Skip to content

Commit e281109

Browse files
philljjphilljj
committed
refactor esp sa lists into separate test example file.
1 parent 8d56109 commit e281109

File tree

4 files changed

+174
-122
lines changed

4 files changed

+174
-122
lines changed

‎src/test/esp_sa_list.c‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
/* Static pre-defined SA lists for testing.*/
2+
3+
static struct wolfIP_esp_sa test_in_sa_list[WOLFIP_ESP_NUM_SA] =
4+
{
5+
{
6+
{0x2f, 0xa9, 0xd8, 0xc8}, /* spi */
7+
0x010A0A0A, /* src */
8+
0x020A0A0A, /* dst */
9+
0,0, /* oseq, seq */
10+
0, /* iv len */
11+
0, {0}, 0, /* null enc */
12+
ESP_AUTH_SHA256_RFC4868,
13+
{0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
14+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01},
15+
16,
16+
ESP_ICVLEN_HMAC_128
17+
},
18+
{
19+
{0x76, 0x4f, 0x47, 0xc9}, /* spi */
20+
0x010A0A0A, /* src */
21+
0x020A0A0A, /* dst */
22+
0,0, /* oseq, seq */
23+
ESP_128_IV_LEN, /* iv len */
24+
ESP_ENC_CBC_AES,
25+
{0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
26+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03},
27+
16,
28+
ESP_AUTH_SHA256_RFC4868,
29+
{0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
30+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01},
31+
16,
32+
ESP_ICVLEN_HMAC_128
33+
},
34+
};
35+
36+
static struct wolfIP_esp_sa test_out_sa_list[WOLFIP_ESP_NUM_SA] =
37+
{
38+
{
39+
{0xf6, 0xe9, 0xb8, 0x0d}, /* spi */
40+
0x020A0A0A, /* src */
41+
0x030A0A0A, /* dst */
42+
0,0, /* oseq, seq */
43+
0, /* iv len */
44+
0, {0}, 0, /* null enc */
45+
ESP_AUTH_SHA256_RFC4868,
46+
{0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
47+
0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02},
48+
16,
49+
ESP_ICVLEN_HMAC_128
50+
},
51+
52+
{
53+
{0x49, 0xeb, 0xfd, 0xd4}, /* spi */
54+
0x020A0A0A, /* src */
55+
0x010A0A0A, /* dst */
56+
0,0, /* oseq, seq */
57+
ESP_128_IV_LEN, /* iv len */
58+
ESP_ENC_CBC_AES,
59+
{0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04,
60+
0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04},
61+
16,
62+
ESP_AUTH_SHA256_RFC4868,
63+
{0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
64+
0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02},
65+
16,
66+
ESP_ICVLEN_HMAC_128
67+
},
68+
69+
};
70+

‎src/test/test_linux_eventloop.c‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@
3030
#include "config.h"
3131
#include "wolfip.h"
3232

33+
#if defined(WOLFIP_ESP)
34+
#include "wolfesp.h"
35+
#include "esp_sa_list.c"
36+
#endif
37+
3338
#define TEST_SIZE (4 * 1024)
3439

3540
#define BUFFER_SIZE TEST_SIZE
@@ -464,6 +469,11 @@ int main(int argc, char **argv)
464469
inet_pton(AF_INET, WOLFIP_IP, &srv_ip);
465470
#endif
466471

472+
#if defined(WOLFIP_ESP)
473+
esp_load_sa_list(test_in_sa_list, 2, 1);
474+
esp_load_sa_list(test_out_sa_list, 2, 0);
475+
#endif
476+
467477
/* Server side test */
468478
test_wolfip_echoserver(s, srv_ip);
469479

‎src/wolfesp.c‎

Lines changed: 28 additions & 122 deletions
Original file line numberDiff line numberDiff line change
@@ -1,144 +1,50 @@
11
#if defined(WOLFIP_ESP) && !defined(WOLFESP_SRC)
22
#define WOLFESP_SRC
33

