to_net_u32 (((esp_header_t *) payload)->seq);
|
||||
@ -417,6 +346,17 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
}
|
||||
pd->current_length = b[0]->current_length;
|
||||
|
||||
/* we need 4 extra bytes for HMAC calculation when ESN are used */
|
||||
/* Chained buffers can process ESN as a separate chunk */
|
||||
if (pd->lb == b[0] && ipsec_sa_is_set_USE_ESN (sa0) && cpd.icv_sz &&
|
||||
(pd->lb->current_data + pd->lb->current_length + 4
|
||||
> buffer_data_size))
|
||||
{
|
||||
b[0]->error = node->errors[ESP_DECRYPT_ERROR_NO_TAIL_SPACE];
|
||||
next[0] = ESP_DECRYPT_NEXT_DROP;
|
||||
goto next;
|
||||
}
|
||||
|
||||
/* anti-reply check */
|
||||
if (ipsec_sa_anti_replay_check (sa0, pd->seq))
|
||||
{
|
||||
@ -438,6 +378,9 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
|
||||
if (PREDICT_TRUE (sa0->integ_op_id != VNET_CRYPTO_OP_NONE))
|
||||
{
|
||||
vnet_crypto_op_t *op;
|
||||
vec_add2_aligned (integ_ops[0], op, 1, CLIB_CACHE_LINE_BYTES);
|
||||
|
||||
vnet_crypto_op_init (op, sa0->integ_op_id);
|
||||
op->key_index = sa0->integ_key_index;
|
||||
op->src = payload;
|
||||
@ -451,42 +394,14 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
{
|
||||
/* buffer is chained */
|
||||
vlib_buffer_t *cb = b[0];
|
||||
op->len = pd->current_length;
|
||||
op->flags |= VNET_CRYPTO_OP_FLAG_CHAINED_BUFFERS;
|
||||
op->chunk_index = vec_len (ptd->chunks);
|
||||
|
||||
/* special case when ICV is splitted and needs to be reassembled
|
||||
* first -> move it to the last buffer. Also take into account
|
||||
* that ESN needs to be added after encrypted data and may or
|
||||
* may not fit in the tail.*/
|
||||
if (pd->lb->current_length < cpd.icv_sz)
|
||||
{
|
||||
u8 extra_esn = 0;
|
||||
op->digest =
|
||||
esp_move_icv_esn (vm, b[0], pd, cpd.icv_sz, sa0,
|
||||
&extra_esn, op);
|
||||
|
||||
if (extra_esn)
|
||||
{
|
||||
/* esn is in the last buffer, that was unlinked from
|
||||
* the chain */
|
||||
op->len = b[0]->current_length;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (pd->lb == b[0])
|
||||
{
|
||||
/* we now have a single buffer of crypto data, adjust
|
||||
* the length (second buffer contains only ICV) */
|
||||
integ_ops = &ptd->integ_ops;
|
||||
crypto_ops = &ptd->crypto_ops;
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
}
|
||||
op->digest = esp_move_icv (vm, b[0], pd, cpd.icv_sz);
|
||||
else
|
||||
op->digest = vlib_buffer_get_tail (pd->lb) - cpd.icv_sz;
|
||||
|
||||
op->flags |= VNET_CRYPTO_OP_FLAG_CHAINED_BUFFERS;
|
||||
op->chunk_index = vec_len (ptd->chunks);
|
||||
vec_add2 (ptd->chunks, ch, 1);
|
||||
ch->len = pd->current_length;
|
||||
ch->src = payload;
|
||||
@ -557,7 +472,6 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
ch->len += sz;
|
||||
}
|
||||
}
|
||||
break;
|
||||
}
|
||||
else
|
||||
ch->len = cb->current_length;
|
||||
@ -568,10 +482,17 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
cb = vlib_get_buffer (vm, cb->next_buffer);
|
||||
}
|
||||
}
|
||||
else
|
||||
esp_insert_esn (vm, sa0, pd, op, &len, b[0], payload);
|
||||
out:
|
||||
vec_add_aligned (integ_ops[0], op, 1, CLIB_CACHE_LINE_BYTES);
|
||||
else if (ipsec_sa_is_set_USE_ESN (sa0))
|
||||
{
