Attachment 587532 Details for Bug 826264 – openswan patch to support aes-gcm with esp

[patch] openswan patch to support aes-gcm with esp

openswan-aes-gcm-esp.patch (text/plain), 5.70 KB, created by Avesh Agarwal on 2012-05-29 21:34:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Avesh Agarwal

Created: 2012-05-29 21:34:22 UTC

Size: 5.70 KB

patch

obsolete

>diff -urNp openswan-2.6.38-patched/lib/libopenswan/alg_info.c openswan-2.6.38-current/lib/libopenswan/alg_info.c
>--- openswan-2.6.38-patched/lib/libopenswan/alg_info.c	2012-05-14 15:17:33.593272378 -0400
>+++ openswan-2.6.38-current/lib/libopenswan/alg_info.c	2012-05-16 14:47:37.642107047 -0400
>@@ -623,6 +623,26 @@ parser_alg_info_add(struct parser_contex
> 		p_ctx->err="enc_alg not found";
> 		goto out;
> 	    }
>+
>+	    /*AES_GCM_128, AES_GCM_192, AES_GCM_256*/
>+	    if(ealg_id == ESP_AES_GCM_8 
>+		|| ealg_id == ESP_AES_GCM_12 
>+		|| ealg_id == ESP_AES_GCM_16) {
>+
>+			/*AES-GCM length key length + 4 bytes (32 bits) */
>+			if( p_ctx->eklen != 128 
>+				&& p_ctx->eklen != 192 
>+				&& p_ctx->eklen != 256 ) {
>+				p_ctx->err="wrong encryption key length with AES-GCM";
>+				goto out;
>+			}
>+			else {
>+				/* increase key length by 4 bytes, RFC 4106 */
>+				p_ctx->eklen = p_ctx->eklen + 4 *  BITS_PER_BYTE;
>+			}
>+
>+	    }
>+
> 	    DBG(DBG_CRYPT, DBG_log("parser_alg_info_add() "
> 				   "ealg_getbyname(\"%s\")=%d",
> 				   p_ctx->ealg_buf,
>diff -urNp openswan-2.6.38-patched/lib/libopenswan/kernel_alg.c openswan-2.6.38-current/lib/libopenswan/kernel_alg.c
>--- openswan-2.6.38-patched/lib/libopenswan/kernel_alg.c	2012-05-14 15:17:33.593272378 -0400
>+++ openswan-2.6.38-current/lib/libopenswan/kernel_alg.c	2012-05-16 14:47:37.643107046 -0400
>@@ -150,6 +150,25 @@ kernel_alg_esp_enc_ok(int alg_id, unsign
> 	if (!ret) goto out;
> 
> 	alg_p=&esp_ealg[alg_id];
>+
>+	if(alg_id == ESP_AES_GCM_8 
>+		|| alg_id == ESP_AES_GCM_12 
>+		|| alg_id == ESP_AES_GCM_16) {
>+		if(key_len != 128 && key_len!=192 && key_len!=256 ) {
>+
>+			ugh = builddiag("kernel_alg_db_add() key_len is incorrect: alg_id=%d, "
>+                          "key_len=%d, alg_minbits=%d, alg_maxbits=%d",
>+                          alg_id, key_len,
>+                          alg_p->sadb_alg_minbits,
>+                          alg_p->sadb_alg_maxbits);
>+			goto out;
>+		}
>+		else {
>+			/* increase key length by 4 bytes (RFC 4106)*/
>+			key_len = key_len + 4 * BITS_PER_BYTE;
>+		}
>+	}
>+
> 	/* 
> 	 * test #2: if key_len specified, it must be in range 
> 	 */
>diff -urNp openswan-2.6.38-patched/programs/pluto/kernel_netlink.c openswan-2.6.38-current/programs/pluto/kernel_netlink.c
>--- openswan-2.6.38-patched/programs/pluto/kernel_netlink.c	2012-05-14 15:17:33.560272378 -0400
>+++ openswan-2.6.38-current/programs/pluto/kernel_netlink.c	2012-05-16 14:47:37.651107042 -0400
>@@ -1118,15 +1118,31 @@ linux_pfkey_add_aead(void)
> 	struct sadb_alg alg;
> 
> 	alg.sadb_alg_ivlen = 8;
>-	alg.sadb_alg_minbits = 128;
>-	alg.sadb_alg_maxbits = 256;
>+	alg.sadb_alg_minbits = 128 + 4 * BITS_PER_BYTE;
>+	alg.sadb_alg_maxbits = 256 + 4 * BITS_PER_BYTE;
> 
> 	alg.sadb_alg_id = SADB_X_EALG_AES_GCM_ICV8;
