ipsec: include high order bytes of ESN in packet length

When esn is used then high-order 32 bits are included in ICV
calculation however are not transmitted. Update packet length
to be consistent with auth data offset and length before crypto
operation. High-order 32 bits of esn will be removed from packet
length in crypto post processing.

Signed-off-by: Lukasz Bartosik <lbartosik@marvell.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev@intel.com>
Acked-by: Akhil Goyal <akhil.goyal@nxp.com>

diff --git a/lib/librte_ipsec/esp_inb.c b/lib/librte_ipsec/esp_inb.c
index 819d2bf..fb10b70 100644 (file)
--- a/lib/librte_ipsec/esp_inb.c
+++ b/lib/librte_ipsec/esp_inb.c
@@ -16,7 +16,8 @@
 #include "pad.h"
 
 typedef uint16_t (*esp_inb_process_t)(const struct rte_ipsec_sa *sa,
-       struct rte_mbuf *mb[], uint32_t sqn[], uint32_t dr[], uint16_t num);
+       struct rte_mbuf *mb[], uint32_t sqn[], uint32_t dr[], uint16_t num,
+       uint8_t sqh_len);
 
 /*
  * helper function to fill crypto_sym op for cipher+auth algorithms.
@@ -228,6 +229,15 @@ inb_pkt_prepare(const struct rte_ipsec_sa *sa, const struct replay_sqn *rsn,
        icv->va = rte_pktmbuf_mtod_offset(ml, void *, icv_ofs);
        icv->pa = rte_pktmbuf_iova_offset(ml, icv_ofs);
 
+       /*
+        * if esn is used then high-order 32 bits are also used in ICV
+        * calculation but are not transmitted, update packet length
+        * to be consistent with auth data length and offset, this will
+        * be subtracted from packet length in post crypto processing
+        */
+       mb->pkt_len += sa->sqh_len;
+       ml->data_len += sa->sqh_len;
+
        inb_pkt_xprepare(sa, sqn, icv);
        return plen;
 }
@@ -443,20 +453,23 @@ tun_process_step3(struct rte_mbuf *mb, uint64_t txof_msk, uint64_t txof_val)
        mb->ol_flags &= ~PKT_RX_SEC_OFFLOAD;
 }
 
-
 /*
  * *process* function for tunnel packets
  */
 static inline uint16_t
 tun_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[],
-       uint32_t sqn[], uint32_t dr[], uint16_t num)
+           uint32_t sqn[], uint32_t dr[], uint16_t num, uint8_t sqh_len)
 {
        uint32_t adj, i, k, tl;
        uint32_t hl[num], to[num];
        struct esp_tail espt[num];
        struct rte_mbuf *ml[num];
 
-       const uint32_t tlen = sa->icv_len + sizeof(espt[0]);
+       /*
+        * remove icv, esp trailer and high-order
+        * 32 bits of esn from packet length
+        */
+       const uint32_t tlen = sa->icv_len + sizeof(espt[0]) + sqh_len;
        const uint32_t cofs = sa->ctp.cipher.offset;
 
        /*
@@ -496,7 +509,7 @@ tun_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[],
  */
 static inline uint16_t
 trs_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[],
-       uint32_t sqn[], uint32_t dr[], uint16_t num)
+       uint32_t sqn[], uint32_t dr[], uint16_t num, uint8_t sqh_len)
 {
        char *np;
        uint32_t i, k, l2, tl;
@@ -504,7 +517,11 @@ trs_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[],
        struct esp_tail espt[num];
        struct rte_mbuf *ml[num];
 
-       const uint32_t tlen = sa->icv_len + sizeof(espt[0]);
+       /*
+        * remove icv, esp trailer and high-order
+        * 32 bits of esn from packet length
+        */
+       const uint32_t tlen = sa->icv_len + sizeof(espt[0]) + sqh_len;
        const uint32_t cofs = sa->ctp.cipher.offset;
 
        /*
@@ -572,18 +589,15 @@ esp_inb_rsn_update(struct rte_ipsec_sa *sa, const uint32_t sqn[],
  * process group of ESP inbound packets.
  */
 static inline uint16_t
-esp_inb_pkt_process(const struct rte_ipsec_session *ss,
-       struct rte_mbuf *mb[], uint16_t num, esp_inb_process_t process)
+esp_inb_pkt_process(struct rte_ipsec_sa *sa, struct rte_mbuf *mb[],
+       uint16_t num, uint8_t sqh_len, esp_inb_process_t process)
 {
        uint32_t k, n;
-       struct rte_ipsec_sa *sa;
        uint32_t sqn[num];
        uint32_t dr[num];
 
-       sa = ss->sa;
-
        /* process packets, extract seq numbers */
-       k = process(sa, mb, sqn, dr, num);
+       k = process(sa, mb, sqn, dr, num, sqh_len);
 