|
||||
/* shift ICV by 4 bytes to insert ESN */
|
||||
u32 seq_hi = clib_host_to_net_u32 (sa0->seq_hi);
|
||||
u8 tmp[ESP_MAX_ICV_SIZE], sz = sizeof (sa0->seq_hi);
|
||||
clib_memcpy_fast (tmp, payload + len, ESP_MAX_ICV_SIZE);
|
||||
clib_memcpy_fast (payload + len, &seq_hi, sz);
|
||||
clib_memcpy_fast (payload + len + sz, tmp, ESP_MAX_ICV_SIZE);
|
||||
op->len += sz;
|
||||
op->digest += sz;
|
||||
}
|
||||
}
|
||||
|
||||
payload += esp_sz;
|
||||
@ -579,6 +500,8 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
|
||||
if (sa0->crypto_dec_op_id != VNET_CRYPTO_OP_NONE)
|
||||
{
|
||||
vnet_crypto_op_t *op;
|
||||
vec_add2_aligned (crypto_ops[0], op, 1, CLIB_CACHE_LINE_BYTES);
|
||||
vnet_crypto_op_init (op, sa0->crypto_dec_op_id);
|
||||
op->key_index = sa0->crypto_key_index;
|
||||
op->iv = payload;
|
||||
@ -639,9 +562,8 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
{
|
||||
if (pd->lb->current_length < cpd.icv_sz)
|
||||
{
|
||||
u16 dif = 0;
|
||||
op->tag =
|
||||
esp_move_icv (vm, b[0], pd, cpd.icv_sz, &dif);
|
||||
esp_move_icv (vm, b[0], pd, cpd.icv_sz);
|
||||
|
||||
/* this chunk does not contain crypto data */
|
||||
op->n_chunks -= 1;
|
||||
@ -649,10 +571,7 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
/* and fix previous chunk's length as it might have
|
||||
been changed */
|
||||
ASSERT (op->n_chunks > 0);
|
||||
if (pd->lb == b[0])
|
||||
ch[-1].len -= dif;
|
||||
else
|
||||
ch[-1].len = pd->lb->current_length;
|
||||
ch[-1].len = pd->lb->current_length;
|
||||
break;
|
||||
}
|
||||
else
|
||||
@ -674,8 +593,6 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
cb = vlib_get_buffer (vm, cb->next_buffer);
|
||||
}
|
||||
}
|
||||
|
||||
vec_add_aligned (crypto_ops[0], op, 1, CLIB_CACHE_LINE_BYTES);
|
||||
}
|
||||
|
||||
/* next */
|
||||
@ -826,7 +743,7 @@ esp_decrypt_inline (vlib_main_t * vm,
|
||||
clib_memcpy_le64 (ip, old_ip, ip_hdr_sz);
|
||||
|
||||
b[0]->current_data = pd->current_data + adv - ip_hdr_sz;
|
||||
b[0]->current_length += ip_hdr_sz - adv;
|
||||
b[0]->current_length = pd->current_length + ip_hdr_sz - adv;
|
||||
esp_remove_tail (vm, b[0], pd->lb, tail);
|
||||
|
||||
if (is_ip6)
|
||||
|
||||
@ -44,6 +44,7 @@ typedef enum
|
||||
_(SEQ_CYCLED, "sequence number cycled (packet dropped)") \
|
||||
_(CRYPTO_ENGINE_ERROR, "crypto engine error (packet dropped)") \
|
||||
_(NO_BUFFERS, "no buffers (packet dropped)") \
|
||||
_(NO_TRAILER_SPACE, "no trailer space (packet dropped)")
|
||||
|
||||
typedef enum
|
||||
{
|
||||
@ -90,8 +91,7 @@ format_esp_encrypt_trace (u8 * s, va_list * args)
|
||||
|
||||
/* pad packet in input buffer */
|
||||
static_always_inline u8 *
|
||||
esp_add_footer_and_icv (vlib_main_t * vm, vlib_buffer_t ** last,
|
||||
u8 block_size, u8 icv_sz,
|
||||
esp_add_footer_and_icv (vlib_buffer_t * b, u8 block_size, u8 icv_sz,
|
||||
u16 * next, vlib_node_runtime_t * node,
|
||||
u16 buffer_data_size, uword total_len)
|
||||
{
|
||||
@ -103,27 +103,18 @@ esp_add_footer_and_icv (vlib_main_t * vm, vlib_buffer_t ** last,
|
||||
u16 min_length = total_len + sizeof (esp_footer_t);
|
||||
u16 new_length = round_pow2 (min_length, block_size);
|
||||
u8 pad_bytes = new_length - min_length;
