Skip to content

Commit 5eb24a1

Browse files
philljjphilljj
committed
cleanup.
1 parent 6b0a364 commit 5eb24a1

4 files changed

Lines changed: 76 additions & 126 deletions

File tree

‎src/test/test_esp.c‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@
4040
static void __attribute__((noreturn)) print_usage_and_die(void);
4141

4242
#define TEST_SIZE (12 * 1024)
43-
4443
#define BUFFER_SIZE TEST_SIZE
4544

4645
static int disable_ipsec = 0;
@@ -54,10 +53,9 @@ static int closed = 0;
5453
static int conn_fd = -1;
5554
static int client_connected = 0;
5655
/* "Test pattern - -" 16 chars without trailing null. */
57-
static const uint8_t test_pattern[16] =
58-
{0x54, 0x65, 0x73, 0x74, 0x20, 0x70,
59-
0x61, 0x74, 0x74, 0x65, 0x72, 0x6e,
60-
0x20, 0x2d, 0x20, 0x2d};
56+
static const uint8_t test_pattern[16] = {0x54, 0x65, 0x73, 0x74, 0x20, 0x70,
57+
0x61, 0x74, 0x74, 0x65, 0x72, 0x6e,
58+
0x20, 0x2d, 0x20, 0x2d};
6159
static uint8_t in_sa_gcm[ESP_SPI_LEN] = {0x01, 0x01, 0x01, 0x01};
6260
static uint8_t out_sa_gcm[ESP_SPI_LEN] = {0x02, 0x02, 0x02, 0x02};
6361
static uint8_t in_sa_cbc[ESP_SPI_LEN] = {0x03, 0x03, 0x03, 0x03};
@@ -75,7 +73,6 @@ static uint8_t out_enc_key[36] =
7573
0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04,
7674
0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04,
7775
0x0a, 0x0b, 0x0c, 0x0d};
78-
7976
static uint8_t in_auth_key[16] =
8077
{0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
8178
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01};
@@ -536,16 +533,11 @@ int main(int argc, char **argv)
536533
case '?':
537534
print_usage_and_die();
538535
break;
539-
default: /* '?' */
540-
fprintf(stderr, "Usage: %s [-t nsecs] [-n] name\n",
541-
argv[0]);
542-
exit(EXIT_FAILURE);
536+
default:
537+
break;
543538
}
544539
}
545540

546-
(void)argc;
547-
(void)argv;
548-
549541
if (!disable_ipsec) {
550542
err = wolfIP_esp_init();
551543
if (err) {

‎src/wolfesp.c‎

Lines changed: 67 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
#if defined(WOLFIP_ESP) && !defined(WOLFESP_SRC)
22
#define WOLFESP_SRC
3-
43
#include "wolfesp.h"
5-
static uint8_t esp_iv_len_from_enc(esp_enc_t enc);
6-
74
static WC_RNG wc_rng;
85
static volatile int rng_inited = 0;
96
/* security association static pool*/
@@ -152,20 +149,58 @@ int wolfIP_esp_sa_new_cbc_sha256(int in, uint8_t * spi, ip4 src, ip4 dst,
152149
return err;
153150
}
154151

155-
#ifdef WOLFIP_DEBUG_ESP
156-
static void
157-
esp_dump_data(const char * what, const uint8_t * data, size_t data_len)
152+
static uint8_t
153+
esp_block_len_from_enc(esp_enc_t enc)
158154
{
159-
printf("info: %s: 0x", what);
155+
uint8_t block_len = 0;
160156

161-
for (size_t i = 0; i < data_len; ++i) {
162-
printf("%02x", data[i]);
157+
switch (enc) {
158+
case ESP_ENC_NONE:
159+
block_len = 0;
160+
break;
161+
case ESP_ENC_CBC_AES:
162+
block_len = AES_BLOCK_SIZE;
163+
break;
164+
#ifndef NO_DES3
165+
case ESP_ENC_CBC_DES3:
166+
block_len = DES_BLOCK_SIZE;
167+
break;
168+
#endif /* !NO_DES3 */
169+
case ESP_ENC_GCM_RFC4106:
170+
case ESP_ENC_GCM_RFC4543:
171+
default:
172+
block_len = 0;
173+
break;
163174
}
164175