4-
#define ESP_SPI_LEN 4
5-
#define ESP_SEQ_LEN 4
6-
#define ESP_PADDING_LEN 1
7-
#define ESP_NEXT_HEADER_LEN 1
8-
#define ESP_ICV_ALIGNMENT 4
9-
/* hmac-[sha256, sha1, md5]-96*/
10-
#define ESP_ICVLEN_HMAC_96 12
11-
#define ESP_ICVLEN_HMAC_128 16
12-
#define WOLFIP_ESP_NUM_SA 2
13-
14-
/* aes-128 */
15-
#define ESP_128_KEY_LEN 16
16-
#define ESP_128_IV_LEN 16
17-
18-
typedef enum {
19-
ESP_ENC_NONE = 0,
20-
ESP_ENC_CBC_AES,
21-
ESP_ENC_CBC_DES3,
22-
ESP_ENC_GCM_RFC4106,
23-
ESP_ENC_GCM_RFC4543, /* placeholder to indicate gmac auth. */
24-
} esp_enc_t;
25-
26-
typedef enum {
27-
ESP_AUTH_NONE = 0,
28-
ESP_AUTH_MD5_RFC2403, /* hmac(md5)-96 */
29-
ESP_AUTH_SHA1_RFC2404, /* hmac(sha1)-96 */
30-
ESP_AUTH_SHA256_RFC4868, /* hmac(sha256)-N, N=96,128 */
31-
ESP_AUTH_GCM_RFC4106, /* placeholder to indicate gcm auth. */
32-
ESP_AUTH_GCM_RFC4543 /* rfc4543 gmac */
33-
} esp_auth_t;
34-
35-
/* Minimal ESP Security Association structure.
36-
* Supports only transport mode.
37-
* */
38-
struct wolfIP_esp_sa {
39-
uint8_t spi[ESP_SPI_LEN]; /* security parameter index */
40-
ip4 src; /* ip src and dst in network byte order */
41-
ip4 dst;
42-
uint32_t oseq; /* outbound sequence number */
43-
uint32_t seq; /* inbound sequence number */
44-
uint8_t iv_len;
45-
esp_enc_t enc;
46-
uint8_t enc_key[32];
47-
uint8_t enc_key_len;
48-
esp_auth_t auth;
49-
uint8_t auth_key[32];
50-
uint8_t auth_key_len;
51-
uint8_t icv_len;
52-
};
4+
#include "wolfesp.h"
535

546
static WC_RNG wc_rng;
557
static uint8_t rng_inited = 0;
568

57-
static void
9+
int
5810
esp_init(void)
5911
{
12+
int ret = 0;
13+
6014
if (rng_inited == 0) {
61-
int ret = wc_InitRng_ex(&wc_rng, NULL, INVALID_DEVID);
15+
ret = wc_InitRng_ex(&wc_rng, NULL, INVALID_DEVID);
6216

6317
if (ret) {
6418
printf("error: wc_InitRng_ex returned: %d\n", ret);
6519
}
66-
67-
rng_inited = 1;
20+
else {
21+
rng_inited = 1;
22+
}
6823
}
6924

70-
return;
25+
return ret;
7126
}
7227

73-
/* Static pre-defined SA lists.*/
7428

75-
struct wolfIP_esp_sa in_sa_list[WOLFIP_ESP_NUM_SA] =
76-
{
77-
{
78-
{0x2f, 0xa9, 0xd8, 0xc8}, /* spi */
79-
0x010A0A0A, /* src */
80-
0x020A0A0A, /* dst */
81-
0,0, /* oseq, seq */
82-
0, /* iv len */
83-
0, {0}, 0, /* null enc */
84-
ESP_AUTH_SHA256_RFC4868,
85-
{0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
86-
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01},
87-
16,
88-
ESP_ICVLEN_HMAC_128
89-
},
90-
{
91-
{0x76, 0x4f, 0x47, 0xc9}, /* spi */
92-
0x010A0A0A, /* src */
93-
0x020A0A0A, /* dst */
94-
0,0, /* oseq, seq */
95-
ESP_128_IV_LEN, /* iv len */
96-
ESP_ENC_CBC_AES,
97-
{0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
98-
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03},
99-
16,
100-
ESP_AUTH_SHA256_RFC4868,
101-
{0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
102-
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01},
103-
16,
104-
ESP_ICVLEN_HMAC_128
105-
},
106-
};
107-
108-
struct wolfIP_esp_sa out_sa_list[WOLFIP_ESP_NUM_SA] =
29+
static struct wolfIP_esp_sa * in_sa_list = NULL;
30+
static struct wolfIP_esp_sa * out_sa_list = NULL;
31+
static uint16_t in_sa_num = 0;
32+
static uint16_t out_sa_num = 0;
33+
34+
void
35+
esp_load_sa_list(struct wolfIP_esp_sa * sa_list, uint16_t num, uint16_t in)
10936
{
110-
{
111-
{0xf6, 0xe9, 0xb8, 0x0d}, /* spi */
112-
0x020A0A0A, /* src */
113-
0x030A0A0A, /* dst */
114-
0,0, /* oseq, seq */
115-
0, /* iv len */
116-
0, {0}, 0, /* null enc */
117-
ESP_AUTH_SHA256_RFC4868,
118-
{0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
119-
0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02},
120-
16,
121-
ESP_ICVLEN_HMAC_128
122-
},
37+
if (in == 1) {
38+
in_sa_list = sa_list;
39+
in_sa_num = num;
40+
}
41+
else {
42+
out_sa_list = sa_list;
43+
out_sa_num = num;
44+
}
12345

124-
{
125-
{0x49, 0xeb, 0xfd, 0xd4}, /* spi */
126-
0x020A0A0A, /* src */
127-
0x010A0A0A, /* dst */
128-
0,0, /* oseq, seq */
129-
ESP_128_IV_LEN, /* iv len */
130-
ESP_ENC_CBC_AES,
131-
{0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04,
132-
0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04},
133-
16,
134-
ESP_AUTH_SHA256_RFC4868,
135-
{0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
136-
0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02},
137-
16,
138-
ESP_ICVLEN_HMAC_128
139-
},
140-
141-
};
46+
return;
47+
}
14248

