aboutsummaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec/esp.h
diff options
context:
space:
mode:
Diffstat (limited to 'src/vnet/ipsec/esp.h')
-rw-r--r--src/vnet/ipsec/esp.h34
1 files changed, 34 insertions, 0 deletions
diff --git a/src/vnet/ipsec/esp.h b/src/vnet/ipsec/esp.h
index 1e7f08277ca..052bbfc1d88 100644
--- a/src/vnet/ipsec/esp.h
+++ b/src/vnet/ipsec/esp.h
@@ -54,6 +54,20 @@ typedef CLIB_PACKED (struct {
}) ip6_and_esp_header_t;
/* *INDENT-ON* */
+/**
+ * AES GCM Additional Authentication data
+ */
+typedef struct esp_aead_t_
+{
+ /**
+ * for GCM: when using ESN it's:
+ * SPI, seq-hi, seg-low
+ * else
+ * SPI, seq-low
+ */
+ u32 data[3];
+} __clib_packed esp_aead_t;
+
#define ESP_SEQ_MAX (4294967295UL)
#define ESP_MAX_BLOCK_SIZE (16)
#define ESP_MAX_IV_SIZE (16)
@@ -117,6 +131,26 @@ hmac_calc (vlib_main_t * vm, ipsec_sa_t * sa, u8 * data, int data_len,
return sa->integ_icv_size;
}
+always_inline void
+esp_aad_fill (vnet_crypto_op_t * op,
+ const esp_header_t * esp, const ipsec_sa_t * sa)
+{
+ esp_aead_t *aad;
+
+ aad = (esp_aead_t *) op->aad;
+ clib_memcpy_fast (aad, esp, 8);
+
+ if (ipsec_sa_is_set_USE_ESN (sa))
+ {
+ /* SPI, seq-hi, seq-low */
+ aad->data[2] = aad->data[1];
+ aad->data[1] = clib_host_to_net_u32 (sa->seq_hi);
+ op->aad_len = 12;
+ }
+ else
+ /* SPI, seq-low */
+ op->aad_len = 8;
+}
#endif /* __ESP_H__ */
/*