summaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec/ipsec.c
diff options
context:
space:
mode:
authorNeale Ranns <nranns@cisco.com>2019-04-11 15:14:07 +0000
committerDamjan Marion <dmarion@me.com>2019-04-16 15:54:31 +0000
commit47feb1146ec3b0e1cf2ebd83cd5211e1df261194 (patch)
tree602218094ef655d3c430ba29762ebf64d59f15d7 /src/vnet/ipsec/ipsec.c
parent3cf215aab7237d44cf153b43d80a971be9300626 (diff)
IPSEC: support GCM in ESP
Change-Id: Id2ddb77b4ec3dd543d6e638bc882923f2bac011d Signed-off-by: Neale Ranns <nranns@cisco.com>
Diffstat (limited to 'src/vnet/ipsec/ipsec.c')
-rw-r--r--src/vnet/ipsec/ipsec.c25
1 files changed, 18 insertions, 7 deletions
diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c
index dc2f4cdbb60..73c5cf4d7ab 100644
--- a/src/vnet/ipsec/ipsec.c
+++ b/src/vnet/ipsec/ipsec.c
@@ -38,13 +38,6 @@ ipsec_check_ah_support (ipsec_sa_t * sa)
static clib_error_t *
ipsec_check_esp_support (ipsec_sa_t * sa)
{
- if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
- return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
- if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_192)
- return clib_error_return (0, "unsupported aes-gcm-192 crypto-alg");
- if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_256)
- return clib_error_return (0, "unsupported aes-gcm-256 crypto-alg");
-
return 0;
}
@@ -293,6 +286,24 @@ ipsec_init (vlib_main_t * vm)
a->dec_op_id = VNET_CRYPTO_OP_AES_256_CBC_DEC;
a->iv_size = a->block_size = 16;
+ a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_128;
+ a->enc_op_id = VNET_CRYPTO_OP_AES_128_GCM_ENC;
+ a->dec_op_id = VNET_CRYPTO_OP_AES_128_GCM_DEC;
+ a->iv_size = a->block_size = 8;
+ a->icv_size = 16;
+
+ a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_192;
+ a->enc_op_id = VNET_CRYPTO_OP_AES_192_GCM_ENC;
+ a->dec_op_id = VNET_CRYPTO_OP_AES_192_GCM_DEC;
+ a->iv_size = a->block_size = 8;
+ a->icv_size = 16;
+
+ a = im->crypto_algs + IPSEC_CRYPTO_ALG_AES_GCM_256;
+ a->enc_op_id = VNET_CRYPTO_OP_AES_256_GCM_ENC;
+ a->dec_op_id = VNET_CRYPTO_OP_AES_256_GCM_DEC;
+ a->iv_size = a->block_size = 8;
+ a->icv_size = 16;
+
vec_validate (im->integ_algs, IPSEC_INTEG_N_ALG - 1);
ipsec_main_integ_alg_t *i;