|
||||
esp_footer_t *f = (esp_footer_t *) (vlib_buffer_get_current (last[0]) +
|
||||
last[0]->current_length + pad_bytes);
|
||||
esp_footer_t *f = (esp_footer_t *) (vlib_buffer_get_current (b) +
|
||||
b->current_length + pad_bytes);
|
||||
u16 tail_sz = sizeof (esp_footer_t) + pad_bytes + icv_sz;
|
||||
|
||||
if (last[0]->current_length + tail_sz > buffer_data_size)
|
||||
if (b->current_data + tail_sz > buffer_data_size)
|
||||
{
|
||||
u32 tmp_bi = 0;
|
||||
if (vlib_buffer_alloc (vm, &tmp_bi, 1) != 1)
|
||||
return 0;
|
||||
|
||||
vlib_buffer_t *tmp = vlib_get_buffer (vm, tmp_bi);
|
||||
last[0]->next_buffer = tmp_bi;
|
||||
last[0]->flags |= VLIB_BUFFER_NEXT_PRESENT;
|
||||
f = (esp_footer_t *) (vlib_buffer_get_current (tmp) + pad_bytes);
|
||||
tmp->current_length += tail_sz;
|
||||
last[0] = tmp;
|
||||
// TODO alloc new buffer
|
||||
b->error = node->errors[ESP_ENCRYPT_ERROR_NO_TRAILER_SPACE];
|
||||
next[0] = ESP_ENCRYPT_NEXT_DROP;
|
||||
return 0;
|
||||
}
|
||||
else
|
||||
last[0]->current_length += tail_sz;
|
||||
|
||||
f->pad_length = pad_bytes;
|
||||
if (pad_bytes)
|
||||
{
|
||||
ASSERT (pad_bytes <= ESP_MAX_BLOCK_SIZE);
|
||||
@ -131,6 +122,8 @@ esp_add_footer_and_icv (vlib_main_t * vm, vlib_buffer_t ** last,
|
||||
clib_memcpy_fast ((u8 *) f - pad_bytes, pad_data, pad_bytes);
|
||||
}
|
||||
|
||||
f->pad_length = pad_bytes;
|
||||
b->current_length += tail_sz;
|
||||
return &f->next_header;
|
||||
}
|
||||
|
||||
@ -409,17 +402,13 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
|
||||
if (ipsec_sa_is_set_IS_TUNNEL (sa0))
|
||||
{
|
||||
payload = vlib_buffer_get_current (b[0]);
|
||||
next_hdr_ptr = esp_add_footer_and_icv (vm, &lb, block_sz, icv_sz,
|
||||
next_hdr_ptr = esp_add_footer_and_icv (lb, block_sz, icv_sz,
|
||||
next, node,
|
||||
buffer_data_size,
|
||||
vlib_buffer_length_in_chain
|
||||
(vm, b[0]));
|
||||
if (!next_hdr_ptr)
|
||||
{
|
||||
b[0]->error = node->errors[ESP_ENCRYPT_ERROR_NO_BUFFERS];
|
||||
next[0] = ESP_ENCRYPT_NEXT_DROP;
|
||||
goto trace;
|
||||
}
|
||||
goto trace;
|
||||
b[0]->flags &= ~VLIB_BUFFER_TOTAL_LENGTH_VALID;
|
||||
payload_len = b[0]->current_length;
|
||||
payload_len_total = vlib_buffer_length_in_chain (vm, b[0]);
|
||||
@ -482,7 +471,7 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
|
||||
|
||||
vlib_buffer_advance (b[0], ip_len);
|
||||
payload = vlib_buffer_get_current (b[0]);
|
||||
next_hdr_ptr = esp_add_footer_and_icv (vm, &lb, block_sz, icv_sz,
|
||||
next_hdr_ptr = esp_add_footer_and_icv (lb, block_sz, icv_sz,
|
||||
next, node,
|
||||
buffer_data_size,
|
||||
vlib_buffer_length_in_chain
|
||||
|
||||
@ -509,10 +509,9 @@ class RunTestIpsecEspAll(ConfigIpsecESP,
|
||||
count=NUM_PKTS)
|
||||
|
||||
LARGE_PKT_SZ = [
|
||||
1970, # results in 2 chained buffers entering decrypt node
|
||||
# but leaving as simple buffer due to ICV removal (tra4)
|
||||
4010, # ICV ends up splitted accross 2 buffers in esp_decrypt
|
||||
# for transport4; transport6 takes normal path
|
||||
|
||||
4020, # same as above but tra4 and tra6 are switched
|
||||
]
|
||||
if self.engine in engines_supporting_chain_bufs:
|
||||
|
||||
Reference in New Issue
Block a user