d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for ESN in cryptosoft

Browse Source 
This patch adds support for IPsec ESN (Extended Sequence Numbers) in
encrypt and authenticate mode (eg. AES-CBC and SHA256) and combined mode
(eg. AES-GCM).

For encrypt and authenticate mode the ESN is stored in separate crp_esn
buffer because the high-order 32 bits of the sequence number are
appended after the Next Header (RFC 4303).

For combined modes the high-order 32 bits of the sequence number [e.g.
RFC 4106, Chapter 5 AAD Construction] are part of crp_aad (prepared by
netipsec layer in case of ESN support enabled), therefore non visible
diff around combined modes.

Submitted by:           Grzegorz Jaszczyk <jaz@semihalf.com>
                        Patryk Duda <pdk@semihalf.com>
Reviewed by:            jhb
Differential revision:  https://reviews.freebsd.org/D22364
Obtained from:          Semihalf
Sponsored by:           Stormshield
This commit is contained in:
Marcin Wojtas 2020-10-16 11:18:13 +00:00
parent 7e89ae49db
commit 6038018ab1
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=366753
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/opencrypto/cryptosoft.c
View File

@ -327,8 +327,8 @@ swcr_authcompute(struct swcr_session *ses, struct cryptop *crp)
axf = sw->sw_axf;
csp = crypto_get_params(crp->crp_session);
if (crp->crp_auth_key != NULL) {
csp = crypto_get_params(crp->crp_session);
swcr_authprepare(axf, sw, crp->crp_auth_key,
csp->csp_auth_klen);
}
@ -354,6 +354,9 @@ swcr_authcompute(struct swcr_session *ses, struct cryptop *crp)
if (err)
goto out;
if (csp->csp_flags & CSP_F_ESN)
axf->Update(&ctx, crp->crp_esn, 4);
axf->Final(aalg, &ctx);
if (sw->sw_octx != NULL) {
bcopy(sw->sw_octx, &ctx, axf->ctxsize);
@ -1235,12 +1238,12 @@ swcr_cipher_supported(const struct crypto_session_params *csp)
return (true);
}
#define SUPPORTED_SES (CSP_F_SEPARATE_OUTPUT | CSP_F_SEPARATE_AAD | CSP_F_ESN)
static int
swcr_probesession(device_t dev, const struct crypto_session_params *csp)
{
if ((csp->csp_flags & ~(CSP_F_SEPARATE_OUTPUT | CSP_F_SEPARATE_AAD)) !=
0)
if ((csp->csp_flags & ~(SUPPORTED_SES)) != 0)
return (EINVAL);
switch (csp->csp_mode) {
case CSP_MODE_COMPRESS: