From 8734e669fc175bf652020bc30d67d99a7073f1a4 Mon Sep 17 00:00:00 2001 From: Lukasz Bartosik Date: Wed, 5 Jun 2019 17:31:27 +0200 Subject: [PATCH] ipsec: include high order bytes of ESN in packet length When esn is used then high-order 32 bits are included in ICV calculation however are not transmitted. Update packet length to be consistent with auth data offset and length before crypto operation. High-order 32 bits of esn will be removed from packet length in crypto post processing. Signed-off-by: Lukasz Bartosik Acked-by: Konstantin Ananyev Acked-by: Akhil Goyal --- lib/librte_ipsec/esp_inb.c | 60 ++++++++++++++++++++++++++++--------- lib/librte_ipsec/esp_outb.c | 36 ++++++++++++---------- lib/librte_ipsec/sa.c | 4 +-- lib/librte_ipsec/sa.h | 8 +++++ 4 files changed, 76 insertions(+), 32 deletions(-) diff --git a/lib/librte_ipsec/esp_inb.c b/lib/librte_ipsec/esp_inb.c index 819d2bf25c..fb10b70853 100644 --- a/lib/librte_ipsec/esp_inb.c +++ b/lib/librte_ipsec/esp_inb.c @@ -16,7 +16,8 @@ #include "pad.h" typedef uint16_t (*esp_inb_process_t)(const struct rte_ipsec_sa *sa, - struct rte_mbuf *mb[], uint32_t sqn[], uint32_t dr[], uint16_t num); + struct rte_mbuf *mb[], uint32_t sqn[], uint32_t dr[], uint16_t num, + uint8_t sqh_len); /* * helper function to fill crypto_sym op for cipher+auth algorithms. @@ -228,6 +229,15 @@ inb_pkt_prepare(const struct rte_ipsec_sa *sa, const struct replay_sqn *rsn, icv->va = rte_pktmbuf_mtod_offset(ml, void *, icv_ofs); icv->pa = rte_pktmbuf_iova_offset(ml, icv_ofs); + /* + * if esn is used then high-order 32 bits are also used in ICV + * calculation but are not transmitted, update packet length + * to be consistent with auth data length and offset, this will + * be subtracted from packet length in post crypto processing + */ + mb->pkt_len += sa->sqh_len; + ml->data_len += sa->sqh_len; + inb_pkt_xprepare(sa, sqn, icv); return plen; } @@ -443,20 +453,23 @@ tun_process_step3(struct rte_mbuf *mb, uint64_t txof_msk, uint64_t txof_val) mb->ol_flags &= ~PKT_RX_SEC_OFFLOAD; } - /* * *process* function for tunnel packets */ static inline uint16_t tun_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], - uint32_t sqn[], uint32_t dr[], uint16_t num) + uint32_t sqn[], uint32_t dr[], uint16_t num, uint8_t sqh_len) { uint32_t adj, i, k, tl; uint32_t hl[num], to[num]; struct esp_tail espt[num]; struct rte_mbuf *ml[num]; - const uint32_t tlen = sa->icv_len + sizeof(espt[0]); + /* + * remove icv, esp trailer and high-order + * 32 bits of esn from packet length + */ + const uint32_t tlen = sa->icv_len + sizeof(espt[0]) + sqh_len; const uint32_t cofs = sa->ctp.cipher.offset; /* @@ -496,7 +509,7 @@ tun_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], */ static inline uint16_t trs_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], - uint32_t sqn[], uint32_t dr[], uint16_t num) + uint32_t sqn[], uint32_t dr[], uint16_t num, uint8_t sqh_len) { char *np; uint32_t i, k, l2, tl; @@ -504,7 +517,11 @@ trs_process(const struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], struct esp_tail espt[num]; struct rte_mbuf *ml[num]; - const uint32_t tlen = sa->icv_len + sizeof(espt[0]); + /* + * remove icv, esp trailer and high-order + * 32 bits of esn from packet length + */ + const uint32_t tlen = sa->icv_len + sizeof(espt[0]) + sqh_len; const uint32_t cofs = sa->ctp.cipher.offset; /* @@ -572,18 +589,15 @@ esp_inb_rsn_update(struct rte_ipsec_sa *sa, const uint32_t sqn[], * process group of ESP inbound packets. */ static inline uint16_t -esp_inb_pkt_process(const