X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fesp_encrypt.c;h=44a0451d29a312eaf89378c2e810c531cd5ba86c;hb=f7b7fa53b7eaec81d8c00c1023fb7d01f1f9761f;hp=7bf1256acca75012090acc5787e5dc78b5dba007;hpb=f616d10d04d5c444e20e617841a54cfb2c58d07d;p=vpp.git

diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index 7bf1256acca..44a0451d29a 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -22,7 +22,7 @@
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/esp.h>
 
-esp_main_t esp_main;
+ipsec_proto_main_t ipsec_proto_main;
 
 #define foreach_esp_encrypt_next                   \
 _(DROP, "error-drop")                              \
@@ -85,10 +85,10 @@ format_esp_encrypt_trace (u8 * s, va_list * args)
 }
 
 always_inline void
-esp_encrypt_aes_cbc (ipsec_crypto_alg_t alg,
-		     u8 * in, u8 * out, size_t in_len, u8 * key, u8 * iv)
+esp_encrypt_cbc (ipsec_crypto_alg_t alg,
+		 u8 * in, u8 * out, size_t in_len, u8 * key, u8 * iv)
 {
-  esp_main_t *em = &esp_main;
+  ipsec_proto_main_t *em = &ipsec_proto_main;
   u32 thread_index = vlib_get_thread_index ();
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
   EVP_CIPHER_CTX *ctx = em->per_thread_data[thread_index].encrypt_ctx;
@@ -100,13 +100,14 @@ esp_encrypt_aes_cbc (ipsec_crypto_alg_t alg,
 
   ASSERT (alg < IPSEC_CRYPTO_N_ALG);
 
-  if (PREDICT_FALSE (em->esp_crypto_algs[alg].type == IPSEC_CRYPTO_ALG_NONE))
+  if (PREDICT_FALSE
+      (em->ipsec_proto_main_crypto_algs[alg].type == IPSEC_CRYPTO_ALG_NONE))
     return;
 
   if (PREDICT_FALSE
       (alg != em->per_thread_data[thread_index].last_encrypt_alg))
     {
-      cipher = em->esp_crypto_algs[alg].type;
+      cipher = em->ipsec_proto_main_crypto_algs[alg].type;
       em->per_thread_data[thread_index].last_encrypt_alg = alg;
     }
 
@@ -124,6 +125,7 @@ esp_encrypt_node_fn (vlib_main_t * vm,
   from = vlib_frame_vector_args (from_frame);
   n_left_from = from_frame->n_vectors;
   ipsec_main_t *im = &ipsec_main;
+  ipsec_proto_main_t *em = &ipsec_proto_main;
   u32 *recycle = 0;
   u32 thread_index = vlib_get_thread_index ();
 
@@ -305,8 +307,10 @@ esp_encrypt_node_fn (vlib_main_t * vm,
 	  if (PREDICT_TRUE (sa0->crypto_alg != IPSEC_CRYPTO_ALG_NONE))
 	    {
 
-	      const int BLOCK_SIZE = 16;
-	      const int IV_SIZE = 16;
+	      const int BLOCK_SIZE =
+		em->ipsec_proto_main_crypto_algs[sa0->crypto_alg].block_size;
+	      const int IV_SIZE =
+		em->ipsec_proto_main_crypto_algs[sa0->crypto_alg].iv_size;
 	      int blocks = 1 + (i_b0->current_length + 1) / BLOCK_SIZE;
 
 	      /* pad packet in input buffer */
@@ -329,18 +333,21 @@ esp_encrypt_node_fn (vlib_main_t * vm,
 	      vnet_buffer (o_b0)->sw_if_index[VLIB_RX] =
 		vnet_buffer (i_b0)->sw_if_index[VLIB_RX];
 
-	      u8 iv[16];
+	      u8 iv[em->
+		    ipsec_proto_main_crypto_algs[sa0->crypto_alg].iv_size];
 	      RAND_bytes (iv, sizeof (iv));
 
 	      clib_memcpy ((u8 *) vlib_buffer_get_current (o_b0) +
-			   ip_hdr_size + sizeof (esp_header_t), iv, 16);
-
-	      esp_encrypt_aes_cbc (sa0->crypto_alg,
-				   (u8 *) vlib_buffer_get_current (i_b0),
-				   (u8 *) vlib_buffer_get_current (o_b0) +
-				   ip_hdr_size + sizeof (esp_header_t) +
-				   IV_SIZE, BLOCK_SIZE * blocks,
-				   sa0->crypto_key, iv);
+			   ip_hdr_size + sizeof (esp_header_t), iv,
+			   em->ipsec_proto_main_crypto_algs[sa0->
+							    crypto_alg].iv_size);
+
+	      esp_encrypt_cbc (sa0->crypto_alg,
+			       (u8 *) vlib_buffer_get_current (i_b0),
+			       (u8 *) vlib_buffer_get_current (o_b0) +
+			       ip_hdr_size + sizeof (esp_header_t) +
+			       IV_SIZE, BLOCK_SIZE * blocks,
+			       sa0->crypto_key, iv);
 	    }
 
 	  o_b0->current_length += hmac_calc (sa0->integ_alg, sa0->integ_key,