> 	kernel_alg_add(SADB_SATYPE_ESP, SADB_EXT_SUPPORTED_ENCRYPT, &alg);
>+
>+        alg.sadb_alg_ivlen = 12;
>+        alg.sadb_alg_minbits = 128 + 4 * BITS_PER_BYTE;
>+        alg.sadb_alg_maxbits = 256 + 4 * BITS_PER_BYTE;
>+
> 	alg.sadb_alg_id = SADB_X_EALG_AES_GCM_ICV12;
> 	kernel_alg_add(SADB_SATYPE_ESP, SADB_EXT_SUPPORTED_ENCRYPT, &alg);
>+
>+        alg.sadb_alg_ivlen = 16;
>+        alg.sadb_alg_minbits = 128 + 4 * BITS_PER_BYTE;
>+        alg.sadb_alg_maxbits = 256 + 4 * BITS_PER_BYTE;
>+
> 	alg.sadb_alg_id = SADB_X_EALG_AES_GCM_ICV16;
> 	kernel_alg_add(SADB_SATYPE_ESP, SADB_EXT_SUPPORTED_ENCRYPT, &alg);
>+
>+	/* keeping aes-ccm behaviour intact as before */
>+        alg.sadb_alg_ivlen = 8;
>+        alg.sadb_alg_minbits = 128;
>+        alg.sadb_alg_maxbits = 256;
>+
> 	alg.sadb_alg_id = SADB_X_EALG_AES_CCM_ICV8;
> 	kernel_alg_add(SADB_SATYPE_ESP, SADB_EXT_SUPPORTED_ENCRYPT, &alg);
> 	alg.sadb_alg_id = SADB_X_EALG_AES_CCM_ICV12;
>diff -urNp openswan-2.6.38-patched/programs/pluto/plutoalg.c openswan-2.6.38-current/programs/pluto/plutoalg.c
>--- openswan-2.6.38-patched/programs/pluto/plutoalg.c	2012-05-14 15:17:33.556272379 -0400
>+++ openswan-2.6.38-current/programs/pluto/plutoalg.c	2012-05-16 14:47:37.651107042 -0400
>@@ -471,8 +471,18 @@ kernel_alg_db_add(struct db_context *db_
> 
> 	    /*	add keylegth if specified in esp= string */
> 	    if (esp_info->esp_ealg_keylen) {
>-		db_attr_add_values(db_ctx, 
>-				   KEY_LENGTH, esp_info->esp_ealg_keylen);
>+
>+		if(esp_info->esp_ealg_id == ESP_AES_GCM_8
>+			|| esp_info->esp_ealg_id == ESP_AES_GCM_12
>+			|| esp_info->esp_ealg_id == ESP_AES_GCM_16 ) {
>+
>+			db_attr_add_values(db_ctx, 
>+				   KEY_LENGTH, esp_info->esp_ealg_keylen - 4 * BITS_PER_BYTE);
>+		}
>+		else {
>+			db_attr_add_values(db_ctx,
>+				KEY_LENGTH, esp_info->esp_ealg_keylen );
>+		}
> 	    }
> 
> 	} else if(policy & POLICY_AUTHENTICATE) {
>diff -urNp openswan-2.6.38-patched/programs/pluto/spdb_v1_struct.c openswan-2.6.38-current/programs/pluto/spdb_v1_struct.c
>--- openswan-2.6.38-patched/programs/pluto/spdb_v1_struct.c	2012-05-14 15:17:33.560272378 -0400
>+++ openswan-2.6.38-current/programs/pluto/spdb_v1_struct.c	2012-05-16 14:51:09.031968628 -0400
>@@ -2357,7 +2357,12 @@ parse_ipsec_sa_body(
> 				}
> 			    break;
> #endif
>-			    
>+                        case ESP_AES_GCM_8:
>+                        case ESP_AES_GCM_12:
>+                        case ESP_AES_GCM_16:
>+                                loglog(RC_LOG_SERIOUS, "kernel algorithm (AES-GCM) does not like: %s", ugh);
>+				continue;
>+
> 			case ESP_DES:          /* NOT safe */
> 			    loglog(RC_LOG_SERIOUS, "1DES was proposed, it is insecure");
> 			default:
>@@ -2583,7 +2588,13 @@ parse_ipsec_sa_body(
> 	    st->st_ah.attrs = ah_attrs;
> 
> 	st->st_esp.present = esp_seen;
>-	if (esp_seen){
>+	if (esp_seen) {
>+		if(esp_attrs.transattrs.encrypt ==  ESP_AES_GCM_8 
>+			|| esp_attrs.transattrs.encrypt == ESP_AES_GCM_12 
>+			|| esp_attrs.transattrs.encrypt == ESP_AES_GCM_16 ) {
>+			esp_attrs.transattrs.enckeylen = esp_attrs.transattrs.enckeylen + 4 * BITS_PER_BYTE;
>+		}
>+
> 	    st->st_esp.attrs = esp_attrs;
> 	}
>

Actions: View | Diff

Attachments on bug 826264: 587532