18 #include <openssl/evp.h> 19 #include <openssl/hmac.h> 20 #include <openssl/rand.h> 25 #include <vpp/app/version.h> 32 #if OPENSSL_VERSION_NUMBER < 0x10100000L 39 #define foreach_openssl_evp_op \ 40 _(cbc, DES_CBC, EVP_des_cbc) \ 41 _(cbc, 3DES_CBC, EVP_des_ede3_cbc) \ 42 _(cbc, AES_128_CBC, EVP_aes_128_cbc) \ 43 _(cbc, AES_192_CBC, EVP_aes_192_cbc) \ 44 _(cbc, AES_256_CBC, EVP_aes_256_cbc) \ 45 _(gcm, AES_128_GCM, EVP_aes_128_gcm) \ 46 _(gcm, AES_192_GCM, EVP_aes_192_gcm) \ 47 _(gcm, AES_256_GCM, EVP_aes_256_gcm) \ 48 _(cbc, AES_128_CTR, EVP_aes_128_ctr) \ 49 _(cbc, AES_192_CTR, EVP_aes_192_ctr) \ 50 _(cbc, AES_256_CTR, EVP_aes_256_ctr) \ 52 #define foreach_openssl_hmac_op \ 55 _(SHA224, EVP_sha224) \ 56 _(SHA256, EVP_sha256) \ 57 _(SHA384, EVP_sha384) \ 62 const EVP_CIPHER * cipher)
68 for (i = 0; i < n_ops; i++)
75 if (op->
op == VNET_CRYPTO_OP_3DES_CBC_ENC)
81 RAND_bytes (op->
iv, iv_len);
83 EVP_EncryptInit_ex (ctx, cipher,
NULL, key->
data, op->
iv);
84 EVP_EncryptUpdate (ctx, op->
dst, &out_len, op->
src, op->
len);
85 if (out_len < op->
len)
86 EVP_EncryptFinal_ex (ctx, op->
dst + out_len, &out_len);
87 op->
status = VNET_CRYPTO_OP_STATUS_COMPLETED;
94 const EVP_CIPHER * cipher)
100 for (i = 0; i < n_ops; i++)
106 EVP_DecryptInit_ex (ctx, cipher,
NULL, key->
data, op->
iv);
107 EVP_DecryptUpdate (ctx, op->
dst, &out_len, op->
src, op->
len);
108 if (out_len < op->
len)
109 EVP_DecryptFinal_ex (ctx, op->
dst + out_len, &out_len);
110 op->
status = VNET_CRYPTO_OP_STATUS_COMPLETED;
117 const EVP_CIPHER * cipher)
123 for (i = 0; i < n_ops; i++)
130 RAND_bytes (op->
iv, 8);
132 EVP_EncryptInit_ex (ctx, cipher, 0, 0, 0);
133 EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_IVLEN, 12,
NULL);
134 EVP_EncryptInit_ex (ctx, 0, 0, key->
data, op->
iv);
137 EVP_EncryptUpdate (ctx, op->
dst, &len, op->
src, op->
len);
138 EVP_EncryptFinal_ex (ctx, op->
dst + len, &len);
139 EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_GET_TAG, op->
tag_len, op->
tag);
140 op->
status = VNET_CRYPTO_OP_STATUS_COMPLETED;
147 const EVP_CIPHER * cipher)
153 for (i = 0; i < n_ops; i++)
159 EVP_DecryptInit_ex (ctx, cipher, 0, 0, 0);
160 EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_IVLEN, 12, 0);
161 EVP_DecryptInit_ex (ctx, 0, 0, key->
data, op->
iv);
163 EVP_DecryptUpdate (ctx, 0, &len, op->
aad, op->
aad_len);
164 EVP_DecryptUpdate (ctx, op->
dst, &len, op->
src, op->
len);
165 EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_TAG, op->
tag_len, op->
tag);
167 if (EVP_DecryptFinal_ex (ctx, op->
dst + len, &len) > 0)
168 op->
status = VNET_CRYPTO_OP_STATUS_COMPLETED;
172 op->
status = VNET_CRYPTO_OP_STATUS_FAIL_BAD_HMAC;
175 return n_ops - n_fail;
187 for (i = 0; i < n_ops; i++)
191 unsigned int out_len;
195 HMAC_Update (ctx, op->
src, op->
len);
196 HMAC_Final (ctx, buffer, &out_len);
200 if ((memcmp (op->
digest, buffer, sz)))
203 op->
status = VNET_CRYPTO_OP_STATUS_FAIL_BAD_HMAC;
209 op->
status = VNET_CRYPTO_OP_STATUS_COMPLETED;
211 return n_ops - n_fail;
216 openssl_ops_enc_##a (vlib_main_t * vm, vnet_crypto_op_t * ops[], u32 n_ops) \ 217 { return openssl_ops_enc_##m (vm, ops, n_ops, b ()); } \ 220 openssl_ops_dec_##a (vlib_main_t * vm, vnet_crypto_op_t * ops[], u32 n_ops) \ 221 { return openssl_ops_dec_##m (vm, ops, n_ops, b ()); } 228 openssl_ops_hmac_##a (vlib_main_t * vm, vnet_crypto_op_t * ops[], u32 n_ops) \ 229 { return openssl_ops_hmac (vm, ops, n_ops, b ()); } \ 247 vnet_crypto_register_ops_handler (vm, eidx, VNET_CRYPTO_OP_##a##_ENC, \ 248 openssl_ops_enc_##a); \ 249 vnet_crypto_register_ops_handler (vm, eidx, VNET_CRYPTO_OP_##a##_DEC, \ 250 openssl_ops_dec_##a); 256 vnet_crypto_register_ops_handler (vm, eidx, VNET_CRYPTO_OP_##a##_HMAC, \ 257 openssl_ops_hmac_##a); \ 268 #if OPENSSL_VERSION_NUMBER >= 0x10100000L 271 HMAC_CTX_init (&(ptd->_hmac_ctx));
278 vec_add (seed_data, &t,
sizeof (t));
279 vec_add (seed_data, &pid,
sizeof (pid));
280 vec_add (seed_data, seed_data,
sizeof (seed_data));
282 RAND_seed ((
const void *) seed_data,
vec_len (seed_data));
292 .runs_after =
VLIB_INITS (
"vnet_crypto_init"),
299 .version = VPP_BUILD_VER,
300 .description =
"OpenSSL Crypto Engine",
#define CLIB_CACHE_LINE_ALIGN_MARK(mark)
static_always_inline u32 openssl_ops_enc_cbc(vlib_main_t *vm, vnet_crypto_op_t *ops[], u32 n_ops, const EVP_CIPHER *cipher)
#define clib_memcpy_fast(a, b, c)
static_always_inline u32 openssl_ops_dec_cbc(vlib_main_t *vm, vnet_crypto_op_t *ops[], u32 n_ops, const EVP_CIPHER *cipher)
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
#define vec_add(V, E, N)
Add N elements to end of vector V (no header, unspecified alignment)
#define static_always_inline
#define VLIB_INIT_FUNCTION(x)
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
clib_error_t * crypto_openssl_init(vlib_main_t *vm)
#define VNET_CRYPTO_OP_FLAG_HMAC_CHECK
EVP_CIPHER_CTX * evp_cipher_ctx
#define foreach_openssl_hmac_op
#define VNET_CRYPTO_OP_FLAG_INIT_IV
#define vec_free(V)
Free vector's memory (no header).
static_always_inline u32 openssl_ops_dec_gcm(vlib_main_t *vm, vnet_crypto_op_t *ops[], u32 n_ops, const EVP_CIPHER *cipher)
static_always_inline u32 openssl_ops_hmac(vlib_main_t *vm, vnet_crypto_op_t *ops[], u32 n_ops, const EVP_MD *md)
static_always_inline vnet_crypto_key_t * vnet_crypto_get_key(vnet_crypto_key_index_t index)
#define foreach_openssl_evp_op
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
static_always_inline u32 openssl_ops_enc_gcm(vlib_main_t *vm, vnet_crypto_op_t *ops[], u32 n_ops, const EVP_CIPHER *cipher)
vnet_crypto_op_status_t status
static vlib_thread_main_t * vlib_get_thread_main()
#define vec_foreach(var, vec)
Vector iterator.
#define CLIB_CACHE_LINE_BYTES
u32 vnet_crypto_register_engine(vlib_main_t *vm, char *name, int prio, char *desc)