X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fesp.h;h=50c4d395ff9eedb84356b0e3870a6bfd9a01ed7a;hb=b4d3053;hp=799003b9e6104bf88389726c62270af86ac17b54;hpb=586afd762bfa149f5ca167bd5fd5a0cd59ce94fe;p=vpp.git diff --git a/src/vnet/ipsec/esp.h b/src/vnet/ipsec/esp.h index 799003b9e61..50c4d395ff9 100644 --- a/src/vnet/ipsec/esp.h +++ b/src/vnet/ipsec/esp.h @@ -15,6 +15,9 @@ #ifndef __ESP_H__ #define __ESP_H__ +#include +#include + #include #include #include @@ -39,6 +42,14 @@ typedef CLIB_PACKED (struct { }) ip4_and_esp_header_t; /* *INDENT-ON* */ +/* *INDENT-OFF* */ +typedef CLIB_PACKED (struct { + ip4_header_t ip4; + udp_header_t udp; + esp_header_t esp; +}) ip4_and_udp_and_esp_header_t; +/* *INDENT-ON* */ + /* *INDENT-OFF* */ typedef CLIB_PACKED (struct { ip6_header_t ip6; @@ -49,39 +60,54 @@ typedef CLIB_PACKED (struct { typedef struct { const EVP_CIPHER *type; -} esp_crypto_alg_t; + u8 iv_size; + u8 block_size; +} ipsec_proto_main_crypto_alg_t; typedef struct { const EVP_MD *md; u8 trunc_size; -} esp_integ_alg_t; +} ipsec_proto_main_integ_alg_t; typedef struct { CLIB_CACHE_LINE_ALIGN_MARK (cacheline0); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + EVP_CIPHER_CTX *encrypt_ctx; +#else EVP_CIPHER_CTX encrypt_ctx; +#endif CLIB_CACHE_LINE_ALIGN_MARK (cacheline1); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + EVP_CIPHER_CTX *decrypt_ctx; +#else EVP_CIPHER_CTX decrypt_ctx; +#endif CLIB_CACHE_LINE_ALIGN_MARK (cacheline2); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + HMAC_CTX *hmac_ctx; +#else HMAC_CTX hmac_ctx; +#endif ipsec_crypto_alg_t last_encrypt_alg; ipsec_crypto_alg_t last_decrypt_alg; ipsec_integ_alg_t last_integ_alg; -} esp_main_per_thread_data_t; +} ipsec_proto_main_per_thread_data_t; typedef struct { - esp_crypto_alg_t *esp_crypto_algs; - esp_integ_alg_t *esp_integ_algs; - esp_main_per_thread_data_t *per_thread_data; -} esp_main_t; + ipsec_proto_main_crypto_alg_t *ipsec_proto_main_crypto_algs; + ipsec_proto_main_integ_alg_t *ipsec_proto_main_integ_algs; + ipsec_proto_main_per_thread_data_t *per_thread_data; +} ipsec_proto_main_t; -esp_main_t esp_main; +extern ipsec_proto_main_t ipsec_proto_main; #define ESP_WINDOW_SIZE (64) #define ESP_SEQ_MAX (4294967295UL) +u8 *format_esp_header (u8 * s, va_list * args); always_inline int esp_replay_check (ipsec_sa_t * sa, u32 seq) @@ -228,38 +254,58 @@ esp_seq_advance (ipsec_sa_t * sa) } always_inline void -esp_init () +ipsec_proto_init () { - esp_main_t *em = &esp_main; + ipsec_proto_main_t *em = &ipsec_proto_main; vlib_thread_main_t *tm = vlib_get_thread_main (); - memset (em, 0, sizeof (em[0])); - - vec_validate (em->esp_crypto_algs, IPSEC_CRYPTO_N_ALG - 1); - em->esp_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_128].type = EVP_aes_128_cbc (); - em->esp_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_192].type = EVP_aes_192_cbc (); - em->esp_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_256].type = EVP_aes_256_cbc (); - - vec_validate (em->esp_integ_algs, IPSEC_INTEG_N_ALG - 1); - esp_integ_alg_t *i; - - i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA1_96]; + clib_memset (em, 0, sizeof (em[0])); + + vec_validate (em->ipsec_proto_main_crypto_algs, IPSEC_CRYPTO_N_ALG - 1); + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_128].type = + EVP_aes_128_cbc (); + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_192].type = + EVP_aes_192_cbc (); + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_256].type = + EVP_aes_256_cbc (); + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_128].iv_size = 16; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_192].iv_size = 16; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_256].iv_size = 16; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_128].block_size = + 16; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_192].block_size = + 16; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_AES_CBC_256].block_size = + 16; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_DES_CBC].type = + EVP_des_cbc (); + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_3DES_CBC].type = + EVP_des_ede3_cbc (); + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_DES_CBC].block_size = 8; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_3DES_CBC].block_size = 8; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_DES_CBC].iv_size = 8; + em->ipsec_proto_main_crypto_algs[IPSEC_CRYPTO_ALG_3DES_CBC].iv_size = 8; + + vec_validate (em->ipsec_proto_main_integ_algs, IPSEC_INTEG_N_ALG - 1); + ipsec_proto_main_integ_alg_t *i; + + i = &em->ipsec_proto_main_integ_algs[IPSEC_INTEG_ALG_SHA1_96]; i->md = EVP_sha1 (); i->trunc_size = 12; - i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA_256_96]; + i = &em->ipsec_proto_main_integ_algs[IPSEC_INTEG_ALG_SHA_256_96]; i->md = EVP_sha256 (); i->trunc_size = 12; - i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA_256_128]; + i = &em->ipsec_proto_main_integ_algs[IPSEC_INTEG_ALG_SHA_256_128]; i->md = EVP_sha256 (); i->trunc_size = 16; - i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA_384_192]; + i = &em->ipsec_proto_main_integ_algs[IPSEC_INTEG_ALG_SHA_384_192]; i->md = EVP_sha384 (); i->trunc_size = 24; - i = &em->esp_integ_algs[IPSEC_INTEG_ALG_SHA_512_256]; + i = &em->ipsec_proto_main_integ_algs[IPSEC_INTEG_ALG_SHA_512_256]; i->md = EVP_sha512 (); i->trunc_size = 32; @@ -267,11 +313,17 @@ esp_init () CLIB_CACHE_LINE_BYTES); int thread_id; - for (thread_id = 0; thread_id < tm->n_vlib_mains - 1; thread_id++) + for (thread_id = 0; thread_id < tm->n_vlib_mains; thread_id++) { +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + em->per_thread_data[thread_id].encrypt_ctx = EVP_CIPHER_CTX_new (); + em->per_thread_data[thread_id].decrypt_ctx = EVP_CIPHER_CTX_new (); + em->per_thread_data[thread_id].hmac_ctx = HMAC_CTX_new (); +#else EVP_CIPHER_CTX_init (&(em->per_thread_data[thread_id].encrypt_ctx)); EVP_CIPHER_CTX_init (&(em->per_thread_data[thread_id].decrypt_ctx)); HMAC_CTX_init (&(em->per_thread_data[thread_id].hmac_ctx)); +#endif } } @@ -281,24 +333,28 @@ hmac_calc (ipsec_integ_alg_t alg, int key_len, u8 * data, int data_len, u8 * signature, u8 use_esn, u32 seq_hi) { - esp_main_t *em = &esp_main; + ipsec_proto_main_t *em = &ipsec_proto_main; u32 thread_index = vlib_get_thread_index (); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + HMAC_CTX *ctx = em->per_thread_data[thread_index].hmac_ctx; +#else HMAC_CTX *ctx = &(em->per_thread_data[thread_index].hmac_ctx); +#endif const EVP_MD *md = NULL; unsigned int len; ASSERT (alg < IPSEC_INTEG_N_ALG); - if (PREDICT_FALSE (em->esp_integ_algs[alg].md == 0)) + if (PREDICT_FALSE (em->ipsec_proto_main_integ_algs[alg].md == 0)) return 0; if (PREDICT_FALSE (alg != em->per_thread_data[thread_index].last_integ_alg)) { - md = em->esp_integ_algs[alg].md; + md = em->ipsec_proto_main_integ_algs[alg].md; em->per_thread_data[thread_index].last_integ_alg = alg; } - HMAC_Init (ctx, key, key_len, md); + HMAC_Init_ex (ctx, key, key_len, md, NULL); HMAC_Update (ctx, data, data_len); @@ -306,7 +362,7 @@ hmac_calc (ipsec_integ_alg_t alg, HMAC_Update (ctx, (u8 *) & seq_hi, sizeof (seq_hi)); HMAC_Final (ctx, signature, &len); - return em->esp_integ_algs[alg].trunc_size; + return em->ipsec_proto_main_integ_algs[alg].trunc_size; } #endif /* __ESP_H__ */