165-
printf("\n");
166-
return;
176+
return block_len;
167177
}
168178

179+
static uint8_t
180+
esp_iv_len_from_enc(esp_enc_t enc)
181+
{
182+
uint8_t iv_len = 0;
183+
184+
switch (enc) {
185+
case ESP_ENC_CBC_AES:
186+
iv_len = ESP_CBC_RFC3602_IV_LEN;
187+
break;
188+
189+
case ESP_ENC_GCM_RFC4106:
190+
case ESP_ENC_GCM_RFC4543:
191+
iv_len = ESP_GCM_RFC4106_IV_LEN;
192+
break;
193+
194+
case ESP_ENC_NONE:
195+
default:
196+
iv_len = 0;
197+
break;
198+
}
199+
200+
return iv_len;
201+
}
202+
203+
#ifdef WOLFIP_DEBUG_ESP
169204
#define esp_print_sep \
170205
printf("+------------------+\n")
171206
#define esp_str_4hex \
@@ -205,7 +240,7 @@ esp_print_field(const char * fld, const uint8_t * val,
205240
* |<---- encrypted ----->|
206241
* |<--- integrity checked ---->|
207242
* */
208-
static void wolfIP_print_esp(const struct wolfIP_esp_sa * esp_sa,
243+
static void wolfIP_print_esp(const wolfIP_esp_sa * esp_sa,
209244
const uint8_t * esp_data, uint32_t esp_len,
210245
uint8_t pad_len, uint8_t nxt_hdr)
211246
{
@@ -273,63 +308,12 @@ static void wolfIP_print_esp(const struct wolfIP_esp_sa * esp_sa,
273308
}
274309
#endif /* WOLFIP_DEBUG_ESP */
275310

276-
static uint8_t
277-
esp_block_len_from_enc(esp_enc_t enc)
278-
{
279-
uint8_t block_len = 0;
280-
281-
switch (enc) {
282-
case ESP_ENC_NONE:
283-
block_len = 0;
284-
break;
285-
case ESP_ENC_CBC_AES:
286-
block_len = AES_BLOCK_SIZE;
287-
break;
288-
#ifndef NO_DES3
289-
case ESP_ENC_CBC_DES3:
290-
block_len = DES_BLOCK_SIZE;
291-
break;
292-
#endif /* !NO_DES3 */
293-
case ESP_ENC_GCM_RFC4106:
294-
case ESP_ENC_GCM_RFC4543:
295-
default:
296-
block_len = 0;
297-
break;
298-
}
299-
300-
return block_len;
301-
}
302-
303-
static uint8_t
304-
esp_iv_len_from_enc(esp_enc_t enc)
305-
{
306-
uint8_t iv_len = 0;
307-
308-
switch (enc) {
309-
case ESP_ENC_CBC_AES:
310-
iv_len = ESP_CBC_RFC3602_IV_LEN;
311-
break;
312-
313-
case ESP_ENC_GCM_RFC4106:
314-
case ESP_ENC_GCM_RFC4543:
315-
iv_len = ESP_GCM_RFC4106_IV_LEN;
316-
break;
317-
318-
case ESP_ENC_NONE:
319-
default:
320-
iv_len = 0;
321-
break;
322-
}
323-
324-
return iv_len;
325-
}
326-
327311
/*
328312
* esp_data covers from start of ESP header to end of ESP trailer, but does not
329313
* include the ESP ICV after trailer.
330314
* */
331315
static int
332-
esp_calc_icv_hmac(uint8_t * hash, const struct wolfIP_esp_sa * esp_sa,
316+
esp_calc_icv_hmac(uint8_t * hash, const wolfIP_esp_sa * esp_sa,
333317
const uint8_t * esp_data, uint32_t esp_len)
334318
{
335319
/* SHA1 and MD5 have these digest sizes:
@@ -435,7 +419,7 @@ esp_const_memcmp(const uint8_t * vec_a, const uint8_t * vec_b, uint32_t len)
435419
(data) + ESP_SPI_LEN + ESP_SEQ_LEN + (iv_len)
436420