        /* handle unprocessed mbufs */
        if (k != num && k != 0)
@@ -609,7 +623,16 @@ uint16_t
 esp_inb_tun_pkt_process(const struct rte_ipsec_session *ss,
        struct rte_mbuf *mb[], uint16_t num)
 {
-       return esp_inb_pkt_process(ss, mb, num, tun_process);
+       struct rte_ipsec_sa *sa = ss->sa;
+
+       return esp_inb_pkt_process(sa, mb, num, sa->sqh_len, tun_process);
+}
+
+uint16_t
+inline_inb_tun_pkt_process(const struct rte_ipsec_session *ss,
+       struct rte_mbuf *mb[], uint16_t num)
+{
+       return esp_inb_pkt_process(ss->sa, mb, num, 0, tun_process);
 }
 
 /*
@@ -619,5 +642,14 @@ uint16_t
 esp_inb_trs_pkt_process(const struct rte_ipsec_session *ss,
        struct rte_mbuf *mb[], uint16_t num)
 {
-       return esp_inb_pkt_process(ss, mb, num, trs_process);
+       struct rte_ipsec_sa *sa = ss->sa;
+
+       return esp_inb_pkt_process(sa, mb, num, sa->sqh_len, trs_process);
+}
+
+uint16_t
+inline_inb_trs_pkt_process(const struct rte_ipsec_session *ss,
+       struct rte_mbuf *mb[], uint16_t num)
+{
+       return esp_inb_pkt_process(ss->sa, mb, num, 0, trs_process);
 }

diff --git a/lib/librte_ipsec/esp_outb.c b/lib/librte_ipsec/esp_outb.c
index 862a998..8c6db35 100644 (file)
--- a/lib/librte_ipsec/esp_outb.c
+++ b/lib/librte_ipsec/esp_outb.c
@@ -104,7 +104,7 @@ outb_cop_prepare(struct rte_crypto_op *cop,
 static inline int32_t
 outb_tun_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc,
        const uint64_t ivp[IPSEC_MAX_IV_QWORD], struct rte_mbuf *mb,
-       union sym_op_data *icv)
+       union sym_op_data *icv, uint8_t sqh_len)
 {
        uint32_t clen, hlen, l2len, pdlen, pdofs, plen, tlen;
        struct rte_mbuf *ml;
@@ -126,11 +126,11 @@ outb_tun_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc,
 
        /* pad length + esp tail */
        pdlen = clen - plen;
-       tlen = pdlen + sa->icv_len;
+       tlen = pdlen + sa->icv_len + sqh_len;
 
        /* do append and prepend */
        ml = rte_pktmbuf_lastseg(mb);
-       if (tlen + sa->sqh_len + sa->aad_len > rte_pktmbuf_tailroom(ml))
+       if (tlen + sa->aad_len > rte_pktmbuf_tailroom(ml))
                return -ENOSPC;
 
        /* prepend header */
@@ -152,8 +152,8 @@ outb_tun_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc,
        rte_memcpy(ph, sa->hdr, sa->hdr_len);
 
        /* update original and new ip header fields */
-       update_tun_l3hdr(sa, ph + sa->hdr_l3_off, mb->pkt_len, sa->hdr_l3_off,
-                       sqn_low16(sqc));
+       update_tun_l3hdr(sa, ph + sa->hdr_l3_off, mb->pkt_len - sqh_len,
+                       sa->hdr_l3_off, sqn_low16(sqc));
 
        /* update spi, seqn and iv */
        esph = (struct rte_esp_hdr *)(ph + sa->hdr_len);
@@ -242,8 +242,8 @@ esp_outb_tun_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[],
                gen_iv(iv, sqc);
 
                /* try to update the packet itself */
-               rc = outb_tun_pkt_prepare(sa, sqc, iv, mb[i], &icv);
-
+               rc = outb_tun_pkt_prepare(sa, sqc, iv, mb[i], &icv,
+                                         sa->sqh_len);
                /* success, setup crypto op */
                if (rc >= 0) {
                        outb_pkt_xprepare(sa, sqc, &icv);
@@ -270,7 +270,8 @@ esp_outb_tun_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[],
 static inline int32_t
 outb_trs_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc,
        const uint64_t ivp[IPSEC_MAX_IV_QWORD], struct rte_mbuf *mb,
-       uint32_t l2len, uint32_t l3len, union sym_op_data *icv)
+       uint32_t l2len, uint32_t l3len, union sym_op_data *icv,
+       uint8_t sqh_len)
 {
        uint8_t np;
        uint32_t clen, hlen, pdlen, pdofs, plen, tlen, uhlen;
@@ -292,11 +293,11 @@ outb_trs_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc,
 