struct rte_ipsec_session *ss, - struct rte_mbuf *mb[], uint16_t num, esp_inb_process_t process) +esp_inb_pkt_process(struct rte_ipsec_sa *sa, struct rte_mbuf *mb[], + uint16_t num, uint8_t sqh_len, esp_inb_process_t process) { uint32_t k, n; - struct rte_ipsec_sa *sa; uint32_t sqn[num]; uint32_t dr[num]; - sa = ss->sa; - /* process packets, extract seq numbers */ - k = process(sa, mb, sqn, dr, num); + k = process(sa, mb, sqn, dr, num, sqh_len); /* handle unprocessed mbufs */ if (k != num && k != 0) @@ -609,7 +623,16 @@ uint16_t esp_inb_tun_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num) { - return esp_inb_pkt_process(ss, mb, num, tun_process); + struct rte_ipsec_sa *sa = ss->sa; + + return esp_inb_pkt_process(sa, mb, num, sa->sqh_len, tun_process); +} + +uint16_t +inline_inb_tun_pkt_process(const struct rte_ipsec_session *ss, + struct rte_mbuf *mb[], uint16_t num) +{ + return esp_inb_pkt_process(ss->sa, mb, num, 0, tun_process); } /* @@ -619,5 +642,14 @@ uint16_t esp_inb_trs_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num) { - return esp_inb_pkt_process(ss, mb, num, trs_process); + struct rte_ipsec_sa *sa = ss->sa; + + return esp_inb_pkt_process(sa, mb, num, sa->sqh_len, trs_process); +} + +uint16_t +inline_inb_trs_pkt_process(const struct rte_ipsec_session *ss, + struct rte_mbuf *mb[], uint16_t num) +{ + return esp_inb_pkt_process(ss->sa, mb, num, 0, trs_process); } diff --git a/lib/librte_ipsec/esp_outb.c b/lib/librte_ipsec/esp_outb.c index 862a9982da..8c6db3553c 100644 --- a/lib/librte_ipsec/esp_outb.c +++ b/lib/librte_ipsec/esp_outb.c @@ -104,7 +104,7 @@ outb_cop_prepare(struct rte_crypto_op *cop, static inline int32_t outb_tun_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc, const uint64_t ivp[IPSEC_MAX_IV_QWORD], struct rte_mbuf *mb, - union sym_op_data *icv) + union sym_op_data *icv, uint8_t sqh_len) { uint32_t clen, hlen, l2len, pdlen, pdofs, plen, tlen; struct rte_mbuf *ml; @@ -126,11 +126,11 @@ outb_tun_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc, /* pad length + esp tail */ pdlen = clen - plen; - tlen = pdlen + sa->icv_len; + tlen = pdlen + sa->icv_len + sqh_len; /* do append and prepend */ ml = rte_pktmbuf_lastseg(mb); - if (tlen + sa->sqh_len + sa->aad_len > rte_pktmbuf_tailroom(ml)) + if (tlen + sa->aad_len > rte_pktmbuf_tailroom(ml)) return -ENOSPC; /* prepend header */ @@ -152,8 +152,8 @@ outb_tun_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc, rte_memcpy(ph, sa->hdr, sa->hdr_len); /* update original and new ip header fields */ - update_tun_l3hdr(sa, ph + sa->hdr_l3_off, mb->pkt_len, sa->hdr_l3_off, - sqn_low16(sqc)); + update_tun_l3hdr(sa, ph + sa->hdr_l3_off, mb->pkt_len - sqh_len, + sa->hdr_l3_off, sqn_low16(sqc)); /* update spi, seqn and iv */ esph = (struct rte_esp_hdr *)(ph + sa->hdr_len); @@ -242,8 +242,8 @@ esp_outb_tun_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], gen_iv(iv, sqc); /* try to update the packet itself */ - rc = outb_tun_pkt_prepare(sa, sqc, iv, mb[i], &icv); - + rc = outb_tun_pkt_prepare(sa, sqc, iv, mb[i], &icv, + sa->sqh_len); /* success, setup crypto op */ if (rc >= 0) { outb_pkt_xprepare(sa, sqc, &icv); @@ -270,7 +270,8 @@ esp_outb_tun_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], static inline int32_t outb_trs_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc, const uint64_t ivp[IPSEC_MAX_IV_QWORD], struct rte_mbuf *mb, - uint32_t l2len, uint32_t l3len, union sym_op_data *icv) + uint32_t l2len, uint32_t l3len, union sym_op_data *icv, + uint8_t sqh_len) { uint8_t