d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prepare crypto framework for IPsec ESN support

Browse Source 
This permits requests (netipsec ESP and AH protocol) to provide the
IPsec ESN (Extended Sequence Numbers) in a separate buffer.

As with separate output buffer and separate AAD buffer not all drivers
support this feature. Consumer must request use of this feature via new
session flag.

Submitted by:           Grzegorz Jaszczyk <jaz@semihalf.com>
                        Patryk Duda <pdk@semihalf.com>
Reviewed by:            jhb
Differential revision:  https://reviews.freebsd.org/D24838
Obtained from:          Semihalf
Sponsored by:           Stormshield
This commit is contained in:
Marcin Wojtas 2020-10-16 11:06:33 +00:00
parent e23ee5b884
commit 7e89ae49db
4 changed files with 33 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
share/man/man9/crypto_request.9
View File

@ -302,6 +302,24 @@ as a single buffer pointed to by
In either case,
.Fa crp_aad_length
always indicates the amount of AAD in bytes.
.Ss Request ESN
IPsec requests may optionally include Extended Sequence Numbers (ESN).
ESN may either be supplied in
.Fa crp_esn
or as part of the AAD pointed to by
.Fa crp_aad .
.Pp
If the ESN is stored in
.Fa crp_esn ,
.Dv CSP_F_ESN
should be set in
.Fa csp_flags .
This use case is dedicated for encrypt and authenticate mode, since the
high-order 32 bits of the sequence number are appended after the Next Header
(RFC 4303).
.Pp
AEAD modes supply the ESN in a separate AAD buffer (see e.g. RFC 4106, Chapter 5
AAD Construction).
.Ss Request IV and/or Nonce
Some cryptographic operations require an IV or nonce as an input.
An IV may be stored either in the IV region of the data buffer or in

9
share/man/man9/crypto_session.9
View File

@ -201,6 +201,15 @@ Sessions with this flag set permit requests with AAD passed in either in
a region of the input buffer or in a single, virtually-contiguous buffer.
Sessions without this flag only permit requests with AAD passed in as
a region in the input buffer.
.It Dv CSP_F_ESN
Support requests that use a separate buffer for IPsec ESN (Extended Sequence
Numbers).
.Pp
Sessions with this flag set permit requests with IPsec ESN passed in special
buffer.
It is required for IPsec ESN support of encrypt and authenticate mode where
the high-order 32 bits of the sequence number are appended after the Next
Header (RFC 4303).
.El
.It Fa csp_ivlen
If either the cipher or authentication algorithms require an explicit

5
sys/opencrypto/crypto.c
View File

@ -743,6 +743,8 @@ alg_is_aead(int alg)
return (alg_type(alg) == ALG_AEAD);
}
#define SUPPORTED_SES (CSP_F_SEPARATE_OUTPUT | CSP_F_SEPARATE_AAD | CSP_F_ESN)
/* Various sanity checks on crypto session parameters. */
static bool
check_csp(const struct crypto_session_params *csp)
@ -750,8 +752,7 @@ check_csp(const struct crypto_session_params *csp)
struct auth_hash *axf;
/* Mode-independent checks. */
if ((csp->csp_flags & ~(CSP_F_SEPARATE_OUTPUT | CSP_F_SEPARATE_AAD)) !=
0)
if ((csp->csp_flags & ~(SUPPORTED_SES)) != 0)
return (false);
if (csp->csp_ivlen < 0 || csp->csp_cipher_klen < 0 ||
csp->csp_auth_klen < 0 || csp->csp_auth_mlen < 0)

3
sys/opencrypto/cryptodev.h
View File

@ -377,6 +377,7 @@ struct crypto_session_params {
#define CSP_F_SEPARATE_OUTPUT 0x0001 /* Requests can use separate output */
#define CSP_F_SEPARATE_AAD 0x0002 /* Requests can use separate AAD */
#define CSP_F_ESN 0x0004 /* Requests can use seperate ESN field */
int csp_ivlen; /* IV length in bytes. */
@ -485,6 +486,8 @@ struct cryptop {
void *crp_aad; /* AAD buffer. */
int crp_aad_start; /* Location of AAD. */
int crp_aad_length; /* 0 => no AAD. */
uint8_t crp_esn[4]; /* high-order ESN */
int crp_iv_start; /* Location of IV. IV length is from
* the session.
*/