14349
#ifdef WOLFIP_DEBUG_ESP
14450
#ifdef WOLFIP_DEBUG_ESP_VERBOSE
@@ -617,7 +523,7 @@ static int esp_unwrap(struct wolfIP *s, struct wolfIP_ip_packet *ip,
617523
memcpy(&seq, ip->data + ESP_SPI_LEN, sizeof(seq));
618524
seq = ee32(seq);
619525

620-
for (size_t i = 0; i < WOLFIP_ESP_NUM_SA; ++i) {
526+
for (size_t i = 0; i < in_sa_num; ++i) {
621527
if (memcmp(spi, in_sa_list[i].spi, sizeof(spi)) == 0) {
622528
#ifdef WOLFIP_DEBUG_ESP
623529
printf("info: found sa: 0x%02x%02x%02x%02x\n",
@@ -762,7 +668,7 @@ static int esp_wrap(struct wolfIP_ip_packet *ip, uint16_t * ip_len)
762668
struct wolfIP_esp_sa * esp_sa = NULL;
763669

764670
/* TODO: priority, tcp/udp port-filtering? */
765-
for (size_t i = 0; i < WOLFIP_ESP_NUM_SA; ++i) {
671+
for (size_t i = 0; i < out_sa_num; ++i) {
766672
if (ip->dst == out_sa_list[i].dst) {
767673
esp_sa = &out_sa_list[i];
768674
#ifdef WOLFIP_DEBUG_ESP

‎wolfesp.h‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#ifndef WOLFESP_H
2+
#define WOLFESP_H
3+
4+
#define ESP_SPI_LEN 4
5+
#define ESP_SEQ_LEN 4
6+
#define ESP_PADDING_LEN 1
7+
#define ESP_NEXT_HEADER_LEN 1
8+
#define ESP_ICV_ALIGNMENT 4
9+
/* hmac-[sha256, sha1, md5]-96*/
10+
#define ESP_ICVLEN_HMAC_96 12
11+
#define ESP_ICVLEN_HMAC_128 16
12+
#define WOLFIP_ESP_NUM_SA 2
13+
14+
/* aes-128 */
15+
#define ESP_128_KEY_LEN 16
16+
#define ESP_128_IV_LEN 16
17+
18+
/* gcm */
19+
#define ESP_GCM_RFC4106_SALT_LEN 4
20+
#define ESP_GCM_RFC4106_IV_LEN 8
21+
#define ESP_GCM_RFC4106_NONCE_LEN (ESP_GCM_RFC4106_SALT_LEN \
22+
23+
typedef enum {
24+
ESP_ENC_NONE = 0,
25+
ESP_ENC_CBC_AES,
26+
ESP_ENC_CBC_DES3,
27+
ESP_ENC_GCM_RFC4106,
28+
ESP_ENC_GCM_RFC4543, /* placeholder to indicate gmac auth. */
29+
} esp_enc_t;
30+
31+
typedef enum {
32+
ESP_AUTH_NONE = 0,
33+
ESP_AUTH_MD5_RFC2403, /* hmac(md5)-96 */
34+
ESP_AUTH_SHA1_RFC2404, /* hmac(sha1)-96 */
35+
ESP_AUTH_SHA256_RFC4868, /* hmac(sha256)-N, N=96,128 */
36+
ESP_AUTH_GCM_RFC4106, /* placeholder to indicate gcm auth. */
37+
ESP_AUTH_GCM_RFC4543 /* rfc4543 gmac */
38+
} esp_auth_t;
39+
40+
/* Minimal ESP Security Association structure.
41+
* Supports only transport mode.
42+
* */
43+
struct wolfIP_esp_sa {
44+
uint8_t spi[ESP_SPI_LEN]; /* security parameter index */
45+
ip4 src; /* ip src and dst in network byte order */
46+
ip4 dst;
47+
uint32_t oseq; /* outbound sequence number */
48+
uint32_t seq; /* inbound sequence number */
49+
uint8_t iv_len;
50+
esp_enc_t enc;
51+
uint8_t enc_key[32];
52+
uint8_t enc_key_len;
53+
esp_auth_t auth;
54+
uint8_t auth_key[32];
55+
uint8_t auth_key_len;
56+
uint8_t icv_len;
57+
#if 0
58+
uint8_t pre_iv[ESP_GCM_RFC4106_IV_LEN]; /* unique salt that is xor'ed with
59+
* oseq to generate the iv. */
60+
#endif
61+
};
62+
63+
int esp_init(void);
64+
void esp_load_sa_list(struct wolfIP_esp_sa * sa_list, uint16_t num, uint16_t in);
65+
66+
#endif /* !WOLFESP_H */

0 commit comments

Comments
 (0)