        /* pad length + esp tail */
        pdlen = clen - plen;
-       tlen = pdlen + sa->icv_len;
+       tlen = pdlen + sa->icv_len + sqh_len;
 
        /* do append and insert */
        ml = rte_pktmbuf_lastseg(mb);
-       if (tlen + sa->sqh_len + sa->aad_len > rte_pktmbuf_tailroom(ml))
+       if (tlen + sa->aad_len > rte_pktmbuf_tailroom(ml))
                return -ENOSPC;
 
        /* prepend space for ESP header */
@@ -314,8 +315,8 @@ outb_trs_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc,
        insert_esph(ph, ph + hlen, uhlen);
 
        /* update ip  header fields */
-       np = update_trs_l3hdr(sa, ph + l2len, mb->pkt_len, l2len, l3len,
-                       IPPROTO_ESP);
+       np = update_trs_l3hdr(sa, ph + l2len, mb->pkt_len - sqh_len, l2len,
+                       l3len, IPPROTO_ESP);
 
        /* update spi, seqn and iv */
        esph = (struct rte_esp_hdr *)(ph + uhlen);
@@ -380,8 +381,8 @@ esp_outb_trs_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[],
                gen_iv(iv, sqc);
 
                /* try to update the packet itself */
-               rc = outb_trs_pkt_prepare(sa, sqc, iv, mb[i], l2, l3, &icv);
-
+               rc = outb_trs_pkt_prepare(sa, sqc, iv, mb[i], l2, l3, &icv,
+                                         sa->sqh_len);
                /* success, setup crypto op */
                if (rc >= 0) {
                        outb_pkt_xprepare(sa, sqc, &icv);
@@ -425,6 +426,9 @@ esp_outb_sqh_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[],
        for (i = 0; i != num; i++) {
                if ((mb[i]->ol_flags & PKT_RX_SEC_OFFLOAD_FAILED) == 0) {
                        ml = rte_pktmbuf_lastseg(mb[i]);
+                       /* remove high-order 32 bits of esn from packet len */
+                       mb[i]->pkt_len -= sa->sqh_len;
+                       ml->data_len -= sa->sqh_len;
                        icv = rte_pktmbuf_mtod_offset(ml, void *,
                                ml->data_len - icv_len);
                        remove_sqh(icv, icv_len);
@@ -494,7 +498,7 @@ inline_outb_tun_pkt_process(const struct rte_ipsec_session *ss,
                gen_iv(iv, sqc);
 
                /* try to update the packet itself */
-               rc = outb_tun_pkt_prepare(sa, sqc, iv, mb[i], &icv);
+               rc = outb_tun_pkt_prepare(sa, sqc, iv, mb[i], &icv, 0);
 
                k += (rc >= 0);
 
@@ -548,7 +552,7 @@ inline_outb_trs_pkt_process(const struct rte_ipsec_session *ss,
 
                /* try to update the packet itself */
                rc = outb_trs_pkt_prepare(sa, sqc, iv, mb[i],
-                               l2, l3, &icv);
+                               l2, l3, &icv, 0);
 
                k += (rc >= 0);
 

diff --git a/lib/librte_ipsec/sa.c b/lib/librte_ipsec/sa.c
index 81e3437..c117d84 100644 (file)
--- a/lib/librte_ipsec/sa.c
+++ b/lib/librte_ipsec/sa.c
@@ -612,10 +612,10 @@ inline_crypto_pkt_func_select(const struct rte_ipsec_sa *sa,
        switch (sa->type & msk) {
        case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4):
        case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6):
-               pf->process = esp_inb_tun_pkt_process;
+               pf->process = inline_inb_tun_pkt_process;
                break;
        case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS):
-               pf->process = esp_inb_trs_pkt_process;
+               pf->process = inline_inb_trs_pkt_process;
                break;
        case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4):
        case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6):

diff --git a/lib/librte_ipsec/sa.h b/lib/librte_ipsec/sa.h
index ffb5fb4..20c0a65 100644 (file)
--- a/lib/librte_ipsec/sa.h
+++ b/lib/librte_ipsec/sa.h
@@ -142,10 +142,18 @@ uint16_t
 esp_inb_tun_pkt_process(const struct rte_ipsec_session *ss,
        struct rte_mbuf *mb[], uint16_t num);
 
+uint16_t
+inline_inb_tun_pkt_process(const struct rte_ipsec_session *ss,
+       struct rte_mbuf *mb[], uint16_t num);
+
 uint16_t
 esp_inb_trs_pkt_process(const struct rte_ipsec_session *ss,
        struct rte_mbuf *mb[], uint16_t num);
 
+uint16_t
+inline_inb_trs_pkt_process(const struct rte_ipsec_session *ss,
+       struct rte_mbuf *mb[], uint16_t num);
+
 /* outbound processing */
 
 uint16_t