np; uint32_t clen, hlen, pdlen, pdofs, plen, tlen, uhlen; @@ -292,11 +293,11 @@ outb_trs_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc, /* pad length + esp tail */ pdlen = clen - plen; - tlen = pdlen + sa->icv_len; + tlen = pdlen + sa->icv_len + sqh_len; /* do append and insert */ ml = rte_pktmbuf_lastseg(mb); - if (tlen + sa->sqh_len + sa->aad_len > rte_pktmbuf_tailroom(ml)) + if (tlen + sa->aad_len > rte_pktmbuf_tailroom(ml)) return -ENOSPC; /* prepend space for ESP header */ @@ -314,8 +315,8 @@ outb_trs_pkt_prepare(struct rte_ipsec_sa *sa, rte_be64_t sqc, insert_esph(ph, ph + hlen, uhlen); /* update ip header fields */ - np = update_trs_l3hdr(sa, ph + l2len, mb->pkt_len, l2len, l3len, - IPPROTO_ESP); + np = update_trs_l3hdr(sa, ph + l2len, mb->pkt_len - sqh_len, l2len, + l3len, IPPROTO_ESP); /* update spi, seqn and iv */ esph = (struct rte_esp_hdr *)(ph + uhlen); @@ -380,8 +381,8 @@ esp_outb_trs_prepare(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], gen_iv(iv, sqc); /* try to update the packet itself */ - rc = outb_trs_pkt_prepare(sa, sqc, iv, mb[i], l2, l3, &icv); - + rc = outb_trs_pkt_prepare(sa, sqc, iv, mb[i], l2, l3, &icv, + sa->sqh_len); /* success, setup crypto op */ if (rc >= 0) { outb_pkt_xprepare(sa, sqc, &icv); @@ -425,6 +426,9 @@ esp_outb_sqh_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], for (i = 0; i != num; i++) { if ((mb[i]->ol_flags & PKT_RX_SEC_OFFLOAD_FAILED) == 0) { ml = rte_pktmbuf_lastseg(mb[i]); + /* remove high-order 32 bits of esn from packet len */ + mb[i]->pkt_len -= sa->sqh_len; + ml->data_len -= sa->sqh_len; icv = rte_pktmbuf_mtod_offset(ml, void *, ml->data_len - icv_len); remove_sqh(icv, icv_len); @@ -494,7 +498,7 @@ inline_outb_tun_pkt_process(const struct rte_ipsec_session *ss, gen_iv(iv, sqc); /* try to update the packet itself */ - rc = outb_tun_pkt_prepare(sa, sqc, iv, mb[i], &icv); + rc = outb_tun_pkt_prepare(sa, sqc, iv, mb[i], &icv, 0); k += (rc >= 0); @@ -548,7 +552,7 @@ inline_outb_trs_pkt_process(const struct rte_ipsec_session *ss, /* try to update the packet itself */ rc = outb_trs_pkt_prepare(sa, sqc, iv, mb[i], - l2, l3, &icv); + l2, l3, &icv, 0); k += (rc >= 0); diff --git a/lib/librte_ipsec/sa.c b/lib/librte_ipsec/sa.c index 81e3437bb5..c117d84945 100644 --- a/lib/librte_ipsec/sa.c +++ b/lib/librte_ipsec/sa.c @@ -612,10 +612,10 @@ inline_crypto_pkt_func_select(const struct rte_ipsec_sa *sa, switch (sa->type & msk) { case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV4): case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TUNLV6): - pf->process = esp_inb_tun_pkt_process; + pf->process = inline_inb_tun_pkt_process; break; case (RTE_IPSEC_SATP_DIR_IB | RTE_IPSEC_SATP_MODE_TRANS): - pf->process = esp_inb_trs_pkt_process; + pf->process = inline_inb_trs_pkt_process; break; case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV4): case (RTE_IPSEC_SATP_DIR_OB | RTE_IPSEC_SATP_MODE_TUNLV6): diff --git a/lib/librte_ipsec/sa.h b/lib/librte_ipsec/sa.h index ffb5fb4f8c..20c0a65c00 100644 --- a/lib/librte_ipsec/sa.h +++ b/lib/librte_ipsec/sa.h @@ -142,10 +142,18 @@ uint16_t esp_inb_tun_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num); +uint16_t +inline_inb_tun_pkt_process(const struct rte_ipsec_session *ss, + struct rte_mbuf *mb[], uint16_t num); + uint16_t esp_inb_trs_pkt_process(const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num); +uint16_t +inline_inb_trs_pkt_process(const struct rte_ipsec_session *ss, + struct rte_mbuf *mb[], uint16_t num); + /* outbound processing */ uint16_t -- 2.20.1