437421
static int
438-
esp_aes_rfc3602_dec(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
422+
esp_aes_rfc3602_dec(const wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
439423
uint32_t esp_len)
440424
{
441425
Aes cbc_dec;
@@ -489,7 +473,7 @@ esp_aes_rfc3602_dec(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
489473
}
490474

491475
static int
492-
esp_aes_rfc3602_enc(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
476+
esp_aes_rfc3602_enc(const wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
493477
uint32_t esp_len)
494478
{
495479
Aes cbc_enc;
@@ -560,7 +544,7 @@ esp_aes_rfc3602_enc(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
560544
- ESP_GCM_RFC4106_SALT_LEN
561545

562546
static int
563-
esp_aes_rfc4106_dec(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
547+
esp_aes_rfc4106_dec(const wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
564548
uint32_t esp_len)
565549
{
566550
Aes gcm_dec;
@@ -637,7 +621,7 @@ esp_aes_rfc4106_dec(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
637621
}
638622

639623
static int
640-
esp_aes_rfc4106_enc(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
624+
esp_aes_rfc4106_enc(const wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
641625
uint32_t esp_len)
642626
{
643627
Aes gcm_enc;
@@ -739,7 +723,7 @@ esp_aes_rfc4106_enc(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
739723
* include the ESP ICV after trailer.
740724
* */
741725
static int
742-
esp_check_icv_hmac(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
726+
esp_check_icv_hmac(const wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
743727
uint32_t esp_len)
744728
{
745729
/* SHA and MD5 have these digest sizes:
@@ -760,12 +744,6 @@ esp_check_icv_hmac(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
760744

761745
/* compare the first N bits depending on truncation type. */
762746
rc = esp_const_memcmp(icv, hash, esp_sa->icv_len);
763-
if (rc) {
764-
#ifdef WOLFIP_DEBUG_ESP
765-
esp_dump_data("icv not matched", hash, esp_sa->icv_len);
766-
#endif /* WOLFIP_DEBUG_ESP */
767-
}
768-
769747
return rc;
770748
}
771749

@@ -869,14 +847,14 @@ static int
869847
esp_transport_unwrap(struct wolfIP *s, struct wolfIP_ip_packet *ip,
870848
uint32_t * frame_len)
871849
{
872-
uint8_t spi[ESP_SPI_LEN];
873-
uint32_t seq = 0;
874-
struct wolfIP_esp_sa * esp_sa = NULL;
875-
uint32_t esp_len = 0;
876-
uint8_t pad_len = 0;
877-
uint8_t nxt_hdr = 0;
878-
uint8_t iv_len = 0;
879-
int err = 0;
850+
uint8_t spi[ESP_SPI_LEN];
851+
uint32_t seq = 0;
852+
wolfIP_esp_sa * esp_sa = NULL;
853+
uint32_t esp_len = 0;
854+
uint8_t pad_len = 0;
855+
uint8_t nxt_hdr = 0;
856+
uint8_t iv_len = 0;
857+
int err = 0;
880858

881859
memset(spi, 0, sizeof(spi));
882860

@@ -904,12 +882,6 @@ esp_transport_unwrap(struct wolfIP *s, struct wolfIP_ip_packet *ip,
904882
seq = ee32(seq);
905883

906884
for (size_t i = 0; i < in_sa_num; ++i) {
907-
#ifdef WOLFIP_DEBUG_ESP
908-
printf("info: sa: 0x%02x%02x%02x%02x\n",
909-
in_sa_list[i].spi[0], in_sa_list[i].spi[1],
910-
in_sa_list[i].spi[2], in_sa_list[i].spi[3]);
911-
#endif /* WOLFIP_DEBUG_ESP */
912-
913885
if (memcmp(spi, in_sa_list[i].spi, sizeof(spi)) == 0) {
914886
#ifdef WOLFIP_DEBUG_ESP
915887
printf("info: found sa: 0x%02x%02x%02x%02x\n",
@@ -921,8 +893,7 @@ esp_transport_unwrap(struct wolfIP *s, struct wolfIP_ip_packet *ip,
921893
}
922894

923895
if (esp_sa == NULL) {
924-
/**
925-
* RFC4303:
896+
/* RFC4303:
926897
* If no valid Security Association exists for this packet, the
927898
* receiver MUST discard the packet; this is an auditable event.
928899
* */
@@ -976,10 +947,9 @@ esp_transport_unwrap(struct wolfIP *s, struct wolfIP_ip_packet *ip,
976947
}
977948
}
978949

950+
/* icv check good, now finish unwrapping esp packet. */
979951
if (iv_len != 0) {
980952
/* Decrypt the payload in place. */
981-
int err = -1;
982-
983953
switch(esp_sa->enc) {
984954
case ESP_ENC_CBC_AES:
985955
err = esp_aes_rfc3602_dec(esp_sa, ip->data, esp_len);
@@ -1001,12 +971,10 @@ esp_transport_unwrap(struct wolfIP *s, struct wolfIP_ip_packet *ip,
1001971
err);
1002972
return -1;
1003973
}
1004-
1005-
/* Payload is now decrypted. We can now parse
1006-
* the ESP trailer for next header and padding. */
1007974
}
1008975

1009-
/* icv check good, now finish unwrapping esp packet. */
976+
/* Payload is now decrypted. We can now parse
977+
* the ESP trailer for next header and padding. */
1010978
pad_len = *(ip->data + esp_len - esp_sa->icv_len - ESP_NEXT_HEADER_LEN
1011979
- ESP_PADDING_LEN);
1012980
nxt_hdr = *(ip->data + esp_len - esp_sa->icv_len - ESP_NEXT_HEADER_LEN);
@@ -1059,7 +1027,7 @@ esp_transport_unwrap(struct wolfIP *s, struct wolfIP_ip_packet *ip,
10591027
*
10601028
* Returns 0 on success.
10611029
* Returns -1 on error.
1062-
* Returns 1 if no ipsec policy not found (send plaintext)
1030+
* Returns 1 if no ipsec policy found (send plaintext)
10631031
* */
10641032
static int
10651033
esp_transport_wrap(struct wolfIP_ip_packet *ip, uint16_t * ip_len)
@@ -1101,7 +1069,6 @@ esp_transport_wrap(struct wolfIP_ip_packet *ip, uint16_t * ip_len)
11011069
}
11021070

11031071
iv_len = esp_iv_len_from_enc(esp_sa->enc);
1104-
11051072
/* move ip payload back to make room for ESP header (SPI, SEQ) + IV. */
11061073
memmove(ip->data + ESP_SPI_LEN + ESP_SEQ_LEN + iv_len,
11071074
ip->data, orig_payload_len);
@@ -1156,6 +1123,7 @@ esp_transport_wrap(struct wolfIP_ip_packet *ip, uint16_t * ip_len)
11561123
payload += orig_payload_len;
11571124

11581125
if (pad_len) {
1126+
/* rfc4303: monotonic increasing sequence for padding. */
11591127
uint8_t i = 0;
11601128
for (i = 0; i < pad_len; ++i) {
11611129
payload[i] = (i + 1);
@@ -1202,7 +1170,6 @@ esp_transport_wrap(struct wolfIP_ip_packet *ip, uint16_t * ip_len)
12021170
err);
12031171
return -1;
12041172
}
1205-
12061173
/* Payload is now encrypted. Now calculate ICV. */
12071174
}
12081175

‎src/wolfip.c‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3753,8 +3753,7 @@ static inline void ip_recv(struct wolfIP *s, unsigned int if_idx,
37533753
* ip forwarding would require esp tunnel mode. */
37543754
if (ip->proto == 0x32) {
37553755
/* proto is ESP 0x32 (50), try to unwrap. */
3756-
int err = 0;
3757-
err = esp_transport_unwrap(s, ip, &len);
3756+
int err = esp_transport_unwrap(s, ip, &len);
37583757
if (err) {
37593758
printf("info: failed to unwrap esp packet, dropping.\n");
37603759
return;
@@ -4324,8 +4323,7 @@ int wolfIP_poll(struct wolfIP *s, uint64_t now)
43244323
}
43254324
}
43264325

4327-
4328-
/**
4326+
/*
43294327
* UDP
43304328
* */
43314329
for (i = 0; i < MAX_UDPSOCKETS; i++) {

0 commit comments

Comments
 (0)